System To Generate Test Data: The Analysis Program Syed Nabeel

Phases of the Analysis Program Symbolic Execution Constraint Simplification Inequality Solver Symbolic Representation Generated Test Case

Phase1: Symbolic Execution Symbolic Execution Constraint Simplification Inequality Solver Symbolic Representation Generated Test Case Path Description

Symbolic Execution Assigning expressions instead of values to variable while following a program path Assigning expressions instead of values to variable while following a program path Expression is the representation of the computation that would have evolved to associate value to a variable Expression is the representation of the computation that would have evolved to associate value to a variable

Structures Used in Symbolic Execution Computation Table Computation Table Symbol Table Symbol Table Evolution Graph Evolution Graph

Computation Table Value number: all unary and binary expressions are allocated value numbers Value number: all unary and binary expressions are allocated value numbers Components Of Computation Table Operator Operator Value Number for operands Value Number for operands Computation Value number for the computation Computation Value number for the computation

Example OperatorOp1Op2 Expression Value *X2X3T1 +X1T1T2 +T2C1T3 Assigned Value Numbers B  X1 C  X2 D  X3 Read (UINT) B,C,D A=B+C*D C=A+5 WRITE C Computation Table

Symbol Table Internal Data Structure that maps variables to value numbers generated Internal Data Structure that maps variables to value numbers generated Its values are updated as the program is symbolically executed Its values are updated as the program is symbolically executed

Example OperatorOp1Op2 Expression Value *X2X3T1 +X1T1T2 +T2C1T3 Read (UINT) B,C,D A=B+C*D C=A+5 WRITE C Assigned Value Numbers B  X1 C  X2 D  X3Name Value Number AT2 BX1 C? D? Symbol Table

Example OperatorOp1Op2 Expression Value *X2X3T1 +X1T1T2 +T2C1T3 Read (UINT) B,C,D A=B+C*D C=A+5 WRITE C Assigned Value Numbers B  X1 C  X2 D  X3Name Value Number AT2 BX1 CT3 DX3 Symbol Table

Evolution Graph A directed graph A directed graph Internal representation for expressions Internal representation for expressions Contains representations for several statements and variables Contains representations for several statements and variables

Example Read (UINT) B,C,D A=B+C*D C=A+5 WRITE C

Folding to simplify Evolution Graph Evaluation of constant expressions Evaluation of constant expressionsExampleA=2B=3C=A-B+1 Simplifies the evolution graph Simplifies the evolution graph Can be suppressed if causes a hindrance Can be suppressed if causes a hindrance

Constraint Construction Predicates from conditional statements are inserted into the computation table Predicates from conditional statements are inserted into the computation table Evolution Graph for constraints is extracted from the computation table Evolution Graph for constraints is extracted from the computation table

Additional Constraints Artificial constraints temporarily created to simulate error conditions Artificial constraints temporarily created to simulate error conditions Solution is evaluated for augmented set of constraints Solution is evaluated for augmented set of constraints If solution exists then error is possible If solution exists then error is possible Increases chances of detecting an error Increases chances of detecting an error

Subscript Example Consider an array of X of size 100 Consider an array of X of size 100 Allowable subscripts Allowable subscripts For an array access X(I) symbol S(I) is generated For an array access X(I) symbol S(I) is generated

Question Consider an array of X of size 100 Consider an array of X of size 100 Allowable subscripts Allowable subscripts For an array access X(I) symbol S(I) is generated For an array access X(I) symbol S(I) is generated Any constraints that can be added in this example ? Any constraints that can be added in this example ?

Additional Constraints Additional constraints: S(I)>100 and S(I) 100 and S(I)<1 If any of the above constraints is consistent with existing constraints an error is detected If any of the above constraints is consistent with existing constraints an error is detected

Phase2: Constraint Simplification Symbolic Execution Constraint Simplification Inequality Solver Symbolic Representation Generated Test Case Path Description

Constraint Simplification Before solving inequalities generated as constraints an attempt is made to simplify them if possible Before solving inequalities generated as constraints an attempt is made to simplify them if possible Example: Example: I1-I2<=3*I2 I1-I2<=3*I2 simplifies to simplifies to I1-4*I2<=0 I1-4*I2<=0

ALTRAN for simplification phase ALTRAN a language for algebraic manipulation used for the FORTRAN program constraints ALTRAN a language for algebraic manipulation used for the FORTRAN program constraints Recognize and flag non linear constraints Recognize and flag non linear constraints Manipulate expressions to obtain linear form. Manipulate expressions to obtain linear form. Example :I1/I2 <=7 is transformed to linear expression I1-7*I2<=0 Example :I1/I2 <=7 is transformed to linear expression I1-7*I2<=0

Phase3: Inequality Solver Symbolic Execution Constraint Simplification Inequality Solver Symbolic Representation Generated Test Case Path Description

Phase 3: Inequality Solver Solves the constraints that have been generated and simplified in the previous phases Procedure Each constraint is added one at a time Each constraint is added one at a time On each addition it is checked whether new constraint is consistent with previous solution On each addition it is checked whether new constraint is consistent with previous solution If consistent new constraints are added If consistent new constraints are added If not consistent a new solution is attempted If not consistent a new solution is attempted If all constraints are consistent then the final solution is a test data set that would cause execution of the path If all constraints are consistent then the final solution is a test data set that would cause execution of the path

Algorithm for Inequality Solving Linear programming algorithm Linear programming algorithm MAX O(X) Subject to AX =0 O  Objective Function (a linear function) X  N Vector of unknowns (input variables) B  M Vector of constants A  M*N matrix coefficient matrix for constraints Rules to convert all inequalities to this standard form

To Sum it up…. symbolic execution of a path symbolic execution of a path symbolic representation of the output variables and path constraints in terms of the program's input variables symbolic representation of the output variables and path constraints in terms of the program's input variables Subscript out of bound, division by zero also detected Subscript out of bound, division by zero also detected Using path constraints Using path constraints Test data is generated for a particular path Test data is generated for a particular path Determined that a particular path is infeasible Determined that a particular path is infeasible Linear Programming technique used for equation solving hence is limited to linear constraints Linear Programming technique used for equation solving hence is limited to linear constraints

Discussion Limitations Limitations Program Correctness vs Program Validation Program Correctness vs Program Validation Any other topic brought up Any other topic brought up