Symbolic Model Checking of Concurrent Programs Using Partial Orders and On-the-Fly Transactions

Abstract. The state explosion problem is one of the core bottlenecks in the model checking of concurrent software. We show how to ameliorate the problem by combining the ability of partial order techniques to reduce the state space of the concurrent program with the power of symbolic model checking to explore large state spaces. Our new verification methodology involves translating the given concurrent program into a circuit-based model which gives us the flexibility to then employ any model checking technique of choice – either SAT or BDD-based – for verifying a broad range of linear time properties, not just safety. The reduction in the explored state-space is obtained by statically augmenting the symbolic encoding of the program by additional constraints. These constraints restrict the scheduler to choose from a minimal conditional stubborn set of transitions at each state. Another key contribution of the paper, is a new method for detecting transactions on-the-fly which takes into account patterns of lock acquisition and yields better reductions than existing methods which rely on a lockset based analysis. Moreover unlike existing techniques, identifying on-the-fly transactions does not require the program to follow a lock discipline in accessing shared variables. We have applied our techniques to the Daisy test bench and shown the existence of several bugs.

A Framework to Synergize Partial Order Reduction with State Interpolation

We address the problem of reasoning about interleavings in safety verification of concurrent programs. In the literature, there are two prominent techniques for pruning the search space. First, there are well-investigated trace-based methods, collectively known as "Partial Order Reduction (POR)", which operate by weakening the concept of a trace by abstracting the total order of its transitions into a partial order. Second, there is state-based interpolation where a collection of formulas can be generalized by taking into account the property to be verified. Our main contribution is a framework that synergistically combines POR with state interpolation so that the sum is more than its parts

A partial order reduction algorithm without the Proviso

Journal ArticleThis paper presents a partial order reduction algorithm, called Two phase, that preserves stutter free LTL properties. Two phase dramatically reduces the number of states visited compared to previous partial order reduction algorithms on most practical protocols. The reason can be traced to a step of the previous algorithms, called the proviso step, that specifies a condition on how a state that closes a loop is expanded. Two phase can be easily combined with an on-the-fly model-checking algorithm to reduce the memory requirements further. Furthermore a simple but powerful selective-caching scheme can also be added to Two phase. Two phase has been implemented in a model-checker called PV (Protocol Verifier) and is in routine use on large problems

A computational group theoretic symmetry reduction package for the SPIN model checker

Symmetry reduced model checking is hindered by two problems: how to identify state space symmetry when systems are not fully symmetric, and how to determine equivalence of states during search. We present TopSpin, a fully automatic symmetry reduction package for the Spin model checker. TopSpin uses the Gap computational algebra system to effectively detect state space symmetry from the associated Promela specification, and to choose an efficient symmetry reduction strategy by classifying automorphism groups as a disjoint/wreath product of subgroups. We present encouraging experimental results for a variety of Promela examples

Performance studies of PV: an On-the-fly model-checker for LTL-X featuring selective caching and partial order reduction

Journal ArticleWe present an enumerative model-checker PV that uses a new partial order reduction algorithm called Twophase. This algorithm does not use the in-stack check to implement the proviso, making the combination of Twophase with on-the-fly LTL-X model-checking based on nested depth-first search, as well as with selective state caching very straightforward. We present a thorough evaluation of PV in terms of several states, memory, search depth, and runtimes. Our very encouraging results, often orders of magnitude better, are objectively explained in this paper. We also explain the different selective state caching methods supported by PV as well as its user interface geared towards verifying cache coherence protocols for conformance against formal memory models, We offer the source code of PV as well as our examples through out webpage