Finding race conditions in Erlang with QuickCheck and PULSE

Stephen J. Hartley Oxford University Press, New York, 1998, 260 pp. ISBN 0-19-511315-2, $45.00 Concurrent Programming is a thorough treatment of Java multi-threaded programming for both a stand-alone and distributed environment. Designed mostly for students in concurrent or parallel programming classes, the text is also an excellent reference for the practicing professional developing multi-threaded programs or applets. Hartley first provides a complete explanation of the features of Java necessary to write concurrent programs, including topics such as exception handling, interfaces, and packages. He then gives the reader a solid background to write multi-threaded programs and also presents the problems introduced when writing concurrent programs—namely race conditions, mutual exclusion, and deadlock. Hartley also provides several software solutions that do not require the use of common process and thread mechanisms. Once the groundwork is laid for writing concurrent programs, Hartley then takes a different approach than most Java references. Rather than presenting how Java handles mutual exclusion with the synchronized keyword (although it is covered later), he first looks at semaphore-based solutions to classic concurrent problems such as bounded-buffer, readers-writers, and the dining philosophers. Hartley also uses the same approach to develop Java classes for monitors and message passing. This unique approach to introducing concurrency allows the readers to both understand how Java threads are synchronized and how the basic synchronization mechanism can be used to construct more abstract tools such as semaphores. If there is a shortcoming with the text it is with the lack of sufficient coverage of remote method invocation (RMI), although there is a section covering RMI. This is quite understandable as RMI is a fairly recent phenomenon with the Java community. Also, the classes that Hartley provides could easily implement RMI rather than sockets to handle communication. The strengths of the book include its ease in reading, several examples at the end of chapters, a package similar to Xtango that provides algorithm animation, and a supportive web site by the author (see www.mcs.drexel.edu/~shartley/ConcProgJava/index.html ) including compressed source code. As Java becomes more dominant on the server side of multi-tier applications, writing thread-safe concurrent applications becomes even more important. Concurrent Programming is a strong step towards teaching students and professionals such skills. Greg Gagne, Westminster College of Salt Lake City Salt Lake City, Utah

Few static analyses support concurrent higher-order programs. Tools for detecting concurrency bugs such as deadlocks and race conditions are nonetheless invaluable to developers. Concurrency can be implemented using a variety of models, each supported by different synchronization primitives. Using this poster, we present an approach for analyzing concurrent higher-order programs in a precise manner through abstract interpretation. We instantiate the approach for two static analyses that are capable of detecting deadlocks and race conditions in programs that rely either on compare-and-swap (cas), or on conventional locks for synchronization. We observe few false positives and false negatives on a corpus of small concurrent programs, with better results for the lock-based analyses. We also observe that these programs lead to a smaller state space to be explored by the analyses. Our results show that the choice of synchronization primitives supported by an abstract interpreter has an important impact on the complexity of the static analyses performed with this abstract interpreter.

The atomic block, a synchronization primitive provided to programmers in transactional memory systems, has the potential to greatly ease the development of concurrent software. However, atomic blocks can still be used incorrectly, and race conditions can still occur at the level of application logic. In this paper, we present a intraprocedural static analysis, formalized as a type system and proven sound, that helps programmers use atomic blocks correctly. Using access permissions, which describe how objects are aliased and modified, our system statically prevents race conditions and enforces typestate properties in concurrent programs. We have implemented a prototype static analysis for the Java language based on our system and have used it to verify several realistic examples.

Despite its widespread use, concurrent programming is still plagued by reliability problems, such as race conditions and deadlock, not found in sequential programs. We present a concurrency framework to help developers avoid these error conditions, and make it possible to verify their absence through static analysis.

Dynamic analysis is a promising technique for finding concurrency bugs in multithreaded programs. However, testing a dynamic analysis tool can be difficult. Researchers end up writing large amounts of small benchmark programs. Since the benchmarks themselves are concurrent programs, they may execute nondeterministically, complicating testing of the analysis tool.We propose testing dynamic analyses by writing traces in a simple trace description language, Tiddle. Our implementation, written in Haskell, generates deterministic multithreaded Java programs for testing dynamic analyses. We report that it is substantially easier to write programs with incriminating bugs such as race conditions in Tiddle than the corresponding Java source code version, reducing the amount of source code to maintain and understand. Although our implementation is targeted towards Java, the ideas extend to any other languages which support mutable fields and multiple threads.

Defects in software cost money and sometimes lives. Even with rigorous testing, there are countless ways for programs to go wrong. Testing does not guarantee that a given program is correct for every input. Concurrent program testing does not guarantee that a program is correct for the example inputs. Formal program verification has been used as a technique to ensure program correctness for several years. It analyses the properties of the code and ensures that nothing goes wrong. In this thesis, a formal verification tool is designed and implemented based on Boogie IVL (Intermediate Verification Language) for a multi-threaded and object-oriented language named HARPO (HARdware Parallel Objects). We have designed the specific annotations intended only for use in verification. These annotations help the HARPO verifier to translate the program into an equivalent Boogie code. The resulting Boogie code is checked with theorem provers to verify the correctness of the HARPO program. Boogie code generation is tested using unit testing, and some of the case studies are reported. Consequently, programmers can use the HARPO verifier for verification of their concurrent programs.

The idea behind Design by Contract (DbC) is that a method defines a contract stating the requirements a client needs to fulfill to use it, the precondition, and the properties it ensures after its execution, the post condition. Though there exists ample support for DbC for sequential programs, applying DbC to concurrent programs presents several challenges. We have proposed a solution to these challenges in the context of Java as programming language and the Java Modeling language as specification language. This paper presents our findings when applying our DbC technique on an industrial case study to evaluate the ability of contract-based, runtime assertion checking code at detecting and diagnosing race conditions and deadlocks during system testing. The case study is a highly concurrent industrial system from the telecommunications domain, with actual faults. It is the first work to systematically investigate the impact of contract assertions for the detection of race conditions and deadlocks, along with functional properties, in an industrial system.

In this talk I discuss the semantics of shared-variable concurrency, aka multi-threading. There are two well-known ways of managing concurrent threads: one either uses a preemptive or a cooperative scheduling discipline. In the former, a program, or more precisely its executable version, can be interrupted at any time during its execution by an external device, the scheduler, and the resources needed for execution are then given to another concurrent component for a while. This is perfect for executing concurrent processes, which do not share memory. In this case, the programmer does not have to care about the relative performance of the various processes in the system: this is the task of the scheduler. Unfortunately, it is very difficult to program multi-threaded applications with this model. The main difficulty is with data races, that is conflicting concurrent accesses to the memory. Although it is very easy to provide a formal “interleaving” semantics for preemptive multi-threading, this semantics usually does not coincide with what is actually implemented. In particular, the grain of atomicity is generally not preserved by the implementation, and a program may be time-sliced at some points of its execution which make no sense at the user level, and the consequence is that there is no clear semantics for the race conditions (see [14] for instance). It is therefore necessary to complement preemptive multi-threading with elaborate synchronization techniques, that require a real expertise from the programmer to be used (see [3]), and to design methods to analyze concurrent programs in order to make them “thread safe”, avoiding or detecting race conditions [1,6,11]. We shall not follow the preemptive approach in our proposal for shared-memory concurrency semantics.KeywordsRecursive CallConcurrent ProgramRealizability InterpretationData RaceConcurrent AccessThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The field of application for distributed algorithms is growing with the ongoing demand for new network applications. Wherever a global goal must be achieved by a number of peers, a distributed algorithm consisting of local computations and communication protocols must be developed. In asynchronous environments the design of a distributed algorithm must respect the fact that processes may vary in speed and that messages might be delayed for an arbitrarily long time. Moreover, it is often required that the algorithm still works in the presence of crash failures, i.e., in scenarios, where some processes stop working at some time. The complex nature of concurrent executions in distributed systems often hinder the application of common methods for modeling and verification. Although many different formal approaches for modeling fault tolerant distributed algorithms, like e.g. I/O automata and process calculi have been proposed, many works in the field of distributed systems use informal pseudo-code representations to introduce new algorithms. On most cases this leads to informal and crude arguments for correctness, which usually become incomprehensible if all race conditions must be taken into account. This work proposes new formal strategies to model and verify distributed algorithms, whereas we focus on two main goals. Firstly, we introduce a means to satisfy a designer’s demands by using methods that are easy to understand and to work with and which are very similar to common applied methods as e.g. TLA and Abstract State Machines. Secondly, our strategies are suitable for the formal use in a theorem proving environment. This enables mechanical verification of our algorithms and therefore, we are able to produce machinechecked proofs for correctness. Our model adopts abstractions from the work of Fuzzati, which examines two similar distributed algorithms in a logical framework. We lifted these abstractions to a more general level to make them suitable and reusable for as many distributed algorithms as possible. Furthermore, we present a new method to place local computation steps in the respective global context. The advantage of our method is that, on the on hand, like with pseudo code, computations can be described as local steps, but, on the other hand, it is possible to formally reason over global system states. Our model for communication mechanisms comprises modules for different kinds of message passing, broadcasts, and shared memory access. We are convinced that our model can easily be extended to support almost all kinds of communication infrastructures that can formally be described. We show how properties that have to be verified can be expressed in terms of our model to enable formal reasoning. Furthermore, we present appropriate strategies to verify different classes of properties. For the theorem proving environment Isabelle/HOL we provide a library which incorporates all introduced abstractions and can, therefore, be reused and extended for further applications, new algorithms, and further verification projects. Finally, we present case studies for the verification of different distributed algorithms to demonstrate the applicability of our strategies. Four known algorithms are verified in our model using our framework for Isabelle/HOL. The algorithms vary in complexity, the used communication infrastructure, the failure model, and other constraints, so that many different modeling and verification aspects are exemplified.

Spin and its immediate predecessors were originally designed for the verification of data communication protocols. It didn’t take long, though, for us to realize that a data communications protocol is just a special case of a general distributed process system, with asynchronously executing and interacting concurrent processes. This covers both multi-threaded software systems with shared memory, and physically distri- buted systems, interacting via network channels.The tool tries to provide a generic capability to prove (or as the case may be, to disprove) the correctness of interactions in complex software systems. This means a reliable and easy-to-use method to discover the types of things that are virtually impossible to detect reliably with traditional software test methods, such as race conditions and deadlocks.As initially primarily a research tool, Spin has been remarkably successful, with well over one million downloads since it was first made available by Bell Labs in 1989. But our goal is te development of a tool that is not only grounded in foundational theory, but also usable by all developers of multi-threaded software, not requiring specialized knowledge of formal methods.In this talk we try to answer the question how close we have come to reach these goals, and where especially we are still lacking. We will see that our understanding has changed of what a verification tool can do – and what it should do.KeywordsSoftware verificationsoftware analysisconcurrencymodel checkingsoftware testingstatic source code analysis

: This final report describes results of the Phase I SBIR research effort to develop new software testing techniques capable of satisfying the demands of distributed real-time software environments. Traditional software testing techniques are inadequate for distribute systems due to such complicating factors as non-deterministic execution, real-time timing constraints, task interaction event sequencing, race conditions, etc. During the course of the Phase I-effort, OTI investigate a wide variety of candidate technique. For each technique, OTI evaluated the feasibility and defined a research and development approach for the technique and required supporting technologies. Detailed comparison-of the attributes of each technique gives the following prioritization of techniques: Deterministic Execution Testing, Timing Analysis, Control Flow Testing, Dependency Analysis, Network Communication Testing, Data Flow Analysis, Problem Tracking Facility, Mutation Analysis, Static Concurrency Testing. OTI's research approach was based on developing new functionality on top of an existing software testing environment to construct the Environment for Test and Analysis of Distributed Software (ETADS). Distributed software testing, Software testing environment, Control flow analysis, Data flow analysis, Timing analysis, Software instrumentation, Non- determinism, Deterministic replay.

Because of the growing importance of concurrent programming, many people are trying to figure out where in the curriculum to introduce students to concurrency. In this paper we discuss the use of concurrency in an introductory computer science course. This course, which has been taught for ten years, introduces concurrency in the context of event-driven programming. It also makes use of graphics and animations with the support of a library that reduces the syntactic overhead of using these constructs. Students learn to use separate threads in a way that enables them to write programs that match their intuitions of the world. While the separate threads do interact, programs are selected so that race conditions are generally not an issue.

Concurrent programming puts demands on software debugging and testing, as concurrent software may exhibit problems not present in sequential software, e.g., deadlocks and race conditions. In aiming to increase efficiency and effectiveness of debugging and bug-fixing for concurrent software, a deep understanding of concurrency bugs, their frequency and fixing-times would be helpful. Similarly, to design effective tools and techniques for testing and debugging concurrent software understanding the differences between non-concurrency and concurrency bugs in real-word software would be useful. This paper presents an empirical study focusing on understanding the differences and similarities between concurrency bugs and other bugs, as well as the differences among various concurrency bug types in terms of their severity and their fixing time. Our basis is a comprehensive analysis of bug reports covering several generations of an open source software system. The analysis involves a total of 4872 bug reports from the last decade, including 221 reports related to concurrency bugs. We found that concurrency bugs are different from other bugs in terms of their fixing time and their severity. Our findings shed light on concurrency bugs and could thereby influence future design and development of concurrent software, their debugging and testing, as well as related tools.

Industry is using more than 30% of the total energy consumed in industrialized countries and manufacturing is one of the most energy-intensive industrial activities. Because of the current global energy crisis, reducing energy consumption in manufacturing has become one of the top research priorities. This paper aims to review the existing technologies that directly improve the energy efficiency in manufacturing plant as well as identify future research opportunities. Four levels to study energy saving technologies are systems, process, equipment, and facility. Two industrial energy monitoring case studies are presented where idle energy is observed to contribute up to 63% of the total energy consumption.

Traditional embedded Real-Time Operating Systems (RTOS) or Basic Software (BSW) implementations typically require manual porting to new hardware platforms. However, this approach can be time-consuming and error-prone, especially given the frequent introduction of new or upgraded hardware architectures. In addition, traditional testing methods may not fully capture the complexity and nuances of the system, making it difficult to ensure correctness and dependability. To address these challenges, we propose a comprehensive methodology that integrates formal methods, a WCET tool, and a code generation technique. We use formal methods to create models and verify their correctness against functional and non-functional specifications or properties such as safety, liveness, and timing. We use the WCET tool as a microarchitecture analyzer to analyze the low-level binary code. The intermediate results of the tool are used to verify the correctness of the software implementation against the runtime effects of the hardware, such as data/memory race conditions. Finally, the code is generated from the formal models. Our proposed framework simplifies the maintenance of RTOS or BSW implementations while ensuring their correctness and partially automating portability to new hardware architectures.