Fast Model-Based Fault Localisation with Test Suites

Fault localisation, i.e. the identification of program locations that cause errors, takes significant effort and cost. We describe a fast model-based fault localisation algorithm which, given a test suite, uses symbolic execution methods to fully automatically identify a small subset of program locations where genuine program repairs exist. Our algorithm iterates over failing test cases and collects locations where an assignment change can repair exhibited faulty behaviour. Our main contribution is an improved search through the test suite, reducing the effort for the symbolic execution of the models and leading to speed-ups of more than two orders of magnitude over the previously published implementation by Griesmayer et al.

[1]  Emina Torlak,et al.  Angelic debugging , 2011, 2011 33rd International Conference on Software Engineering (ICSE).

[2]  Roderick Bloem,et al.  Fault localization using a model checker , 2010 .

[3]  Brian C. Williams,et al.  Diagnosing Multiple Faults , 1987, Artif. Intell..

[4]  Alex Groce,et al.  What Went Wrong: Explaining Counterexamples , 2003, SPIN.

[5]  Rolf Drechsler,et al.  Debugging Design Errors by Using Unsatisfiable Cores , 2008, MBMV.

[6]  Greg Nelson,et al.  Simplification by Cooperating Decision Procedures , 1979, TOPL.

[7]  Nikolaj Bjørner,et al.  Z3: An Efficient SMT Solver , 2008, TACAS.

[8]  Baowen Xu,et al.  A theoretical analysis of the risk evaluation formulas for spectrum-based fault localization , 2013, TSEM.

[9]  Steven P. Reiss,et al.  Fault localization with nearest neighbor queries , 2003, 18th IEEE International Conference on Automated Software Engineering, 2003. Proceedings..

[10]  Iris Vessey,et al.  Expertise in Debugging Computer Programs: A Process Analysis , 1984, Int. J. Man Mach. Stud..

[11]  Roderick Bloem,et al.  Automated Fault Localization for C Programs , 2007, V&D@FLoC.

[12]  Rolf Drechsler,et al.  Automatic TLM Fault Localization for SystemC , 2012, IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems.

[13]  RothermelGregg,et al.  Supporting Controlled Experimentation with Testing Techniques , 2005 .

[14]  Lee Naish,et al.  A model for spectra-based software diagnosis , 2011, TSEM.

[15]  Raúl A. Santelices,et al.  Lightweight fault-localization using multiple coverage types , 2009, 2009 IEEE 31st International Conference on Software Engineering.

[16]  Stephen A. Cook,et al.  The complexity of theorem-proving procedures , 1971, STOC.

[17]  Dawson R. Engler,et al.  EXE: automatically generating inputs of death , 2006, CCS '06.

[18]  Bernd Fischer,et al.  SMT-Based Bounded Model Checking for Embedded ANSI-C Software , 2012, IEEE Transactions on Software Engineering.

[19]  Roderick Bloem,et al.  Automated error localization and correction for imperative programs , 2011, 2011 Formal Methods in Computer-Aided Design (FMCAD).

[20]  Dawei Qi,et al.  SemFix: Program repair via semantic analysis , 2013, 2013 35th International Conference on Software Engineering (ICSE).

[21]  Roderick Bloem,et al.  Automatic Error Localization for Software Using Deductive Verification , 2014, Haifa Verification Conference.

[22]  Rupak Majumdar,et al.  Cause clue clauses: error localization using maximum satisfiability , 2010, PLDI '11.

[23]  Thomas J. Ostrand,et al.  Experiments on the effectiveness of dataflow- and control-flow-based test adequacy criteria , 1994, Proceedings of 16th International Conference on Software Engineering.

[24]  Vikram S. Adve,et al.  Using likely invariants for automated software fault localization , 2013, ASPLOS '13.

[25]  Hoang Pham.  Software Reliability , 1999 .

[26]  H. Cleve,et al.  Locating causes of program failures , 2005, Proceedings. 27th International Conference on Software Engineering, 2005. ICSE 2005..

[27]  Andreas Zeller,et al.  Yesterday, my program worked. Today, it does not. Why? , 1999, ESEC/FSE-7.

[28]  Peter C. Cheeseman,et al.  Where the Really Hard Problems Are , 1991, IJCAI.

[29]  Roderick Bloem,et al.  Repair with On-The-Fly Program Analysis , 2012, Haifa Verification Conference.

[30]  Mary Jean Harrold,et al.  Empirical evaluation of the tarantula automatic fault-localization technique , 2005, ASE.

[31]  Raymond Reiter,et al.  A Theory of Diagnosis from First Principles , 1986, Artif. Intell..

[32]  Daniele Theseider Dupré,et al.  Model-Based Diagnosis Meets Error Diagnosis in Logic Programs , 1993, IJCAI.

[33]  Alex Groce,et al.  SPECIAL S ECTION O N T OOLS A ND A LGORITHMS F OR THE C ONSTRUCTION A ND A NALYSIS O F S YSTEMS , 2005 .

[34]  Roderick Bloem,et al.  Fault Localization and Correction with QBF , 2007, SAT.