Model checking transactional memories

Abstract

Model checking software transactional memories (STMs) is difficult because of the unbounded number, length, and delay of concurrent transactions and the unbounded size of the memory. We show that, under certain conditions, the verification problem can be reduced to a finite-state problem, and we illustrate the use of the method by proving the correctness of several STMs, including two-phase locking, DSTM, TL2, and optimistic concurrency control. The safety properties we consider include strict serializability and opacity; the liveness properties include obstruction freedom, livelock freedom, and wait freedom.Our main contribution lies in the structure of the proofs, which are largely automated and not restricted to the STMs mentioned above. In a first step we show that every STM that enjoys certain structural properties either violates a safety or liveness requirement on some program with two threads and two shared variables, or satisfies the requirement on all programs. In the second step we use a model checker to prove the requirement for the STM applied to a most general program with two threads and two variables. In the safety case, the model checker constructs a simulation relation between two carefully constructed finite-state transition systems, one representing the given STM applied to a most general program, and the other representing a most liberal safe STM applied to the same program. In the liveness case, the model checker analyzes fairness conditions on the given STM transition system.

Mechanized proofs of opacity: a comparison of two techniques

“…Although there are several works comparing and contrasting different correctness conditions for STM (including opacity) (e.g., [DGLM13,LLM12b,AGHR14]), there only a handful of papers that consider verification of the STM implementations themselves. A model checking approach is presented in [GHS10], however, the technique only considers conflicts between read and write operations in different transactions. More recently, Lesani has considered opacity verification of numerous algorithms [Les14], which includes techniques for reducing the problem of proving opacity into one of verifying a number of simpler invariants on the orders of events [LP14].…”

“…Model checking (e.g., [COP + 07]) is generally not suitable for our aims of rigorously verifying algorithms against all possible executions. One promising approach is by Guerraoui et al [GHS08,GHS10], who present a method for model checking opacity using a reduction theorem that lifts opacity (for two threads and two variables) to opacity (for an arbitrary number of processes and variables). However, their specifications do not consider the values that are read/written, and hence, the link to the definition of opacity in [GK10], which requires a memory semantics is unclear.…”

On the Complexity of Checking Consistency for Replicated Data Types

“…While Bouajjani et al [5,14] consider the complexity for individual linearizable collection types, we are the first to establish (in)tractability of individual replicated data types. Others have developed effective consistency checking algorithms for sequential consistency [3,9,23,31], serializability [12,17,18,21], linearizability [10,16,28,37], and even weaker notions like eventual consistency [7] and sequential happens-before consistency [13,15]. In contrast, we are the first to establish precise polynomial-time algorithms for runtime verification of replicated data types.…”

State space reduction in modeling checking parameterized cache coherence protocol by two-dimensional abstraction

“…snps(3) = prop 1 (3) ∧ prop 2 (3). Table 1 demonstrates the result of the state space of PS y (3) partitioned by snps (2). The first column lists the sets of equivalence class, while the second is the label of each equivalence class and its bit vector expression is shown in the last column.…”

“…Model checking is an automatic technique for verifying finite state concurrent systems, which uses a finite state machine to describe the system under consideration and temporal logic to state the properties that the system must satisfy. This method has been used successfully in practice to verify complex software and hardware systems [1,2]. However, efficient verification of parameterized cache coherence protocols is one of the most challenging problems in verification domain today.…”