Symbolic Execution of Alloy Models
Symbolic execution is a technique for systematic exploration of program behaviors using symbolic inputs, which characterize classes of concrete inputs. Symbolic execution is traditionally performed on imperative programs, such as those in C/C++ or Java. This paper presents a novel approach to symbolic execution for declarative programs, specifically those written in Alloy – a first-order, declarative language based on relations. Unlike imperative programs that describe how to perform computation to conform to desired behavioral properties, declarative programs describe what the desired properties are, without enforcing a specific method for computation. Thus, symbolic execution does not directly apply to declarative programs the way it applies to imperative programs. Our insight is that we can leverage the fully automatic, SAT-based analysis of the Alloy Analyzer to enable symbolic execution of Alloy models – the analyzer generates instances, i.e., valuations for the relations in the model, that satisfy the given properties and thus provides an execution engine for declarative programs. We define symbolic types and operations, which allow the existing Alloy tool-set to perform symbolic execution for the supported types and operations. We demonstrate the efficacy of our approach using a suite of models that represent structurally complex properties. Our approach opens promising avenues for new forms of more efficient and effective analyses of Alloy models.
KeywordsAlloy Model Path Condition Symbolic Execution Binary Search Tree Alloy Analyzer
Unable to display preview. Download preview PDF.
- 1.Bush, W.R., et al.: A Static Analyzer for Finding Dynamic Programming Errors. Softw. Pract. Exper. 30 (2000)Google Scholar
- 3.Cadar, C., et al.: EXE: Automatically Generating Inputs of Death. In: CCS 2006 (2006)Google Scholar
- 4.Cadar, C., et al.: Symbolic Execution for Software Testing in Practice Preliminary Assessment. In: ICSE Impact (2011)Google Scholar
- 5.Clarke, L.A.: Test Data Generation and Symbolic Execution of Programs as an aid to Program Validation. PhD thesis, University of Colorado at Boulder (1976)Google Scholar
- 8.Dennis, G., Yessenov, K.: Forge website, http://sdg.csail.mit.edu/forge/
- 9.Godefroid, P.: Compositional Dynamic Test Generation. In: POPL 2007 (2007)Google Scholar
- 10.Godefroid, P., et al.: DART: Directed Automated Random Testing. In: PLDI 2005 (2005)Google Scholar
- 11.Jackson, D.: Software Abstractions: Logic, Language, and Analysis. The MIT Press, Cambridge (2006)Google Scholar
- 13.Khurshid, S., Marinov, D.: TestEra: Specification-Based Testing of Java Programs using SAT. Automated Softw. Eng. J. 11 (2004)Google Scholar
- 14.King, J.C.: Symbolic Execution and Program Testing. Commun. ACM 19 (1976)Google Scholar
- 15.Sen, K., et al.: CUTE: A Concolic Unit Testing Engine for C. In: ESEC/FSE 2005 (2005)Google Scholar
- 18.Wang, T., et al.: Symbolic Execution of Behavioral Requirements. In: Pract. Aspects Decl. Lang. (2004)Google Scholar