Fault localization using a model checker

Abstract

If a program does not fulfill its specification, a model checker can deliver a counterexample. However, although such a counterexample shows how the specification can be violated, it typically comprises large parts of the program and gives little information about which of the visited statements is responsible for the error. In this article, we show that model checkers can also be used to perform model‐based diagnosis and thus fault localization. The approach leads to significantly more precise diagnoses than the state‐of‐the‐art and typically rules out 90–99% of the code as possible fault locations. The approach is general and can be applied to any system that is amenable to model checking (with respect to language and complexity). To demonstrate the applicability and high precision of our approach, we present implementations for C programs using two different model checking tools and show experimental results from the TCAS case study and an integration with the DDVerify framework to debug Linux device drivers. Copyright © 2009 John Wiley & Sons, Ltd.

A Formula-based Approach for Automatic Fault Localization of Multi-fault Programs

“…Automatic fault localization of imperative programs is a well-known problem, and has been studied from various approaches (cf., Refs. [8], [9], [24], [27]). Among these, coveragebased or spectrum-based debugging [11] is considered a promising method.…”

Fast test suite-driven model-based fault localisation with application to pinpointing defects in student programs

“…2 for a more detailed discussion. Griesmayer et al [24] improve the original implementation to achieve times roughly comparable to our own initial re-implementation (see Sect. 4 for details).…”

“…Griesmayer et al have shown that their technique can (in principle) be extended to work with (failing) test cases, but the published results [23] are prohibitively slow, typically executing in hundreds to thousands of seconds per each small benchmark program. Griesmayer et al have improved the original implementation [24] but only achieve times typically in the hundreds of seconds. Approximating model-based fault localisation approaches for test suites, such as Jose and Majumdar's method [34] (cf.…”

Optimising Spectrum Based Fault Localisation for Single Fault Programs Using Specifications

“…Schupman and Bierre [37] generate short counterexamples for use in fault localisation, where a short counterexample will usually mean fewer uuts for the user to inspect. Griesmayer [38] and Birch et al [39] use model checkers to find failing executions and then look for whether a given number of changes to values of variables can be made to make the counterexample disappear. Gopinath et al [40] compute minimal unsatisfiable cores in a given failing test case, where statements in the core will be given a higher suspiciousness level in the spectra ranking.…”