Modeling and Verifying Transaction Scheduling for Software Transactional Memory using CSP

Complete formal verification of the PSTM transaction Scheduler

“…The authors of the paper [1] constructed the formal model of the PSTM scheduler architecture and the first three online transaction scheduling algorithms (RR, ETLB, and AC) from [23] as a group of CSP processes representing: an application, the scheduler input queue, the scheduler, the worker input queues, the workers, and the processes formalizing RR, ETLB, and AC algorithms. Using the model checker PAT, they automatically proved deadlock and starvation freeness properties and analyzed algorithms performance from the perspective of makespan, relative speedup, number of aborts, and throughput.…”

“…However, instead of using test workloads from [23] and [24], they introduced three simplified test workloads: CFW, CW-1 (Conflict Workload 1), and CW-2 (Conflict Workload 2), so a direct comparison of their results with the results of [23] and [24] was not possible. Moreover, the formal verification in [1] was made with some shortcomings, which we discovered and remedied in [25].…”

“…In [25], we tested the CSP# model of the PSTM transaction scheduler introduced in [1] by comparing the model checker PAT results with the manually derived expected results, for the test workloads defined in [1], and we discovered six shortcomings. Next, we extended the CSP# model in order to eliminate the discovered shortcomings.…”

“…However, as this paper shows, conducting traditional formal verification in two steps (described above) as was, for example, done in [1], [4], [5], and [6] is not sufficient. As will be elaborated in more detail in Section 1.1 (related work), the main problem with the traditional two-steps formal verification is that the formal model constructed in the first step is not directly tested.…”

“…State of the art formal verification based on model checking is performed in two steps: (i) constructing a formal model of a given safety critical software, and (ii) proving that this formal model satisfies a given set of correctness properties, which consists of safety and liveness properties. For example, a PSTM (Python Software Transactional Memory) transaction scheduler was recently modeled (see [1]) in process algebra Communicating Sequential Processes (CSP) [2], in order to automatically prove the subject's deadlock-freeness (a safety property) and starvation-freeness (a liveness property) by the model checker PAT (Process Analysis Toolkit) [3].…”