Predicate abstraction and refinement for verifying multi-threaded programs

Abstract

Automated verification of multi-threaded programs requires explicit identification of the interplay between interacting threads, so-called environment transitions, to enable scalable, compositional reasoning. Once the environment transitions are identified, we can prove program properties by considering each program thread in isolation, as the environment transitions keep track of the interleaving with other threads. Finding adequate environment transitions that are sufficiently precise to yield conclusive results and yet do not overwhelm the verifier with unnecessary details about the interleaving with other threads is a major challenge. In this paper we propose a method for safety verification of multi-threaded programs that applies (transition) predicate abstraction-based discovery of environment transitions, exposing a minimal amount of information about the thread interleaving. The crux of our method is an abstraction refinement procedure that uses recursion-free Horn clauses to declaratively state abstraction refinement queries. Then, the queries are resolved by a corresponding constraint solving algorithm. We present preliminary experimental results for mutual exclusion protocols and multi-threaded device drivers.

Bit-Precise Procedure-Modular Termination Analysis

“…We envisage extending the analysis to multi-threaded C programs. One way of extending the analysis to multi-threaded programs is using the rely-guarantee technique which is proposed by Jones [1983], and explored in several works [Cook et al 2007;Gupta et al 2011;Albert et al 2017] for termination analysis. In our setting, the predicates for environment assumptions can be used in a similar way as invariants and summaries are used in the analysis of sequential programs.…”

Effective Verification for Low-Level Software with Competing Interrupts

“…-The concurrent version of CBMC [Alglave et al 2013]; -IMPARA [Wachter et al 2013], which combines a new, symbolic form of partial-order reduction with the Impact algorithm [McMillan 2006]; -ESBMC [Morse et al 2014], a context-bounded symbolic model checker for multithreaded C programs; -Lazy-CSeq [Inverso et al 2015], a tool that translates a multi-threaded C program into a sequential C program with a given bound on the schedule rounds; -The concurrent version of SatAbs [Clarke et al 2005]; -Threader [Popeea and Rybalchenko 2013], which implements thread-modular reasoning [Gupta et al 2011]. …”

Inductive data flow graphs

“…The program is a challenge for many existing approaches. We ran experiments, for example, with the tool THREADER [16], which generates Owicki-Gries type proofs and rely-guarantee type proofs, and with the tool SLAB [11], which uses abstraction-refinement using Craig interpolation with slicing. In both tools, the space used for the proof grows exponentially in N .…”