Effective Fault Localization Using Dynamic Slicing and an SMT Solver

Abstract

Dynamic slicing and spectrum-based fault localization (SFL) are widely used as fault localization methods. While these methods are effective for localizing a faulty statement in a program, they have some practical drawbacks. One of the drawbacks with dynamic slicing is that if a program is large, the sliced program will also remain large in general. One of the drawbacks with SFL is that the suspiciousness of faulty statements may become low, even if only one fault exists in a program. To overcome these drawbacks, we propose an effective fault localization method that iteratively generates test cases that cause an error using a satisfiability modulo theories (SMT) solver such that the result of dynamic slicing for each generated failed test case is distinct. Using test cases generated by our method, the suspiciousness of a faulty statement is always maximum when a target has only one fault. Furthermore, the number of statements that have maximum suspiciousness, that is, the number of fault candidates, is smaller than that obtained by conventional dynamic slicing. In this paper, we explain our proposed method by applying it to MATLAB/Simulink models.