Presentation is loading. Please wait.

Presentation is loading. Please wait.

Lazy Sequentialization Unbounded Concurrent Programs

Published byἨσαῦ Κορωναίος Modified over 6 years ago

Similar presentations

Presentation on theme: "Lazy Sequentialization Unbounded Concurrent Programs"— Presentation transcript:

1 Lazy Sequentialization Unbounded Concurrent Programs
for the Safety Verification of Unbounded Concurrent Programs Truc Lam Nguyen University of Southampton, UK Bernd Fischer Stellenbosch University, South Africa Salvatore La Torre Università di Salerno, Italy Gennaro Parlato

2 Concurrent Program - Reachability Problem
concurrent C programs POSIX threads SC memory model reachability assertion failure out-of-bound array division-by-zero, … SHARED MEMORY … T1 T2 TN N THREADS goals: Proving correctness Finding bugs

3 Concurrent Program - Reachability Problem
concurrent C programs POSIX threads SC memory model reachability assertion failure out-of-bound array division-by-zero, … SHARED MEMORY … T1 T2 TN N THREADS goals: Proving correctness Finding bugs Our contribution: an automatic verification approach based on sequentialization

4 What is Sequentialization?
CONC PROGRAM SEQUENTIALIZATION (code-to-code translation) SEQ PROGRAM SEQ TOOL advantages reuse robust sequential analysis tools fast prototyping of concurrency handling delegating all sequential reasoning to an existing target analysis tool easier to implement than full-fledged tools

5 Sequentialization: literature
CONC PROGRAM SEQUENTIALIZATION (code-to-code translation) SEQ PROGRAM SEQ TOOL papers proposal [ Qadeer, Wu - PLDI’04 ] eager, bounded context-switch, finite # threads [ Lal, Reps - CAV’08 ] lazy, finite # threads, parameterized [La Torre, Madhusudan, Parlato - CAV’09, CAV’10] thread creation [Bouajjani, Emmi, Parlato - SAS’11] [Emmi, Qadeer, Rakamaric - POPL’11] Lal/Reps for real-time systems [Chaki, Gurfinkel, Strichman - FMCAD’11] message-passing programs [Bouajjani, Emmi - TACAS’12] lazy sequentialization [Inverso, Tomasco, Fischer, La Torre, Parlato - CAV’14] memory unwinding [Tomasco, Inverso, Fischer, La Torre, Parlato - TACAS’15] weak memory models [Tomasco, Nguyen, Fischer, La Torre, Parlato - FMCAD’16]

6 Sequentialization: verification tools
CONC PROGRAM SEQUENTIALIZATION (code-to-code translation) SEQ PROGRAM SEQ TOOL tools (Implementations of variants of Lal/Reps schema) Corral [ Lal, Qadeer, Lahiri – CAV’12 ] CSeq [ Fischer, Inverso, Parlato – ASE’13,15 ] Rek [ Chaki, Gurfinkel, Strichman – FMCAD’11 ] STORM [ Lahiri,Qadeer,Rakamaric – CAV’09 ] only suitable for finding bugs

7 Recall Lazy Sequentialization
Outline Recall Lazy Sequentialization Unbounded Lazy Sequentialization Tool & Experiments Conclusion & Future Work

8 Lazy Sequentialization
for bug finding CAV’14

9 Lazy Sequentialization
CONC PROGRAM BOUNDED PROGRAM SEQUENTIALIZATION (code-to-code translation) BMC SEQUENTIAL TOOL SEQ PROGRAM Implemented in CSeq framework [Fischer, Inverso, Parlato - ASE’13] C99 + PThread + counter-example [Inverso, Nguyen, Fischer, La Torre, Parlato - ASE’15] Medals at SV-COMP ( ), concurrency category Extended for weak memory models [Tomasco, Nguyen, Inverso, Fischer, La Torre, Parlato - FMCAD’16] Very effective at finding bugs in complex benchmarks other approaches fail

10 … Round robin schedule T0 T1 TN-1 TN
main() T0 T1 … TN-1 TN round k captures all bounded Round-Robin computations for a given bound error manifest themselves within very few rounds [ Musuvathi, Qadeer – PLDI’07 ]

11 Lazy Sequentialization: Schema overview
… main() T0 bounded concurrent program T1 TN Sequentialization (code-to-code translation) translates translates … translates … sequential program F0 F1 FN main() Sequentialized functions Driver

12 Lazy Sequentialization: Main driver
pc0=0 ; ..., pcN=0; local0; ..., localN; main() { while(i <= K){ ... if(createdi) Fi(); i++; } bounded loop to simulate K rounds of computations

13 Lazy Sequentialization: Main driver
pc0=0 ; ..., pcN=0; local0; ..., localN; main() { while(i <= K){ ... if(createdi) Fi(); i++; } bounded loop to simulate K rounds of computations thread simulation function (for each thread i)

14 Lazy Sequentialization: Main driver
a global pc for each thread thread locals → thread global main driver pc0=0 ; ..., pcN=0; local0; ..., localN; main() { while(i <= K){ ... if(createdi) Fi(); i++; } bounded loop to simulate K rounds of computations thread simulation function (for each thread i)

15 Unbounded Lazy Sequentialization

16 Lazy Sequentialization: Main driver
a global pc for each thread thread locals → thread global main driver pc0=0 ; ..., pcN=0; local0; ..., localN; main() { while(i <= K){ ... if(createdi) Fi(); i++; } bounded loop to simulate K rounds of computations thread simulation function (for each thread i)

17 Lazy Sequentialization: Main driver (extended)
a global pc for each thread thread locals → thread global main driver pc0=0 ; ..., pcN=0; local0; ..., localN; main() { while(true){ ... if(createdi) Fi(); } infinite loop to simulate unbounded # rounds thread simulation function (for each thread i)

18 Lazy Sequentialization: Schema overview
… main() T0 bounded concurrent program T1 TN Sequentialization (code-to-code translation) translates translates … translates … sequential program F0 F1 FN main() Sequentialized functions Driver

19 Lazy Sequentialization: Schema (extended)
… main() T0 bounded concurrent program T1 TN Sequentialization (code-to-code translation) translates translates … translates … sequential program F0 F1 FN main() Sequentialized functions Driver

20 UL Sequentialization: Thread Simulation
l1: stmt1; l2: stmt2; l3: stmt3; . lM: stmtM;

21 UL Sequentialization: Thread Simulation
l1: stmt1; l2: stmt2; l3: stmt3; . lM: stmtM; l1: stmt1; l2: stmt2; l3: stmt3; . lM: stmtM; translate

22 UL Sequentialization: Thread Simulation
Fi l1: stmt1; l2: stmt2; l3: stmt3; . lM: stmtM; l1: stmt1; l2: stmt2; l3: stmt3; . lM: stmtM; [[ l1: stmt1 ]]; [[ l2: stmt2 ]]; [[ l3: stmt3 ]]; . [[ lM: stmtM ]]; translate translates

23 UL Sequentialization: Thread Simulation
execute statements Fi [[ l1: stmt1 ]]; [[ l2: stmt2 ]]; [[ l3: stmt3 ]]; . [[ lM: stmtM ]]; skip ... RESUME EXECUTE

24 UL Sequentialization: Thread Simulation
suspend execution Fi [[ l1: stmt1 ]]; [[ l2: stmt2 ]]; [[ l3: stmt3 ]]; . [[ lM: stmtM ]]; skip ... RESUME EXECUTE SUSPEND skip ...

25 UL Sequentialization: Translation for Simple Stmts
Simple statements: assignment, goto, return [[ l: simple_stmt ]]

26 UL Sequentialization: Translation for Simple Stmts
Simple statements: assignment, goto, return [[ l: simple_stmt ]] translates into CONTR(l) l: EXEC(simple_stmt)

27 UL Sequentialization: Translation for Simple Stmts
Simple statements: assignment, goto, return [[ l: simple_stmt ]] translates into CONTR(l) l: EXEC(simple_stmt) #define CONTR(l) if(s=RESUME && pci=l) s:=EXECUTE; if(s=EXECUTE && *) { pci:=l; s:=SUSPEND;}

28 UL Sequentialization: Translation for Simple Stmts
Simple statements: assignment, goto, return [[ l: simple_stmt ]] translates into CONTR(l) l: EXEC(simple_stmt) #define EXEC(stmt) if(s=EXECUTE) {stmt;}

29 UL Sequentialization: Translation for Loop Stmts
[[ l: while (b) do {... k: stm} ]]

30 UL Sequentialization: Translation for Loop Stmts
[[ l: while (b) do {... k: stm} ]] translates into CONTR(l) l: skip

31 UL Sequentialization: Translation for Loop Stmts
[[ l: while (b) do {... k: stm} ]] translates into CONTR(l) l: while( (s=RESUME && pci <= k) || (s=EXECUTE && b) ) do [[{... k: stm}]] skip

32 UL Sequentialization: Translation for Conditional Stmts
[[ l: if (b) {... k: stm1} else {... h: stm2} ]]

33 UL Sequentialization: Translation for Conditional Stmts
[[ l: if (b) {... k: stm1} else {... h: stm2} ]] translates into CONTR(l) l:

34 UL Sequentialization: Translation for Conditional Stmts
[[ l: if (b) {... k: stm1} else {... h: stm2} ]] translates into CONTR(l) l: if((s=RESUME && pci <= k) ||(s=EXECUTE && b)) [[{... k: stm1}]] else if ((s=RESUME && pci <= h) ||(s=EXECUTE)) [[{... h: stm2}]]

35 Tool / Empirical Evaluation

36 UL-CSeq UL-CSeq tool sequential tools P P' Implementation
concurrent C program sequential non-deterministic C program UL-CSeq ANSWER sequential tools P P' Implementation CSeq framework Input: C99 + POSIX threads Support backends Proving correctness: SeaHorn, Ultimate Automizer, CPAChecker, VVT Finding bugs: CBMC, ESBMC, LLBMC

37 Experiments: Proving Correctness
category #file #LOC UL-CSeq + SeaHorn UL-CSeq + UAutomizer UL-CSeq + CPAChecker UL-CSeq + VVT pass fail t.o. time pthread 15 1285 3 2 10 67.3 390.8 204.9 5 7 247.3 pthread-atomic 9 1136 6 1 167.9 456.7 4 352.6 171.8 pthread-ext 45 3679 27 18 199.1 12 31 226.5 30 214.6 16 24 179.7 pthread-lit 8 427 23.3 544.9 164.1 79.8 pthread-wmm 144 29426 32.5 60 84 421.6 26 118 271.3 141 275.3 [FMCAD’13] 542 51.1 238.6 244.7 133.1 [TACAS’11] 290 5.7 181.8 44.9 17.2 Totals 234 36785 194 37 59.9 87 376.2 171 235.7 180 11 43 248.2 SV-COMP Benchmark [Beyer - TACAS’16] SAFE instances [Watcher, Kroening, Ouaknine - FMCAD’13] [Garg, Madhusudan - TACAS’11]

38 Experiments: Proving Correctness
category #file #LOC UL-CSeq + SeaHorn UL-CSeq + UAutomizer UL-CSeq + CPAChecker UL-CSeq + VVT pass fail t.o. time pthread 15 1285 3 2 10 67.3 390.8 204.9 5 7 247.3 pthread-atomic 9 1136 6 1 167.9 456.7 4 352.6 171.8 pthread-ext 45 3679 27 18 199.1 12 31 226.5 30 214.6 16 24 179.7 pthread-lit 8 427 23.3 544.9 164.1 79.8 pthread-wmm 144 29426 32.5 60 84 421.6 26 118 271.3 141 275.3 [FMCAD’13] 542 51.1 238.6 244.7 133.1 [TACAS’11] 290 5.7 181.8 44.9 17.2 Totals 234 36785 194 37 59.9 87 376.2 171 235.7 180 11 43 248.2 Time is measures in second, t.o is timeout

39 Experiments: Proving Correctness
category #file #LOC UL-CSeq + SeaHorn UL-CSeq + UAutomizer UL-CSeq + CPAChecker UL-CSeq + VVT pass fail t.o. time pthread 15 1285 3 2 10 67.3 390.8 204.9 5 7 247.3 pthread-atomic 9 1136 6 1 167.9 456.7 4 352.6 171.8 pthread-ext 45 3679 27 18 199.1 12 31 226.5 30 214.6 16 24 179.7 pthread-lit 8 427 23.3 544.9 164.1 79.8 pthread-wmm 144 29426 32.5 60 84 421.6 26 118 271.3 141 275.3 [FMCAD’13] 542 51.1 238.6 244.7 133.1 [TACAS’11] 290 5.7 181.8 44.9 17.2 Totals 234 36785 194 37 59.9 87 376.2 171 235.7 180 11 43 248.2 Time is measures in second, t.o is timeout

40 Experiments: Proving Correctness
category #file #LOC UL-CSeq + SeaHorn UL-CSeq + UAutomizer UL-CSeq + CPAChecker UL-CSeq + VVT pass fail t.o. time pthread 15 1285 3 2 10 67.3 390.8 204.9 5 7 247.3 pthread-atomic 9 1136 6 1 167.9 456.7 4 352.6 171.8 pthread-ext 45 3679 27 18 199.1 12 31 226.5 30 214.6 16 24 179.7 pthread-lit 8 427 23.3 544.9 164.1 79.8 pthread-wmm 144 29426 32.5 60 84 421.6 26 118 271.3 141 275.3 [FMCAD’13] 542 51.1 238.6 244.7 133.1 [TACAS’11] 290 5.7 181.8 44.9 17.2 Totals 234 36785 194 37 59.9 87 376.2 171 235.7 180 11 43 248.2 Impara Satabs Threader Time is measures in second, t.o is timeout

41 Experiments: Proving Correctness
category #file #LOC UL-CSeq + SeaHorn UL-CSeq + UAutomizer UL-CSeq + CPAChecker UL-CSeq + VVT pass fail t.o. time pthread 15 1285 3 2 10 67.3 390.8 204.9 5 7 247.3 pthread-atomic 9 1136 6 1 167.9 456.7 4 352.6 171.8 pthread-ext 45 3679 27 18 199.1 12 31 226.5 30 214.6 16 24 179.7 pthread-lit 8 427 23.3 544.9 164.1 79.8 pthread-wmm 144 29426 32.5 60 84 421.6 26 118 271.3 141 275.3 [FMCAD’13] 542 51.1 238.6 244.7 133.1 [TACAS’11] 290 5.7 181.8 44.9 17.2 Totals 234 36785 194 37 59.9 87 376.2 171 235.7 180 11 43 248.2 Impara Satabs Threader 12.2 308.7 128.4 7.3 61.8 1.3 24.4 143.7 8.7 13 17 34.6 36 104.8 38 66.2 0.4 8.1 N/A 120 100 22 312.2 130 14 222.2 0.5 27.5 154.7 2.7 0.8 58.2 8.8 77 154 11.2 134 52 48 244 57 164 88.2 192 172.6 Time is measures in second, t.o is timeout

42 Experiments: Proving Correctness
category #file #LOC UL-CSeq + SeaHorn UL-CSeq + UAutomizer UL-CSeq + CPAChecker UL-CSeq + VVT pass fail t.o. time pthread 15 1285 3 2 10 67.3 390.8 204.9 5 7 247.3 pthread-atomic 9 1136 6 1 167.9 456.7 4 352.6 171.8 pthread-ext 45 3679 27 18 199.1 12 31 226.5 30 214.6 16 24 179.7 pthread-lit 8 427 23.3 544.9 164.1 79.8 pthread-wmm 144 29426 32.5 60 84 421.6 26 118 271.3 141 275.3 [FMCAD’13] 542 51.1 238.6 244.7 133.1 [TACAS’11] 290 5.7 181.8 44.9 17.2 Totals 234 36785 194 37 59.9 87 376.2 171 235.7 180 11 43 248.2 Impara Satabs Threader 12.2 308.7 128.4 7.3 61.8 1.3 24.4 143.7 8.7 13 17 34.6 36 104.8 38 66.2 0.4 8.1 N/A 120 100 22 312.2 130 14 222.2 0.5 27.5 154.7 2.7 0.8 58.2 8.8 77 154 11.2 134 52 48 244 57 164 88.2 192 172.6 Time is measures in second, t.o is timeout

43 Experiments: Finding Bugs
category #file LOC UL-CSEQ + CBMC Lazy-CSeq + CBMC CBMC CIVL Smack pass t.o. time pthread 17 4085 14 3 12.2 19.4 16 1 63.1 14.9 8 9 84.2 atomic 2 204 1.4 0.4 3.4 15 ext 780 0.3 7 12 47.2 lit 148 1.3 0.2 2.7 11.1 wmm 754 237700 1.1 1.2 0.5 6.1 753 78.1 Totals 784 242917 781 1.6 2.9 6.2 772 77.6 SV-COMP Benchmark [Beyer - TACAS’16] UNSAFE instances Time is measures in second, t.o is timeout

44 Experiments: Finding Bugs
category #file LOC UL-CSEQ + CBMC Lazy-CSeq + CBMC pass t.o. time pthread 17 4085 14 3 12.2 19.4 atomic 2 204 1.4 1 ext 8 780 0.3 lit 148 1.3 wmm 754 237700 1.1 1.2 Totals 784 242917 781 1.6 Time is measures in second, t.o is timeout

45 Experiments: Finding Bugs
category #file LOC UL-CSEQ + CBMC Lazy-CSeq + CBMC pass t.o. time pthread 17 4085 14 3 12.2 19.4 atomic 2 204 1.4 1 ext 8 780 0.3 lit 148 1.3 wmm 754 237700 1.1 1.2 Totals 784 242917 781 1.6 Time is measures in second, t.o is timeout

46 Experiments: Finding Bugs
category #file LOC UL-CSEQ + CBMC Lazy-CSeq + CBMC CBMC CIVL Smack pass t.o. time pthread 17 4085 14 3 12.2 19.4 atomic 2 204 1.4 1 ext 8 780 0.3 lit 148 1.3 wmm 754 237700 1.1 1.2 Totals 784 242917 781 1.6 Time is measures in second, t.o is timeout

47 Experiments: Finding Bugs
category #file LOC UL-CSEQ + CBMC Lazy-CSeq + CBMC CBMC CIVL Smack pass t.o. time pthread 17 4085 14 3 12.2 19.4 16 1 63.1 14.9 8 9 84.2 atomic 2 204 1.4 0.4 3.4 15 ext 780 0.3 7 12 47.2 lit 148 1.3 0.2 2.7 11.1 wmm 754 237700 1.1 1.2 0.5 6.1 753 78.1 Totals 784 242917 781 1.6 2.9 6.2 772 77.6 Time is measures in second, t.o is timeout

48 Conclusions

49 Conclusion & Future Work
We have presented a new sequentialization Lazy Unbounded context switches Preserving loop Simple to implement (CSeq framework), support multiple backends Proving correctness Finding bugs Competitive with existing approaches (bug-finding + correctness) Future Work Application to Embedded systems Extended to unbounded thread creation Weak Memory Models (WMM)

50 users.ecs.soton.ac.uk/gp4/cseq
Thank You users.ecs.soton.ac.uk/gp4/cseq

Download ppt "Lazy Sequentialization Unbounded Concurrent Programs"

Similar presentations

Automated Theorem Proving Lecture 1. Program verification is undecidable! Given program P and specification S, does P satisfy S?

Automated Theorem Proving Lecture 1. Program verification is undecidable! Given program P and specification S, does P satisfy S?
Ermenegildo Tomasco University of Southampton, UK Omar Inverso University of Southampton, UK Bernd Fischer Stellenbosch University, South Africa Salvatore.

Ermenegildo Tomasco University of Southampton, UK Omar Inverso University of Southampton, UK Bernd Fischer Stellenbosch University, South Africa Salvatore.
Jeremy Morse, Mikhail Ramalho, Lucas Cordeiro, Denis Nicole, Bernd Fischer ESBMC 1.22 (Competition Contribution)

Jeremy Morse, Mikhail Ramalho, Lucas Cordeiro, Denis Nicole, Bernd Fischer ESBMC 1.22 (Competition Contribution)
A Program Transformation For Faster Goal-Directed Search Akash Lal, Shaz Qadeer Microsoft Research.

A Program Transformation For Faster Goal-Directed Search Akash Lal, Shaz Qadeer Microsoft Research.
Abstraction and Modular Reasoning for the Verification of Software Corina Pasareanu NASA Ames Research Center.

Abstraction and Modular Reasoning for the Verification of Software Corina Pasareanu NASA Ames Research Center.
Α ϒ ʎ …… Reachability Modulo Theories Akash Lal Shaz Qadeer, Shuvendu Lahiri Microsoft Research.

Α ϒ ʎ …… Reachability Modulo Theories Akash Lal Shaz Qadeer, Shuvendu Lahiri Microsoft Research.
1 Regression-Verification Benny Godlin Ofer Strichman Technion.

1 Regression-Verification Benny Godlin Ofer Strichman Technion.
1 1 Regression Verification for Multi-Threaded Programs Sagar Chaki, SEI-Pittsburgh Arie Gurfinkel, SEI-Pittsburgh Ofer Strichman, Technion-Haifa Originally.

1 1 Regression Verification for Multi-Threaded Programs Sagar Chaki, SEI-Pittsburgh Arie Gurfinkel, SEI-Pittsburgh Ofer Strichman, Technion-Haifa Originally.
1 Symbolic Execution for Model Checking and Testing Corina Păsăreanu (Kestrel) Joint work with Sarfraz Khurshid (MIT) and Willem Visser (RIACS)

1 Symbolic Execution for Model Checking and Testing Corina Păsăreanu (Kestrel) Joint work with Sarfraz Khurshid (MIT) and Willem Visser (RIACS)
1/20 Generalized Symbolic Execution for Model Checking and Testing Charngki PSWLAB Generalized Symbolic Execution for Model Checking and Testing.

1/20 Generalized Symbolic Execution for Model Checking and Testing Charngki PSWLAB Generalized Symbolic Execution for Model Checking and Testing.
1 Eran Yahav Technion Joint work with Martin Vechev (ETH), Greta Yorsh (ARM), Michael Kuperstein (Technion), Veselin Raychev (ETH)

1 Eran Yahav Technion Joint work with Martin Vechev (ETH), Greta Yorsh (ARM), Michael Kuperstein (Technion), Veselin Raychev (ETH)
© Anvesh Komuravelli Spacer Automatic Abstraction in SMT-Based Unbounded Software Model Checking Anvesh Komuravelli Carnegie Mellon University Joint work.

© Anvesh Komuravelli Spacer Automatic Abstraction in SMT-Based Unbounded Software Model Checking Anvesh Komuravelli Carnegie Mellon University Joint work.
Reducing Context-bounded Concurrent Reachability to Sequential Reachability Gennaro Parlato University of Illinois at Urbana-Champaign Salvatore La Torre.

Reducing Context-bounded Concurrent Reachability to Sequential Reachability Gennaro Parlato University of Illinois at Urbana-Champaign Salvatore La Torre.
6/14/991 Symbolic verification of systems with state machines David L. Dill Jeffrey Su Jens Skakkebaek Computer System Laboratory Stanford University.

6/14/991 Symbolic verification of systems with state machines David L. Dill Jeffrey Su Jens Skakkebaek Computer System Laboratory Stanford University.
Verification for Concurrency Part 2: Incomplete techniques and bug finding.

Verification for Concurrency Part 2: Incomplete techniques and bug finding.
The Tree-Width of auxiliary storage Gennaro Parlato (University of Southampton, UK) Joint work: P. Madhusudan – UIUC, USA.

The Tree-Width of auxiliary storage Gennaro Parlato (University of Southampton, UK) Joint work: P. Madhusudan – UIUC, USA.
The Spin Model Checker Promela Introduction 50374 Nguyen Tuan Duc 50378 Shogo Sawai.

The Spin Model Checker Promela Introduction Nguyen Tuan Duc Shogo Sawai.
1 Spin Model Checker Samaneh Navabpour Electrical and Computer Engineering Department University of Waterloo SE-464 Summer 2011.

1 Spin Model Checker Samaneh Navabpour Electrical and Computer Engineering Department University of Waterloo SE-464 Summer 2011.
The Language Theory of Bounded Context-Switching Gennaro Parlato (U. of Illinois, U.S.A.) Joint work with: Salvatore La Torre (U. of Salerno, Italy) P.

The Language Theory of Bounded Context-Switching Gennaro Parlato (U. of Illinois, U.S.A.) Joint work with: Salvatore La Torre (U. of Salerno, Italy) P.
Termination Proofs for Systems Code Andrey Rybalchenko, EPFL/MPI joint work with Byron Cook, MSR and Andreas Podelski, MPI PLDI’2006, Ottawa.

Termination Proofs for Systems Code Andrey Rybalchenko, EPFL/MPI joint work with Byron Cook, MSR and Andreas Podelski, MPI PLDI’2006, Ottawa.

Similar presentations

Ads by Google