Simplifying Linearizability Proofs with Reduction and Abstraction

Abstract

The typical proof of linearizability establishes an abstraction map from the concurrent program to a sequential specification, and identifies the commit points of operations. If the concurrent program uses fine-grained concurrency and complex synchronization, constructing such a proof is difficult. We propose a sound proof system that significantly simplifies the reasoning about linearizability. Linearizability is proved by transforming an implementation into its specification within this proof system. The proof system combines reduction and abstraction, which increase the granularity of atomic actions, with variable introduction and hiding, which syntactically relate the representation of the implementation to that of the specification. We construct the abstraction map incrementally, and eliminate the need to reason about the location of commit points in the implementation. We have implemented our method in the QED verifier and demonstrated its effectiveness and practicality on several highly-concurrent examples from the literature.

An integrated specification and verification technique for highly concurrent data structures

“…Related work Much previous work on verification of concurrent programs has concerned the desection of generic concurrency problems, such as race conditions, atomicity violations, or deadlocks [15,23,24]. Verification of conformance to a simple abstract specification has been performed using refinement techniques, which establish simulation relations between the implementation and specification, using partly manual techniques [9,12,13,34]. Amit et al [4] verify linearizability by verifying conformance to an abstract specification, which is the same as the implementation, but restricted to serialized executions.…”

A separation logic for refining concurrent objects

“…The basic form of our calculus clearly bears resemblance to Elmas et al's calculus of atomic actions [5,6]. The key idea in that work is to combine Lipton's technique of reduction [14] for enlarging the grain of atomicity, with abstraction (e.g.…”

“…This paper draws on several ideas from recent work, especially that of Vafeiadis et al [27,28] and Elmas et al [5,6]. We refer the reader to §8 for a detailed discussion of prior work.…”

“…In the last several years, there has been stunning progress in the formal verification of fine-grained concurrent data structures [4,6,9,27], giving logics appropriate for hand verification as well as automated verification. We have sought in this work to clarify and consolidate this literature-the linchpin for us being the connection between ownership, atomicity, and interference.…”

An Integrated Specification and Verification Technique for Highly Concurrent Data Structures

“…Much previous work on verification of concurrent programs has concerned the detection of generic concurrency problems, such as race conditions, atomicity violations, or deadlocks [14,22,23]. Verification of conformance to a simple abstract specification has been performed using refinement techniques, which establish simulation relations between the implementation and specification, using partly manual techniques [11,8,12,33].…”