Symbolic execution based on language transformation

Abstract

International audienceWe propose a language-independent symbolic execution framework for languages endowed with a formal operational semantics based on term rewriting. Starting from a given definition of a language, a new language definition is generated, with the same syntax as the original one, but whose semantical rules are transformed in order to rewrite over logical formulas denoting possibly infinite sets of program states. Then, the symbolic execution of concrete programs is, by definition , the execution of the same programs with the symbolic semantics. We prove that the symbolic execution thus defined has the properties naturally expected from it (with respect to concrete program execution). A prototype implementation of our approach was developed in the K Framework. We demonstrate the tool's genericity by instantiating it on several languages, and illustrate it on the reachability analysis and model checking of several programs

Executing and verifying higher-order functional-imperative programs in Maude

“…By contrast, in a deep embedding programs have to stay within the bounds of the guest language's syntax and semantics. The same dichotomy (shallow vs. deep embeddings) distinguishes the present paper with our previous work on language-parametric symbolic execution, program verification and program equivalence [11,12,13,14,15].…”

Generalized Rewrite Theories and Coherence Completion

“…The key point is that the notion of generalized rewrite theory thus obtained, although in general not executable in the standard sense, can still be executed symbolically under fairly reasonable assumptions. For example, the notion of rewriting modulo SMT [22] (see also the related work [1]) shows how such generalized theories can be symbolically executed under some typing restrictions and the requirement that satisfiability of a rule's condition ϕ is always decidable. Related, yet different, notions of symbolic execution are also given in [12,16].…”

“…One key issue is that the rewrite theories used in several of these approaches go beyond the standard notion of rewrite theory in, say [3], and also beyond the executability requirements in, say, [8]. For example: (1) conditions in rules are not just conjunctions of equations, but quantifier-free (QF) formulas in an, often decidable, background theory T (e.g., Presburger arithmetic); and (2) the rewrite rules may model open systems interacting with an environment, so that they may have extra variables in their righthand sides [22]. Furthermore, each of the approaches just mentioned uses different assumptions about the rewrite theories they handle: no general notion has yet been proposed.…”

“…This work is all about such new wineskins. It asks, and provides answers for, two main questions: (1) How can the notion of rewrite theory be generalized to support symbolic reasoning? and (2) What are the appropriate symbolic executability requirements needed for such rewrite theories; and how can they be ensured for, and made available to, a widest possible class of theories?…”

“…Symbolic methods are used to reason about concurrent systems specified by rewrite theories in many ways, including: (i) cryptographic protocol verification, e.g., [10], (ii) logical LTL model checking, e.g., [2], (iii) rewriting modulo SMT and related approaches, e.g., [22,1], (iv) inductive theorem proving and program verification, e.g., [12,16], and (v) reachability logic theorem proving, e.g., [25,17,24]. One key issue is that the rewrite theories used in several of these approaches go beyond the standard notion of rewrite theory in, say [3], and also beyond the executability requirements in, say, [8].…”