A Framework for Formally Verifying Software Transactional Memory Algorithms

Lesani, Mohsen; Luchangco, Victor; Moir, Mark

doi:10.1007/978-3-642-32940-1_36

Cited by 19 publications

(22 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Others [22] describe a method of specifying and verifying TM algorithms. They specify some transactional algorithms in terms of I/O automata [26] and this choice of language enables them to fully verify those specifications in PVS.…”

Section: Related Workmentioning

confidence: 99%

The Push/Pull model of transactions

Koskinen

Parkinson

2015

Proceedings of the 36th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

We present a general theory of serializability, unifying a wide range of transactional algorithms, including some that are yet to come. To this end, we provide a compact semantics in which concurrent transactions PUSH their effects into the shared view (or UNPUSH to recall effects) and PULL the effects of potentially uncommitted concurrent transactions into their local view (or UNPULL to detangle). Each operation comes with simple criteria given in terms of commutativity (Lipton's left-movers and right-movers).The benefit of this model is that most of the elaborate reasoning (coinduction, simulation, subtle invariants, etc.) necessary for proving the serializability of a transactional algorithm is already proved within the semantic model. Thus, proving serializability (or opacity) amounts simply to mapping the algorithm on to our rules, and showing that it satisfies the rules' criteria.

show abstract

Section: Related Workmentioning

confidence: 99%

The Push/Pull model of transactions

Koskinen

Parkinson

2015

Proceedings of the 36th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

show abstract

“…Our proof therefore proceeds by encoding TMS2 and TML as IOA within Isabelle, then proving the existence of a forward simulation, which in turn has been shown to ensure trace refinement of IOA [LV95]. Our second proof technique is closely related to that of Lesani et al [LLM12a], who verify the NOrec algorithm [DSS10] using the PVS proof assistant [ORS92]. Both techniques have evolved from the same set of earlier work on linearizability verification [DGLM04].…”

Section: Introductionmentioning

confidence: 99%

Mechanized proofs of opacity: a comparison of two techniques

et al. 2018

View full text Add to dashboard Cite

Software transactional memory (STM) provides programmers with a high-level programming abstraction for synchronization of parallel processes, allowing blocks of codes that execute in an interleaved manner to be treated as atomic blocks. This atomicity property is captured by a correctness criterion called opacity, which relates the behaviour of an STM implementation to those of a sequential atomic specification. In this paper, we prove opacity of a recently proposed STM implementation: the Transactional Mutex Lock (TML) by Dalessandro et al. For this, we employ two different methods: the first method directly shows all histories of TML to be opaque (proof by induction), using a linearizability proof of TML as an assistance; the second method shows TML to be a refinement of an existing intermediate specification called TMS2 which is known to be opaque (proof by simulation). Both proofs are carried out within interactive provers, the first with KIV and the second with both Isabelle and KIV. This allows to compare not only the proof techniques in principle, but also their complexity in mechanization. It turns out that the second method, already leveraging an existing proof of opacity of TMS2, allows the proof to be decomposed into two independent proofs in the way that the linearizability proof does not.

show abstract

“…The main safety condition for TM is opacity [21,22], which provides conditions for serialising (concurrent) transactions into a sequential order and describes the meaning of this sequential order. Over the years, several methods for verifying opacity have been developed [26,29,27,19,18,2,12]. A difficulty in opacity verification is that it must deal with sequences of memory snapshots that reflect the history of all committed transactions.…”

Section: Introductionmentioning

confidence: 99%

“…Lesani et al directly verified opacity of NORec [27] via simulation against the TMS2 specification. In comparison to our approach, Lesani et al introduce several layers of intermediate automata, performing the full simulation proof in a step-wise manner.…”

mentioning

confidence: 99%

“…Each of layer adds additional complexity and design elements of the NORec algorithm to the abstract TMS2 specification. A full (in-depth) comparison of against this existing proof [27] has however not been possible because these details are not publicly available. In contrast, we have developed a simple coarse-grained abstraction NORec-CGA that generates opaque traces, reducing the proof of opacity for NORec to linearizability against NORec-CGA.…”

mentioning

confidence: 99%

See 1 more Smart Citation

Proving Opacity via Linearizability: A Sound and Complete Method

Armstrong

Dongol

Doherty

2017

Formal Techniques for Distributed Objects, Components, and Systems

View full text Add to dashboard Cite

Transactional memory is a mechanism that manages thread synchronisation on behalf of a programmer so that blocks of code execute with an illusion of atomicity. The main safety criterion for transactional memory is opacity, which defines conditions for serialising concurrent transactions.Proving opacity is complicated because it allows concurrent transactions to observe distinct memory states, while TM implementations are typically based on one single shared store. This paper presents a sound and complete method, based on coarse-grained abstraction, for reducing proofs of opacity to the relatively simpler correctness condition: linearizability. We use our methods to verify TML and NORec from the literature and show our techniques extend to relaxed memory models by showing that both are opaque under TSO without requiring additional fences. Our methods also elucidate TM designs at higher level of abstraction; as an application, we develop a variation of NORec with fast-path reads transactions. All our proofs have been mechanised, either in the Isabelle theorem prover or the PAT model checker.

show abstract

A Framework for Formally Verifying Software Transactional Memory Algorithms

Cited by 19 publications

References 14 publications

The Push/Pull model of transactions

The Push/Pull model of transactions

Mechanized proofs of opacity: a comparison of two techniques

Proving Opacity via Linearizability: A Sound and Complete Method

Contact Info

Product

Resources

About