Practical Formal Verification of MPI and Thread Programs Tutorial Notes

This document is being prepared to serve as a reference for the tutorial with the same title that will be offered during EuroPVM/MPI 2009 in Espoo, September 7, 2009. In this tutorial, we will mostly focus on the topic of formal dynamic verification [1] of MPI programs using our tool ISP. There will also be a short session on shared memory program verification using our tool Inspect. Section 4 discusses Inspect/threading; until this section, this document focuses on ISP and MPI dynamic formal verification. In this tutorial document, we assume familiarity with MPI and basic threading concepts. In the EuroPVM/MPI tutorial, we will provide short introductions to MPI and threading. ISP (In-Situ Partial order) is our dynamic formal verification tool for MPI programs. Currently, ISP can verify MPI C programs (Fortran porting is underway), and employs available standard MPI libraries to provide the semantics of MPI calls. So far, ISP has been tested successfully using the MPI libraries MPICH2, OpenMPI, and Microsoft MPI. To a lesser extent, ISP has also been tested using MVAPICH and IBM MPI. ISP has been successfully run on the Linux, Mac OS/X, and Windows operating systems. As to graphical user interfaces, ISP has two of them, one created using Visual Studio and the other using Eclipse. This document is written without specific references to the particular high level language, MPI library, operating system, or GUI used by ISP. It is meant to cover the basic principles underlying all these versions of ISP. Specific details pertaining to these platforms, including user manuals, are available on the ISP website. With these preliminaries out of the way, we are now ready to present the heart of ISP – namely, its central algorithm POE (Partial Order avoiding Elusive interleavings). We name the algorithm employed by ISP separately because in future we plan to have other algorithms in lieu of POE (the tool name is expected to remain ISP). Let us study POE using the example executions shown in Figure 1. In the pseudo-code presented in this figure, we have suppressed details of the data shipped by the communication commands, as well as computation oriented statements that would typically be employed between MPI calls. Also we employ * to highlight wildcard receive.