Dynamic Program Analysis

Klaus HavelundKestrel Technology

NASA Ames Research Center

Motivation for writing specs: Instant gratification

Static and Dynamic Analysis

Program

Specification

Input Output

Test case generation Runtime verification

Program instrumentation

?

Property language power

Scalability

Coverage

Of course … it is not Ideal

Runtime Verification

Specification-based monitoring Algorithm-based monitoring

For test For fault protection

Pre/post conditions, invariants: Eiffel, JML, Java’s assert. Temporal logic: Temporal Rover, MAC Real-time properties: Timed Automata Quantified temporal logic: Sipma+Finkbeiner Statecharts: TLChart Process algebra: Jass Regular expressions: Rosu, MAC Wide spectrum: Spec#, VDM Embed in for example RWL: LTL in Maude (JPAX) Combining logics into one notation: MAC, TLChart,

Eagle

Specification-Based monitoring.Problem is to choose a specification language

Eagle

Three temporal connectives: •Next: @F

•Previous: #F

•Concatenation: F1;F2 Recursive parameterized rules over trace

Even(Term t) = t \/ @Even(t) . Ktimes(int k, Term t) = k>0 -> (t /\ # Ktimes(t-1,t)) .

@F#F now

Memory leaks: Purify.

Low level data races and deadlocks: Visual Threads, JProbe, JPAX.

High level data races: Stoller, Flanagan, JPAX.

Algorithm-Based monitoring.Problem is to classify errors

Program InstrumentationProblem is reducing overhead

Aspect Oriented Programming: AspectJ, AspectC, AspectC++, MOP

Object code/byte code instr.: Java: BCEL, Jtrek, jContractor, jMonitor Others: Valgrind

But Properties are Hard to Formulate

To quote quite excellent NASA software engineer when asked what properties hissystem would have to satisfy: “I have absolutely no! idea what

properties this system should satisfy”.

Specification Generation

Inferring invariants: DAIKON

Inferring temporal properties: Yang + Evans

Static and Dynamic Analysis

Static analysis can reduceinstrumentation overhead.

Dynamic analysis functions as fallback position for properties that cannot be proven statically.

Two Recently CreatedWorkshop Series

RVWorkshop On Runtime Verificationhttp://react.cs.uni-sb.de/rv2005

WODAWorkshop On Dynamic Analysishttp://www.csd.uwo.ca/woda2005