an executable formal semantics of c with applications.pdfVIP

POPL12, ACM, pp 533-544. 2012 An Executable Formal Semantics of C with Applications Chucky Ellison Grigore Rosu , University of Illinois {celliso2, grosu}@illinois.edu Abstract a version of C that includes every language feature except for This paper describes an executable formal semantics of C. Being ex- and types, and that includes only a subset ecutable, the semantics has been thoroughly tested against the GCC of the standard library. Our semantics is the first arguably complete torture test suite and successfully passes 99.2% of 776 test programs. dynamic semantics of C (see Section 2). It is the most complete and thoroughly tested formal definition of C Above all else, our semantics has been motivated by the desire to to date. The semantics yields an interpreter, debugger, state space develop formal, yet practical tools. Our semantics was developed in search tool, and model checker “for free”. The semantics is shown such a way that the single definition could be used immediately for capable of automatically finding program errors, both statically and interpreting, debugging, or analysis (described in Section 6). At the at runtime. It is also used to enumerate nondeterministic behavior. same time, this practicality does not mean that our definition is not formal. Being written in a subset of rewriting logic (RL), it