Parallel bug-finding in concurrent programs via reduced interleaving instances

Abstract

Concurrency poses a major challenge for program verification, but it can also offer an opportunity to scale when subproblems can be analysed in parallel. We exploit this opportunity here and use a parametrizable code-to-code translation to generate a set of simpler program instances, each capturing a reduced set of the original program's interleavings. These instances can then be checked independently in parallel. Our approach does not depend on the tool that is chosen for the final analysis, is compatible with weak memory models, and amplifies the effectiveness of existing tools, making them find bugs faster and with fewer resources. We use Lazy-CSeq as an off-the-shelf final verifier to demonstrate that our approach is able, already with a small number of cores, to find bugs in the hardest known concurrency benchmarks in a matter of minutes, whereas other dynamic and static tools fail to do so in hours.

An efficient software verification using multi-layered software verification tool

“…From this approach, it seems to be automatic code generation with user specifications incorporated again without any manual involvements. [9] reduced the interleaving instances through program instances generated by code to code translations. This approach consumes less time and memory dimensions of the backend analysis tool (Lazy-Cseq).…”

“…Verification of parallel programs using FRAMA-C plugins shows inefficient results in value analysis and runtime error detection [8]. Reducing the interleaving instances during bug detection is inapplicable in safestack TSO [9]. As in clang static analyzer and Facebook infer, it is not possible to integrate with standard chain for bounded model checking of Ccodebases through CBMC and abstract interpretation [10].…”

Symbolic Partial-Order Execution for Testing Multi-Threaded Programs

“…They use over-approximations to explore all behaviors, while we focus on testing and never produce false alarms. Sequentialization techniques [26,36,40] encode a multi-threaded program into a sequential one. While these encodings can be very effective for small programs [26] they grow quickly with large context bounds (5 or more, see [36]).…”

Extracting safe thread schedules from incomplete model checking results

“…Sequentialized programs [14,22,25,35,36,39] emulate the semantics of a multithreaded program, allowing tools for sequential programs to be used. The amount of possible schedules is either not reduced at all or similar to context bounding.…”