Verifying distributed programs via canonical sequentialization

Abstract

We introduce canonical sequentialization, a new approach to verifying unbounded, asynchronous, messagepassing programs at compile-time. Our approach builds upon the following observation: due the combinatorial explosion in complexity, programmers do not reason about their systems by case-splitting over all the possible execution orders. Instead, correct programs tend to be well-structured so that the programmer can reason about a small number of representative executions, which we call the program's canonical sequentialization. We have implemented our approach in a tool called Brisk that synthesizes canonical sequentializations for programs written in Haskell, and evaluated it on a wide variety of distributed systems including benchmarks from the literature and implementations of MapReduce, two-phase commit, and a version of the Disco distributed file-system. Brisk verifies unbounded versions of the benchmarks in tens of milliseconds, yielding the first concurrency verification tool that is fast enough to be integrated into a design-implement-check cycle. is limited to finite systems: when the number of processes is unbounded, e.g., if processes are spawned based on input parameters, model checking cannot guarantee correctness as the state space, and hence, the number of executions, is infinite. Consequently, the distributed systems developer is bereft of development-and compile-time tools that guarantee the absence of concurrency errors.Our Approach In this paper, we propose canonical sequentialization, a new approach to verifying concurrency properties of unbounded, asynchronous, message-passing programs at compile-time. Our approach builds upon the following observation: due the combinatorial explosion in complexity, programmers do not reason about their systems by case-splitting over all the possible execution orders. Instead, correct programs tend to be well-structured so that the programmer can reason about a small number of representative executions which we call the program's canonical sequentialization.Example: Two-Phase Commit Consider the classic two-phase commit protocol [Lampson and Sturgis 1976], which consists of a leader process trying to commit a transaction to a number of database nodes. The protocol proceeds in two phases. In the first phase, the leader issues a tentative transaction. The leader then waits for answers from the nodes who may decide to either accept or abort the transaction. This initiates the second phase: if all nodes agreed, the leader sends them a commit message; otherwise, it sends an abort message. Finally, each node sends its acknowledgement of the final decision.Even though leader and database nodes execute in parallel, the concurrency is well-structured. First, due to the lack of a shared memory, most actions executed by different nodes are independent of each other, and thus commute. For example, a tentative proposal sent to one of the database nodes is independent of the messages other database nodes might send or receive. Thus, in the spirit of Lipton's movers [Lipto...

Formal foundations of serverless computing

“…Verification. There is a large body of work on verification, testing, and modular programming for distributed systems and algorithms (e.g., [Bakst et al 2017;Chajed et al 2018;Desai et al 2018;Drăgoi et al 2016;Gomes et al 2017;Guha et al 2013;Hawblitzel et al 2015;Sergey et al 2017;Wilcox et al 2015]). The serverless computation model is more constrained than arbitrary distributed systems and algorithms.…”

Communication-Closed Asynchronous Protocols

“…For each value of rd , to compute the code of round , we consider each path π in the control flow graph of the loop's body and we identify (1) a block of instructions (possibly empty) B π : a sequence of instruction in π that starts with rd = and ends with the instructions preceding the next assignment to rd ; (2) the context under which each block B π is executed, that is a condition cond π that is the conjunction of all the branches leading to rd = on the path π. The B is the sequential composition of all if (cond π ) B π with π path in the control flow.…”

“…Our research belongs to an effort to develop techniques for automated reduction to synchronized executions. Three concurrent approaches in this quest are the exciting results in [5], [26] and [2,21]. Compared to their work, our approach is less guided by specific communication patterns of existing systems.…”

Verifying safety and accuracy of approximate parallel programs via canonical sequentialization

“…Approximation-Aware Canonical Sequentialization. Our safety and accuracy analyses rest on the recently proposed approach for canonical sequentialization of parallel programs [Bakst et al 2017]. This approach statically verifies concurrency properties of asynchronous message passing programs (with simple send and receive primitives) by exploiting the symmetric nondeterminism of well-structured parallel programs.…”