Domain-Independent
Multi-Threaded Software Model Checking

Dirk Beyer and Karlheinz Friedberger


Publication

A preprint of this article is available for you to download. The published paper is available from ACM.

The approach was presented at ASE 2018 (slides) and CPA 2018 (slides).


Abstract

Recent development of software aims at massively parallel execution, because of the trend to increase the number of processing units per CPU socket. But many approaches for program analysis are not designed to benefit from a multi-threaded execution and lack support to utilize multi-core computers. Rewriting existing algorithms is difficult and error-prone, and the design of new parallel algorithms also has limitations. An orthogonal problem is the granularity: computing each successor state in parallel seems too fine-grained, so the open question is to find the right structural level for parallel execution. We propose an elegant solution to these problems: Block summaries should be computed in parallel. Many successful approaches to software verification are based on summaries of control-flow blocks, large blocks, or function bodies. Block-abstraction memoization is a successful domain-independent approach for summary-based program analysis. We redesigned the verification approach of block-abstraction memoization starting from its original recursive definition, such that it can run in a parallel manner for utilizing the available computation resources without losing its advantages of being independent from a certain abstract domain. We present an implementation of our new approach for multi-core shared-memory machines. The experimental evaluation shows that our summary-based approach has no significant overhead compared to the existing sequential approach and that it has a significant speedup when using multi-threading.


Content

The supplementary archive contains all data, tables, used benchmark programs, and configurations as well as a ready-to-run version of CPAchecker. Next to a README, the supplementary archive contains the tool CPAchecker ./CPAchecker/ and our experimental results ./results-VABAM-VAparallelBAM/ ./results-VAparallelBAM/ .

The rest of the files are part of a ready-to-run version of CPAchecker, revision 28809.


Results

The results of the evaluation in the paper are available here:

Claim I: Sequential vs. Parallel Algorithm The following quantile plots show the results of BAM with value analysis, sequential version compared to parallel version with one thread.
Fig. 1a: Quantile plot for the results with proofs of BAM with value analysis, sequential version compared to parallel version with one thread
Fig. 1b: Quantile plot for the results with a property violation of BAM with value analysis, sequential version compared to parallel version with one thread
Detailed tables as generated by BenchExec are available here:
Claim II: Scalability of the Parallel Algorithm The following plots show the response time for the verification with different thread numbers, based on a selected benchmark set containing tasks without a property violation.
Fig. 2a: Response time for tasks without a property violation
Fig. 2b: Box plot comparing 1 thread to N threads without a property violation
The following plots show the response time for the verification with different thread numbers, based on a selected benchmark set containing tasks with a property violation.
Fig. 2c: Response time for tasks with a property violation
Fig. 2d: Box plot comparing 1 thread to N threads with a property violation
Detailed tables as generated by BenchExec are available here:
Claim III: Control Variables Influencing the Parallelization The following plots show the results of BAM with value analysis, sequential version compared to parallel version with one thread, based on a selected benchmark set containing tasks without a property violation.
quantile plot
Fig. 3a: Box plot comparing the response time of 1 thread to 8 threads, evaluated on as many processing units as #analysis threads
quantile plot
Fig. 3b: Box plot comparing the response time of 1 thread to 8 threads, evaluated on 8 processing units
The following plots show the results of BAM with value analysis, sequential version compared to parallel version with one thread, based on a selected benchmark set containing tasks with a property violation.
quantile plot
Fig. 3c: Box plot comparing the response time of 1 thread to 8 threads, evaluated on as many processing units as #analysis threads
quantile plot
Fig. 3d: Box plot comparing the response time of 1 thread to 8 threads, evaluated on 8 processing units
Detailed tables as generated by BenchExec are available here:
New Material: Comparison Value Analysis without, with Sequential and with Parallel BAM The following plots show the results of value analysis value analysis without BAM, value analysis with BAM as sequential application and the parallel approach executed on 8 CPU cores, based on a selected benchmark set containing tasks without and with a property violation.
Fig. 4a: Results without a property violation
Fig. 4b: Results with a property violation
Detailed tables as generated by BenchExec are available here:

You can click on the cells in the status columns in these tables to see the output of the corresponding tool. Clicking on the column headings (e.g., “cputime”) will produce a plot with the quantile function of the values of this column. This requires JavaScript in your browser.


How to reproduce the results

In order to reproduce the results, download the supplementary archive (that includes CPAchecker). Our benchmark script assumes the extracted archives for all tools in the same directory than our extracted archive. The evaluation was done on an Ubuntu 16.04 (64 bit).

How to run the benchmark for a set of programs

  1. Run the benchmark script with chosen input file, for example:
    scripts/benchmark.py ../benchmark-definitions/bam-parallel.xml
  2. The results (log files and data) will be placed in the “test/results” directory.