Many novel programming models for concurrency have been proposed in the wake of the multicore computing paradigm shift. These models aim to raise the level of abstraction for expressing concurrency and synchronization in a program, thereby helping programmers avoid programming errors. This goal, however, causes the semantics of the models to become ever more complex and increases the risk of design flaws. Such flaws can have costly consequences if they are discovered after compiler and runtime support has been developed. It is therefore beneficial to verify the models beforehand. This thesis proposes to prototype concurrency models using executable formal specifications. The prototype is useful from the beginning to the end of a model development. Initially, developers can use the prototype to test and correct the core of the model. As the development continues, developers can expand the prototype iteratively. For each extension, they enhance the specification, test the extension against the rest of the model, and apply corrections where necessary. Once the development is completed, the prototype serves as a reference. This thesis applies the prototyping method to SCOOP, an object-oriented concurrency model. It demonstrates how the method facilitates the process of finding and resolving flaws in SCOOP and two extensions. In particular, it applies the method to extend SCOOP with (1) an exception mechanism to handle exceptions resulting from asynchronous calls and (2) a mechanism for fast and safe data sharing, reducing execution time by several orders of magnitude on data-intensive parallel programs. This effort results in 16 clarifications across various aspects, all included in a comprehensive executable formal specification in Maude. This thesis also presents new SCOOP-specific performance metrics and a technique to compute them from event traces. Having a verified concurrency model does not guarantee that programmers write efficient concurrent programs. It is hence necessary to provide performance analysis tools that assist programmers in their task. Since SCOOP differs considerably from established models, reusing existing performance metrics is not an option. Instead, the new metrics are specifically designed for SCOOP. A case study on optimizing a robot control software iii iv Abstract demonstrates the usefulness of these metrics. As a result of this thesis, SCOOP has an executable formal specification for future SCOOP developers, new mechanisms for exception handling and data sharing, as well as SCOOP-specific performance metrics. Having demonstrated the benefits of the method on an extensive concurrency model, we believe that the method can also benefit other models-new or mature.

Abstract. Network objects are a simple and natural abstraction for distributed object-oriented programming. Languages that support network objects, however, often leave synchronization to the user, along with its associated pitfalls, such as data races and the possibility of failure. In this paper, we present D-SCOOP, a distributed programming model that allows for interference-free and transactionlike reasoning on (potentially multiple) network objects, with synchronization handled automatically, and network failures managed by a compensation mechanism. We achieve this by leveraging the runtime semantics of a multi-threaded object-oriented concurrency model, directly generalizing it with a message-based protocol for efficiently coordinating remote objects. We present our pathway to fusing these contrasting but complementary ideas, and evaluate the performance overhead of the automatic synchronization in D-SCOOP, finding that it comes close to-or outperforms-explicit locking-based synchronization in Java RMI.

Programming models for concurrency are optimized for dealing with nondeterminism, for example to handle asynchronously arriving events. To shield the developer from data race errors effectively, such models may prevent shared access to data altogether. However, this restriction also makes them unsuitable for applications that require data parallelism. We present a library-based approach for permitting parallel access to arrays while preserving the safety guarantees of the original model. When applied to SCOOP, an object-oriented concurrency model, the approach exhibits a negligible performance overhead compared to ordinary threaded implementations of two parallel benchmark programs.Comment: MUSEPAT 201

In shared-memory concurrent programming, shared resources can be protected using synchronization mechanisms such as monitors or channels. The connection between these mechanisms and the resources they protect is, however, only given implicitly; this makes it difficult both for programmers to apply the mechanisms correctly and for compilers to check that resources are properly protected. This paper presents a mechanism to automatically check that shared memory is accessed properly, using a methodology called shared ownership. In contrast to traditional ownership, shared ownership offers more flexibility by permitting multiple owners of a resource. On the basis of this methodology, we define an abstract model of resource access that provides operations to manage data dependencies, as well as sharing and transfer of access privileges. The model is rigorously defined using a formal semantics, and shown to be free from data races. This property can be used to detect unsafe memory accesses when simulating the model together with the execution of a program. The expressiveness and efficiency of the approach is demonstrated on a variety of programs using common synchronization mechanisms.

No abstract