Symbolic Abstract Data Types (ADTs) Constantin Enea University - - PowerPoint PPT Presentation

Symbolic Abstract Data Types (ADTs)

Constantin Enea

University Paris Diderot - Paris 7 joint work with Michael Emmi, IMDEA Madrid

𝜒

⊧

𝜒

⊧

smaller & simpler program, easier to reason about Abstract Data Types

Compositional Proof Rule

that could be checked once for all programs

⊧ ⊧

your program complex objects

Modular Reasoning

Concurrent objects

• methods are called from different threads
• behaviors = sequences of method calls and returns
• callt1 push(1) ret t1 OK callt2 pop() callt1 pop() ret t1 1 …. ret t2 3

happens-before partial order

push(1) pop ⇒ 1 push(2) push(3) pop ⇒ 2 pop ⇒ 3

• more abstractly, as histories (posets of invocations)

• ADT = set of sequential histories (total orders)

O |= ADT iff ∀ h ∈ Histories(O) ∃ linearization ∈ ADT

∃ linearization ∈ SeqStack ?

∉

∉

∉ ∈

ADTs, Linearizability

Challenges:

• a history has exponentially-many linearizations

(checking linearizability is more complex than checking reachability)

• infinite sets of linearizations

Approach: symbolic representations of seq. hist. (linearizations) (first order logic)

Modular Reasoning

• 1. Is there a valid linearization for each history ?
• 2. Does every valid linearization preserve client invariants ?

Describing ADTs

• declarative specifications rather than state-based
• specifying a register: every read returns the value written by

the most recent write

∀ o1, o2, o3. “o1 is a write(a)” ∧ “o2 is a write(b)” ∧ “o3 is a read=>a” ∧ o1 < o2 => o3 < o2

Inferring Symbolic ADTs

GOAL
 inferring FO descriptions of ADTs HYPOTHESIS


• violations can be decomposed in a small set of patterns
• patterns manifest with few operations

[Emmi, E, POPL’16]

Challenges

pop⇒1 push(1) pop⇒1

violation correct

• infinite sets of method invocations and input/output

values

• characterizing infinite sets of violations with a finite

set of patterns:

• adding ops. to violations may lead to correct hist.

Abstracting Data: Matchings

push(1) push(2) pop⇒EMPTY pop⇒2 pop⇒1

• Describing histories in first-order logic:
• Empty: an unmatched push cannot precede a pop⇒EMPTY
• Fifo order: for every two ordered enqueues, the matching

dequeues cannot be in the reverse order

enq(1) deq⇒1 enq(2) deq⇒2

• Group operations in matchings (operations referring to the

same instances of values)

Abstract Algorithm

Input: a reference implementation Impl Output: FO formula representing Histories(Impl) patterns = O ; for each seq. hist. h do if * then break; else if h is executable with Impl then continue; else if h is redundant with patterns then continue; else add h to patterns return exclusion of patterns

Example: atomic queue

deq⇒1 deq⇒1 enq(1) deq⇒1 enq(1) deq⇒1 enq(1) deq⇒EMPTY enq(1) deq⇒1 deq⇒EMPTY enq(2) enq(1) deq⇒2 enq(2) enq(1) deq⇒2 deq⇒1

One deq per enq dequeuing empty fifo order

Abstract Algorithm

Input: a reference implementation Impl Output: FO formula representing Histories(Impl) patterns = O ; for each seq. hist. h do if * then break; else if h is executable with Impl then continue; else if h is redundant with patterns then continue; else add h to patterns return exclusion of patterns

some pattern ⪯ h

History Weakening

LEMMA
 Libraries closed under weakening

weaker order

push(1) pop⇒1 push(2)

pop⇒EMPTY

pop⇒2

all concurrent

push(1) pop⇒1 push(2) pop⇒EMPTY pop⇒2

• “weaker than” = linearizability

Closure properties

• LEMMA. Libraries closed under weakening
• Closure under removing matches

push(1) pop⇒1 pop⇒EMPTY push(2) pop⇒2

• Closure under removing duplicates

write(1) read⇒1 read⇒1 read⇒1

Weaker than ++

PROPOSITION
 Typical concurrent libraries are closed under ⪰

• the set of violations is closed under ⪯

h ⪯ h’ iff h is weaker than h’ or h has more matches or duplicates THEOREM
 ⪯ is a well quasi-order on bounded-width histories

bounded number

• f threads

Inference Algorithm

• enumerate histories according to their size
• patterns = minimal elements w.r.t. ⪯
• closure properties => all histories greater than

patterns are violations

• ⪯ is a wqo => there are only finitely-many patterns
• stop, when increasing the size doesn’t add new patterns
• typically, at most 4 ops. suffice to infer complete

specifications

Excluding Patterns

enq(1) deq⇒1

∃ o, o’: lab(o) = deq⇒1 ⋀ lab(o’) = enq(1) ⋀ o < o’ ⋀ match(o) = o’

• formulas describing patterns where operations are

existentially-quantified

• the negation describes all histories greater than

the pattern

Runtime Monitoring

GOAL


• nline history checking

• complete per sample

• constant space
• /w: exhaust memory

• linear time
• /w: progressive slowdown

HYPOTHESIS
 w/o sacrificing practical completeness


• avoid linearizations

NP → PTIME


• forget operations

PTIME → linear time + constant space

[Emmi, E, Hamza, PLDI’15]

Symbolic checking

THEORY(AtomicStack) transitive ∀o1,o2,o3. o1 < o2 ⋀ o2 < o3 ⟹ o1 < o3
 antisymmetric ∀o1,o2. o1 < o2 ⟹ o2 ≮ o1
 empty ∀o1,o2. pop(o1,empty) ⋀ push(o2,_) ⋀ unmatched(o2) ⟹ o1 < o2
 … FORMULA(h) … ⋀ push(o4,2) 
 ⋀ …
 ⋀ pop(o6,empty)
 ⋀ …
 ⋀ o4 < o5
 ⋀ o5 < o6

THEOREM
 h ∈ Hist(L) iff FORMULA(h) ⋀ THEORY(L) is SAT

transitive


• 4 < o6

empty


• 6 < o4

} }

• 4
• 5
• 6
• 1
• 3
• 2

Saturation Algorithm

ONLY PROPAGATION

transitive empty

branch backtrack

NO DECISIONS

NP → PTIME

Operation Removal

THEOREM
 Always sound to remove matches IDEA
 identify obsolete matches

remove match PTIME → linear time + constant space

STILL A VIOLATION

m a t c h i n g

Empirically

exponentially more efficient complete
 in practice

Conclusion

Future work:

• Complete verification: Leverage insights on violations?
• Weaker abstractions: e.g., causal consistency in place of

atomicity?

• monitoring scheme for checking h ∈ Hist(L)
• first-order theories for describing atomic objects
• incomplete solver (only boolean propagation)
• inferring logical characterizations of sets of histories

Inference Algorithm

Input: a reference implementation Impl Output: FO formula representing Seq(Impl) patterns = O ; k = 1; repeat none-found = true; for each seq. hist. h of size k do if h is executable with Impl then continue; else if some pattern ⪯ h then continue; else add h to patterns; none-found = false; k++; return exclusion of patterns