Proof Spaces for Unbounded Parallelism Zachary Kincaid University - - PowerPoint PPT Presentation

▶
proof spaces for unbounded parallelism
SMART_READER_LITE
LIVE PREVIEW

Proof Spaces for Unbounded Parallelism Zachary Kincaid University - - PowerPoint PPT Presentation

Apr 21, 2023 310 likes •919 views

Proof Spaces for Unbounded Parallelism Zachary Kincaid University of Toronto January 16, 2015 Joint work with: Azadeh Farzan, University of Toronto Andreas Podelski, University of Freiburg Single template T executed by every thread

slide-1
SLIDE 1

Proof Spaces for Unbounded Parallelism

Zachary Kincaid University of Toronto January 16, 2015

Joint work with: Azadeh Farzan, University of Toronto Andreas Podelski, University of Freiburg

slide-2
SLIDE 2

Multi-threaded program verification

  • Unbounded/unknown number of threads
  • E.g., webservers, computations parallelized over N processors, ...
  • Single template T executed by every thread

TN T T T

N times

  • Goal: prove that a given program is free of (certain types of) errors.

Program Verifier

No Yes Property T Diverge

slide-3
SLIDE 3

Multi-threaded program verification

  • Unbounded/unknown number of threads
  • E.g., webservers, computations parallelized over N processors, ...
  • Single template T executed by every thread

TN = T ∥ T ∥· · · ∥ T

  • N times
  • Goal: prove that a given program is free of (certain types of) errors.

Program Verifier

No Yes Property T Diverge

slide-4
SLIDE 4

Multi-threaded program verification

  • Unbounded/unknown number of threads
  • E.g., webservers, computations parallelized over N processors, ...
  • Single template T executed by every thread

TN = T ∥ T ∥· · · ∥ T

  • N times
  • Goal: prove that a given program is free of (certain types of) errors.

Program Verifier

No Yes Property T Diverge

slide-5
SLIDE 5

Multi-threaded program verification

  • Unbounded/unknown number of threads
  • E.g., webservers, computations parallelized over N processors, ...
  • Single template T executed by every thread

TN = T ∥ T ∥· · · ∥ T

  • N times
  • Goal: prove that a given program is free of (certain types of) errors.

Program Verifier

No Yes Property T Diverge

slide-6
SLIDE 6

global t : int // ticket counter global s : int // service counter local m : int // my ticket init s ≤ t m := t++ // acquire ticket do { // busy wait } until (m <= s) // critical section s++ // bump service counter

slide-7
SLIDE 7

Proving correctness of a multi-threaded program is hard. ∀i, j ∈ Thread.pc(i) ̸= init ∧ pc(j) ̸= init ∧ m(i) = m(j) ⇒ i = j Proving correctness of a trace of a multi-threaded program is easy.

  • Re-use sequential verification!

Program is correct each of its traces are correct.

slide-8
SLIDE 8

Proving correctness of a multi-threaded program is hard. ∀i, j ∈ Thread.pc(i) ̸= init ∧ pc(j) ̸= init ∧ m(i) = m(j) ⇒ i = j Proving correctness of a trace of a multi-threaded program is easy.

  • Re-use sequential verification!

Program is correct each of its traces are correct.

slide-9
SLIDE 9

Proving correctness of a multi-threaded program is hard. ∀i, j ∈ Thread.pc(i) ̸= init ∧ pc(j) ̸= init ∧ m(i) = m(j) ⇒ i = j Proving correctness of a trace of a multi-threaded program is easy.

  • Re-use sequential verification!

Program is correct ⇐ ⇒ each of its traces are correct.

slide-10
SLIDE 10

Proof Spaces

slide-11
SLIDE 11

init wait crit exit m := t++ [m <= s] [m > s] s++ global t : int // ticket counter global s : int // service counter local m : int // my ticket init s ≤ t m := t++ // acquire ticket do { // busy wait } until (m <= s) // critical section s++ // bump service counter

T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04

  • P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs

by construction or approximation of fixpoints. POPL’77.

  • P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15.
slide-12
SLIDE 12

init wait crit exit m := t++ [m <= s] [m > s] s++ global t : int // ticket counter global s : int // service counter local m : int // my ticket init s ≤ t m := t++ // acquire ticket do { // busy wait } until (m <= s) // critical section s++ // bump service counter

T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04

  • P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs

by construction or approximation of fixpoints. POPL’77.

  • P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15.
slide-13
SLIDE 13

init wait crit exit m := t++ [m <= s] [m > s] s++ m := t++ : 1 m := t++ : 2 [m <= s] : 1 [m <= s] : 2 Error trace ∈ (Σ×N)∗ Commands Thread IDs

T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04

  • P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs

by construction or approximation of fixpoints. POPL’77.

  • P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15.
slide-14
SLIDE 14

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-15
SLIDE 15

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-16
SLIDE 16

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-17
SLIDE 17

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-18
SLIDE 18

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-19
SLIDE 19

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-20
SLIDE 20

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-21
SLIDE 21

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-22
SLIDE 22

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-23
SLIDE 23

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-24
SLIDE 24

init wait crit exit m := t++ [m <= s] [m > s] s++ {s ≤ t} m := t++ : 1 s m m t m := t++ : 2 s m m m [m <= s] : 1 s m m m [m <= s] : 2 {false}

Intermediate assertions

Craig interpolation, Abstract post, Dual narrowing, ...

T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04

  • P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs

by construction or approximation of fixpoints. POPL’77.

  • P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15.
slide-25
SLIDE 25

init wait crit exit m := t++ [m <= s] [m > s] s++ {s ≤ t} m := t++ : 1 {s ≤ m(1) ∧ m(1) < t} m := t++ : 2 {s ≤ m(1)∧m(1) < m(2)} [m <= s] : 1 {s ≤ m(1)∧m(1) < m(2)} [m <= s] : 2 {false}

Intermediate assertions

Craig interpolation,1 Abstract post,2 Dual narrowing,3 ...

1 T A. Henzinger, R. Jhala, R. Majumdar, K. L. McMillan. Abstractions from proofs. POPL’04 2 P. Cousot & R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs

by construction or approximation of fixpoints. POPL’77.

3 P. Cousot. Abstracting Induction by Extrapolation and Interpolation. VMCAI’15.

slide-26
SLIDE 26

“Small theorems” from sequential verifiers

{s ≤ t} m := t++ : 1 {s ≤ m(1)} {true} m := t++ : 1 {m(1) < t} {m(1) < t} m := t++ : 2 {m(1) < m(2)} {s ≤ m(1) ∧ m(1) < m(2)} [m <= s] : 2 {false} {s ≤ m(1) ∧ m(1) < m(2)} s++ : 1 {s ≤ m(2)}

slide-27
SLIDE 27

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-28
SLIDE 28

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-29
SLIDE 29

Sequencing

{s ≤ t} m := t++ : 1 {m(1) < t} {m(1) < t} m := t++ : 2 {m(1) < m(2)} s t m := t++ : 1; m := t++ : 2 m m

slide-30
SLIDE 30

Sequencing

{s ≤ t} m := t++ : 1 {m(1) < t} {m(1) < t} m := t++ : 2 {m(1) < m(2)} {s ≤ t} m := t++ : 1; m := t++ : 2 {m(1) < m(2)}

slide-31
SLIDE 31

Symmetry

TN = T ∥ T ∥· · · ∥ T

  • N times

{s ≤ m(1)∧m(1) < m(2)} [m <= s] : 2 {false}

slide-32
SLIDE 32

Symmetry

TN = T ∥ T ∥· · · ∥ T

  • N times

{s ≤ m(1)∧m(1) < m(2)} [m <= s] : 2 {false} {s ≤ m(2)∧m(2) < m(1)} [m <= s] : 1 {false} [1 → 2] [2 → 1]

slide-33
SLIDE 33

Symmetry

TN = T ∥ T ∥· · · ∥ T

  • N times

{s ≤ m(1)∧m(1) < m(2)} [m <= s] : 2 {false} {s ≤ m(2)∧m(2) < m(3)} [m <= s] : 3 {false} [1 → 2] [2 → 3]

slide-34
SLIDE 34

Conjunction

{m(1) < t} m := t++ : 3 {m(1) < m(3)} {m(2) < t} m := t++ : 3 {m(2) < m(3)} m t m t m := t++ : 3 m m m m

slide-35
SLIDE 35

Conjunction

{m(1) < t} m := t++ : 3 {m(1) < m(3)} {m(2) < t} m := t++ : 3 {m(2) < m(3)} {m(1) < t ∧ m(2) < t} m := t++ : 3 {m(1) < m(3) ∧ m(2) < m(3)}

slide-36
SLIDE 36

A Proof space is a set of valid Hoare triples which is closed under sequencing, symmetry, and conjunction.

  • Finitely generated: there is a finite “basis” which generates the space

Proof rule: if there exists a proof space H such that for all error traces pre false H then the program is correct.

slide-37
SLIDE 37

A Proof space is a set of valid Hoare triples which is closed under sequencing, symmetry, and conjunction.

  • Finitely generated: there is a finite “basis” which generates the space

Proof rule: if there exists a proof space H such that for all error traces pre false H then the program is correct.

slide-38
SLIDE 38

A Proof space is a set of valid Hoare triples which is closed under sequencing, symmetry, and conjunction.

  • Finitely generated: there is a finite “basis” which generates the space

Proof rule: if there exists a proof space H such that for all error traces τ {pre}τ{false} ∈ H, then the program is correct.

slide-39
SLIDE 39

Relative completeness

Theorem Every inductive invariant (with control variables & universal thread quantification) corresponds to a proof space.

slide-40
SLIDE 40

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-41
SLIDE 41

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-42
SLIDE 42

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-43
SLIDE 43

Infeasible traces Feasible traces No corresponding executions At least one corresponding execution Error traces Error is reachable! Proof Space

slide-44
SLIDE 44

Predicate Automata

slide-45
SLIDE 45

Predicate automata (PA)

Vocabulary (Q, ar) is a finite relational first-order vocabulary Q = {p, q}, ar(p) = 2, ar(q) = 1 p p p q true Configurations

slide-46
SLIDE 46

Predicate automata (PA)

Vocabulary (Q, ar) is a finite relational first-order vocabulary Q = {p, q}, ar(p) = 2, ar(q) = 1 p(1, 2) p(1, 2) ∧ p(2, 3) ∧ q(1) true Configurations

slide-47
SLIDE 47

q(i) q(i) p(i, j) ∧ q(j) a : j [ i = j ] a : j [ t r u e ] q q p q a a q p q a q q p q p p q a a

slide-48
SLIDE 48

q(i) q(i) p(i, j) ∧ q(j) a : j [ i = j ] a : j [ t r u e ] q(1) q(1) p(1, 1) ∧ q(1) a : 1 a : 1 q p q a q q p q p p q a a

slide-49
SLIDE 49

q(i) q(i) p(i, j) ∧ q(j) a : j [ i = j ] a : j [ t r u e ] q(1) q(1) p(1, 1) ∧ q(1) a : 1 a : 1 q(2) p(2, 1) ∧ q(1) a : 1 q q p q p p q a a

slide-50
SLIDE 50

q(i) q(i) p(i, j) ∧ q(j) a : j [ i = j ] a : j [ t r u e ] q(1) q(1) p(1, 1) ∧ q(1) a : 1 a : 1 q(2) p(2, 1) ∧ q(1) a : 1 q(1) ∧ q(2) p(2, 1) ∧ q(1) p(1, 1) ∧ p(2, 1) ∧ q(1) a : 1 a : 1

slide-51
SLIDE 51

Proof checking

  • For any H, {τ : {pre}τ{false} ∈ H} is recognized by a PA A(H)
  • For any program, set of error traces is recognized by a PA Err
  • PA languages are closed under intersection and complement
slide-52
SLIDE 52

Proof checking

  • For any H, {τ : {pre}τ{false} ∈ H} is recognized by a PA A(H)
  • For any program, set of error traces is recognized by a PA Err
  • PA languages are closed under intersection and complement
slide-53
SLIDE 53

Proof checking

  • For any H, {τ : {pre}τ{false} ∈ H} is recognized by a PA A(H)
  • For any program, set of error traces is recognized by a PA Err
  • PA languages are closed under intersection and complement
slide-54
SLIDE 54

Proof checking

  • For any H, {τ : {pre}τ{false} ∈ H} is recognized by a PA A(H)
  • For any program, set of error traces is recognized by a PA Err
  • PA languages are closed under intersection and complement

Proof space inclusion reduces to PA emptiness ∀τ ∈ Error trace.{pre}τ{false} ∈ H ⇐ ⇒ Err ∩ A(H) = ∅

slide-55
SLIDE 55

Theorem The emptiness problem for predicate automata is undecidable. Theorem The emptiness problem for monadic predicate automata ( q Q ar q ) is decidable.

slide-56
SLIDE 56

Theorem The emptiness problem for predicate automata is undecidable. Theorem The emptiness problem for monadic predicate automata (∀q ∈ Q, ar(q) ≤ 1) is decidable.

slide-57
SLIDE 57

Proof spaces: a theoretical foundation for verifying multi-threaded programs

  • Prove traces, not programs
  • Sample - generalize - check loop
  • Proof generalization via a simple deductive system
  • Complete relative to inductive invariants
  • Reduce “proof checking” to an automata-theoretic problem
  • Interesting decidable sub-problem
slide-58
SLIDE 58

Proof spaces: a theoretical foundation for verifying multi-threaded programs

  • Prove traces, not programs
  • Sample - generalize - check loop
  • Proof generalization via a simple deductive system
  • Complete relative to inductive invariants
  • Reduce “proof checking” to an automata-theoretic problem
  • Interesting decidable sub-problem
slide-59
SLIDE 59

Proof spaces: a theoretical foundation for verifying multi-threaded programs

  • Prove traces, not programs
  • Sample - generalize - check loop
  • Proof generalization via a simple deductive system
  • Complete relative to inductive invariants
  • Reduce “proof checking” to an automata-theoretic problem
  • Interesting decidable sub-problem