Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate...
Transcript of Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate...
![Page 1: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/1.jpg)
![Page 2: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/2.jpg)
![Page 3: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/3.jpg)
![Page 4: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/4.jpg)
![Page 5: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/5.jpg)
![Page 6: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/6.jpg)
![Page 7: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/7.jpg)
![Page 8: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/8.jpg)
![Page 9: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/9.jpg)
![Page 10: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/10.jpg)
Verification framework for GoOverview
Behavioural types
SSA IR
Go source code
(1) Type inference
(2) Modelchecking
(3) Termina-tion checking
Transform and verifyCreate input model
and formula
Pass to termination
prover
Check safety andliveness
Address type andprocess gap
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 11: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/11.jpg)
Concurrency in GoConcurrency primitives
func main() {
ch := make(chan int) // Create channel.
go send(ch) // Spawn as goroutine.
print(<-ch) // Recv from channel.
}
func send(ch chan int) { // Channel as parameter.
ch <- 1 // Send to channel.
}
Send/receive blocks goroutines if channel full/empty resp.
Channel buffer size specified at creation: make(chan int, 1)
Other primitives:
Close a channel close(ch)Guarded choice select { case <-ch:; case <-ch2: }
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 12: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/12.jpg)
Concurrency in GoDeadlock detection
func main() {
ch := make(chan int) // Create channel.
send(ch) // Spawn as goroutine.
print(<-ch) // Recv from channel.
}
func send(ch chan int) { ch <- 1 }
Missing ’go’ keyword
Run program:
$ go run main.go
fatal error: all goroutines are asleep - deadlock!
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 13: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/13.jpg)
Concurrency in GoDeadlock detection
func main() {
ch := make(chan int) // Create channel.
send(ch) // Spawn as goroutine.
print(<-ch) // Recv from channel.
}
func send(ch chan int) { ch <- 1 }
Run program:
$ go run main.go
fatal error: all goroutines are asleep - deadlock!
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 14: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/14.jpg)
Concurrency in GoDeadlock detection
Go has a runtime deadlock detector, panics (crash) if deadlock
Deadlock if all goroutines are blocked
Some packages (e.g. net for networking) disables it
import _ "net" // Load "net" package
func main() {
ch := make(chan int)
send(ch)
print(<-ch)
}
func send(ch chan int) { ch <- 1 }
Deadlock NOT detected
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 15: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/15.jpg)
Concurrency in GoDeadlock detection
Go has a runtime deadlock detector, panics (crash) if deadlock
Deadlock if all goroutines are blocked
Some packages (e.g. net for networking) disables it
import _ "net" // Load "net" package
func main() {
ch := make(chan int)
send(ch)
print(<-ch)
}
func send(ch chan int) { ch <- 1 }
Add benign import
Deadlock NOT detected
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 16: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/16.jpg)
Abstracting Go with Behavioural Types
Type syntax
α := u | u | τT ,S := α;T | T ⊕ S | N{αi ;Ti}i∈I | (T | S) | 0
| (new a)T | close u;T | t〈u〉T := {t(yi ) = Ti}i∈I in S
Types of a CCS-like process calculus
Abstracts Go concurrency primitives
Send/Recv, new (channel), parallel composition (spawn)Go-specific: Close channel, Select (guarded choice)
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 17: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/17.jpg)
Verification framework for Go (1)Type inference by example
func main() {
ch := make(chan int) // Create channel
go sendFn(ch) // Run as goroutine
x := recvVal(ch) // Function call
for i := 0; i < x; i++ {
print(i)
}
close(ch) // Close channel
}
func sendFn(c chan int) { c <- 3 } // Send to c
func recvVal(c chan int) int { return <-c } // Recv from c
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 18: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/18.jpg)
Verification framework for Go (1)Program in Static Single Assignment (SSA) form
package main
t0 = make chan int 0:int
go sendFn(t0)
t1 = recvVal(t0)
jump 3
0
t5 = p h i [0: 0:int , 1: t3] #i
t6 = t5 < t1
i f t6 g o t o 1 e l s e 2
3
t2 = print(t5)
t3 = t5 + 1:int
jump 3
1
t4 = close(t0)
r e t u r n
2
for.loopfor.done
func main.main()entry
return
send c <- 42: int
r e t u r n
0
func main.sendFn(c)entry
return
t0 = <-c
r e t u r n t0
0
func main.recvVal(c)entry
return
Block of instructions
Function boundary
Package boundary
Context-sensitive analysis to distinguish channel variables
Skip over non-communication code
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 19: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/19.jpg)
Verification framework for GoTypes inferred from program
func main() {
ch := make(chan int) // Create channel
go sendFn(ch) // Run as goroutine
x := recvVal(ch) // Function call
for i := 0; i < x; i++ {
print(i)
}
close(ch) // Close channel
}
func sendFn(c chan int) { c <- 3 } // Send to c
func recvVal(c chan int) int { return <-c } // Recv from c
main() = (new t0)(sendFn〈t0〉 | recvVal〈t0〉;main 3〈t0〉)main 1(t0) = main 3〈t0〉main 2(t0) = close t0; 0main 3(t0) = main 1〈t0〉 ⊕main 2〈t0〉sendFn(c) = c ; 0recvVal(c) = c ; 0
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 20: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/20.jpg)
Verification framework for Go (2)Model checking with mCRL2
Generate LTS model and formulae from types
Finite control (no parallel composition in recursion)
Properties (formulae for model checker):
X Global deadlockX Channel safety (no send/close on closed channel)X– Liveness (partial deadlock)X– Eventual reception
Require additional guarantees
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 21: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/21.jpg)
Verification framework for Go (3)Termination checking with KITTeL
Extracted types do not consider data in processType liveness != program liveness
Especially when involving iterationCheck for loop termination
Properties:X Global deadlockX Channel safety (no send/close on closed channel)X Liveness (partial deadlock)X Eventual reception
func main() {ch := make(chan int)go func() {
for i := 0; i < 10; i−− {// Does not terminate
}ch <− 1
}()<−ch
}
Type: Live
Program: NOT live
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 22: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/22.jpg)
Tool demo
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 23: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/23.jpg)
Conclusion
Verification framework based onBehavioural Types
Behavioural types for Go concurrency
Infer types from Go source code
Model check types for safety/liveness
+ termination for iterative Go code
Behavioural types
SSA IR
Go source code
Type inference
Modelchecking
Terminationchecking
Transform and verify
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk
![Page 24: Behavioural Type-Based Static Verification Framework for ... · Model checking with mCRL2 Generate LTS model and formulae from types Finite control (no parallel composition in recursion)](https://reader034.fdocuments.net/reader034/viewer/2022050113/5f4a469097b07b795233b406/html5/thumbnails/24.jpg)
Future work
Extend framework to support more properties
Unlimited possibilities!Different verification techniques
e.g. [POPL’17], Choreography synthesis [CC’15]
Different concurrency issues
Other synchronisation mechanismsRace conditions
Julien Lange, Nicholas Ng, Bernardo Toninho, Nobuko Yoshida
Behavioural Type-Based Static Verification Framework for Gomrg.doc.ic.ac.uk