Available online at Procedia Computer Science 9 (2012 ) International Conference on Computational Science, ICCS 2012

Transcription

1 Available online at Procedia Coputer Science 9 (2012 ) Abstract International Conference on Coputational Science, ICCS 2012 Reachability Analysis of Concurrent Boolean Progras with Sybolic Counter Abstraction Junyan Qian, Min Li, Lingzhong Zhao* Departent of Coputer Science and Engineering,GuiLin University of Electronic Technology,GuiLin541004,China A basic proble in software odel checking is the choice of a odel for software. Boolean progra is the ost popular representation and is aenable to odel checking. We show how to apply counter abstraction to real world concurrent Boolean progras to eliinate state redundancy. We present a odel checking algorith for thread-state reachability analysis of concurrent Boolean progras, constructing Karp-Miller coverability tree directly on a Boolean progra. And finally evaluate the perforance of the approach using a substantial set of Boolean progra bencharks. Keywords:Concurrent Boolean Progras; Sybolic Counter Abstraction; Model Checking; Thread-state Reachability; Karp-Miller Coverability Tree 1. Introduction Model checking [1] is an autoated verification technique to prove the correctness of the finite-state concurrent systes, by searching the state space of a syste to deterine if the syste property holds. Model checking has been successfully used for verification of concurrent systes, such as integrated circuits, counication protocols. However, the ain obstacle of odel checking concurrent software is the state explosion proble: the nuber of reachable states of a progra grows exponentially with the nuber of concurrent threads. As a result, straightforward ipleent of odel checking on concurrent software can need excessive eory and coputation resources, which leads to the efficiency of verification is very low. To address the proble, a series of ethods have been proposed, including sybolic odel checking[2], abstraction[3], partial order reduction[4], syetry reduction[5]and so on, one of the ost effective way aong these techniques to alleviate the state space explosion is abstraction, especially predicate abstraction[6]is the ost successful prooted by Microsoft Research. Boolean progras [7] are obtained fro source progras using predicate abstraction, i.e., all variables are in type of Boolean. The verification of Boolean progra is the bottleneck in predicate abstraction refineent fraework. Multi-threaded concurrent software often exhibits syetry, finding a way to reduce the verification coplexity according to the nature: counter abstraction. The traditional global state is represented by a vector of local states, *Corresponding author. Tel.: +86_773_229_1629; fax: +86_773_560_1330. E-ail address: Zhaolingzhong163@163.co Published by Elsevier Ltd. doi: /j.procs Open access under CC BY-NC-ND license.

2 1364 Junyan Qian et al. / Procedia Coputer Science 9 ( 2012 ) now introducing a counter for each local state, each counter records the nuber of threads in the current local state, and a vector of counters represents global state of a syste. Counter abstraction turns the state space size of concurrent systes grows exponentially in n into polynoial in n. Since a local state is defined as a valuation of all thread local variables of a thread, the nuber of local states grows exponentially with the nuber of thread-local variables. As a result, the nuber of local states generated is very large, probably resulting in any illions of local states. Introducing a counter for each local state is ipractical but only for tiny progra. To solve the proble, we present a solution for the thread-state reachability analysis of syetric concurrent Boolean progra. First, instead of statically translating each stateent s of the input progra into counter changes, do the translation on the fly. This way requires executing s only in the narrow context of a given and reachable local state. In addition, in a global state only keep counters for those local states that at least one thread exists in. Because l» n (l, n represent respectively the nuber of local states and that of threads), in every syste state the value of ost counters are zero, reoving the zero-valued counters will save huge storage space. Second, construct Karp- Miller coverability tree directly on a Boolean progra. Since the proble of thread-state reachability can reduce to the coverability proble of VASS (vector addition systes with states) [8], and the coverability proble of VASS can be deterined by building a Karp-Miller [9] coverability tree for it. The advantage of constructing Karp-Miller tree directly on Boolean progra is to avoid the blowup that Boolean progra translation into VASS entails. Finally, evaluate the perforance of the ethod on a set of Boolean progra bencharks. 2. Preliinaries 2.1. Concurrent Boolean Progra Boolean progras are obtained by applying predicate abstraction to the original progra P, all variables are Boolean variables. In order to get sound verification of the reachability proble, constructing Boolean progra by over-approxiate the behavior of P, which ay appear spurious paths, this can refine the abstraction further by adding predicates, then detect and eliinate spurious paths, this process is counterexaple-guided abstraction refineent(cegar)[10]. The Boolean progra syntax has been detailed in [7]. SATABS extends the seantics for sequential Boolean progras with the following four instructions to support concurrency: The instruction start_thread goto l creates a new thread that starts execution at the progra location l. It gets a copy of the local variables of the current thread, which continues execution at the proceeding stateent. The instruction end_thread terinates the current thread, i.e., has no successor state. The instruction atoic_begin prevents the scheduler fro a context switch to other thread. The instruction atoic_end allows any thread to be executed. Let P, PC, L, V s, V l, V be a Boolean progra, progra counter, progra location, the set of shared variables, the set of thread-local variables, the set of progra variables respectively, where V = V s V l. Definition 1. An explicit state of a Boolean progra is a triple <n, PC, >, where n is the nuber of threads, PC: {1,,n} L is the vector of progra locations, : V s ({1,,n} V l ) B { } is the valuation of the progra variables. Definition 2. <PC, > with PC L, B { } is called a thread state. It is a valuation of the progra counter, the local variables of a particular thread, and the globally shared variables. We use η ξ to denote a transition fro thread state η to thread state ξ. The conditions on the transition η ξ for each instruction are shown as follows: skip: PPC ( ) = skip < PC, Ω> < PC + 1, Ω> PPC ( ) = goto l,, lk < PC, Ω> < l, Ω> i PPC ( ) = x,..., xk : = e,..., econstrain e, Ω = [ x/ k e, Ω, ι ]...[ x k k / e, Ω, ι ], k e, Ω, Ω, ι < PC, Ω> < PC + 1, Ω > goto l 1,,l k : 1 x 1,,x k :=e 1,,e k constrain e: i {1,...,k} (2) (1) (3)

3 Junyan Qian et al. / Procedia Coputer Science 9 ( 2012 ) start_thread: PPC ( ) = start thread l < PC, Ω> < PC + 1, Ω> PPC ( ) = start thread l < PC, Ω> < l, Ω> (4) 2.2. Counter Abstraction Counter abstraction [11] can be seen as a for of syetric reduction that presented by Pnueli et al. in the verification of liveness properties of paraeter syste, the ain idea is to use an abstract state replacing the concrete state of a concurrent syste that consists of any siilar coponents, each abstract state is a k-tuple of integer, denoted by (c 1, c 2,..., c k ), c j counts how any processes are currently in the j-th state. A transition fro local state A to local state B can be translated a decreent of the counter for A and an increent of that for B. This transforation can be ipleented statically in the text of syetric progra P before creating the Kripke odel, the resulting counter-abstracted progra ˆP generates a Kripke structure ˆM whose reachable is isoorphic to that of the traditional quotient structure M, so that can be odel checked without considering further syetry. Counter abstraction technique akes a proble of size exponential in n reduces to one of size polynoial in n, iproving the efficiency of the verification. For any given Boolean progra, l is a constant, seen fro a theoretical view, sees to have solved the state space explosion proble. However, for concurrent software, the thread behavior is given in the for of a progra that control thread-local variables, a local state is defined as a valuation of all thread-local variables, which is incopatible in practice with the idea of counter abstraction: the nuber of the local states generated is very large. For exaple, a Boolean progra with five thread-local variables and the PC with range {1 10} can generate 2 5 *10=320 local states. In practice, concurrent Boolean progras generally have dozens of thread-local variables and thousands of lines, which can generate illions of local states. As a result of the local state space explosion proble, the state space of the V 2 l counter-abstracted progra is of size Ω ( n ), doubly-exponential in the nuber of thread-local variables. Therefore, the traditional counter abstraction is unfit to general progra but for tiny progras Karp-Miller Coverability Tree We use S, and respectively denote the set of states, the set of -tuple of integers and the set of -tuple of non-negative integers. An -diensional VASS is a finite-state achine whose edges are labeled with v, denoted by W= (d, ), where d S is the initial configuration and : S S is the transition function. A configuration of a VASS is denoted by (q, x), where q is a state, x is an -tuple of non-negative integers. There is a transition (q, x) (q', x') if (q', v) (q) and x'=x + v. A Configuration (q, x) is reachable if there is a sequence of transitions start at d and end at (q, x). The coverability proble of VASS asks whether a given configuration (q, x) is covered by the VASS, i.e., whether a configuration (q, x') is reachable such that x' x. Figure 1 shows an exaple of VASS. (0,0,0,0) (-1,1,0,0) (-1,1,0,0) (0,-1,1,0) decl s:=0 ain () begin 0: goto 1 1: s: =1 2: s: =0 3: end d (1,0,0,0) (0,0,0,0) (0,0,-1,1) s=0 s=1 (0,0,-1,1) (0,-1,1,0) (a) Boolean progra Fig.1. (a) Boolean progra; (b) VASS (b) VASS Theore 1([12]). The coverability proble for VASS is decidable. The thread state reachability proble can be reduced to VASS coverability proble, for this reduction, local states corresponding to an -diensional vector, the value of i-th coponent of VASS configuration vector

4 1366 Junyan Qian et al. / Procedia Coputer Science 9 ( 2012 ) corresponding to the nuber of threads in state i. As a result, the tie coplexity of thread-state reachability proble is equivalent to that of the coverability proble for VASS that are polynoial. Corollary 2. The thread-state reachability proble for replicated finite-state progras is decidable. Karp-Miller tree can copactly represent the set of covered configurations of a VASS. The algorith as follows: The root of the tree is labeled by the initial configuration of VASS. For any two nodes and in the tree, if there is a path fro to, denotes as ; if there is an edge fro to, then is a successor of. A node without successors is called an end node. Each node of the tree is labeled with l ( ) = (q, x), where q is a state, x is -diensional vector whose coordinate are eleents of {ω} (ω is any natural nuber). For any node labeled with l ( ) = (p, y) differs fro, we say l ( ) covers l ( ) if p=q and for each i-th coordinates of vectors x and y, such that x i y i. For soe node, l ( ) = (q, x): is an end node if there exist soe node,, l ( ) =l ( ); otherwise, is a successor of, l ( ) = (q', x'). Deterines each i-th coordinates of vector x' as followings (We call it the ω procedure): (1) if there is a path and l ( ) =(s, y), such that covers and y i <(x + v) i, then x' i =ω, ω is a sybol such that z, ω > z and ω+ z =ω;(2) if there is no such node, then x' i =(x + v) i. This process eventually reaches a fix point. If there is a label (q, v) such that x v, then the configuration (q, x) is covered by the VASS. Figure 2 depicts the Coverability Tree of the exaple in Figure 1: 3. Sybolic Counter Abstraction <S 0, (,, 0, )> <S d, (ω, 0, 0, 0)> < S 0, (, 0, 0, 0)> < S 0, (,, 0, 0)> <S 1, (,, 1, 0)> <S d, (0, 0, 0, 0)> <S 0, (0, 0, 0, 0)> < S 1, (,,, 0)> < S 1, (,, 1, )> < S 1, (,,, )> <S 0, (,,, )> Fig.2. Corresponding Karp-Miller tree for Figure 1 To solve the state sapce explosion proble faced during the ipleentation of the traditional counter abstraction, we give a solution for the thread state reachability analysis of concurrent Boolean progra. First, instead of statically translating each stateent s of the input progra into counter updates, do the translation on the fly. In a global state only keep counters for those local states that at least one thread resides in. Because l» n, in every syste state ost counters are zero; Second, construct Karp-Miller coverability tree directly on a Boolean progra. The advantage is to avoid the blowup that Boolean progra translation into VASS entails. As a result, the worst-case size of the Kripke structure of the counter-abstracted progra is reduced fro n l to n in {n, l}, copletely eliinating the sensitivity to the local state space explosion proble. We first describe a data structure used to store syste states copactly before describing the sybolic state space exploration algorith that ipleents this ethod Sybolic representation Boolean progra ake heavy use of data nondeterinis, the nondeterinistic Boolean value is denoted by. In practice, enuerating all possible values of expression associated with is infeasible, a better ethod is to

5 Junyan Qian et al. / Procedia Coputer Science 9 ( 2012 ) interpret sybolically, this interpretation is not only copatible with Boolean progra encodings based on BDDs, but can also be cobined well with counter abstraction. Our approach is to count sets of local states, rather than individual local state. To foralize the state representation, let L be the set of local states, i.e., L =l. An abstract global state can be expressed as: <S, (L 1, n 1 ),, (L k, n k )> (5) In this expression, S represents valuations of the shared variables, L i represents the set of local states, L i L, n i represents a counter, n i 1, n i { }, (L i, n i ) denotes there are n i threads in the local state L i. For instance, the abstract global state < ({x=1}, 2), ({x=0}, 4)> represents these concrete states where 2 threads satisfy x=1, whereas the reaining 4 threads satisfy x=0. The seantics of this representation is given by the set of concrete states that expression (5) represents, naely the states of the for (s, l 1,..., l n )such that: (a) s S, k (b) = n, (6) n i= 1 i (c) there exists a partition {I 1,..., I k } of {1,...,n} such that for all i {1,...,n}, I i =n i and for all j I i, l j L i. In traditional counter abstraction, k=l= L and do not require n i 1, thus suffer fro the potential redundancy of n i being 0 for ost i. In addition, representation (5) has a proble. When counicate data between threads, Boolean progras can introduce such constraints between shared and thread-local variables, such as introduced by an assignent of the for shared: =local, are inexpressible. The reason is that neither S nor the sets L i are defined by expressions over both shared and thread-local variables. In order to ake this constraint expressible, we ust treat certain assignents and related stateents specially. Definition 3. A splice state is a predicate f over shared V s and thread-local variables V l such that ( Vs. f) ( V l. f) Splice states result fro counication. Split the current thread state before executing a splice stateent as follows: Iage (T) = Iage (T v=0) Iage (T v=1) The worst-case cost of state splitting is exponential in the nuber of splice variables. However, we observed in experients: (1) there is relatively few splice stateents; (2) very few splice variables in a splice stateent (one or two); (3) relatively proportion of cofactors encountered during the exploration is actually unsatisfiable and does not produce new states. As a result, the decoposition never suffers fro the potential cobinatorial explosion Sybolic State Space Exploration We present a sybolic odel checking algorith for thread-state reachability analysis of concurrent Boolean progras, constructing Karp-Miller coverability tree directly on a Boolean progra (Fig 3). The algorith uses the state representation described section 3.1, ainly coputes the counter-abstracted set of states reachable fro a given set of initial state, and checks whether the new node covers previously discovered node. To ake the search efficient, keep a separate copy of those discovered nodes that are axial as to the covering partial order. New labels are copared against these axial nodes only. More precisely, when a new node is found, the algorith first checks whether soe previously discovered node covers. if so, then discard. To check this, only copare with the axial eleents of each chain in the covering partial order. Conversely, the algorith checks whether covers soe previously discovered node. if so, then reoved fro the unexplored list. The algorith as follows: f

6 1368 Junyan Qian et al. / Procedia Coputer Science 9 ( 2012 ) : Initialize: R :={< S 0, (L 0, n 0 ) >}; insert<s 0, (L 0, n 0 )>into WorkList n 0 threads in L 0 2: While WorkList Ø do 3: pop =<S, F> (F= {(L 1, n 1 ),,(L k, n k )})fro WorkList 4: for i {1,...,k}do 5: T :=< S, L i > extract i-th thread state fro 6: for v all valuations of Splice Variables (T) do 7: T'=<S', L' >:= Iage (T v) copute successor thread state 8: if L' L i then 9: ':= UPDATECOUNTERS (S, S', F, i, L')> build new syste state ' 10: '':= UPDATECOVER ( ') build covered syste state '' 11: if '' R then 12: R: = R ' if new, store ' as reachable 13: insert ' into WorkList Fig.3. Reachability Analysis The algorith (in Fig 3) expands unexplored syste states fro a worklist. The loop in line 4 iterates over all pairs (L i, n i ) contained in the popped state. The next and crucial step is to copute the successor thread states (lines 6-7). After coputing the iage for each cofactor, the algorith constructs the respective syste state for it (lines 8-9). The UPDATECOUNTERS function (see Fig 4(a)) deterines the new set of F' according to the local state part L' of the newly coputed thread state. If n i =ω, then n i is never updated, since ω - 1=ω. If n i ω and no ore threads reside in the state L i, then eliinate the i-th pair (line 4). If the new local state L' was already present in the syste state, if n j ω, n i =ω and S'=S, then n j doesn t change, since ω + 1=ω (line 8); if n i ω, then n j is increented (lines 9-11). Otherwise the state is inserted with counter value 1 (line 13). The procedure UPDATECOVER (see Fig 4(b)) introduces ω for the thread states that can be reached. The idea is to look for cycles in the execution path that spawn new threads infinitely. That is, we first walk backwards towards the initial state (line 4) and check if any preceding state is subsued by the state τ. If such a state ' has been found (line 5), any pair (L i, n i ) that occurs in the new state τ with a higher counter value than in the preceding state ' is replaced by the pair (L i, ω) (lines 6-8). Finally, the algorith adds the states encountered for the first tie to the set of reachable states, and to the worklist of states to expand (lines in Fig 3). 1: procedure UPDATECOUNTERS (S, S, F, i, L') 2: let (L i, n i ) be the i-th pair in F 3: if n i ω then 4:F':= F {(L i,n i )} (n i >1? {(L i, n i 1)}: Ø) 5: if j. (L', n j ) F then 6: if n j ω then 7: if n i =ω S'=S then 8: F':= F' {(L', n j )} {(L', ω)} else 9: F':= F' {(L', n j )} {(L', n j + 1)} 10: else if n i =ω S'=S then 11: F':= F' {(L', ω)} 12: else 13: F':= F' {(L', 1)} 14: return< S', F'> 1: procedure UPDATECOVER ( ) 2: σ =τ 3: let (L i, n i ) be the i-th pair in σ=<s, (L 1, n 1 ),,(L k, n k )> 4: for all ' Pred( ) do 5: if and S'=S then 6: let (L' j,n' j ) be the i-th pair in '=<S',(L' 1, n' 1 ), (L' k, n' k )> 7: I: = {i L' j =L i, n' j < n i } 8: σ:=σ [(L i, n i )/ (L i, ω), i I] 9: return σ (a) Build Coverability Tree Fig.4. (a) Build Coverability Tree; (b) Build Covering State (b) Build Covering State

7 Junyan Qian et al. / Procedia Coputer Science 9 ( 2012 ) Experiental Evaluation We have ipleented the algorith presented in this paper in a tool of reachability analysis of concurrent Boolean progra called BOOM, the concurrent bencharks used is drawn fro a large and diverse set of benchark Boolean progras generated by SATABS[13]that abstract Linux and Windows kernel coponents using SLAM tool[14]. The experiental setup is as follows: we run full reachability analysis with n 0 =1 initial thread, and then increase the bound N until the tool ties out. The tieout is set to 720s and the eory liit to 12GB. The experients are perfored on Linux operating syste. The ain goal of this paper is the sybolic analysis of Boolean progras. In the sae bencharks, we copare the running tie of the sybolic counter abstraction with that of a plain sybolic ipleentation in BOOM that ignores the syetry, shown in Fig 5(a). Counter abstraction gets the iproveent in scalability, when the nuber of threads is sall, traditional Model Checking is faster, but the coplexity of counter abstraction is polynoial; in fact, our algorith can verify any instances for 7 or ore threads. Overall, the running tie of sybolic counter abstraction is faster. For the thread-state reachability analysis with unbounded thread creation, the experient shows the running ties using Karp-Miller ethod are very sall (Fig 5(b)). running tie(s) sybolic counter abstraction plain sybolic exploration threads(n) running tie(s) the running tie of Karp-Miller Boolean progras (a) (b) Fig.5. (a) Running tie of sybolic counter abstraction vs. plain exploration; (b) Running tie of Karp-Miller ethod for various Boolean progras 5. Conclusion We present a odel checking algorith based on sybolic counter abstraction for thread-state reachability analysis of concurrent Boolean progras, construct Karp-Miller coverability tree directly on a Boolean progra, which avoids effectively the local state space explosion proble facing that Boolean progra translation into VASS, experiental results show the effectiveness of the ethod. In concurrent software verification, counter abstraction has an iproveent in scalability. Since the state space size of the counter-abstracted progra is polynoial, which reduces greatly the coplexity of the verification. Sybolic counter abstraction prooted the verification of syetric concurrent systes that described using Boolean progras. In future work we will consider how to cobine it with other techniques to achieve ore effective copression, such as partial order, and research how to apply it to reachability analysis of concurrent systes of paraeterized systes or unbounded dynaic thread creation. Acknowledgeents This work is supported by Natural Science Foundation of China (No , No ), Guangxi Natural Science Foundation of China (No.2011GXNSFA018164, No.2011GXNSFA018166), China Postdoctoral Science Foundation (No ), Guangxi Graduate Innovation Foundation (No M19). We

8 1370 Junyan Qian et al. / Procedia Coputer Science 9 ( 2012 ) sincerely thank all the colleagues in Software Technology Institute for helping and inspiring discussions on reachability analysis of concurrent Boolean progras. References 1. E. Clarke, O. Gruberg, D. Peled.Model Checking.Cabridge: MIT Press, A. Ciatti, E. Clarke, E. Giunchiglia, F. Giunchiglia, M. Pistore, M. Roveri, etc.nusmv 2:An OpenSource Tool for sybolic odel checking.in Proceedings of the 14th International Conference on Coputer Aided Verification. LNCS 2404, Copenhagen:Springer- Verlag,2002, P. Cousot.The Role of Abstract Interpretation in Foral Methods.In Proceedings of the 5th IEEE International Conference on Software Engineering and For- al Methods. London: IEEE,2007, V. Kahlon, C. Wang, A. Gupta. Monotonic Partial Order Reduction: An Optial Sybolic Partial Order Reduction Technique. In Proceedings of the 21st Inte- rnational Conference on Coputer Aided Verification. LNCS 5643, Grenoble:Springer-Verlag,2009, E. Clarke, R. Enders, T. Filkorn, and S. Jha. Exploiting Syetry in Teporal Logic Model Checking. Foral Methods in Syste Design,1996,9(1-2): K. Lahiri, R. Bryant and B. Cook.A Sybolic Approach to Predicate Abstraction.In Proceedings of the 15th International Conference on Coputer Aided Verification. LNCS 2725, Boulder:Springer-Verlag,2003, T. Ball, S. Rajaani. Bebop: A Sybolic Model Checker for Boolean Progras. In Spin Model Checking and Software Verification, LNCS1885, Springer-Verlag,2000, T. Brázdil, P. Jan ar and A. Ku era. Reachability Gaes on Extended Vector Addition Systes with States. In Proceedings of the 37th International Colloquiu on Autoata, Languages and Prograing. LNCS 6199, Bordeaux:Springer-Verlag,2010, K. N. Vera and J. Goubault-Larrecq.Karp-Miller trees for a branching extension of VASS. In Discrete Matheatics and Theoretical Coputer Science, 2005,7(1): R. Kurshan. Coputer-Aided Verification of Coordinating Processes.Princeton University Press, A. Pnueli, J. Xu, and L. Zuck. Liveness with (0,1, )-counter abstraction.in Proceedings of the14th International Conference on Coputer Aided Verification.LNCS 2404, Copenhagen:Springer-Verlag,2002, R. Karp and R. Miller. Parallel progra scheata. In Coputer and Syste Sciences,1969,3(2): E. Clarke, D. Kroening, N. Sharygina and K. Yorav. SATABS: SAT-based predicate abstraction for ANSI-C. In Tools and Algoriths for the Construction and Analysis of Systes, LNCS3440, Springer-Verlag,2005, T. Ball and S. Rajaani. The SLAM project: debugging syste software via static analysis.in Proceedings of the 29th ACM SIGPLAN- SIGACT syposiu on Principles of prograing languages, ACM, 2002,37(1):1-3.