implement symbolic execution without model-checking

Question

How can I implement symbolic execution for particular language without using model checking and Finite State Machine (FSM) for example not such as Java Path Finder? I need a detail about it. for example by what language I can implement this symbolic execution and what other things I need to know?

Ira Baxter · Accepted Answer · 2016-09-20 20:37:58Z

3

You need:

A parser for the language to be symbolically executed that can build ASTs
Name resolution (and associated symbol tables), so when your execution engine encounters an identifier it can determine the associated type and value
Control flow analysis, so that the symbolic execution engine can follow flow of control through the program
A symbolic algebra that can compose and simplify symbolic terms. This needs a parser (so you can enter such equations) and prettyprinter (so you can see what it computes)
A way to specify assumed values at the point of symbolic execution start

This is rather a lot of machinery, and it is hard to find it all in one place. It is harder to build it all just for one tool, which is part of the reason you don't find many tools like this.

Our DMS Software Reengineering Toolkit has all the requisites. You may find an example of a symbolic language implemented with DMS interesting.

edited Sep 20, 2016 at 20:37

answered Sep 14, 2016 at 14:59

Ira Baxter

95.9k24 gold badges188 silver badges357 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

any Over a year ago

Thanks for your kind help. if I want to use model-checking what changes occur to above steps? whether using model-checking make implementation of symbolic execution easier than when not use?

Ira Baxter Over a year ago

For model checking you have to be willing to enumerate different symbolic simulations for each state, and add constraints over what states aren't allowed. Because state spaces are huge, you probably want all that to go parallel. DMS has parallel foundations :-} See semanticdesigns.com/Products/DMS/ParlanseForDMS.html

any Over a year ago

thanks a lot. Would you please explain fourth and fifth item of the answer a little more?

Ira Baxter Over a year ago

Item 4: see the link "symbolic language implemented with DMS". In particular, this means being able to build algebraic/boolean formulas, and mechanically/automatically simplyifying those formulas using algebraic laws. Item 5: you need to pick a part of your code, and specify the (algebraic) conditions under which that code starts execution ("precondition").

any Over a year ago

Thank you very much indeed.

Collectives™ on Stack Overflow

implement symbolic execution without model-checking

1 Answer 1

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related