Dynamic Reductions for Model Checking Concurrent Software Alfons - PowerPoint PPT Presentation

Introduction Transactions Dynamic Experiments Conclusion Dynamic Reductions for Model Checking Concurrent Software Alfons Laarman alfons@laarman.com Henning G¨ unther , Ana Sokolova and Georg Weissenbacher Formal Methods in Systems Engineering Vienna University of Technology March 21, 2017 1/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Reductions Model Checking of Concurrent Software 1 Explosion of interleavings 2 Partial-order reduction vs Lipton reduction 3 Symbolic is a challenge 4 Global commutativity is needed, but a severe bottleneck 2/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Reductions Model Checking of Concurrent Software 1 Explosion of interleavings 2 Partial-order reduction vs Lipton reduction 3 Symbolic is a challenge 4 Global commutativity is needed, but a severe bottleneck x = 1; � a = 1; x += 2; b = 2; x += 3; 2/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Reductions Model Checking of Concurrent Software 1 Explosion of interleavings 2 Partial-order reduction vs Lipton reduction 3 Symbolic is a challenge 4 Global commutativity is needed, but a severe bottleneck x = 1; x = 1; � a = 1; x += 2; b = 2; x += 3; 2/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton vs Partial-Order Reduction (POR) l 1 l a a=0; x=1; l 2 l b b=2; y=2; l 3 l c 3/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton vs Partial-Order Reduction (POR) l 1 l a a=0; x=1; a=0; x=1; b=2; x=1; a=0; y=2; l 2 l b b=2; y=2; x=1; b=2; y=2; a=0; l 3 l c y=2; b=2; 3/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton vs Partial-Order Reduction (POR) l 1 l a a=0; a=0; x=1; a=0; x=1; x=1; b=2; x=1; a=0; y=2; l 2 l b b=2; y=2; x=1; b=2; b=2; y=2; a=0; l 3 l c y=2; y=2; b=2; 3/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton vs Partial-Order Reduction (POR) a,b=0,2; x,y=1,2; l 1 l a a=0; a=0; x=1; a=0; x=1; x=1; b=2; x=1; a=0; y=2; l 2 l b b=2; y=2; x=1; b=2; b=2; y=2; a=0; l 3 l c y=2; y=2; b=2; x,y=1,2; a,b=0,2; 3/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Transactions in databases lock A lock B lock C UPDATE unlock C unlock B unlock A 4/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Transactions in databases internal lock A lock B lock C UPDATE unlock C unlock B unlock A 4/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Transactions in databases internal lock A lock B lock C UPDATE unlock C unlock B unlock A commit pre-phase post-phase 4/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Commutativity Action α right commutes with β , i ff α can always be delayed after β : β β α α � 5/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Commutativity Action α right commutes with β , i ff α can always be delayed after β : β β α α � → Definition (Right commutativity ( ⊲ ⊳ )) σ 1 σ 1 β σ 4 → → α ⊲ ⊳ β i ff ∀ σ 1 ,σ 2 ,σ 3 : → ⇒ ∃ σ 4 : → → α α α σ 2 β σ 3 σ 2 β σ 3 → → 5/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Commutativity Action α right commutes with β , i ff α can always be delayed after β : β β α α � → Definition (Right commutativity ( ⊲ ⊳ )) σ 1 σ 1 β σ 4 → → α ⊲ ⊳ β i ff ∀ σ 1 ,σ 2 ,σ 3 : → ⇒ ∃ σ 4 : → → α α α σ 2 β σ 3 σ 2 β σ 3 → → Example An action both-commutes with all actions that access a disjoint set of variables. A lock(/unlock) right(/right)-commutes with other lock and unlock operations. 5/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Commutativity Action α right commutes with β , i ff α can always be delayed after β : β β α α � → Definition (Right commutativity ( ⊲ ⊳ )) σ 1 σ 1 β σ 4 → → α ⊲ ⊳ β i ff ∀ σ 1 ,σ 2 ,σ 3 : → ⇒ ∃ σ 4 : → → α α α σ 2 β σ 3 σ 2 β σ 3 → → Example An action both-commutes with all actions that access a disjoint set of variables. A lock(/unlock) right(/right)-commutes with other lock and unlock operations. Definition (Right-Movability) The action α of thread i is a right-mover, i ff for all j � i : α → → i ⊲ ⊳ → j 5/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton Reduction [Lipton ’77, Lamport et al. ’89] Example (A statement sequence, where x is the only global variable) a = 1; x = 2; b = 3; c = 4; 6/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton Reduction [Lipton ’77, Lamport et al. ’89] Example (A statement sequence, where x is the only global variable) a = 1; x = 2; b = 3; c = 4; a, x, b, c = 1, 2, 3, 4; � 6/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton Reduction [Lipton ’77, Lamport et al. ’89] Lipton Reduction A statement α 1 ; ... ; α n of thread i can be reduced to α 1 ◦ ··· ◦ α n , if for some 1 ≤ k < n , and all j � i : → α 1 ,...,α k − 1 ⊲ ⊳ → j ( pre-phase statements (before α k ) are right movers ) 1 ← ⊳ → j ( post-phase statements (after α k ) are left movers ) α k + 1 ,...,α n ⊲ 2 α 2 α n ∀ σ ∃ σ ′ : σ → i σ ′ → i ◦···◦ (statements after α 1 do not block) 3 Example (A statement sequence, where x is the only global variable) a = 1; x = 2; b = 3; c = 4; a, x, b, c = 1, 2, 3, 4; � 6/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton Reduction [Lipton ’77, Lamport et al. ’89] Lipton Reduction A statement α 1 ; ... ; α n of thread i can be reduced to α 1 ◦ ··· ◦ α n , if for some 1 ≤ k < n , and all j � i : → α 1 ,...,α k − 1 ⊲ ⊳ → j ( pre-phase statements (before α k ) are right movers ) 1 ← ⊳ → j ( post-phase statements (after α k ) are left movers ) α k + 1 ,...,α n ⊲ 2 α 2 α n ∀ σ ∃ σ ′ : σ → i σ ′ → i ◦···◦ (statements after α 1 do not block) 3 Example (A statement sequence, where x is the only global variable) a = 1; x = 2; b = 3; c = 4; a, x, b, c = 1, 2, 3, 4; � x = 6 a = 1 x = 7 x = 8 x = 2 b = 3 x = 9 c = 4 6/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton Reduction [Lipton ’77, Lamport et al. ’89] Lipton Reduction A statement α 1 ; ... ; α n of thread i can be reduced to α 1 ◦ ··· ◦ α n , if for some 1 ≤ k < n , and all j � i : → α 1 ,...,α k − 1 ⊲ ⊳ → j ( pre-phase statements (before α k ) are right movers ) 1 ← ⊳ → j ( post-phase statements (after α k ) are left movers ) α k + 1 ,...,α n ⊲ 2 α 2 α n ∀ σ ∃ σ ′ : σ → i σ ′ → i ◦···◦ (statements after α 1 do not block) 3 Example (A statement sequence, where x is the only global variable) a = 1; x = 2; b = 3; c = 4; a, x, b, c = 1, 2, 3, 4; � x = 6 a = 1 x = 7 x = 8 x = 2 b = 3 x = 9 c = 4 x = 6 x = 7 a = 1 x = 8 x = 2 b = 3 x = 9 c = 4 6/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton Reduction [Lipton ’77, Lamport et al. ’89] Lipton Reduction A statement α 1 ; ... ; α n of thread i can be reduced to α 1 ◦ ··· ◦ α n , if for some 1 ≤ k < n , and all j � i : → α 1 ,...,α k − 1 ⊲ ⊳ → j ( pre-phase statements (before α k ) are right movers ) 1 ← ⊳ → j ( post-phase statements (after α k ) are left movers ) α k + 1 ,...,α n ⊲ 2 α 2 α n ∀ σ ∃ σ ′ : σ → i σ ′ → i ◦···◦ (statements after α 1 do not block) 3 Example (A statement sequence, where x is the only global variable) a = 1; x = 2; b = 3; c = 4; a, x, b, c = 1, 2, 3, 4; � x = 6 a = 1 x = 7 x = 8 x = 2 b = 3 x = 9 c = 4 x = 6 x = 7 a = 1 x = 8 x = 2 b = 3 x = 9 c = 4 x = 6 x = 7 x = 8 a = 1 x = 2 b = 3 x = 9 c = 4 6/14 Alfons Laarman (TU Wien)

Introduction Transactions Dynamic Experiments Conclusion Lipton Reduction [Lipton ’77, Lamport et al. ’89] Lipton Reduction A statement α 1 ; ... ; α n of thread i can be reduced to α 1 ◦ ··· ◦ α n , if for some 1 ≤ k < n , and all j � i : → α 1 ,...,α k − 1 ⊲ ⊳ → j ( pre-phase statements (before α k ) are right movers ) 1 ← ⊳ → j ( post-phase statements (after α k ) are left movers ) α k + 1 ,...,α n ⊲ 2 α 2 α n ∀ σ ∃ σ ′ : σ → i σ ′ → i ◦···◦ (statements after α 1 do not block) 3 Example (A statement sequence, where x is the only global variable) a = 1; x = 2; b = 3; c = 4; a, x, b, c = 1, 2, 3, 4; � x = 6 a = 1 x = 7 x = 8 x = 2 b = 3 x = 9 c = 4 x = 6 x = 7 a = 1 x = 8 x = 2 b = 3 x = 9 c = 4 x = 6 x = 7 x = 8 a = 1 x = 2 b = 3 x = 9 c = 4 x = 6 x = 7 x = 8 a = 1 x = 2 b = 3 c = 4 x = 9 6/14 Alfons Laarman (TU Wien)