A Formula-Based Approach for Automatic Fault Localization of Imperative Programs

  • Si-Mohamed Lamraoui
  • Shin Nakajima
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8829)


Among various automatic fault localization methods, two of them are specifically noticed, coverage-based and formula-based. While the coverage-based method relies on statistical measures, the formula-based approach is an algorithmic method being able to provide fine-grained information account for identified root causes. The method combines the SAT-based formal verification techniques with the Reiter’s model-based diagnosis theory. This paper adapts the formula-based fault localization method, and improves the efficiency of computing the potential root causes by using the push & pop mechanism of the Yices solver. The technique is particularly useful for programs with multiple faults. We implemented the method in a tool, SNIPER, which was applied to the TCAS benchmark. All single and multiple faults were successfully identified and discriminated by using the original test cases of the TCAS.


Model-based Diagnosis Theory Multiple faults Partial Maximum Satisfiability LLVM Yices 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Binkley, D., Gold, N., Harman, M.: An Empirical Study of Static Program Slice Size. ACM TOSEM 16(2), Article 8 (April 2007)Google Scholar
  2. 2.
    Christ, J., Ermis, E., Schäf, M., Wies, T.: Flow-Sensitive Fault Localization. In: Giacobazzi, R., Berdine, J., Mastroeni, I. (eds.) VMCAI 2013. LNCS, vol. 7737, pp. 189–208. Springer, Heidelberg (2013)CrossRefGoogle Scholar
  3. 3.
    Clarke, E., Kroning, D., Lerda, F.: A Tool for Checking ANSI-C Programs. In: Jensen, K., Podelski, A. (eds.) TACAS 2004. LNCS, vol. 2988, pp. 168–176. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  4. 4.
    DiGiuseppe, N., Jones, J.A.: On the Influence of Multiple Faults on Coverage-based Fault Localization. In: Proc. ISSTA 2011, pp. 210–220 (2011)Google Scholar
  5. 5.
    Dutertre, B., de Moura, L.: The Yices SMT Solver, http://yices.csl.sri.com
  6. 6.
    Griesmayer, A., Staber, S., Bloem, R.: Fault Localization using a Model Checker. In: STVR, pp. 149–173 (2010)Google Scholar
  7. 7.
    Groce, A., Chaki, S., Kroening, D., Strichman, O.: Error Explanation with Distance Metrics. STTT 8(3), 229–247 (2006)CrossRefGoogle Scholar
  8. 8.
    Jones, J.A., Harrold, M.J.: Empirical Evaluation of the Tarantula Automatic Fault-Localization Technique. In: Proc. ASE 2005, pp. 273–282 (2005)Google Scholar
  9. 9.
    Jose, M., Majumdar, R.: Cause Clue Clauses: Error Localization using Maximum Satisfiability. In: Proc. PLDI 2011, pp. 437–446 (2011)Google Scholar
  10. 10.
    Kusumoto, S., Nishimatsu, A., Nishie, K., Inoue, K.: Experimental Evaluation of Program Slicing for Fault Localization. Empirical Software Engineering 7(1), 49–76 (2002)CrossRefMATHGoogle Scholar
  11. 11.
    Lattner, C., Adve, V.: LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation. In: Proc. CGO 2004, pp. 75–86 (2004)Google Scholar
  12. 12.
    Liffiton, M.H., Sakallah, K.A.: Algorithms for Computing Minimal Unsatisfiable Subsets of Constraints. Automated Reasoning 40(1), 1–33 (2008)MathSciNetCrossRefMATHGoogle Scholar
  13. 13.
    Merz, F., Falke, S., Sinz, C.: LLBMC: Bounded Model Checking of C and C++ Programs Using a Compiler IR. In: Joshi, R., Müller, P., Podelski, A. (eds.) VSTTE 2012. LNCS, vol. 7152, pp. 146–161. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  14. 14.
    Morgado, A., Liffiton, M., Marques-Silva, J.: MaxSAT-Based MCS Enumeration. In: Biere, A., Nahir, A., Vos, T. (eds.) HVC. LNCS, vol. 7857, pp. 86–101. Springer, Heidelberg (2013)CrossRefGoogle Scholar
  15. 15.
    Prasad, M.R., Biere, A., Gupta, A.: A Survey of Recent Advances in SAT-Based Formal Verification. STTT 7(2), 156–173 (2005)CrossRefGoogle Scholar
  16. 16.
    Reiter, R.: A Theory of Diagnosis from First Principles. Artificial Intelligence 32(1), 57–95 (1987)MathSciNetCrossRefMATHGoogle Scholar
  17. 17.
    Safarpour, S., Mangassarian, H., Veneris, A., Liffiton, M.H., Sakallah, K.A.: Improved Design Debugging using Maximum Satisfiability. In: Proc. FMCAD 2007, pp. 13–19 (2007)Google Scholar
  18. 18.
    Weiser, M.: Programmers Use Slices When Debugging. Comm. ACM 25(7), 446–452 (1982)CrossRefGoogle Scholar
  19. 19.
    Wotawa, F.: On the Relationship between Model-based Debugging and Program Slicing. Artificial Intelligence 135(1), 125–143 (2002)MathSciNetCrossRefMATHGoogle Scholar
  20. 20.
    Wotawa, F., Nica, M., Moraru, I.: Automated Debugging based on a Constraint Model of the Program and a Test Case. Logic and Algebraic Programming 81(4), 390–407 (2012)MathSciNetCrossRefMATHGoogle Scholar
  21. 21.
    Zeller, A., Hildebrandt, R.: Simplifying and Isolating Failure-Inducing Input. IEEE Trans. Softw. Eng. 28(2), 183–200 (2002)CrossRefGoogle Scholar

Copyright information

© Springer International Publishing Switzerland 2014

Authors and Affiliations

  • Si-Mohamed Lamraoui
    • 1
    • 2
  • Shin Nakajima
    • 1
    • 2
  1. 1.The Graduate University for Advanced Studies (SOKENDAI)Japan
  2. 2.National Institute of InformaticsTokyoJapan

Personalised recommendations