CRI: Symbolic Debugger for MCAPI Applications

Abstract

Abstract. We present a trace-driven SMT-based symbolic debugging tool for MCAPI (Multicore Association Communication API) applications. MCAPI is a newly proposed standard that provides an API for connectionless and connection-oriented communication in multicore applications. Our tool obtains a trace by executing an instrumented MCAPI. The collected trace is then encoded into an SMT formula such that its satisfiability indicates the existence of a reachable error state such as an assertion failure.

Message Race Detection for Web Services by an SMT-Based Analysis

“…Similar ideas that apply symbolic analysis to detect message races have been reported in [17] [18]. However, the technique has been applied in a different domain on MCAPI (Multicore Association Communication API), which leads to totally different modeling and encoding algorithms.…”

Trace-Driven Verification of Multithreaded Programs

“…4.3 An Illustrative Example Assume the first executed trace is π 1 = (1, 0.1), (1, 1.1), (1, 2.1), (1, 3), (1, 0.2), (1, 1.2), (1, 2.2), (1,5), (1,6), (2,13), (2,14), (2,15), (2,16), (3,13), (3,14), (3,15), (3,16),…”

“…Note that in π 1 we drop the occurrence index if a statement of a thread occurs only once. An under-approximated symbolic analysis on π 1 does not yield an assertion violation, but the over-approximated symbolic analysis produces a counter-example CEX 1 = (1, 0), (1, 1), (2,13), (2,14), (2,15), (1,2), (1,5), (1,7), (1,10), (1,11) , which leads to an assertion failure on Line 11. An execution following CEX 1 shows that the counterexample is spurious as it can only follow up to (1,5), because the else branch on Line 5 cannot be taken.…”

“…An execution following CEX 1 shows that the counterexample is spurious as it can only follow up to (1,5), because the else branch on Line 5 cannot be taken. The complete executed trace is π 2 = (1, 0), (1, 1), (2,13), (2,14), (2,15), (1,2), (1,5), (1,6), (2,16), (1,12) . There is no assertion failure in π 2 , but the counterexample obtained from the over-approximated analysis is CEX 2 = (1, 0), (1, 1), (2, 13), (2, 14), (2, 15), (2, 16), (1, 2), (1, 5), (1, 7), (1, 10), (1, 11) .…”

“…Predictive analysis [28] encodes a single execution symbolically without further refinement. The approach that augments testing with formal analysis has also been applied in other domains such as MCAPI [13,12] and service computing [14].…”