Program Statements Research Articles

Verification and code generation for invariant diagrams in Isabelle

Invariant-based programming is a correct-by-construction programming methodology in which programs are expressed as graphs of situations connected by transitions. Such graphs are called invariant diagrams. The situations correspond to the pre- and postconditions and loop invariants of the program, while the transitions correspond to the program statements. The situations are developed before the transitions, and each transition is verified at the time it is added to the diagram. The correctness conditions for the transitions are derived using Hoare-like rules. In this paper, we present an embedding of invariant diagrams in the higher-order logic framework Isabelle/HOL for both proving the verification conditions in the Isabelle proof assistant, as well as generating code that is operationally consistent with the verification semantics by constructing a proof that the generated code is correct with respect to the situations of the invariant diagram. We describe a mechanic translation of the transitions of an invariant diagram into a collection of mutually recursive functions and an associated correctness theorem stating that the value computed by the functions satisfies the final situation. We show that the proofs of the correctness theorem and the well-foundedness of the recursive functions can be built mechanically. The verification conditions are lemmas in the proofs. The collection of recursive functions is a refinement of the original invariant diagram, and is in a form that can be directly converted to executable code by Isabelle. This allows proof-producing compilation of invariant diagrams into any of the languages supported by Isabelle code generator. We illustrate our approach with a case study, and show that full proof automation can be achieved. This work is a step towards verified compilation of invariant diagrams.

Revisiting loop fusion in the polyhedral framework

Loop fusion is an important compiler optimization for improving memory hierarchy performance through enabling data reuse. Traditional compilers have approached loop fusion in a manner decoupled from other high-level loop optimizations, missing several interesting solutions. Recently, the polyhedral compiler framework with its ability to compose complex transformations, has proved to be promising in performing loop optimizations for small programs. However, our experiments with large programs using state-of-the-art polyhedral compiler frameworks reveal suboptimal fusion partitions in the transformed code. We trace the reason for this to be lack of an effective cost model to choose a good fusion partitioning among the possible choices, which increase exponentially with the number of program statements. In this paper, we propose a fusion algorithm to choose good fusion partitions with two objective functions - achieving good data reuse and preserving parallelism inherent in the source code. These objectives, although targeted by previous work in traditional compilers, pose new challenges within the polyhedral compiler framework and have thus not been addressed. In our algorithm, we propose several heuristics that work effectively within the polyhedral compiler framework and allow us to achieve the proposed objectives. Experimental results show that our fusion algorithm achieves performance comparable to the existing polyhedral compilers for small kernel programs, and significantly outperforms them for large benchmark programs such as those in the SPEC benchmark suite.

Experimental Design and Analysis with Emphasis on Communicating What Has Been Done: I. A Comparison of Statistical Models Using General Linear Model Procedure of SAS

Statistical analyses are important methods for interpreting results of agricultural experiments for scientific writing, which should clearly communicate the particulars of the research being described in a way that it can be precisely repeated. Probabilities (p-values) are often described in articles in journals to compare treatment means to each other and to compare regression coefficients to zero. Most published data are subjected to ANOVA (analysis of variance) or regression models using the GLM (general linear models) procedure of the SAS program (SAS Institute, 2006). The object is to determine the significance levels that means are different. Different statistical models and programming statements may lead to quite different conclusions. Illustrative data from an experiment with two independent variables (X1 and X2) and one dependent variable (Y) were analyzed. There were 6 levels of X1 and 2 levels of X2. Several ANOVA and regression models are reported here with or without “class” statements in SAS. The ANOVA model requires a Class statement be included for each independent variable to signify classification variables. With the Class statement, SAS computes the Sums of Squares (SS) with n-1 degrees of freedom where n is the number of levels of each independent variable. However, without the Class statement, SAS computes the SS with only 1 degree of freedom, as in a regression model. By using either a one-way ANOVA with Duncan’s New Multiple Range Test or a two-way ANOVA, no differences between treatments were detected. When using a linear regression model, X2 and the X1 × X2 interaction term had significant p-values (0.025 and 0.014, respectively). When using a second order polynomial regression model, only X2 had a significant pvalue (0.036). When an ANOVA with components including linear and quadratic terms was computed, the interaction term between X2 and (linear X1) had a significant p-value (0.023). The choice of an appropriate statistical model is important because conclusions from the subsequent analyses depend on the particular model used.

Tutorial: Survival Estimation for Cox Regression Models with Time-Varying Coefficients UsingSASandR

Survival estimates are an essential compliment to multivariable regression models for time-to-event data, both for prediction and illustration of covariate effects. They are easily obtained under the Cox proportional-hazards model. In populations defined by an initial, acute event, like myocardial infarction, or in studies with long-term followup, the proportional-hazards assumption of constant hazard ratios is frequently violated. One alternative is to fit an interaction between covariates and a prespecified function of time, implemented as a time-dependent covariate. This effectively creates a time-varying coefficient that is easily estimated in software such as SAS and R. However, the usual programming statements for survival estimation are not directly applicable. Unique data manipulation and syntax is required, but is not well documented for either software. This paper offers a tutorial in survival estimation for the time-varying coefficient model, implemented in SAS and R. We provide a macro coxtvc to facilitate estimation in SAS where the current functionality is more limited. The macro is validated in simulated data and illustrated in an application.

QP test: a dependence test for quadratic array subscripts

Traditional dependence tests detect dependences with linear array subscripts, but only give passive results to those with non-linear expressions. It may result in a multitude of pseudo-dependences. To maximise the parallelism of applications and improve an optimising compiler's ability of detecting dependences between program statements, it is necessary to develop a non-linear dependence test to eliminate these pseudo-dependences. This study presents a new non-linear dependence test by analysing the optimal solution of the quadratic subscripts with the index bounds constraints. The authors prove that the non-linear dependences caused by subscripts, which can be written in the form of quadratic programming model, are able to be detected, and introduce a non-linear dependence testing algorithm based on quadratic programming. The effectiveness of this algorithm is verified. The authors developed a prototype implementation of the test with the Open64 compiler and evaluated it using some real world applications from Perfect Club benchmarks and Spec2006 benchmark suites. The experimental results indicate that, compared to existing testing methods, the quadratic programming (QP) test is more efficient for quadratic cases.

A theoretical analysis of the risk evaluation formulas for spectrum-based fault localization

An important research area of Spectrum-Based Fault Localization (SBFL) is the effectiveness of risk evaluation formulas. Most previous studies have adopted an empirical approach, which can hardly be considered as sufficiently comprehensive because of the huge number of combinations of various factors in SBFL. Though some studies aimed at overcoming the limitations of the empirical approach, none of them has provided a completely satisfactory solution. Therefore, we provide a theoretical investigation on the effectiveness of risk evaluation formulas. We define two types of relations between formulas, namely, equivalent and better. To identify the relations between formulas, we develop an innovative framework for the theoretical investigation. Our framework is based on the concept that the determinant for the effectiveness of a formula is the number of statements with risk values higher than the risk value of the faulty statement. We group all program statements into three disjoint sets with risk values higher than, equal to, and lower than the risk value of the faulty statement, respectively. For different formulas, the sizes of their sets are compared using the notion of subset. We use this framework to identify the maximal formulas which should be the only formulas to be used in SBFL.

Metallaxis‐FL: mutation‐based fault localization

SummaryFault localization methods seek to identify faulty program statements based on the information provided by the failing and passing test executions. Spectrum‐based methods are among the most popular ones and assist programmers by assigning suspiciousness values on program statements according to their probability of being faulty. This paper proposes Metallaxis, a fault localization approach based on mutation analysis. The innovative part of Metallaxis is that it uses mutants and links them with the faulty program places. Thus, mutants that are killed mostly by failing tests provide a good indication about the location of a fault. Experimentation using Metallaxis suggests that it is significantly more effective than statement‐based approaches. This is true even in the case where mutation cost‐reduction techniques, such as mutant sampling, are facilitated. Additionally, results from a controlled experiment show that the use of mutation as a testing technique provides benefits to the fault localization process. Therefore, fault localization is significantly improved by using mutation‐based tests instead of block‐based or branch‐based test suites. Finally, evidence in support of the methods’ scalability is also given. Copyright © 2013 John Wiley & Sons, Ltd.

Platform Independent Analysis of Probabilities on Multithreaded Programs

A concurrent program is intuitively associated with probability: the executions of the program can produce nondeterministic execution program paths due to the interleavings of threads, whereas some paths can always be executed more frequently than the others. An exploration of the probabilities on the execution paths is expected to provide engineers or compilers with support in helping, either at coding phase or at compile time, to optimize some hottest paths. However, it is not easy to take a static analysis of the probabilities on a concurrent program in that the scheduling of threads of a concurrent program usually depends on the operating system and hardware (e.g., processor) on which the program is executed, which may be vary from machine to machine. In this paper the authors propose a platform independent approach, called ProbPP, to analyzing probabilities on the execution paths of the multithreaded programs. The main idea of ProbPP is to calculate the probabilities on the basis of two kinds of probabilities: Primitive Dependent Probabilities (PDPs) representing the control dependent probabilities among the program statements and Thread Execution Probabilities (TEPs) representing the probabilities of threads being scheduled to execute. The authors have also conducted two preliminary experiments to evaluate the effectiveness and performance of ProbPP, and the experimental results show that ProbPP can provide engineers with acceptable accuracy.

Predicting SQL injection and cross site scripting vulnerabilities through mining input sanitization patterns

ContextSQL injection (SQLI) and cross site scripting (XSS) are the two most common and serious web application vulnerabilities for the past decade. To mitigate these two security threats, many vulnerability detection approaches based on static and dynamic taint analysis techniques have been proposed. Alternatively, there are also vulnerability prediction approaches based on machine learning techniques, which showed that static code attributes such as code complexity measures are cheap and useful predictors. However, current prediction approaches target general vulnerabilities. And most of these approaches locate vulnerable code only at software component or file levels. Some approaches also involve process attributes that are often difficult to measure. ObjectiveThis paper aims to provide an alternative or complementary solution to existing taint analyzers by proposing static code attributes that can be used to predict specific program statements, rather than software components, which are likely to be vulnerable to SQLI or XSS. MethodFrom the observations of input sanitization code that are commonly implemented in web applications to avoid SQLI and XSS vulnerabilities, in this paper, we propose a set of static code attributes that characterize such code patterns. We then build vulnerability prediction models from the historical information that reflect proposed static attributes and known vulnerability data to predict SQLI and XSS vulnerabilities. ResultsWe developed a prototype tool called PhpMinerI for data collection and used it to evaluate our models on eight open source web applications. Our best model achieved an averaged result of 93% recall and 11% false alarm rate in predicting SQLI vulnerabilities, and 78% recall and 6% false alarm rate in predicting XSS vulnerabilities. ConclusionThe experiment results show that our proposed vulnerability predictors are useful and effective at predicting SQLI and XSS vulnerabilities.

Validating Second-Order Mutation at System Level

Mutation has been recognized to be an effective software testing technique. It is based on the insertion of artificial faults in the system under test (SUT) by means of a set of mutation operators. Different operators can mutate each program statement in several ways, which may produce a huge number of mutants. This leads to very high costs for test case execution and result analysis. Several works have approached techniques for cost reduction in mutation testing, like n-order mutation where each mutant contains n artificial faults instead of one. There are two approaches to n-order mutation: increasing the effectiveness of mutation by searching for good n-order mutants, and decreasing the costs of mutation testing by reducing the mutants set through the combination of the first-order mutants into n-order mutants. This paper is focused on the second approach. However, this second use entails a risk: the possibility of leaving undiscovered faults in the SUT, which may distort the perception of the test suite quality. This paper describes an empirical study of different combination strategies to compose second-order mutants at system level as well as a cost-risk analysis of n-order mutation at system level.

Coverage-directed observability-based validation for embedded software

Motivated by the need for validation methodologies for embedded systems we propose a method for embedded software testing that can be integrated with existing hardware methods. Existing coverage-directed validation methods guarantee the execution of a certain percentage of the program code under test. Yet they do not generally verify whether the statements executed have any influence on the program's output. In the proposed method, a program statement is considered covered not simply for belonging to the executed path, but only if its execution has influence in some observable output. The paths are generated by searching the longest path in terms of the number of statements in the path. Given that not all paths are valid, we check their feasibility using a method based on Mixed Integer Linear Programming (MILP). Variable aliasing is accounted for by representing variables by their memory addresses when building this MILP problem. In this manner, for feasible paths, we obtain immediately the input values that allow the execution of the path. Using these inputs, we determine the statements actually observed. We repeat this process until a user-specified level of coverage has been achieved. In the generation of each new path, the statement coverage obtained so far and the feasibility of previous paths is taken into account. We present results that demonstrate the effectiveness of this methodology.

A New Spectrum-based Fault Localization Method by Using Clustering Algorithm

Locating the errors or faults in the software debugging process is very expensive and time-consuming. Therefore, automated debugging has become popular due to its capability to reduce cost and increase the efficiency. Spectrum-based method is one of the most important automated fault localization methods in the Software debugging techniques. Most of the existing spectrum-based fault localization methods against some others, whereas the comparison of presented methods is not comprehensive due to the different test case set is utilized. This paper implemented the existing 28 methods to evaluate the spectrumbased fault localization methods in the same test case set. Furthermore, we proposed a new spectrumbased fault localization method, which utilize k-means algorithm, to obtain a suspicious ranking of program statements and capture the statement with accepted high suspiciousness, so as to improve the effectiveness of fault-localization. An experiment is designed and we apply the proposed method to our java plug-in project of spectrum-based fault localization. The experimental results show that this method can locate faults in the software effectively and has good performance.

The Selection of High-Power Shearer Output Shaft Bearing and the Roller Bearing Selecting Expert System

This paper is based on a coal winning machine cutting part simulation project cooperated with a mining machinery group. Because of coal winning machine actual working environment is very bad, the objects’ physical and mechanical properties are quite uncertain, coal winning machine output shaft bearing vulnerable to damage, so choose the right bearing is very important. In this paper, the output shaft bearings’ stress is calculated by Matlab and the concrete working condition is analysed, mainly to bearing life, as a supplement to clearance, precision, and price and so on, then the types of the output shaft is determined. In the Visual C6.0 integrated development environment, judge principles can be translated into the computer program statements and input them into the MFC software to create roller bearing selecting Expert System. Friendly interface realizes a direct and fast man-machine dialogue in Visual C6.0, and you can find the suitable bearing type quickly by inputing bearings’ basic parameters in the environment which under the control of the process of reasoning.

Computing and visualizing the impact of change with Java PathFinder extensions

Change impact analysis techniques estimate the potential effects of changes made to software. Directed Incremental Symbolic Execution (DiSE) is a Java PathFinder extension that computes the impact of changes on program execution behaviors. The results of DiSE are a set of impacted path conditions that can be efficiently processed by a subsequent client analysis. Path conditions, however, may not be intuitive for software developers without the context of the source code. In this paper we present a framework for visualizing the results of DiSE. The visualization includes annotated source code and control ow graphs indicating program statements that are changed and statements that may be impacted by the changes. A simulation mode enables users to also observe the impact of changes on symbolic execution of the program, by showing the changes to the path conditions as the user steps through the sequences of statements executed.

Formal Modeling and Verification of Security Property in Handel C Program

Multi-million gate system-on-chip (SoC) designs easily fit into today’s Field Programmable Gate Arrays (FPGAs). As FPGAs become more common in safety-critical and mission-critical systems, researchers and designers require information flow guarantees for the FPGAs. Tools for designing a secure system of chips (SOCs) using FPGAs and new techniques to manage and analyze the security properties precisely are desirable. In this work we propose a formal approach to model, analyze and verify a typical set of security properties – noninterference – of Handel C programs using Petri Nets and model checking. This paper presents a method to model Handel C programs using Predicate Transition Nets, a type of Petri Net, and define security properties on the model, plus a verification approach where security properties are checked. Three steps are used. First, a formal specification on the Handel C description using Petri Nets is extracted. Second, the dynamic noninterference properties with respect to the Handel C program statements are defined on the model. To assist in verification, a translation rule from the Petri Nets specification to the Maude programming language is also defined. Thus, the formal specification can be verified against the system properties using model checking. A case study of the pipeline multiplier is discussed to illustrate the concept and validate the approach.

Energy-aware GPU programming at source-code levels

To enhance the energy efficiency and performance of algorithms with Graphics Processing Unit (GPU) accelerators in source-code development, we consider the power efficiency based on data transfer bandwidth and power consumption in key situations. First, a set of primitives is abstracted from program statements. Then, data transfer bandwidth and power consumption in different granularity sizes are considered and mapped into proper primitives. With these mappings, a programmer can intuitively determine the power efficiency and performance in different running states of a thread. Finally, this intuition enables the programmer to tune the algorithm in order to achieve the best energy efficiency and performance. Using these power-aware principles, two Fast Fourier Transform (FFT) methods are compared. The mapping between power consumption and primitives is helpful for algorithm tuning in source-code levels.

Status and Awards

This issue has three interesting papers about test design. The first paper in this issue, Automated Functional Testing of Online Search Services, by Zhou, Zhang, Hagenbuchner, Tse, Kuo, and Chen, tests search engines. A major problem that is addressed is the ‘oracle function’, which for these applications means how can we know whether the search results are ‘correct’ (recommended by Byoungju Choi). The second, Automated Verification and Testing of User-interactive Undo Features in Database Applications, by Ngo and Tan, addresses the problem of testing the ability for users to undo operations. A correspondence between program statements that raise erroneous effects and program statements that can undo those effects is reported and is used to develop a verification technique (recommended by Shaoying Liu). The third, Testing Aspect-oriented Programs with Finite State Machines, by Xu, El-Ariss, Xu, and Wang, reports that aspect-oriented programs have new kinds of faults, which they call aspect faults. This observation is used to develop a test strategy to detect these kinds of faults (recommended by Sudipto Ghosh). The journal held its third editorial board meeting at the Fifth International Conference on Software Testing, Verification, and Reliability (ICST) in Montreal. It was a good meeting with our publishing editor from Wiley and about a dozen members of the board. This meeting is important to resolve issues, discuss strategic directions for the journal, and plan for future directions. Our most important decision was to institute two yearly awards for the journal. The first will be a Best Paper of the Year award. Accepted papers will be nominated by the Reviewing Editor who handles the paper, and then the winner will be chosen from among the nominees by votes of members of the editorial board. The second will be the paper with the Highest 5-year Impact. We will make a short list based on the number of references and then a discussion and vote from a subset of the editorial board. We expect to announce the first winners early in the next year.

Interference Verification for Structural Parallel Programs

This paper presents a simplified fractional type system for a toy imperative language with structured parallelism and synchronization. In this system, we make the permission as a kind of linear values associated with some piece of state in a program. Different permissions permit different operations and fractions are attached to permissions to distinguish reads from writes, with which we are able to check interference among parallel threads. The main purpose is to detect race conditions and deadlocks in a multithreaded program. Program expressions and statements are transformed into action traces, then we permission-check all possible interleavings among traces in parallel. Operational semantics as well as permission type rules are provided and a type soundness result is then established.

A model for spectra-based software diagnosis

This article presents an improved approach to assist diagnosis of failures in software (fault localisation) by ranking program statements or blocks in accordance with to how likely they are to be buggy. We present a very simple single-bug program to model the problem. By examining different possible execution paths through this model program over a number of test cases, the effectiveness of different proposed spectral ranking methods can be evaluated in idealised conditions. The results are remarkably consistent to those arrived at empirically using the Siemens test suite and Space benchmarks. The model also helps identify groups of metrics that are equivalent for ranking. Due to the simplicity of the model, an optimal ranking method can be devised. This new method out-performs previously proposed methods for the model program, the Siemens test suite and Space. It also helps provide insight into other ranking methods.

An empirical investigation into the design of auditory cues to enhance computer program comprehension

Decades of research have led to notable improvements in the representations used to aid human comprehension of computer programs. Much of this research has focused on visual representations, which leaves open the question of how best to design auditory representations of computer programs. While this question has particular relevance for visually impaired programmers, sighted programmers might also benefit from enhanced auditory representations of their programs. In order to investigate this question empirically, first, we introduce artifact encoding, a novel approach to rigorously measuring the comprehensibility of auditory representations of computer programs. Using this approach as a foundation, we present an experimental study that compared the comprehensibility of two alternative auditory program representations: one with lexical scoping cues that convey the nesting level of program statements, and another without such scoping cues. The results of our first experiment validate both artifact encoding and the scoping cues we used. To see whether auditory cues validated through our paradigm can aid program comprehension in a realistic task scenario, we experimentally compared programmers' ability to debug programs using three alternative environments: (1) an auditory execution environment with our empirically derived auditory cues; (2) an auditory execution environment with the current state-of-the-art auditory cues generated by a screen reader running on top of Microsoft Visual Studio; and (3) a visual version of the execution environment. The results of our second experiment showed that our comprehensible auditory cues are significantly better than the state-of-the-art, affording human performance approaching the effectiveness of visual representations within the statistical margin of error. This research contributes a novel methodology and foundational empirical data that can guide the design of effective auditory representations of computer programs.