Shared Variables and Efficient Synchronization Primitives for Synchronous Symbolic Verifiers

Abstract

In spite of the increasingly frequent application of formal verification tools today they still are difficult to use for non trivial verification tasks. One reason is that the specification languages used by these systems are still quite different than the programming languages designers use. One significant difference is the absence of shared variables for synchronous verifiers. Many systems use shared variables in their implementation, but most synchronous formal verification tools do not model them. Instead the user must use additional variables to maintain the illusion of shared memory and model the correct behavior. Unfortunately this can cause a significant overhead making the final model much larger than necessary. This work proposes a new technique called BDD markings to overcome this problem. BOD markings provide a way of keeping track of control flow information and have allowed us to implement shared variables in Verus, a synchronous symbolic verifier. Using the new method we have been able to verify a variant of a mutual exclusion algorithm used in the Mach operating system and to determine the existence of priority inversion in a complex real-time system. Priority inversion is a serious and subtle problem that can cause real-time systems to fail unexpectedly. Its importance has been highlighted recently when it was discovered that priority inversion has caused system shutdowns in the Pathfinder spacecraft soon after it started collecting Martian meteorological data. This example has been modeled with and without shared variables. The new method has allowed verification to be performed up to 10 times faster and using up to 20 times less memory, demonstrating the efficiency of the technique proposed.