Probabilistic symbolic execution

Geldenhuys, Jaco; Dwyer, Matthew B.; Visser, Willem

doi:10.1145/2338965.2336773

Cited by 119 publications

(124 citation statements)

References 28 publications

Supporting

Mentioning

124

Contrasting

Order By: Relevance

“…We build on our previous work from [18,15,7], that uses symbolic execution for PSA. The goal of the analysis is: (1) to identify the symbolic constraints characterizing the inputs that make the execution satisfy a given property, and then (2) to quantify the probability of satisfying the constraints.…”

Section: Probabilistic Software Analysismentioning

confidence: 99%

“…Probabilistic analysis based on symbolic execution has been described in e.g., [18,36,15]. Geldenhuys et al [18] considered uniform distributions for the inputs, linear integer arithmetic constraints, and used LattEMacchiato [14] to count solutions of path conditions produced during symbolic execution.…”

Section: Related Workmentioning

confidence: 99%

“…Geldenhuys et al [18] considered uniform distributions for the inputs, linear integer arithmetic constraints, and used LattEMacchiato [14] to count solutions of path conditions produced during symbolic execution. Sankaranarayanan et al [36] and Filieri et al [15] proposed similar techniques to compute probabilities of violating program assertions.…”

Section: Related Workmentioning

confidence: 99%

“…Recent PSA techniques [18,15,16,28] use symbolic execution of the program to collect symbolic constraints on the inputs that lead to the occurrence of target program events. The number of satisfying assignments for these constraints are then calculated using model counting procedures.…”

Section: Introductionmentioning

confidence: 99%

“…LattE [2], to compute probabilities [18,15,16,28]. Recent techniques have been introduced to estimate the (approximate) number of solutions for floating point constraints [7].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Model Counting for Complex Data Structures

Filieri

Frias

PăźSăźReanu

et al. 2015

Model Checking Software

Self Cite

View full text Add to dashboard Cite

We extend recent approaches for calculating the probability of program behaviors, to allow model counting for complex data structures with numeric fields. We use symbolic execution with lazy initialization to compute the input structures leading to the occurrence of a target event, while keeping a symbolic representation of the constraints on the numeric data. Off-the-shelf model counting tools are used to count the solutions for numerical constraints and field bounds encoding data structure invariants are used to reduce the search space. The technique is implemented in the Symbolic PathFinder tool and evaluated on several complex data structures. Results show that the technique is much faster than an enumeration-based method that uses the Korat tool and also highlight the benefits of using the field bounds to speed up the analysis.

show abstract

Section: Probabilistic Software Analysismentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…LattE [2], to compute probabilities [18,15,16,28]. Recent techniques have been introduced to estimate the (approximate) number of solutions for floating point constraints [7].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Model Counting for Complex Data Structures

Filieri

Frias

PăźSăźReanu

et al. 2015

Model Checking Software

Self Cite

View full text Add to dashboard Cite

show abstract

Automated test case generation for FBD programs implementing reactor protection system software

Jee

Shin

Cha

et al. 2014

Software Testing Verif & Rel

View full text Add to dashboard Cite

Automated and effective testing for function block diagram (FBD) programs has become an important issue, as FBD is increasingly used in implementing safety-critical systems. This work describes an automated test case generation technique for FBD programs and its associated tool-FBDTester. Given an FBD program and desired test coverage criteria, FBDTester generates test requirements and invokes the Satisfiability Modulo Theories solver iteratively to derive a set of test cases. An industrial case study using reactor protection system software shows that the automatically generated test suites detected at least 82% of the known faults, whereas manually generated test cases only detected approximately 35%. Mutation analysis revealed that the automatically generated test suites substantially outperformed manually generated ones. Although test sequence generation requires some manual effort in the current FBDTester, it is apparent that the proposed approach significantly improves the efficiency and the reliability of FBD testing. AUTOMATED TEST CASE GENERATION FOR FBD PROGRAMS 609 A real-world industrial case study was conducted using trip (shutdown) modules of the bistable processor (BP) of reactor protection systems developed in the Korea Nuclear Instrumentation and Control System R&D Center project. Test cases were manually generated by FBD testing professionals, taking nearly three man-months to generate test cases for the BP system. In the case study, test cases automatically generated by the FBDTester are compared with respect to fault detection capability using real faults detected in development. In addition, mutation analysis was also performed to compare effectiveness against a large number of artificial errors (i.e., mutants).The manually generated test cases only detected approximately 35% of the faults revealed in the preliminary version of the BP systems. The application of other techniques (e.g., model checking) detected the rest. Using the FBDTester, however, at least 82% of known faults in various modules were detected. In mutation analysis, the FBDTester also outperformed the manually generated test cases in almost all configurations. It is highly expected that the proposed approach could improve the efficiency and the reliability of FBD testing significantly.This paper is organized as follows. Section 2 explains FBD test coverage criteria as background for the study and Section 3 presents a literature survey of the most relevant research. A test case generation technique and an automated tool for FBD programs are described in Section 4. Section 5 reports the results of the KNICS BP case study and presents an evaluation of the proposed approach. The paper is concluded in Section 6.

show abstract

MuFBDTester: A mutation‐based test sequence generator for FBD programs implementing nuclear power plant software

Liu

Jee

Bae

2022

Software Testing Verif & Rel

View full text Add to dashboard Cite

Summary Function block diagram (FBD) is a standard programming language for programmable logic controllers (PLCs). PLCs have been widely used to develop safety‐critical systems such as nuclear reactor protection systems. It is crucial to test FBD programs for such systems effectively. This paper presents an automated test sequence generation approach using mutation testing techniques for FBD programs and the developed tool, MuFBDTester. Given an FBD program, MuFBDTester analyses the program and generates mutated programs based on mutation operators. MuFBDTester translates the given program and mutants into the input language of a satisfiability modulo theories (SMT) solver to derive a set of test sequences. The primary objective is to find the test data that can distinguish between the results of the given program and mutants. We conducted experiments with several examples including real industrial cases to evaluate the effectiveness and efficiency of our approach. With the control of test size, the results indicated that the mutation‐based test suites were statistically more effective at revealing artificial faults than structural coverage‐based test suites. Furthermore, the mutation‐based test suites detected more reproduced faults, found in industrial programs, than structural coverage‐based test suites. Compared to structural coverage‐based test generation time, the time required by MuFBDTester to generate one test sequence from industrial programs is approximately 1.3 times longer; however, it is considered to be worth paying the price for high effectiveness. Using MuFBDTester, the manual effort of creating test suites was significantly reduced from days to minutes due to automated test generation. MuFBDTester can provide highly effective test suites for FBD engineers.

show abstract

Probabilistic symbolic execution

Cited by 119 publications

References 28 publications

Model Counting for Complex Data Structures

Model Counting for Complex Data Structures

Automated test case generation for FBD programs implementing reactor protection system software

MuFBDTester: A mutation‐based test sequence generator for FBD programs implementing nuclear power plant software

Contact Info

Product

Resources

About