Efficient Modeling of Concurrent Systems in BMC

Abstract

Abstract. We present an efficient method for modeling multi-threaded concurrent systems with shared variables and locks in Bounded Model Checking (BMC), and use it to improve the detection of safety properties such as data races. Previous approaches based on synchronous modeling of interleaving semantics do not scale up well due to the inherent asynchronism in those models. Instead, in our approach, we first create independent (uncoupled) models for each individual thread in the system, then explicitly add additional synchronization variables and constraints, incrementally, and only where such synchronization is needed to guarantee the (chosen) concurrency semantics (based on sequential consistency). We describe our modeling in detail and report verification results to demonstrate the efficacy of our approach on a complex case study.

Verifying multi-threaded software using smt-based context-bounded model checking

“…t2 uses a local variable y to store the value of x and uses this in the test (cf. lines [12][13]. This simulates a possible context switch between the evaluation of the guard and the execution of the next statement.…”

“…Ganai and Gupta describe a lazy method for modelling multi-threaded concurrent systems using shared variables [13], but this again is restricted to two threads. Gupta et al [17] extend [13,16] by supporting more than two threads and by combining dynamic partial order reduction with symbolic state space exploration.…”

“…In an attempt to cope with growing system complexity, Boolean Satisfiability (SAT) solvers are increasingly replaced by Satisfiability Modulo Theories (SMT) solvers to prove the generated verification conditions (VCs) [1,8,12]. There have also been attempts to extend BMC to the verification of multi-threaded software [13,16,17,25]. The main challenge here is the state space explosion, as the number of possible interleavings grows exponentially with the number of threads and program statements.…”

“…Here, we continue this work and develop and evaluate three related approaches for model checking multi-threaded ANSI-C software. In contrast to previous fully symbolic approaches (e.g., [13,16,17,25,15]), we combine symbolic model checking with explicit state space exploration. In particular, we explicitly explore the possible interleavings (up to the given context bound) while we treat each interleaving itself symbolically.…”

Verifying safety properties of concurrent heap-manipulating programs

“…Traditional approaches consist of manually abstracting the data-structure into a simple finite state machine representing the states of the data-structure that are relevant to the verification problem (e.g., [Strom 1983;Strom and Yemini 1986]). As a second phase, these works use one of the numerous approaches for model-checking concurrent finite-state programs (e.g., [Cook et al 2005]), performing various forms of bounded model-checking (e.g., [Qadeer and Rehof 2005;Ganai and Gupta 2008]), and using predicate abstraction (e.g., [Das et al 1999]). …”