Symbolic Model Checking of Concurrent Programs Using Partial Orders and On-the-Fly Transactions

Abstract

Abstract. The state explosion problem is one of the core bottlenecks in the model checking of concurrent software. We show how to ameliorate the problem by combining the ability of partial order techniques to reduce the state space of the concurrent program with the power of symbolic model checking to explore large state spaces. Our new verification methodology involves translating the given concurrent program into a circuit-based model which gives us the flexibility to then employ any model checking technique of choice -either SAT or BDD-based -for verifying a broad range of linear time properties, not just safety. The reduction in the explored state-space is obtained by statically augmenting the symbolic encoding of the program by additional constraints. These constraints restrict the scheduler to choose from a minimal conditional stubborn set of transitions at each state. Another key contribution of the paper, is a new method for detecting transactions on-the-fly which takes into account patterns of lock acquisition and yields better reductions than existing methods which rely on a lockset based analysis. Moreover unlike existing techniques, identifying on-the-fly transactions does not require the program to follow a lock discipline in accessing shared variables. We have applied our techniques to the Daisy test bench and shown the existence of several bugs.

Efficient Modeling of Concurrent Systems in BMC

“…There have been some efforts [13][14][15][16] to combine symbolic model checking with the above mentioned state-reduction methods for verifying concurrent software. However, they still suffer from lack of scalability.…”

“…We have implemented our techniques in a prototype SMT-based BMC framework, and demonstrate its effectiveness through controlled experiments on a complex concurrency benchmark. For experiments, we contrast our lazy modeling approach with an eager modeling [13][14][15][16] of the concurrent system, i.e., a monolithic model synchronously composed with interleaving semantics (and possibly, with state-reduction constraints) enforced by an explicit scheduler, capturing all concurrent behaviors of the system eagerly.…”

“…-We also would like to formulate and solve iterative BMC problems incrementally, and integrate seamlessly state-of-the-art advancements in static analysis and BMC. We achieve our goals in a lazy modeling paradigm that simultaneously facilitates the use of several static techniques such as context-sensitive CSR and lockset analysis [9,10,14] and model transformations [21] to accelerate the performance of BMC.…”

“…Section 7). For example, using the lockset analysis [9,10,14], we can remove constraints for all pairs other than (r 2 @1, w 1 @9), (r 1 @1, w 2 @9), (r 2 @10, w 1 @3), (r 2 @10, w 1 @5) and (r 2 @10, w 1 @9). This is because other pairs are not reachable simultaneously in the mutually exclusive region, protected by the lock.…”

“…3. Deeper analysis: For a given BMC depth D and n concurrent threads, we guarantee finding a witness trace (if it exists), i.e., a sequence of global interleaved transitions, of length ≤ n · D, where the number of local thread transitions is at most D. In contrast, an eager modeling approach using BMC [14], an unrolling depth of n · D is needed for such a guarantee. Thus, we gain in memory use by a factor of n.…”