Correct and Complete Symbolic Execution for Free
Pith reviewed 2026-06-26 12:33 UTC · model grok-4.3
The pith
Symbolic SOS rules generate concrete and symbolic semantics that are provably correct and complete.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
Symbolic SOS is a rule format that allows simultaneous specification of concrete and symbolic operational semantics. When symbolic semantics are generated from symbolic SOS, they are both correct and complete with respect to the corresponding concrete semantics. The approach relies only on an algebraic signature of the source language.
What carries the argument
Symbolic SOS rule format that extends standard SOS rules to handle symbolic variables and side conditions while preserving the concrete semantics.
If this is right
- Symbolic execution tools can be derived automatically from a single semantics specification.
- Correctness and completeness hold uniformly for all languages fitting the rule format.
- No separate proof is needed for each language's symbolic semantics.
Where Pith is reading between the lines
- The method could reduce duplication in verification frameworks that currently maintain separate concrete and symbolic interpreters.
- Languages with non-SOS features such as higher-order effects or concurrency primitives might need extensions to the rule format before the guarantees apply.
Load-bearing premise
Any programming language can be given a complete operational semantics as a finite set of SOS rules over an algebraic signature.
What would settle it
A language whose semantics require rules outside finite SOS over an algebraic signature, or a program where the generated symbolic execution produces a path with no concrete counterpart.
Figures
read the original abstract
Symbolic execution is a powerful technique for program analysis. However, the formal semantics underlying symbolic execution is often developed on an ad-hoc basis and decoupled from the concrete semantics of the programming language. To overcome this issue, we introduce symbolic SOS: a rule format that allows us to simultaneously specify concrete and symbolic operational semantics. We prove that symbolic semantics, when generated from symbolic SOS, is both correct and complete with respect to the corresponding concrete semantics. The approach relies only on an algebraic signature of the source language, and is thus language-independent.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces symbolic SOS, a rule format that allows simultaneous specification of concrete and symbolic operational semantics for a programming language given only its algebraic signature. It proves that the symbolic semantics generated from symbolic SOS rules is both correct and complete with respect to the corresponding concrete semantics, and claims the result is language-independent.
Significance. If the proof is valid, the work supplies a reusable, signature-based method for obtaining verified symbolic execution semantics directly from standard SOS rules. This addresses the common problem of ad-hoc symbolic semantics and could improve the reliability of symbolic execution tools across languages by construction.
minor comments (2)
- The abstract and introduction should explicitly restate the scope condition (finite SOS rules over an algebraic signature) as a prerequisite rather than only as a strength, to make the applicability limits clear to readers.
- Add a small worked example (e.g., a simple imperative language fragment) showing how a concrete SOS rule is turned into its symbolic counterpart; this would make the generation process and the correctness argument easier to follow.
Simulated Author's Rebuttal
We thank the referee for the positive assessment of our paper and the recommendation of minor revision. No major comments were provided in the report.
Circularity Check
No significant circularity
full rationale
The paper's central result is a direct proof that symbolic semantics generated from a finite set of symbolic SOS rules over an algebraic signature is correct and complete w.r.t. the corresponding concrete semantics. This relationship is established by construction from the shared rule format and signature, without fitted parameters, self-referential definitions, or load-bearing self-citations. The derivation is self-contained as a language-independent theorem under the stated assumptions on the operational semantics format.
Axiom & Free-Parameter Ledger
axioms (2)
- domain assumption Every language of interest admits a complete operational semantics expressed as a finite set of SOS rules over an algebraic signature.
- standard math Standard properties of algebraic signatures and SOS rule formats hold (e.g., substitution, congruence).
invented entities (1)
-
symbolic SOS rule format
no independent evidence
Reference graph
Works this paper leans on
-
[1]
Ahrendt, W., Beckert, B., Bubel, R., Hähnle, R., Schmitt, P.H., Ulbrich, M. (eds.): Deductive Software Verification - The KeY Book - From Theory to Prac- tice, Lecture Notes in Computer Science, vol. 10001. Springer (2016).https: //doi.org/10.1007/978-3-319-49812-6
-
[2]
In: Erwig, M., Paige, R.F., Wyk, E.V
Arusoaie, A., Lucanu, D., Rusu, V.: A generic framework for symbolic execu- tion. In: Erwig, M., Paige, R.F., Wyk, E.V. (eds.) Software Language Engineer- ing - 6th International Conference, SLE 2013, Indianapolis, IN, USA, October 26-28, 2013. Proceedings. Lecture Notes in Computer Science, vol. 8225, pp. 281–
2013
-
[3]
Springer (2013).https://doi.org/10.1007/978-3-319-02654-1_16,https: //doi.org/10.1007/978-3-319-02654-1_16
-
[4]
ACM Computing Surveys (CSUR)51(3), 1–39 (2018)
Baldoni, R., Coppa, E., D’elia, D.C., Demetrescu, C., Finocchi, I.: A survey of sym- bolic execution techniques. ACM Computing Surveys (CSUR)51(3), 1–39 (2018)
2018
-
[5]
Berdine, J., Calcagno, C., O’Hearn, P.W.: Symbolic execution with separation logic. In: Yi, K. (ed.) Proc. Third Asian Symposium on Programming Languages and Systems (APLAS 2005). Lecture Notes in Computer Science, vol. 3780, pp. 52–68. Springer (2005),https://doi.org/10.1007/11575467_5 18 E. Voogd et al
-
[6]
Bloom, B., Istrail, S., Meyer, A.R.: Bisimulation can’t be traced. J. ACM42(1), 232––268 (Jan 1995).https://doi.org/10.1145/200836.200876
-
[7]
Bodin, M., Gardner, P., Jensen, T., Schmitt, A.: Skeletal semantics and their inter- pretations. Proc. ACM Program. Lang.3(POPL) (jan 2019).https://doi.org/ 10.1145/3290357
-
[8]
In: Proceedings of the 2015 Conference on Certified Programs and Proofs
Bodin, M., Jensen, T., Schmitt, A.: Certified abstract interpretation with pretty- big-step semantics. In: Proceedings of the 2015 Conference on Certified Programs and Proofs. p. 29–40. CPP ’15, Association for Computing Machinery (2015). https://doi.org/10.1145/2676724.2693174
-
[9]
In: ter Beek, M.H., McIver, A., Oliveira, J.N
de Boer, F.S., Bonsangue, M.: On the nature of symbolic execution. In: ter Beek, M.H., McIver, A., Oliveira, J.N. (eds.) Formal Methods – The Next 30 Years. pp. 64–80. Springer International Publishing, Cham (2019)
2019
-
[10]
Formal As- pects of Computing33(4), 617–636 (2021)
de Boer, F.S., Bonsangue, M.: Symbolic execution formally explained. Formal As- pects of Computing33(4), 617–636 (2021)
2021
-
[11]
Boyer, R.S., Elspas, B., Levitt, K.N.: SELECT - a formal system for testing and debugging programs by symbolic execution. In: Shooman, M.L., Yeh, R.T. (eds.) Proc. International Conference on Reliable Software 1975. pp. 234–245. ACM (1975).https://doi.org/10.1145/800027.808445
-
[12]
In: Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation
Fragoso Santos, J., Maksimović, P., Ayoun, S.É., Gardner, P.: Gillian, part i: A multi-language platform for symbolic execution. In: Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation. pp. 927–942 (2020)
2020
-
[13]
van Glabbeek, R.J.: The meaning of negative premises in transition system specifications II. J. Log. Algebraic Methods Program.60-61, 229–258 (2004). https://doi.org/10.1016/J.JLAP.2004.03.007,https://doi.org/10.1016/j. jlap.2004.03.007
-
[14]
Leibniz International Proceedings in Informatics (LIPIcs), vol
Goncharov, S., Milius, S., Schröder, L., Tsampas, S., Urbat, H.: Stateful Structural OperationalSemantics.In:Felty,A.P.(ed.)7thInternationalConferenceonFormal Structures for Computation and Deduction (FSCD 2022). Leibniz International Proceedings in Informatics (LIPIcs), vol. 228, pp. 30:1–30:19. Schloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl...
-
[15]
Groote, J.F.: Transition system specifications with negative premises. Theor. Comput. Sci.118(2), 263–299 (1993).https://doi.org/10.1016/0304-3975(93) 90111-6,https://doi.org/10.1016/0304-3975(93)90111-6
-
[16]
ACM SIGPLAN Notices10(6), 143–155 (1975)
Katz, S., Manna, Z.: Towards automatic debugging of programs. ACM SIGPLAN Notices10(6), 143–155 (1975)
1975
-
[17]
Communications of the ACM 19(7), 385–394 (1976)
King, J.C.: Symbolic execution and program testing. Communications of the ACM 19(7), 385–394 (1976)
1976
-
[18]
Klin, B., Nachyla, B.: Some undecidable properties of SOS specifications. J. Log. Algebraic Methods Program.87, 94–109 (2017).https://doi.org/10.1016/J. JLAMP.2016.08.005,https://doi.org/10.1016/j.jlamp.2016.08.005
work page doi:10.1016/j 2017
-
[19]
Journal of Symbolic Computation80, 125–163 (2017)
Lucanu, D., Rusu, V., Arusoaie, A.: A generic framework for symbolic execution: A coinductive approach. Journal of Symbolic Computation80, 125–163 (2017)
2017
-
[20]
In: Silva, A., Leino, K.R.M
Maksimović, P., Ayoun, S.É., Santos, J.F., Gardner, P.: Gillian, part II: Real-world verification for JavaScript and C. In: Silva, A., Leino, K.R.M. (eds.) Computer Aided Verification. pp. 827–850. Springer (2021)
2021
-
[21]
Plotkin, G.D.: A structural approach to operational semantics. J. Log. Algebraic Methods Program.60-61, 17–139 (2004), originally a tech. report from Aarhus University, 1981. Correct and Complete Symbolic Execution for Free 19
2004
-
[22]
Porncharoenwase, S., Nelson, L., Wang, X., Torlak, E.: A formal foundation for symbolic evaluation with merging. Proc. ACM Program. Lang.6(POPL) (jan 2022).https://doi.org/10.1145/3498709
-
[23]
In: Peled, D., Pretschner, A
Rosu,G.:K-asemanticframeworkforprogramminglanguagesandformalanalysis tools. In: Peled, D., Pretschner, A. (eds.) Dependable Software Systems Engineer- ing. NATO Science for Peace and Security, IOS Press (2017)
2017
-
[24]
Stefanescu, A., Ciobâcă, Ş., Mereuta, R., Moore, B.M., Serbanuta, T., Rosu, G.: All-path reachability logic. In: Dowek, G. (ed.) Proc. Joint International Con- ference on Rewriting and Typed Lambda Calculi (RTA-TLCA 2014). Lecture Notes in Computer Science, vol. 8560, pp. 425–440. Springer (2014),https: //doi.org/10.1007/978-3-319-08918-8_29
-
[25]
Steinhöfel, D.: Abstract execution: automatically proving infinitely many pro- grams. Ph.D. thesis, Technische Universität Darmstadt (2020)
2020
-
[26]
In: Pro- ceedings of Twelfth Annual IEEE Symposium on Logic in Computer Science
Turi, D., Plotkin, G.: Towards a mathematical operational semantics. In: Pro- ceedings of Twelfth Annual IEEE Symposium on Logic in Computer Science. pp. 280–291 (1997).https://doi.org/10.1109/LICS.1997.614955
-
[27]
by induction
Voogd, E., Johnsen, E.B., Silva, A., Susag, Z.J., Wasowski, A.: Symbolic semantics for probabilistic programs. In: Proc. 20th Intl. Conf. on Quantitative Evaluation of SysTems (QEST 2023). Lecture Notes in Computer Science, vol. 14287, pp. 329–345. Springer (2023) A Proofs In the proofs of Lemmas 1 and 2, we will use some universal algebra. The family εof...
2023
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.