Transcript Slides
Theory-Aided Model Checking of Concurrent Transition Systems Guy Katz, Clark Barrett, David Harel Weizmann Institute of Science New York University Compositional Verification ο A divide and conquer verification approach π1 ο ππ2 π3 β¨ π β¨ π1 β¨ π2 β¨ π3 No need to explore all composite states 2 The Difficulties ο Automation 1. 2. 3. 4. ο Partition the system into modules Choose βgoodβ module properties Prove module properties Prove global property A very difficult problem! 3 Our Approach ο Trade generality for effectiveness β¦ Do well on specific classes of programs ο We present a fully automatic, compositional approach β¦ Handle concurrent programs written in the RWB model β¦ Based on SMT solving 4 An SMT-Driven Process Input program π SAT (unsafe) or UNSAT (safe) SMT Solver Assertion: ¬π πππ(π ) Arithmetic Transition Systems Arrays 5 A Theory of Transition Systems ο Decision procedure: state space traversal ο Look for known patterns in the input β¦ Generate lemmas for other theory solvers ο Lemmas allow other theories to aid in the verification β¦ Prune the search space β¦ Can significantly reduce verification time 6 Agenda ο RWB Transition Systems ο A Theory of Transition Systems ο Programs with Shared Arrays ο Periodic Programs ο Experimental Results 7 Agenda ο RWB Transition Systems ο A Theory of Transition Systems ο Programs with Shared Arrays ο Periodic Programs ο Experimental Results 8 Request / Wait / Block (RWB) ο RWB programs have events and threads ο Threads synchronize and declare 1. Requested events 2. Waited-for events 3. Blocked events ο Trigger an event that is requested and not blocked ο Inform threads that requested / waited-for the event 9 The Execution Cycle Wait B-s Threads Request Block 10 Toy Example ο ο πΏ = (05 β (0 + 1))π 1 requested and not blocked at rightmost states β¦ Precisely every 6 steps 0, 1 π =0 π΅=1 0 Trace: 00000(0 00 0 000 0000 00000 + 1) π = 0, 1 0, 1 π =0 π΅=1 0 π =0 π΅=1 0 π = 0, 1 11 Why RWB? ο RWB idioms are common β¦ β¦ β¦ β¦ Publish / Subscribe systems Supervisory control Live Sequence Charts (LSCs) Behavioral Programming ο The strict synchronization mechanism facilitates reasoning about individual threads ο Makes finding module properties easier 12 Agenda ο RWB Transition Systems ο A Theory of Transition Systems ο Programs with Shared Arrays ο Periodic Programs ο Experimental Results 13 The Transition System (TS) Solver ο Input: β¦ Formulas describing RWB threads β¦ An assertion that the program is unsafe ο A deadlock state is reachable ο Safety reducible to deadlock freedom ο Output: β¦ SAT if the property is violated (+ counter-example) β¦ UNSAT if the property holds 14 Basic Decision Procedure ¬π πππ(π ) π0 START π3 ¬π πππ π ¬π πππ_π π‘ππ‘π(π0 ) π1 DECIDE ¬π πππ π ¬π πππ_π π‘ππ‘π(π0 ) ¬π πππ_π π‘ππ‘π π1 DECIDE π2 ¬π πππ π ¬π πππ_π π‘ππ‘π(π3 ) Theory-valid lemmas: ¬ππππππππ(π0 ) SAT DECIDE UNSAT ¬π πππ π ¬π πππ_π π‘ππ‘π(π0 ) ¬π πππ_π π‘ππ‘π π1 ¬π πππ_π π‘ππ‘π(π2 ) ¬ππππππππ(π1 ) ¬ππππππππ(π2 ) β₯ 15 Pattern Matching ο During state space traversal, TS looks for thread patterns β¦ Structural properties of threads β¦ Checked on each thread separately (compositionally) ο When a pattern applies, lemmas are generated β¦ From the languages of other theory solvers β¦ The SMT core handles the interfaces ο Other solvers can then curtail the search space 16 Pattern Matching: Example ο πΏ = (05 β (0 + 1))π ο Property: never 1 ο 7 composite states 0, 1 π =0 π΅=1 0 π = 0, 1 0, 1 π =0 π΅=1 0 π =0 π΅=1 0 π = 0, 1 1 π΅ = 0, 1 17 Looped Threads ο Looped thread: Step index determines state ο Recognizing looped threads: Every state has 1 successor ο Also looped 0, 1 π =0 π΅=1 0 π = 0, 1 0, 1 π =0 π΅=1 0 π =0 π΅=1 0 π = 0, 1 18 Generating Lemmas ο Where can 1 be triggered? β¦ Only where it is not blocked ο Generate the lemma: ¬π πππ_π π‘ππ‘π β©π1 , π1 βͺ βΊ ¬π πππ_π π‘ππ‘π β©π2 , π3 βͺ β§ βπ‘ β β. π‘ β‘ 1 πππ 2 β§ π‘ β‘ 2(πππ 3) 0, 1 0, 1 π1 π =0 π΅=1 0 ππ22 π1 π = 0, 1 π =0 π΅=1 0 π2 π =0 π΅=1 0 π3 π = 0, 1 19 Generating Lemmas (cntβd) ο This part of the lemma: βπ‘ β β. π‘ β‘ 1 πππ 2 β§ π‘ β‘ 2 πππ 3 indicates that state β©π2 , π3 βͺ is reachable ο The SMT core asserts it to the arithmetic solver ο If no such π‘ exists, return UNSAT β¦ State β©π2 , π3 βͺ is unreachable ο Otherwise continue from state β©π2 , π3 βͺ β¦ Skip intermediate states Implementing Pattern Matchers ο Matchers implemented as C++ classes ο Take the input transition systems, answer yes/no β¦ If pattern holds, invoked every time a new state is visited β¦ Get to generate lemmas ο Internally, very flexible β¦ Compute strongly connected components β¦ Check when events are always blocked / never requested β¦ Threads are small, so this is cheap ο Restriction: donβt construct the composite state graph! Limitations ο The technique is useful only when a pattern applies ο Can a few stored patterns apply to many programs? β¦ Examples in next sections ο Adding patterns is amortized over future applications ο Portfolio approach: quickly recognize that no pattern matches Agenda ο RWB Transition Systems ο A Theory of Transition Systems ο Programs with Shared Arrays ο Periodic Programs ο Experimental Results 23 Shared Arrays in RWB ο Locally, threads can use any construct β¦ Arrays, lists, etc ο Inter-thread shared arrays β only through RWB 24 Example: A Shared Bit π΅ = ππππ(1) π 0 π€πππ‘π(1) π€πππ‘π(0) π 1 π΅ = ππππ(0) ο Read by simultaneously requesting ππππ 0 , ππππ(1) β¦ The βwrongβ value will be blocked ο Can generalize to arbitrary shared arrays 25 Leveraging Shared Arrays ο Recognize shared arrays in the input threads β¦ Extract arity, read / write events, initial value, etc β¦ Sometimes it is used unintentionally ο Check if violations occur only in certain configurations β¦ Sometimes certain configurations are the violation ο During state traversal, generate lemmas when a shared memory cell becomes fixed β¦ Write events always blocked / never requested ο The array theory solver can then curtail the search 26 Example: Tic Tac Toe ο Goal: complete a row, column or diagonal X ο X X O X O O If no mistakes are made, game always ends in a draw 27 Implementing Tic Tac Toe ο Program plays π, player plays π β¦ Goal: never lose ο Board modeled as a shared array with 3-valued elements ο Rule threads, strategy threads β¦ Blocking used to prevent multiple writes to each cell 28 Verifying Tic Tac Toe ο Programmer: Iβve covered all cases in which π wins by taking the upper row. Letβs test that! ο A state is bad if π has the upper row β¦ A certain configuration of the array ο Generate lemma: ¬π πππ π β πππππ 0 = πππππ 1 = πππππ 2 = π 29 Example ο Board: π ο ο ο ο π π DECIDE: π 1,1 DECIDE: π 2,2 DECIDE: π(0,0) DECIDE: π 0,1 π π π ¬safe_state q1 β πππππ 4 = π ¬safe_state q2 β πππππ 8 = π ¬safe_state q3 β πππππ 0 = π ¬safe_state q4 β πππππ 1 = π β¦ Array theory solver raises a conflict β¦ Backtrack, without exploring successor states 30 Agenda ο RWB Transition Systems ο A Theory of Transition Systems ο Programs with Shared Arrays ο Periodic Programs ο Experimental Results 31 Periodic Programs ο Single processor scheduling problems ο Each task has β¦ period π β¦ execution time πΆ β¦ priority (static/dynamic) ο Programs have nice arithmetic properties 32 Periodic Programs in RWB ο A task that needs to be scheduled requests an event ο Priorities expressed by blocking less urgent tasks ο Pattern matcher checks this on individual threads ο Then generates arithmetic lemmas about time instances when a violation can occur Example TS Theory π₯ πππ 5 β₯ 3 π₯ πππ 6 β₯ 3 π₯ πππ 11 == 0 Arithmetic Theory π₯ π₯ = 143 β¦, π₯ β 143 π₯ = 513 β¦, π₯ β 513 UNSAT, property holds 34 Agenda ο RWB Transition Systems ο A Theory of Transition Systems ο Programs with Shared Arrays ο Periodic Programs ο Experimental Results 35 Experimental Results ο Benchmarks: periodic programs and program with shared arrays Average speedup: 63% 100000 CVC4 BPMC 10000 Time (seconds) ο 1000 100 10 1 1 11 21 31 41 51 61 71 81 91 101 111 Number of Solved Instances 36 Experimental Results (cntβd) ο Larger example: a web-server Average speedup: 16% 10000 CVC4 Time (seconds) ο 1000 BPMC 100 10 1 1 2 3 4 5 6 7 8 9 10 Number of Solved Instances 37 Conclusion ο Automatic compositional verification of RWB programs ο Added a theory of transition systems to CVC4 ο Traverse state space and look for patterns β¦ When a pattern is found, generate lemmas β¦ Other theories can then curtail the search space ο Examples: β¦ Programs with shared arrays β¦ Periodic programs 38 Future Work ο Support additional models beyond RWB ο Add more patterns ο Improve the portfolio approach 39 Thank You! Questions 40