Reliability analysis in Symbolic PathFinder

Abstract

Abstract-Software reliability analysis tackles the problem of predicting the failure probability of software. Most of the current approaches base reliability analysis on architectural abstractions useful at early stages of design, but not directly applicable to source code. In this paper we propose a general methodology that exploit symbolic execution of source code for extracting failure and success paths to be used for probabilistic reliability assessment against relevant usage scenarios. Under the assumption of finite and countable input domains, we provide an efficient implementation based on Symbolic PathFinder that supports the analysis of sequential and parallel programs, even with structured data types, at the desired level of confidence. The tool has been validated on both NASA prototypes and other test cases showing a promising applicability scope.

Model Counting for Complex Data Structures

“…We build on our previous work from [18,15,7], that uses symbolic execution for PSA. The goal of the analysis is: (1) to identify the symbolic constraints characterizing the inputs that make the execution satisfy a given property, and then (2) to quantify the probability of satisfying the constraints.…”

“…We focus here on another important application, namely Probabilistic Software Analysis (PSA) [36,15,7,21]. PSA is an emerging technique to quantify the probability of reaching program events of interest assuming that program inputs follow given probabilistic distributions [15].…”

“…PSA is an emerging technique to quantify the probability of reaching program events of interest assuming that program inputs follow given probabilistic distributions [15]. The input distributions allow data from real world observations to be incorporated in the analysis of programs that interact with their environment, as well as to encode uncertainty in design assumptions about the usage profile of a program, including the interactions with third-party components and systems.…”

“…Recent PSA techniques [18,15,16,28] use symbolic execution of the program to collect symbolic constraints on the inputs that lead to the occurrence of target program events. The number of satisfying assignments for these constraints are then calculated using model counting procedures.…”

“…LattE [2], to compute probabilities [18,15,16,28]. Recent techniques have been introduced to estimate the (approximate) number of solutions for floating point constraints [7].…”