Floating-point symbolic execution: A case study in N-version programming

Liew, Daniel; Schemmel, Daniel; Cadar, Cristian; Donaldson, Alastair F.; Zahl, Rafael; Wehrle, Klaus

doi:10.1109/ase.2017.8115670

Cited by 28 publications

(12 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, as it is a testing based verification argument, it cannot be considered to be complete. [41] used a similar technique successfully in a more limited setting without the emphasis on ground truth.…”

Section: Correctnessmentioning

confidence: 99%

Building Better Bit-Blasting for Floating-Point Problems

Brain

Schanda

Sun

2019

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

An effective approach to handling the theory of floatingpoint is to reduce it to the theory of bit-vectors. Implementing the required encodings is complex, error prone and requires a deep understanding of floating-point hardware. This paper presents SymFPU, a library of encodings that can be included in solvers. It also includes a verification argument for its correctness, and experimental results showing that its use in CVC4 out-performs all previous tools. As well as a significantly improved performance and correctness, it is hoped this will give a simple route to add support for the theory of floating-point.

show abstract

Section: Correctnessmentioning

confidence: 99%

Building Better Bit-Blasting for Floating-Point Problems

Brain

Schanda

Sun

2019

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

show abstract

“…The KLEE symbolic execution engine [9] has support for floating-point programs [26] through an interface to Z3's floating-point theory [8]. This theory is also based on IEEE 754 and will thus not be able to verify the kind of optimizations that Icing supports.…”

Section: Related Workmentioning

confidence: 99%

Icing: Supporting Fast-Math Style Optimizations in a Verified Compiler

Becker

Darulová

Myreen

et al. 2019

Computer Aided Verification

View full text Add to dashboard Cite

Verified compilers like CompCert and CakeML offer increasingly sophisticated optimizations. However, their deterministic source semantics and strict IEEE 754 compliance prevent the verification of "fast-math" style floating-point optimizations. Developers often selectively use these optimizations in mainstream compilers like GCC and LLVM to improve the performance of computations over noisy inputs or for heuristics by allowing the compiler to perform intuitive but IEEE 754-unsound rewrites. We designed, formalized, implemented, and verified a compiler for Icing, a new language which supports selectively applying fast-math style optimizations in a verified compiler. Icing's semantics provides the first formalization of fast-math in a verified compiler. We show how the Icing compiler can be connected to the existing verified CakeML compiler and verify the end-to-end translation by a sequence of refinement proofs from Icing to the translated CakeML. We evaluated Icing by incorporating several of GCC's fast-math rewrites. While Icing targets CakeML's source language, the techniques we developed are general and could also be incorporated in lower-level intermediate representations.

show abstract

“…More generally, some of these patches require a precise environmental model (KLEE's model is incomplete, e.g., it lacks the ability to handle symbolic directories), and at least one patch requires support for symbolic floating-point values (which KLEE does not provide). However, one could implement Shadow in other symbolic execution engines, such as in Cloud9 [6], which extends KLEE with a more comprehensive environmental model, or in one of the recent extensions of KLEE for floating point [23].…”

Section: Unsuccessful Executionsmentioning

confidence: 99%

Shadow Symbolic Execution for Testing Software Patches

Kuchta

Palikareva

Cadar

2018

ACM Trans. Softw. Eng. Methodol.

Self Cite

View full text Add to dashboard Cite

While developers are aware of the importance of comprehensively testing patches, the large effort involved in coming up with relevant test cases means that such testing rarely happens in practice. Furthermore, even when test cases are written to cover the patch, they often exercise the same behaviour in the old and the new version of the code. In this article, we present a symbolic execution-based technique that is designed to generate test inputs that cover the new program behaviours introduced by a patch. The technique works by executing both the old and the new version in the same symbolic execution instance, with the old version shadowing the new one. During this combined shadow execution, whenever a branch point is reached where the old and the new version diverge, we generate a test input exercising the divergence and comprehensively test the new behaviours of the new version. We evaluate our technique on the Coreutils patches from the CoREBench suite of regression bugs, and show that it is able to generate test inputs that exercise newly added behaviours and expose some of the regression bugs.

show abstract

Floating-point symbolic execution: A case study in N-version programming

Cited by 28 publications

References 44 publications

Building Better Bit-Blasting for Floating-Point Problems

Building Better Bit-Blasting for Floating-Point Problems

Icing: Supporting Fast-Math Style Optimizations in a Verified Compiler

Shadow Symbolic Execution for Testing Software Patches

Contact Info

Product

Resources

About