TL;DR: This work has successfully applied the SLAM toolkit to Windows XP device drivers, to both validate behavior and find defects in their usage of kernel APIs.
Abstract: The goal of the SLAM project is to check whether or not a program obeys "API usage rules" that specify what it means to be a good client of an API. The SLAM toolkit statically analyzes a C program to determine whether or not it violates given usage rules. The toolkit has two unique aspects: it does not require the programmer to annotate the source program (invariants are inferred); it minimizes noise (false error messages) through a process known as "counterexample-driven refinement". SLAM exploits and extends results from program analysis, model checking and automated deduction. We have successfully applied the SLAM toolkit to Windows XP device drivers, to both validate behavior and find defects in their usage of kernel APIs.
TL;DR: DIDUCE, a practical and effective tool that aids programmers in detecting complex program errors and identifying their root causes, is introduced and suggests that detecting and checking program invariants dynamically is a simple and effective methodology for debugging many different kinds of program errors across a wide variety of application domains.
Abstract: This paper introduces DIDUCE, a practical and effective tool that aids programmers in detecting complex program errors and identifying their root causes. By instrumenting a program and observing its behavior as it runs, DIDUCE dynamically formulates hypotheses of invariants obeyed by the program. DIDUCE hypothesizes the strictest invariants at the beginning, and gradually relaxes the hypothesis as violations are detected to allow for new behavior. The violations reported help users to catch software bugs as soon as they occur. They also give programmers new visibility into the behavior of the programs such as identifying rare corner cases in the program logic or even locating hidden errors that corrupt the program's results.We implemented the DIDUCE system for Java programs and applied it to four programs of significant size and complexity. DIDUCE succeeded in identifying the root causes of programming errors in each of the programs quickly and automatically. In particular, DIDUCE is effective in isolating a timing-dependent bug in a released JSSE (Java Secure Socket Extension) library, which would have taken an experienced programmer days to find. Our experience suggests that detecting and checking program invariants dynamically is a simple and effective methodology for debugging many different kinds of program errors across a wide variety of application domains.
TL;DR: Key topics covered in this book include: Identifying large-scale strategic decisions that affect most software elements Coordinating and organizing system components and subsystems Managing memory and resources.
Abstract: When creating real-time and embedded (RTE) systems, there is no room for error. The nature of the final product demands that systems be powerful, efficient, and highly reliable. The constraints of processor and memory resources add to this challenge. Sophisticated developers rely on design patterns-proven solutions to recurrent design challenges-for building fail-safe RTE systems.Real-Time Design Patterns is the foremost reference for developers seeking to employ this powerful technique. The text begins with a review of the Unified Modeling Language (UML) notation and semantics then introduces the Rapid Object-Oriented Process for Embedded Systems (ROPES) process and its key technologies. A catalog of design patterns and their applications follows.Key topics covered in this book include: Identifying large-scale strategic decisions that affect most software elements Coordinating and organizing system components and subsystems Managing memory and resources Defining how objects can be distributed across multiple systems Building safe and reliable architectures Mapping subsystem and component architectures to underlying hardwareThe book's extensive problem-solving templates, which draw on the author's years in the trenches, will help readers find faster, easier, and more effective design solutions.The accompanying CD-ROM contains: Related papers Object Management Group (OMG) specifications Rhapsody™-a UML-compliant design automation tool that captures the analysis and design of systems and generates full behavioral code with intrinsic model-level debug capabilities RapidRMA™-a tool that integrates with Rhapsody™ to perform schedulability and timeliness analysis of UML models 0201699567B08142002
TL;DR: ConTest, a tool for detecting synchronization faults in multithreaded Java™ programs that makes random or coverage-based decisions as to whether the seeded primitive is to be executed, and a replay algorithm facilitates debugging by saving the order of shared memory accesses and synchronization events.
Abstract: We describe ConTest, a tool for detecting synchronization faults in multithreaded Java™ programs. The program under test is seeded with a sleep(), yield(), or priority() primitive at shared memory accesses and synchronization events. At run time, ConTest makes random or coverage-based decisions as to whether the seeded primitive is to be executed. Thus, the probability of finding concurrent faults is increased. A replay algorithm facilitates debugging by saving the order of shared memory accesses and synchronization events.
TL;DR: In this paper, techniques and systems for analysis, diagnosis and debugging fabricated hardware designs at a Hardware Description Language (HDL) level are described, where the hardware designs have been designed in HDL and have been fabricated in integrated circuit products with limited input/output pins.
Abstract: Techniques and systems for analysis, diagnosis and debugging fabricated hardware designs at a Hardware Description Language (HDL) level are described. Although the hardware designs (which were designed in HDL) have been fabricated in integrated circuit products with limited input/output pins, the techniques and systems enable the hardware designs within the integrated circuit products to be comprehensively analyzed, diagnosed, and debugged at the HDL level at speed. The ability to debug hardware designs at the HDL level facilitates correction or adjustment of the HDL description of the hardware designs.
TL;DR: The system presented here consists of an on-chip debug infrastructure and supporting debugger software, which interacts with the infrastructure to make the chip's features accessible through a serial interface.
Abstract: For large, complex ICs, engineers need efficient techniques for debugging first silicon. The system presented here consists of an on-chip debug infrastructure and supporting debugger software,which interacts with the infrastructure to make the chip's features accessible through a serial interface.
TL;DR: In this paper, a hybrid instruction processor and reconfigurable processor implemented algorithm is presented, where control is passed from one code block to another code block based on the output value of the code block until EXIT is reached.
Abstract: An embodiment of the invention includes a method of simulating a hybrid instruction processor and reconfigurable processor implemented algorithm which utilizes a runtime selectable emulation library that emulates a reconfigurable processor and its resources, and a control-data flow emulator that emulates the reconfigurable logic for the algorithm. Another embodiment of the invention includes a method of simulating a control-dataflow graph that includes building an internal representation of the control-dataflow graph that includes one or more dataflow code blocks, and simulating the control-dataflow graph as a sequence of code block dataflow executions, where control is passed from one code block to another code block based on the output value of the code block until EXIT is reached.
TL;DR: The design of (several variants of) a local parallel model-checking algorithm for the alternation-free fragment of the µ-calculus is described, which exploits a characterisation of the problem for this fragment in terms of two-player games.
Abstract: We describe the design of (several variants of) a local parallel model-checking algorithm for the alternation-free fragment of the µ-calculus. It exploits a characterisation of the problem for this fragment in terms of two-player games. For the corresponding winner, our algorithm determines in parallel a winning strategy, which may be employed for debugging the underlying system interactively, and is designed to run on a network of workstations. Depending on the variant, its complexity is linear or quadratic. A prototype implementation within the verification tool Truth shows promising results in practice.
TL;DR: A method for debugging reconfigurable hardware is described in this article, where all necessary debug information is written in each configuration cycle into a memory, which is then analyzed by the debugger.
Abstract: A method for debugging reconfigurable hardware is described. According to this method, all necessary debug information is written in each configuration cycle into a memory, which is then analyzed by the debugger.
TL;DR: This thesis presents a method for automatic location of type errors in constraint logic programs (CLP) and a prototype debugging tool based on techniques of verification and static checking.
Abstract: This thesis presents a method for automatic location of type errors in constraint logic programs (CLP) and a prototype debugging tool. The appriach is based on techniques of verification and static ...
TL;DR: The Walkabout project investigates and develops dynamic binary translation techniques that are based on properties of retargetability, ease of experimentation, separation of machine-dependent from machine-independent concerns, and good debugging support, as well as techniques in related areas such as interpreters, instrumentation tools, and optimization.
Abstract: Dynamic compilation techniques have found a renaissance in recent years due to their use in high-performance implementations of the Java™ language. Techniques originally developed for use in virtual machines for such object-oriented languages as Smalltalk are now commonly used in Java virtual machines (JVM™) and Java just-intime compilers. These techniques have also been applied to binary translation in recent years, most commonly appearing in binary optimizers for a given platform that improve the performance of binary programs while they execute.
The Walkabout project investigates and develops dynamic binary translation techniques that are based on properties of retargetability, ease of experimentation, separation of machine-dependent from machine-independent concerns, and good debugging support. Walkabout is a framework for experimenting with dynamic binary translation ideas, as well as techniques in related areas such as interpreters, instrumentation tools, and optimization.
In this report, we present the design of the Walkabout framework and its initial implementation. Tools generated from this initial framework include disassemblers, machine code interpreters (emulators), and binary rewriting tools for the SPARC® and x86 architectures.
TL;DR: In this article, the authors present techniques for debugging a computer program that includes multiple modules written in multiple languages, allowing machines for the multiple languages to interface with a single debugger client using a standard interface.
Abstract: Techniques for debugging a computer program that includes multiple modules written in multiple languages allow machines for the multiple languages to interface with a single debugger client using a standard interface. The techniques include storing a mapping that maps language constructs of a first language into language constructs of a second language. While a first machine is executing a first module that is written in the first language, the mapping is used to generate debugging information based on language constructs of the second language. The debugging information is sent to a debugger process designed for debugging programs written in the second language.
TL;DR: In this paper, an execution engine synchronizes test suite execution to run multiple independent operations concurrently or in parallel, and allows the user to interactively step through a test case when debugging a fault.
Abstract: An execution engine synchronizes test suite execution to run multiple independent operations concurrently or in parallel. The execution engine operates by stepping through the test suite. At each step it runs the required number of independent operations and waits for their completion. It then checks the results, and continues to the next step of the test suite. If at any step, the actual results are different from the expected results, then the exact sequence that triggered the fault is known. The sequence can be repeated when a correction is provided for the fault. Furthermore, the execution engine allows the user to interactively step through a test case when debugging a fault. A synchronization pattern generator may be incorporated in the system to generate minimal numbers of repetitions of test cases to guarantee varying degrees of interaction coverage.
TL;DR: In this paper, the value of a variable and a comment associated with the variable are displayed as fly-over text in a user interface screen in a location other than in the original location of the comment.
Abstract: Method, apparatus and article manufacture of debugging code. One embodiment provides a method of debugging code, comprising displaying a user interface screen of a debugging program; and in response to an event, displaying the value of the variable and a comment associated with the variable in the user interface screen in a location other than in an original location of the comment. In one embodiment, the comment associated with the variable comprises at least one of a user-drafted comment embedded in the code being debugged, an external comment retrieved from a data source external to the code being debugged, and a machine-generated comment indicative of a manner in which the variable is used. In one embodiment, the value and the comment are displayed as fly-over text.
TL;DR: The methods used in MPI‐CHECK 2.0 are presented to detect many situations where actual and potential deadlocks occur when using blocking and non‐blocking point‐to‐point routines as well as when using collective routines.
Abstract: SUMMARY The Message-Passing Interface (MPI) is commonly used to write parallel programs for distributed memory parallel computers. MPI-CHECK is a tool developed to aid in the debugging of MPI programs that are written in free or fixed format Fortran 90 and Fortran 77. This paper presents the methods used in MPI-CHECK 2.0 to detect many situationswhereactual andpotential deadlocksoccur whenusingblocking and non-blocking point-to-point routines as well as when using collective routines. Copyright 2002 John Wiley & Sons, Ltd.
TL;DR: The design of a scalable and flexible simulator which allows for the direct execution, at source code level, of applications written for TinyOS, the operating system that executes on Smart Dust is described.
Abstract: Large clouds of tiny devices capable of computation, communication and sensing, the goal of the Smart Dust project, will soon become a reality. Hardware miniaturization is shrinking devices and research in software is producing applications that allow devices to communicate and cooperate toward a common goal. Success on the software front hinges on the design of algorithms that can scale up with system size. Given that the number of individual cooperating devices will reach high orders of magnitude (hundreds of thousands or even millions), debugging and evaluating the software in such a large system can reap much benefit from simulation. This paper describes the design of a scalable and flexible simulator which allows for the direct execution, at source code level, of applications written for TinyOS, the operating system that executes on Smart Dust. This simulator also provides detailed models for radio signal propagation and node mobility.
TL;DR: This thesis establishes that structural static analysis performed on the underlying system of equations from object-oriented mathematical models can effectively be used to statically debug real Modelica programs.
Abstract: A significant part of the software development effort is spent on detecting deviations between software implementations and specifications, and subsequently locating the sources of such errors. This thesis illustrates that is possible to identify a significant number of errors during static analysis of declarative object-oriented equation-based modeling languages that are typically used for system modeling and simulation. Detecting anomalies in the source code without actually solving the underlying system of equations provides a significant advantage: a modeling error can be corrected before trying to get the model compiled or embarking on a computationally expensive symbolic or numerical solution process. The overall objective of this work is to demonstrate that debugging based on static analysis techniques can considerably improve the error location and error correcting process when modeling with equation-based languages. A new method is proposed for debugging of over- and under-constrained systems of equations. The improved approach described in this thesis is to perform the debugging process on the flattened intermediate form of the source code and to use filtering criteria generated from program annotations and from the translation rules. Each time when an error is detected in the intermediate code and the error fixing solution is elaborated, the debugger queries for the original source code before presenting any information to the user. In this way, the user is exposed to the original language source code and not burdened with additional information from the translation process or required to inspect the intermediate code. We present the design and implementation of debugging kernel prototypes, tightly integrated with the core of the optimizer module of a Modelica compiler, including details of the novel framework required for automatic debugging of equation-based languages. This thesis establishes that structural static analysis performed on the underlying system of equations from object-oriented mathematical models can effectively be used to statically debug real Modelica programs. Most of our conclusions developed in this thesis are also valid for other equation-based modeling languages.
TL;DR: In this article, an event engine and a computer controlled GUI are used to monitor a signal and execute an action based on thereon, which can be deployed co-functionally with debuggers, logic analyzers, scopes, utilities, and software development tools.
Abstract: Programming a plurality of states having respective threads is achieved by an event engine and a computer controlled GUI causing the event engine to monitor a signal and execute an action based thereon. The GUI programs an event and several states and causes the event engine to traverse between the states upon reaching the event. The GUI further programs a logic chain which unifies the threads. A method unifies several threads by selecting and executing a logic operation. The method further configures several states and causes traversing between them. The GUI may be deployed co-functionally with debuggers, logic analyzers, scopes, utilities, and software development tools. The results of the GUI are automatically transformed into program code which programs the event engine to operate during debug of a device under test by monitoring for events and taking action based thereon.
TL;DR: This paper provides a comprehensive overview and rules to integrate model checking into UML-based designs, showing its usefulness from a practical point of view, and giving some guidelines to exploit the benefits of the integration.
Abstract: Model Checking is currently one of the most exciting techniques to improve the quality of complex software systems. It is a computer aided verification method that, in many cases, has discovered design bugs in early development steps, thus saving time and costs to produce the final code. Although this technique is successfully applied to many formal description techniques, it is not commonly used by the object oriented programming community, in general, nor by UML developers, in particular. In this paper, we provide a comprehensive overview and rules to integrate model checking into UML-based designs, showing its usefulness from a practical point of view, and giving some guidelines to exploit the benefits of the integration.
TL;DR: In this article, three debug access methods into an integrated circuit are provided to control the testing and debugging of program code, functional blocks and circuitry therein, including a serial access, an I/O mapped parallel access, and a direct parallel access.
Abstract: Method and apparatus for integrated circuit debugging. Three debug access methods into an integrated circuit are provided to control the testing and debugging of program code, functional blocks and circuitry therein. The debug access includes a serial access, an I/O mapped parallel access, and a direct parallel access. The three debug accesses have varying levels of intrusiveness and test/debug efficiency. Depending upon whether the integrated circuit is unpackaged, packaged, coupled to a printed circuit board or found within a system, any one or more of the three debug accesses to debugging the integrated circuit can be utilized.
TL;DR: In this article, the value of a variable and a comment associated with the variable are displayed as fly-over text in a user interface screen in a location other than in the original location of the comment.
Abstract: Method, apparatus and article manufacture of debugging code. One embodiment provides a method of debugging code, comprising displaying a user interface screen of a debugging program; and in response to an event, displaying the value of the variable and a comment associated with the variable in the user interface screen in a location other than in an original location of the comment. In one embodiment, the comment associated with the variable comprises at least one of a user-drafted comment embedded in the code being debugged, an external comment retrieved from a data source external to the code being debugged, and a machine-generated comment indicative of a manner in which the variable is used. In one embodiment, the value and the comment are displayed as fly-over text.
TL;DR: In this paper, a trace buffer is used for debugging a computer program, and a memory image snapshot of at least a portion of memory being utilized by the computer program is captured.
Abstract: An invention is provided for debugging a computer program. Program information is recorded in a trace buffer. The program information generally includes write accesses from the computer program and the execution path of the computer program. In addition, a memory image snapshot of at least a portion of memory being utilized by the computer program is captured. Simulated re-execution of the computer program then occurs by adjusting the state of the memory image snapshot based on the program information. Further, debugging logic can be inserted into a simulated re-execution at particular points in the computer program. In particular, the debugging logic does not change the trace buffer or the memory image snapshot, and as such, do not alter the captured sequence events being debugged.
TL;DR: This work presents program slicing as a tool that, along with model checking and simulation techniques, can facilitate understanding and debugging of protocols.
Abstract: Static program slicing has been used effectively for a variety of applications ranging from debugging to program integration to software re-engineering. A program slice consists of the parts of a program that may affect or are affected by the value being computed at the point of interest. A slice, for sequential programs, is computed by examining control and data dependence in the program. Recent work in slicing concurrent programs examines how values at a particular program point are affected by synchronization, communication, and non-determinism (along with the traditional control and data dependence effects.) We are extending this work to slice the Promela programming language, used to specify protocols for the Spin model checker. Another application of slicing may be its usefulness in paring down protocol descriptions to just the pieces that affect particular points of interest (e.g. assertion statements, never claims, etc. in Promela). Model checking and simulation of the pared-down protocol may, in some cases, be much more efficient. We present program slicing as a tool that, along with model checking and simulation techniques, can facilitate understanding and debugging of protocols.
TL;DR: In this article, the authors present a method and system for debugging a device such as a microcontroller in a distributed architectural scheme, where the device may operate at speeds much faster than the debugger program is run, with limited debugging resources physically incorporated into the device itself, and with relatively limited computational capacity.
Abstract: Embodiments of the present invention effectuate a method and system for debugging a device such as a microcontroller in a distributed architectural scheme, where the device may operate at speeds much faster than the debugger program is run, with limited debugging resources physically incorporated into the device itself, and with relatively limited computational capacity, vis-a-vis the platform deploying the debugging software. The embodiments place relatively modest, uncomplicated demands on the debugger software, and the ICE may also be relatively simple. Further, debugging methods and systems according to these embodiments are flexible and adaptable to a variety of different devices that must undergo debugging, yet remain effective, simple, and inexpensive.
TL;DR: In this article, techniques and systems for analysis, diagnosis and debugging fabricated hardware designs at a Hardware Description Language (HDL) level are described, where the hardware designs have been designed in HDL and have been fabricated in integrated circuit products with limited input/output pins.
Abstract: Techniques and systems for analysis, diagnosis and debugging fabricated hardware designs at a Hardware Description Language (HDL) level are described. Although the hardware designs (which were designed in HDL) have been fabricated in integrated circuit products with limited input/output pins, the techniques and systems enable the hardware designs within the integrated circuit products to be comprehensively analyzed, diagnosed, and debugged at the HDL level at speed. The ability to debug hardware designs at the HDL level facilitates correction or adjustment of the HDL description of the hardware designs.
TL;DR: In this paper, a single instance of a debugger application intended to be only capable of debugging a single task, is performed by intercepting system calls made by the debugger application to the operating system.
Abstract: Debugging multiple tasks, using a single instance of a debugger application intended to be only capable of debugging a single task, is performed by intercepting system calls made by the debugger application to the operating system. The intercepted system calls are directed to an appropriate task, which is one amongst the multiple tasks to be debugged.
TL;DR: Improved facilities for performance analysis using coloured Petri nets are provided, including facilities for collecting data, running multiple simulations, generating statistically reliable simulation output, and comparing alternative system configurations.
Abstract: This paper provides an overview of improved facilities for performance analysis using coloured Petri nets. Coloured Petri nets is a formal method that is well suited for modeling and analyzing large and complex systems. The paper describes steps that have been taken to make a distinction between modeling the behavior of a system and observing the behavior of a model. Performance-related facilities are discussed, including facilities for collecting data, running multiple simulations, generating statistically reliable simulation output, and comparing alternative system configurations.
TL;DR: In this paper, the authors present a DSP device and a host system, where the host device inserts breakpoints into the shared program memory and tracks the debug breakpoints to determine which subsystems are associated with the breakpoints, and the subsystem halts until the host gathers necessary debug information from the subsystem.
Abstract: A processing system comprises a digital signal processor (DSP) device and a host system on which the DSP device is implemented. The DSP device comprises a shared program memory and a plurality of processor subsystems coupled to the shared program memory to concurrently execute program instructions stored in the shared program memory. The host system is capable of independently debugging each subsystem. During debugging, the host device inserts breakpoints into the shared program memory and tracks the debug breakpoints to determine which subsystems are associated with the breakpoints. When a subsystem executes a breakpoint associated with that subsystem, the subsystem halts until the host gathers necessary debug information from the subsystem. However, when a subsystem executes a breakpoint that is not associated with that subsystem, the host system causes the subsystem to execute the original program instructions and proceed as directed.
TL;DR: In this article, the authors present a plug-in module that allows the host computer to interact in the debugging process as necessary, so that any ICE may be programmed to communicate with any device.
Abstract: Communications between a device and a debugging system are effectuated by programming an ICE with a first logic set, which enables the ICE to establish communications with the device and determine a unique identifier thereof. The ICE communicates the device's unique identifier back to a host computer. The host computer matches the unique identifier to a second logic set and a plug-in module. The host computer then programs the ICE with the second logic set and activates the plug-in module. The second logic set allow the ICE and the device to execute program instructions downloaded with the second logic set in lock-step fashion. The plug-in module allows the host computer to interact in the debugging process as necessary. This achieves flexibility, because any ICE may be programmed to communicate with any device.
TL;DR: Alloy is a lightweight language for software modelling designed to be flexible and expressive, and yet amenable to fully automatic simulation and checking, and is investigating the use of Alloy to analyze object-oriented code.
Abstract: Alloy is a lightweight language for software modelling. It's designed to be flexible and expressive, and yet amenable to fully automatic simulation and checking. At its core, Alloy is a simple first order logic extended withrelational operators. A simple structuring mechanism allows Alloy to be used in a variety of idioms, and supports incremental construction of models. Alloy is analyzed by translation to SAT. The current version of the tool uses the Chaff and Berkmin solvers; these are powerful enoughto handle a searchspace of 2100 or more. Alloy has been applied to problems from very different domains, from checking the conventions of Microsoft COM to debugging the design of a name server. Most recently, we have used it to check distributed algorithms that are designed for arbitrary topologies. We are also investigating the use of Alloy to analyze object-oriented code.