1. System To Generate Test Data: The Analysis Program Syed Nabeel

2. Phases of the Analysis Program Symbolic Execution Constraint Simplification Inequality Solver Symbolic Representation Generated Test Case

3. Phase1: Symbolic Execution Symbolic Execution Constraint Simplification Inequality Solver Symbolic Representation Generated Test Case Path Description

4. Symbolic Execution Assigning expressions instead of values to variable while following a program path Assigning expressions instead of values to variable while following a program path Expression is the representation of the computation that would have evolved to associate value to a variable Expression is the representation of the computation that would have evolved to associate value to a variable

5. Structures Used in Symbolic Execution Computation Table Computation Table Symbol Table Symbol Table Evolution Graph Evolution Graph

6. Computation Table Value number: all unary and binary expressions are allocated value numbers Value number: all unary and binary expressions are allocated value numbers Components Of Computation Table Operator Operator Value Number for operands Value Number for operands Computation Value number for the computation Computation Value number for the computation

7. Example OperatorOp1Op2 Expression Value *X2X3T1 +X1T1T2 +T2C1T3 Assigned Value Numbers B  X1 C  X2 D  X3 Read (UINT) B,C,D A=B+C*D C=A+5 WRITE C Computation Table

8. Symbol Table Internal Data Structure that maps variables to value numbers generated Internal Data Structure that maps variables to value numbers generated Its values are updated as the program is symbolically executed Its values are updated as the program is symbolically executed

9. Example OperatorOp1Op2 Expression Value *X2X3T1 +X1T1T2 +T2C1T3 Read (UINT) B,C,D A=B+C*D C=A+5 WRITE C Assigned Value Numbers B  X1 C  X2 D  X3Name Value Number AT2 BX1 C? D? Symbol Table

10. Example OperatorOp1Op2 Expression Value *X2X3T1 +X1T1T2 +T2C1T3 Read (UINT) B,C,D A=B+C*D C=A+5 WRITE C Assigned Value Numbers B  X1 C  X2 D  X3Name Value Number AT2 BX1 CT3 DX3 Symbol Table

11. Evolution Graph A directed graph A directed graph Internal representation for expressions Internal representation for expressions Contains representations for several statements and variables Contains representations for several statements and variables

12. Example Read (UINT) B,C,D A=B+C*D C=A+5 WRITE C

13. Folding to simplify Evolution Graph Evaluation of constant expressions Evaluation of constant expressionsExampleA=2B=3C=A-B+1 Simplifies the evolution graph Simplifies the evolution graph Can be suppressed if causes a hindrance Can be suppressed if causes a hindrance

14. Constraint Construction Predicates from conditional statements are inserted into the computation table Predicates from conditional statements are inserted into the computation table Evolution Graph for constraints is extracted from the computation table Evolution Graph for constraints is extracted from the computation table

15. Additional Constraints Artificial constraints temporarily created to simulate error conditions Artificial constraints temporarily created to simulate error conditions Solution is evaluated for augmented set of constraints Solution is evaluated for augmented set of constraints If solution exists then error is possible If solution exists then error is possible Increases chances of detecting an error Increases chances of detecting an error

16. Subscript Example Consider an array of X of size 100 Consider an array of X of size 100 Allowable subscripts 1..100 Allowable subscripts 1..100 For an array access X(I) symbol S(I) is generated For an array access X(I) symbol S(I) is generated

17. Question Consider an array of X of size 100 Consider an array of X of size 100 Allowable subscripts 1..100 Allowable subscripts 1..100 For an array access X(I) symbol S(I) is generated For an array access X(I) symbol S(I) is generated Any constraints that can be added in this example ? Any constraints that can be added in this example ?

18. Additional Constraints Additional constraints: S(I)>100 and S(I) 100 and S(I)<1 If any of the above constraints is consistent with existing constraints an error is detected If any of the above constraints is consistent with existing constraints an error is detected

19. Phase2: Constraint Simplification Symbolic Execution Constraint Simplification Inequality Solver Symbolic Representation Generated Test Case Path Description

20. Constraint Simplification Before solving inequalities generated as constraints an attempt is made to simplify them if possible Before solving inequalities generated as constraints an attempt is made to simplify them if possible Example: Example: I1-I2<=3*I2 I1-I2<=3*I2 simplifies to simplifies to I1-4*I2<=0 I1-4*I2<=0

21. ALTRAN for simplification phase ALTRAN a language for algebraic manipulation used for the FORTRAN program constraints ALTRAN a language for algebraic manipulation used for the FORTRAN program constraints Recognize and flag non linear constraints Recognize and flag non linear constraints Manipulate expressions to obtain linear form. Manipulate expressions to obtain linear form. Example :I1/I2 <=7 is transformed to linear expression I1-7*I2<=0 Example :I1/I2 <=7 is transformed to linear expression I1-7*I2<=0

22. Phase3: Inequality Solver Symbolic Execution Constraint Simplification Inequality Solver Symbolic Representation Generated Test Case Path Description

23. Phase 3: Inequality Solver Solves the constraints that have been generated and simplified in the previous phases Procedure Each constraint is added one at a time Each constraint is added one at a time On each addition it is checked whether new constraint is consistent with previous solution On each addition it is checked whether new constraint is consistent with previous solution If consistent new constraints are added If consistent new constraints are added If not consistent a new solution is attempted If not consistent a new solution is attempted If all constraints are consistent then the final solution is a test data set that would cause execution of the path If all constraints are consistent then the final solution is a test data set that would cause execution of the path

24. Algorithm for Inequality Solving Linear programming algorithm Linear programming algorithm MAX O(X) Subject to AX =0 O  Objective Function (a linear function) X  N Vector of unknowns (input variables) B  M Vector of constants A  M*N matrix coefficient matrix for constraints Rules to convert all inequalities to this standard form

25. To Sum it up…. symbolic execution of a path symbolic execution of a path symbolic representation of the output variables and path constraints in terms of the program's input variables symbolic representation of the output variables and path constraints in terms of the program's input variables Subscript out of bound, division by zero also detected Subscript out of bound, division by zero also detected Using path constraints Using path constraints Test data is generated for a particular path Test data is generated for a particular path Determined that a particular path is infeasible Determined that a particular path is infeasible Linear Programming technique used for equation solving hence is limited to linear constraints Linear Programming technique used for equation solving hence is limited to linear constraints

26. Discussion Limitations Limitations Program Correctness vs Program Validation Program Correctness vs Program Validation Any other topic brought up Any other topic brought up