Counterexample-guided abstraction refinement for symmetric concurrent programs

Abstract

Predicate abstraction and counterexample-guided abstraction refinement (CE-GAR) have enabled finite-state model checking of software written in mainstream programming languages. This combination of techniques has been successful in analysing systemlevel sequential C code. In contrast, there is little evidence of fruitful applications of CE-GAR to shared-variable concurrent software. We attribute this gap to the lack of abstraction strategies that permit a scalable analysis of the resulting multi-threaded Boolean programs. The goal of this paper is to close this gap. We have developed a symmetry-aware CEGAR technique: it takes into account the replicated structure of programs that consist of many threads executing the same procedure, and generates a Boolean program template whose multi-threaded execution soundly overapproximates the original concurrent program. State explosion during model checking parallel instantiations of this template can now be absorbed by exploiting symmetry. We have implemented our method in a tool, SYMMPA, and Supported by EPSRC projects EP/G026254/1 and EP/G051100/1 and ERC project 280053. 26Form Methods Syst Des (2012) 41:25-44 demonstrate its superior performance over alternative approaches on a range of synchronisation programs.

Abstracting and Counting Synchronizing Processes

“…In case the concurent processes can only read, test and write shared boolean variables, or spawn and join other processes, the obtained counter machine is essentially a Vector Addition System (VAS) for which state reachability is decidable [3,13]. For instance, works such as [6,8,9] build on this idea. Such translations cannot faithfully capture behaviours enforced by the barriers, e.g., there is no process still in the reading phase when some process crossed the barrier to the writing phase.…”

“…Still, program correctness might depend on the fact that these program variables do implement a barrier. Existing techniques, such as symmetric predicate abstraction [8,9], generate (broadcast) concurrent boolean programs for integer manipulating concurrent programs. The obtained transition systems are monotonic and cannot exclude behaviors forbidden by the implicit barriers.…”

“…We implement the outer loop by leveraging on existing symmetric predicate abstraction techniques [8,9]. We encode resulting boolean programs in terms of a counter machine where reachability of the concurrent program configurations satisfying a counting property from our logic is captured as a reachability problem for a target state of the counter machine.…”

“…Monotonic abstraction was not combined with predicate abstraction, nor did it explicitly target counting properties or dynamic barrier based synchronization. In [10,9], the authors propose a predicate abstraction framework for concurrent multithreaded programs. As explained earlier such abstractions cannot exclude runs forbidden by synchronization mechanisms such as barriers.…”

“…As explained earlier such abstractions cannot exclude runs forbidden by synchronization mechanisms such as barriers. In our work, we build on [10,9] in order to handle shared and local integer variables.…”