Instantly share code, notes, and snippets.

@rindPHI /
Last active Feb 16, 2017

What would you like to do?
Example Usage of the Symbolic Execution API
package example;
import java.util.HashMap;
import java.util.List;
import org.key_project.util.collection.ImmutableSLList;
import de.uka.ilkd.key.control.*;
import de.uka.ilkd.key.logic.op.IProgramMethod;
import de.uka.ilkd.key.proof.*;
import de.uka.ilkd.key.settings.*;
import de.uka.ilkd.key.symbolic_execution.*;
import de.uka.ilkd.key.symbolic_execution.model.IExecutionNode;
import de.uka.ilkd.key.symbolic_execution.po.ProgramMethodPO;
import de.uka.ilkd.key.symbolic_execution.profile.SymbolicExecutionJavaProfile;
import de.uka.ilkd.key.symbolic_execution.strategy.*;
import de.uka.ilkd.key.symbolic_execution.strategy.breakpoint.*;
import de.uka.ilkd.key.symbolic_execution.util.*;
import de.uka.ilkd.key.util.MiscTools;
* Example application which symbolically executes
* {@code example/Number#equals(Number)}
* @author Martin Hentschel
public class Main {
* The program entry point.
* @param args The start parameters.
public static void main(String[] args) {
File location = new File("example"); // Path to the source code folder/file or to a *.proof file
List<File> classPaths = null; // Optionally: Additional specifications for API classes
File bootClassPath = null; // Optionally: Different default specifications for Java API
List<File> includes = null; // Optionally: Additional includes to consider
try {
// Ensure that Taclets are parsed
if (!ProofSettings.isChoiceSettingInitialised()) {
KeYEnvironment<?> env = KeYEnvironment.load(location, classPaths, bootClassPath, includes);
// Set Taclet options
ChoiceSettings choiceSettings = ProofSettings.DEFAULT_SETTINGS.getChoiceSettings();
HashMap<String, String> oldSettings = choiceSettings.getDefaultChoices();
HashMap<String, String> newSettings = new HashMap<String, String>(oldSettings);
// Load source code
KeYEnvironment<DefaultUserInterfaceControl> env = KeYEnvironment.load(SymbolicExecutionJavaProfile.getDefaultInstance(), location, classPaths, bootClassPath, includes, true); // env.getLoadedProof() returns performed proof if a *.proof file is loaded
try {
// Find method to symbolically execute
KeYJavaType classType = env.getJavaInfo().getKeYJavaType("Number");
IProgramMethod pm = env.getJavaInfo().getProgramMethod(classType,
// Instantiate proof for symbolic execution of the program method (Java semantics)
AbstractOperationPO po = new ProgramMethodPO(env.getInitConfig(),
"Symbolic Execution of: " + pm,
null, // An optional precondition
true, // Needs to be true for symbolic execution!
true); // Needs to be true for symbolic execution!
// po = new ProgramMethodSubsetPO(...); // PO for symbolic execution of some statements within a method (Java semantics)
// po = new FunctionalOperationContractPO(...) // PO for verification (JML semantics)
Proof proof = env.createProof(po);
// Create symbolic execution tree builder
SymbolicExecutionTreeBuilder builder = new SymbolicExecutionTreeBuilder(proof,
false, // Merge branch conditions
false, // Use Unicode?
true, // Use Pretty Printing?
true, // Variables are collected from updates instead of the visible type structure
true); // Simplify conditions
// Optionally, create an SymbolicExecutionEnvironment which provides access to all relevant objects for symbolic execution
SymbolicExecutionEnvironment<DefaultUserInterfaceControl> symbolicEnv = new SymbolicExecutionEnvironment<DefaultUserInterfaceControl>(env, builder);
printSymbolicExecutionTree("Initial State", builder);
// Configure strategy for full exploration
false, // true to apply method contracts instead of inlining,
false, // true to apply loop invariants instead of unrolling,
false, // true to apply block contracts instead of expanding.
false, // true to hide branch conditions caused by symbolic execution within modalities not of interest,
false); // true to perform alias checks during symbolic execution
// Optionally, add a more advanced stop conditions like breakpoints
CompoundStopCondition stopCondition = new CompoundStopCondition();
stopCondition.addChildren(new ExecutedSymbolicExecutionTreeNodesStopCondition(100)); // Stop after 100 nodes have been explored on each branch.
// stopCondition.addChildren(new StepOverSymbolicExecutionTreeNodesStopCondition()); // Perform only a step over
// stopCondition.addChildren(new StepReturnSymbolicExecutionTreeNodesStopCondition()); // Perform only a step return
IBreakpoint breakpoint = new ExceptionBreakpoint(proof, "java.lang.NullPointerException", true, true, true, true, 1);
stopCondition.addChildren(new SymbolicExecutionBreakpointStopCondition(breakpoint)); // Stop at specified breakpoints
// Perform strategy which will stop at breakpoint
printSymbolicExecutionTree("Stopped at Breakpoint", builder);
// Perform strategy again to complete symbolic execution tree
printSymbolicExecutionTree("Stopped at Breakpoint", builder);
finally {
env.dispose(); // Ensure always that all instances of KeYEnvironment are disposed
catch (Exception e) {
System.out.println("Exception at '" + location + "':");
* Prints the symbolic execution tree as flat list into the console.
* @param title The title.
* @param builder The {@link SymbolicExecutionTreeBuilder} providing the root of the symbolic execution tree.
protected static void printSymbolicExecutionTree(String title, SymbolicExecutionTreeBuilder builder) {
System.out.println(StringUtil.createLine("=", title.length()));
ExecutionNodePreorderIterator iterator = new ExecutionNodePreorderIterator(builder.getStartNode());
while (iterator.hasNext()) {
IExecutionNode<?> next =;
// next.getVariables(); // Access the symbolic state.
// next.getCallStack(); // Access the call stack.
// next.getPathCondition(); // Access the path condition.
// next.getFormatedPathCondition(); // Access the formated path condition.
// next... // Additional methods provide access to additional information.
// Check also the specific sub types of IExecutionNode like IExecutionTermination.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment