A static verification framework for message passing in Go using behavioural types

Abstract

The Go programming language has been heavily adopted in industry as a language that efficiently combines systems programming with concurrency. Go's concurrency primitives, inspired by process calculi such as CCS and CSP, feature channel-based communication and lightweight threads, providing a distinct means of structuring concurrent software. Despite its popularity, the Go programming ecosystem offers little to no support for guaranteeing the correctness of message-passing concurrent programs. This work proposes a practical verification framework for message passing concurrency in Go by developing a robust static analysis that infers an abstract model of a program's communication behaviour in the form of a behavioural type, a powerful process calculi typing discipline. We make use of our analysis to deploy a model and termination checking based verification of the inferred behavioural type that is suitable for a range of safety and liveness properties of Go programs, providing several improvements over existing approaches. We evaluate our framework and its implementation on publicly available real-world Go code. CCS CONCEPTS • Theory of computation → Verification by model checking; Type theory; Process calculi; • Software and its engineering → Model checking; Automated static analysis; Software verification; Concurrent programming languages;

Bounded verification of message-passing concurrency in Go using Promela and Spin

“…Hence, we can verify them independently by considering each function declaration without channel parameters as a program entry point. As a consequence, we obtain a more precise and wider analysis of code-bases, while reducing the computational cost of our analysis, comparing to [8]. In particular, we can detect some partial deadlocks in the program under considering by identifying global deadlocks in some of its partitions.…”

“…This value is then used as a bound in the for-loops at lines 4 and 7 as well as the capacity of channel a. [8]. All programs are available online [4].…”

“…To help programmers produce correct concurrent software, several authors have proposed techniques to verify Go programs both statically (at compile-time) [7,8,10,12,14] and dynamically (at run-time) [15,16]. One of the more mature techniques for statically verifying Go programs is Godel [8] which relies on the similarity of Go's messagepassing aspect to CCS [11]. Godel follows an approach based on behavioural types where Go programs are over-approximated by CCS-like processes, which in turns are model-checked, using mCRL2 [2] for safety and liveness properties.…”

“…Note that this program spawns |files| threads and creates a channel whose capacity is |files|. The length of files is unknown at compile-time, hence this program cannot be checked for concurrency errors with existing static verification techniques for Go [7,8,10,12,14].…”

“…For example, the number of threads and the capacity of channel a are unknown at compile-time in Figure 1. To fulfil our objective, we augment the behavioural types technique of [8] with (i) an intra-procedural analysis to identify unknown communication-related parameters, and (ii) a bounded verification wrt. these parameters.…”