From Traces To Proofs: Proving Concurrent Programs Safe S. - - PowerPoint PPT Presentation

▶
from traces to proofs proving concurrent programs safe
SMART_READER_LITE
LIVE PREVIEW

From Traces To Proofs: Proving Concurrent Programs Safe S. - - PowerPoint PPT Presentation

Jul 10, 2023 211 likes •671 views

From Traces To Proofs: Proving Concurrent Programs Safe S. Arun-Kumar (Joint work with Chinmay Narayan, Subodh Sharma, and Shibashis Guha) Indian Institute of Technology Delhi TASE-2016 S. Arun-Kumar From Traces To Proofs: Proving Concurrent

slide-1
SLIDE 1

From Traces To Proofs: Proving Concurrent Programs Safe

  • S. Arun-Kumar

(Joint work with Chinmay Narayan, Subodh Sharma, and Shibashis Guha) Indian Institute of Technology Delhi

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-2
SLIDE 2

Overview

1

Motivation

2

Preliminaries

3

Example

4

Overall Picture

5

Optimizations

6

Performance Evaluation

7

Contribution

8

Remarks

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-3
SLIDE 3

Motivation

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-4
SLIDE 4

Example: Peterson’s Algorithm

Example trace

flag1 = true, flag2 = true, turn = 0 while(true) do a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); CS1. cs := 1; d. ℓ1 := cs; e. flag1 := false

  • d

while(true) do p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2; s. ℓ2 := cs; t. flag2 := false

  • d

Informal reasoning about the correctness of the mutual exclusion property

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-5
SLIDE 5

Example: Peterson’s Algorithm

Example trace

flag1 = true, flag2 = true, turn = 0 while(true) do a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); CS1. cs := 1; d. ℓ1 := cs; e. flag1 := false

  • d

while(true) do p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2; s. ℓ2 := cs; t. flag2 := false

  • d

Informal reasoning about the correctness of the mutual exclusion property When turn := 2 is the last write to variable turn

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-6
SLIDE 6

Example: Peterson’s Algorithm

Example trace

flag1 = true, flag2 = true, turn = 0 while(true) do a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); CS1. cs := 1; d. ℓ1 := cs; e. flag1 := false

  • d

while(true) do p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2; s. ℓ2 := cs; t. flag2 := false

  • d

Informal reasoning about the correctness of the mutual exclusion property When turn := 2 is the last write to variable turn When turn := 1 is the last write to variable turn

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-7
SLIDE 7

Overall Partitioning Algorithm

Subtr P1 Pn Generation SC Trace AFA Generation Is Safe? No S=S-AFA

S Empty?

Set of traces (S) Pick a Trace from S Yes Yes Program is Safe

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-8
SLIDE 8

Some Preliminaries: Weakest Preconditions

wp(S, φ) is the largest set of states from where the execution of the statement S halts in a state satisfying φ.

Weakest Preconditin ψ S Postcondition φ

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-9
SLIDE 9

Some Preliminaries: Weakest Preconditions

wp(S, φ) is the largest set of states from where the execution of the statement S halts in a state satisfying φ.

Weakest Preconditin ψ S Postcondition φ

wp(x := a + 1, x > 5) = a + 1 > 5

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-10
SLIDE 10

Some Preliminaries: Weakest Preconditions

wp(S, φ) is the largest set of states from where the execution of the statement S halts in a state satisfying φ.

Weakest Preconditin ψ S Postcondition φ

wp(x := a + 1, x > 5) = a + 1 > 5 wp(assert(ψ), φ) = ψ ∧ φ

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-11
SLIDE 11

Some Preliminaries: Weakest Preconditions

wp(S, φ) is the largest set of states from where the execution of the statement S halts in a state satisfying φ.

Weakest Preconditin ψ S Postcondition φ

wp(x := a + 1, x > 5) = a + 1 > 5 wp(assert(ψ), φ) = ψ ∧ φ wp(assume(ψ), φ) = ψ ∧ φ

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-12
SLIDE 12

Preliminaries

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-13
SLIDE 13

Some Preliminaries: Alternating Finite Automata

s1

∀

s2

∃

a s3

∃

a s4

∃

c b s5

∃ b

c s6

∃

b lang(s2)=cb∗ lang(s3)=cb∗ + b lang(s1)=acb∗

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-14
SLIDE 14

Example

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-15
SLIDE 15

Example trace and its AFA construction

Peterson

Example trace σ a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2) Let I be an initial condition. Then show that wp(σ, ¬(ℓ2 = 2)) ∧ I is unsatisfiable

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-16
SLIDE 16

Step 1

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1

∃

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-17
SLIDE 17

Step 2

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1 ¬(cs = 2) s2

∃ ∃

s

Note that wp(s, ¬(ℓ2 = 2)) = ¬(cs = 2)

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-18
SLIDE 18

Step 3

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 true s3

∃ ∃ ∃

s CS1

Note that wp(c, ¬(cs = 2)) = true

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-19
SLIDE 19

Step 4

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 true s3

∃ ∃ ∃

s CS1 CS2

Note that wp(CS2, true) = true

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-20
SLIDE 20

Step 5

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 ¬flag1 turn = 2 s3 ¬flag1 s4 turn = 2 s5

∃ ∃ ∀ ∃ ∃

s CS1 CS2 P P

Note that wp(P, true) = (flag1 = 0turn = 2)

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-21
SLIDE 21

Step 6

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 ¬flag1 turn = 2 s3 ¬flag1 s4 turn = 2 s5

∃ ∃ ∀ ∃ ∃

s CS1 CS2 P P p, q

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-22
SLIDE 22

Step 7

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 ¬flag1 turn = 2 s3 ¬flag1 s4 turn = 2 s5 false s6

∃ ∃ ∀ ∃ ∃

s CS1 CS2 P P p, q q p, a, b, A

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-23
SLIDE 23

Step 8

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 ¬flag1 turn = 2 s3 ¬flag1∧ (¬flag2 turn = 1) s4 turn = 2 s5 false s6 ¬flag1 s7 ¬flag2 turn = 1 s8 ¬flag2 s9 turn = 1 s10

∃ ∃ ∀ ∀ ∃ ∃ ∃ ∀ ∃ ∃

s CS1 CS2 P P p, q q A A ǫ ǫ a, b p, a, b, A TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-24
SLIDE 24

Step 9

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 ¬flag1 turn = 2 s3 ¬flag1∧ (¬flag2 turn = 1) s4 turn = 2 s5 false s6 ¬flag1 s7 ¬flag2 turn = 1 s8 ¬flag2 s9 turn = 1 s10 false s11

∃ ∃ ∀ ∀ ∃ ∃ ∃ ∀ ∃ ∃ ∃

s CS1 CS2 P P p, q q A A ǫ ǫ b a, b a p, a, b, A

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-25
SLIDE 25

Step 10

a. flag1 := true b. turn := 2 A. assume(¬flag2 turn = 1); p. flag2 := true q. turn := 1 P. assume(¬flag1 turn = 2); CS2. cs := 2 CS1. cs := 1 s. ℓ2 := cs assert(ℓ2 = 2)

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 ¬flag1 turn = 2 s3 ¬flag1∧ (¬flag2 turn = 1) s4 turn = 2 s5

∃ ∃ ∀ ∀ ∃

s CS1 CS2 P P p, q false s6

∃

q p, a, b, A false s6 ¬flag1 s7 ¬flag2 turn = 1 s8 ¬flag2 s9 turn = 1 s10

∃ ∀ ∃ ∃

A A ǫ ǫ a, b b false s11

∃

b a false s12

∃

a TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-26
SLIDE 26

AFA constructed from the given trace

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 ¬flag1 turn = 2 s3 ¬flag1∧ (¬flag2 turn = 1) s4 turn = 2 s5 false s6 ¬flag1 s7 ¬flag2 turn = 1 s8 ¬flag2 s9 turn = 1 s10 false s11 false s12

∃ ∃ ∀ ∀ ∃ ∃ ∃ ∀ ∃ ∃ ∃ ∃

s c r P P p, q q A A ǫ ǫ b a a, b b a p, a, b, A TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-27
SLIDE 27

Weakest precondition generation from this AFA

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 ¬flag1 turn = 2 s3 ¬flag1∧ (¬flag2 turn = 1) s4 turn = 2 s5 false s6 false ¬flag1 s7 false ¬flag2 turn = 1 s8 ¬flag2 s9 ¬flag2 turn = 1 s10 false s11 false false s12 false

∃ ∃ ∀ ∀ ∃ ∃ ∃ ∀ ∃ ∃ ∃ ∃

s c r P P p, q q A A ǫ ǫ b a a, b b a p, a, b, A TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-28
SLIDE 28

Weakest precondition generation from this AFA

¬(ℓ2 = 2) s1 ¬(cs = 2) s2 ¬flag1 turn = 2 s3 ¬flag1∧ (¬flag2 turn = 1) s4 turn = 2 s5 false s6 false ¬flag1 s7 false ¬flag2 turn = 1 s8 ¬flag2 ¬flag2 s9 ¬flag2 turn = 1 s10 false false s11 false false s12 false

∃ ∃ ∀ ∀ ∃ ∃ ∃ ∀ ∃ ∃ ∃ ∃

s c r P P p, q q A A ǫ ǫ b a a, b b a p, a, b, A TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-29
SLIDE 29

Weakest precondition generation from this AFA: Final

¬(ℓ2 = 2) s1 false ¬(cs = 2) s2 false ¬flag1 turn = 2 s3 false ¬flag1∧ (¬flag2 turn = 1) s4 false turn = 2 s5 false false s6 false ¬flag1 s7 false ¬flag2 turn = 1 s8 ¬flag2 ¬flag2 s9 ¬flag2 turn = 1 s10 false false s11 false false s12 false

∃ ∃ ∀ ∀ ∃ ∃ ∃ ∀ ∃ ∃ ∃ ∃

s c r P P p, q q A A ǫ ǫ b a a, b b a p, a, b, A TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-30
SLIDE 30

Overall Picture

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-31
SLIDE 31

Overall Picture

Let Aσ,¬φ be the AFA constructed from the trace σ and the safety assertion ¬φ Let ψ be the annotation that flows to the initial state then

1

For every word σ′ accepted by the AFA Aσ,¬φ Theorem 1: wp(rev(σ′), ¬φ) is same as ψ

2

rev(σ) is also accepted by the AFA Aσ,¬φ

3

If ψ ∧ I is unsatisfiable then Safe to exclude the words of this automaton from safety checking

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-32
SLIDE 32

Overall Picture

Let Aσ,¬φ be the AFA constructed from the trace σ and the safety assertion ¬φ Let ψ be the annotation that flows to the initial state then

1

For every word σ′ accepted by the AFA Aσ,¬φ Theorem 1: wp(rev(σ′), ¬φ) is same as ψ

2

rev(σ) is also accepted by the AFA Aσ,¬φ

3

If ψ ∧ I is unsatisfiable then Safe to exclude the words of this automaton from safety checking Optimizations to increase the set of accepted words but preserving Theorem 1

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-33
SLIDE 33

Optimizations

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-34
SLIDE 34

Optimization 1: Conversion from Universal to Existential states

¬(ℓ2 = 2) s1 false ¬(cs = 2) s2 false ¬flag1 turn = 2 s3 false ¬flag1∧ (¬flag2 turn = 1) s4 false turn = 2 s5 false false s6 false ¬flag1 s7 false ¬flag2 turn = 1 s8 ¬flag2 ¬flag2 s9 ¬flag2 turn = 1 s10 false false s11 false false s12 false

∃ ∃ ∀ ∀ ∃ ∃ ∃ ∀ ∃ ∃ ∃ ∃

s c r P P p, q q A A ǫ ǫ b a a, b b a p, a, b, A

Annotation (wp) will remain false even after converting it to an existential state

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-35
SLIDE 35

Optimization 2: Adding Extra Edges

¬(ℓ2 = 2) s1 false ¬(cs = 2) s2 false ¬flag1 turn = 2 s3 false ¬flag1∧ (¬flag2 turn = 1) s4 false turn = 2 s5 false false s6 false ¬flag1 s7 false ¬flag2 turn = 1 s8 ¬flag2 ¬flag2 s9 ¬flag2 turn = 1 s10 false false s11 false false s12 false

∃ ∃ ∃ ∀ ∃ ∃ ∃ ∀ ∃ ∃ ∃ ∃

s c r P P p, q q A A ǫ ǫ b a a, b b a p, a, b, A

Label q in Peterson’s algorithm is turn := 1

slide-36
SLIDE 36

Optimization 2: Adding Extra Edges

¬(ℓ2 = 2) s1 false ¬(cs = 2) s2 false ¬flag1 turn = 2 s3 false ¬flag1∧ (¬flag2 turn = 1) s4 false turn = 2 s5 false false s6 false ¬flag1 s7 false ¬flag2 turn = 1 s8 ¬flag2 ¬flag2 s9 ¬flag2 turn = 1 s10 false false s11 false false s12 false

∃ ∃ ∃ ∀ ∃ ∃ ∃ ∀ ∃ ∃ ∃ ∃

s c r P P p, q q A A ǫ ǫ b a a, b b a p, a, b, A q

Label q in Peterson’s algorithm is turn := 1

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-37
SLIDE 37

Performance Evaluation

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-38
SLIDE 38

Performance Evaluation- Time in Seconds

Program ProofTraPar THREADER[GPR11] Lazy-CSeq[ITF+14] Peterson.safe 0.3 3.2 3.1 Dekker.safe 1.1 1.7 4.2 Lamport.safe 2.4 47 5.1 Szymanksi.safe 3 12.8 4 TimeVarMutex.safe 0.76 8.56 4.2 RWLock.safe (2R+2W) 8.8 140 6.7 RWLock.unsafe (2R+2W) 3.8 153 0.7 Qrcu.safe (2R+1W) 20 – 41 Qrcu.unsafe (2R+1W) 13.8 76 1.1

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-39
SLIDE 39

Contribution

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-40
SLIDE 40

Contribution

A novel algorithm to directly construct an AFA to give a sound and complete verification algorithm Demonstrated the feasibility of trace partitioning approach by implementing and comparing it against state-of-the-art tools

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-41
SLIDE 41

Remarks

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-42
SLIDE 42

Remarks

1

Trace partitioning and Partial Order Reduction

2

Comparison to inductive Data Flow graph(iDFG) proposed in Farzan et.al [FKP13]

iDFG Converted to AFA for set theoretic operations No implementation hence difficult to compare the cost of direct AFA construction vs iDFG to AFA construction

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-43
SLIDE 43

Thank You

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe

slide-44
SLIDE 44
  • A. Farzan, Z. Kincaid, and A. Podelski.

Inductive data flow graphs. In POPL, pages 129–142, 2013.

  • A. Gupta, C. Popeea, and A. Rybalchenko.

Threader: A constraint-based verifier for multi-threaded programs. In CAV, pages 412–417, 2011.

  • O. Inverso, E. Tomasco, B. Fischer, S. La Torre, and G. Parlato.

Bounded model checking of multi-threaded C programs via lazy sequentialization. In CAV, volume 8559 of LNCS, pages 585–602. Springer, 2014.

TASE-2016

  • S. Arun-Kumar

From Traces To Proofs: Proving Concurrent Programs Safe