A Widening Approach to Multithreaded Program Verification

Abstract

Pthread-style multithreaded programs feature rich thread communication mechanisms, such as shared variables, signals, and broadcasts. In this article, we consider the automated verification of such programs where an unknown number of threads execute a given finite-data procedure in parallel. Such procedures are typically obtained as predicate abstractions of recursion-free source code written in C or Java. Many safety problems over finite-data replicated multithreaded programs are decidable via a reduction to the coverability problem in certain types of well-ordered infinite-state transition systems. On the other hand, in full generality, this problem is Ackermann-hard, which seems to rule out efficient algorithmic treatment. We present a novel, sound, and complete yet empirically efficient solution. Our approach is to judiciously widen the original set of coverability targets by configurations that involve fewer threads and are thus easier to decide, and whose exploration may well be sufficient: if they turn out uncoverable, so are the original targets. To soften the impact of "bad guesses"-configurations that turn out coverable-the exploration is accompanied by a parallel engine that generates coverable configurations; none of these is ever selected for widening. Its job being merely to prevent bad widening choices, such an engine need not be complete for coverability analysis, which enables a range of existing partial (e.g., nonterminating) techniques. We present extensive experiments on multithreaded C programs, including device driver code from FreeBSD, Solaris, and Linux distributions. Our approach outperforms existing coverability methods by orders of magnitude.

An SAT‐Based Method to Multithreaded Program Verification for Mobile Crowdsourcing Networks

“…Starting from the target states, it computed the exact backward reachability by using finite state symbolic model checking [27] based on BDDs [28] to solve the coverability problem of NSW. Kaiser et al [11,22] introduced a new algorithm to solve the safety properties of multithreaded programs with an unbounded number of threads executing a finite state, nonrecursive procedure. By using many inexpensive uncoverability proofs, this new approach combined forward propagation under-approximations with backward propagation of overapproximations to the coverability problem in TTS.…”

“…It is easy to see that ( , ⪯) fulfills the definition of WSTS. A TTS with standard thread and spawn transition can be expressed as plain Petri nets [22] and is the subset class of NSW [20].…”

“…Coverability is the base verification task for WSTS: the question is whether the system can reach an unsafe or illegal configuration among some subset of its (possibly unbounded number of) components. There have been several algorithms published for WSTS coverability problem [9][10][11][20][21][22], but none perform as efficiently as finite state model checking.…”

Occam’s Razor Applied to the Petri Net Coverability Problem

“…It comprises models from various sources: Mist [10], BFC [13], Erlang programs abstracted into Petri nets [6], as well as so-called medical and bug_tracking examples [7]. We let each tool work for 2000 seconds in a machine on Ubuntu Linux 14.04 with Intel(R) Core(TM) i7-4770 CPU at 3.40GH with 16 GB of memory for each benchmark.…”

The Polynomial Complexity of Vector Addition Systems with States

“…Vector addition systems (VASs) [13], which are equivalent to petri nets, are a popular model for the analysis of parallel processes [7]. Vector addition systems with states (VASSs) [10] are an extension of VASs with a finite control and are a popular model for the analysis of concurrent systems, because the finite control can for example be used to model a shared global memory [12]. In this paper, we consider VASSs over a parameterized initial configuration.…”