An Abstraction Technique for Describing Concurrent Program Behaviour

Size: px

Start display at page:

Download "An Abstraction Technique for Describing Concurrent Program Behaviour"

Russell White
5 years ago
Views:

1 An Abstraction Technique for Describing Concurrent Program Behaviour Wytse Oortwijn (joint with Stefan Blom and Marieke Huisman) Formal Methods and Tools, University of Twente September 19, 2017 Wytse Oortwijn, UTwente Verifying Model Abstractions 1 / 21

2 Outline 1 Introduction 2 Approach 3 Distributed programs 4 Conclusion Wytse Oortwijn, UTwente Verifying Model Abstractions 2 / 21

3 Outline 1 Introduction 2 Approach 3 Distributed programs 4 Conclusion Wytse Oortwijn, UTwente Verifying Model Abstractions 3 / 21

4 Introduction Approach Distributed programs Concurrent programming is error-prone THERAC-25 Wytse Oortwijn, UTwente Verifying Model Abstractions 4 / 21 Conclusion

5 Introduction Approach Distributed programs Concurrent programming is error-prone THERAC-25 Wytse Oortwijn, UTwente Intel TSX Verifying Model Abstractions 4 / 21 Conclusion

6 Introduction Approach Distributed programs Concurrent programming is error-prone THERAC-25 Intel TSX Toyota car acceleration Wytse Oortwijn, UTwente Verifying Model Abstractions 4 / 21 Conclusion

7 Introduction Approach Distributed programs Concurrent programming is error-prone THERAC-25 Intel TSX Toyota car acceleration Mars climate orbiter Wytse Oortwijn, UTwente Verifying Model Abstractions 4 / 21 Conclusion

8 Introduction Approach Distributed programs Concurrent system behaviour Single traffic light only a few possible behaviours: red, orange, and green Wytse Oortwijn, UTwente Verifying Model Abstractions 5 / 21 Conclusion

orange, and green the number of possible behaviours is exponential in the

9 Introduction Approach Distributed programs Concurrent system behaviour Single traffic light Multiple traffic lights only a few possible behaviours: red, orange, and green the number of possible behaviours is exponential in the number of lights Wytse Oortwijn, UTwente Verifying Model Abstractions 5 / 21 Conclusion

10 Static verification: deductive verification void main(args) { S 1 S 2; How to verify a concurrent program? Wytse Oortwijn, UTwente Verifying Model Abstractions 6 / 21

11 Static verification: deductive verification void main(args) { S 1 S 2; {P 1 S 1 {Q 1 {P 2 S 2 {Q 2 {P 1 P 2 S 1 S 2 {Q 1 Q 2 {P 1 P 2 main(args) {Q 1 Q 2 How to verify a concurrent program? Using program logics, like: Hoare logic, separation logic, etc. Wytse Oortwijn, UTwente Verifying Model Abstractions 6 / 21

12 Static verification: deductive verification requires P 1 P 2; ensures Q 1 Q 2; void main(args) { S 1 S 2; {P 1 S 1 {Q 1 {P 2 S 2 {Q 2 {P 1 P 2 S 1 S 2 {Q 1 Q 2 {P 1 P 2 main(args) {Q 1 Q 2 How to verify a concurrent program? (using automated tools) Using program logics, like: Hoare logic, separation logic, etc. Wytse Oortwijn, UTwente Verifying Model Abstractions 6 / 21

13 Static verification: deductive verification requires P 1 P 2; ensures Q 1 Q 2; void main(args) { S 1 S 2; {P 1 S 1 {Q 1 {P 2 S 2 {Q 2 {P 1 P 2 S 1 S 2 {Q 1 Q 2 {P 1 P 2 main(args) {Q 1 Q 2 How to verify a concurrent program? (using automated tools) Using program logics, like: Hoare logic, separation logic, etc. Strong correctness guarantees Wytse Oortwijn, UTwente Verifying Model Abstractions 6 / 21

14 Static verification: deductive verification requires P 1 P 2; ensures Q 1 Q 2; void main(args) { S 1 S 2; {P 1 S 1 {Q 1 {P 2 S 2 {Q 2 {P 1 P 2 S 1 S 2 {Q 1 Q 2 {P 1 P 2 main(args) {Q 1 Q 2 How to verify a concurrent program? (using automated tools) Using program logics, like: Hoare logic, separation logic, etc. Hard to construct a proof Wytse Oortwijn, UTwente Verifying Model Abstractions 6 / 21

15 Static verification: model checking void main(args) { S 1 S 2;

16 Static verification: model checking void main(args) { S 1 S 2; Abstract model capturing program behaviour

17 Static verification: model checking void main(args) { S 1 S 2; abstraction Abstract model capturing program behaviour

18 Static verification: model checking void main(args) { S 1 S 2; abstraction Abstract model capturing program behaviour Model checker algorithmic analysis

19 Static verification: model checking void main(args) { S 1 S 2; abstraction Abstract model capturing program behaviour input Model checker algorithmic analysis

20 Static verification: model checking void main(args) { S 1 S 2; abstraction Abstract model capturing program behaviour input Temporal properties LTL, CTL, etc. Model checker algorithmic analysis

21 Static verification: model checking void main(args) { S 1 S 2; abstraction Abstract model capturing program behaviour input Temporal properties LTL, CTL, etc. input Model checker algorithmic analysis Wytse Oortwijn, UTwente Verifying Model Abstractions 7 / 21

22 Static verification: model checking void main(args) { S 1 S 2; abstraction Abstract model capturing program behaviour input Temporal properties LTL, CTL, etc. input Model checker algorithmic analysis Good automation Wytse Oortwijn, UTwente Verifying Model Abstractions 7 / 21

23 Static verification: model checking void main(args) { S 1 S 2; abstraction Abstract model capturing program behaviour input Temporal properties LTL, CTL, etc. input Model checker algorithmic analysis State-space explosion problems Wytse Oortwijn, UTwente Verifying Model Abstractions 7 / 21

24 Static verification: model checking void main(args) { S 1 S 2; abstraction Abstract model capturing program behaviour input Temporal properties LTL, CTL, etc. input Model checker algorithmic analysis Is the program abstraction correct? Wytse Oortwijn, UTwente Verifying Model Abstractions 7 / 21

25 Outline 1 Introduction 2 Approach 3 Distributed programs 4 Conclusion Wytse Oortwijn, UTwente Verifying Model Abstractions 8 / 21

26 Our approach: deducative + algorithmic verification void main(args) { S 1 S 2 ; abstraction Abstract model capturing program behaviour input Temporal properties LTL, CTL, etc. input Model checker algorithmic analysis Wytse Oortwijn, UTwente Verifying Model Abstractions 9 / 21

27 Our approach: deducative + algorithmic verification void main(args) { S 1 S 2 ; abstraction Process algebras input Temporal properties LTL, CTL, etc. input Model checker algorithmic analysis Abstract models are process algebra terms Wytse Oortwijn, UTwente Verifying Model Abstractions 9 / 21

28 Our approach: deducative + algorithmic verification requires Process(P); ensures Process(ε); void main(args) { S 1 S 2 ; abstraction Process algebras input Temporal properties LTL, CTL, etc. input Model checker algorithmic analysis Deductively verifying correctness of the abstraction Wytse Oortwijn, UTwente Verifying Model Abstractions 9 / 21

29 Our approach: deducative + algorithmic verification requires Process(P); ensures Process(ε); void main(args) { S 1 S 2 ; abstraction Process algebras with action contracts input Model checker algorithmic analysis The properties are encoded as process/action contracts Wytse Oortwijn, UTwente Verifying Model Abstractions 9 / 21

30 Our approach: deducative + algorithmic verification requires Process(P); ensures Process(ε) Res; void main(args) { S 1 S 2 ; abstraction Process algebras with action contracts results input Model checker algorithmic analysis Applying model checking result in the program logic Wytse Oortwijn, UTwente Verifying Model Abstractions 9 / 21

31 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; static void add2(counter c) { parallel { atomic-add(c.val, 1); and { atomic-add(c.val, 1); Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

32 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; ensures c.val = old(c.val) + 2; static void add2(counter c) { parallel { atomic-add(c.val, 1); and { atomic-add(c.val, 1); How to verify this property? Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

33 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; static void add2(counter c) { parallel { atomic-add(c.val, 1); and { atomic-add(c.val, 1); action incr; The incr action abstracts the atomic-add s. Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

34 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; static void add2(counter c) { parallel { atomic-add(c.val, 1); and { atomic-add(c.val, 1); action incr; process parincr() := incr incr; The parincr process abstracts the add2 program. Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

35 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; static void add2(counter c) { parallel { atomic-add(c.val, 1); and { atomic-add(c.val, 1); guard true; effect x = old(x) + 1; action incr; process parincr() := incr incr; Contracts are used to encode the properties of interest. Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

36 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; static void add2(counter c) { parallel { atomic-add(c.val, 1); and { atomic-add(c.val, 1); guard true; effect x = old(x) + 1; action incr; requires true; ensures x = old(x) + 2; process parincr() := incr incr; Contracts are used to encode the properties of interest. Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

37 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; requires Process(parincr); requires c.val x; static void add2(counter c) { parallel { atomic-add(c.val, 1); and { atomic-add(c.val, 1); guard true; effect x = old(x) + 1; action incr; requires true; ensures x = old(x) + 2; process parincr() := incr incr; Linking concrete program to abstract model. Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

38 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; requires Process(parincr); requires c.val x; static void add2(counter c) { parallel { act incr do atomic-add(c.val, 1); and { act incr do atomic-add(c.val, 1); guard true; effect x = old(x) + 1; action incr; requires true; ensures x = old(x) + 2; process parincr() := incr incr; Linking abstract actions to concrete implementation. Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

39 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; requires Process(parincr); requires c.val x; ensures Process(ε); static void add2(counter c) { parallel { act incr do atomic-add(c.val, 1); and { act incr do atomic-add(c.val, 1); guard true; effect x = old(x) + 1; action incr; requires true; ensures x = old(x) + 2; process parincr() := incr incr; Linking concrete program to abstract model. Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

40 Example program: concurrent counting Concrete program Program abstraction class Counter { public int val; requires Process(parincr); requires c.val x; ensures Process(ε); ensures c.val = old(c.val) + 2; static void add2(counter c) { parallel { act incr do atomic-add(c.val, 1); and { act incr do atomic-add(c.val, 1); guard true; effect x = old(x) + 1; action incr; requires true; ensures x = old(x) + 2; process parincr() := incr incr; Using the result from analyzing all traces of parincr. Wytse Oortwijn, UTwente Verifying Model Abstractions 10 / 21

41 Model abstractions: theory Formalised using the Coq proof assistant (see our VSTTE2017 paper for more details) Wytse Oortwijn, UTwente Verifying Model Abstractions 11 / 21

42 Model abstractions: tool support As extension to the VerCors verification tool set (see our ifm2017 paper+talk for more details) Wytse Oortwijn, UTwente Verifying Model Abstractions 12 / 21

43 The VerCors verification tool set OpenCL OpenMP VerCors Tool Viper Silver PVL Java Common Object Language Silicon Z3 VerCors can be tried and downloaded via Wytse Oortwijn, UTwente Verifying Model Abstractions 13 / 21

44 Model abstractions: verified examples 1 Concurrent counting: verifying that a concurrent counter computes the correct result. 2 No-send-after-read: verifying that confidential data can not be send after being received. 3 Parallel GCD: verifying that a parallel GCD algorithm computes the correct result (VSTTE2017). 4 Locking protocol: verifying that a lock implementation adheres to the intended locking protocol. Wytse Oortwijn, UTwente Verifying Model Abstractions 14 / 21

45 Outline 1 Introduction 2 Approach 3 Distributed programs 4 Conclusion Wytse Oortwijn, UTwente Verifying Model Abstractions 15 / 21

46 Message Passing Interface (MPI) MPI primitives MPI Send(i, m) - sending a message m to process i; m := MPI Send(i) - receiving a message m from process i; MPI Bcast(m) - broadcasting a message m to every process, etc. Wytse Oortwijn, UTwente Verifying Model Abstractions 16 / 21

47 Message Passing Interface (MPI) MPI primitives MPI Send(i, m) - sending a message m to process i; m := MPI Send(i) - receiving a message m from process i; MPI Bcast(m) - broadcasting a message m to every process, etc. Challenges Message exchanges are concurrent; Number of processes often unknown; and Number of possible behaviours often unbounded Wytse Oortwijn, UTwente Verifying Model Abstractions 16 / 21

48 Modeling MPI primitives Abstracting MPI primitives MPI Send(i, m); action send(i, m); m := MPI Send(i); action recv(i, m); MPI Bcast(m); action bcast(m); MPI Barrier(); action barrier; Wytse Oortwijn, UTwente Verifying Model Abstractions 17 / 21

49 Modeling MPI primitives Abstracting MPI primitives MPI Send(i, m); action send(i, m); m := MPI Send(i); action recv(i, m); MPI Bcast(m); action bcast(m); MPI Barrier(); action barrier; Introducing Hoare logic axioms {send(i, m) P MPI Send(i, m) {P {recv(i, m) P m := MPI Recv(i) {P Wytse Oortwijn, UTwente Verifying Model Abstractions 17 / 21

50 Linking abstractions to MPI programs MPI program void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

51 Linking abstractions to MPI programs MPI program void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); Program abstraction process p(int k) := Σ i:int recv(, i) send(0, i + k) Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

52 Linking abstractions to MPI programs MPI program requires Process(p(k) ɛ); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); Program abstraction process p(int k) := Σ i:int recv(, i) send(0, i + k) Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

53 Linking abstractions to MPI programs MPI program requires Process(p(k) ɛ); ensures Process(ε); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); Program abstraction process p(int k) := Σ i:int recv(, i) send(0, i + k) Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

54 Linking abstractions to MPI programs MPI program requires Process(p(k) ɛ); ensures Process(ε); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); Program abstraction process p(int k) := Σ i:int recv(, i) send(0, i + k) Does the program correctly execute its abstraction? Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

55 Linking abstractions to MPI programs MPI program requires Process(p(k) ɛ); ensures Process(ε); void main(int k) { {P(k) ɛ int v := MPI Recv( ); MPI Send(0, v + k); Program abstraction process p(int k) := Σ i:int recv(, i) send(0, i + k) Does the program correctly execute its abstraction? Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

56 Linking abstractions to MPI programs MPI program requires Process(p(k) ɛ); ensures Process(ε); void main(int k) { {P(k) ɛ {Σ i:int recv(, i) send(0, i +k) ɛ int v := MPI Recv( ); MPI Send(0, v + k); Program abstraction process p(int k) := Σ i:int recv(, i) send(0, i + k) Does the program correctly execute its abstraction? Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

57 Linking abstractions to MPI programs MPI program requires Process(p(k) ɛ); ensures Process(ε); void main(int k) { {P(k) ɛ {Σ i:int recv(, i) send(0, i +k) ɛ int v := MPI Recv( ); {send(0, v + k) ɛ MPI Send(0, v + k); Program abstraction process p(int k) := Σ i:int recv(, i) send(0, i + k) Does the program correctly execute its abstraction? Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

58 Linking abstractions to MPI programs MPI program requires Process(p(k) ɛ); ensures Process(ε); void main(int k) { {P(k) ɛ {Σ i:int recv(, i) send(0, i +k) ɛ int v := MPI Recv( ); {send(0, v + k) ɛ MPI Send(0, v + k); {ε Program abstraction process p(int k) := Σ i:int recv(, i) send(0, i + k) Does the program correctly execute its abstraction? Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

59 Linking abstractions to MPI programs MPI program requires Process(p(k) ɛ); ensures Process(ε); void main(int k) { {P(k) ɛ {Σ i:int recv(, i) send(0, i +k) ɛ int v := MPI Recv( ); {send(0, v + k) ɛ MPI Send(0, v + k); {ε Program abstraction process p(int k) := Σ i:int recv(, i) send(0, i + k) Does the program correctly execute its abstraction? Yes! Wytse Oortwijn, UTwente Verifying Model Abstractions 18 / 21

60 Toolchain overview requires Process(p(k) P); ensures Process(P); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k);

61 Toolchain overview requires Process(p(k) P); ensures Process(P); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); 1

62 Toolchain overview process p(int k) := Σ i:int recv(, i) send(0, i + k); 2 requires Process(p(k) P); ensures Process(P); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); 1

63 Toolchain overview process p(int k) := Σ i:int recv(, i) send(0, i + k); 2 requires Process(p(k) P); ensures Process(P); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); 1 3 Verdict Does the program correctly executes its abstraction? Hoare logic reasoning

64 Toolchain overview process p(int k) := Σ i:int recv(, i) send(0, i + k); 2 requires Process(p(k) P); ensures Process(P); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); 1 3 Verdict Does the program correctly executes its abstraction? Hoare logic reasoning P(k 1 ) P(k 2 ) MPI

65 Toolchain overview process p(int k) := Σ i:int recv(, i) send(0, i + k); 2 requires Process(p(k) P); ensures Process(P); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); 1 3 Verdict Does the program correctly executes its abstraction? Hoare logic reasoning P(k 1 ) P(k 2 ) MPI 4

66 Toolchain overview process p(int k) := Σ i:int recv(, i) send(0, i + k); 2 requires Process(p(k) P); ensures Process(P); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); 1 3 Verdict Does the program correctly executes its abstraction? Hoare logic reasoning 5 P(k 1 ) P(k 2 ) MPI 4

Does the program correctly executes its abstraction?

67 Toolchain overview process p(int k) := Σ i:int recv(, i) send(0, i + k); 2 requires Process(p(k) P); ensures Process(P); void main(int k) { int v := MPI Recv( ); MPI Send(0, v + k); 1 3 Verdict Does the program correctly executes its abstraction? Hoare logic reasoning 5 6 P(k 1 ) P(k 2 ) MPI 4 Final verdict Either pass or fail Wytse Oortwijn, UTwente Verifying Model Abstractions 19 / 21

68 Outline 1 Introduction 2 Approach 3 Distributed programs 4 Conclusion Wytse Oortwijn, UTwente Verifying Model Abstractions 20 / 21

69 Conclusion VerCors verification tool set Automated verification of parallel and concurrent software More information: Download & try: Wytse Oortwijn, UTwente Verifying Model Abstractions 21 / 21

A VERIFICATION TECHNIQUE FOR DETERMINISTIC PARALLEL PROGRAMS

A VERIFICATION TECHNIQUE FOR DETERMINISTIC PARALLEL PROGRAMS MARIEKE HUISMAN UNIVERSITY OF TWENTE, NETHERLANDS JOINT WORK WITH SAEED DARABI AND STEFAN BLOM THE CHALLENGE OF RELIABLE SOFTWARE ICT problems