Symbolic execution and testing

Abstract

Symbolic execution has several applications mainly in the validation of software. It may be used in the generation of test data, in program proving, and in program reduction. The paper is a tutorial on symbolic execution and how it may be used in software testing and in particular the testing of commercial data-processing (DP) software. An example is used to describe: the symbolic execution of feasible and infeasible paths; the creation of a test case from a feasible path condition; and the checking of assertions by conjoining them to the path condition. Some problems in applying symbolic execution are discussed, with particular attention given to the task of assessing path feasibility. For some programs, linear programming optimizers can be used to assess path feasibility. Commercial DP software is a class of software likely to be amenable to the linear optimizer approach, but this class brings a few problems of its own. Most of these problems can be overcome. Early software tools that used symbolic execution were aimed at numerical software written in languages such as Fortran. No symbolic execution tool has previously been built for commercial DP languages such as Cobol. The last section of the paper describes the main features of SYM-BOL, a symbolic execution testing tool for Cobol.