1/25 Context-Bounded Analysis of Concurrent Queue Systems Gennaro Parlato University of Illinois at Urbana-Champaign Università degli Studi di Salerno Salvatore La Torre (U. Salerno) P. Madhusudan (U. Illinois U-C)

2/25 Queue Systems  Architecture A node is a process:  Finite control  Recursive (call-stack) An edge is a FIFO channel  Unbounded capacity queue  Finite message alphabet  Finite shared memory shared memory p1p1 p2p2 Self-loops not allowed!

3/25 Queue Systems  A configuration C = ( LS 1,...,LS n, SM, St 1,..., St n, Q 1,..., Q m )  LS i = local states SM = shared memory St i = stack content of process pi Q i = content of queue i  An action for a process p i : internal (changes LS i / SM ) push or pop from its own stack send or receive a message from a queue finiteunbounded

4/25 A natural model  Asynchronous or event-driven programs Multi-core systems  Libasync-smp (Zeldovich et al, USENIX’03) Single-processor systems (e.g. Java, web service design)  Callbacks  NesC (Gay et al, PLDI’03)  Distributed systems communicating via FIFO message channels Distributed communication protocols

5/25 Model-Check Queue Systems  Reachability problem for queue systems Given a set of global control states T, is any state in T reachable?  Reachability is undecidable  Weakening the model to tackle undecidability Lossy channels (Abdulla-Jonsson, LICS’93) Model queues as bags (Sen-Viswanathan, CAV’06) (Jhala-Majumdar, POPL’07)  Our contribution: a new way to curb undecidability where queues are modeled accurately

6/25 Bounded context-switch reachability  In a context only one process evolves dequeue only from one queue it can enqueue on all outgoing queues Well-queuing (for recursive processes)  Dequeue only when stack is empty  Bounded context-switch reachability problem Given k N a set of global control states T, Is T reachable within k context-switches?

7/25 Context-Bounded analysis for concurrent systems  Introduced by Context-Bounded Model Checking of Concurrent Software (Qadeer-Rehof, TACAS’05)  Experimental results: Large state coverage with few contexts Iterative context bounding for systematic testing of multithreaded programs (Musuvathi-Qadeer, PLDI’07) CHESS at MSR  Context-bounded analysis for otherwise intractable systems Reachability Analysis of Multithreaded Software with Asynchronous Communication (Bouajjani-Esparza-Kiefer-Schwoon, FSTTCS’05) Context-Bounded Analysis of Multithreaded Programs with Dynamic Linked Structures (Bouajjani-Fratani-Qadeer, CAV’07) A Robust Class of Context-Sensitive Languages (La Torre-P.Madhusudan-Parlato, LICS’07)

8/25 Our Results  Bounded Context-Switch Reachability is decidable for non-recursive queuing processes for well-queuing recursive processes  Precise characterization of architectures that admit a decidable (unbounded) reachability problem with shared memory is undecidable for simple architectures) no shared memory & well-queuing recursive: directed forest architectures no shared memory & non recursive: underlying undirected graph is a forest Decidability: reduction to BCS reachability problem

9/25 Outline of the talk  Overview  Solving Bounded Context-Switch Reachability  Unbounded context-switching reachability: Precise characterization of decidable architectures  Conclusions

10/25 Bounded-phase multi-stack pushdown automata [La Torre, P.Madhusudan, Parlato, LICS’07)] finite control A phase is a sub-run where only A unique stack can be popped all stacks can be pushed onto  Finite set of states Q  An initial state q o  Q  Actions: internal move push onto one stack pop from one stack phase-switch phase-switch RUN phase phase phase Bounded-Phase Reachability Problem Given k  N a set of control states T, is any state of T reachable with at most k phases? Theorem Bounded-phase reachability is decidable. Complexity: time exponential in Q double-exponential in k.  Multiply nested structures  MSO on multiply nested structures to MSO on trees  Quite complex proof

11/25 Bounded context-switch reachability for Non- Recursive processes Proof. Reduction to bounded-phase reachability for multi-stack systems. ….  Theorem The bounded context-switch reachability for non-recursive QS is decidable Complexity: 2-Exptime in the number of context-switches Exptime in the size of the system

12/25 Proof (non-recursive case) We define a MSPS that simulates the QS Simulation  of a context Sending m to queue q  push onto st q Receiving m from q  pop from red stack  of a context-switch (p,q)  (p’,q’) Reverse stack q Reverse stack q’

13/25 Proof (recursive case) Simulate incoming queue and call-stack using a single stack! (exploit well-queuing assumption)

14/25 Removing conditions gives undecidability  BCS reachability is undecidable for non well-queuing recursive processes  BCS reachability is undecidable if we allow to dequeuing from two queues in the same context with only 2 context-switches p3p3 q1q1 q2q2 p1p1 p2p2

15/25 Outline of the talk  Overview  Solving Bounded Context-Switch Reachability  Unbounded context-switching reachability: Precise characterization of decidable architectures  Conclusions

16/25 Decidable Architectures with shared memory is undecidable p 1 p 2 With shared memory reachability is undecidable even for simple architectures: (reduction from the membership problem for Turing machines ) Non-recursive:  Two non-recursive processes  One queue Recursive  Two recursive processes  No queues p 1 p 2 s 1 s 2

17/25 Decidable Architectures recursive processes & no shared memory Theorem: An architecture admits decidable reachability for well-queuing QSs with no shared memory iff it is a directed forest Complexity  in 2-Exptime in the number of processes  in Exptime in the size of the QS

18/25 Decidable Architectures recursive processes & no shared memory Reachability is decidable on directed forests reduction to bounded context-switch reachability  Fix an order over the processes such that p > parent(p) p 1, p 2, p 3, p 4, p 5  In the context i process p i evolves p1p1 p2p2 p3p3 p4p4 p5p5

19/25 Undecidable Architectures recursive processes & no shared memory  Reachability is undecidable for all other architectures. Reduction from the emptiness of the intersection of two CFLs reduction from the membership problem for Turing machines  (even for non-recursive) pp’ q p1p1 p2p2 q1q1 q2q2 p3p3 q1q1 q2q2 p2p2 p1p1 Precise characterization Recursive processes No shared memory directed forests

20/25 Decidable Architectures non-recursive processes & no shared memory Theorem: An architecture admits decidable reachability for non-recursive QSs with no shared memory iff the undirected architecture graph is a forest Complexity: Pspace-complete

21/25 Decidable Architectures non-recursive processes & no shared memory Reachability is decidable when the undirected underlying graph is a forest  Algorithm 1.Reverse edges 2.Solvable using bounded context- switch reachability 3.Better solution bounded size queue (1 message) leads to a Pspace procedure  Complexity: Pspace-complete p1 p2 q p1 q

22/25 Undecidable Architectures non-recursive processes & no shared memory Reachability is undecidable when the undirected underlying graph there is a cycle p 1 p 2 p 1 p 2 Precise characterization Non-recursive processes No shared memory undirected architecture graph is a forest

23/25 Outline of the talk  Overview  Solving Bounded Context-Switch Reachability  Unbounded context-switching reachability: Precise characterization of decidable architectures  Conclusions

24/25 Conclusions  Bounded Context-Switch Reachability decidable in 2-EXPTIME  Unbounded context-switching reachability: Precise characterization of decidable architectures Undecidable Decidable iff directed forest (in 2-EXPTIME) Decidable iff undirected forest (Pspace-complete) Shared Memory Well-queuing Recursive processes Non-Recursive processes No Shared Memory

25/25 A Future Direction Practical algorithm for - non recursive processes - no-shared memory -undirected forest architectures  We proposed a Pspace algorithm  Each queue can be considered only of bounded size (one message)  This can be modeled as a finite state transition system  Implementations using standard model checkers (like NuSMV) Approximate schemes to solve bounded context switching reachability for recursive queue systems - a la [Jhala-Majumdar,POPL07] for [Sen-Viswanathan:CAV06]