Debugging of Concurrent Systems Using Counterexample Analysis

Abstract

Abstract. Model checking is an established technique for automatically verifying that a model satisfies a given temporal property. When the model violates the property, the model checker returns a counterexample, which is a sequence of actions leading to a state where the property is not satisfied. Understanding this counterexample for debugging the specification is a complicated task for several reasons: (i) the counterexample can contain hundreds of actions, (ii) the debugging task is mostly achieved manually, and (iii) the counterexample does not give any clue on the state of the system (e.g., parallelism or data expressions) when the error occurs. This paper presents a new approach that improves the usability of model checking by simplifying the comprehension of counterexamples. Our solution aims at keeping only actions in counterexamples that are relevant for debugging purposes. To do so, we first extract in the model all the counterexamples. Second, we define an analysis algorithm that identifies actions that make the behaviour skip from incorrect to correct behaviours, making these actions relevant from a debugging perspective. Our approach is fully automated by a tool that we implemented and applied on real-world case studies from various application areas for evaluation purposes.

Debugging of Behavioural Models with CLEAR

“…The first step of our approach is to identify in the LTS parts of it corresponding to correct or incorrect behaviours. This is achieved using several algorithms that we define and that are presented in [3,4]. We use different techniques depending on the property family.…”

Counterexample Simplification for Liveness Property Violation

“…We published in [2] an approach for counterexample analysis of safety property violation. [2] describes a preliminary version of neighbourhood and of the counterexample abstraction.…”

“…[2] describes a preliminary version of neighbourhood and of the counterexample abstraction. The algorithmic solution using prefix/suffix annotations presented in Section 3 as well as the tool support and experiments presented in Section 4 are entirely new.…”

Visual Debugging of Behavioural Models

“…In the rest of the paper, we do not present pre-processing steps for computing counterexamples and for analyzing them in order to identify correct/incorrect transitions and states where there are choices between those transitions, see [2] for details. We prefer to focus on the visualization techniques provided by our tool that we present in Section II.…”

“…Neutral transitions can lead to both correct and incorrect behaviour 2. There are four kinds of neighbourhoods: (i) with at least one correct transition (and no incorrect transition), (ii) with at least one incorrect transition (and no correct transition), (iii) with at least one correct transition and one incorrect transition, but no neutral transition, (iv) with at least one correct transition, one incorrect transition and one neutral transition.…”