SmacC: A Retargetable Symbolic Execution Engine

Biere, Armin; Knoop, Jens; Kovács, Laura; Zwirchmayr, Jakob

doi:10.1007/978-3-319-02444-8_40

Cited by 4 publications

(3 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A symbolic execution engine, e.g. (Biere et al, 2013), models program executions by using symbolic values instead of concrete values. This allows to execute a program on symbolic instead of concrete input data.…”

Section: Preliminariesmentioning

confidence: 99%

“…The symbolic execution engine of r-TuBound, which is used in WCET Squeezing for proving precise WCET bounds, is implemented in the standalone symbolic engine SmacC (Biere et al, 2013). SmacC applies path-wise symbolic execution of a supplied C program that lies in the supported subset of (ANSI) C and uses the Boolector SMT solver (Brummayer and Biere, 2009) to check feasibility of WCET trace candidates in the quantifier-free logic of bit-vectors with arrays.…”

Section: Wcet Squeezing and R-tuboundmentioning

confidence: 99%

See 1 more Smart Citation

Replacing conjectures by positive knowledge: Inferring proven precise worst-case execution time bounds using symbolic execution

Knoop

Kovács

Zwirchmayr

2017

Journal of Symbolic Computation

Self Cite

View full text Add to dashboard Cite

Embedded real-time software systems (ESS) play an important role in almost every aspect of our daily lives. We do rely on them to be functionally correct and to adhere to timing-constraints ensuring that their computational results are always delivered in time. Violations of the timing-constraints of a safety-critical ESS, such as an airplane or a medical control device, can have disastrous economic and social consequences. Identifying and correcting such violations is therefore an important and challenging research topic. In this article we address this challenge and describe a rigorous approach for the timing analysis of programs and for proving its results precise. In practice most important is the worst-case execution time (WCET) of an ESS, that is, the maximal running time of the system on a specified hardware. A WCET analysis needs to provide a formal guarantee that a system meets its timing-constraints even in the worst case. This requires to compute a safe and tight bound for the execution time of a program. Existing WCET tools, however, are usually not able to guarantee that there is a feasible system trace that takes indeed as long as stated by the computed execution time bound: often, due to the employed abstractions during static analysis a computed WCET bound overestimates the actual WCET bound, since loop bounds and other timing-relevant program properties their computation is based on are computed for spurious infeasible system traces that can be ruled out by a path-sensitive program abstraction and analyzing program resources. In this article we present an approach for inferring and proving WCET bounds precise. This approach guarantees that the WCET bound is computed for a feasible system trace. This is achieved by combining WCET computation with path-wise symbolic execution in an abstraction refinement loop. This way, symbolic execution can be targeted and limited to relevant program parts thereby taming and avoiding the usually prohibitive computational costs of symbolic execution with a full path coverage. Moreover, our approach improves the quality of the underlying WCET analysis, since it automatically tightens the bound until it is proven precise, thereby improving the precision of the initially computed WCET bound. Our overall approach is an anytime algorithm, i.e., it can be stopped at any time without violating the soundness of its results. If run until termination, the WCET bound is proven precise, by automatically inferring additional constraints from spurious traces and using these constraints in the abstraction refinement. We implemented our approach in the r-TuBound WCET toolchain and tested it on challenging benchmarks from the WCET community. Our experimental results underline the advantage of using symbolic methods for proving WCET bounds precise, at a moderate cost.

show abstract

Section: Preliminariesmentioning

confidence: 99%

Section: Wcet Squeezing and R-tuboundmentioning

confidence: 99%

Replacing conjectures by positive knowledge: Inferring proven precise worst-case execution time bounds using symbolic execution

Knoop

Kovács

Zwirchmayr

2017

Journal of Symbolic Computation

Self Cite

View full text Add to dashboard Cite

show abstract

“…Note that this updated version is not available anymore. In the same year, ddsexpr [5], a generic hierarchical delta debugger for S-expressions (and thus applicable to the SMT-LIB language family), and ddSMTv1 [18], a delta debugger specific to the SMT-LIBv2 language, were presented. The latter implements a variant of Zeller's ddmin algorithm [24] and is considered as the current de-facto standard delta debugger in the SMT community.…”

Section: Introductionmentioning

confidence: 99%

ddSMT 2.0: Better Delta Debugging for the SMT-LIBv2 Language and Friends

Kremer

Niemetz

Preiner

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Erroneous behavior of verification back ends such as SMT solvers require effective and efficient techniques to identify, locate and fix failures of any kind. Manual analysis of large real-world inputs usually becomes infeasible due to the complex nature of these tools. Delta Debugging has emerged as a valuable technique to automatically reduce failure-inducing inputs while preserving the original erroneous behavior. We present , the successor of the delta debugger . is the current de-facto standard delta debugger for the SMT-LIBv2 language. Our tool improves and extends core concepts of and extends input language support to the entire family of SMT-LIBv2 language dialects. In addition to its ddmin-based main minimization strategy, it implements an alternative, orthogonal strategy based on hierarchical input minimization. We combine both strategies into a hybrid strategy and show that significantly improves over and other delta debugging tools for SMT-LIBv2 on real-world examples.

show abstract