Verifying Qthreads: Is Model Checking Viable for User Level Tasking Runtimes?

'As scale grows and relaxed memory models become common, it is becoming more difficult to establish the correctness of HPC runtimes through simple testing, making formal verification an attractive alternative. This paper describes a formal specification and verification of an HPC user-level tasking runtime through the design, implementation, and evaluation of a model checked implementation of the Qthreads user-level tasking runtime. We implement our model in SPIN model checker by doing a function to function translation of Qthreads'' C implementation to Promela code. This translation bridges the differences in the modeling and implementation languages by translating C''s rich pointer semantics, functions and non-local gotos to Promela''s comparatively simple semantics. We then evaluate our implementation to show that it is both tractable and useful, exhaustively searching the state-space for counterexamples in reasonable time on modern architectures and use it to find a lingering concurrency error in the Qthreads runtime.