We propose a new Statistical Model Checking (SMC) method to
identify bugs in variability-intensive systems (VIS). The
state-space of such systems is exponential in the number of
variants, which makes the verification problem harder than for
classical systems. To reduce verification time, we propose to
combine SMC with featured transition systems (FTS)—a
model that represents jointly the state spaces of all variants. Our
new methods allow the sampling of executions from one or more
(potentially all) variants. We investigate their utility in two
complementary use cases. The first case considers the problem of
finding all variants that violate a given property expressed in
Linear-Time Logic (LTL) within a given simulation budget. To achieve
this, we perform random walks in the featured transition system
seeking accepting lassos. We show that our method allows us to find
bugs much faster (up to 16 times according to our experiments) than
exhaustive methods. As any simulation-based approach, however, the
risk of Type-1 error exists. We provide a lower bound and an upper
bound for the number of simulations to perform to achieve the
desired level of confidence. Our empirical study involving 59
properties over three case studies reveals that our method manages
to discover all variants violating 41 of the properties.
This indicates that SMC can act as a coarse-grained
analysis method to quickly identify the set of buggy variants.
The second case complements the first one. In case the
coarse-grained analysis reveals that no variant can guarantee to
satisfy an intended property in all their executions, one should
identify the variant that minimizes the probability of violating
this property. Thus, we propose a fine-grained SMC method that
quickly identifies promising variants and accurately estimates their
violation probability. We evaluate different selection strategies
and reveal that a genetic algorithm combined with elitist selection
yields the best results.