Data-driven Verification a Dissertation Submitted to the Department of Computer Science and the Committee on Graduate Studies of Stanford University in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy

ly, if L ≡ while B do S is a loop, then to check if I is a loop invariant, we need to establish the following conditions: 1. If φ is a precondition at the beginning of L, then φ⇒ I. 2. Furthermore, executing the loop body S with a state satisfying I ∧B, always results in a state satisfying the invariant I. The above checks for validating I are performed by an off-the-shelf decision procedure [43]. For our example, we first check whether the precondition at the beginning of the loop implies I: (x = 0 ∧ y = 0)⇒ (x = 0 ∧ y = 0 ∧ x = 0 ∧ y = 0 ∧ xy = 0) This condition is indeed valid, and therefore we check whether the following condition on the loop body (lines 4–5) also holds (we can obtain the predicate representing the loop body via symbolic execution [86]): (x = 0 ∧ y = 0 ∧ x = 0 ∧ y = 0 ∧ xy = 0 ∧ y′ = y + 1 ∧ x′ = x+ y′)⇒ (x′ = 0 ∧ y′ = 0 ∧ x′2 = 0 ∧ y′2 = 0 ∧ x′y′ = 0) This predicate is not valid, and we obtain a counterexample x′ = 1, y′ = 1 at line 3 of the program. Let us assume that we generate more program states at line 3 by executing the loop for 4 iterations. As a result, we get a data matrix that also includes the row from the previous data matrix as shown below.