Quick Verification of Concurrent Programs by Iteratively Relaxed Scheduling

Transcription

1 Quick Verificaion of Concurren Programs by Ieraively Relaxed Scheduling Parick Mezler, Habib Saissi, Péer Bokor, Neeraj Suri Technische Univerisä Darmsad, Germany {mezler, saissi, pbokor, Absrac The mos prominen advanage of sofware verificaion over esing is a rigorous check of every possible sofware behavior. However, large sae spaces of concurren sysems, due o non-deerminisic scheduling, resul in a slow auomaed verificaion process. Therefore, verificaion inroduces a large delay beween compleion and deploymen of concurren sofware. This paper inroduces a novel ieraive approach o verificaion of concurren programs ha drasically reduces his delay. By resricing he execuion of concurren programs o a small se of admissible schedules, verificaion complexiy and ime is drasically reduced. Ieraively adding admissible schedules afer heir verificaion evenually resores non-deerminisic scheduling. Thereby, our framework allows o find a swee spo beween a low verificaion delay and sufficien execuion ime performance. Our evaluaion of a prooype implemenaion on well-known benchmark programs shows ha afer verifying only few schedules of he program, execuion ime overhead is compeiive o exising deerminisic muli-hreading frameworks. I. INTRODUCTION Auomaed verificaion of concurren programs wih nondeerminisic scheduling is known o be challenging: verificaion has o consider all possible schedules a concurren program may be execued wih, which may resul in exponenially many saes o be verified, known as sae space explosion []. Parial order reducion (POR) is able o reduce he sae space of a concurren program by idenifying equivalence classes of program execuions such ha only one represenaive of each class needs o be verified [2] [4]. Such an equivalence class is called Mazurkiewicz race or simply race. However, he reduced sae space may sill be of exponenial size [3]. Hence, he high complexiy of sae space exploraion for concurren sysems remains and hinders a wide applicaion of auomaed verificaion (e.g., model checking) in indusrial sofware developmen. In paricular, verificaion inroduces a considerable delay beween compleion and deploymen of sofware. When developmen of a candidae program is complee, i may be deployed only afer he verifier approved ha i is correc under all possible schedules. This verificaion delay reaches large values for benchmark programs even if sae-of-he-ar POR is used [5], [6]. We conjecure ha he verificaion delay is unaccepably high for large areas of indusrial sofware developmen. Neverheless, individual races can be verified quickly as can be seen when relaing verificaion ime o he number of explored races. Inernal pre-prin version only copyrigh for he original aricle is held by IEEE. In he area of concurrency esing, deerminisic mulihreading (DMT) can help o reduce he number of necessary es cases. Several echniques exis o resric scheduling such ha () scheduling is deerminisic for a paricular inpu and/or (2) only a reduced se of schedules may occur [7], [8]. Such DMT echniques rade poenial execuion ime overhead (compared o execuing he unmodified program) for reduced non-deerminism ha may simplify esing. However, hese approaches do no allow o conrol he schedule ha will occur in advance, which renders hem unsuiable for auomaed verificaion of concurren programs. We are no aware of any exising ool or concep ha allows o execue seleced schedules afer hey are successfully verified. Moreover, i is no possible o adjus he amoun of non-deerminism in exising DMT approaches. We propose o make he amoun of non-deerminism and hereby he verificaion delay adjusable by using inermediae verificaion resuls and reducing non-deerminism by dynamically consrained scheduling. In paricular, insead of waiing for verificaion o complee, we propose o use inermediae verificaion resuls ha guaranee program correcness for one or more schedules. By generalizing he concep of Mazurkiewicz races [9] for symbolic model checking, we are able o use POR as a verificaion echnique wih inermediae verificaion resuls. As soon as a single race is verified, he program may be used inside a suiable execuion environmen wih consrained scheduling. By coninuously verifying and permiing more races, scheduling consrains are ieraively relaxed and, as shown by our evaluaion, execuion ime overhead is reduced. Thus, execuion ime overhead can be raded for verificaion delay. We provide he following conribuions. () We develop a formal framework for ieraive, auomaed verificaion of concurren programs. (2) We inroduce he concep of symbolic races as an exension and generalizaion of Mazurkiewicz races o symbolic model checking. (3) We discuss implemenaion issues for a suiable execuion environmen using our prooype implemenaion for LLVM programs [0]. (4) We show experimenally ha only few races need o be verified o considerably reduce execuion ime overhead. II. OVERVIEW We propose ieraively relaxed scheduling (IRS) for concurren programs wih non-deerminisic scheduling as an improvemen over he convenional approach o program verificaion:

2 2 Verifier Verify program Execuion environmen (unconsrained scheduling) (a) Convenional Program can be safely used Verifier Verify program Submi iniial schedule Ieraively submi addiional schedules Permi all schedules IRS Execuion environmen (b) IRS Program can be safely used Figure : The program verificaion process (sequence diagram) () Develop a program (or program updae). (2) Verify he program. (3) The program can be safely used (wih unconsrained scheduling). In case verificaion is successful, correcness is ensured for all feasible schedules of he program. This guarany comes a he price of a ypically large verificaion delay because of exponenially many schedules when unconsrained (nondeerminisic) scheduling is used. Insead of waiing unil he program is verified for all feasible schedules, we propose o sar using he program already afer a use case-specific hreshold of schedules has been verified. Correcness is guaraneed by wrapping he program in an IRS execuion environmen, which permis only verified schedules by consraining scheduling. We provide deails abou IRS execuion environmens in Secion III. Specifically, verifying a concurren program wih IRS proceeds as follows. () Develop a program (or program updae). (2) Coninuously verify individual schedules or ses of schedules. (3) As soon as one admissible schedule is available, he program can be safely used inside an IRS execuion environmen. (4) Addiional verified schedules may be added during program usage o relax scheduling consrains. The difference beween convenional verificaion and IRS is illusraed in Figure. While convenionally he verificaion delay corresponds o he full verificaion ime, IRS enables o adjus verificaion delay and he amoun of non-deerminism in scheduling: he longer he verificaion delay, he more schedules are verified and he fewer scheduling consrains are necessary o enforce ha only admissible schedules may occur. Consraining scheduling presumably inroduces considerable execuion ime overhead. While execuion ime overhead may be considerable, relaxing scheduling consrains is able o quickly reduce his overhead. Our experimens show ha ieraively relaxing scheduling consrains also ieraively reduces execuion ime overhead, which we deail in Secion V. Given a posiive relaionship beween relaxed scheduling consrains and decreased execuion ime overhead, IRS may be used o exploi he swee spo beween a shor verificaion delay and small execuion ime overhead. In oher words, IRS enables o use as much non-deerminism in scheduling as needed for execuion ime performance and no more nondeerminism han necessary in order o limi he verificaion delay. An addiional advanage of IRS over convenional program verificaion is ha programs ha show boh correc and erroneous schedules can be used safely, as erroneous schedules are never enabled. Such a program may be eiher correced such ha evenually, all schedules can be enabled, or lef unchanged such ha he program is used wih erroneous schedules disabled. In conras, convenional verificaion requires o correc he program so ha he program is only available afer verificaion is resared and compleed successfully. Please noe ha i is well possible ha a program ha is used inside an IRS execuion environmen has erroneous schedules. However, program usage inside he IRS environmen is always safe as only correc schedules are enabled. The only limiaion in such a case is ha he program canno be used safely wih all schedules enabled (e.g., ouside he IRS execuion environmen). Several scenarios of how o use IRS are conceivable, e.g.: () Safely deploy programs wih large sae spaces due o concurrency ha are infeasible o fully verify. (2) In case a program updae inroduces a bug bu correc schedules can sill be found, safely deploy he program wih erroneous schedules disabled unil he bug is fixed. (3) For a given ime budge for verificaion (maximum verificaion delay), verify as much schedules as possible unil he hreshold is reached and deploy he program (wih he remaining schedules disabled). Verificaion delay is reduced. (4) For a given budge of execuion ime performance (e.g., maximum execuion ime overhead), sar verificaion and coninuously es he execuion ime performance for he so far verified schedules. As soon as he program is fas enough, deploy he program (wih he remaining schedules disabled). Verificaion delay is reduced. (5) In addiion o (4), coninue verificaion afer deploymen and coninuously exend he se of verified and enabled schedules. Execuion ime performance is increased afer deploymen. (I is required o updae scheduling consrains online. Wih a suiable implemenaion, i is no necessary o updae he program iself.) Depending on he specific requiremens of a use case, i may be suiable or even necessary o combine or exend hese scenarios. As we deail in Secion IV, i is possible o realize an IRS execuion environmen compleely inside an applicaion program, wihou modifying he operaing sysem.

3 3 In order o execue programs safely inside an IRS execuion environmen (i.e., such ha he specificaion is never violaed) while preserving usabiliy (i.e., such ha full program funcionaliy is available), i mus be ensured ha inermediae verificaion resuls correspond o scheduling consrains ha describe how o remain inside he known-o-be-safe sae space for arbirary program inpus. Thereby, i is guaraneed ha he program is safely execued regardless of he curren inpu. While his requiremen may be srong for programs wih non-deerminisic inpus, he same limiaion applies for verificaion of sequenial programs. Alhough here exis echniques o deerminisically execue concurren programs (e.g., [7], [8], []) in order o suppor concurrency esing, IRS consiues a novel approach o verifying concurren programs. To our bes knowledge, all exising DMT approaches depend on concree program inpus for enforcemen of a deerminisic execuion: no guarany is given abou which schedule is used afer a change in program inpus. However, program verificaion requires correc behavior for every possible program inpu. Consequenly, using an exising DMT approach for verificaion would require o verify a program separaely for each individual inpu, which is ypically infeasible. III. APPROACH A key requiremen for a verificaion echnique o be useful in conjuncion wih IRS is o yield meaningful inermediae verificaion resuls. Oherwise, safe execuion of he program would have o wai unil he program has been verified for all schedules and IRS would be reduced o convenional verificaion. Meaningful inermediae verificaion resuls eiher show a couner example for program correcness or guaranee correcness under cerain scheduling consrains. No addiional consrains should be necessary such as consrains abou program inpus or execuion lengh, as a program may no be fully operaional under such consrains. Therefore, echniques such as explici sae model checking or bounded model checking are unsuiable for IRS. Parial order reducion (POR) is a sae space reducion echnique suiable for symbolic model checking [2], alhough i is ofen presened for explici-sae model checking [4] [6]. We choose POR as a verificaion echnique o insaniae IRS and exend he noion of Mazurkiewicz races o a novel concep of symbolic races in order o suppor symbolic model checking wih meaningful inermediae verificaion resuls. An alernaive echnique for reducing he complexiy of non-deerminisic scheduling, ieraive conex bounding (ICB) [3], would equally fi o produce meaningful inermediae verificaion resuls. However, o our knowledge, ICB has no been applied o symbolic model checking before. A. Sysem Model A (concurren) program P is a ransiion sysem (S, S ini, Σ, ) where S is a finie se of saes, S ini S is a se of iniial saes (program inpus), Σ is a finie se of hreads, and P (S Σ) S is an acyclic ransiion Algorihm : IRS Daa: V he se of admissible races, iniially empy Verifier: 2 for each race o in races(p ) do 3 verify o; 4 if o is correc hen 5 add o o he se of admissible races V ; 6 Execuion environmen: 7 se he curren parial execuion (s 0, u) o he empy sequence; 8 while P has no erminaed do 9 choose some hread from admissible(v, s 0, u); 0 execue he nex even of ; append o u; relaion (for a given sae and hread, here is a mos one successor sae). We wrie s s2 o denoe (s,, s 2 ). A parial execuion of P is an iniial sae (he program inpu for his execuion) and a sequence (s 0, u) S ini Σ, where u =... n such ha here exis saes s,..., s n wih s 0 s n sn (s 0 may be omied if i is clear from he conex or arbirary). In order o uniquely describe each occurrence i of a hread in u, i is associaed wih an even e Σ N such ha e = (, k) wih k = { j : j < i j = i }, i.e., e specifies he hread i and he number of hread occurrences of i ha occur before posiion i in u. We assume he exisence of a dependency relaion for P ha induces a happens-before relaion beween evens and a noion of Mazurkiewicz equivalence on parial execuions [6], [9]. We exend he noion of Mazurkiewicz races o symbolic races as follows. A symbolic race or simply race o of P is a graph o = (E o, C o, o ) ha represens a parial order, he happens-before relaion, of some parial execuion u of P and all parial execuions ha are Mazurkiewicz equivalen o u. We say ha u is a linearizaion of o. Le u =... n be an arbirary linearizaion of o such ha here exis saes s,..., s n wih s 0 s n sn. E o = {e,..., e n } is a se of evens such ha e i corresponds o i for i n. C o is a se of ses of pah consrains (ha may be colleced during model checking). o E o C o E o is an edge relaion beween evens annoaed wih pah consrains such ha for every even e i E o and every incoming edge of e i wih pah consrains C, s i saisfies C. We wrie races(p ) for a se of races ha compleely cover he sae space of P, i.e., i is sufficien o verify all races in races(p ) in order o decide correcness of P. B. Algorihm Given a program P, we define an IRS execuion environmen ha is able o () coninuously receive represenaions of admissible races from a verifier and (2) schedule he program P such ha only admissible execuions occur. Verifier and execuion environmen of P are defined by Algorihm.

4 4 During execuion of a program, he IRS execuion environmen mainains ha he curren parial execuion (s 0, u) adheres o he scheduling consrains represened by some admissible race o, for which we wrie (s 0, u) o. We formalize his noion for a sequence u =... n wih n s 0 s sn for some saes s 0,..., s n and o wih evens E o = {e,..., e m } as (s 0, u) o if () u is empy or (2) here exiss some e i E o ha represens and for all incoming edges wih pah consrains C, s 0 does no saisfy C and (s, 2... n ) remove(e i, o) where remove(e i, o) is o wih e i and all incoming and ougoing edges of e i removed. Inuiively, (s 0, u) o can be checked as follows: if u is empy, he condiion is saisfied, as hey do no conain any evens ha can violae any ordering given by o. If u is no empy, check wheher he firs elemen of u corresponds o an even e i in o ha has no incoming edge ha saisfies he curren pah consrains (i.e., no even has o be scheduled before under he curren program inpus). The condiion is saisfied if u wihou is firs elemen adheres o o wih e i and all adjacen edges removed. For a given parial execuion (s 0, u) and a se of admissible races V, we define he se of all hreads ha can be execued nex, wihou violaing adherence o an admissible race, as admissible(v, s 0, u) := { Σ P : o V. (s 0, u ) o}. When large fracions of a program s sae space are o be explored, i.e., when V conains many races, ime and space complexiy of checking admissible(v, s 0, u) and (s 0, u) o may be relevan. An efficien implemenaion of Algorihm may use, for example, a compac represenaion of muliple races in a single daa srucure. The execuion environmen represenaion of Algorihm corresponds o he inerleaving semanics of concurren programs. I does no show explicily when hreads wai for permission o execue heir nex memory access. In a simple implemenaion, a hread wais before each memory access, which corresponds o one wai operaion per loop ieraion of he execuion environmen. For a possible implemenaion of an execuion environmen, please refer o Secion IV. Correcness In order o use IRS for program verificaion, i is necessary o ensure ha an IRS execuion environmen permis only correc races, i.e., races ha show correc program behavior. For Algorihm, i is clear ha only execuions ha adhere o a admissible race may occur by he definiion of admissible(). Progress Besides correcness, progress is required in order o safely use a program inside an IRS execuion environmen wih he same funcionaliy as he unmodified program. Progress for an IRS execuion environmen expresses ha as long as a program has no ye erminaed, here exiss a hread ha can be scheduled nex in coherence wih a admissible race, i.e., admissible(v, s 0, u) is no empy. In oher words, progress means ha IRS does no inroduce addiional deadlocks ino he program. Algorihm provides progress, as only complee races are added by he verifier. %20 = call %his) 2 %2 = alloca i32 3 sore i32 %20, i32 %2 4 %22 = load i32, i32 %2 5 %23 = bicas i32 %7 o i8 6 call %22, i8 %23, i64 4, i32 ) 7 %24 = cmpxchg i32 %7, i32 0, i32 %9 seq_cs seq_cs 8 call %22) Lising : A global memory access (cmpxchg) afer insering callbacks direcly before and afer. IV. IMPLEMENTATION We have implemened IRS in a C++ prooype ha uses he LLVM compiler infrasrucure [0] o auomaically insrumen LLVM-IR code and enforces a se of admissible races when execuing he program. This design allows o use IRS for programs ha can be ranslaed o LLVM-IR, e.g., C or C++ programs. Afer insrumening a program and linking o our IRS library, he program can be safely used (provided ha a leas one correc schedule is known) wihou modifying he operaing sysem or any oher parameers of he environmen. We do no see fundamenal obsacles o implemen IRS differenly, e.g., inside a Java virual machine (for programs ha can be ranslaed o Java byecode) or wih a cusomized scheduler inside he operaing sysem. Our implemenaion consiss of an LLVM pass responsible for insrumenaion and a library ha enforces specified races in insrumened code. The insrumenaion insers a callback o he library direcly before and afer memory access insrucions (load, sore, compare-and-swap). Only hose memory accesses are insrumened ha direcly access a global variable or where he address of he access depends (possibly ransiively) on he value of a global variable. Hence, he library sees hread execuions as a sequence of evens ha conain exacly one global memory access. We consider wo evens dependen if hey access he same memory locaion and a leas one of hem is a wrie operaion. Lising shows he global memory access of he Indexer benchmark [4] and how callbacks are insered. Idenifiers have been renamed for easier readabiliy. Only line 7 (conaining he compare-and-swap insrucion cmpxchg) is conained in he original program. All addiional lines are added by our insrumenaion. Before he memory access, hread ID, memory locaion and wheher he access can modify he memory are repored by callback before_memory_access o he library, where he even is recorded. Afer he memory access, callback afer_memory_access signals ha he memory access is compleed. A he beginning of he program, an addiional scheduler hread is sared, which collecs recorded evens and decides wheher an even is currenly admissible. When a program hread eners he callback funcion before a memory access, i checks wheher i is necessary o wai for an oher hread in order o follow he se of admissible races. Only if his is he case, synchronizaion wih he scheduler hread is necessary. The program hread appends is curren even o a queue of requess and wais on a C++ condiion variable. Once he scheduler hread reads he reques and he corresponding even is admissible, he program hread is

5 5 signaled and coninues by locking he memory locaion of he curren access, performing he memory operaion, and recording he execued even. When esing our implemenaion, we found ha as expeced, locks and condiion variables are responsible for a large porion of execuion ime overhead. In order o reduce he number of locks, we inroduced busy-waiing in he scheduler hread, which made synchronizaion beween program hreads and he scheduler hread faser for mos cases. However, in some cases, synchronizaion may also be much slower, which may be a disadvanage if execuion ime should never exceed a igh maximum. We expec furher improvemen by he use of more advanced lock-less synchronizaion. Alernaive implemenaion approaches ha do no use an addiional scheduler hread are well conceivable and we expec imporan insighs from comparing differen implemenaion approaches. For example, i migh be overall faser o perform scheduling asks locally in program hreads insead of he scheduler hread. Even if his duplicaes work, execuion ime migh be improved by omiing synchronizaion. V. EXPERIMENTAL EVALUATION We concenrae our experimenal evaluaion on supporing he claim ha ieraively relaxing scheduling consrains decreases execuion ime overhead. Experimenally validaing his claim would show ha i is feasible o use IRS o adjus and find a swee spo beween verificaion delay and execuion ime overhead. As developmen of our prooype is only in an early sage, we do no provide a full experimenal evaluaion bu repor preliminary resuls for wo benchmark programs Indexer [4] and Las Zero [6] ha are used o evaluae POR algorihms. These programs have been chosen because hey are suppored by our prooype and model-checking hem wih POR is well-sudied. We use he Las Zero benchmark wih 5 worker hreads, for which Abdulla e al. repor races and 83s execuion ime for POR. For Indexer, we use 5 hreads, where Abdulla e al. repor 4096 races and 355s execuion ime for POR [6]. Table I shows our experimenal resuls. Each benchmark is run wihou insrumenaion (plain) and insrumened by our prooype (IRS). The number of admissible races is gradually increased. Each configuraion is run 000 imes. We repor he median execuion ime and execuion ime overhead in comparison o he unmodified benchmark. Illusraing he inerplay of execuion ime overhead and verificaion delay, we show he linearly inerpolaed verificaion delay for verificaion imes given by Abdulla e al. as an approximaion of how long a model checker would need o verify he corresponding number of races. For boh benchmarks, execuion ime overhead can be reduced considerably by permiing only a small porion of all races. For Las Zero, permiing less han % of all races reduces execuion ime overhead from 230% o 68%. For Indexer, permiing 6% of all races reduces execuion ime overhead from 32% o 367%. However, execuion ime overhead is reduced less drasically when addiional races are permied. Neverheless, execuion ime overhead wih only Benchmark #Traces Time (µs) Overhead Delay (s) (inerpolaed) Las Zero (IRS) % 0 Las Zero (IRS) % 2 Las Zero (IRS) % 3 Las Zero (IRS) % 20 Las Zero (plain) % 83 Indexer (IRS) % Indexer (IRS) % 2 Indexer (IRS) % 97 Indexer (IRS) % 578 Indexer (plain) % 355 Table I: Execuion ime overhead of IRS and inerpolaed verificaion delay few admissible races is compeiive wih he execuion ime overhead of up o abou 700% and 300% repored for CoreDe and Dhreads [7]. VI. RELATED WORK Approaches ha aemp o limi he amoun of nondeerminism in he behavior of muli-hreaded programs perform deerminisic muli-hreading (DMT) and may be implemened using runime sysems [8], [], [4], libraries [7], and OS modificaions [5]. Liu e al. presen Dhreads [7] as a replacemen for he muli-hreading library Phreads. For a given inpu, Dhreads forces a deerminisic execuion by allowing hreads o execue in parallel, updaing separae copies of he shared sae. The separae copies are hen merged back in a deerminisic order once a synchronizaion poin is reached. In [], Cui e al. propose o enforce deerminisic schedules by recording iniial execuions and reusing he execued schedule subsequenly on compaible execuions wih similar inpus. Anoher deerminisic approach is Parro [8], which combines a runime environmen wih consrained scheduling wih a model checker for bug-finding. Only performance-criical pars of he program need o be model-checked ha are manually excluded from deerminisic scheduling. The main difference beween hese DMT approaches and IRS is ha he former suppor concurrency esing, while our approach is suiable for program verificaion by supporing symbolic program inpus. Using exising DMT approaches for verificaion seems unrealisic as heir scheduling consrains depend on concree program inpus, which would require o verify all possible inpus separaely. Anoher limiaion of above described DMT approaches are fixed scheduling consrains ha canno be relaxed a runime. In conras, our approach allows o auomaically and ieraively relax scheduling consrains a runime, evenually leading o all schedules (ha are successfully verified) being permied. Addiionally, hese DMT approaches eiher provide no fairness in scheduling (compleely deerminisic execuion) or provide fairness for pars of he program by compleely unconsrained scheduling. IRS, in conras, may provide conrolled fairness by enabling corresponding schedules and enabling hem. Anoher line of work deals wih limiing he number of conex swiches o faciliae concurrency bug deecion and concurrency esing. In [6] and [7], programs are modelchecked using bounded model checking (BMC) where he SMT formula is furher consrained o allow only a cerain

6 6 number of conex swiches. By doing so, hey reduce he number of program execuions ha he SAT/SMT solver has o consider. Musuvahi e al. [3] ake his furher by using an ieraive approach o conex swich bounding (ICB). They sar wih an iniial number of conex swiches, and ieraively allow more o gain a higher confidence in he correcness of he program. In his approach, he model checker implemens an explici sae space exploraion sraegy ha sysemaically explores all possible execuions as long as a number of conex swiches is no exceeded. While hese echniques only deal wih bug finding and concurrency esing, IRS proposes a complee verificaion deploymen soluion. Neverheless, we expec ha he concep of ICB can be applied o symbolic model checking as well and herefore could be used as a verificaion echnique under IRS. To our knowledge, ICB has no ye been applied o symbolic model checking. In addiion o scheduling, a source of non-deerminism are relaxed memory models in modern archiecures. Relaxed memory models allow more feasible orderings han he more resriced sequenial consisency model (SC) leading o more program behavior ha has o be covered by he model checker. In [8], a memory monioring approach is proposed o make sure ha SC is mainained during he execuion of a program. Fang e al. in [9] presen an auomaed memory fence inserion echnique o enforce SC using insrumenaion a he source code level. In boh cases, he program can be safely verified under he assumpion ha SC holds wih a reduced sae space. Similarly o IRS, hese approaches resric he amoun of non-deerminism. However, in conras o IRS, hey are no able o dynamically adap he amoun of nondeerminism and are resriced o non-deerminism due o relaxed memory access. VII. CONCLUSION We propose a formal framework for ieraively relaxed scheduling (IRS) as a mehod o make boh verificaion delay and he amoun of non-deerminism in scheduling of concurren programs adjusable. By enforcing scheduling consrains, muli-hreaded programs can be safely used even if he program has only parially been verified. We ouline several scenarios of how o use IRS o enable verificaion of programs wih inracably-large sae spaces, enable safe deploymen of programs wih erroneous schedules, handle verificaion wihin a given ime budge, manage execuion ime overhead, and increase execuion ime performance afer deploymen. Our preliminary experimenal resuls sugges ha ieraively relaxing scheduling consrains gradually reduces execuion ime overhead. [2] E. M. Clarke, O. Grumberg, M. Minea, and D. Peled, Sae space reducion using parial order echniques, Inernaional Journal on Sofware Tools for Technology Transfer (STTT), vol. 2, no. 3, 999. [3] P. Godefroid, Parial-Order Mehods for he Verificaion of Concurren Sysems - An Approach o he Sae-Explosion Problem, ser. LNCS. Springer, 996, vol [4] C. Flanagan and P. Godefroid, Dynamic parial-order reducion for model checking sofware, in Symposium on Principles of Programming Languages (POPL). ACM, [5] G. Guea, C. Flanagan, E. Yahav, and M. Sagiv, Caresian parialorder reducion, in Inernaional SPIN Workshop, ser. LNCS, vol Springer, [6] P. A. Abdulla, S. Aronis, B. Jonsson, and K. F. Sagonas, Opimal dynamic parial order reducion, in Symposium on Principles of Programming Languages (POPL). ACM, 204. [7] T. Liu, C. Cursinger, and E. D. Berger, Dhreads: efficien deerminisic mulihreading, in Symposium on Operaing Sysems Principles (SOSP). ACM, 20. [8] H. Cui, J. Simsa, Y. Lin, H. Li, B. Blum, X. Xu, J. Yang, G. A. Gibson, and R. E. Bryan, Parro: a pracical runime for deerminisic, sable, and reliable hreads, in Symposium on Operaing Sysems Principles (SOSP). ACM, 203. [9] A. W. Mazurkiewicz, Trace heory, in Advances in Peri Nes, 986. [0] The LLVM compiler infrasrucure, hp://llvm.org. [] H. Cui, J. Wu, J. Gallagher, H. Guo, and J. Yang, Efficien deerminisic mulihreading hrough schedule relaxaion, in Symposium on Operaing Sysems Principles (SOSP). ACM, 20. [2] B. Wacher, D. Kroening, and J. Ouaknine, Verifying muli-hreaded sofware wih impac, in Formal Mehods in Compuer-Aided Design (FMCAD). IEEE, 203. [3] M. Musuvahi and S. Qadeer, Ieraive conex bounding for sysemaic esing of mulihreaded programs, in Conference on Programming Language Design and Implemenaion (PLDI). ACM, [4] T. Bergan, O. Anderson, J. Deviei, L. Ceze, and D. Grossman, Corede: a compiler and runime sysem for deerminisic mulihreaded execuion, in Inernaional Conference on Archiecural Suppor for Programming Languages and Operaing Sysems (ASPLOS). ACM, 200. [5] A. Aviram, S. Weng, S. Hu, and B. Ford, Efficien sysem-enforced deerminisic parallelism, in Symposium on Operaing Sysems Design and Implemenaion (OSDI). USENIX Associaion, 200. [6] I. Rabinoviz and O. Grumberg, Bounded model checking of concurren programs, in Inernaional Conference Compuer Aided Verificaion (CAV), ser. LNCS, vol Springer, [7] L. C. Cordeiro and B. Fischer, Verifying muli-hreaded sofware using sm-based conex-bounded model checking, in Inernaional Conference on Sofware Engineering (ICSE), 20. [8] S. Burckhard and M. Musuvahi, Effecive program verificaion for relaxed memory models, in Inernaional Conference Compuer Aided Verificaion (CAV), ser. LNCS, vol Springer, [9] X. Fang, J. Lee, and S. P. Midkiff, Auomaic fence inserion for shared memory muliprocessing, in Inernaional Conference on Supercompuing (ICS). ACM, VIII. ACKNOWLEDGMENTS We hank he anonymous reviewers for heir consrucive commens. Research suppored, in par, by H (ESCUDO-CLOUD). REFERENCES [] A. Valmari, The sae explosion problem, in Lecures on Peri Nes I: Basic Models, Advances in Peri Nes, ser. LNCS, vol. 49. Springer, 996.