Infeasible Paths Elimination by Symbolic Execution Techniques: Proof of Correctness and Preservation of Paths

Burkhart Wolff (1, 2) , Romain Aissat (2) , Frédéric Voisin (2)

1 IRT SystemX
2 LRI - Laboratoire de Recherche en Informatique

TRACER [8] is a tool for verifying safety properties of sequential C programs. TRACER attempts at building a finite symbolic execution graph which over-approximates the set of all concrete reach-able states and the set of feasible paths. We present an abstract framework for TRACER and similar CEGAR-like systems [2, 3, 5, 6, 9]. The framework provides 1) a graph-transformation based method for reducing the feasible paths in control-flow graphs, 2) a model for symbolic execution, subsumption, predicate abstraction and invariant generation. In this framework we formally prove two key properties: correct construction of the symbolic states and preservation of feasible paths. The framework focuses on core operations, leaving to concrete prototypes to " fit in " heuristics for combining them.

Mots clés: TRACER; CEGAR; Symbolic Execution; Feasible Paths; Control-Flow Graphs; Graph Transformation

Domaines: Informatique

Burkhart Wolff, Romain Aissat, Frédéric Voisin. Infeasible Paths Elimination by Symbolic Execution Techniques: Proof of Correctness and Preservation of Paths. International Conference on Interactive Theorem Proving ITP 2016, Aug 2016, Nancy, France. ⟨hal-01702847⟩