Parameterized Model Checking of Fine Grained Concurrency

Sethi, Divjyot; Talupur, Muralidhar; Schwartz-Narbonne, Daniel; Malik, Sharad

doi:10.1007/978-3-642-31759-0_15

Cited by 3 publications

(8 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Firstly, we can minimize the number of user supplied lemmas by automatically discovering useful lemmas similar to the approach we take in [18]. Secondly, the model checking time for verifying Linearizability can be reduced by designing more efficient abstractions.…”

Section: Discussionmentioning

confidence: 99%

Model Checking Unbounded Concurrent Lists

Sethi

Talupur²,

Malik

2013

Model Checking Software

Self Cite

View full text Add to dashboard Cite

Abstract. We present a method for model checking list-based concurrent data structures. These data structures, increasingly available in libraries such as Intel Thread Building blocks and Java.util.concurrent (JSR), are notorious for being error prone. This stems from the usage of sophisticated synchronization techniques in their implementation for high efficiency. This efficiency comes at the cost of increasing the number of possible thread interleavings during execution, thus making them hard to verify. Consequently, the verification of concurrent data structures has been of interest to the formal methods community. Concurrent data structures are unbounded in two dimensions: the list size is unbounded and an unbounded number of threads access them. Thus, their model checking requires abstraction to a model bounded in both the dimensions. In previous work, we showed how the unbounded threads can be model checked by using the CMP (CoMPositional) method. The method abstracted the unbounded threads by keeping one thread as is and abstracting all the other threads to a single environment thread. Next, this abstraction was iteratively refined by the user in order to prove correctness. However, in that work we assumed that the number of list elements were bounded to a fixed value. In practice this fixed value was small; model checking could only complete for small sized lists. In this work, we overcome this limitation and model check the unbounded list as well. Our method has the same flavor as the CMP method in the thread dimension, but differs significantly in the list dimension. In the list dimension, our method constructs an abstraction of the unbounded list by keeping the nodes pointed to by the pointers in the model as is (referred to as concrete nodes), and abstracting away chains of all the nodes which are not pointed to by any pointers to abstract nodes. Since the accesses to the abstract nodes return non-deterministic field values, the abstraction may have to be refined to constrain these values. This is accomplished by the iterative addition of lemmas by the user. We show the soundness of our method and establish its utility by model checking challenging concurrent data structure examples.

show abstract

Section: Discussionmentioning

confidence: 99%

Model Checking Unbounded Concurrent Lists

Sethi

Talupur²,

Malik

2013

Model Checking Software

Self Cite

View full text Add to dashboard Cite

show abstract

“…Then, the local pointer values are non-deterministically chosen to complete the actions. This abstraction is completely syntactic in nature [18].…”

Section: Abstracting Unbounded Threadsmentioning

confidence: 99%

“…In previous work [18], we showed how to model check Linearizability for concurrent data structures. Concurrent list-based data structures are unbounded in two dimensions -they have an unbounded number of list nodes and an unbounded number of threads accessing the list items.…”

Section: Introductionmentioning

confidence: 99%

“…The refinement of the abstract model is done in a loop, referred to as the CMP loop. In the loop, if the abstract model is falsified by the model checker, the model is refined by the user by supplying non-interference lemmas, in order to constrain the other thread [18].…”

Section: Introductionmentioning

confidence: 99%

“…Since the CMP method does not handle unbounded list size, in our initial work [18], we had assumed the list size to be bounded. Further, in practice, we were only able to scale to a small number of list nodes.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Model checking unbounded concurrent lists

Sethi

Talupur

Malik

2015

Int J Softw Tools Technol Transfer

Self Cite

View full text Add to dashboard Cite

We present a method for model checking list-based concurrent data structures. These data structures, increasingly available in libraries such as Intel Thread Building blocks and Java.util.concurrent (JSR), are notorious for being error prone. This stems from the usage of sophisticated synchronization techniques in their implementation for high efficiency. This efficiency comes at the cost of increasing the number of possible thread interleavings during execution, thus making them hard to verify. Consequently, the verification of concurrent data structures has been of interest to the formal methods community. Concurrent data structures are unbounded in two dimensions: the list size is unbounded and an unbounded number of threads access them. Thus, their model checking requires abstraction to a model bounded in both the dimensions. In previous work, we showed how the unbounded threads can be model checked by using the CMP (CoMPositional) method. The method abstracted the unbounded threads by keeping one thread as is and abstracting all the other threads to a single environment thread. Next, this abstraction was iteratively refined by the user in order to prove correctness. However, in that work we assumed that the number of list elements were bounded to a fixed value. In practice this fixed value was small; model checking could only complete for small sized lists. In this work, we overcome this limitation and model check the unbounded list as well. Our method has the same flavor as the CMP method in the thread dimension, but differs significantly in the list dimension. In the list dimension, our method constructs an abstraction of the unbounded list by keeping the nodes pointed to by the pointers in the model as is (referred to as concrete nodes), and abstracting away chains of all the nodes which are not pointed to by any pointers to abstract nodes. Since the accesses to the abstract nodes return non-deterministic field values, the abstraction may have to be refined to constrain these values. This is accomplished by the iterative addition of lemmas by the user. We show the soundness of our method and establish its utility by model checking challenging concurrent data structure examples.

show abstract

Parametrized verification diagrams: temporal verification of symmetric parametrized concurrent systems

Sánchez

2016

Ann Math Artif Intell

View full text Add to dashboard Cite

Parameterized Model Checking of Fine Grained Concurrency

Cited by 3 publications

References 20 publications

Model Checking Unbounded Concurrent Lists

Model Checking Unbounded Concurrent Lists

Model checking unbounded concurrent lists

Parametrized verification diagrams: temporal verification of symmetric parametrized concurrent systems

Contact Info

Product

Resources

About