Lecture Notes in Computer Science 3472

324 Levi Lúcio and Marko Samer
be used to extract test cases from specifications given as logic programs, and
why correctness proofs can be useful in test case generation.
Symbolic execution is a program verification technique from the 1970s. Differently
from the other verification techniques discussed in this chapter, symbolic
execution was initially applied to real code rather than to abstract models. Several
software verification frameworks using symbolic execution were built in the
1970s. However, their success was limited since the required mathematical machinery
was not sufficiently developed. Recently, the principles of symbolic execution
have been reused to cope with the problems of state space explosion while
searching for execution traces in a software application’s abstract model. By replacing
actual system inputs with symbols, i.e., variables and sets of constraints
over them, symbolic execution allows coping with the problem of unbounded
entries – thus reducing state space explosion. There is however a price to pay
since traces found in this way are symbolic and need to be instantiated. After
introducing the basic concepts of symbolic execution as it was invented in the
1970s for code verification, we will discuss several modern frameworks for test
case generation that make use of symbolic execution. The examples are chosen
to demonstrate that symbolic execution canbeusedbothwithabstractmodels
and concrete code.
Model checking is a method for verifying finite-state systems. Given a system
model and a specification written in a temporal logic, the model checker automatically
determines whether the model satisfies the specification. In addition to
being fully automatic, an important feature of model checking is that in principle
a witness resp. counterexample can be supplied when the model succeeds resp.
fails to satisfy the specification. There exist several approaches that establish
connections between model checking and model-based testing. The main idea
of these approaches is that test case specifications can be written in temporal
logics such that the problem of test case generation is reduced to the problem of
finding a set of witnesses resp. counterexamples to the specification. Since model
checking in the context of test case generation is also covered by other chapters
in this book, we will give only a short summary and refer to other chapters.
This chapter is organized as follows: In Sec. 12.2, we present test case generation
by theorem proving. The use of symbolic execution is then described in
Sec. 12.3. Afterwards, in Sec. 12.4, we cover test case generation by model checking.
Finally, we summarize in Sec. 12.5. The responsibilities for the two main
parts of this chapter, namely theorem proving and symbolic execution, were splitted
in the following way: Marko Samer was responsible for Sec. 12.2 and Levi
Lúcio was responsible for Sec. 12.3.
12.2 Theorem Proving
An automated theorem prover attempts to construct a proof for a given input
conjecture. However, since for complex problems it is rarely possible to construct