Model checking transactional memories

Abstract

Model checking software transactional memories (STMs) is difficult because of the unbounded number, length, and delay of concurrent transactions and the unbounded size of the memory. We show that, under certain conditions, the verification problem can be reduced to a finite-state problem, and we illustrate the use of the method by proving the correctness of several STMs, including two-phase locking, DSTM, TL2, and optimistic concurrency control. The safety properties we consider include strict serializability and opacity; the liveness properties include obstruction freedom, livelock freedom, and wait freedom.Our main contribution lies in the structure of the proofs, which are largely automated and not restricted to the STMs mentioned above. In a first step we show that every STM that enjoys certain structural properties either violates a safety or liveness requirement on some program with two threads and two shared variables, or satisfies the requirement on all programs. In the second step we use a model checker to prove the requirement for the STM applied to a most general program with two threads and two variables. In the safety case, the model checker constructs a simulation relation between two carefully constructed finite-state transition systems, one representing the given STM applied to a most general program, and the other representing a most liberal safe STM applied to the same program. In the liveness case, the model checker analyzes fairness conditions on the given STM transition system.

Model Checking Transactional Memory with Spin

“…At Sun and Stanford [30], researchers have used an axiomatic formulation of a memory model with randomized testing to find bugs in a transactional memory implementation. Finally, work at EPFL gives a correctness condition intended to rule out bugs like the privatization problem given above [12], and gives a set of conditions under which the verification problem reduces to two threads and two variables [10], [11].…”

“…Recent advances in parametrized verification [4], [22], [37] might allow us to reduce the problem of checking large configurations with n threads to checking small configurations like those we can check now. A recent theoretical result [10] reduces the problem of checking a deferredupdate implementation of transactional memory with n threads to checking just two threads accessing two variables. Unfortunately, that result does not apply to our work:…”

Formalising of Transactional Memory Using Interval Temporal Logic (ITL)

“…They use an automated theorem prover to obtain mechanical proofs. Guerraoui et al [16] and Emmi et al [17] propose an algorithm capable of verifying that TM systems satisfy strict serialisability with respect to opacity as a safety condition. These researches (except Cohen) focus only on the STM systems and neglect the hybrid and hardware transactional memory.…”

Model checking transactional memories

“…In the safety case, the model checker checks language inclusion between two finite-state transition systems, a nondeterministic transition system representing the given TM applied to a most general program, and a deterministic transition system This research was supported by the Swiss National Science Foundation. This paper is an extended and revised version of our previous work on model checking transactional memories [11,12].R. Guerraoui representing a most liberal safe TM applied to the same program.…”