[[Program Analysis]] using constraint solving to generate inputs that provable cover different parts of the [[SUT]].
- Called [[70024 - Software Reliability/Symbolic Execution]], and is only loosely definable as [[Fuzzing]]
Constraint solving ensures a minimal set of inputs (fast to run, slow to generate) that can perfectly cover entire [[SUT]], including inputs that are extremely unlikely to occur under random testing.
- Limited scalability due to solving overhead
- Requires specialized toolchain