Formal verification of PBXT locking code, my experience with verification tools
In the last few months we’ve got couple of bugs with the PBXT read/write locking code. One of the problems was directly in the lock/grant algorithm. It was strange to find such kind of error after quite long time of various testing and real-life usage. From the point of view of QA it was clear that manual code review was not efficient in this case.
Given all this I decided to try formal verification of the code. The specifics of the PBXT locking code is that it’s relatively small (about 100 LOC) but quite complex. The algorithm itself is not that trivial but the major source of complexity is concurrent execution of its parts. So if I had to manually create a finite state table for it then it would be essentially a cartesian product of states of all concurrent threads. In numbers that is if there is about 20-30 states per thread and there are 3 threads (empirically I estimated that threads beyond 3 don’t add more states) then I would get between 8000 and 27000 of states to check - quite a bit of work to do on a piece of paper (and a very good example of multithread complexity).
So I decided to try a verification tool. After some evaluation I picked SPIN. Verification with SPIN bascially consists of 2 steps: 1) build SPIN model 2) run verification and/or simulation.
I built 2 models - the buggy one and (presumably) fixed one. The buggy version triggered an assertion after a second of simulation (compare that to months of C code testing!) while the fixed one successfully passed both simulation and verfication.
Does this mean the code is bug-free? The answer is - the SPIN model is bug free. But given that it fairly close resembles the code chances are very high that the code is bug-free as well. Knowing this will save us some debugging time in future.
This was my first practical experience with formal verification. If you use formal verification in your work then please let me know which tools do you use, what kind of code do you check, general considerations, etc…
Thanks

