Symbolic Execution for Runtime Error Detection and Investigation of Refactoring Activities Based on a New Dataset

It is a big challenge in software engineering to produce huge, reliable and robust software systems. In industry, developers typically have to focus on solving problems quickly. The importance of code quality in time pressure is frequently secondary. However, software code quality is very important, because a too complex, hard-to-maintain code results in more bugs, and makes further development more expensive. The research work behind this thesis is inspired by the wish to develop high quality software systems in industry in a more effective and easier way to make the lives of customers and eventually end-users more comfortable and more effective. The thesis consists of two main topics: the utilization of symbolic execution for runtime error detection and the investigation of practical refactoring activity. Both topics address the area of program source code quality. Symbolic execution is a program analysis technique which explores the possible execution paths of a program by handling the inputs as unknown variables (symbolic variables). The main usages of symbolic execution are generating inputs of program failure and high-coverage test cases. It is able to expose defects that would be very difficult and timeconsuming to find through manual testing, and would be exponentially more costly to fix if they were not detected until runtime. In this work, we focus on runtime error detection (such as null pointer dereference, bad array indexing, division by zero, etc.) by discovering critical execution paths in Java programs. One of the greater challenges in symbolic execution is the very large number of possible execution paths, which increas exponentially. Our research proposes approaches to handling the aforementioned problem of path explosion by applying symbolic execution at the level of methods. We also investigated the limitations of this state space together with the development of efficient search heuristics. To make the detection of runtime errors more accurate, we propose a novel algorithm that keeps track of the conditions above symbolic variables during the analysis. Source code refactoring is a popular and powerful technique for improving the internal structure of software systems. The concept of refactoring was introduced by Martin Fowler. He originally proposed that detecting code smells should be the primary technique for identifying refactoring opportunities in the code. However, we lack empirical research results on how, when and why refactoring is used in everyday software development, what are its effects on short- and long-term maintainability and costs. By getting answers to these questions, we could understand how developers refactor code in practice, which would help propose new methods and tools for them that are aligned with their current habits leading to more effective software engineering methodologies in the industry. To help further empirical investigations of code refactoring, we proposed a publicly available refactoring dataset. The dataset consists of refactorings and source code metrics of open-source Java systems. We subjected the dataset to an analysis of the effects of code refactoring on source code metrics and maintainability, which are primary quality attributes in software development

SUBRANGE DATA TYPE APPLIED TO DEFINITION OF SUCH VIRTUAL COORDINATE SYSTEMS WHERE THE DOMAINS ARE CONSTRAINED BY GEOMETRIC BOUNDARIES OF EACH OBJECT

Modern dynamic program languages such as ADA, PASCAL, MODULA'2 give us further possibilities to generalize the idea of classical real numbers. There are many applications in GIS where it is not possible to effectively model the invidual values of attributes neither with integer data type (N) nor positive integer numbers (Z). For instance an elevation of object such as attributes could oscillate between lower and upper limits. Those limits are always determined by the information environment. In case of subrange data type the declaration may be the following: high-type = 200 ... 700, where 200 is the lower and 700 is the upper limit within a territory

Comparison of Different Standards Based on Computing the Probability of Failure of Flood Protection Dikes

Flood damage poses a major threat to many countries across Europe. One of the most disadvantageous communities is Hungary, especially in view of the fact that 23% of the total area is situated on floodplain. 97% of this region is protected by flood control dikes and the remaining 3% is generally low-value zone. Through the decades different design methods referring to flood protection dikes have been recommended with newer and newer safety factors. In a few areas of geotechnical engineering – with the presence of Eurocode 7 – the reliability based design came to the front. The performance of a certain embankment cannot be compared by considering only the safety factors of the different theories but based on computing the probability of failure values it becomes possible. The article aims to show a method of how to define the input parameters and calculate the probability of failure of a flood protection dike. Hence the reliability of different standards can be compared

The optimization of a symbolic execution engine for detecting runtime errors

In a software system, most of the runtime failures may come to light only during test execution, and this may have a very high cost. To help address this problem, a symbolic execution engine called RTEHunter, which has been developed at the Department of Software Engineering at the University of Szeged, is able to detect runtime errors (such as null pointer dereference, bad array indexing, division by zero) in Java programs without actually running the program in a real-life environment. Applying the theory of symbolic execution, RTEHunter builds a tree, called a symbolic execution tree, composed of all the possible execution paths of the program. RTEHunter detects runtime issues by traversing the symbolic execution tree and if a certain condition is fulfilled the engine reports an issue. However, as the number of execution paths increases exponentially with the number of branching points, the exploration of the whole symbolic execution tree becomes impossible in practice. To overcome this problem, different kinds of constraints can be set up over the tree. E.g. the number of symbolic states, the depth of the execution tree, or the time consumption could be restricted. Our goal in this study is to find the optimal parametrization of RTEHunter in terms of the maximum number of states, maximum depth of the symbolic execution tree and search strategy in order to find more runtime issues in a shorter time. Results on three open-source Java systems demonstrate that more runtime issues can be detected in the 0 to 60 basic block-depth levels than in deeper ones within the same time frame. We also developed two novel search strategies for traversing the tree based on the number of null pointer references in the program and on linear regression that performs better than the default depth-first search strategy

Az őrbottyáni 50 éves örök rozs és egyéb műtrágyázási tartamkísérletek tanulságai

A homoktalajok védelme, javítása, termékenységük megőrzése hazánkban kiemelt figyelmet érdemel,mert a hasznosított mezőgazdasági területünk 1-5-ét homokos területek képviselik. Itt terem a zöldség, a gyümölcs, dohány és egyéb növényeink jelentős hányada, mely döntően befolyásolja a hazai lakosság ellátását, valamint a mezőgazdaság exportképességét. másrészről a falusi népesség megélhetésének szinte egyedüli forrását helyenként az e talajon folyó gazdálkodás jelenti munkaalkalmat teremtve. A homok talajok javításával, trágyázásával nyert évtizedes eredményeket és javaslatokat fogalmaz meg a termékenység megőrzését szolgáló egyszerű és környezetkímélő eljárásokra a Duna-Tisza közi őrbottyányi örökrozs és egyéb kísérletek félévszázados eredményeire támaszkodva. a könyv egyaránt ajánlható a kutatás, az oktatás, szaktanácsadás számára

Runtime exception detection in Java programs using symbolic execution

Most of the runtime failures of a software system can be revealed during test execution only, which has a very high cost. In Java programs, runtime failures are manifested as unhandled runtime exceptions. In this paper we present an approach and tool for detecting runtime exceptions in Java programs without having to execute tests on the software. We use the symbolic execution technique to implement the approach. By executing the methods of the program symbolically we can determine those execution branches that throw exceptions. Our algorithm is able to generate concrete test inputs also that cause the program to fail in runtime. We used the Symbolic PathFinder extension of the Java PathFinder as the symbolic execution engine. Besides small example codes we evaluated our algorithm on three open source systems: jEdit, ArgoUML, and log4j. We found multiple errors in the log4j system that were also reported as real bugs in its bug tracking system

Hálózatszennyezést megszüntető impulzusszélesség-modulációs áramirányítók fejlesztése = Network pollution free solution with pulsewidth-modulated rectifiers.

Elkészültek a hálózatbarát átalakítók szimulációs programjai (egy- és háromfázisú betáplálásra, valamint a motor és a hálózati oldali inverter különböző szabályozási algoritmusokra). Megvizsgáltuk a hálózati és a motor oldali inverterterek hiszterézises ISZM áramszabályozását, illetve a vivőfrekvenciás ISZM módszereket a hajtás mind motoros, mind generátoros üzemére. Irodalmi és kutatási szinten foglalkoztunk a háromszintű invereterek alkalmazásával is. Kifejlesztettünk és üzembe helyeztünk egy hálózatbarát frekvenciaváltó berendezést. A motor oldali inverter mezőorientált szabályozású, míg a hálózat oldali inverter biztosítja a közbenső egyenfeszültség szabályozását, valamint a hálózati áram közel szinuszos alakját, illetve a hálózati meddő teljesítmény zérus értékét. Üzembe helyeztünk egy CEGELEC gyártmányú hálózatbarát hajtásvezérlő berendezést is, amely régebben került a tanszékre. A hajtás vezérlése mikroprocesszoros, kezelése számítógépes irányítású. A szimulációs programokat és a berendezéseket felhasználtuk a nappali tagozatos hallgatók gyakorlatainál és önálló laboratóriumhoz, valamint tudományos munkához. A mérési és kutatási eredmények több diplomatervben, ill. mérési jegyzőkönyvben, illetve 15 cikkben foglaltuk össze. A laboratóriumi mérési utasítás elkészült. Jelentős előreléptünk az irodalmi és elméleti kutatómunkában az áramgenerátoros táplálású és ISZM vezérlésű hálózati áramirányítók területén. Az eredményekről két cikkben számoltunk be. | The simulation programs for network pollution free PWM rectifier of ac drives (for single or three phase networks and for several control algorithms of the motor and network side inverters) were worked out. The drives were investigated for both the motor and the generator operation modes as well for current two-point PWM methods and for different carrier-based PWM ones. The PWM methods of three-level inverters were summarized and investigated. A 7 kVA drive with PWM rectifier was developed and put into operation. The flux oriented control is used on motor side inverter while the network side converter controls the dc side voltage and ensures the network nearly sinusoidal current and the reactive power zero value as well. Similar ancient CEGELEC product equipment was also put into operation. This drive has microprocessor system and can be PC controlled. The simulation programs and the test equipments were used for the investigation and the test measurements in the ordinary student laboratory practice, at the preparation for Master and Doctor degrees, and for other scientific efforts as well. The results are presented in more diploma works and test reports as well as in 15 papers. The instruction for student laboratory practice was prepared. The PWM methods of network rectifiers with current source supply were summarizes and investigated. The results are given in two papers