Model checking unbounded concurrent lists

  • Divjyot SethiEmail author
  • Muralidhar Talupur
  • Sharad Malik
SPIN 2013


We present a model checking-based method for verifying list-based concurrent set data structures. Concurrent data structures are notorious for being hard to get right and thus, their verification has received significant attention from the verification community. These data structures are unbounded in two dimensions: the list size is unbounded and an unbounded number of threads access them. Thus, their model checking requires abstraction to a model bounded in both the dimensions. We first show how the unbounded number of threads can be model checked by reduction to a finite model, while assuming a bounded number of list nodes. In particular, we leverage the CMP (CoMPositional) method which abstracts the unbounded threads by keeping one thread as is (concrete) and abstracting all the other threads to a single environment thread. Next, the method proceeds as a series of iterations where in each iteration the abstraction is model checked and, if a spurious counterexample is observed, refined. This is accomplished by the user by inspecting the returned counterexamples. If the user determines the returned counterexample to be spurious, she adds constraints to the abstraction in the form of lemmas to refine it. Upon addition, these lemmas are also verified for correctness as part of the CMP method. Thus, since these lemmas are verified as well, we show how some of the lemmas required for refinement of this abstract model can be mined automatically using an assertion mining tool, Daikon. Next, we show how the CMP method approach can be extended to the list dimension as well, to fully verify the data structures in both the dimensions. While it is possible to show correctness of these data structures for an unbounded number of threads by keeping one concrete thread and abstracting others, this is not directly possible in the list dimension as the nodes pointed to by the threads change during list traversal. Our method addresses this challenge by constructing an abstraction for which the concrete nodes, i.e., the nodes pointed to by the threads, can change as the thread pointers move with program execution. Further, our method also allows for refinement of this abstraction to prove properties of interest. We show the soundness of our method and establish its utility by model checking challenging concurrent list-based data structure examples.


Model checking Linearizability Concurrent data structures Compositional reasoning Abstractions 


  1. 1.
    Berdine, J., Lev-Ami, T., Manevich, R., Ramalingam, G., Sagiv, M.: Thread quantification for concurrent shape analysis. In: Proceedings of CAV ’08, pp. 399–413. Springer, Berlin (2008)Google Scholar
  2. 2.
    Burckhardt, S., Dern, C., Musuvathi, M., Tan, R.: Line-up: a complete and automatic linearizability checker. In: Proceedings of the 2010 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI ’10, pp. 330–340. ACM, New York, NY, USA (2010)Google Scholar
  3. 3.
    Calcagno, C., Parkinson, M., Vafeiadis, V.: Modular safety checking for fine-grained concurrency. In: Static Analysis, pp. 233–248. Springer, Berlin, Heidelberg (2007)Google Scholar
  4. 4.
    Cerný, P., Radhakrishna, A., Zufferey, D., Chaudhuri, S., Alur, R.: Model checking of linearizability of concurrent list implementations. In: Proceedings of Computer Aided Verification, pp. 465–479 (2010)Google Scholar
  5. 5.
    Chou, C.T., Mannava, P.K., Park, S.: A simple method for parameterized verification of cache coherence protocols. In: Proceedings of FMCAD (2004)Google Scholar
  6. 6.
    Colvin, R., Groves, L., Luchangco, V., Moir, M.: Formal verification of a lazy concurrent list-based set algorithm. In: Computer Aided Verification, pp. 475–488. Springer, Berlin, Heidelberg (2006)Google Scholar
  7. 7.
    Das, S., Dill, D.L., Park, S.: Experience with predicate abstraction. In: Computer Aided Verification. pp. 160–171. Springer, Berlin, Heidelberg (1999)Google Scholar
  8. 8.
    Dinsdale-Young, T., Dodds, M., Gardner, P., Parkinson, M.J., Vafeiadis, V.: Concurrent abstract predicates. In: Proceedings of the 24th European Conference on Object-Oriented Programming. ECOOP’10, pp. 504–528. Springer, Berlin (2010)Google Scholar
  9. 9.
    Ernst, M.D., Perkins, J.H., Guo, P.J., McCamant, S., Pacheco, C., Tschantz, M.S., Xiao, C.: The Daikon system for dynamic detection of likely invariants. Sci. Comput. Progr. 69(1–3), 35–45 (2007)MathSciNetCrossRefzbMATHGoogle Scholar
  10. 10.
    Gotsman, A., Berdine, J., Cook, B., Sagiv, M.: Thread-modular shape analysis. SIGPLAN Not. 42(6), 266–277 (2007)CrossRefGoogle Scholar
  11. 11.
    Herlihy, M., Shavit, N.: The Art of Multiprocessor Programming. Morgan Kaufmann Publishers Inc., San Francisco (2008)Google Scholar
  12. 12.
    Herlihy, M.P., Wing, J.M.: Linearizability: a correctness condition for concurrent objects. ACM Trans. Program. Lang. Syst. 12, 463–492 (1990)CrossRefGoogle Scholar
  13. 13.
    Jacobs, B., Piessens, F.: Expressive modular fine-grained concurrency specification. In: Proceedings of the 38th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL ’11, pp. 271–282. ACM, New York (2011)Google Scholar
  14. 14.
    Kristic, S.: Parameterized system verification with guard strengthening and parameter abstraction. In: Proceedings of 4th International Workshop on Automatic Verification of Finite State Systems (2005)Google Scholar
  15. 15.
    Lahiri, S.K., Bryant, R.E.: Predicate abstraction with indexed predicates. ACM Trans. Comput. Logic (TOCL) 9(1) (2007)Google Scholar
  16. 16.
    Lea, D.: The java.util.concurrent synchronizer framework. Sci. Comput. Program. 58, 293–309 (2005).
  17. 17.
    Liu, Y., Chen, W., Liu, Y.A., Sun, J.: Model checking linearizability via refinement. In: Proceedings of FM ’09, pp. 321–337. Springer, Berlin (2009)Google Scholar
  18. 18.
    McMillan, K.L.: Verification of infinite state systems by compositional model checking. In: Proceedings of CHARME ’99, pp. 219–234. Springer, London (1999)Google Scholar
  19. 19.
    Michael, M.M., Scott, M.L.: Correction of a memory management method for lock-free data structures. No. TR-599. University of Rochester, Computer Science Department (1995)Google Scholar
  20. 20.
    Noll, T., Rieger, S.: Verifying dynamic pointer-manipulating threads. In: Proceedings of the 15th International Symposium on Formal Methods, FM ’08, pp. 84–99. Springer, Berlin (2008)Google Scholar
  21. 21.
    O’Leary, J., Talupur, M., Tuttle, M.: Protocol verification using flows: An industrial experience. In: Proeedings of Formal Methods in Computer-Aided Design, FMCAD 2009, pp. 172–179 (2009)Google Scholar
  22. 22.
    Pnueli, A., Ruah, S., Zuck, L.D.: Automatic deductive verification with invisible invariants, TACAS 2001, pp. 82–97. Springer, London (2001)Google Scholar
  23. 23.
    Pnueli, A., Xu, J., Zuck, L.D.: Liveness with (0, 1, infty)-counter abstraction. In: Proceedings of the 14th International Conference on Computer Aided Verification, CAV ’02, pp. 107–122. Springer London (2002)Google Scholar
  24. 24.
    Reinders, J.: Intel Threading Building Blocks, 1st edn. O’Reilly & Associates Inc, Sebastopol (2007)Google Scholar
  25. 25.
    Sagiv, M., Reps, T., Wilhelm, R.: Parametric shape analysis via 3-valued logic. In: Proceedings of the 26th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL ’99, pp. 105–118. ACM, New York (1999)Google Scholar
  26. 26.
    Sethi, D., Talupur, M., Schwartz-Narbonne, D., Malik, S.: Parameterized model checking of fine grained concurrency. In: Proceedings of 19th International SPIN Workshop on Model Checking of Software (2012)Google Scholar
  27. 27.
    Talupur, M., Tuttle, M.: Going with the flow: Parameterized verification using message flows. In: Proceedings of Formal Methods in Computer-Aided Design, FMCAD ’08, pp. 1–8 (2008)Google Scholar
  28. 28.
    Vafeiadis, V.: Shape-value abstraction for verifying linearizability, VMCAI ’09, pp. 335–348. Springer, Berlin (2009)Google Scholar
  29. 29.
    Vafeiadis, V.: Automatically proving linearizability. In: Proceedings of Computer Aided Verification, pp. 450–464 (2010)Google Scholar
  30. 30.
    Vafeiadis, V., Herlihy, M., Hoare, T., Shapiro, M.: Proving correctness of highly-concurrent linearisable objects. In: Proceedings of PPoPP ’06, pp. 129–136. ACM, New York (2006)Google Scholar
  31. 31.
    Vechev, M., Yahav, E., Yorsh, G.: Experience with model checking linearizability. In: Proceedings of the 16th International SPIN Workshop on Model Checking Software, pp. 261–278. Springer, Berlin (2009)Google Scholar
  32. 32.
    Yahav, E.: Verifying safety properties of concurrent java programs using 3-valued logic. In: Proceedings of the 28th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL ’01, pp. 27–40. ACM, New York (2001)Google Scholar
  33. 33.
    Zhang, S.J.: Scalable automatic linearizability checking. In: Proceedings of the 33rd International Conference on Software Engineering, ICSE ’11, pp. 1185–1187. ACM, New York (2011)Google Scholar
  34. 34.
    Zhang, S.J., Liu, Y.: Model checking a lazy concurrent list-based set algorithm. In: Proceedings of the 2010 Fourth International Conference on Secure Software Integration and Reliability Improvement, SSIRI ’10, pp. 43–52. IEEE Computer Society, Washington DC (2010)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2015

Authors and Affiliations

  • Divjyot Sethi
    • 1
    Email author
  • Muralidhar Talupur
    • 2
  • Sharad Malik
    • 1
  1. 1.Princeton UniversityPrincetonUSA
  2. 2.Strategic CAD Labs, Intel CorporationHillsboroUSA

Personalised recommendations