[Paper Review] Partial Orders for Efficient BMC of Concurrent Software

Jade Alglave, Daniel Kroening+1 more|arXiv (Cornell University)|Jan 8, 2013

Formal Methods in Verification50 references3 citations

TL;DR

This paper proposes a partial order-based bounded model checking (BMC) technique for concurrent software that generalizes to weak memory models like x86 and Power, avoiding the combinatorial explosion of interleaved executions. By modeling concurrent executions as partial orders instead of total interleavings, the approach enables scalable, sound, and complete verification of real-world concurrent C programs across multiple memory models, achieving first-time formal verification of non-trivial systems code including Apache, PostgreSQL, and Linux kernel RCU.

ABSTRACT

The vast number of interleavings that a concurrent program can have is typically identified as the root cause of the difficulty of automatic analysis of concurrent software. Weak memory is generally believed to make this problem even harder. We address both issues by modelling programs' executions with partial orders rather than the interleaving semantics (SC). We implemented a software analysis tool based on these ideas. It scales to programs of sufficient size to achieve first-time formal verification of non-trivial concurrent systems code over a wide range of models, including SC, Intel x86 and IBM Power.

Motivation & Objective

• To address the scalability problem in concurrent software verification caused by the exponential number of thread interleavings under Sequential Consistency (SC).
• To overcome the limitations of interleaving-based verification in weak memory models like Intel x86 and IBM Power, which allow more behaviours than SC.
• To enable practical, sound, and complete verification of real concurrent systems code (e.g., Apache, PostgreSQL, Linux kernel) across diverse memory models.
• To support efficient verification of complex concurrency patterns, including store atomicity relaxation on Power and ARM, which are often missed by existing tools.

Proposed method

• Model program executions using partial orders instead of total interleavings, capturing the happens-before and program order relations explicitly.
• Encode each concurrent program as a logical formula with two parts: per-thread control/data flow and concurrent execution constraints via partial orders.
• Use symbolic decision procedures to answer reachability queries over the formula, ensuring soundness and completeness for bounded loops.
• Support multiple memory models (SC, x86, Power) by encoding their axiomatic specifications as constraints in the formula.
• Implement a tool that translates C programs into this logical representation and performs bounded model checking with partial order reduction.
• Leverage clocks from Lamport’s happens-before model to define partial orders without transitive closure, avoiding redundant constraints.

Experimental results

Research questions

• RQ1 Can partial order semantics be used to scale bounded model checking for concurrent C programs across weak memory models?
• RQ2 Does modeling concurrent executions via partial orders reduce the state space explosion problem compared to interleaving-based approaches?
• RQ3 Can a single verification framework handle diverse memory models—including SC, x86, and Power—without sacrificing soundness or completeness?
• RQ4 Is it possible to formally verify complex, real-world concurrent systems code (e.g., Apache, PostgreSQL, Linux kernel) using this approach?
• RQ5 Can the method detect subtle concurrency bugs, such as those involving store atomicity relaxation on Power, that are missed by existing tools?

Key findings

• The tool verified 4,500 litmus tests for weak memory artefacts (e.g., reordering, store buffering, non-atomic stores) across all models in an average of 0.22 seconds, outperforming all other tools.
• The tool successfully verified the Apache HTTP server’s fdqueue module (28,864 lines) in 2.45s on x86 and 2.8s on Power, ensuring data consistency during worker handover.
• The tool confirmed a previously undetected bug in PostgreSQL’s worker synchronization mechanism on Power, which was fixed by adding two fences.
• The tool verified the Linux kernel’s RCU mechanism for x86 and Power (5,824–5,834 lines) in under 1 second, proving data consistency and showing that removing the lwsync fence breaks the invariant.
• The tool scaled to over 300 loop unrollings for the Fibonacci example, 30× more than ESBMC, within the same time budget, demonstrating superior scalability.
• The approach is the first to handle subtle store atomicity relaxation on Power and ARM, which are critical in real hardware but often overlooked in formal verification.