Hybrid Symbolic Concrete Execution for Embedded Software Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for testing embedded software are inadequate due to the limitations of computing capability and resource consumption in embedded systems, making it difficult to apply dynamic symbolic execution techniques effectively, which require significant modifications and resource-intensive instrumentation.
Innovation Solution
A method that divides dynamic symbolic execution into concrete and symbolic execution parts, where the concrete execution runs on the embedded system and the symbolic execution on a host system, using a symbolic execution kernel module, path selection module, solver, and debugger to generate test cases without requiring source code or extensive modifications, leveraging existing dynamic symbolic execution software from general-purpose platforms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic symbolic execution software is directly imported from general-purpose platform to embedded system, then test coverage can be improved, but device complexity and resource consumption increase significantly
Solution Approach 1:
The patent divides the testing system into two independent parts: a symbolic execution engine running on the host system and a concrete execution engine running on the embedded target system. This segmentation allows the complex symbolic execution functionality to reside on the host while the embedded system only needs lightweight instrumentation, thereby improving test coverage without increasing embedded system complexity
Solution Approach 2:
The patent introduces an intermediary communication mechanism between the host system and embedded target system. The host system acts as an intermediary that collects runtime information from the embedded system, performs symbolic execution analysis, and generates test cases. This intermediary approach enables comprehensive testing while keeping the embedded system lightweight
2Productivity
If symbolic execution is performed on embedded system, then test case generation capability is improved, but resource consumption exceeds embedded system capabilities
Solution Approach 1:
The patent extracts the resource-intensive symbolic execution functionality from the embedded system and relocates it to the host system. The embedded system only performs lightweight concrete execution and collects runtime information, while the host system performs the computationally expensive symbolic execution analysis. This extraction resolves the contradiction by maintaining high productivity while reducing resource consumption on the embedded system
3Measurement precision
If source code instrumentation is performed, then test accuracy is improved, but ease of operation deteriorates due to requiring source code modifications
Solution Approach 1:
The patent uses binary instrumentation technology to create a copy of the executable code with embedded instrumentation points, rather than modifying the original source code. This copying approach allows the system to insert tracking code at critical points in the executable, maintaining test accuracy while avoiding the need for source code modifications and simplifying the software import process
Data Source
AI summary
A device and a method are provided to automatically generate test case for embedded software. This invention is in software test field, including symbolic execution kernel module, path selection module, solver, debugger, concrete execution kernel module and debugger agent module. The tested software and test cases are uploaded from the host system to the embedded system through debugger and debugger agent. The concrete execution kernel module starts the tested software. The symbolic execution kernel module captures the run-time information of the tested software through the debugger. When the tested software operates on the symbol source, the symbolic execution kernel module marks the symbol source, tracks the symbol propagation, generates path condition and sends the path condition to path selection module. This invention can automatically generate test cases for embedded software, which doesn't need the source code of the tested software and can be conveniently used for commercial software.