Some FMUs generated by OpenModelica crash under FMUChecker

[anatoly.trosinenko@…]

I had to investigate a crash of OpenModelica-generated FMU. During this, a minimal example was produced that compiles to FMU without any warnings but crashes under FMUChecker with Segmentation Fault.

How to reproduce

1. Compile the TestPackage.Test model to FMU.

   package TestPackage
   
     model X
       annotation(Inline=true);
       input Real x[2];
       output Real y[2];
     algorithm
       y := [1, 0; 0, 1] * x;
     end X;
   
     model Test
       input Real x[2];
       output Real y[2];
       X m;
     equation
       connect(x, m.x);
       connect(m.y, y);
     end Test;
   
   end TestPackage;
   

2. Pass path to the compiled FMU to the FMUChecker

What is expected

Either Modelica compiler refuses to compile the model at the step 1 or the generated FMU passes checks of FMUChecker.

What really happens

At the step 1, the model is compiled to FMU without any warnings and errors. But when I run FMUChecker on it, the process crashes with Segmentation fault. (And it seems that simulation of the same model does work) What shows gdb after manual recompilation of FMU with CFLAGS="-ggdb3 -O0":

(gdb) r
Starting program: /home/trosinenko/tmp/FMUChecker-2.0.1/build/fmuCheck.linux64 TestPackage_Test.fmu
[INFO][FMUCHK] FMI compliance checker Test [FMILibrary: Test] build date: Aug  5 2016
[INFO][FMUCHK] Called with following options:
[INFO][FMUCHK] /home/trosinenko/tmp/FMUChecker-2.0.1/build/fmuCheck.linux64 TestPackage_Test.fmu
[INFO][FMUCHK] Will process FMU TestPackage_Test.fmu
[INFO][FMILIB] XML specifies FMI standard version 2.0
[INFO][FMI2XML] Found model identifiers for ModelExchange and CoSimulation
[INFO][FMUCHK] Model name: TestPackage.Test
[INFO][FMUCHK] Model GUID: {4ba261a5-07e7-488b-83b0-06e1c8ea4eb9}
[INFO][FMUCHK] Model version: 
[INFO][FMUCHK] FMU kind: ModelExchange and CoSimulation
[INFO][FMUCHK] The FMU contains:
0 constants
0 parameters
0 discrete variables
8 continuous variables
2 inputs
2 outputs
4 local variables
0 independent variables
0 calculated parameters
8 real variables
0 integer variables
0 enumeration variables
0 boolean variables
0 string variables

[INFO][FMUCHK] No input data provided. In case of simulation initial values from FMU will be used.
[INFO][FMUCHK] Printing output file header
"time","y[1]","y[2]"
[INFO][FMUCHK] Model identifier for ModelExchange: TestPackage_Test
[INFO][FMILIB] Loading 'linux64' binary with 'default' platform types
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[INFO][FMUCHK] Version returned from ME FMU: '2.0'


Program received signal SIGSEGV, Segmentation fault.
0x00007ffff71c0bed in pool_expand (len=8) at include/./gc/memory_pool.c:92
92        if (memory_pools->size - memory_pools->used >= len) {
(gdb) p memory_pools
$1 = (list *) 0x0
(gdb) bt
#0  0x00007ffff71c0bed in pool_expand (len=8) at include/./gc/memory_pool.c:92
#1  0x00007ffff71c0cdb in pool_malloc (sz=8) at include/./gc/memory_pool.c:110
#2  0x00007ffff71c1d57 in calc_base_index_dims_subs (ndims=1) at include/./util/base_array.c:314
#3  0x00007ffff71bf0ec in TestPackage_Test_eqFunction_1 (data=0x697120, threadData=0x695d90) at TestPackage_Test_06inz.c:24
#4  0x00007ffff71bf218 in TestPackage_Test_functionInitialEquations_0 (data=0x697120, threadData=0x695d90) at TestPackage_Test_06inz.c:58
#5  0x00007ffff71bf273 in TestPackage_Test_functionInitialEquations (data=0x697120, threadData=0x695d90) at TestPackage_Test_06inz.c:70
#6  0x00007ffff71e7076 in symbolic_initialization (data=0x697120, threadData=0x695d90, numLambdaSteps=5) at include/./simulation/solver/initialization/initialization.c:286
#7  0x00007ffff71e77da in initialization (data=0x697120, threadData=0x695d90, pInitMethod=0x7ffff71e801f "", pInitFile=0x7ffff71e801f "", initTime=0, lambda_steps=5) at include/./simulation/solver/initialization/initialization.c:632
#8  0x00007ffff71bafe1 in fmi2EnterInitializationMode (c=0x697a80) at include/fmi2/fmu2_model_interface.c:458
#9  0x000000000040f6d7 in fmi2_me_simulate ()
#10 0x000000000040e757 in fmi2_check ()
#11 0x000000000040849a in main ()

[gdinis]

I'm having the same problem with FMI2 and ME. I'm running the fmu on a wrapper but also, the same problem happens on fmuchk.
Log:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb00feb40 (LWP 31692)]
0xaed3a6b6 in pool_expand () from tmp/fmuTmploKPnD/binaries/linux32/XPTO.so
#0  0xaed3a6b6 in pool_expand () from tmp/fmuTmploKPnD/binaries/linux32/XPTO.so
#1  0xaed3a351 in pool_malloc () from tmp/fmuTmploKPnD/binaries/linux32/XPTO.so
#2  0xaec9f806 in mmc_mk_scon () from tmp/fmuTmploKPnD/binaries/linux32/XPTO.so
#3  0xaec620c5 in setDefaultStartValues () from tmp/fmuTmploKPnD/binaries/linux32/XPTO.so
#4  0xaec5c227 in fmi2Instantiate () from tmp/fmuTmploKPnD/binaries/linux32/XPTO.so

It is normally related with:

[INFO][FMILIB] Loading 'linux32' binary with 'default' platform types
[FATAL][FMICAPI] Could not load the DLL: /tmp/fmucktmpZX4P6v/binaries/linux32/XPTO.so: undefined symbol: mmc_mk_modelica_array
[FATAL][FMUCHK] Could not create the DLL loading mechanism(C-API) for ME.

Does anyone knows what might be the cause of the problem?

[spinhalf@…]

The same trouble with the FMUs (pendulum1 and pendulum2) in
the "FmuFmuPendulumInternalDynamics" model which is included
in the examples of composite model for OMTLMSimulator.

As it is tested in linux64 system, there is a segfault in
mmc_mk_scon() to set the string constants in the routine
to assign the initial condition.

After some maze running, I found that pool_malloc() is called without
initialization of the memory pools.
So, as an ad-hoc remedy, one can modify pool_exapnd() just adding a line to initialize the pools.

Dose it help?

static inline void pool_expand(size_t len)
{
  list *newlist = NULL;
  /* Check if we have enough memory already */
  if (memory_pools == NULL) pool_init(); // <-- this line !!!!
  if (memory_pools->size - memory_pools->used >= len) {
    return;
  }
  newlist = (list*) malloc(sizeof(list));
  memory_pools = newlist;
  memory_pools->used = 0;
  memory_pools->size = upper_power_of_two(3*memory_pools->next->size/2 + len); /* expand by 1.5x the old memory pool. More if we request a very large array. */
  memory_pools->memory = malloc(memory_pools->size);

}

[Martin Sjölund]

There are changes to the way the memory pool works with FMUs; can you test the nightly build to see if the problem remains?

[anatoly.trosinenko@…]

Thank you! Now it seems to be simulated correctly -- at least does not crash. Tested on fresh OpenModelica nightly build, FMUChecker 2.0.3b2 (slightly outdated) and FMU export modes 1.0 ME, 2.0 ME / CS / ME_CS.

[Andreas Heuermann]

Seems that this issue was solved 2 years ago.