Modeling Non-deterministic C Code with Active Objects

Abstract

Cheap and ubiquitous availability of multi-processor hardware provides a strong incentive to parallelize existing software. We aim to annotate existing sequential applications written in C with OpenMP directives that can be processed by compilers on high performance parallel computers. We adopt a model-based approach, where from sequential C-code a software model is extracted in a largely automatic fashion. The target is the modeling language ABS (Abstract Behavioral Specification), an active objects-language with formal semantics. ABS has been designed to be statically analyzable. We focus on the first stages of model-based parallelization: model extraction and validation. We define a behavior-preserving, fully automatic translation of a large fragment of sequential C that explicitly renders all possible execution sequences, then use automated test case generation to produce validation test cases.

The Right Kind of Non-Determinism: Using Concurrency to Verify C Programs with Underspecified Semantics

“…In order to extract an ABS model annotated with appropriate specifications from a (specified) C program, we extend the approach from [37] (which extracts a non-deterministic Active Objects model from C code containing underspecified behavior) by automatically generating some specifications which are sound by construction and generating all other specifications by translation of the specifications in the underlying C program. In order to translate ACSL function contracts into method contracts it was also required to slightly change the manner in which function parameters were modeled, from parameters of the class to parameters of the call method within the class.…”

“…C2ABS [37] is an Eclipse plugin which extracts an ABS model from a C program. Here we describe how this extraction takes place.…”

“…Verification of this program is a challenging task due to the extensive non-determinism. In [37] the extracted model for this program was exhaustively checked for inputs up to 5, validating that all possible outputs (and no outputs outside this range) could be produced. Later experiments with an enhanced model extraction process partially validated models for inputs up to 10.…”

“…More precisely, this work presents an approach to automatically verify functional behavior of C programs with underspecified semantics, which is based on reducing underspecification to non-determinism in a fully specified language: We are able to verify functional properties of C programs without undefined behavior with respect to every possible standard-compliant semantics. In this work we build upon the model-extraction approach by Wasser et al [37] for a subset of the C language and give an implemented system that verifies the functional behavior of the extracted model. The extracted model gives a fully formal and analyzable semantics for C in terms of an Active Object framework.…”

“…While our approach currently works only with an admittedly smaller subset of C containing underspecification than that allowed in RV-Match and Frama-C, it faithfully considers all possible evaluation paths allowed by the standard. Cerberus [4,33] is an analysis tool for undefined and underspecified behavior; however, it cannot utilize any specifications and its treatment of unspecified evaluation order of side effects does not match the C standard, as demonstrated in [37]. The separation logic system of Frumin et al [17], based on small-step semantics in Coq [30] correctly treats underspecification.…”