Selected Topics of Software Technology 3 Model-based ... · Selected Topics of Software Technology 3 2 Model-based Software Debugging S C I E N C E P A S S I O N T E C H N O L O G

Selected Topics of Software Technology 3 Model-based Software Debugging 2

S C I E N C E P A S S I O N T E C H N O L O G Y

www.tugraz.at

Selected Topics of Software Technology 3 Model-based Software Debugging

Birgit Hofer Institute for Software Technology


The art of identifying a disease from its signs and symptoms

Greek Diagnosis


Outline

Model-based Software Debugging

− Repetition

− Examples for dependency-based models

− MBSD for Java programs

o SSA form

o Loop unrolling

− Combined approaches


Outline


− Repetition



o SSA form

o Loop unrolling




Origin − Hardware Debugging

Basic idea − Derive model directly from a faulty program

Diagnosis problem (SD, COMP, OBS) − System descriptions SD − Set of components COMP − Set of observations OBS

Health predicates AB(C)


Automatic Reasoning

Spreadsheet + Expect. Output

Constraints (Model)

Conversion

System description SD: AB(D2) ˅ D2 = B2 + C2 AB(D3) ˅ D3 = D4 / D2 AB(B4) ˅ B4 = B3 * B2

…

Test case OBS: D7 == 0,786 B7 == 0,750

…

For single faults: SUM(AB(D2),AB(D3),…)==1

Diagnoses Solve

Single Fault: o {D5} o {D6} o {D7}

Double Fault: o {D3,D4} o …

Should be 78,6%


Constraint-based Reasoning – Experiments

Spreadsheet + Expect. Output

Constraints (Model) Conversion

AB(D2) ˅ behavior(D2) AB(D3) ˅ behavior(D3) AB(B4) ˅ behavior(B4)

Diagnoses Solve

Value-based (VB) Dependency-based (DB) D2 = B2 + C2 ok(B2) ∧ ok(C2) → ok(D2) + less diagnoses − many diagnoses 3.3 times more than VB − high computation time + low computation time 1/3: 20 min timeout less than 1 second 2/3: 1 minute


Example

Should be 78.6%


Improving the Dependency-based Model

Use ↔ instead of → ook(B2) ok(C2) ↔ ok(D2) ook(D4) ok(D2) ↔ ok(D3) ook(B3) ok(B2) ↔ ok(B4)

Coincidental correctness

o Conditional like IF-function o Abstraction function like MIN, MAX, COUNT o Boolean o Multiplication by zero o Power with 0 or 1 as base number or 0 as exponent


Example – Features of a circle

Version 1 1.begin 2. r = d ; 3. c = 2 * r * 3.14; 4. a = r * r * 3.14; 5.end Test case: {d=2} Expected result: {c=6.28, a=3.14}

Version 2 1.begin 2. r = d/2 ; 3. c = 2 * d * 3.14; 4. a = r * r * 3.14; 5.end

Version 3 1.begin 2. r = d/2 ; 3. c = r * 3.14; 4. a = r * r * 3.14 / 4; 5.end Version 4 1.begin 2. r = d/2 ; 3. c = r * 3.14; 4. a = r * r * 3.14; 5.end


Outline


− Repetition



o SSA form

o Loop unrolling



1. public int[ ] getTastes(red, blue, green, yellow){ 2. red = red * 5; 3. sweet = 2 * red * green; // FAULT 4. sour = 0; 5. i = 0; 6. while(i < red) { 7. sour = sour + green; 8. i = i + 1; 9. } 10. salty = blue + yellow; 11. yellow = sour + 1; 12. bitter = 2 * yellow + green; // FAULT 13. return {bitter, sweet, sour, salty}; 14.}

Example

Source: Unravel project (http://hissa.nist.gov/unravel/)


Problem

Intersection of slices − Small result set − Not possible for multiple faults Union of slices − Works for multiple faults − Too large result set

Can we do better?


red = red * 5; sweet = 2 * red * green; sour = 0;

Solution

red1 = red0 * 5; sweet1 = 2 * red1 * green0; sour1 = 0;

Execution Trace

SSA conv. Exec. Trace


red = red * 5; sweet = 2 * red * green; sour = 0;

Solution

red1 = red0 * 5; sweet1 = 2 * red1 * green0; sour1 = 0;

AB2 ˅ red1 == red0 * 5; AB3 ˅ sweet1 == 2 * red1 * green0; AB4 ˅ sour1 == 0;

Execution Trace

SSA conv. Exec. Trace

Constraints


watched-or({element(ab,3,1),product(2, red_1,tmp_var_2)}) watched-or({element(ab,3,1),product(tmp_var_2,green_0,tmp_var_3)}) watched-or({element(ab,3,1),eq(sweet_0,tmp_var_3)})

Minion constraints

AB2 ˅ red1 == red0 * 5; AB3 ˅ sweet1 == 2 * red1 * green0; AB4 ˅ sour1 == 0;

watched-or({element(ab,2,1),product(red_0,5,tmp_var_1)}) watched-or({element(ab,2,1),eq(red_1,tmp_var_1)})

watched-or({element(ab,4,1),eq(sour_0,0)})


AB2 ˅ red1 == red0*5; AB3 ˅ sweet1 == 2*red1*green0; AB4 ˅ sour1 == 0; …

Solution

Constraints

Constraint Solver

Diagnoses

find all solutions

zB {13}


Loop unrolling 1. static public int test1() { 2. int a,b,c,d,i; 3. i = 1; 4. a = 1; 5. b = 2; 6. c = 3; 7. d = 4; 8. while (i < 3) { 9. a = b; 10. b = c; 11. c = d; 12. i++; 13. } 14. return a; 15. }

1. i = 1; 2. a = 1; 3. b = 2; 4. c = 3; 5. d = 4; 6. while (i < 3) // True 7. a = b; 8. b = c; 9. c = d; 10. i++; 11. while (i < 3) // True 12. a = b; 13. b = c; 14. c = d; 15. i++; 16. while (i < 3) // False 17. return a;

Execution trace


Traffic Light Example 1. public static void test () { 2. TrafficLight tl = new TrafficLight(0); // initializes tl.state=0; 3. int i = 0; 4. int finalState; 5. while (i < 5) { 6. tl.printState(); 7. if (tl.state == 0) { 8. tl.state = 1; 9. } else { 10. if (tl.state == 1) { 11. tl.state = 2; 12. } else { 13. if (tl.state == 2) { 14. tl.state = 3; 15. } else { 16. tl.state = 3; // should be tl.state = 0; 17. } 18. } 19. } 20. i++; 21. } 22. tl.printState(); 23. finalState = tl.state; 24. }


Triangle Example

1. public String getTriangleType(int in1, int in2, int in3){ 2. a = in1; 3. b = in2; 4. c = in3; 5. if (!(a<0) & (b>0) & (c>0)) 6. return “no triangle”; 7. if ((a+b<c) | (a+c<b) | (b+c<a)) 8. return “invalid”; 9. if (a == b && a ==c) 10. return “equilateral”; 11. if (a == b || a == c || b == c) 12. return “isosceles”; 13. return “scalene”; 14. }

Test Case: in1 = 2 in2 = 2 in3 = 3

output0 = “isosceles" intrace0


What happens if a fault causes changes in the execution path?


Modelling

RecInput

AssignInput

=NEG

condA

?

¬ intrace0 ⋁ AB1 ⋁ a0 = in1 ¬ intrace0 ⋁ AB2 ⋁ b0 = in2 ¬ intrace0 ⋁ AB3 ⋁ c0 = in3

¬ intrace0 →¬ intrace1 AB4 → ¬ intrace1 ¬ intrace0 ⋁ AB4 ⋁ (a0<0) ⋀ (b0>0) ⋀ (c0>0)↔¬ intrace1

then else

¬ intrace1 ⋁ AB5 ⋁ output0 = “No triangle”

in1 = 2 in2 = 2 in3 = 3



Diagnosis on the path

RecInput

AssignInput

=NEG

condA

?



then else


in1 = 2 in2 = 2 in3 = 3



Diagnoses changing the execution trace

RecInput

AssignInput

=NEG

condA

?



then else


in1 = 2 in2 = 2 in3 = 3



Diagnoses changing the execution trace

RecInput

AssignInput

=NEG

condA

?



then else


in1 = 2 in2 = 2 in3 = 3



Outline


− Repetition



o SSA form

o Loop unrolling



Combined approaches

Refining Spectrum-based Rankings DEPUTO Spectrum-based Reasoning BARINEL Spectrum Enhanced Dynamic Slicing SENDYS


DEPUTO [1]

[1] R. Abreu et al.: Refining spectrum-based fault localization rankings. In Proceedings of the 24th Annual ACM Symposium on Applied Computing (SAC'09).

STEP 1: Spectrum

based Ranking

STEP 2: Model based

Debugging (Filter)

1st ranked stmt.

2nd ranked stmt.

3rd ranked stmt.

…


BARINEL [2]

[2] R. Abreu et al.: Spectrum-based multiple fault localization. In Proceedings of the IEEE/ACM International Conference on Automated Software Engineering (ASE'09).

Spectra information of neg. TC

Diagnoses Hitting Sets Ranking Bayes’ rule


SENDYS [3]

[3] B. Hofer and F. Wotawa: Spectrum enhanced dynamic slicing for better fault localization. In The 20th European Conference on Artficial Intelligence (ECAI 2012).

Slices as Conflict Sets Diagnoses Diagnoses

Likelihood

Similarity Coefficients

Probabilities Hitting Sets


Comparison

DEPUTO

− performs best

− but not scalable to large programs

BARINEL and SENDYS

− good alternatives for larger programs


Summary

Approach

correct / faulty

Result

User input

SFL MBSD CONBUG MUSSCO

Computational Complexity low

expected values

expected values

several time expected

values

high high very high

ranking filtered set filtered set repair

single faults Fault Complexity

multiple faults

multiple faults

multiple faults

Granularity block level Stmt. level Stmt. level fine

Documents

Selected Topics of Software Technology 3 Model-based ... · Selected Topics of Software Technology 3 2 Model-based Software Debugging S C I E N C E P A S S I O N T E C H N O L O G