Model and Program Repair via SAT Solving

Attie, Paul C.; Bab, Kinan Dak Al; Sakr, Mouhammad

doi:10.1145/3147426

Cited by 6 publications

(10 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The rules we consider are replacing a + operator with aoperator, and vice versa, replacing a < operator with a > operator, and vice versa, and increasing or decreasing a numerical constant by 1. 4 Example 1. In this example we demonstrate how different repair schemes define different sets of relevant locations.…”

Section: Must Fault Localizationmentioning

confidence: 99%

“…In the literature there is also a wide range of techniques for automated program repair using formal methods [4,10,19,22,29,32,33,42]. Both [11] and [37] also use fault localization followed by applying mutations for repair.…”

Section: Related Workmentioning

confidence: 99%

“…If st is an assignment, its expression is its right-hand-side. If st is a conditional statement, its expression is its condition 4. This simple definition of the mutation scheme is used only for simplicity of presentation.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Must Fault Localization for Program Repair

Rothenberg

Grumberg

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This work is concerned with fault localization for automated program repair. We define a novel concept of a must location set. Intuitively, such a set includes at least one program location from every repair for a bug. Thus, it is impossible to fix the bug without changing at least one location from this set. A fault localization technique is considered a must algorithm if it returns a must location set for every buggy program and every bug in the program. We show that some traditional fault localization techniques are not must. We observe that the notion of must fault localization depends on the chosen repair scheme, which identifies the changes that can be applied to program statements as part of a repair. We develop a new algorithm for fault localization and prove that it is must with respect to commonly used schemes in automated program repair. We incorporate the new fault localization technique into an existing mutation-based program repair algorithm. We exploit it in order to prune the search space when a buggy mutated program has been generated. Our experiments show that must fault localization is able to significantly speed-up the repair process, without losing any of the potential repairs.

show abstract

Section: Must Fault Localizationmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Must Fault Localization for Program Repair

Rothenberg

Grumberg

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…(P [c])(i) = o (similar to our template-based synthesis formulation in Definition 1) and solves the problem using a SAT solver. Other synthesis and program repair researches, e.g., [4,29,32,44,45], also use similar formulation to integrate verification tools, e.g., test-input generation, to synthesize desired programs. In general, such integrations are common in many ongoing synthesis works including the multi-disciplinary ExCAPE project [14] and the SyGuS competition [46], and have produced many practical and useful tools such as Sketch that generates low-level bit-stream programs [40], Autograder that provides feedback on programming homework [39], and FlashFill that constructs Excel macros [19,20].…”

Section: Related Workmentioning

confidence: 99%

Connecting Program Synthesis and Reachability: Automatic Program Repair using Test-Input Generation

Nguyen¹,

Weimer²,

Kapur³

et al. 2019

Preprint

View full text Add to dashboard Cite

We prove that certain formulations of program synthesis and reachability are equivalent. Specifically, our constructive proof shows the reductions between the template-based synthesis problem, which generates a program in a pre-specified form, and the reachability problem, which decides the reachability of a program location. This establishes a link between the two research fields and allows for the transfer of techniques and results between them. To demonstrate the equivalence, we develop a program repair prototype using reachability tools. We transform a buggy program and its required specification into a specific program containing a location reachable only when the original program can be repaired, and then apply an off-theshelf test-input generation tool on the transformed program to find test values to reach the desired location. Those test values correspond to repairs for the original program. Preliminary results suggest that our approach compares favorably to other repair methods.

show abstract

“…For faults in the internal behavior of a process, the approach we propose is similar to existing repair approaches [5,37]: we start with a non-deterministic implementation, and restrict non-determinism to obtain a correct implementation. This non-determinism may have been added by a designer to "propose" possible repairs for a system that is known or suspected to be faulty.…”

Section: Introductionmentioning

confidence: 99%

Automatic Repair and Deadlock Detection for Parameterized Systems

Jacobs¹,

Sakr²,

Völp³

2021

Preprint

Self Cite

View full text Add to dashboard Cite

We present an algorithm for the repair of parameterized systems. The repair problem is, for a given process implementation, to find a refinement such that a given property is satisfied by the resulting parameterized system, and deadlocks are avoided. Our algorithm employs a constraint-based search for candidate repairs, and uses a parameterized model checker to determine their correctness and update the constraint system in case errors are reachable. We apply this algorithm on systems that can be represented as well-structured transition systems (WSTS), including disjunctive systems, pairwise rendezvous systems, and broadcast protocols. Moreover, we show that parameterized deadlock detection can be decided in NEXPTIME for disjunctive systems, vastly improving on the best known lower bound, and that it is in general undecidable for broadcast protocols.Contributions. Our main contribution is a counterexample-guided parameterized repair approach, based on model checking of well-structured transition systems (WSTS) [1,30]. We investigate which information a parameterized model checker needs to provide to guide the search for candidate repairs, and how this information can be encoded into propositional constraints. Moreover, we investigate how to systematically avoid deadlocks in the repaired system. Our repair algorithm supports many classes of systems, including guarded protocols with disjunctive guards [20], rendezvous systems [33] and broadcast protocols [24].Since existing model checking algorithms for WSTS do not support deadlock detection, our approach has a subprocedure to solve this problem, which relies on new theoretical results: for disjunctive systems, we provide a novel deadlock detection algorithm that vastly improves on the complexity of the best known solution, while for broadcast protocols we prove that deadlock detection is in general undecidable, so approximate methods have to be used. We evaluate an implementation of our algorithm on benchmarks from different application domains, including a distributed lock service and a robot-flocking protocol.This paper is organized as follows. In Sect. 2 we present our basic system model for disjunctive systems. In Sect. 3 we define the parameterized repair problem, propose a solution, and highlight three research challenges. In Sect. 4 we develop algorithms for parameterized model checking and deadlock detection that provide information on error paths for our repair approach. In Sect. 5 we introduce our parameterized repair algorithm, and in Sect. 6 we extend it to more general properties and systems. We provide our experimental evaluation in Sect. 7, followed by a discussion of related work in Sect. 8, and our conclusion and discussion of future work in Sect. 9. System ModelIn the following, let Q be a finite set of states.Processes. A process template is a transition system U = (Q U , init U , G U , δ U ), where Q U ⊆ Q is a finite set of states including the initial state init U , G U ⊆ P(Q) is a set of guards, and δ U :We denote by t U a transition of U ,...

show abstract

Model and Program Repair via SAT Solving

Abstract: We consider the following model repair problem: given a finite Kripke structure M and a specification formula η in some modal or temporal logic, determine if M contains a substructure M ′ (with the same initial state) that satisfies η. Thus, M can be "repaired" to *

Cited by 6 publications

References 33 publications

Must Fault Localization for Program Repair

Must Fault Localization for Program Repair

Connecting Program Synthesis and Reachability: Automatic Program Repair using Test-Input Generation

Automatic Repair and Deadlock Detection for Parameterized Systems

Contact Info

Product

Resources

About