Making the Most of BMC Counterexamples

Abstract

The value of model checking counterexamples for debugging programs (and specifications) is widely recognized. Unfortunately, bounded model checkers often produce counterexamples that are difficult to understand due to the values chosen by a SAT solver. This paper presents two approaches to making better use of BMC counterexamples. The first contribution is a new notion of counterexample minimization that minimizes values with respect to the type system of the language being model checked, rather than at the level of SAT variables. Greedy and optimal approaches to the minimization problem are presented and compared. The second contribution extends a BMC-based error explanation approach to automatically hypothesize causes for the error in a counterexample. These hypotheses (in terms of relationships between variables) can be automatically checked to determine if a causal dependence exists. Experimental results show that causes can be automatically determined for errors in interesting ANSI C programs.

Simulation-Based Bug Trace Minimization With BMC-Based Refinement

“…The algorithm was able to greatly reduce bug traces in Mozilla, which is a popular web browser. A recent contribution that draws upon counterexamples found by model checking is by Groce and Kroening [9]. Their solution focuses on minimizing a trace with respect to the primitive constructs available in the language used to describe the hardware or software system and on trying to highlight the causes of the error in the counterexample to produce a simplified trace that is more understandable by a software designer.…”

Shortest Counterexamples for Symbolic Model Checking of LTL with Past

“…Finding the shortest bad prefix for safety formulae can be done in parallel, using the (doubly exponential) method proposed in [17]. The solution to the second problem is left as future work; for approaches and more references see [13].…”

Flow-Sensitive Fault Localization

“…They isolate parts of a counterexample that do not occur on feasible traces. Groce et al [7][8][9] use causal dependencies (see, e.g. [2]) and distance metrics for program executions to find minimal abstractions of error traces.…”

“…A common approach to fault localization is to compare failing with successful executions (e.g., [1,7,8,14,15,17,19,20]). These approaches differ in the way the failing and successful executions are obtained, the way they compare executions, and in the information they report to the user.…”