State-space exploration is the essence of model checking and an increasingly popular approach for automating test generation. A key issue in exploration of object-oriented programs is handling the program state, in particular the heap. Previous research has focused on standard program execution that operates on one state/heap. We present Delta Execution, a technique that simultaneously operates on several states/heaps. Delta execution exploits the fact that many execution paths in state-space exploration partially overlap and speeds up the exploration by sharing the common parts across the executions and separately executing only the “deltas ” where the executions differ. The heart of Delta Execution is an efficient representation and manipulation of sets of states/heaps. We have implemented Delta Execution in two model checkers: JPF and BOX. JPF is a popular general-purpose model checker for Java programs, and BOX is a specialized model checker that we have developed for efficient exploration of sequential Java programs. We have evaluated Delta Execution for (bounded) exhaustive exploration of ten basic subject programs without errors. The experimental results show that on average Delta Execution improves the exploration time 10.97x (over an order of magnitude) in JPF and 2.07x in BOX, while taking on average 1.51x less memory in JPF and roughly the same amount of memory in BOX. We have also evaluated Delta Execution for one larger case study with errors, where the exploration time improved up to 1.43x. Additionally, the experimental results for abstract matching, a recently proposed non-exhaustive exploration in JPF, of four subject programs show that on average Delta Execution improves the exploration time 3.37x.

Abstract. Java PathFinder (JPF) is an explicit-state model checker for Java programs. It explores all executions that a given program can have due to different thread interleavings and nondeterministic choices. JPF implements a backtracking Java Virtual Machine (JVM) that executes Java bytecodes using a special representation of JVM states. This special representation enables JPF to quickly store, restore, and compare states; it is crucial for making the overall state exploration efficient. However, this special representation creates overhead for each execution, even execution of deterministic blocks that have no thread interleavings or nondeterministic choices. We propose mixed execution, a technique that reduces execution time of deterministic blocks in JPF. JPF is written in Java as a special JVM that runs on top of a regular, host JVM. Mixed execution works by translating the state between the special JPF representation and the host JVM representation. We also present lazy translation, an optimization that speeds up mixed execution by translating only the parts of the state that a specific execution dynamically depends on. We evaluate mixed execution on six programs that use JPF for generating tests for data structures and on one case study for verifying a network protocol. The results show that mixed execution can improve the overall time for state exploration up to 36.98%, while improving the execution time of deterministic blocks up to 69.15%. Although we present mixed execution in the context of JPF and Java, it generalizes to any model checker that uses a special state representation.

The prominent visions of wireless sensor networks that appeared about a decade ago have spurred enormous efforts in research and development of this new class of wireless networked embedded systems. Despite the significant effort made, successful deployments and real-world applications of sensor networks are still scarce, labor-intensive and oftenn cumbersome to achieve. In this article, we survey prominent examples of sensor network deployments, their interaction with the real world and pinpoint a number of potential causes for errors and common pitfalls. In the second half of this work, we present methods and tools to be used to pinpoint failures and understand root causes. These instrumentation techniques are specifically designed or adapted for the analysis of distributed networked embedded systems at the level of components, sensor nodes, and networks of nodes.

Despite the technological advances in languages and tools to support program development, programmers still deliver software with lots of errors. Software testing has been the dominant approach in industry to improve the quality of software at code level. Testing software is not cheap though. A study done in 2002 by the National Institute of Standards and Technology (NIST) [NIS02] reports that between 70 % and 80 % of development costs is due to testing. We believe that automation of software testing can help to reduce this cost; automation can assist the programmer to test the code under development in a more systematic way. Software model checkers are becoming increasingly popular to assist in the automation of software testing. Model checkers are tools that systematically explore the state space of a model to demonstrate the presence of errors or to confirm their absence. For example, a model checker can report a test whenever it finds an “interesting ” state, i.e., a state which violates a user-defined assertion or a state that makes execution throw a runtime exception. This dissertation focuses on software model checkers that operate directly on code. Model checking programs is becoming very popular, as it enables the discovery of errors in the implementation as opposed to errors in a system design.