Mechanically verified proof obligations for linearizability

Abstract

Concurrent objects are inherently complex to verify. In the late 80s and early 90s, Herlihy and Wing proposed linearizability as a correctness condition for concurrent objects, which, once proven, allows us to reason about concurrent objects using pre-and postconditions only. A concurrent object is linearizable if all of its operations appear to take effect instantaneously some time between their invocation and return.In this article we define simulation-based proof conditions for linearizability and apply them to two concurrent implementations, a lock-free stack and a set with lock-coupling. Similar to other approaches, we employ a theorem prover (here, KIV) to mechanize our proofs. Contrary to other approaches, we also use the prover to mechanically check that our proof obligations actually guarantee linearizability. This check employs the original ideas of Herlihy and Wing of verifying linearizability via possibilities.

Using Coarse-Grained Abstractions to Verify Linearizability on TSO Architectures

“…There has been an enormous amount of interest in deriving techniques for verifying linearizability. These range from using shape analysis [2,4] and separation logic [4] to rely-guarantee reasoning [20] and refinement-based simulation methods [10,7]. Most of this work has been for sequentially consistent architectures, but some work has been done for TSO [3,11,19,9].…”

“…Below we describe how we adapt the formal definition and proof method for linearizability given in [7]. In the standard definition of linearizability, histories are sequences of events which can be invocations or returns of operations from a set I and performed by a particular process from a set P. On the TSO architecture, operations can be flushes and we assume that a flush is only executed by a CPU process cpu ∈ P, different from all other processes.…”

“…Let mp(p, m, n, h) denote matching pairs of invocations and returns by process p in history h as in [7]. Its definition requires that h(m) and h(n) are executed by the same process p and are an invocation and return event, respectively, of the same operation.…”

“…Existing proof methods for showing this include the simulation-based approach in [7]. This is based on showing that the concrete specification is a non-atomic refinement of the abstract one.…”

Quiescent Consistency: Defining and Verifying Relaxed Linearizability

“…Refinement techniques have already proved useful in the verification of linearizability, see [10]. Here, we employ coupled simulations to derive a methodology for showing that fine-grained atomic concurrent algorithms are quiescent consistent, and apply it to prove quiescent consistency of a concurrent queue implementation.…”