References: Thomas A. Henzinger (1996): The theory of hybrid automata In: Annual IEEE Symposium on Logic in Computer Science

Transcription

1 Hybrid Systems Modeling In today's fast evolving technologies where the line between analog and digital systems is getting blurred, systems consist of a mix of continuous and discrete components. A discrete component jumps abruptly from a state to another while continuous systems change states in a progressive continuous manner. In order be able to formally reason about such hybrid systems, for the purpose of verification for instance, a formal model is needed. The student in this seminar is required to survey few models for hybrid systems, summarize them and discuss their benefits and drawbacks. Thomas A. Henzinger (1996): The theory of hybrid automata In: Annual IEEE Symposium on Logic in Computer Science

2 Partial-Order Reduction techniques In the realm of formal verification of complex distributed systems, Model checking has been shown to be a promising technique to prove the correctness of systems. Given a concurrent program, an input and a specification, a model checker systematically explores every reachable execution and verifies the correctness of the system. The process can be modeled as an exploration of a state graph. Due to the concurrency of the considered systems, their state graph model is exponential in size (i.e., state explosion problem). With respect to the specifications, the exploration of some executions can be redundant. Different techniques exist to identify such executions and avoid their exploration. A significant class of such techniques are referred to as partial-order reduction (POR) techniques. In this seminar, the student is required to survey and classify existing POR approaches considering their cons and pros. Parosh Abdulla, Stavros Aronis, Bengt Jonsson, and Konstantinos Sagonas (2014): Optimal dynamic partial order reduction In: ACM SIGPLAN Notices 49, no. 1 Kahlon, Vineet, Chao Wang, and Aarti Gupta (2009): Monotonic partial order reduction: An optimal symbolic partial order reduction technique. In: Proc. of Computer Aided Verification

3 Program Slicing with Model Checking Program slicing is a well-established technique that can be used for a wide range of purposes such as debugging or software partitioning. Given a so called slicing criterion, a program slicer computes a portion of the code which is relevant to the criterion. There exist many techniques to achieve this goal with different degrees of precision and efficiency. One of the goals that can be achieved using this technique is reducing the code size for model checking by filtering out code which is irrelevant to the specification under consideration. In this seminar, the student is required to survey existing model checking approaches that make use of program slicing in any form to improve on the performance and discuss their advantages and disadvantages. Mark Weiser (1981): Program slicing In: Proc. the International Conference on Software Engineering Ranjit Jhala and Rupak Majumdar (2005): Path Slicing In: ACM SIGPLAN Notices. Vol. 40. No. 6

4 SAT Solvers SAT solvers are extensively used in the verification of software (e.g. symbolic execution, theorem proving based verification). A recent work showed promising results advocating the possible use of optimization techniques to address the scalability problems SAT solvers suffer from. In this seminar report, you are required to thoroughly read an advanced paper, summarize it and discuss its content. C.-S. Han, et al., "When boolean satisfiability meets gaussian elimination in a simplex way," Proc. of the 24th International Conference on Computer Aided Verification, 2012.

5 Test input generation of high coverage via Symbolic Execution Symbolic execution has garnered a lot of attention in recent years as an effective technique for generating high-coverage test suites. However, for many complex programs it is still a challenging problem to generate test suites of high coverage. Generation of test suites of high coverage has been widely studied. In this seminar the student should explore current scientific methods on test input generation of high coverage using symbolic execution and summarize the state of the art discussing the pros and cons. Cristian Cadar, Vijay Ganesh, Peter M. Pawlowski, David L. Dill, Dawson R. Engler EXE: Automatically Generating Inputs of Death. In: ACM Transactions on Information and System Security (TISSEC),12(2), 10. Cristian Cadar, Daniel Dunbar, Dawson Engler. KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs. In: OSDI (Vol. 8, pp ).

6 Test input generation for Database Programs Database programs are one of the most widely used software applications where automated support for testing and verification is indispensable. Symbolic execution has become a promising technique to ensure software quality. However, the effectiveness of many existing symbolic execution engines on database programs is hindered by the frequent usage of declarative languages such as SQL whose operational semantics are ignored. In this task the student should explore current scientific methods on test input generation for database programs using symbolic execution techniques and summarize the state of the art discussing their pros and cons. M. Emmi, R. Majumdar, and K. Sen. Dynamic Test Input Generation for Database Applications. In: ISSTA, pages , K. Pan, X. Wu, and T. Xie. Database state generation via dynamic symbolic execution for coverage criteria. In: DBTest, pages 01-06, K. Pan, X. Wu, and T. Xie. Guided Test Generation for Database Applications via Synthesized Database Interactions. In: ACM Trans. Softw. Eng. Methodol, 23(2):12:1 12:27, 2014.