Verifying a quantitative relaxation of linearizability via refinement

Abstract

Concurrent data structures have found increasingly widespread use in both multicore and distributed computing environments, thereby escalating the priority for verifying their correctness. The thread safe behavior of these concurrent objects is often described using formal semantics known as linearizability, which requires that every operation in a concurrent object appears to take effect between its invocation and response. Quasi linearizability is a quantitative relaxation of linearizability to allow more implementation freedom for performance optimization. However, ensuring the quantitative aspects of this new correctness condition is an arduous task. We propose the first method for formally verifying quasi linearizability of the implementation model of a concurrent data structure. The method is based on checking the refinement relation between the implementation model and a specification model via explicit state model checking. It can directly handle multi-threaded programs where each thread can make infinitely many method calls, without requiring the user to manually annotate for the linearization points. We have implemented and evaluated our method in the PAT model checking toolkit. Our experiments show that the method is effective in verifying quasi linearizability and in detecting its violations.

Round-up: Runtime checking quasi linearizability of concurrent data structures

“…A closely related work is a model checking based approach for formally verifying quantitative relaxations of linearizability in models of concurrent systems, which we have published recently [17]. However, the method is not designed for checking the C/C++ code.…”

Linearizability Is Not Always a Safety Property

“…If (q, op, res, q ) ∈ δ, it means that a possible result of applying operation op to an object in state q is that the object moves to state q and returns the response res to the process that invoked op. 1 For example, an erroneous claim is made in two recent papers [1,11] that explicitly permit nondeterministic objects and make no restriction that the nondeterminism of the objects should be finite. The latter paper states that "linearizability is a safety property, so its violation can be detected with a finite prefix of an execution history."…”

“…We thus highlight that, even if this was not always stated in the past, claims that linearizability is a safety property, should assume finite nondeterminism. 1 Lynch's proof that linearizability is a safety property [12] applies only to the more restricted class of deterministic objects.…”

Preface of the special issue on Model Checking of Software

“…In the third contribution, Adhikari et al [1] present an automated method for verifying the quasi-linearizability property on highly concurrent data structures. Quasilinearizability is a quantitative variation of the classical notion of linearizability, a requirement of correctness for concurrent systems stating that all the method calls on a shared object appear to take effect instantaneously between their invocation and the response.…”

“…Contributions by Lopes et al [12] and Sethi et al [13] directly address problems with analyzing programs with such structures. Concurrent data structures are also considered by Adhikari et al [1] by tackling the verification of quasi-linearizability property, which relaxes the traditional requirements for ensuring their correctness. State space reduction for the verification of software systems is addressed by Laarman et al in [8] with a language-agnostic partial order reduction technique.…”