Parallel and distributed model checking in Eddy

  • I. MelattiEmail author
  • R. Palmer
  • G. Sawaya
  • Y. Yang
  • R. M. Kirby
  • G. Gopalakrishnan


Model checking of safety properties can be scaled up by pooling the CPU and memory resources of multiple computers. As compute clusters containing 100s of nodes, with each node realized using multi-core (e.g., 2) CPUs will be widespread, a model checker based on the parallel (shared memory) and distributed (message passing) paradigms will more efficiently use the hardware resources. Such a model checker can be designed by having each node employ two shared memory threads that run on the (typically) two CPUs of a node, with one thread responsible for state generation, and the other for efficient communication, including (1) performing overlapped asynchronous message passing, and (2) aggregating the states to be sent into larger chunks in order to improve communication network utilization. We present the design details of such a novel model checking architecture called Eddy. We describe the design rationale, details of how the threads interact and yield control, exchange messages, as well as detect termination. We have realized an instance of this architecture for the Murphi modeling language. Called Eddy_Murphi, we report its performance over the number of nodes as well as communication parameters such as those controlling state aggregation. Nearly linear reduction of compute time with increasing number of nodes is observed. Our thread task partition is done in such a way that it is modular, easy to port across different modeling languages, and easy to tune across a variety of platforms.


Model Check Shared Memory Hash Table Message Passing Work Thread 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Stern, U., Dill, D.: Parallelizing the Mur\({\phi}\) verifier. Form Methods Sys Des 18(2), 117–129 (2001) (Journal version of their CAV 1997 paper)Google Scholar
  2. 2.
    Lerda, F., Sisto, R.: Distributed-memory model checking with SPIN. In: Proceedings of SPIN 1999, Lecture Notes in Computer Science, vol. 1680. Springer, Heidelberg (1999)Google Scholar
  3. 3.
    Dill, D.L.: The mur phi verification system. In: Proceedings of CAV 1996, Lecture Notes in Computer Science, vol. 1102, pp. 390–393. Springer, Heidelberg (1996)Google Scholar
  4. 4.
    Butenhof D.R.: Programming with POSIX Threads. Addison-Wesley, Reading (1997)Google Scholar
  5. 5.
  6. 6.
  7. 7.
    PThreads Win32 home page
  8. 8.
  9. 9.
    Palmer, R., Gopalakrishnan, G.: Refactoring spin for safety. Technical report, University of Utah, July 2005Google Scholar
  10. 10.
    Della Penna G., Intrigila B., Melatti I., Tronci E., Venturini Zilli M.: Exploiting transition locality in automatic verification of finite state concurrent systems. Softw Tools Technol Transf 6(4), 320–341 (2004)CrossRefGoogle Scholar
  11. 11.
  12. 12.
    Grumberg, O., Heyman, T., Ifergan, N., Schuster, A.: Achieving speedups in distributed symbolic reachability analysis through asynchronous computation. In: Proceedings of CHARME 2005, Lecture Notes in Computer Science, vol. 3725, pp. 129–145. Springer, Heidelberg (2005)Google Scholar
  13. 13.
    Feldman, Y., Dershowitz, N., Hanna, Z.: Parallel multithreaded satisfiability solver: design and implementation. In: Proceedings of PDMC 2004, Electronic Notes in Theoretical Computer Science, vol. 128(3), pp. 75–90. Elsevier, Amsterdam (2005)Google Scholar
  14. 14.
    Kumar, R., Mercer, E.: Scalable distributed model checking: experiences, lessons, and expectations. In: Proceedings of PDMC 2003, Electronic Notes in Theoretical Computer Science, vol. 89(1), p. 3. Elsevier, Amsterdam (2003)Google Scholar
  15. 15.
    Stern, U., Dill, D.L.: Automatic verification of the sci cache coherence protocol. In: Proceedings of CHARME 1995, Lecture Notes in Computer Science, vol. 987, pp. 21–34. Springer, Heidelberg (1995)Google Scholar
  16. 16.
    Sivaraj, H., Gopalakrishnan, G.: Random walk based heuristic algorithms for distributed memory model checking. In: Proceedings of PDMC 2003, Electronic Notes in Theoretical Computer Science, vol. 89(1), pp. 51–67. Elsevier, Amsredam (2003)Google Scholar
  17. 17.
    Kumar, R., Mercer, E.: Load balancing parallel explicit state model checking. In: Proceedings. of PDMC 2004, Electronic Notes in Theoretical Computer Science, vol. 128 (3), pp. 19–34. Elsevier (2004)Google Scholar
  18. 18.
    Andrews, T., Qadeer, S., Rajamani, S.K., Rehof, J., Xie, Y.: Zing: A model checker for concurrent software. Technical report, Microsoft Research (2004)Google Scholar
  19. 19.
    Gropp, W., Lusk, E., Skjellum, A.: Using MPI: Portable Parallel Programming with the Message-Passing Interface. MIT Press (1999)Google Scholar
  20. 20.
    MPI official specification
  21. 21.
  22. 22.
    Stern, U., Dill, D.: Parallelizing the murφ verifier. In: Grumberg, O. (ed.) Proceedings. of CAV 1997, Lecture Notes in Computer Science, vol. 1254, pp. 256–278. Springer (1997)Google Scholar
  23. 23.
    Kuskin, J., Ofelt, D. et al.: The Stanford FLASH multiprocessor. In: Proceedings. of SIGARCH 1994, pp. 302–313, May 1994Google Scholar
  24. 24.
    Holzmann G.J., Puri A.: A minimized automaton representation of reachable states. Software Tools for Technology Transfer 3(1), 270–278 (1998)Google Scholar

Copyright information

© Springer-Verlag 2008

Authors and Affiliations

  • I. Melatti
    • 1
    Email author
  • R. Palmer
    • 1
  • G. Sawaya
    • 1
  • Y. Yang
    • 1
  • R. M. Kirby
    • 1
  • G. Gopalakrishnan
    • 1
  1. 1.School of ComputingUniversity of UtahSalt Lake CityUSA

Personalised recommendations