Julian Erhard,Manuel Bentele,Matthias Heizmann,Dominik Klumpp,Simmo Saan,Frank Schüssele,Michael Schwarz,Helmut Seidl,Sarah Tilscher,Vesal Vojdani
Abstract:Static analyzers are typically complex tools and thus prone to contain bugs themselves. To increase the trust in the verdict of such tools, witnesses encode key reasoning steps underlying the verdict in an exchangeable format, enabling independent validation of the reasoning by other tools. For the correctness of concurrent programs, no agreed-upon witness format exists -- in no small part due to the divide between the semantics considered by analyzers, ranging from interleaving to thread-modular approaches, making it challenging to exchange information. We propose a format that leverages the well-known notion of ghosts to embed the claims a tool makes about a program into a modified program with ghosts, such that the validity of a witness can be decided by analyzing this program. Thus, the validity of witnesses with respect to the interleaving and the thread-modular semantics coincides. Further, thread-modular invariants computed by an abstract interpreter can naturally be expressed in the new format using ghost statements. We evaluate the approach by generating such ghost witnesses for a subset of concurrent programs from the SV-COMP benchmark suite, and pass them to a model checker. It can confirm 75% of these witnesses -- indicating that ghost witnesses can bridge the semantic divide between interleaving and thread-modular approaches.
What problem does this paper attempt to address?
### Problems the paper attempts to solve
This paper aims to solve a key problem in the correctness verification of concurrent programs: **How to establish a unified correctness proof format between different semantic models (such as interleaving semantics and thread - modular semantics)**. Specifically, the author proposes a method based on "ghost variables" to bridge the semantic differences between different static analysis tools, thereby increasing the confidence in the correctness of concurrent programs.
#### Background and motivation
1. **Limitations of static analysis tools**:
- Although static analysis tools can help developers write error - free programs, these tools themselves may have flaws, resulting in unreliable conclusions.
- To increase confidence in the conclusions of static analysis tools, researchers have proposed the concept of "witnesses", that is, key reasoning steps containing static analysis results, so that other tools can independently verify these reasonings.
2. **Complexity of concurrent programs**:
- For the correctness verification of concurrent programs, there is currently no unified witness format. This is mainly because different analysis tools adopt different semantic models, such as interleaving semantics and thread - modular semantics, making information exchange difficult.
#### Proposed solutions
The author proposes a new witness format, embedding the tool's assertions about the program into the modified program by introducing "ghost variables". The core ideas of this method are:
- **Ghost variables**: These are additional variables introduced to simplify the specification and verification of complex program properties. They can encode the progress of other threads, thus correlating the observations of the current thread with its progress.
- **Atomic blocks**: To ensure that the update of ghost variables does not affect the behavior of the original program, the author introduces "atomic blocks", that is, encapsulating multiple operations into an indivisible whole for execution.
#### Main contributions
1. **Unified witness format**: By introducing ghost variables, the author proposes a witness format that is effective under both interleaving semantics and thread - modular semantics.
2. **Verification method**: The author shows how to use a model checker to verify the generated ghost witnesses, and experiments show that 75% of the witnesses can be confirmed to be valid.
3. **Extension of SV - COMP format**: The ghost witness format proposed by the author extends the existing SV - COMP witness format, facilitating adoption by other software verification tools.
Through these improvements, the author hopes to provide a more reliable and trustworthy method in the correctness verification of concurrent programs, thereby increasing the credibility of static analysis tools.