Tarmo: A Framework for Parallelized Bounded Model Checking

Abstract

This paper investigates approaches to parallelizing Bounded Model Checking (BMC) for shared memory environments as well as for clusters of workstations. We present a generic framework for parallelized BMC named Tarmo. Our framework can be used with any incremental SAT encoding for BMC but for the results in this paper we use only the current state-of-the-art encoding for full PLTL [4]. Using this encoding allows us to check both safety and liveness properties, contrary to an earlier work on distributing BMC that is limited to safety properties only.Despite our focus on BMC after it has been translated to SAT, existing distributed SAT solvers are not well suited for our application. This is because solving a BMC problem is not solving a set of independent SAT instances but rather involves solving multiple related SAT instances, encoded incrementally, where the satisfiability of each instance corresponds to the existence of a counterexample of a specific length. Our framework includes a generic architecture for a shared clause database that allows easy clause sharing between SAT solver threads solving various such instances.We present extensive experimental results obtained with multiple variants of our Tarmo implementation. Our shared memory variants have a significantly better performance than conventional single threaded approaches, which is a result that many users can benefit from as multi-core and multi-processor technology is widely available. Furthermore we demonstrate that our framework can be deployed in a typical cluster of workstations, where several multi-core machines are connected by a network.

A symbolic model checking approach to verifying satellite onboard software

“…On the BMC side, the parallel and distributed BMC engine of [WNH09] could be used to go deeper into the system state space by exploiting multiple multi-core computers running on a single BMC instance in parallel. While the properties we check are not strictly safety properties (some of the counterexamples could be infinite loops where e.g., the mode does not change at all), they still have some counterexamples that can be represented by finite paths (e.g., the mode entered next is a wrong one).…”

Thread-based multi-engine model checking for multicore platforms

“…Tarmo, a parallel bounded model checking (BMC) tool for shared memory environments and clusters of workstations, is introduced in Wieringa et al [2009]. Tarmo uses a fully incremental SAT approach where threads share a common clause database with a clause queue for each BMC bound.…”

Cube and Conquer: Guiding CDCL SAT Solvers by Lookaheads

“…As discussed in [26] different settings are possible for the amount of clauses shared. Tarmo's default setting which shares learnt clauses that have a length which is below average appeared the most effective for this application.…”

“…However as we make use of incremental SAT, so one can also think of this phase as one single incremental problem. In [26] two different job assignment strategies for parallel incremental SAT were discussed and implemented in a tool called Tarmo. That work was focused on Bounded Model Checking (BMC) but it can be seen as a general framework for parallel incremental SAT solving with clause sharing.…”