18,286 research outputs found
Path-Based Program Repair
We propose a path-based approach to program repair for imperative programs.
Our repair framework takes as input a faulty program, a logic specification
that is refuted, and a hint where the fault may be located. An iterative
abstraction refinement loop is then used to repair the program: in each
iteration, the faulty program part is re-synthesized considering a symbolic
counterexample, where the control-flow is kept concrete but the data-flow is
symbolic. The appeal of the idea is two-fold: 1) the approach lazily considers
candidate repairs and 2) the repairs are directly derived from the logic
specification. In contrast to prior work, our approach is complete for programs
with finitely many control-flow paths, i.e., the program is repaired if and
only if it can be repaired at the specified fault location. Initial results for
small programs indicate that the approach is useful for debugging programs in
practice.Comment: In Proceedings FESCA 2015, arXiv:1503.0437
Learning a Static Analyzer from Data
To be practically useful, modern static analyzers must precisely model the
effect of both, statements in the programming language as well as frameworks
used by the program under analysis. While important, manually addressing these
challenges is difficult for at least two reasons: (i) the effects on the
overall analysis can be non-trivial, and (ii) as the size and complexity of
modern libraries increase, so is the number of cases the analysis must handle.
In this paper we present a new, automated approach for creating static
analyzers: instead of manually providing the various inference rules of the
analyzer, the key idea is to learn these rules from a dataset of programs. Our
method consists of two ingredients: (i) a synthesis algorithm capable of
learning a candidate analyzer from a given dataset, and (ii) a counter-example
guided learning procedure which generates new programs beyond those in the
initial dataset, critical for discovering corner cases and ensuring the learned
analysis generalizes to unseen programs.
We implemented and instantiated our approach to the task of learning
JavaScript static analysis rules for a subset of points-to analysis and for
allocation sites analysis. These are challenging yet important problems that
have received significant research attention. We show that our approach is
effective: our system automatically discovered practical and useful inference
rules for many cases that are tricky to manually identify and are missed by
state-of-the-art, manually tuned analyzers
Instruction-Level Abstraction (ILA): A Uniform Specification for System-on-Chip (SoC) Verification
Modern Systems-on-Chip (SoC) designs are increasingly heterogeneous and
contain specialized semi-programmable accelerators in addition to programmable
processors. In contrast to the pre-accelerator era, when the ISA played an
important role in verification by enabling a clean separation of concerns
between software and hardware, verification of these "accelerator-rich" SoCs
presents new challenges. From the perspective of hardware designers, there is a
lack of a common framework for the formal functional specification of
accelerator behavior. From the perspective of software developers, there exists
no unified framework for reasoning about software/hardware interactions of
programs that interact with accelerators. This paper addresses these challenges
by providing a formal specification and high-level abstraction for accelerator
functional behavior. It formalizes the concept of an Instruction Level
Abstraction (ILA), developed informally in our previous work, and shows its
application in modeling and verification of accelerators. This formal ILA
extends the familiar notion of instructions to accelerators and provides a
uniform, modular, and hierarchical abstraction for modeling software-visible
behavior of both accelerators and programmable processors. We demonstrate the
applicability of the ILA through several case studies of accelerators (for
image processing, machine learning, and cryptography), and a general-purpose
processor (RISC-V). We show how the ILA model facilitates equivalence checking
between two ILAs, and between an ILA and its hardware finite-state machine
(FSM) implementation. Further, this equivalence checking supports accelerator
upgrades using the notion of ILA compatibility, similar to processor upgrades
using ISA compatibility.Comment: 24 pages, 3 figures, 3 table
Sciduction: Combining Induction, Deduction, and Structure for Verification and Synthesis
Even with impressive advances in automated formal methods, certain problems
in system verification and synthesis remain challenging. Examples include the
verification of quantitative properties of software involving constraints on
timing and energy consumption, and the automatic synthesis of systems from
specifications. The major challenges include environment modeling,
incompleteness in specifications, and the complexity of underlying decision
problems.
This position paper proposes sciduction, an approach to tackle these
challenges by integrating inductive inference, deductive reasoning, and
structure hypotheses. Deductive reasoning, which leads from general rules or
concepts to conclusions about specific problem instances, includes techniques
such as logical inference and constraint solving. Inductive inference, which
generalizes from specific instances to yield a concept, includes algorithmic
learning from examples. Structure hypotheses are used to define the class of
artifacts, such as invariants or program fragments, generated during
verification or synthesis. Sciduction constrains inductive and deductive
reasoning using structure hypotheses, and actively combines inductive and
deductive reasoning: for instance, deductive techniques generate examples for
learning, and inductive reasoning is used to guide the deductive engines.
We illustrate this approach with three applications: (i) timing analysis of
software; (ii) synthesis of loop-free programs, and (iii) controller synthesis
for hybrid systems. Some future applications are also discussed
Skolem Functions for Factored Formulas
Given a propositional formula F(x,y), a Skolem function for x is a function
\Psi(y), such that substituting \Psi(y) for x in F gives a formula semantically
equivalent to \exists F. Automatically generating Skolem functions is of
significant interest in several applications including certified QBF solving,
finding strategies of players in games, synthesising circuits and bit-vector
programs from specifications, disjunctive decomposition of sequential circuits
etc. In many such applications, F is given as a conjunction of factors, each of
which depends on a small subset of variables. Existing algorithms for Skolem
function generation ignore any such factored form and treat F as a monolithic
function. This presents scalability hurdles in medium to large problem
instances. In this paper, we argue that exploiting the factored form of F can
give significant performance improvements in practice when computing Skolem
functions. We present a new CEGAR style algorithm for generating Skolem
functions from factored propositional formulas. In contrast to earlier work,
our algorithm neither requires a proof of QBF satisfiability nor uses
composition of monolithic conjunctions of factors. We show experimentally that
our algorithm generates smaller Skolem functions and outperforms
state-of-the-art approaches on several large benchmarks.Comment: Full version of FMCAD 2015 conference publicatio
Temporal Stream Logic: Synthesis beyond the Bools
Reactive systems that operate in environments with complex data, such as
mobile apps or embedded controllers with many sensors, are difficult to
synthesize. Synthesis tools usually fail for such systems because the state
space resulting from the discretization of the data is too large. We introduce
TSL, a new temporal logic that separates control and data. We provide a
CEGAR-based synthesis approach for the construction of implementations that are
guaranteed to satisfy a TSL specification for all possible instantiations of
the data processing functions. TSL provides an attractive trade-off for
synthesis. On the one hand, synthesis from TSL, unlike synthesis from standard
temporal logics, is undecidable in general. On the other hand, however,
synthesis from TSL is scalable, because it is independent of the complexity of
the handled data. Among other benchmarks, we have successfully synthesized a
music player Android app and a controller for an autonomous vehicle in the Open
Race Car Simulator (TORCS.
- …