1. Symmetry-Aware Predicate Abstraction for Shared-Variable Concurrent Programs Alastair Donaldson, Alexander Kaiser, Daniel Kroening, and Thomas Wahl Computer Science Department, Oxford University, United Kingdom Limor Goldberg 15.4.2012

2. Outline  Introduction  Symmetry-Aware Predicate Abstraction  Symmetry-Aware Predicate Abstraction with aliasing  Closing the CEGAR Loop  Experimental results  Conclusion

3. Introduction

4. Introduction  Overview  Predicate Abstraction  Example  Uses of predicate abstraction  Naïve solution

5. Overview  Enables applying finite- state model checkers to programs written in mainstream languages  The use of predicate abstraction till now Goal: present an application of PA to shared variable concurrent software Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

6. Overview A symmetry aware predicate abstraction:  Consider the replicated structure of a C program consists of many threads  Generate a boolean program Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

7. Predicate Abstraction Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

8. Predicate Abstraction Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

9. Predicate Abstraction Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

10. Example Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

11. Example Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

12. Example Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

13. Example Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

14. Example Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution (1,1) (2,1) (1,0,0) (0,1,0)

15. Uses of predicate abstraction Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution  Predicate abstraction introduces as a way of dealing with data state explosion  It turns C programs into finite state boolean programs which can be model checked  Analyzing sequential software:  In the SLAM project at Microsoft, using this approach, was able to discover numerous control- dominated errors in low level operating system code.

16. Uses of predicate abstraction Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution  The bottleneck of PA in shared variable concurrent programs:  the exponential dependence of the generate state apace on the number of running threads.  Solution – exploit symmetry

17. Uses of predicate abstraction Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

18. Uses of predicate abstraction Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution  We present program as code fragments that declare shred and local variables.  such code is to be understood as a procedure to be executed by any number of threads  The code can declare shared variables – declared at the global scope (the complete program)  Can declare local variables (within the procedure)

19. Naïve solution Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution  Since the program B is executed by parallel threads its variables have to be partitioned into “shared” and “local”.  The “shared” and “local” attribute of B’s variables depend on the attributes of P’s variables a predicate is formulated over.  Definition: - A local predicate refers solely to a local C program variables - A shared predicate refers solely to a shared C program variables - A mixed predicate is neither local nor shared.

20. Naïve solution Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution  Definition: - A local predicate refers solely to a local C program variables - A shared predicate refers solely to a shared C program variables - A mixed predicate is neither local nor shared. Example to mix predicate: let s and l be a shared and local variables respectively. b is a boolean corresponding to the predicate: s != l Thus b is a mix variable

21. Naïve solution Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution shared int s = 0; local int l = 1; assert s != l; ++s; local bool b = 1; assert b; b = b ? * : 1 ;

22. Naïve solution Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution shared int s = 0; local int l = 1; assert s != l; ++s; local bool b = 1; assert b; b = b ? * : 1 ;

23. Naïve solution Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution shared int s = 0; shared bool t = 0; local int l = 0; If * then if t then assert s != l; l = s + 1; t = 1; shared bool b = 1; shared bool t = 0; If * then if t then assert ! b; b = 0; t = 1;

24. Naïve solution Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution shared int s = 0; shared bool t = 0; local int l = 0; If * then if t then assert s != l; l = s + 1; t = 1; shared bool b = 1; shared bool t = 0; If * then if t then assert ! b; b = 0; t = 1;

25. Naïve solution Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

26.  The assertion in this program cannot cannot be violated  We can prove that over a set od non mixed predicates, no invariant is computable that is strong enough to prove s == l. Naïve solution Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution 0: shared int s = 0; 1: shared int r = 0; 2: local int l = 0; 3: ++r; 4: if ( r == 1 ) then 5: ++s; ++l; 6: assert s == l; 7: goto 5

27. Naïve solution Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution

28. Naïve solution - summarize Overview Predicate Abstraction Example Uses of predicate abstraction Naïve solution  Mixed predicate as local  Make unsound abstraction  Mixed predicate as shared  Make unsound abstraction  Use only shared or local predicate  Cannot verify a simple bug-free program  Instantiate the template as the number of threads  The program is no longer symmetric – cause state explosion  Symmetry oblivious – will not scale beyond a very small number of threads

29. Symmetry Aware Predicate Abstraction

30.  Definitions  Mixed predicate and notify all updates  Implementing Notify-All updates  The predicate abstraction algorithm

31. Definitions Definitions Mixed predicate Notify All implementation The algorithm

32. Definitions Mixed predicate Notify All implementation The algorithm

33. Mix predicates and Notify-All updates Definitions Mixed predicate Notify All implementation The algorithm

34. Mix predicates and Notify-All updates We have noticed that mixed predicate are tracked in local variables Why? Declaring b i shared would lose information, declaring it local doesn’t – though, it is insufficient to guarantee a sound abstraction.  This is a problem we can solve! Definitions Mixed predicate Notify All implementation The algorithm

35. Mix predicates and Notify-All updates Definitions Mixed predicate Notify All implementation The algorithm

36. Mix predicates and Notify-All updates Definitions Mixed predicate Notify All implementation The algorithm

37. Mix predicates and Notify-All updates Definitions Mixed predicate Notify All implementation The algorithm

38. Mix predicates and Notify-All updates Definitions Mixed predicate Notify All implementation The algorithm

39. Weakest precondition Definitions Mixed predicate Notify All implementation The algorithm

40. Weakest precondition Definitions Mixed predicate Notify All implementation The algorithm

41. Weakest precondition Definitions Mixed predicate Notify All implementation The algorithm

42. Weakest precondition Definitions Mixed predicate Notify All implementation The algorithm

43. Weakest precondition Definitions Mixed predicate Notify All implementation The algorithm

44. Weakest precondition Definitions Mixed predicate Notify All implementation The algorithm

45. Weakest precondition Definitions Mixed predicate Notify All implementation The algorithm

46. Implementing Notify-All updates Implementing Notify-All updates Definitions Mixed predicate Notify All implementation The algorithm

47. Implementing Notify-All updates Implementing Notify-All updates Definitions Mixed predicate Notify All implementation The algorithm

48. Implementing Notify-All updates Implementing Notify-All updates Definitions Mixed predicate Notify All implementation The algorithm

49. The Algorithm Definitions Mixed predicate Notify All implementation The algorithm

50. The Algorithm Definitions Mixed predicate Notify All implementation The algorithm Indexes of all the predicate that that effected by v

51. The Algorithm Definitions Mixed predicate Notify All implementation The algorithm When v is shared, indexes of mixed predicate s.t the corresponding boolean predicate is local and needs to be updated separately

52. Symmetry Aware Predicate Abstraction with Aliasing

53.  Assumptions  Definitions  The algorithm

54. Assumptions Assumptions Definitions The algorithm

55. Definitions Assumptions Definitions The algorithm

56. Predicate Abstraction Algorithm with Aliasing Assumptions Definitions The algorithm

57. must_notify  Again, we need to determine whether an update affects the truth of a predicate only for the threads executing the update, or for all threads.  We need to define must_notify like we did without aliasing. Assumptions Definitions The algorithm

58. must_notify – first try  The previous definition (without aliasing) was: So, we can try to adapt it to this situation with the new definitions: Assumptions Definitions The algorithm

59. must_notify – first try Assumptions Definitions The algorithm

60. must_notify – second try Assumptions Definitions The algorithm

61. The Algorithm Assumptions Definitions The algorithm

62. The CEGAR loop

63. The CEGAR Loop  Reminder  Adept CEGAR loop to handle concurrency

64. Remainder T h is not spurious check spurious counterexample ThTh stop M h |=  generate counterexample T h M h |=  model check MhMh generate initial abstraction M and  refinement ThTh is spurious Remainder CEGAR loop with concurrency

65. Remainder T h is not spurious check spurious counterexample ThTh stop M h |=  generate counterexample T h M h |=  model check MhMh generate initial abstraction M and  refinement ThTh is spurious Remainder CEGAR loop with concurrency

66. Remainder T h is not spurious check spurious counterexample ThTh stop M h |=  generate counterexample T h M h |=  model check MhMh generate initial abstraction M and  refinement ThTh is spurious Remainder CEGAR loop with concurrency

67. Remainder T h is not spurious check spurious counterexample ThTh stop M h |=  generate counterexample T h M h |=  model check MhMh generate initial abstraction M and  refinement ThTh is spurious Remainder CEGAR loop with concurrency

68. spurious counterexample x1x1 x2x2 y1y1 y2y2 X Y Considering the counterexample Y  X  Y : This path exists only in the abstract model Remainder CEGAR loop with concurrency

69. Remainder T h is not spurious check spurious counterexample ThTh stop M h |=  generate counterexample T h M h |=  model check MhMh generate initial abstraction M and  refinement ThTh is spurious Remainder CEGAR loop with concurrency

70. Remainder T h is not spurious check spurious counterexample ThTh stop M h |=  generate counterexample T h M h |=  model check MhMh generate initial abstraction M and  refinement ThTh is spurious Remainder CEGAR loop with concurrency

71. Adept CEGAR loop to handle concurrency  Model checking boolean broadcast program  Simulation  Refinement Remainder CEGAR loop with concurrency

72. Model checking boolean broadcast program  We can no longer use existing concurrent Boolean program model checkers such as Boom (*).  A prototype extension of Boom which called B-Boom can overcome the problem that the new syntax and semantics for broadcasts created.  B-Boom extends the capabilities of Boom to support broadcast operations. Remainder CEGAR loop with concurrency

73. Simulation  The existing S AT A BS simulator:  extracts the control flow from the trace  Mapped it back to the original C program  Translate it into a propositional formula The error is spurious exactly if the formula is unsatisfiable  For concurrent case the control flow information of an abstract trace includes which thread executes actively in each steps.  An extended version of the S AT A BS create a trace over a replicated C program which can be checked using SAT Remainder CEGAR loop with concurrency

74. Refinement  The implementation performs refinement by extracting new predicates from counterexample via WP calculations. Remainder CEGAR loop with concurrency

75. Experimental results

76.  Symmetry-aware vs. Symmetry oblivious  Sound abstraction vs. unsound abstraction

77. Symmetry aware vs. Symmetry oblivious Reminder: SOPA: an n-thread symmetric concurrent program expanded so that variables for all threads are explicitly duplicated and n copies of all non-shared predicate are generated.

79. Sound Abs vs. Unsound Abs Reminder: we saw Unsound Abstraction in the two naïve solutions to the mixed predicate problem.