A generic framework for symbolic execution: A coinductive approach

Abstract

We propose a language-independent symbolic execution framework. The approach is parameterised by a language definition, which consists of a signature for the syntax and execution infrastructure of the language, a model interpreting the signature, and rewrite rules for the language's operational semantics. Then, symbolic execution amounts to computing symbolic paths using a derivative operation. We prove that the symbolic execution thus defined has the properties naturally expected from it, meaning that the feasible symbolic executions of a program and the concrete executions of the same program mutually simulate each other. We also show how a coinduction-based extension of symbolic execution can be used for the deductive verification of programs. We show how the proposed symbolic-execution approach, and the coinductive verification technique based on it, can be seamlessly implemented in language definition frameworks based on rewriting such as the K framework. A prototype implementation of our approach has been developed in K. We illustrate it on the symbolic analysis and deductive verification of nontrivial programs.

Executing and verifying higher-order functional-imperative programs in Maude

“…By contrast, in a deep embedding programs have to stay within the bounds of the guest language's syntax and semantics. The same dichotomy (shallow vs. deep embeddings) distinguishes the present paper with our previous work on language-parametric symbolic execution, program verification and program equivalence [11,12,13,14,15].…”

“…We reformulate the language-independent symbolic execution approach already presented elsewhere [11], with notable simplifications (e.g., we do not use coinduction). The approach consists in transforming the semantics of a programming language so that, under reasonable restrictions, shown below, executing a program with the modified semantics amounts to executing the program symbolically.…”

Programming and symbolic computation in Maude

“…The most recent Maude-based work on reachability logic provers closest to the work in [125] is that in [80] and, even more so, in [23]. The approach in [80] adopts a semantic framework for models similar to the already-discussed work in [131,132], i.e., state properties are specified using matching logic and assume a given first-order logic model. Therefore, the semantic framework is different from the one in [125].…”

Reducing Total Correctness to Partial Correctness by a Transformation of the Language Semantics

“…Given a program and a program variant, its total correctness in the original language reduces to showing partial correctness in the new language. Language transformations have been used before, for example to develop languageparametric symbolic execution engines [18] or language-parametric partial equivalence checkers [9]. In general, the research community treats the subject of termination orthogonally to the subject of partial correctness.…”