Abstract. Sequentialization translates concurrent programs into equivalent nondeterministic sequential programs so that the different concurrent schedules no longer need to be handled explicitly. It can thus be used as a concurrency preprocessor for many sequential program verification techniques. CSeq implements sequentialization for C and uses ESBMC as sequential verification backend [5]. 

Fischer, Bernd

Inverso, Omar

Parlato, Gennaro

English

Southampton (e-Prints Soton)

CSeq: A Sequentialization Tool for C(Competition Contribution)Bernd Fischer1;2, Omar Inverso1, and Gennaro Parlato11 Electronics and Computer Science, University of Southampton, UK2 Department of Computer Science, Stellenbosch University, South Afric{b.fischer,oi2c11,gennaro}@ecs.soton.ac.ukAbstract. Sequentialization translates concurrent programs into equivalent non-deterministic sequential programs so that the different concurrent schedules nolonger need to be handled explicitly. It can thus be used as a concurrency pre-processor for many sequential program veriﬁcation techniques. CSeq implementssequentialization for C and uses ESBMC as sequential veriﬁcation backend [5].1 IntroductionSequentialization is a recent veriﬁcation technique that translates a concurrent programinto a non-deterministic sequential program that (under certain assumptions) behavesequivalently, so that the different concurrent schedules do not need to be explicitly han-dled during veriﬁcation. It can be implemented as a source-to-source program transfor-mation and can be used as a concurrency pre-processor for sequential program veriﬁ-cation tools, which in principle makes it an attractive and general approach.However, in practice, only a few tools exist, and most of them work on an idealizedlanguage such as Boolean programs, or on an intermediate representation level, whichmakes them unsuitable as concurrency pre-processors for third-party tools. With CSeq,we aim to close this gap, and to develop a sequentialization tool for the full C language.2 Veriﬁcation ApproachLal/Reps Sequentialization Schema. CSeq largely follows the schema proposed byLal and Reps [7], which replaces the control non-determinism inherent to concurrentprograms by data non-determinism. More speciﬁcally, it translates a concurrent pro-gram (t1 || t2) into a sequential but non-deterministic program (t01 ; t02 ; c), whichcontains additional copies of the shared global memory; c checks any assumptions onthese copies that have been made independently by the transformed threads t01 and t02.CSeq replaces each shared variable x by a k-indexed entry x[k] in an array of sizeK where k is an auxiliary variable called the current round counter and K is the roundbound. The transformed program then calls the thread functions sequentially, in thesame order in which they are created. It simulates a context switch simply by non-deterministically increasing k up to the round bound K; if k grows beyond K, an earlyreturn is enforced (i.e., the thread is pre-empted). CSeq inserts this simulation code atall sequence points of the original program.In this schema, the ﬁrst thread accesses a fresh copy of the memory for each round,with non-deterministically chosen values, while the subsequent threads always continuewith the state left by their predecessor at each round. The initial guesses are stored in asecond copy x0[k]; at the end of the program c then checks that each round has endedwith the guesses that are used in the next round, i.e., that x[j] = x0[j + 1] holds;simulations that do not satisfy this condition do not correspond to feasible runs, and arediscarded.Since infeasible runs are only discarded at the end, assertion and reachability check-ing need to be integrated with the sequentialization; in particular, in order to preventfalse results, errors can only be reported after the checker c has run. CSeq thus replacesall assertions by conditionals that set an error variable that is tested by c. The same ar-gument also applies to implicit safety properties such as array bounds violations, or nilpointer dereferences that are handled by the applied backend veriﬁcation tool. In princi-ple, these need to be translated into explicit checks, and their detection by the backendneeds to be explicitly suppressed. However, CSeq does currently not support this.Related Approaches. Sequentialization was originally developed for two threads andtwo context switches only by Qadeer and Wu [9], but was subsequently generalizedby Lal and Reps to a ﬁxed number of threads and a parameterized number of round-robin scheduling [7]. Later, LaTorre/Madhusadan/Parlato extended [7] to track onlyreachable conﬁgurations [10]. Further extensions allowed modelling of unbounded, dy-namic thread creation [6,3,11], and dynamically linked data structures allocated on theheap [2].Like CSeq, Rek[4] implementssequentialization for Cvia code-to-codetrans-formation, but it is targeted at real-time systems and hard-codes a speciﬁc schedulingpolicy. Poirot [8] also veriﬁes concurrent C programs via sequentialization, but it ﬁrsttranslates them into Boogie and then implements the sequentialization transformationat the Boogie level.3 Architecture, Implementation, and AvailabilityArchitecture. CSeq is implemented as a source-to-source transformation tool in Python(V2.7.1). It uses the pycparser (v2.08) [1] to parse a C program into an abstractsyntax tree (AST), and then traverses the AST to construct the sequentialized version,as outlined above. The result can then be processed by any veriﬁcation tool for C; asmall script (cseq-esbmc) bundles up translation and veriﬁcation by ESBMC.AvailabilityandInstallation.CSeqcanbedownloadedfromhttp://users.ecs.soton.ac.uk/gp4/cseq.zip. It must be installed as global Python script; it alsorequires installation of the pycparser, and ESBMC (v1.20, which is available atwww.esbmc.org) must be on the path to use the cseq-esbmc script.Call. For the competition, CSeq should be called in the installation directory as follows:./cseq-esbmc <file>.Limitations. CSeq is in the initial development and there are still some limitations onthe structure of the programs that can be translated, and on the properties that can bechecked. Currently we assume that the main function consists of an initialization stage,inwhichthevariablesareinitializedandaknownnumberofthreadsiscreated,followedby a shut-down stage that includes all (if any) pthread join’s. We currently donot support conditional waiting nor pthread join and pthread exit with returnvariables. We implemented a deadlock check, but do not use it for the competition, asit is not required by the benchmarks. Since heap-allocated memory is accessible to allthreads, it needs to be treated similarly to global variables; CSeq does not support thisyet. Lifting these restrictions, and in particular supporting dynamic memory, dynamicthread creation, and conditional waiting will require signiﬁcant efforts.We further assume that the declarations for the global variables precede those forall functions, that there are no static variables and no global multi-dimensional arrays,and that local variables cannot shadow global variables. We do not support switch state-ments, due to limitations in the pycparser. These limitations simpliﬁed our imple-mentation and can be lifted relatively easily.Sequentialization is in principle independent of the veriﬁcation tool used as back-end, but the current version of CSeq is (tightly) integrated with ESBMC. Despite this,ESBMC’s counterexamples are not yet translated back into the original concurrent pro-gram, although this is a purely mechanic process.4 ResultsSince CSeq is a concurrency pre-processor, we only competed in the Concurrencycategory. Here, CSeq did well, and correctly solved 11 of the 33 benchmarks, with nofalse results, winning the Silver medal. In particular, it scored better than ESBMC v1.20with its built-in concurrency handling. The existing implementation limitations showedparticularly prominently in the CIL-preprocessed benchmarks, which CSeq could nothandle.References1. E. Bendersky. Pycparser. http://code.google.com/p/pycparser/.2. M. F. Atig, A. Bouajjani, and S. Qadeer. Context-bounded analysis for concurrent programswith dynamic creation of threads. Logical Methods in Computer Science, 7(4), 2011.3. A. Bouajjani, M. Emmi, and G. Parlato. On sequentializing concurrent programs. SAS, LNCS6887, pp. 129–145, 2011.4. S. Chaki, A. Gurﬁnkel, and O. Strichman. Time-bounded analysis of real-time systems.FMCAD, pp. 72–80, 2011.5. L. Cordeiro and B. Fischer. Verifying multi-threaded software using smt-based context-bounded model checking. ICSE, pp. 331–240, 2011.6. M. Emmi, S. Qadeer, and Z. Rakamaric. Delay-bounded scheduling. POPL, pp. 411–422,2011.7. A. Lal and T. W. Reps. Reducing concurrent analysis under a context bound to sequentialanalysis. Formal Methods in System Design, 35(1):73–97, 2009.8. S. Qadeer. Poirot - a concurrency sleuth. ICFEM, LNCS 6991, pp. 15, 2011.9. S. Qadeer and D. Wu. KISS: keep it simple and sequential. PLDI, pp. 14–24, 2004.10. S. La Torre, P. Madhusudan, and G. Parlato. Reducing context-bounded concurrent reacha-bility to sequential reachability. CAV, LNCS 5643, pp. 477–492, 2009.11. S. La Torre, P. Madhusudan, and G. Parlato. Sequentializing parameterized programs. FIT,EPTCS 87, pp. 34-47, 2012.

Context-bounded analysis for concurrent programs with dynamic creation of threads.

KISS: keep it simple and sequential. PLDI,

On sequentializing concurrent programs.

Poirot - a concurrency sleuth.

Reducing concurrent analysis under a context bound to sequential analysis.

Reducing context-bounded concurrent reachability to sequential reachability.

Sequentializing parameterized programs.

Time-bounded analysis of real-time systems.

Verifying multi-threaded software using smt-based contextbounded model checking. ICSE,

CSeq: A Sequentialization Tool for C - (Competition Contribution)

http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.297.9336

CSeq: A Sequentialization Tool for C - (Competition Contribution)

Abstract

Similar works

Full text

Available Versions

Southampton (e-Prints Soton)