Using symbolic execution and data flow criteria to aid test data selection

The utilization is described of a data flow path selection criterion in a symbolic execution system. The system automatically generates a subset of program paths according to a certain control flow criterion. This subset is called the ZOT‐subset, since it requires paths that traverse loops zero, one and two times. Experience indicates that traversing this subset of program paths is enough to cover most control flow and data flow components of the program. The problem with the ZOT‐subset is that it might contain, for large programs, a large number of paths. The number of paths in this subset can be reduced by concentrating on executable paths that cover vital components of programs such as data flow components. This object is achieved by employing a data flow path selection criterion in the system. The system symbolically executes the paths of the ZOT‐subset, and creates a system of branch conditions for each one. The user determines infeasible paths by checking the consistency of each system of conditions. The system selects feasible paths from the ZOT‐subset that cover the data flow criterion. Solving the systems of conditions of the selected paths provides the user with test data to fulfil the given data flow criterion.