Lecture Notes in Computer Science 3472

552 Séverine Colin and Leonardo Mariani
it can specify only invariants stating if a given variable is constant, positive, negative,
odd, even or approximatively bounded. This approach has been shown to
be particularly effective for debugging [HL02a]; in fact an anomalous behavior
often violates several invariants before generating the failure. Thus, the sequence
of violated invariants can be used to reach the point storing the fault from the
point that has generated the failure.
Other Techniques In the past, other inference techniques have been proposed
in the Machine Learning field [RW88], but they are quite complex and rarely
can learn programs more complex than a binary function. For instance, Lau et
al. [LDW03] proposed a learning technique able to learn program statements
from executions, but it learns only procedural programs, requires a heavy instrumentation,
and is not suitable to learn programs of non-trivial complexity
(the average program length is six statements).
18.7 Case Studies
Theoretical aspects such as language expressiveness, complexity of specifying
requirements and intrusiveness of the approach are very important, but the
concrete applicability of a run-time verification technique must be demonstrated
with industrial case studies.
The Java implementation of PathExplorer, named JPaX, has been essentially
developed and used in the NASA Research Center, therefore it has been
applied to many programs produced for rovers, spacecrafts and similar devices.
In particular, JPaX has been used to verify the planetary rover controller K9’s
executive subsystem [ADG + 03], a space craft fault protection system [ADG + 03]
and a space craft attitude control system [HR04].
The K9’s executive subsystem is a multi-threaded system of about 8.000 lines
of Java code that executes hierarchical plans. JPaX has been used to discover
faults related to concurrency, and produced encouraging results; in fact, the tool
discovered all but two concurrency faults, all data races and all deadlocks. The
two missed faults are subtle errors involving Java’s wait and notify constructs.
More advanced techniques, e.g., model checking, are required to detect such kind
of errors.
The space craft fault protection system monitors both critical hardware and
software components to detect faults and to execute corrective responses. JPaX
has been used to check LTL formulas against execution traces and it discovered
some bugs and inaccuracies in the documentation. One of the found bugs was
even present in the program version that flew on the space craft.
The attitude control system is 1850 lines length Java program that was analyzed
by the JPaX’s concurrency algorithms. Also in this case JPaX found unknown
data races and found all artificially generated deadlocks and data races.
Moreover, JPaX has been executed also for verifying several small size programs,
such as a discrete-event elevator simulator (about 500 lines of code) and
two task-parallel applications (about 250 and 700 lines of code) [AHB03]. JPaX