Localizing Faults Using Verification Technique

In model-based fault diagnosis, it is assumed that a correct model of each program being diagnosed is available. That is, these models serve as the oracles of the corresponding programs. Differences between the behaviors of a model and the actual observed behaviors of the program are then used to find bugs in the program. However, these techniques normally require test cases and user-specified assertions to localize the fault. In this paper, we aim to localize faults in a faulty program without user-specified assertions and without executing the programs, and therefore, without using test cases. Instead, given the faulty and the correct versions of a program, a product code is automatically constructed and assertions are automatically generated. This is a fully automatic, model-based static approach to fault localization. The proposed method reduces the fault search space by removing equivalent regions from the product code using verification techniques. We demonstrate the effectiveness of the proposed method using the Siemens TCAS benchmark. We observe that the method can successfully localize the wrong safety check bug produced by LLVM compiler.