Software model checking for distributed systems with selector-based, non-blocking communication

Abstract

Abstract-Many modern software systems are implemented as client/server architectures, where a server handles multiple clients concurrently. Testing does not cover the outcomes of all possible thread and communication schedules reliably. Software model checking, on the other hand, covers all possible outcomes but is often limited to subsets of commonly used protocols and libraries.Earlier work in cache-based software model checking handles implementations using socket-based TCP/IP networking, with one thread per client connection using blocking input/output. Recently, servers using non-blocking, selector-based input/output have become prevalent. This paper describes our work extending the Java PathFinder extension net-iocache to such software, and the application of our tool to modern server software.

Precondition Coverage in Software Testing

“…For object-oriented software, test cases are often designed to cover possible exceptions, but tend to stop at the first exception [8], [19]. This bias was confirmed in our case studies for designing models for network libraries [2], [3]. In this work, we present evidence for a bias for using valid parameters or states over invalid ones, which again shows that incorrect uses of libraries (including multiple incorrect uses) are not sufficiently considered by human testers.…”

Model-based Testing of the Java Network API

“…Our work on testing Java's non-blocking networking (package java.nio) extends previous work where we tested a custom version of that library and found several hidden defects [3]. That custom library was designed to be compatible with Java Pathfinder (JPF) [18] by working with JPF extension net-iocache to backtrack the effects of network input/output [10].…”

“…Our model faithfully reflects all key operations of the Java network library [16], and can be used to analyze different implementations in depth; previous work reports on defects found with our approach [3].…”

“…For example, the number of bytes read may be less or equal than the number of bytes available in the channel. The opposite case, a return value suggesting the availability of data where no data is believed (by the model) to exist, results in a property violation that is shown as an error trace by Modbat [3]. …”

“…Our Modbat model for java.nio expands on an earlier version, which was used to uncover defects in a custom version of the java.nio library but did not use multiple connections [3].…”