Automated Fault Localization for C Programs

Abstract

If a program does not fulfill a given specification, a model checker delivers a counterexample, a run which demonstrates the wrong behavior. Even with a counterexample, locating the actual fault in the source code is often a difficult task for the verification engineer. We present an automatic approach for fault localization in C programs. The method is based on model checking and reports only components that can be changed such that the difference between actual and intended behavior of the example is removed. To identify these components, we use the bounded model checker CBMC on an instrumented version of the program. We present experimental data that supports the applicability of our approach.

Automatic Fault Localization for Programmable Logic Controllers ★

“…For each component correction logic is inserted in the CDFG as described in [9]. That is, each right-hand side of an expression and all control predicates can be replaced by a non-deterministic value.…”

“…SAT-based debugging [17] partially automates the debugging by finding possible fault locations, i.e., components that can fix the faulty behavior. The usability for complex models was shown for debugging hardware [17] as well as software [9].…”

Fast test suite-driven model-based fault localisation with application to pinpointing defects in student programs

“…What do commonly exist, though, are extensive unit test suites, in particular in the context of modern test-driven design approaches. Griesmayer et al have shown that their technique can (in principle) be extended to work with (failing) test cases, but the published results [23] are prohibitively slow, typically executing in hundreds to thousands of seconds per each small benchmark program. Griesmayer et al have improved the original implementation [24] but only achieve times typically in the hundreds of seconds.…”

“…the identification of program locations that can cause erroneous state transitions that eventually lead to observed program failures, is a critical component of the debugging cycle. Since it puts a significant time [47,50] and expertise burden [1,66] on programmers, a variety of different automated fault localisation methods have been proposed [12,14,23,25,26,34,55,56,58]. We describe a fast model-based fault localisation algorithm that, given a test suite, uses symbolic execution methods to fully automatically identify a small subset of program locations within which (under a single-fault assumption) a genuine program repair exists.…”

“…For example, Griesmayer et al describe a method [23] in which the model (in the form of a logical satisfiability problem) is derived by running the CBMC model checker over a transformed program and then analysed by means of the model checker's integrated SAT solver. The transformation "inverts" the program's specification (cf.…”