Executable Slices Research Articles

An empirical evaluation of quasi-static executable slices

Program slicing aims to reduce a program to a minimal form that produces the same output for a given slicing criterion. Program slicing approaches divide into static and dynamic approaches: whereas static approaches generate an over-approximation of the slice that is valid for all possible program inputs, dynamic approaches rely on executing the program and thus generate an under-approximation of the slice that is valid for only a subset of the inputs. An important limitation of static approaches is that they often do not generate an executable program, but rather identify only those program components upon which the slicing criterion depends (referred to as a closure slice). In order to overcome this limitation, we propose a novel approach that combines static and dynamic slicing. We rely on observation-based slicing, a dynamic approach, but protect all statements that have been identified as part of the static slice by the static slicer CodeSurfer. As a result, we obtain slices that cover at least the behavior of the static slice, and that can be compiled and executed. We evaluated this new approach on a set of 62 C programs and report our findings.

The 24-Core POWER9 Processor With Adaptive Clocking, 25-Gb/s Accelerator Links, and 16-Gb/s PCIe Gen4

The POWER9TM family of chips is fabricated in 14-nm silicon-on-insulator finFET technology using 17 levels of copper interconnect. The 695-mm2 24-core microprocessor features a new core based on an execution slice microarchitecture. The chip contains 8 billion transistors and has 120 MB of eDRAM L3 cache. The processor features an adaptive clock strategy to reduce timing margin needed during power supply droop events by embedding analog voltage-droop monitors that direct a digital phase-locked loop to immediately reduce clock frequency in response to a droop event. The scale-out chip IO subsystem supports up to 300-GB/s accelerator bandwidth using new 25-Gb/s links, 48 lanes of PCIeGen4 totaling 192 GB/s, eight ports of 2667 MT/s DDR4, and 256 GB/s of symmetric multiprocessor (SMP) interconnect. The scale-up chip adds additional SMP bandwidth and replaces the DDR4 memory interface with eight ports of differential memory interfaces with 230 GB/s of bandwidth resulting in 12.9 Tb/s of total off-chip bandwidth.

On detecting environment sensitivity using slicing

Modern malware often evades debuggers, virtual machines, and emulators. It is interesting if one can observe their behavior difference using controlled environments. This paper formalizes the notion of environment sensitivity, and proposes two alternative semantics: one based on program trace and the other based on code coverage. Then it tackles the following question: can one minimize an environment sensitive program? The work presents progressive executable slice, a subprogram generated from a partial control but full data dependency closure of a program under study. It shows that a progressive slice can retain trace based environment sensitivity but not the code coverage sensitivity, for which, a special condition is needed for restraining the slice. The saturated trace set of a program is used as a cost indicator for observing its behavior difference. The paper shows that a progressive slice does not necessarily have a lower observation cost than its container program. To address it, a consistency condition is proposed. The paper introduces a reference algorithm for generating progressive slices, and discusses its approximation in practice.

Simulink fault localization: an iterative statistical debugging approach

SummaryDebugging Simulink models presents a significant challenge in the embedded industry. This paper proposes SimFL, a fault localization approach for Simulink models by combining statistical debugging and dynamic model slicing. Simulink models, being visual and hierarchical, have multiple outputs at different hierarchy levels. Given a set of outputs to observe for localizing faults, we generate test execution slices, for each test case and output, of the Simulink model. In order to further improve fault localization accuracy, we propose iSimFL, an iterative fault localization algorithm. At each iteration, iSimFL increases the set of observable outputs by including outputs at lower hierarchy levels, thus increasing the test oracle cost but offsetting it with significantly more precise fault localization. We utilize a heuristic stopping criterion to avoid unnecessary test oracle extension. We evaluate our work on three industrial Simulink models from Delphi Automotive. Our results show that, on average, SimFL ranks faulty blocks in the top 8.9% in the list of suspicious blocks. Further, we show that iSimFL significantly improves this percentage down to 4.4% by requiring engineers to observe only an average of five additional outputs at lower hierarchy levels on top of high‐level model outputs. Copyright © 2016 John Wiley & Sons, Ltd.

Real-Time Scheduling for Xen-ARM Virtual Machines

This paper investigates the feasibility of real-time scheduling with mobile hypervisor, Xen-ARM. Particularly for mobile virtual machines, real-time support is in high demand. However, it is difficult to guarantee real-time scheduling with virtual machines because inter-VM and intra-VM schedulability have to be determined in multi-OS environments. To address the schedulability, first, this paper presents a definition of a real-time virtual machine. Second, this paper analyzes intra-VM schedulability, taking quantization overhead into account. Quantization overhead comes from tick-based scheduling of Xen-ARM, which requires integer presentation of scheduling period and execution slice. Third, to minimize quantization overhead, this paper provides a new algorithm, called SH-quantization that provides accurate and efficient parameterization of a real-time virtual machine. Fourth, this paper presents an inter-VM schedulability test for incorporating multiple real-time virtual machines. To evaluate the approach, we implement the SH-quantization algorithm in Xen-ARM and paravirtualize a real-time OS, called xeno-μC/OS-II. We ran extensive experiments with various configurations of real-time tasks on a real hardware platform in order to characterize the scheduling behavior of real-time virtual machine with quantization. The results show that quantization overhead consumes additional CPU bandwidth up to 90% and the proposed algorithm guarantees intra/inter-VM schedulability with minimal CPU bandwidth.

Specialization Slicing

This paper defines a new variant of program slicing, called specialization slicing , and presents an algorithm for the specialization-slicing problem that creates an optimal output slice. An algorithm for specialization slicing is polyvariant : for a given procedure р, the algorithm may create multiple specialized copies of р. In creating specialized procedures, the algorithm must decide for which patterns of formal parameters a given procedure should be specialized and which program elements should be included in each specialized procedure. We formalize the specialization-slicing problem as a partitioning problem on the elements of the possibly infinite unrolled program. To manipulate possibly infinite sets of program elements, the algorithm makes use of automata-theoretic techniques originally developed in the model-checking community. The algorithm returns a finite answer that is optimal (with respect to a criterion defined in the article). In particular, (i) each element replicated by the specialization-slicing algorithm provides information about specialized patterns of program behavior that are intrinsic to the program, and (ii) the answer is of minimal size (i.e., among all possible answers with property (i), there is no smaller one). The specialization-slicing algorithm provides a new way to create executable slices. Moreover, by combining specialization slicing with forward slicing, we obtain a method for removing unwanted features from a program. While it was previously known how to solve the feature-removal problem for single-procedure programs, it was not known how to solve it for programs with procedure calls.

HSFal: Effective fault localization using hybrid spectrum of full slices and execution slices

Most of the existing fault localization approaches use execution coverage of test cases to isolate the suspicious codes that likely contain faults. Program slicing can extract the dependencies of program entities with respect to a specific criterion. Therefore this technique is expected to have a beneficial effect on fault localization. In this paper, we propose a novel approach using a hybrid spectrum of full slices and execution slices to improve the effectiveness of fault localization. In particular, our approach firstly computes full slices of failed test cases and execution slices of passed test cases respectively. Secondly it constructs the hybrid spectrum by intersecting full slices and execution slices. Finally it computes the suspiciousness of each statement in the hybrid slice spectrum and generates a fault location report with descending suspiciousness of each statement. We also implement our proposed approach in our prototype tool HSFal by Java programming language. To verify the effectiveness of our approach, we performed an empirical study by the prototype on several widely used open source programs. Our approach is compared with eight representative coverage-based and slice-based fault localization approaches. Final experimental results show that our proposed approach is more effective in fault localization than other compared approaches, and can reduce almost 2.98–31.79% of the average cost of examined code significantly.

Effective program debugging based on execution slices and inter-block data dependency

Localizing a fault in program debugging is a complex and time-consuming process. In this paper we present a novel approach using execution slices and inter-block data dependency to effectively identify the locations of program faults. An execution slice with respect to a given test case is the set of code executed by this test, and two blocks are data dependent if one block contains a definition that is used by another block or vice versa. Not only can our approach reduce the search domain for program debugging, but also prioritize suspicious locations in the reduced domain based on their likelihood of containing faults. More specifically, we use multiple execution slices to prioritize the likelihood of a piece of code containing a specific fault. In addition, the likelihood also depends on whether this piece of code is data dependent on other suspicious code. A debugging tool, DESiD, was developed to support our method. A case study that shows the effectiveness of our method in locating faults on an application developed for the European Space Agency is also reported.

Slicing tools for synchronous reactive programs

In this paper, we present two slicing tools: VHDL_Slice and Est_slice that compute static executable slices of VHDL and Esterel programs respectively. The slicers have been tested on a number of small and medium sized examples.

REDESIGNING LEGACY SYSTEMS INTO THE OBJECT-ORIENTED PARADIGM

Object-oriented languages support many modern programming concepts such as information hiding, inheritance, polymorphism, and dynamic binding. As a result, software systems implemented in OO languages are in general more reusable and reliable than others. Many legacy software systems, created before OO programming became popular, need to be redesigned and updated to OO programs. The process of abstracting OO designs from the procedural source code has often been done with limited assistance from program structural diagrams. Most reengineering focuses on the functionality of the original program, and the OO redesign often results in a completely new design based on the designers' understanding of the original program. Such an approach is not sufficient because it may take a significant amount of time and effort for designers to comprehend the original program. This paper presents a computer-aided semi-automatic method that abstracts OO designs from the original procedural source code. More specifically, it is a method for OO redesign based on program structural diagrams, visualization, and execution slices. We conducted a case study by applying this method to an inventory management software system. Results indicate that our method can effectively and efficiently abstract an appropriate OO design out of the original C code. In addition, some of the code from the original system can be automatically identified and reused in the new OO system.

Slicing knowledge-based systems: techniques and applications

Slicing is a process for automatically obtaining subparts of a program responsible for specific computations. It has been employed within conventional procedural programming to solve a number of software development issues. We have adapted and extended slicing techniques originally proposed for procedural languages, to knowledge-based systems. Our techniques comprise a representation proposal for the successful and failed inferences performed by the system, a means to detect and represent the dependences among parts of the system, a formal definition of relevance among these parts and an algorithm proven correct to obtain executable slices of a system. We illustrate the usefulness of the slicing process with practical applications.

An overview and comparative classification of program slicing techniques

Program slicing is a method for decomposing programs into slices. A program slice contains all statements that could have influenced the value of a variable of interest at some program point. The technique of program slicing has up to now been applied within a number of areas, such as software maintenance, program integration, testing, parallel processing distribution and, especially, program debugging. A slice of a program is computed either by use of static information (a static slice) or dynamic information (a dynamic slice). A static slice of a program, although imprecise, contains much broader information, and thus it tends to be much thicker than the corresponding dynamic slice. The reason is that, for a specified variable in a program, the static slice is the collection of all possible computations of values of that variable. On the other hand, a dynamic slice isolates the unique computation of the value of the specified variable for a certain program execution. The current literature on slicing is becoming unwieldy, with many different notions and methods. This article attempts to bring order to disorder by identifying and classifying different notions of program slicing and their applications. A new notion of execution slice and a method for interprocedural dynamic slicing are introduced as well.

Static slicing in the presence of goto statements

A static program slice is an extract of a program which can help our understanding of the behavior of the program; it has been proposed for use in debugging, optimization, parallelization, and integration of programs. This article considers two types of static slices: executable and nonexecutable. Efficient and well-founded methods have been developed to construct executable slices for programs without goto statements; it would be tempting to assume these methods would apply as well in programs with arbitrary goto statements. We show why previous methods do not work in this more general setting, and describe our solutions that correctly and efficiently compute executable slices for programs even with arbitrary goto statements. Our conclusion is that goto statements can be accommodated in generating executable static slices.