Verification of MPI-based Computations

Mpi-Spin [1, 2] is an extension to the model checker Spin [3, 4] for verifying correctness of MPI-based parallel and distributed algorithms. It adds to Spin’s input language a number of types, constants, and functions corresponding to primitives in the MPI Standard [5]. The semantics of these added primitives are defined using an abstract model of a generic MPI implementation which encodes all possible behaviors permitted by the Standard. Thus Mpi-Spin can verify that an algorithm will behave correctly on any (correct) MPI platform. By default, Mpi-Spin will check for a number of standard defects in MPIbased algorithms: deadlocks, failure to wait for the completion of communication requests before finalization, attempts to access buffers used in active communication operations, out-of-order invocations of collective functions, and so on. It can also be used to verify the functional correctness of an algorithm—that an algorithm will always produce the correct result on any given input [6]. Functional correctness is specified by providing a sequential version of the algorithm which is presumed to be correct. The problem is then reduced to verifying that the parallel and sequential versions are functionally equivalent. This is accomplished using symbolic execution [7]: the inputs to the algorithms are modeled using symbolic constants Xi and the outputs are expressed as symbolic expressions in the Xi. Nondeterministic choice is used to model branches and the branch decision is recorded in a symbolic path condition variable pc. A simple decision procedure can detect that pc becomes unsatisfiable, at which point the search backtracks. To compare the two versions, a composite model is constructed in which pc is initialized to true, the sequential model is executed, and then the parallel model is executed with the value of pc resulting from the sequential execution. Finally, an assertion is used to check that the symbolic results from the two versions coincide. A depth-first search of the state space of the composite model will explore all possible executions of the sequential version, each of which results in a path condition-symbolic output pair. For each of these pairs, all possible executions of the parallel version consistent with pc are explored, and the outputs are compared. Thus the path condition is used to “match up” executions of the two versions on the same inputs domains. The notion of equivalence depends upon the semantics one associates to the numerical operations. Successively weaker notions of equivalence supported by Mpi-Spin are Herbrand (operations are treated as uninterpreted functions),