Search

Symbolic execution can automatically explore different execution paths in a system under test and generate tests to precisely cover them. It has two main advantages—being automatic and thorough within a theory—and has many successful applications. The bottleneck of symbolic execution currently is the computation consumption for complex systems. Compositional Symbolic Execution (CSE) introduces a summarisation module to eliminate the redundancy in the exploration of repeatedly encountered code. In our previous work, we generalised the summarisation for any code fragments instead of functions. In this paper, we transplant this idea onto LLVM with many additional features, one of them being the use of incremental solving. We show that the combination of CSE and incremental solving is mutually beneficial. The obvious weakness of CSE is the lack of context during summarisation. We discuss the use of assumption-based features, available in modern constraint solvers, as a way to overcome this problem.

Compositional symbolic execution has been proposed as a way to increase the efficiency of symbolic execution. Essentially, when a function is symbolically executed, a summary of the path that was executed is stored. This summary records the precondition and post condition of the path, and on subsequent calls that satisfy that precondition, the corresponding post condition can be returned instead of executing the function again. However, using functions as the unit of summarisation leaves the symbolic execution tool at the mercy of a program designer, essentially resulting in an arbitrary summarisation strategy. In this paper, we explore the use of fine-grained summaries, in which blocks within functions are summarised. We propose three types of summarisation and demonstrate how to generate these. At such a fine-grained level, symbolic execution of a path effectively becomes the concatenation of the summaries along that path. Using a prototype symbolic execution tool, we perform a preliminary experimental evaluation of our summary approaches, demonstrating that they can improve the speed of symbolic execution by reducing the number of calls sent to the underlying constraint solver.

This paper investigates the suitability of Sen's approach in modelling hydrologic time series and in particular the generation of synthetic flow series. It was found that several problems exist with the method as proposed. These include too many parameters in the model, difficulties in modelling skewed series, and finding a suitable stochastic model for the residuals between the original and the fitted cumulative departure curves. On the other hand, it has been found that Sen's method is effective in preserving the Hurst phenomenon and is especially suited for modelling time series with a relatively high Hurst coefficient but low lag-one serial correlation coefficient. Also, with some modifications to the suggested procedure some of the stated problems can be somewhat overcome.

Statistical flood frequency analysis assumes that the flood record to be analysed is a reliable set of measurements of independent random events from a stationary population. The validity of this assumption can be verified using statistical tests of independence. However, most statistical tests of independence are designed to show up only short-term serial correlation. They are insensitive to the long-term serial correlation structure of the flood record which can be far more important. To demonstrate this issue, the serial correlation structure of the peak flow series from 90 Canadian rivers was analysed for both short- and long-term dependence. The results show that although short-term dependence is practically absent for most of the peak flow series, significant long-term dependence is present for a large number of peak flow series tested.