Model-based diagnosis versus error explanation

Abstract

Abstract-Debugging techniques assist a developer in localizing and correcting faults in a system's description when the behavior of the system does not conform to its specification. Two fault localization techniques are model-based diagnosis and error explanation. Model-based diagnosis computes a subset of the system's components which when replaced correct the system. Error explanation determines potential causes of the system's misbehavior by comparing faulty and correct execution traces. In this paper we focus on fault localization for imperative, nonconcurrent programs. We compare the two fault localization techniques in a unified setting presenting SAT-based algorithms for both. The algorithms serve as a vantage point for a fair comparison and allow for efficient implementations leveraging state-of-the-art decision procedures. Firstly, in our comparison we use constructed programs to study strengths and weaknesses of the two fault localization techniques. We show that in general none of the fault localization techniques is superior but that the computed fault candidates depend on the program structure. Secondly, we implement the SAT-based algorithms in a prototype tool utilizing a Satisfiability Modulo Theories (SMT) solver and evaluate them on mutants of the ANSI-C program TCAS from the Software-Artifact Infrastructure Repository (SIR).

FAuST: A Framework for Formal Verification, Automated Debugging, and Software Test Generation

“…The optimization problem is implemented as a binary search over logic variables utilizing incremental SAT. For 41 mutants of TCAS, we computed potentially faulty program locations using both strategies [20]: on average the computation takes 4.37 seconds with strategy MBD and 39.29 seconds with strategy EE.…”

“…The experimental results are partially published for fault-based test generation [19] and currently under review for fault localization [20].…”

“…Next, we show a case study for two selected applications: fault-based test generation (partly published in [19]) and fault localization [20] (in review). For the presentation, we use the ANSI-C program TCAS from the Software-Artifact Infrastructure Repository (SIR).…”

“…The output depends on its application. For instance, in fault-based test generation [19] the output is a test suite and in fault localization [20] the output is a set of potentially faulty program locations. The core engine of each tool is a highly customizeable BMC algorithm.…”

MetaSMT: a unified interface to SMT-LIB2

“…Thus, metaSMT allows to switch between different SMT solvers by using one common API. metaSMT's EDSL has been effectively used for test stimuli generation of software [6] and hardware [7], fault localization [8], assessing fault tolerance [9], symbolic execution [10], and circuit minimization [11].…”