Dynamically discovering likely program invariants to support program evolution

Abstract

Explicitly stated program invariants can help programmers by identifying program properties that must be preserved when modifying code. In practice, however, these invariants are usually implicit.An alternative to expecting programmers to fully annotate code with invariants is to automatically infer invariants from the program itself. This research focuses on dynamic techniques for discovering invariants from execution traces. This paper reports two results. First, it describes techniques for dynamically discovering invariants, along with an instrumenter and an inference engine that embody these techniques. Second, it reports on the application of the engine to two sets of target programs. In programs from Gries's work on program derivation, we rediscovered predefined invariants. In a C program lacking explicit invariants, we discovered invariants that assisted a software evolution task.

Dependent Types for Program Understanding

“…Various approaches based on analysis techniques other than static type inference, e.g., concept analysis, dynamic analysis, and structural heuristics, have been proposed for the purpose of extracting logical data models (or aspects of logical data models) from existing code [1,2,4,9]. Previous work in this area has not, to the best of our knowledge, addressed extraction of type abstractions analogous to our guarded types (in particular, extraction of union/tag information).…”

Integrating Tools for Automatic Program Verification

“…It starts with a large standard set of likely program invariants [2]. By executing test suites it deletes those invariants from the set that are falsified during the program run, leaving a set of possibly valid specifications.…”

“…In this paper we describe our findings after integrating several tools based upon the Java Modeling Language (JML) [1], a specification language used to annotate Java programs. The tools we consider are Daikon [2], ESC/Java [3], JML runtime assertion checker [1], and Loop/PVS tool [4]. The first one generates specifications; the others are used to verify them.…”

Takuan: A Tool for WS-BPEL Composition Testing Using Dynamic Invariant Generation

“…Automatic dynamic invariant generation [2] has proved to be a successful technique to assist in white-box testing of programs written in imperative languages. Let us note that, throughout this work, the term dynamic invariant (or likely invariant) is considered, as in most related works, in its broadest sense: a property that a program holds for a specified test suite.…”

“…There are different ways to use dynamically generated invariants to help program testing [2]. We will focus on two of them, as shown in figure 1: debugging a program and improving a test suite.…”