Fault localization in embedded software based on a single cyclic trace

Abstract

Abstract-Locating faults in embedded software, especially in microcontrollers, is still difficult. Quite recently, it became possible to recover execution traces from microcontrollers using specific hardware probes. However, the collected traces contain a huge volume of low-level data. Consequently, manual analysis is difficult and our industrial partners call for automatic and more effective fault-localization methods for embedded software.This paper presents a new approach to automatically locate faults in embedded programs given a single faulty execution trace. Our approach exploits the cyclic nature of embedded programs and uses several adapted spectrum-based methods in order to find faults on a single execution, rather than a set of multiple failing and passing executions. Our approach is implemented in the tool CoMET and evaluated on several faulty programs. The evaluation shows that our single-trace faultlocalization method using Ochiai [1] allows engineers to find a fault by inspecting less than 5% of the program in most cases, and it confirms the interest of automatic fault localization for microcontrollers.

Introduction to Runtime Verification

“…In MTL, temporal operators are annotated with discrete time intervals, e.g. ϕ U [3,7] ψ states that ψ should hold between 3 and 7 time units from now and until then ϕ should hold. MTL also contains the notion of congruences that allow one to state that a formula should hold periodically with respect to an absolute time.…”

“…Later we point out work that combines regular expressions and temporal logic as they are declarative approaches with different advantages. Whilst regular expressions have been extended with a quantitative notion of time [7] and to handle data words [111], such extensions have not received much interest in runtime verification.…”

On the Runtime Enforcement of Timed Properties

“…In the case of softwarebased instrumentation, it can operate at the level of the source (language) of the application system, its intermediate representation (IR), the binary, or using library interposition. Hardware-based instrumentation [8,9,75,99] can be for instance realized by observing and controlling the system through a JTAG port and using dedicated hardware (e.g., an FPGA).…”