Deriving State Machines from TinyOS Programs Using Symbolic Execution

Kothari, Nupur; Millstein, Todd; Govindan, Ramesh

doi:10.1109/ipsn.2008.62

Cited by 51 publications

(30 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We omit detailed case studies in the interest of space. We note that the state-of-theart techniques such as deriving finite state machines [9] can detect most of these faults at compile-time itself. However, the faults such as in Section 8.1 could not have been detected with [9] as the state itself was missing.…”

Section: Faulty State Machines Implementationsmentioning

confidence: 99%

“…Kothari et al [9] use symbolic execution to extract the finite state machine implied by the TinyOS code, which aids in better understanding of the code. While these tools are helpful in development and testing, they are not meant for run-time debugging.…”

Section: Tools Based On Program Analysismentioning

confidence: 99%

“…These approaches incur a substantial overhead and put much load on the programmer who has to navigate though the program at run-time. Finally, (c) program analysis based tools [18,9] provide higher-level understanding of programs but fail to quickly pinpoint the exact causes of faults, or exhibit high complexity.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Diagnostic tracing for wireless sensor networks

Sundaram

Eugster

Zhang

et al. 2013

ACM Trans. Sen. Netw.

View full text Add to dashboard Cite

Wireless sensor networks (WSNs) are hard to program due to unconventional programming models used to satisfy stringent resource constraints. The common event-driven concurrent programming model and lack of kernel protection in these systems introduce the possibility of several subtle faults such as race conditions. These faults are often triggered by unexpected interleavings of events in the real world, and can occur long after their causes. Reproducing a fault from the trace of the past events can play a crucial role in debugging such faults. The same tight constraints that motivate the specific programming model however make tracing challenging. This paper proposes an efficient intra-procedural and inter-procedural control-flow tracing algorithm that generates the traces of all interleaving concurrent events. Our approach enables reproducing faults at a later stage, allowing the programmer to identify them effectively. We argue for the accuracy of our approach through case studies, and illustrate its low overhead through measurements and simulations.

show abstract

Section: Faulty State Machines Implementationsmentioning

confidence: 99%

Section: Tools Based On Program Analysismentioning

confidence: 99%

See 1 more Smart Citation

Diagnostic tracing for wireless sensor networks

Sundaram

Eugster

Zhang

et al. 2013

ACM Trans. Sen. Netw.

View full text Add to dashboard Cite

show abstract

“…FSMGen (Kothari et al, 2008) takes another approach to error detection in TinyOS programs: it statically analyzes the program and derives automatically a !nite-state machine to describe the high-level application logic, thus aiding the programmer's understanding of the application code. The method is applied over the demo applications available with TinyOS.…”

Section: Veri!cation and Simulationmentioning

confidence: 99%

On software verification for sensor nodes

Bucur

Kwiatkowska

2011

Journal of Systems and Software

View full text Add to dashboard Cite

We consider software written for networked, wireless sensor nodes, and specialize software verification techniques for standard C programs in order to locate programming errors in sensor applications before the software's deployment on motes. Ensuring the reliability of sensor applications is challenging: lowlevel, interrupt-driven code runs without memory protection in dynamic environments. The difficulties lie with (i) being able to automatically extract standard C models out of the particular "avours of embedded C used in sensor programming solutions, and (ii) decreasing the resulting program's state space to a degree that allows practical verification times.We contribute a platform-dependent, OS-independent software verification tool for OS-wide programs written in MSP430 embedded C with asynchronous hardware interrupts. Our tool automatically translates the program into standard C by modelling the MCU's memory map and direct memory access. To emulate the existence of hardware interrupts, calls to hardware interrupt handlers are added, and their occurrence is minimized with a double strategy: a partial-order reduction technique, and a supplementary reachability check to reduce overapproximation. This decreases the program's state space, while preserving program semantics. Safety speci!cations are written as C assertions embedded in the code. The resulting sequential program is then passed to CBMC, a bounded software veri!er for sequential ANSI C. Besides standard errors (e.g., out-of-bounds arrays, null-pointer dereferences), this tool chain is able to verify application-speci!c assertions, including low-level assertions upon the state of the registers and peripherals.Veri!cation for wireless sensor network applications is an emerging !eld of research; thus, as a !nal note, we survey current research on the topic.

show abstract

“…Kothari et al [14] recently developed a technique for extracting state-machines from TinyOS programs using symbolic execution. The resulting state-machines provide an abstracted view of the TinyOS program.…”

Section: Related Workmentioning

confidence: 99%

Using CSP to Model and Analyze TinyOS Applications

McInnes

2009

2009 16th Annual IEEE International Conference and Workshop on the Engineering of Computer Based Systems

View full text Add to dashboard Cite

Abstract-The TinyOS concurrency model, although easier to reason about than shared-state threads, may still produce undesirable behavior as a result of unexpected interleaving of concurrent activities. This is problematic, since TinyOS applications are typically intended to run unattended for long periods of time, and must be reliable. In this paper, we describe a technique for modeling the interactions between TinyOS application components, and between an application and the TinyOS scheduling and preemption mechanisms, using the process algebra CSP. Analysis of the resulting process models can help TinyOS application developers to discover and diagnose concurrency-related errors in their designs that might otherwise go undetected until deployment of the application.

show abstract

Deriving State Machines from TinyOS Programs Using Symbolic Execution

Abstract: The

Cited by 51 publications

References 34 publications

Diagnostic tracing for wireless sensor networks

Diagnostic tracing for wireless sensor networks

On software verification for sensor nodes

Using CSP to Model and Analyze TinyOS Applications

Contact Info

Product

Resources

About