Correct and Complete Symbolic Execution for Free

2026-06-19

AI Summary

Existing symbolic execution approaches often lack a formal foundation aligned with the concrete semantics of programming languages, typically being constructed in an ad hoc and fragmented manner. This work proposes a symbolic Structural Operational Semantics (SOS) rule format that, for the first time, relies solely on the algebraic signature of the source language to uniformly capture both concrete and symbolic operational semantics, thereby enabling language-agnostic generation of symbolic execution semantics. Within this framework, we formally derive symbolic semantics and rigorously prove their soundness and completeness relative to the concrete semantics, demonstrating applicability to arbitrary programming languages.

Abstract

Symbolic execution is a powerful technique for program analysis. However, the formal semantics underlying symbolic execution is often developed on an ad-hoc basis and decoupled from the concrete semantics of the programming language. To overcome this issue, we introduce symbolic SOS: a rule format that allows us to simultaneously specify concrete and symbolic operational semantics. We prove that symbolic semantics, when generated from symbolic SOS, is both correct and complete with respect to the corresponding concrete semantics. The approach relies only on an algebraic signature of the source language, and is thus language-independent.

Problem

• symbolic execution
• formal semantics
• concrete semantics
• language independence

Innovation

• symbolic execution
• symbolic SOS
• operational semantics
• language independence
• formal verification