download pdf version

Introduction Debugging is just one part of software development and, just as in the insect world, some bugs are harder to find than others. Concurrency errors are the cockroaches of the software bug world—they are difficult to detect and appear at the most inopportune times. These errors occur when concurrent computer operations attempt to access a shared resource— such as data in memory— without proper synchronization. The result is either a deadlock (the program grinds to a halt) or race conditions (leading to inconsistent and unpredictable behavior). Concurrency errors are among the most expensive and time consuming bugs to diagnose and fix. Because concurrency problems are intermittent and difficult to replicate, these types of bugs tend to remain undetected for long periods of time. When they do appear, however, they can have catastrophic consequences. The Fluid Solution In its role of identifying new software development tools, Lockheed Martin’s Software Technology Initiative (STI), managed by Lockheed Martin Advanced Technology Laboratories (ATL), discovered Fluid. Fluid is a practical tool for programmers to detect concurrency errors in Java software. Developed by Carnegie Mellon University (CMU), Fluid examines program source code, plus design intent captured by developer annotations in the code, to provide sound analysis-based verification that the code is free of critical concurrency errors. Using Fluid, there is no longer any reason to risk releasing software that may contain concurrency bugs. Fluid provides positive assurance that harmful defects have been eliminated during development. In a series of diagnostics coordinated by ATL, Fluid identified logic and programming errors in sensor and tracking software in which earlier extensive testing had revealed no errors. Fluid can reduce the time required to detect and diagnose concurrency errors by several orders of magnitude, helping to quickly deliver a highly reliable and dependable software product. Fluid is also easy to use. After a brief training period of less than four hours, developers were able to run Fluid on their programs with only minimum assistance. One engineer observed during the Fluid tests, “I can’t think of any of our Java code I wouldn’t want to run this tool on.” Another engineer observed, Fluid “pointed out things that we would not have looked at—would not have even noticed or caught in a code review.” Fluid is now being transitioned to a commercial product called JSureR by SureLogic of Pennsylvania. The Future Demand for tools like Fluid is increasing. For example, the U. S. Air Force recently announced its intention to spend more than $10M for analysis tools to find vulnerabilities in its internally written software. Our customers will soon realize that they do not have to accept software for which both the customer and the developer are innocently unaware of potentially critical errors.