Abstract: Techniques for providing a fair stateless model checker are disclosed. In some aspects, a schedule is generated to allocate resources for threads of a multi-thread program in lieu of having an operating system allocate resources for the threads. The generated schedule is both fair and exhaustive. In an embodiment, a priority graph may be implemented to reschedule a thread when a different thread is determined not to be making progress. A model checker may then implement one of the generated schedules in the program in order to determine if a bug or a livelock occurs during the particular execution of the program. An output by the model checker may facilitate identifying bugs and/or livelocks, or authenticate a program as operating correctly.

Abstract: Procedure summaries can be generated and used for multithreaded software. A set of actions for a software procedure can be identified as atomically modelable with respect to multithreaded execution of the software. Such actions can be considered a transaction and deemed to have occurred one after another without interruption by other threads. Thus, multithreaded execution of the software can be modeled to detect programming flaws. For example, reachability analysis can be used in concert with the procedure summaries to determine if specified invariants fail.

Abstract: The state space of modeled software can be explored using an object-based systematic state explorer. The object-based model can perform well even in light of the complexities of concurrent software. During state space exploration, differences between states can be stored instead of storing a complete copy of the state.

Abstract: Testing multithreaded application programs for errors can be carried out in an efficient and productive manner at least in part by prioritizing thread schedules based on numbers of context switches between threads therein. In particular, each thread schedule in a multithreaded application program can be prioritized based on whether a given thread schedule has the same as or less than some maximum value. A model checker module can then iteratively execute thread schedules that fit within a given context switch maximum value, or a progressively higher value up to some limit. In one implementation, for example, the model checker module executes all thread schedules that have zero preempting context switches, then all thread schedules that have only one preempting context switch, etc. Most errors in an application program can be identified by executing only those thread schedule with relatively few preempting context switches.

Abstract: A concurrent program is analyzed for the presence of data races by the creation of a sequential program from the concurrent program. The sequential program contains assertions which can be verified by a sequential program analysis tool, and which, when violated, indicate the presence of a data race. The sequential program emulates multiple executions of the concurrent program by nondeterministically scheduling asynchronous threads of the concurrent program on a single runtime stack and nondeterministically removing the currently-executing thread from the stack before instructions of the program. Checking functions are used to provide assertions for data races, along with a global access variable, which indicates if a variable being analyzed for data races is currently being accessed by any threads.

Abstract: A data race detection system is described which precisely identifies data races in concurrent programs. The system and techniques described utilize locksets to maintain information while searching through executions of a concurrent program. The locksets are updated according to program statements in the concurrent program. The dynamic updating of the locksets, combined with a less conservative approach then used in existing lockset data race detection techniques, allows the technique to be precise; that is, the technique does not report false positives when searching a program.

Abstract: Described techniques and tools facilitate model checking for program models that effectively model pointer behavior while avoiding complexity in the model itself, thereby allowing rigorous and accurate testing of the model. A model checking algorithm for deciding assertions in programs with references terminates and yields precise results even on programs that allocate an unbounded amount of memory.

Abstract: Described techniques and tools help model checking scale to large programs while reducing missed errors. In particular, described techniques and tools help reduce the state space of concurrent programs without depending on cycle detection and without scheduling execution of postponed threads at all cycles. For example, described techniques and tools use a type of partial-order reduction called transaction-based reduction to reduce program state space. Analysis is performed at commit points to determine whether to schedule delayed threads.

Abstract: Validity of one or more assertions for any concurrent execution of a plurality of software instructions with at most k?1 context switches can be determined. Validity checking can account for execution of the software instructions in an unbounded stack depth scenario. A finite data domain representation can be used. The software instructions can be represented by a pushdown system. Validity checking can account for thread creation during execution of the plurality of software instructions.

Abstract: A concurrent program is analyzed for the presence of data races by the creation of a sequential program from the concurrent program. The sequential program contains assertions which can be verified by a sequential program analysis tool, and which, when violated, indicate the presence of a data race. The sequential program emulates multiple executions of the concurrent program by nondeterministically scheduling asynchronous threads of the concurrent program on a single runtime stack and nondeterministically removing the currently-executing thread from the stack before instructions of the program. Checking functions are used to provide assertions for data races, along with a global access variable, which indicates if a variable being analyzed for data races is currently being accessed by any threads.

Abstract: A method of verifying a protocol for a shared-memory multiprocessor system for sequential consistency. In the system there are n processors and m memory locations that are shared by the processors. A protocol automaton, such as a cache coherence protocol automaton, is developed. The protocol automaton and a plurality of checker automata are provided to a model checker which exhaustively searches the state space of the protocol automaton. During the search, the plurality of checker automata check for the presence of cycles in a graph that is the union of the total orders of the processor references and the partial orders at each memory location. If the plurality of checker automata detect the presence of a cycle, then the protocol does not meet the sequential consistency requirement.

Abstract: The state space of modeled software can be explored using an object-based systematic state explorer. The object-based model can perform well even in light of the complexities of concurrent software. During state space exploration, differences between states can be stored instead of storing a complete copy of the state.

Abstract: A method of verifying a protocol for a shared-memory multiprocessor system for sequential consistency. In the system there are n processors and m memory locations that are shared by the processors. A protocol automaton, such as a cache coherence protocol automaton, is developed. The protocol automaton and a plurality of checker automata are provided to a model checker which exhaustively searches the state space of the protocol automaton. During the search, the plurality of checker automata check for the presence of cycles in a graph that is the union of the total orders of the processor references and the partial orders at each memory location. If the plurality of checker automata detect the presence of a cycle, then the protocol does not meet the sequential consistency requirement.