Science, Faculty of
Computer Science, Department of
DSpace
UBCV
Bingham, Jesse
Doctor of Philosophy - PhD
University of British Columbia
Perhaps the most difficult aspect of designing a shared memory multiprocessor is the hardware protocol that facilitates the sharing of memory by multiple processors; these protocols are thus a natural target for formal verification. In this thesis we consider several problems relevant to model checking these protocols. The ultimate specification of a protocol is the memory model. Our more theoretical contributions relate to the problem of model checking a protocol for the well-known memory model sequential consistency (SC). We define a restricted version of SC called decisive SC (DSC), which rules out pathologies admitted by SC, and explore the complexities of its verification problems. Our key results are that DSC of a single behavior is NP-complete, DSC of a protocol is PSPACE-hard, a bounded variant DSQ is decidable in EXPSPACE, and full SC remains undecidable even when we require protocol behaviors to be prefix-closed. Also, we show that SC in conjunction with the ubiquitous property data independence imply DSC, which is strong evidence that restricting attention to DSC will never preclude any real protocol. Our second area of contribution considers parameterized model checking (PMC) of protocols. Here the goal is algorithmic proof over all of the infinite configurations of a protocol family parameterized by one or more quantities. We develop a technique to automatically abstract a family parameterized by the number of addresses and the number of data values, such that (a subset of) SC of the abstraction implies that of the family. We apply this method successfully to two nontrivial protocols, and suggest user-assisted solutions if the abstraction blows up or is too coarse for successful verification. We also contribute an approach for sound and complete processor-PMC of state assertions. The approach uses BDD-based symbolic model checking, and harnesses the theory of well-structured transition systems (WSTS). WSTS disallow conjunctive guards, which are found in many protocols. To extend applicability, we provide an automatic reduction for systems with conjunctive guards. Experiments show the efficacy of our conjunctive guard reduction, and that our approach scales better with the local state of each processor when compared with the classical WSTS algorithm.
Model Checking Sequential Consistency and Parameterized Protocols by Jesse Bingham B.Sc. University of Victoria, 1998 M.Sc . University of Victoria, 2001 A T H E S I S S U B M I T T E D IN P A R T I A L F U L F I L L M E N T O F T H E R E Q U I R E M E N T S F O R T H E D E G R E E O F Doctor of Philosophy in T H E F A C U L T Y O F G R A D U A T E S T U D I E S (Computer Science) The University of British Columbia August 2005 © Jesse Bingham, 2005 Abstract Perhaps the most difficult aspect of designing a shared memory multiprocessor is the hardware protocol that facilitates the sharing of memory by multiple processors; these protocols are thus a natural target for formal verification. In this thesis we consider several problems relevant to model checking these protocols. The ultimate specification of a protocol is the memory model. Our more theoretical contributions relate to the problem of model checking a protocol for the well-known memory model sequential consistency (SC). We define a restricted version of S C called decisive SC (DSC), which rules out pathologies admitted by S C , and explore the complexities of its verification problems. Our key results are that D S C of a single behavior is NP-complete, D S C of a protocol is PSPACE-hard, a bounded variant D S Q is decidable in E X P S P A C E , and full S C remains undecidable even when we require protocol behaviors to be prefix-closed. Also, we show that S C in conjunction with the ubiquitous property data independence imply D S C , which is strong evidence that restricting attention to D S C will never preclude any real protocol. Our second area of contribution considers parameterized model checking (PMC) of protocols. Here the goal is algorithmic proof over all of the infinite configurations of a protocol family pa-rameterized by one or more quantities. We develop a technique to automatically abstract a family parameterized by the number of addresses and the number of data values, such that (a subset of) S C of the abstraction implies that of the family. We apply this method successfully to two non-trivial protocols, and suggest user-assisted solutions if the abstraction blows up or is too coarse for successful verification. We also contribute an approach for sound and complete processor-PMC of state assertions. The approach uses BDD-based symbolic model checking, and harnesses the theory of well-structured transition systems (WSTS). W S T S disallow conjunctive guards, which are found in many protocols. To extend applicability, we provide an automatic reduction for systems with conjunctive guards. Experiments show the efficacy of our conjunctive guard reduction, and that our approach scales better with the local state of each processor when compared with the classical W S T S algorithm. ii Contents Abstract ii Contents iii List of Tables vi List of Figures vii Notations ix Acknowledgments xii 1 Introduction 1 1.1 Memory Model Verification 2 1.2 Parameterized Verification 4 1.3 Contributions 5 1.4 Organization of Thesis 7 2 Decisive Sequential Consistency 8 2.1 Introduction 8 2.2 Preliminary Definitions 9 2.3 Definition of Decisive Sequential Consistency 12 2.3.1 D S C f c 14 2.3.2 Data Independence and D S C 15 2.3.3 Example: Lazy Caching 17 2.4 Complexity of Trace Problems 19 iii 2.5 Complexity of Model Checking D S C f c 25 2.5.1 View Windows 26 2.5.2 VW-Boundedness 34 2.6 Complexity of Model Checking D S C 38 2.6.1 The Protocol P v 40 2.6.2 Proof that Vv is D S C Implies <p 44 2.6.3 Proof that <p Implies Vv is D S C 50 2.7 Undecidability of Prefix-Closed S C 53 2.7.1 The Protocol 55 2.7.2 The Proof 58 3 Address and Value Parameterization 61 3.1 Introduction 61 3.2 Preliminaries 62 3.3 Verification Approach 64 3.4 A Protocol Description Formalism 71 3.4.1 Syntax 72 3.4.2 Semantics 73 3.5 A Candidate Q 74 3.6 Experimental Results 81 3.7 Comments on our Abstraction 84 3.7.1 Comparison to Other Abstractions 85 3.7.2 Example of Verification Failure 87 4 Process Parameterized Verification using BDDs 91 4.1 Introduction 91 4.2 Well-Structured Transition Systems 93 4.2.1 Definitions 93 4.2.2 Examples 94 4.2.3 The Classical Algorithm 98 4.3 Our Approach 100 iv 4.3.1 Nicely Sliceable W S T S 100 4.3.2 Our Algorithm 104 4.3.3 Parametric Initial States 108 4.3.4 A n Optimization I l l 4.3.5 Near Necessity of the Convergence Theorem 112 4.4 Conjunctive Guard Reduction 114 4.5 Evaluation 119 4.5.1 Implementation 119 4.5.2 Comparison to Standard Approach 121 4.5.3 Petri Nets 122 4.5.4 M E S I Protocol 123 4.5.5 German's Protocol 125 5 Related Work 126 5.1 General Protocol Verification 127 5.2 Memory Model Verification: No Model Checking 127 5.3 Memory Model Verification: Model Checking 129 5.4 Parameterized Verification 133 5.5 Other Related Work 136 6 Conclusions and Future Work 137 6.1 Decidability of D S C 138 6.2 Hardness of D S C f e 141 6.3 Universal D S C 143 6.4 Extending/Improving Chapter 3 144 6.5 Future Directions for Chapter 4 147 Bibliography 148 v List of Tables 3.1 Results for the Piranha and Wisconsin Directory Protocols 84 4.1 Run of our algorithm against example petri net 109 4.2 Results for selected petri nets 122 4.3 Results for the M E S I protocol with P C G over multiple blocks 125 4.4 Results for German's Protocol 125 vi List of Figures 1.1 Abstract view of a multiprocessor shared memory protocol 3 1.2 A parallel program based on Decker's Algorithm 3 2.1 A coloured trace and its reordering 14 2.2 The architecture of Lazy Caching 18 2.3 Lazy Caching in guarded commands 19 2.4 The trace ec(j') 22 2.5 V W and V W operations referred to in Examples 1 and 2 30 2.6 The DSC2 trace used in Example 3 35 2.7 The protocol 40 2.8 The trace eva b(i) 42 2.9 The trace ec'(7) 43 2.10 The inheritance edges discussed in the proof of Lemma 18 49 2.11 The traces evaF(^)o and eva F(z)^ 54 3.1 A non-SC trace that is per-address simple S C 62 3.2 Relationship between the traces mentioned in the proof of Theorem 12 69 3.3 Example of a Q F A for which ^-abstraction is too coarse 86 3.4 Example A V P P F C for which our 3-abstraction is too coarse to verify S S C 88 4.1 The relationship between =^ and —» required by Def. 41 95 4.2 The classical algorithm for the W S T S covering problem 99 4.3 A diagrammatic presentation of Def. 49 102 4.4 Our algorithm for the N S W covering problem 107 vii 4.5 Example petri net 109 4.6 The petri net and upward-closed set discussed in the proof of Theorem 20 113 4.7 The petri net ME{h) 122 4.8 Execution times on the petri net ME(h) 124 6.1 The stripe rearrangement described in the proof of Theorem 23 140 viii Notat ions N the natural numbers 9 N n the set {1 , . . . ,n} 9 B the set of boolean constants {T, F} 9 | r | the length of the string r 9 e the empty string/trace 9 E* the set of all strings over an alphabet S 9 r ( i ) the ith element of string r 9 r[i] the prefix of string T of length z 10 T]A the projection of string r onto the symbols in A 10 r i i = i ° i m e string concatenation o\.. .o^ 10 M the set of memory actions 10 op(a) the first component of memory action a (either R or W) 10 proc(a) the second component (processor) of memory action a 10 addr(a) the third component (address) of memory action a 10 val(a) the fourth component (data value) of memory action a 10 (R, p, a, v) a read action 10 (W,p,a,v) a write action 10 IW(T, i, a) the last write to address a not greater than index i in r 10 lpa(r, p) the index of the last action of processor p in r 11 rn the trace obtained by permuting T with the permutation 7r 11 the processor order on the indices of trace r 11 H->£ the inheritance relation on the indices of r induced by reordering n . . . . 11 ix Ir (a, i) the last read relative to index i in serial trace a 11 IR(a,j,a) the inheritance range predicate 12 C(A) the language accepted by automaton A 12 traces^) the set of traces of protocol V 12 (r) the atomicity construct involving trace r 20 eva (i, b) a trace that encodes the assignment of b to variable Xi 22 ec(j) a trace that encodes clause Cj 22 ps a position sequence for a serial trace 27 VW(a, ps) the VW-set of serial trace a and position sequence ps 27 v a sequence of views 27 Ip a processor position function 27 < v w a partial order on view windows 29 ~~>T view window r-evolution relation 31 evalq((^) the boolean value of Q B F formula ip 39 evaf,(z) encodes the assignment of 6 to variable X j and selects some value for j / j . . 40 C L S the trace that encodes the clauses of a Q B F formula 40 C A the trace that checks the current variable assignment 40 S n the alphabet of an ro-counter machine 53 S n augmented with the end of string marker $ 56 J a finite automaton such that C(J) equals (2.16) 55 (p a function of the form * —> M* 57 7 an address and value-parameterized protocol family 62 scg(r) the simple constraint graph of unambiguous trace r 65 1= the satisfaction relation between m-states and Q F A s 74 £ the abstract address 74 sub(^) the substitution operation on Q F A ip 75 subi(V>) a variant of sub(^) 75 Q the abstraction of an A V P P F 75 H a simulation relation between m-states and abstract states 78 J_ the "no-information" logic value 85 x =$! a preorder or a well-quasi-ordering 93 | V the upward-closure of set Y 93 basis({7) the unique canonical basis of upward-closed set U 94 =^ M the inclusion ordering on markings 95 *t the pre-vector of petri net transition t 96 t' the post-vector of petri net transition t 96 a! a? broadcast protocol rendezvous labels 97 a\\ a?? broadcast protocol broadcast labels 97 =<!vv the subword ordering 98 pre(U) the preimage of a set U 98 pb(y) a pred-basis of finite set Y 98 w(x) the weight of a dwqo element x 101 bw(U) the base weight of an upwards-closed set U 101 br(Y, i) the backwards reachability from Y not exceeding weight i 105 Lift the lifting operator 106 I) the number of occurrences of symbol I in string w 109 TipCg the set of properly conjunctively guarded actions 115 xi Acknowledgments I thank my parents for sticking with me through my tumultuous teenage years, which persisted well into my twenties, and for their ongoing support. I thank Claire and Joshua for their tolerance of my temperament as I attempted to balance my new found family life, my irregular sleeping patterns, and pursuit of this degree. Being co-supervised by Anne Condon and Alan H u has been a truly gratifying experience. Alan has the uncanny ability to attach intuition to technical concepts, while conversely he often phrases social, political, and everyday scenarios in terms of the mathematical. He has been a great mentor in all of these areas and more. Anne's abilities as a theoretician never cease to amaze me; having her as a supervisor has been invaluable. Anne has also been a source of sage advice for non-technical aspects of my career. Despite having perpetually full plates, both Alan and Anne have always made time for me whenever requested. I also thank Mark Greenstreet (the "other" ISD Lab professor) and Shaz Qadeer (the third member of my supervisory committee), who were both sources of encouragement and insight whenever called upon. Finally, I thank my brothers and all my good friends who have been exceptional collaborators at running amok. J E S S E B I N G H A M The University of British Columbia August 2005 xii Chapter 1 Introduction Shared memory multiprocessors ( S M M P ) are becoming a pervasive computing platform, and the importance of these machines will only increase with the current emergence of the chip-multiprocessor [60]. Perhaps the most difficult aspect of designing a S M M P is the hardware-based protocol that facilitates the sharing of memory by multiple processors. Performance is paramount in such protocols, hence they are typically highly optimized. This, coupled with the copious concurrency inherent in these systems, makes them extremely bug-prone and hence a natural target for formal verification. Formal verification strives to find bugs and/or certify correctness by constructing a mathematically rigorous, i.e. formal, proof that a model of a system adheres to its specification. This thesis is about formal verification of S M M P memory protocols. Since the seminal work in the late 1960s, the majority of the formal verification literature has focused on employing computers to reduce the level of human expertise and time needed to con-struct proofs. Here, the computer plays two (not necessarily distinct) roles: to ensure soundness of the proof, and to automate aspects of the proof. A popular method that achieves both of these goals is called model checking, which, for the purposed of this thesis, simply refers to any totally algorithmic means of answering a verification query about a system.1 We treat two orthogonal goals surrounding S M M P memory protocol (hereafter simply protocol) verification: memory model verification and parameterized verification. Both of these are ambitious for contrary reasons; the former tackles verification of a difficult specification while the latter tack-'in some contexts, model checking implies systematic state space exploration of a finite-state system; however when discussing complexities of model checking problems and parameterized verification (as we do) our broader sense is appropriate. 1 1.1. Memory Model Verification 2 les verification of a difficult system. In the ensuing Sects. 1.1 and 1.2, we respectively discuss these goals. The contributions of the thesis are outlined in Sect. 1.3, and finally a brief roadmap is presented in Sect. 1.4. 1.1 Memory Model Verification The memory model [4] is the ultimate specification of the protocol, and has been aptly described as the contract between the multiprocessor designer and its programmer [113]. Consider the abstract view of an S M M P memory protocol depicted in Fig. 1.1. Here we see n clients, the processors, con-nected to the protocol. The protocol typically involves common hardware features such as caches, memories, F I F O queues, networks, control logic, and buses. A s the clients, the processors instigate memory events across the conceptual interface between the processors and the protocol. For the purposes of this thesis, memory events will comprise write events, wherein a processor writes a data value to a specified address, and read events, wherein a processor reads a data value from an address.2 A memory model can be viewed as a set of strings of these events specifying the legal behaviors at the interface. A given protocol satisfies the memory model if all its behaviors are permitted by the memory model. The memory model considered in this thesis is called Sequential Consistency (SC), which was first articulated by Lamport [88] and more recently promoted by Hi l l [77]. The intuition behind this model is this: on a sequentially consistent S M M P , memory appears to service requests atomically. Usually, due to various optimizations, most notably caching, this appearance is illusory. The following example should illuminate S C and memory models in general. Consider the parallel program of Fig. 1.2, which strives to allow at most one of the processors p\ and p2 to execute their respective critical sections, and assumes that initially f l a g l = f l ag2 = 0. Suppose that a mn of this program yields the following sequence of memory events on the interface: (W,Pl, f l a g l , 1 ) ( W , P 2 , f lag2 , l)(R,Pl, f lag2,0)(R,p 2, f l a g l , b) (1.1) Here, (W, p, a, d) (resp. (R, p, a, d)) is the memory event in which processor p writes (resp. reads) value d to (resp. from) address a. Note that (1.1) actually defines two different sequences, depending 2 The third type of memory event, which are not considered in this thesis, are explicit synchronization commands, which are supported by many multiprocessors. 1.1. Memory Model Verification 3 Conceptual interface Figure 1.1: Abstract view of a multiprocessor shared memory protocol Processor p\ Processor p2 flagl := 1; if ( ! f l a g 2 ) { f l a g 2 := 1; if (-flagl) { critical_section(); critical_section(); } } Figure 1.2: A parallel program based on a fragment of Decker's Algorithm [15]. Assuming that initially f l a g l = f l a g 2 = 0, when executed on a sequentially consistent multiprocessor the code will allow at most one of the two processors to enter its critical section. on whether the final event reads 6 = 0 or 6 = 1. Regardless of b, the reader might find (1.1) to be aberrant; the second event writes 1 to address f lag2 , but then later the value 0 is read from the same address. On a uniprocessor such behavior would be indicative of a broken memory system. However, in the multiprocessor setting, S C allows such behavior. Indeed, (1.1) with 6 = 1 satisfies S C , and clearly this behavior only allows pi into its critical section. Assuming an S C machine, one can easily prove that the program of Fig. 1.2 will never allow both processors into their critical sections. This is not necessarily the case for more permissive (a.k.a weaker) memory models; several models would allow (1.1) with 6 = 0, hence mutual exclusion would be violated. 1.2. Parameterized Verification 4 A s seen in the above example, the conformance of the protocol to the intended memory model is crucial; violation of this "contract" can have disastrous consequences on the behavior of parallel programs. Hence, it is desirable to formally prove correctness with respect to the memory model, or at least harness formal verification to weed out bugs and thus increase confidence in correctness. In this thesis, our attention is focused on model checking a protocol to determine memory model ad-herence, and the memory model we consider is sequential consistency. Though many real machines are not sequentially consistent, the other prevalent models are often defined as relaxations of S C , and hence we believe that research on verification of S C can inform techniques for other models. 1.2 Parameterized Verification In theory, a real protocol implemented in hardware has only a finite number of state holding ele-ments, and thus only a finite number of reachable states. However, the number of reachable states is much greater than the number of SAPs in the universe, where a SAP is the reader's favorite sub-atomic particle. Hence, in practice, real protocols should be regarded as infinite state systems. Related is the notion of parameterization; typical protocol descriptions are meant to work for any number of processors, shared addresses, data values per address, and other parameters such as cache sizes, queue depths, network capacities, etc. Ideally, we would prove correctness of all members of this infinite family of related protocols. O f course model checking generally falls sub-stantially short of this goal, since only very small instantiations (i.e. 2 processors, 2 addresses, 2 value per address) can be handled. Correctness of such miniscule configurations builds confi-dence that the entire family is correct, but special techniques are required if we wish to make such generalizations logically sound. Parameterized Model Checking (PMC) refers to methods that extend model checking for certain classes of systems so that correctness can be proven for all parameter values. Such methods roughly fall into two classes: abstraction-based approaches which are sound but typically incomplete,3 and those methods that are both sound and complete. This thesis explores an example of each of these. We note that since P M C in a sense subsumes finite state model checking, it is tricky business. Typ-ically, both the class of properties and the class of systems that can be handled by P M C techniques Soundness means that the method will never pass an erroneous system. Conversely, completeness means that the method will never fail a correct system. 1.3. Contributions 5 are restrictive. Combining P M C with memory model verification (as we will do in Chapter 3) is indeed an important and formidable objective. 1.3 Contributions Our contributions are divided amongst the three main thesis chapters. Chapter 2 treats the complex-ities of several verification problems related to a new subset of S C called D S C . Chapter 3 meshes the two goals of memory model verification and P M C into an abstraction-based method that verifies a subset of S C for arbitrary numbers of addresses and data values per address. Finally, Chapter 4 focuses on P M C across processor counts, which is the hardest dimension to tackle. Here only state assertions are verified, as opposed the more difficult property of memory model adherence. We now elaborate on these three chapters. Chapter 2. Here we study the problem of model checking a finite state (i.e. unparameterized) protocol for adherence to sequential consistency. It turns out that for even a finite state protocol this is a computationally hard problem; unlike model checking for temporal logics such as C T L or L T L , which have algorithms that are polynomial in the size of the state space of the protocol, S C is undecidable [8]. Full S C allows for pathological behaviors in which the protocol must necessarily revoke decisions regarding which write event bestowed the value imparted to a given read event. In hopes of alleviating complexity yet still capturing the behaviors of any conceivable protocol, we define a restricted version of S C called decisive SC (DSC). D S C forbids precisely those pathological behaviors mentioned above. We also define a variant of D S C called D S Q . (for any integer k > 1), which in some sense bounds the historical information required to maintain D S C . Our key results regarding the complexities of related verification problems are: • S C in conjunction with the ubiquitous property of data independence imply D S C , which is strong evidence that restricting attention to D S C will never preclude any real protocols. • Verifying either full D S C or DSCfc for > 2 of a single behavior is NP-complete. • Model checking a bounded variant DSCfc can be accomplished in E X P S P A C E . • Model checking D S C is PSPACE-hard. 1.3. Contributions 6 • Model checking S C itself remains undecidable when we require the set of behaviors of a protocol to be prefix-closed; this was not required by Alur et al. [8] in their proof that model checking S C is undecidable. The foremost problem left open by Chapter 2 is the decidability of model checking D S C . Note that our PSPACE-hardness result is exactly that, only a proof that the problem is at least as hard as anything in P S P A C E , and says nothing about decidability. As the concentration is complexity and computability results, Chapter 2 is the most theoretical of the thesis. The following Chapter 3 actually involves experiments with real protocols. Chapter 3. Here we develop a method for P M C over the address and data value parameters; the property verified is a restricted version of S C called simple SC. The method uses abstraction; we automatically construct a finite state protocol that abstracts the entire parameterized family of protocols in such a way that simple S C of the abstraction implies that of the whole parameterized family. We apply the technique successfully to two nontrivial example protocols. In principle, the technique can be carried out automatically, however in practice, we find that it can fail for two different reasons: the state space of the abstraction blows up, or the abstraction is too coarse. We spell out means of remedying both of these situations that require only a modest level of user assistance. Later, in Sect. 6.4 we suggest how one might extend the method of Chapter 3 to handle non-simple S C protocols. Chapter 4. Due to their strong interactions, parameterizing over the number of processors is the most difficult dimension to handle in P M C . Our final contribution is a technique that can perform automatic, sound and complete processor-parameterized P M C ; the property verified here is the un-reachability of a set of error states. The approach uses BDD-based symbolic model checking, and harnesses the theory of well-structured transition systems (WSTS), which is a class of infinite state systems that enjoy decidability of certain verification problems. The technique involves analysing the system restricted to 1 processor, then 2, then 3, etc., until either an error is found, or a certain convergence condition is reached. The latter case allows one to conclude correctness for an arbitrary number of processors. This convergence condition and how it is computed using B D D s are the main theoretical contributions of the chapter. Well-structuredness precludes several attributes typically found in protocols; one of these is the conjunctive guard. To extend the reach of our approach, we provide a sound and automatic reduction 1.4. Organization of Thesis 7 for systems with conjunctive guards. This allows us to perform P M C of German's Protocol (a well-known challenge problem for P M C ) in about one minute of processing time. Several experiments are presented that demonstrate how our approach scales much more gracefully with the size of the local state of each processor when compared with the classical algorithm from the W S T S literature. 1.4 Organization of Thesis Following this introductory chapter are the three core chapters summarized in the previous section. Subsequently, Chapter 5 highlights related work, and Chapter 6 concludes the thesis and describes future research directions. Sect. 2.2 defines much of the notation used throughout the thesis, other notation is introduced on a need-to-know basis. Chapter 2 Decis ive Sequential Cons i s t ency 2.1 Introduction This section is devoted to motivating, defining, and exploring the verification complexity of a mul-tiprocessor correctness criterion we call decisive sequential consistency (DSC). D S C amends the well-known memory model sequential consistency by precluding certain behaviors that are both difficult to reason about and unlikely to exist in a real shared memory system. Intuitively, a shared memory system is sequentially consistent (SC) if it appears, from the point of view of the client processors, that the system services memory requests atomically. In other words, the system must be indistinguishable, from the processors' perspective, from a serial mem-ory, in which each read inherits the value written by the (temporally) last write to the same address. A n outside observer, i.e. one that can see the histories of all processors, could notice behaviors that are not serial, however, any behavior of the S C system must be explainable as a behavior of serial memory. Formally, the explanation will be a reordering (a.k.a. shuffling, permutation) of the original behavior. One can define S C protocols that behave very strangely. We feel that the most pathological behavior admitted by S C is the ability for the explanation to radically change as history unfolds. This notion of disallowing radical changes is formally defined in Sect. 2.3, wherein we show that this notion is equivalent to the requirement that, in the explanation, no read inherits its value from a write that occurs in its temporal future. Any protocol that requires this "prophetic inheritance" must either be forcing certain necessary writes to occur, or has been modelled with write and read events associated with the incorrect protocol transitions. Hence, we introduce D S C as a correctness 8 2.2. Preliminary Definitions 9 criterion that rules-out such peculiarities. Informally, D S C requires that when a memory read event occurs, the protocol "knows" which write event the data value stemmed from, and the protocol never needs to "change its mind" in the future in order to maintain S C . A l l S C protocols with which we are familiar actually implement the slightly stronger property D S C . 1 This chapter makes the following contributions. Sect. 2.2 formalizes the notions of S C and shared memory protocols. Sect. 2.3 motivates and defines our notion of decisive SC (DSC), and also defines a version of D S C that is bounded in some sense. We provide evidence that D S C is the "right" notion by showing that an oft-studied S C protocol has this property, and further that any data independent S C protocol must be D S C . Sects. 2.4, 2.5, and 2.6 respectively consider the complexities of testing a single protocol behavior for (bounded) D S C , model checking a protocol for the bounded version of D S C , and model checking a protocol for unbounded D S C . We find that these three problems are respectively in the classes NP-complete, E X P S P A C E , and PSPACE-hard. Note that this final result is merely a lower-bound;2 the decidability of model checking D S C is an open problem. We conclude the chapter with Sect. 2.7, wherein we prove that model checking S C for our notion of protocol, which requires the set of behaviors to be prefix-closed, is undecidable. This refines an earlier result of Alur et al. [8] stating that S C is undecidable for protocols that are not (necessarily) prefix-closed. 2.2 Preliminary Definitions Let N denote the set of natural numbers {0,1,2, . . .} . For a natural n, let N n = {1 , . . . , n}. The boolean constants for true and false will respectively be denoted T and F, and we define B = {T, F}. Strings. Given an alphabet E , a string or word over E is a mapping r : Ne —> E for some £, and we define the length of r to be |r | = I. We sometimes refer to i 6 as an index (of r). The empty string, denoted e, is the unique string of length 0. The set of all strings over an alphabet E is denoted E * . A string can be expressed by writing its symbols in order, i.e. r ( l ) . . . r( |r|) . Hence 'Lamport, who originated the notion of sequential consistency [88], wrote a footnote on page 195 of his book [89] that is worthy of duplication here: "The freedom to change explanations, which a sequentially consistent memory allows, could conceivably be used to permit a more efficient implementation, but it's not easy to see how." 2But a hard-won lower bound! 2.2. Preliminary Definitions 10 the use of the terms left and right to refer to features of the string makes sense, we sometimes use the term last to mean rightmost. The prefix of r of length i is denoted r[i]. Given a string r and a set A, the projection of r onto A is the string r | i obtained by deleting all symbols not in A. For a € S we say that a string r ' € S* is obtained from r by inserting a at position j if T ' = T(1) . . . T(j)ar(j + 1 ) . . . T ( | T | ) , where j may be any element of N | T | U {0}. We will use the term substring to refer to a contiguous substring. A string may be expressed as the concatenation of symbols and/or other strings; we simply juxtapose strings and symbols to denote the larger string formed by their concatenation. Also, given strings o i , . . . , Cfc, we will use k U" 1=1 to denote the concatenation o~\ . . . o\.. Mathematically, there is of course a distinction between a string a and an occurrence of a as a substring of some other string. We have not introduced a formal notation to make this distinction, the intention will either be clear from context or the word occurrence will be used to disambiguate. M e m o r y actions and traces. Given sets P, A, and V, the set of memory actions is the set M(P, A, V) = {R, W} x P x A x V. Intuitively, P, A, and V are respectively the processors, addresses, and data values involved in a shared memory protocol. A memory action will typically be called simply an action or sometimes an event. When P, A, and V are irrelevant or clear from context, we simply refer to the set of memory actions by M. Unless otherwise noted, P, A, and V will be sets of the form N n , N m , and N „ for some n, m, and v, respectively. For a = (o, p, a, v) € M, we define op(a) — o, proc(a) = p, addr(a) = a, and val(a) = v. We call a string over M a trace. We also define subsets of M using the wild-card symbol *. For instance, (*, p, a, *) is the set {a € A4 | proc(a) = p A addr(a) = a}. Sometimes we also use subsets in various components, for example (*, {1,2}, a, *) is the set of all actions a such that proc(a) € {1,2} and addr(a) = a. The set (R, *, *, *) constitutes the read actions while the elements of (W, *, *, *) are the write actions. Given a memory trace r , an index i, and address a, we define IW(T, i, a) to be the greatest index j < i such that r(j) € (W, *, a, *) or to be 0 if no such j exists. Intuitively, IW(T, i, a) is the index of the last write to address a that is not greater than i. For address a and value v, we define a v-phase of a to be an interval [i, j] such that r(i) € (W, *, a, v), lw(r, i',a) = i for all i' £ [i, j], and either 2.2. Preliminary Definitions 11 r ( j + 1 ) 6 (W, *, a, *) or j = | r | . Let r ' be an occurrence of a substring in r , assumed not to contain any writes to a. We say that T' is in a v-phase of a if there exists a u-phase of a that contains all indices of r ' , i.e. if the last write to a in T prior to r ' wrote value v. For processor p, the index of the last action of r in (*,p, *, *) is extracted via lpa(r,p) = max({i | proc(r(i)) = p} U {0}). Here, the acronym Zpa stands for last processor action. A trace a is said to be serial if, for all indices i such that op(c(i)) = R we have that z is in a val(o{ij)-phase of addr(o(i)). In other words, in a serial trace each read action returns the value of the last write action to the same address.3 As a notational convenience, we define val(a(0)) to be a distinguished constant ± , which signifies that no value has been assigned. We typically use o to represent a serial trace, while r represents a trace that is not necessarily serial. A reordering of a trace r is a permutation TT on N | T | , and we define the trace r " by ^(7r-1(l))...r(7r-1(|-r|)) In a slight abuse of terminology, we will sometimes also refer to r 7 1' as a reordering. We allow the application of a reordering TT to a prefix of length < | r | by defining the permutation TT' : —* such that 7r'(z) < TT'(J) O TT(I) < 7r(j) for all i , 7 e Nfc, and then defining the reordered prefix rffc]^ to be equal to rffc]^ . Associated with a trace is a partial order which places actions of the same processor in the order they occur in the trace; the resulting relation is called the processor order. Formally, given a trace r we define the partial order <f° on the indices such that i <T° j (proc(i) = proc(j)) A (i < j). A serial reordering of r is a reordering TT such that r 1 is serial, and further TT respects < ? ° , i.e. i < ? ° j iff tr(i) < tr(j), or equivalently, for all processors p, we have r | (*,p, *, *) = r " | (*,P) *> *)• A trace is said to be sequentially consistent (SC) if it has a serial reordering. If r is S C and has serial reordering TT, then we define an inheritance relation 1— on the indices of r by i j if O P ( T ( « ) ) = W, op(r(j)) — R, addr(r(i)) = addr(r(j)), and 7r(i) = Zu;(T 7 R , 7r(j), addr(r(j))). When ? i — j we say that j inherits from i. If a trace cr is serial, then we use 1—>a to denote 1 — ^ , where id is the identity permutation. Let a be a serial trace. For any i such that op(a(i)) = W, we define the last read of i by lr(o, i) = max({z' | i 1—>CT «'} U {i}). Intuitively, lr(o, i) provides the last read that inherits from i. 3For simplicity's sake, we have chosen to disallow initial values; this approach is also taken by Gibbons and Korach [66]. It should be clear that all theory herein can be generalized to handle formalizations that allow reading of initial data values. 2.3. Definition of Decisive Sequential Consistency 12 For any j G {0 , . . . , |<r|} and address a, we define the inheritance range predicate IR(o,j, a) that is true iff lw(o,j, a) ^ 0 and j < lr(o, lw(o,j, a)). Thus IR(o,j, a) holds whenever position j is between a write to address a and a read that inherits from the write. Automata and Protocols. A n automaton is a quintuple A = (S,T,,S,SQ,F), where S is a set of states, E is a finite alphabet, 8 C S x T, x S is the transition relation, so G 5 is the initial state, and F C. S are the accepting states. A is said to be a finite automaton if 5 is finite. Let 5* be the natural generalization of 5 to strings; formally we define 8* C 5 x E * x 5 as the smallest relation such that • (s, e, s) G 8* for all s £ S, and • whenever (s, io, s") G 5* and (s", a , s') G <5, we have (s, w a , s') G <5*. The language of A is the set of strings C(A) C E * such that io 6 £ ( A ) if and only if there exists Sf € F such that (so, w,Sf) G <5*. The sr'ze of A, denoted | A | , is the number of bits needed to encode A, which is roughly proportional to \S\. A shared memory protocol (or simply protocol) V is a finite automaton in which all states are accepting and the alphabet is a set of memory actions along with a disjoint set of silent (or internal actions) I. Hence the final component of an automaton is redundant when specifying protocols, and we express V as a quadruple (5, E , 8, s), where M(P, A, V) C E for some P , A, and V and Y,\M.(P, A, V) contains no memory actions. We say that V involves \P\ processors, | A | addresses, and | V | data values. The traces of V are defined to be the projection of its language onto memory actions, i.e. traces(V) = {w"[M \ w G C(V)} Any property of traces is automatically extended to refer to a protocol if all its traces satisfy the property, for example a protocol is sequentially consistent if all its traces are sequentially consistent. 2.3 Definition of Decisive Sequential Consistency In this section, we define two S C variants, D S C and P T S C , and we prove their equivalence. Then, for each G N, we define a class D S Q t , which is a subset of D S C that is bounded in some sense. 2.3. Definition of Decisive Sequential Consistency 13 Definition 1 (Decisive SC). A trace r is said to be decisive sequentially consistent (DSC) if there exists a serial reordering ir of r such that for any prefix T[£] and 1 < i, j < £ we have: (1) T[£]N is serial, and (2) i j ^ i j- In this case we say that TT is a DSC-reordering ofr. On an intuitive level, a D S C protocol is a S C protocol that never needs to "change its mind" regarding which write a given read inherits from. To our knowledge, the only place in the literature where this characteristic is paid heed is Lamport's book [89, Chapter 11.2]. There, Lamport calls a notion similar to D S C serial memory (an unfortunate terminological conflict with this thesis). However, his emphasis is on specification rather than verification. A trace being D S C implies that all prefixes of the trace are S C (moreover they are all D S C ) . However, having all prefixes S C is insufficient for D S C , as this example trace p demonstrates.4 To aid comprehension, we attach a number underneath each memory action giving its position in p. P ={W,P2,a1,2)(W,p2,a1,l)(W,P2,a2,l)(R,pi,a2,l){W,p3,a2,l){R,pi,au2) 1 2 3 4 5 6 A serial reordering IT exists: Pn ={W,p3,a2,1)(R,pi,a2,1)(W,p2l au 2)(R,Pl,ai, 2)(W,P2,a1:1)(W,p2,a2,1) 5 4 1 6 2 3 It can be shown that any serial reordering must have 4 inherit from 5; this follows from the fact that any serial reordering must order 6 prior to 2. However, restricting such a reordering to the prefix r of length 4 will not give a serial reordering. Continuing our example, we find p[4]* = ( i 2 ,p i , o 2 , l)(W,p2,au2)(W,p2,ai, l)(W,p2,a2,1) 4 1 2 3 which is clearly not serial. The reader may confirm that all prefixes of r are S C , for instance p[4] may be serially reordered as (W,P2,ai,2)(W,p2,a1,l)(W,p2,a2,l)(R,p1,a2,l) 1 2 3 4 We now present a seemingly different S C variant, P T S C , and prove that it is equivalent to D S C . Our motivation for presenting D S C in the guise of P T S C is to provide greater intuition regarding what type of behaviors these models allow and disallow. 4Lamport provides a very similar trace on page 187 of his book [89]. 2.3. Definition of Decisive Sequential Consistency 14 (a) coloured trace (b) the coloured trace reordered Figure 2.1: A trace with a prefix coloured black and the remainder coloured white, and the striping effect induced on a reordering of the trace. Definition 2 (past-time SC). A trace r is said to be past-time sequentially consistent (PTSC) if there exists a serial reordering TT of Y such that i i—j implies i < j. In this case we say that rr is a PTSC-reordering of r. Theorem 1. n is a DSC-reordering ofr if and only if IT is a PTSC-reordering of r. Proof. (=>) Suppose there exist i and j such that i i—j and i > j. Consider the prefix r[i — 1]. Clearly i j cannot hold, since i isn't an index of r[i — 1]. (•£=) Now assume TT is a P T S C -reordering of r . We prove by (decreasing) induction on £ that properties 1 and 2 from definition 1 hold w.r.t T[£]. For £ = |r| we have r[£] = r, hence the properties hold trivially. Now assume that the properties hold in T[£}. If T(£) is a write then there does not exist i such that £ i, thus T[£ — l]n satisfies both properties. Now if T(£) is a read, then T[£ — l ] 7 r is trivially serial, since removing a read from a serial trace will always yield a serial trace; property 2 is also satisfied given the inductive hypothesis. • Consider a trace T = T\T2 with DSC-reordering TT, and imagine that we colour the events of T\ and T2 black and white, respectively. From afar, r would appear as a single black segment ( T X ) followed by a single white segment (r 2 ) as in Fig. 2.1(a). Observing rn from a distance, however, one would see multiple black and white stripes as a result of the shuffling of black and white events. Fig. 2.1(b) depicts how this effect might appear. The striping, in some sense, captures the amount of shuffling between n and r 2 . We formalize this notion as follows. Definition 3 (shuffle degree). Let TT be a DSC-reordering of trace r, and let £ 6 {1 , . . . , | T | } . Let C£ : {1 , . . . , | T | } —> {black, white} be defined so that ce(i) = black iff-K~l{i) < £. Then the shuffle 2.3.1 DSC f c 2.3. Definition of Decisive Sequential Consistency 15 degree of (r, TT, £) is equal to \{i € {0 , . . . , |r|} | (i = 0 V ce(i) = black) A (ct(i + 1) = w/iite V z = |r|)}| (2.1) Intuitively, I gives the length of a prefix TI of r which we colour black, we colour the remainder of r white, and the shuffle degree is the resulting number of black stripes in the reordering rn, with the exception that we add 1 if the leftmost stripe is white. Definition 4 (DSC-bound,DSCfc). Let TT be a DSC-reordering of trace T, and let k be a positive integer. Then (r, TT) is said to have DSC-bound k if for all £ 6 {1 , . . . , |r|}, the shuffle degree of (r, TT, €) is not greater than k. The set DSCk is defined to be the set of all traces r having some DSC-reordering TT such that (r, TT) has DSC-bound k. So a D S C trace r has DSC-bound k if there exists some DSC-reordering TT such that no matter how we factor r = T\TI and perform our colouring exercise, we never see more than k black stripes in the reordered trace T " . Note that the D S C bound does not restrict how far out of sync (i.e. with respect to a reordering) two processors can be. It is the number of stripes in the shuffling that is bounded, not the number of events in each stripe. This contrasts with other proposed restrictions on S C [74,117]. A l l conceivable D S C protocols are DSCfc for some finite k.5 One can think of k as being the (maximum) number of points in logical time that the protocol maintains information about for future use by processors. Typically this information is implicit in protocol messages, message ordering constraints, and other features of the protocol state, and k depends on the message capacities of various communication resources. For example, in Sect. 2.4 we will see that seriality and D S C i are equivalent. Hence serial protocols are DSCi , which agrees with the fact that in such protocols all processors always exist at the same point in logical time. Later, in Sect. 2.3.3, we give a concrete example of a D S C ^ protocol (with k > 1) and how the value of k depends on its architecture. 2.3.2 Data Independence and DSC A n interesting question pertains to the space of protocols that are S C but not D S C : are these of any conceivable practical importance? In this section we answer this question negatively. 5This is formalized by Conjecture 1 on page 38. 2.3. Definition of Decisive Sequential Consistency 16 Data independence (DI) is a property that any real shared memory protocol possesses. Intu-itively, DI in a system (of any kind) means that variables of a certain type can only be nondetermin-istically assigned, copied, and outputted [124].6 When the system is a protocol, and the type is data values, DI requires that the protocol simply moves data items around, oblivious to the actual data values being moved. Not only is DI inherent in real protocols, it can be (and typically is) enforced by syntactic constraints on protocol descriptions [113,124]. Here we prove that DI precludes traces that are S C and not D S C . The basic idea behind our proof is very simple. Call a trace unambiguous if it has the feature that no two writes to the same address write the same value. For any non-DSC protocol trace r, DI guarantees the existence of an unambiguous trace r' with the same structure as r. This notion of "same structure", defined below via renaming functions, along with the fact that r is not D S C , imply that r' is also not D S C . It follows that r' must have a read event (R, p, a, v) that occurs before the unique event of (W, *, a, v). We then note that an appropriately selected prefix of r ' contains (R,p, a, v) but does not contain any event of (W, *, a, v), thus immediately ruling out the possibility that this prefix is S C . To formally define DI, it is convenient to do so for a countably infinite set of related protocols, each involving a different set of data values. Our definitions roughly follow Qadeer [113]. Definition 5 (value-parameterized protocol family). A value-parameterized protocol family is a mapping V that takes each v > 1 to a protocol V(v) involving v data values. Renaming functions are used to formally define a connection between the traces of the constituent protocols of a value-parameterized protocol family. They take an address and a data value, and return another data value, thusly renaming the address's data. Definition 6 (renaming function). Given m, v, and v' such that m > 1 and 1 < v < v', we call a Junction A : N m x Nv> —> N „ a renaming function. We extend the renaming function A to a function M —* M by decreeing X((o,p,j,d)) = (o,p,j, X(j, d)). We further extend A to a function M* —• M* by applying A to each event in the trace. We are now equipped to define data independence. 6Some literature also allows for equality tests on the type; we do not. 2.3. Definition of Decisive Sequential Consistency 17 Definition 7 (data independence). A value-parameterized protocol family V is said to be data independent if for all v > 1, for any trace r ofV(v), there exists v' > v, a renaming function A : N m x Nvi —> Nv, and an unambiguous trace r' ofV(v') such that A ( T ' ) = r. Theorem 2. Let V be a data independent value-parameterized family of protocols. Then V is SC if and only ifV is DSC. Proof. (<=) Trivial (=>) Suppose, on the contrary, there exists a value-parameterized family V that is S C and DI, but not D S C . Then there exists v > 1 and a trace r of V(v) such that r is S C but not D S C . By data independence, there exists v' > v, an unambiguous trace r' of V(v'), and a renaming function A : N m x Nv> —> N„ such that A(r') = r. It follows that r' is not D S C , since applying A to a DSC-reordering of r' would yield a DSC-reordering of r. r' must have a serial reordering TT, and, from Theorem 1, TT is not a P T S C reordering. Hence there exists i, j e {1 , . . . , \T'\} such that i i—j and i > j. Let (FF, p, a, d) = T'(I). Since r' is unambiguous, there exists no il ^ i such that T ' (Z ' ) is a write of value d to address a. Consider the prefix T'\J}\ this string has no such write, yet it does contain T ' ( J ) which is a read of d from address a. Therefore, r'\j] cannot be S C , which contradicts V being S C , since it is a trace of V(v'). • 2.3.3 Example: Lazy Caching As an example of the expressiveness of D S C we show that the well-studied S C protocol Lazy Caching [6] is D S C . Our description of Lazy Caching follows later papers [11,99].7 The architecture of Lazy Caching is shown in Fig. 2.2. The processors pi, •.. ,pn are of course the clients of the protocol and not actually part of the protocol. Each processor pi has its own private cache caches, the memory events of pi can be thought of as occurring on the interface between pi and cachei. Each cachei communicates with main memory Mem via F I F O queues outi and irij. The former of these queues buffers messages en-route from cachei to Mem, while the latter buffers messages traveling in the opposite direction. Let P, A, and V be the set of processors, addresses, and data values. For each (i, j, d) € P x A x V, Lazy Caching exhibits the familiar memory actions (R, i, j , d) and (W, i, j, d), as well 7 The primary difference between the description of the original Lazy Caching paper [6] and the later papers [11,99] is that in the former, the externally visible memory events are split into requests and returns, and hence SC is also defined over this alphabet. In the latter, the visible events are from our M. 2.3. Definition of Decisive Sequential Consistency 18 Figure 2.2: The architecture of Lazy Caching as the following four internal events. • Memory Write, (a, d). A message is dequeued from outi and used to update a location at Mem. This also elicits a message from Mem to each cache, via the respective in FIFOs. • MemoryRead^a). A cache line is sent from Mem to cachei by appending to m*. • CacheUpdate^a, d). A new cache line is brought into cachei by dequeuing a message from • Cachelnvalidatej(a). Here cachei nondeterministically invalidates one of its addresses. A n operational description of Lazy Caching is given in Fig. 2.3 using guarded commands. Lazy Caching has received considerable interest from the formal verification community. A special issue of the journal Distributed Computing, dedicated to proof techniques for this protocol, has been published [99]. Arons also considers Lazy Caching for her proof technique [11]. The challenge in verifying S C of Lazy Caching stems from the fact that the the reorderings involved to "witness" S C are relatively convoluted. In particular, Lazy Caching is not simple S C (defined formally in Def. 27), where writes to the same address cannot be reordered. Hence the following theorem supports the thesis that D S C has a high "reordering expressivity". 2.4. Complexity of Trace Problems 19 Event Guard Action (R,i,j, d) cachei [j] i s v a n d A cachei\j] = d A no starred entries in irii A outi is empty none (W,i,j,d) true ouij := append(outi,(j,d)) Memory Write j (a, d) head(outi) = (a, d) Mem[a] := d; outi '•= tail(outi); Vfc ^ z : irifc := append(irik, (a,d)); irii := append (irii, (a, d,*)) MemoryRead^ (a) cachei [j] is invalid int :— append(ini, (a, Mem[a])) CacheUpdatej(a, d) head(irii) G {(a, d), (a, d, *)} int :— tail(ini); cachei(a) := d; mark cachei(a) valid Cachelnvalidatej (a) cachei [j] is valid mark cachei(a) invalid Figure 2.3: Lazy Caching in guarded commands; this description is from Arons' paper [11]. Theorem 3. Lazy Caching is DSCr+ng+i, where r and I are the respective capacities of the in and out FIFOs, and n is the number of processors. Proof. We prove this theorem on page 37, after we develop the view window machinery used in its proof. • It is important to note that D S C r + n ^ + i contains many traces not admitted by Lazy Caching. In fact, even D S C 2 has traces with this property; in Example 3 of Sect. 2.5 we will see that the trace ( W i l , l , l ) ( i 2 , l , l , l ) ( W ; 2 ,1 ,2 )^ ,2 ,1 ,1 ) is D S C 2 ; this trace is given by Afek et al. as an example of a trace that Lazy Caching does not admit [6]. 2.4 Complexity of Trace Problems Given a set A C M*, the trace problem for A is the decision problem that asks, given trace T , if T 6 A. In this section, we look at the complexity of the trace problem for D S C and DSCfe. One might be interested in solving the trace problem for traces obtained by random or user-directed pre-silicon simulation or so-called post-silicon verification [70]. 2.4. Complexity of Trace Problems 20 The trace problem for S C was explored by Gibbons and Korach [66], in which several quite restricted versions of the problem are proven to be NP-complete. 8 Here we show that the problem remains NP-complete when we consider D S C traces. In fact, we prove the stronger theorem that the trace problem for DSCfc is NP-complete for each k > 2. Our reduction is inspired by the reduction employed in the proof of Gibbons and Korach's Theorem 2.1 [66], however, in order that the resulting trace has D S C bound 2, several nontrivial modifications are necessary. First we show that the trace problem for D S C i can be solved in linear time; this result stems from the following important lemma. L e m m a 1. DSCi are precisely the serial traces. Proof. Let r be a trace of D S C i . Then there exists a DSC-reordering n of r such that shuffle degree of (r, 7r, I) is 1 for all values of I. Clearly this holds if and only if tt is the identity permutation. • Theorem 4. The trace problem for DSC\ can be solved in linear time. Proof. From Lemma 1, the problem is equivalent to checking for seriality. A linear time algorithm simply scans the trace from left to right. Each address mentioned in the trace corresponds to an address used by the algorithm. Every time a write is encountered, the address is updated with the written value. Every time a read is encountered, the algorithm simply checks that the read value is the value currently stored at the relevant address. • Our NP-completeness proof is quite involved; we first introduce a couple more definitions. Some of the proofs in this section (as well as those of future sections) involve reasoning how events from a trace r' can be/must be DSC-reordered into a trace r / 7 r . We will desire certain substrings r of T' to be atomic in the sense that r is always guaranteed to be a substring of r , 7 r . In other words, we would like to preclude the possibility that in r / 7 r , r is "shuffled" with other events. This is achieved by a mechanism of Alur et al.'s [8], which requires the introduction of a fresh address lock. 8It should be noted that Gibbons and Korach [66] use a slightly different formalism. Rather than a single trace of memory events, their input is a set of traces in which each trace is the history of a single processor. The difference, then, is that they don't have any information about relative orderings of events at different processors. However, all their results apply to our "single trace" formalism; since the definition of SC doesn't call upon the relative ordering of events at different processors, we may simply transform one of our traces into a set of histories in the obvious way. 2.4. Complexity of Trace Problems 21 Definition 8 (atomicity construct). Given a memory trace r such that all events ofr are performed by the same processor p, define the atomicity constmct (r) = (W,p, lock,p) T (R,p, lock,p) Intuitively, the atomicity constmct has p write its name into lock before r , and then read its name back after r . Atomicity will only be guaranteed if all processors follow the same protocol. To avoid cluttering our presentation, we decree that all events e that are not explicitly nested in an atomicity construct will implicitly be replaced with (e), to ensure that the substrings that need to be atomic are such. Hence, from now on we tacitly assume that atomicity constructs yield atomic-ity. Also, we note that though Alur et al. [8] employ this construct for reasoning about sequential consistency, it adapts to D S C since all reads of lock inherit from previous writes. For brevity, some-times we will omit processor names from the events inside an atomicity construct (since they are necessarily all the same), and subscript the constmct itself with the processor name. For example ({W,a, v)(R, a',v')(R, a", v"))p is shorthand for ((W,p, a, v)(R,p, a',v')(R,p, a", v")). Our reduction involves the well-known NP-complete problem 3 S A T , defined as follows. Let X = {x\,..., xn} be a set of boolean variables. A literal is a variable X j or its negation x j , a clause is a disjunction of literals, and a CNF formula is a conjunction of clauses. Finally, a 3CNF formula is simply a C N F formula in which all clauses have exactly 3 literals. The decision problem 3 S A T asks, given a 3 C N F formula </?, if there exists an assignment assign : X —> B such that <p evaluates to T under assign. If such an assign exists, ip is said to be satisfiable, otherwise (p is unsatisfiable. Given a 3 C N F formula </?, we will construct a trace such that (p is satisfiable if and only if TV is D S C . Let {c i , . . . , cm} be the set of clauses of ip. Then rv involves the following addresses. • A n address X{ for each variable X j € X. The values written to X{ are the booleans B. We call these variable addresses. • A n address Cj for each clause Cj of ip. These addresses either store T (indicating the clause has been satisfied) or X (used to invalidate previous written Ts in the reordering). We call these clause addresses. The processors of are: 2.4. Complexity of Trace Problems 22 <(i?,xu,pol j(U)) {W,Cj,T)) <CR,x„,poL») (W,cjtT)) ((R^x^poljiw)) (W,Cj,T Figure 2.4: The trace ec(j). • For each Xi € X and each b 6 B , a processor named x^1. This processor is responsible for writing value b to address X j . • A processor x\ for each i, j such that variable X j appears in clause Cj. • A processor named q, which is responsible for checking that all clauses are satisfied. We build by defining several of its constituent subtraces. For a variable X j 6 X and b G B , Intuitively, eva(i, 6) assigns X to all clause addresses and writes b into address xu all atomically. eva stands for encode variable assignment. For each clause Cj of we define a trace ec(j) in Fig. 2.4. Here the variables of Cj are x u , x v , x w € X, and polj(u) is the polarity of the literal of xu in Cj, i.e. po\j(u) = F if x u is negated in Cj and po\j(u) = T if xu is not negated in Cj. po\j(v) and po\j(w) are defined analo-gously for the variables xv and xw. The events of each row are all done by the processor named on the left, hence processor names are omitted from the events. Intuitively, ec(j) has atomicity con-structs for three processors, and each will write T to address Cj if it occurs in the phase of a variable address that satisfies the clause Cj; ec stands for encode clause. We may now define TV. Note that the relative ordering of atomicity constructs across the three lines defining will prove to be important, however many of the relative orderings within each line are arbitrary. Definition 9 (T^,). Given a 3CNF formula ip over variables X = { x i , . . . , x n } and with clauses { c i , . . . , c m } , we define define r v = n iL i (eva(xi, F)eva(aji, T)) r m i « ( i ) 2.4. Complexity of Trace Problems 23 L e m m a 2. \T<P\ = 0(\ip\ ). Proof. Obvious. • Our two key lemmas regarding the relationship between ip and TV are now stated and proven. L e m m a 3. If 3 CNF formula cp is satisfiable, then Tv is DSC2-Proof. Let a : X —• B be an assignment that satisfies (p. Given a clause Cj of </?, let Ij,I'j C {1 , . . . , n) be the indices of the variables with literals appearing in Cj that are satisfied by a (resp. unsatisfied by a), i.e. the set of (indices of) variables appearing in Cj is precisely Ij U Ij. Note that since a satisfies ip it also satisfies each clause, thus we have Ij ^ 0. Now define ec(j)° = ec(j)U*,{x{ \ ielj},*,*) and ec(j)1 = ec(j) T (*, {x{ | i E I'j}, *, *) Note that it is possible that 7j = 0, hence ec(j)1 could be empty. Then let TT be the DSC-reordering of TV defined by n = JJeva(xj,a(xi)) (2.2a) i=l m ]Jec(i)0 (2.2b) i=i (j[(R,Ci,T)j (2.2c) n JJeva(x i,a(x i)) (2.2d) i=l m n^w1 (2-2e) i=l Here we place a bar over a member of E to obtain the other member. That TT is a DSC-reordering follows from the facts that each clause address must be assigned T in (2.2b), hence the reads of (2.2c) are all satisfied, and all reads in (2.2e) inherit from events in (2.2d). Also, all reads of (2.2b) inherit from writes in (2.2a), since a satisfies every clause. 2.4. Complexity of Trace Problems 24 We now argue that (T^, TT) has DSC-bound 2. Consider colouring TV such that a prefix is black and the remainder is white. In general, the induced striping on will involve at most 2 black stripes, and if there are exactly 2, one of the black stripes will be at the start of TVN. Let us call these black stripes bi and 62, respectively. Note that in some cases these stripes can be empty.9 61 starts at the beginning of T^, i.e. (2.2a), and 62 starts at the beginning of (2.2d). It follows that the shuffle degree is always at most 2, and thus (TV, TT) has DSC-bound 2. • L e m m a 4. / / 3 CNF formula <7> ci> ~0) therein. Clearly, prior to o, for each clause Cj of <p, there must exist a write of T to the address Cj. Now, consider the earliest (in r ¥ , 7 r ) write w to a clause address Cj such that an event of a inherits from w. Then r v , 7 r has the form Pi w [32 a f33 for some traces 8\, 62, and [3%. Now 02 must not have any writes to variable addresses, since any such write occurs in an atomicity construct eva(z, b) which includes events that overwrite all clause addresses with X , and hence o would not inherit from w. Further, the trace V0B2 contains a write of T to every clause address. Define a : X —• B such that for each X j 6 X, a(xi) is the value written in the rightmost (of the at least one and at most two) write to address x, in Pi. It follows that all clauses are satisfied by a, and thus <p is satisfiable. • We may now state and prove our desired results. Theorem 5. The following are NP-complete • the trace problem for DSCk, where k > 2. • the trace problem for DSC 9&2 will be empty in two cases: 1) all of TV is black, or 2) the black prefix is so short as to only involve events of eva(a;i, F), and also a(a;i) = F. Furthermore, there is a case in which the beginning of is white, i.e. bi is empty. This occurs when the black prefix is so short as to only involve events of eva(a;i, F), and a(x\) = T , which results in all black events from the beginning of TV contributing to 62-2.5. Complexity of Model Checking DSCk 25 Proof. First we note that any of these problems is in NP. For a trace T , the witness is a D S C -reordering TT, with the additional requirement that (T,TT) has DSC-bound fc if we are checking DSCfc. It is straightforward to check, in polynomial time, if a purported witness TT has the nec-essary properties. We now show that the trace problem for D S C 2 is NP-hard, by reducing 3 S A T to this problem. From Lemmas 3 and 4, given an instance <p of 3 S A T , we may construct a trace TV such that if <p is satisfiable, then TV is D S C 2 , otherwise is not even S C . Furthermore, from Lemma 2, TV has length polynomial in \tp\, and clearly it can be constructed in time proportional to its length. Finally, because of the following containments D S C 2 C D S C 3 C D S C 4 C • • • C D S C C S C the same reduction works for DSCfc where k > 2, as well as for unbounded D S C , hence these problems are also NP-hard. • 2.5 Complexity of Model Checking DSC f c This section is devoted to proving that for any fixed k, the problem of checking if a given protocol V is DSCfc is decidable. The main result is Theorem 8, which states that this problem is in E X P S P A C E . Let V be a protocol involving n processors, m addresses, and v data values, let fc be a positive integer, and suppose we wish to decide if V is DSCfc. Let DSCfc(n, m, v) be the set of all D S C traces with DSC-bound fc over M(Nn, N m , Nv). We prove Theorem 8 by showing that there exists a protocol Qkin, m, v) such that • traces(Qk(n, m,v)) = DSCfc(n, m, v), and • the number of states of Qk(n, m, v) is 2 ° ^ l o § l p D . Thus, we may decide our problem by checking the finite automata language containment traces(V) C C(Qk{n,m,v)). Since deciding finite automata language containment is P S P A C E -complete [122], and our containment instance is exponential in the size of our original query (i.e. the input of which is V), the implied algorithm executes in exponential space. A n important notion in defining the state space of traces(Qk(n, m, v)) is that of the view window, which is expounded on in Sect. 2.5.1. 2.5. Complexity of Model Checking DSCk 26 We now proceed with the details of the proof. For the time being, let us fix n, m, and v, so that M represents M.(Nn, N m , Nv), and trace will mean string over this M. As motivation, we first describe an infinite-state protocol, Q^, whose trace set is the set of all D S C traces, and then consider how the state space of Goo could be made finite. Let Q^, = (SQO, M, 5^, e), where • SQQ is the (countably infinite) set of all serial traces over M. • C 5 x M x 5 includes exactly those triples (a, a , a') where a' is a serial trace obtained by inserting a at some position j in a, where j > lpa(a, proc(a)). • e is the empty trace Then, it can be shown by induction on | r | that C l a i m 1. (e, r , a) € 8^ if and only if a is a DSC reordering of r. Our claim implies that the trace set of the protocol Goo is exactly the set of D S C traces. In-tuitively, to obtain a (restricted) finite state version of Goo, it is necessary to avoid storing all of a serial trace a in the state. For this purpose, in Sect. 2.5.1 we develop a data structure we call a view window that is a condensed version of a serial trace. View windows generalize Braun et al.'s con-cept of the window [22]. Also in Sect. 2.5.1 we define operations that morph view windows; these operations roughly correspond to dropping information, performing memory events, and advancing processors in logical time. 2.5.1 View Windows A view window is an abstraction of a serial trace a that can be used to determine, for a few positions j and any memory action a, whether the string a' obtained from a by inserting a at position j is serial. To this end, a view window contains an array of bookkeeping information called a view (of position j). For each address b, the view contains the following information: • The value of the last write operation to b before position j in a. This is used to determine the acceptable value of a read operation to address b, inserted at position j . • A pair of tags. One tag indicates whether or not the predicate IR(a,j,b) holds; that is, whether position j is between a write to address b in a and a read that inherits from the write. 2.5. Complexity of Model Checking DSCk 27 This tag can be used to determine whether the protocol is free to insert a write operation to address b at position j . The tag has value F (free to write) or O (reads only). The other tag is needed to help update the FjO tag. It has value L (last) or ./V (not last). In addition to the views, the view window contains additional information, called the processor position function, which is used to determine whether insertion of a respects processor order. We now formally define view windows. Define the set of tagged values T = (Nv U {-L}) x {L, N} x {O, F}. Given a tagged value z = (v, i i , t2), we extract the components via val(z) = v, tag^z) = ti, and tag2(z) = t2. A view is a function v: N m —> T. Given a serial trace o £ M*, a (non-contiguous) subsequence ps of 0 , . . . , \o\ such that ps includes \o\ is called a position sequence Definition 10 (VW-set ,VW). Given serial trace o and a position sequence ps for o, we define the VW-set VW(o, ps) to be the set of all pairs (v, Ip) that satisfy the following: v is a sequence of views with |v| = |ps| defined as follows. 1. val(v(i)(b)) = val(o(lw(cr,ps(i),b))) 4. ps(lp(p)) > lpa(o,p)for all p € N n . A pair w = (v, Ip) is called a view window (VW) (of o) if there exists ps such that (v, Ip) € VW(cr, ps). The size of a VW w = (v, Ip) is defined to be \w\ = |v|. Example 1. An example of a serial trace o £ A4(N3, N2, N2)*, a position sequence ps for o, and a VW (v, Ip) € VW(o, ps) are given in Fig. 2.5. Fig. 2.5(a) is the trace a. The top row of Fig. 2.5(b) are the indices of ps, the second row is ps, the third row is v (in which each view v is expressed as a column vector [v(l) v(2)]T), and the fourth row specifies Ip. All entries in Fig. 2.5(b) are aligned vertically with their corresponding position in o. (for a). L if i = 1 V [i > 1 A ps(i - 1) < lw(o, ps(i), 6)] otherwise and Ip, called the processor position function is a function N n —> N | v | which must satisfy 2.5. Complexity of Model Checking DSCk 28 Recall that in the infinite-state protocol Qoo (discussed on page 26), upon each transition, the state (a serial trace) is updated by insertion of a memory action. In a protocol that abstracts states as view windows, we need operations (state transitions) that update view windows upon insertion of a memory action. We define five such operations as functions that take V W s to V W s . The delete function removes a view from a view window (in order to keep the view small). The insert function inserts a view into a view window (corresponding to the insertion of a memory action a into the serial trace that the view window abstracts). The hop function makes it possible to advance lp(p) for any processor p (in order that an operation of processor p is inserted after the appropriate view). Finally, the unfree and bind operations update the view tags appropriately. Example applications of these functions are given in Example 2. We now formally define the five operations. In all descriptions, (v', Ip') is the V W returned by the function, and p and b may be any processor and address, respectively. • delete((v, Ip), /i) requires h G N | v | _ i . The new view v' is defined according to v(j)(6) iij<h (val(v(h + l)(b)),L, tag2(v(h + 1)(&))) if j = h Ata9l(y(h)(b))=L A tagx(y(h + l)(b)) = N [ v(j + l)(b) otherwise Finally, for all p € N n we have \ p'(p) = \p(p) if lp(p) < h, and lp'(p) = lp(p) — 1 otherwise. hop((\/,\p),p,h) requires \p(p) < h < |v| . hop leaves v unchanged, i.e. v' — v. Ip' is everywhere equal to Ip with the exception lp'(p) = h. insert((v, lp),p, v) is called against a view v. Intuitively, v' is obtained from v by inserting v at position lp(p). Ip' is defined by \p'(q) = lp(g) if Ip(cjr) < lp(p) A p ^ q; otherwise \p'(q) = \p(p) + 1. un/ree((v, Ip),p, b): L e t 1 0 j = m a x ( { i | i < lp(p) A to31(v(i)(6)) = L}). 10unfree is only used when lp(p) > 1 and Def. 10.2 ensures that to51(v(l)(6)) = L, hence j is well-defined. 2.5. Complexity of Model Checking DSCk 29 Then v' is everywhere equal to v, with the possible exceptions: for all k G {j,..., lp(p) — 1} we have v'(fc)(6) = (val(v(k)(b)), tag1(v(k)(b)), O). Finally, Ip' is simply equal to Ip. • bind((v, Ip),p, b, v): Here we require v G N „ . This function leaves Ip unchanged, and if lp(p) = |v|, then v' = v. Otherwise, let j be minimal such that j > lp(p) and iag 1(v(j)(6)) = L ; if no such j exists take j = |v| + 1. Then v' is the same as v, with the exception that for all ke {lp(p) + l , . . . , j - l } w e h a v e v ' ( f c ) ( 6 ) = (v,N,F). We define the partial order < v w on V W s such that x <vw y iff y can be obtained from a; by 0 or more delete and hop operations. Similarly to the protocol Goo, wherein the protocol "evolves" on memory actions from serial trace to serial trace, we can also define what it means to evolve on a memory action from V W to V W . Definition 11. Given VWs w = (v, Ip) and w' and a G M, we say that w can directly cv-evolve to w' if the following conditions are satisfied. 1. If a = (R,p,b,v), then we require v = val(v(\p(p))(b)) ^ _L, and the following equation must hold: w' — unfree(insert(w,p,u),p,b) where v is given by u(d) = (val(v(\p(p))(a)),N, tag2(v(\p(p))(a))) for each a G Nm. 2. Ifa = (W, p, b, v), then we must have (a) tag2(v(\p(p))(b)) = F (b) w' = bind (ins ert(w,p, u),p, b, v), where u is given by v(a) = (u, L,F) if a = b (val(v(\p(p))(a)), N, tag2(v(\p(p))(a))) otherwise If there exists w' such that w directly a-evolves to w', we say that w is directly a-enabled. If there exist wi = (vi, \pi) and w2 = (v2, lp 2 ) such that w <vw u>i and w2 <vw w', and w\ directly in (a) cr (VP, 2,1,2) ( V F , l , l , l ) ( V F , l , 2 , l ) ( t f , l , l , l ) (R, 1,2,1) (W, 2, 2, 2 ) ( f l , 2 , l , l ) ( f l , l , 2 , 2 ) 9 I 8 TO s-s" fa Co o J Ps(j) (b) v(j) IP _ 1 (J ) 1 2 0 1 "±, L F "2, LF ±,LF ± 0 {3} 1 2 0 1 X , L F " "2, L F _ L , L F ± 4 5 "1, L O 1, NO' 1 , L 0 0 1,NF 0 3 4 4 5 1, LO "1, NO' l,LO l,NF 0 {3} 5 7 1, JVF" 2, L 0 {2} " 1, NF 2, NF " {1} ' psi(i) (c) V i ( j ) 2 , L F "{1,2}" (d) 0-2 (VP, 2,1,2) ( V P , l , l , l ) ( V P , l , 2 , l ) ( i ? , l , l , l ) (fi, 1,2,1) (W, 3,2,4) (VP, 2,2,2)(R, 2,1,1) ( f l , l , 2 , 2 ) J PS 2(j) (e) v 2 ( j ) 1 2 0 1 ± , L F 2, L F ± , L F ± 3 4 1, LO" l , L O 4 5 1, iVO" l , i V F 5 6 4, L F {3} " 6 9 1, NF' 2, L F '{1,2}" Figure 2.5: V W and V W operations referred to in Examples 1 and 2 2.5. Complexity of Model Checking DSCk 31 OL-evolves to w2, we say w cv-evolves to w', denoted w w'. If there exists w' such that w ~*a w' we say that w is a-enabled. Example 2. Continuing with Example 1, let w be the VW of Fig. 2.5(b). Then Fig. 2.5(c) gives the VW wi = ( v i j p j ) = hop (delete (w, 5), 3,4), along with position sequence psx such that w\ G VW(o, ps x). Fig. 2.5(d) is a serial string o2 obtained by performing an insertion of (W, 3, 2,4) against o. Finally, Fig. 2.5(e) presents a position sequence ps 2 for o2 and a VW w2 = ( v 2 , lp 2 ) 6 VW(o2, ps 2), where w\ directly (W, 3,2,4.)-evolves to w2. Some other points of note here are: w ~*(w,3,2,4) w2 and w <vw w\. Also, the set of all a such that w\ is directly a-enabled is (W, 1, *, *) U (W, 2, *, *) U (W, 3, 2, *)U {(R, 1,1,1), (R, 1,2,2), (R, 2,1,1), (R, 2,2,2), (R, 3,1,1), (R, 3,2,1)} This completes our description of operations on view windows and the associated a-evolves relation. Before proving properties of this relation in the rest of this section, we provide some informal intuition. First we note that we can generalize the notion of cv-evolves to sequences r of memory actions, where w w' if and only if there is a sequence wo, w\,... w\T\ of view windows such that w = wo, w' = w\T\, and Wi-\ ~"*T(i) for 1 < i < | r | . Let we be the view window of the empty trace, that is, we = (yo, lp 0 ) where vo is a singleton view sequence with vo(b) = (±, L, F) for each address b and lpo(p) = 1 for all p G N n . It turns out that C l a i m 2. For all traces T, we ^>T w if and only ifr is DSC and w is a view window of T77 for some DSC reordering TC of r. Claim 2 is analogous to Claim 1 for serial traces given on page 26, except the former pertains to view windows. Roughly, Claim 2 can be proved by induction on | r | , using the following theorem. Theorem 6. Let r have DSC-reordering TT, w be a VWofr11, and a G M. be such that w ~-»a w'. Then there exists a DSC-reordering n' ofr' = ra such that r1*' = T N , and w' is a VWofr'n . Proof. From Def. 11, there exist V W s w\ and w2 such that w <vw w\ and w2 <vw w', and w\ directly a-evolves to w2. From Lemma 5 we have that w\ is a V W of T*. Choose ps to be a position sequence such that w\ = (vi, lp x) G VW(rn, ps), and define (o,p,b,v) — a. Let TT' be the permutation of T' such that T'« is the string obtained by inserting a into at position lpi(p). From this definition of TT' we have r 7 r ' = r 7 7 . 2.5. Complexity of Model Checking DSCk 32 We must show that TT' is a DSC-reordering of r ' . TT' adheres to the processor order of r ' , since TT adheres to the processor order of r , and by the Def. 10 we have ps(lp(p)) > lpa(rn,p), and Lemma 6 guarantees that r / 7 r is serial. Finally, from Lemma 7 we have that w2 is a V W of r / 7 r , and hence by Lemma 5 we have w' is a V W of r / 7 r . • L e m m a 5. If w is a VWofa, and w <vw w' then w' is a VWofa. Proof. We show that if w is a V W of a, then applying a single hop or delete operation gives another V W of cr; the lemma follows by induction. Let ps be such that w G VW(a, ps). Case: w' = (v',lp') = hop(w,p,h). Then we have lp(p) < lp'(p) = h < |v'|, this being the sole discrepancy between w and w'. Let x = min({i | lpa(a,p) < ps(i)} U {0}). Since w G VW(a, ps), we have from Def. 10 that lp(p) > x, and thus also lp'(p) > x. Thus w' G VW(a, ps). Case: w' = (v', Ip') = delete(w, h). Let ps' be ps with the /ith entry removed. We claim that w' G VW(a, ps'), and show that v' and Ip' are compliant with the conditions of Def. 10. Note that since delete requires h < |v|, we have that ps' has \a\ as the final element, and hence ps' is a legal position sequence for a. Let v be v with v(h) removed, and let ps' be ps with the hth entry removed. Clearly, for all i G N | p s / | we have val(v(i)(b)) = a(lw(a, ps'(i), b)). Further, tag2(v(i){b)) = O iff IR(a, ps'(z), b). Thus v' and ps' are compliant with Def. 10(1) and Def. 10(3), since v' only differs from v in tag1 components. In general v does not satisfy Def. 10(2). This is because the boolean expression in Def. 10(2) depends on other entries in the position sequence, which was altered. The only case where v can potentially be in violation is at position h, which can be seen as follows. We have 0(h) = v(h + 1) and ps'(h) = ps(h + 1). It is possible that for some address b, we have that ps(h — 1) < lw(a, ps(h), b) = lw(a, ps(h + 1), b) (taking ps(0) = 0 if necessary) which implies both ia5 1(v(/i)(6)) = N and ps'(h — 1) < lw(a, ps'(h), b). In this case we find a noncompliance. However, delete returns v', which differs from v by correcting precisely such scenarios. Therefore v' is compliant. Since Ip' is obtained from Ip by simply decrementing values where appropriate to reflect the deleted view, it follows that Ip' adheres to Def. 10(4). Again we conclude that w' G VW(a, ps). • L e m m a 6. Suppose w = (v, Ip) G VW(a, ps) and w is directly a-enabled. Then the string a' obtained by inserting a at position ps(lp(proc(a))) in a is serial. 2.5. Complexity of Model Checking DSCk 33 Proof Since o is serial, we must argue that the insertion of a = (o, p, b, v) maintains seriality. We case-split on op(a). Suppose a is a read. From Def. 11 we have val(y(\p(p))(b)) = v ^ J_, and from Def. 10 we have that val(v(\p(p))(b)) = val(lw(o, ps(lp(p)), b)). Thus o' maintains seriality in this case. Now assume a is a write. From Def. 11 we have tag2(v(\p(p))(b)) = F, hence from Def. 10 we have -<IR(o, ps(lp(p)), b). Thus the insertion of a will not interfere with any inheritance from lw(o, ps(lp(p)), b), or any other write to address b. Therefore a' is serial in both cases. • L e m m a 7. Suppose w = (v, Ip) € VW(o, ps) and w directly a-evolves to w'. Letting p = proc(a), let o' he obtained by inserting a at position ps(lp(p)), and let ps' be the position sequence of o' obtained by inserting ps(lp(p)) + l into ps at \p(p), and then incrementing all entries right of\p(p).11 Then w' G VW{o', ps'). Proof. Let (o, p, b, v) = a. We note that VW(o', ps') is well-defined, since from Lemma 6 we have cr' serial. We case split on o. For convenience in this proof, we introduce the function c : N | p s ' | —> N | p s | given by c(i) = i when i < \p(p) or c(i) = i — 1 otherwise. Also, v is the inserted view, as in Def. 11. Case o = R: Clearly Def. 10(1) is satisfied w.r.t v', since for all addresses a we have val(v(a)) = val(v(\p(p))(a)) . This follows from the fact that lw(o', ps'(lp'(p)), a) = lw(o, ps(lp(p)), a), which also implies that Def. 10(2) is satisfied, since for all addresses a we have tagl{y(a)) = N and lp'(p) > 1. Now for all addresses a ^ b and indexes i of ps', we have IR(o', ps'(i), a) o IR(o, ps(c(z')), a). Thus, the fact that for all such a, we have £ a c / 2 ( v ' ( z ) ( a ) ) = tag2{v(c(i))(a)) is compliant with Def. 10(3). Also, if £ = lr(o, lw(o, Ip(p), b)) > ps(lp(p)), then we have both IR(a', ps'(z'), b) <£> IR(o, ps(c(z)), b) and tag2(y'{i)(b)) = tag2(y(c(i))(b)) for all indexes i of ps'. Then Def. 10(3) is satisfied. However, if £ < ps(lp(p)) then for each i in the nonempty set 7 = {i \ i < lp'(p) A£< ps'(i)} we have IR(o', ps'(i),b) A ~^IR(o, ps(c(i)),b). In this case unfree has the effect that for all i G I, tag2(v'(i)(b)) = O, which hence pre-serves compliance with Def. 10(3). Finally, we have Def. 10(4) satisfied w.r.t ps' and Ip' since ps'(lp'(p)) = ps(lp(j))) + l = lpa(o',p). A similarly simple argument handles the other processors. Case o = W: Similar to the previous case, Def. 10(1) is satisfied w.r.t v'. The slight complica-tion here is that for a l H in I = {lp'(p), . . . ,jmin} where nI.e. ps' = ps(l),...', ps(lp(p)), ps(lp(p)) + 1, . . . , ps(|ps|) + 1 2.5. Complexity of Model Checking DSCk 34 jmin = min({ j | j > lp'(p) A tag x(v'(j)(b)) = L) U {|V'| + 1}) - 1 we have lw{a\ ps'(z),fe) = ps'(lp'(p)) ^ lw(a, ps(c(i)),6). However, Def. 11(2) correctly sets val(v(b)) = val(cr'(ps'(\p'(p)))) v, and bind sets val(v'(i)(b)) = v for all i € I. Now for all addresses a ^ b, we have lw(a', ps'(lp'(p)), a) = Zu;(cr, ps(lp(p)), a), and since we have tagl(u(a)) = N and lp'(p) > 1, Def. 10(2) is satisfies w.r.t all such a. For address b, we have lw(a', ps'(lp'(p)), b) = ps'(lp'(p)) = ps'(lp'(p) - 1) + 1, and thus, ps'(lp'(p) - 1) < lw(a', ps'(lp'(p)), b). Thus the assignment tag^val^uip))) = Lis consistent with Def. 10(2). Similar to the previous case, we have Def. 10(3) satisfied. Def. 11(2) assigns tag2(V\i)(a)) = tag2(v(c(i))(a)) for all addresses a and indexes i of ps', i.e. the tag2 components are preserved. The correctness of this preservation follows from the fact that for all such a and i we have IR(a', ps'(i),a) = IR(a, ps(c(i)),a). The argument that Def. 10(4) is satisfied is the same as in the previous case. For both cases, we conclude that w' e VW(a', ps'). • 2.5.2 VW-Boundedness In this section we define the concept of the VW-bound of a D S C trace, and show that this notion corresponds to the DSC-bound. Definition 12 (VW-bound) . Let r he a trace such that there exists VWs WQ, W\, ..., w\T\ and k > 1 such that 1. u>o = w€ (the view window of the empty trace), 2. for all 1 < i < | r | we have Wi-\ ~~*T(i) wi> and 3. for all 1 < i < | r | we have \wi\ < k, Then we say that r has VW-bound k. Theorem 7. A trace r has VW-bound k if and only if r is DSCk-Proof. (<=) Let TT be a DSC-reordering of r such that (r, TT) has DSC-bound k. For each 0 < £ < | r | , we define a position sequence ps^ for T[£]N. Consider the striping induced on r 7 1' by colouring the events of T[£] black and the remaining suffix white. The colouring of rn defines ps^ as follows. Note that r[£]n can be obtained from rn by removing all white events; we include index i in ps^ 2.5. Complexity of Model Checking DSCk 35 (1,LF) IPo 1 {1,2} r[ir (W, 1,1,1) vi ( ± , L F ) ( 1 , L F ) ipr1 {2} {1} (W, 1,1,1) (fl, 1,1,1) V2 ( J _ , L F ) ( 1 , L F ) IP2 1 {2} {1} ( W , 2 , l , 2 ) (W, 1,1,1) (it, 1,1,1) V3 ( 2 , L F ) ( 1 , L F ) {2} {1} ( W , 2 , l , 2 ) (W, 1,1,1) (fl, 1,1,1) (#,2,1,1) v 4 ( 1 , 1 0 ) (1,NF) I P 4 1 {1} {2} Figure 2.6: The DSC2 trace used in Example 3 whenever a nonempty segment of white events was removed directly following the ith event of T[£]N. Also, we include 0 at the beginning of in ps^ if the first event of rn is white, or if £ — 0. Now let wu be the unique view window of V W ( r [£]*', ps^) in which Ip is such that for each processor p, \p(p) is minimal. Intuitively, this Ip places each processor as early as possible. It can be shown that we-i ~*T(t) we. f ° r e a c h 1 < £ < | T | . Also, our definitions imply that WQ = we, and for each 1 < £ < | r | we have \w(\ < k. Thus r has VW-bound k. (=>) Suppose r has VW-bound k. Then there exist V W s WQ, • •., iW|T| such that the three condi-tions of Def. 12 hold. Furthermore, by Theorem 6, there exists some DSC-reordering 7r of T such that for each 0 < £ < | r | we have that wt is a V W of r [ £ ] 7 r . Now for any prefix length £, fac-tor r = T [ ^ ] T ' . Then wi ~~v w \ r \ , and there exists some position sequence ps of r[£]n such that Wi e ^ ^ ( r ^ , ps). Then clearly rn can be obtained from T[£Y by inserting traces only at the positions listed in ps. If we colour events of r ' white and those of r[£] black, this implies that the shuffle degree of (r, TT, £) is at most |ps|, which is at most k. Since £ is arbitrary, we have shown that (r, TT) has DSC-bound k. • Example 3. Here we consider the trace r = (W, 1,1,1)(R, 1,1,1)(W, 2,1,2)(R, 2,1,1), given by Afek et al. [6] as an example of a SC sequence that is not a trace of Lazy Caching. This example shows that r is DSC with VW-bound 2 (and, by Theorem 7 is thus DSC2). A DSC-reordering of r is TT, where T " = (W, 2,1,2){W, 1,1,1)(R, 1,1, !)(#, 2,1,1). Fig. 2.6 gives VWs w0,...,w4 of 2.5. Complexity of Model Checking DSCk 36 r f O ] 7 7 , . . . , r[4] 7 r respectively that satisfy the conditions of Def. 12 for k = 2. We now show how our V W theory along with Theorem 7 can be employed to decide D S C ^ . Let us unfix n, m, and v, and employ the term (n, m, v)-VW to refer to a V W for n processors, m addresses, and v data values. Definition 13 (Gk(n,m, v)). For any n,m,v,k > 1, define the finite automaton Gk{n,m,v) = (S, A4(Nn,N m ,N,;) ,<5, we) such that • S is the set of all (n, m, v)-VWs w such that \w\ < k • 6 — {(w,a,w') | w ~^>a w'} • w€ is the empty (n, m, v)-VW L e m m a 8. For any integers n, m,v,k > 1, C(Gk(n, m, v)) = D5Cfc(n, m, v). Proof. Follows from Theorem 7. • L e m m a 9. For any n, m,v,k > 1, C) f c(n, m, v) has no more than kn'(4v)m(fc+1) states. Proof. There are (Av)m possible views, hence at most (4v) m ( f c + 1 ) possible view sequences. Each may have at most kn processor position functions, thus the states 5 of Qk(n,m,v) is such that |5 | < kn(4.v)m(-k+1\ • We are now equipped to prove our desired theorem about deciding DSCfc. Theorem 8. For each k > 1, the problem of checking if a given protocol V is DSCk " in EX-PSPACE.n Proof. Give a protocol V involving n processors, m addresses, and v data values, we construct the protocol Qk{n, m, v), which, by Lemma 9 has at most kn {Av)m^k+l') states. Clearly n,m,v < \V\, thus the number of states of Qk (n, m, v) is bounded by fc|p|(4|P|)|p|(fc+1) = IPJ 0^!) = 2°(l pl l ogl pl) (2.3) 1 2Here we adopt the definition of Aaronson [1], which defines EXPSPACE to be the class of problems solvable on a deterministic Turing machine using space 0(2P^) for some polynomial p(n). Some authors (e.g. Du and Ko [47]) use EXPSPACE to refer to the smaller class obtained by restricting p(n) to being a linear function. 2.5. Complexity of Model Checking DSCk 37 Now, by Lemma 8, V is DSCfc if and only if traces(V) C traces(Qk(n,m,v)) (2.4) (2.4) requires checking language containment of (nondeterministic) finite automata, which can be done in space polynomial in the size of the involved automata. Hence the problem can be de-cided in space polynomial in (2.3), which implies that the space requirements are exponential in We conclude this section by proving Theorem 3 (originally stated on page 19), the proof of which was postponed until after the development of the view window theory. Theorem 3. Lazy Caching is DSCr+ne+i, where r and £ are the respective capacities of the in and out FIFOs, and n is the number of processors. Proof. (Sketch) That Lazy Caching is D S C follows from Theorem 2 (page 17), along with the facts that Lazy Caching is data independent and S C . The remainder sketches the proof that Lazy Caching is in D S C r + „ £ + i . For any state of Lazy Caching, we associate a finite set of possible V W s . We define this set by placing restriction on an arbitrary member w = (v, Ip). Given a trace r of Lazing Caching, these sets can be used to construct a sequence of V W s satisfying the conditions to witness that r has VW-bound r + n£ + 1 (see Def. 12 on page 34). Thus, by Theorem 7 (page 34), r is For convenience, we shift the index set of the sequence v (and hence the range of the function Ip) leftwards by r + 1, i.e. v = v ( — r ) . . . v ( 0 ) . . . v(n£). The val components of v(0) always represents the contents of Mem. When \p(i) < 0, this corresponds to \im\ = — \p(i) and \outi\ = 0, where \q\ gives the number of messages in the F I F O q. The n£ possible views to the right of v(0) are to accommodate the views corresponding to the n£ potential out queue entries that may be buffered in the system at any given time. Prior to performing an event (W, i, a, v), the operation hop(w, i, h) must be performed for some h > 0 . 1 3 The actual value of h is nondeterministic; the relative ordering of the views to the right of 1 3This may seem counterintuitive, since Lazy Caching allows write events to be performed by processor i even if m; is nonempty. However, after performing (W, i, a, v), processor i cannot perform any read event until ini is flushed of all entries present at the time the write took place. 0(|7>|log|P|). • D S C r + n ^ + i . 2.6. Complexity of Model Checking DSC 38 v(0) reflect a "prediction" made regarding the order that the associated W events are seen by Mem via MemoryRead actions. Other Lazy Caching actions result in the following updates to w. ReadRequest, WriteRequest, and Cachelnvalidate produce no change. MemoryWrite causes no effective change, though under our shifted view naming convention, all names would be decremented. MemoryRead inserts a new view with the same val components as v(0) immediately following v(0). CacheUpdate; simply increments lp(z) if \p(i) < 0, otherwise CacheUpdatej effects no change. To see that r + n£ + 1 is an upper bound on \w\, we note that the leftmost view in v can always be deleted (without impeding any possible future events) whenever we have \p(i) > — r for all processors i. • 2.6 Complexity of Model Checking DSC In Sect. 2.5 we saw that for any finite k, it is decidable to check if a protocol is DSCfc. We have been unsuccessful in our attempts to determine the decidability of the analogous problem for (unbounded) D S C . Decidability would follow from the following conjecture, a variation of which was originally made in a paper of the author et al.'s [18]. Conjecture 1. Any DSC protocol V is DSCk for some k, and further k is computable given a description ofV.u In this section we show that this problem is not too easy; specifically, it is PSPACE-Hard. The proof uses a reduction from the problem 3-QUANTIFIED B O O L E A N F O R M U L A [47], which is defined as follows. 3-QUANTIFIED B O O L E A N F O R M U L A can be viewed as a generalization of the problem 3SAT, defined in Sect. 2.4 on page 21. Here it is convenient to have our boolean variables belong to X UY, where X = { x i , . . . , xn} and Y = { y i , . . . , yn} are disjoint. Hence, by variable we now mean any member of X U Y. We will use x* (resp. y{) to refer to a member of X (resp. Y), use v to refer to an arbitrary member of X U Y, and use Vi to refer to a member of {x ,^ yf\. At times we commit a minor abuse by identifying 0 with F and 1 with T , e.g. the statement of Lemma 15 is guilty of this. 1 4Here "computable" is probably far too general of a term; it is likely that k is always bounded by the number of states and in practice this bound is very loose. 2.6. Complexity of Model Checking DSC 39 The notions of literal, clause, CNF formula, and 3CNF formula, are the same as in Sect. 2.4. A 3QBF formula is a quantified boolean formula of the form: Vxn3yn • • • V x i B y i : / (2.5) where / is a 3 C N F formula. For the remainder, we assume / has the m clauses C i , . . . , Cm. Each 3 Q B F formula evaluates to either T or F; this evaluation is defined recursively as follows. Given a boolean combination tp of the boolean constants T and F, let \ip\ be the one of these constants defined in the usual way. Then we may recursively define an evaluation function for Q B F formulae evalq by eva\q((p'[xi := F]) A evalq(<//[xj := T]) if <p = VXJ</?' evalqfa) = < evalq((^ /[y i := F]) V evalqfa'foi := T]) if <p = 3yi<p' \<p\ if (p is not quantified where <p'[v :— b] is the formula obtained by substituting the boolean constant b for all occurrences of the variable v in tp'. Definition 14 (3-QUANTIFIED BOOLEAN FORMULA). Given a 3QBF formula ip, the decision problem 3-QUANTIFIED BOOLEAN FORMULA asks i/evalq(<p) = T . 3-QUANTIFIED BOOLEAN FORMULA is well-known to be PSPACE-complete as was shown by Stockmeyer and Meyer [122]. Our proof will exploit the following definition and lemma about Q B F formulas. Definition 15. An assignment function for a QBF formula of the form (2.5) is a function assign : (X - » B) -> (Y -» 1) such that 1. For all A G (X —> B), (A U assign (A)) makes f true. 2. For all i € { 1 , . . . , n) and all A\, A2 : X —* B we have that if A\ and A2 agree on their assignments to the variables xn,..., X j , then assign(Ai)(?/j) = assign(A2)(yi) Lemma 10. A QBF formula has an assignment function if and only if it evaluates to T . Proof. Easy. • The next subsection defines the protocol used in our reduction. 2.6. Complexity of Model Checking DSC 40 •o Figure 2.7: The protocol 7^ 2.6.1 The Protocol V, Given a 3 Q B F formula ip of the form (2.5), we map ip to a protocol as shown in Fig. 2.7. Our encoding can be viewed as a generalization of Gibbons and Korach's reduction used to prove that checking sequential consistency of a single trace is NP-complete [66]. For simplicity we assume that each clause Cj has exactly three literals. 1 5 The various transition labels are the following traces. • For each 1 < i < n, and b £ B, evab(z) is defined in Fig. 2.8. eva{,(i) stands for "en-code variable assignments", and, intuitively, is responsible for the mechanisms that force the assignment Xi := b, and existentially select some value of B for j / j . 1 6 • C L S is defined to be r i j = i e c ' G ? ) ' where ec'(j) is defined in Fig. 2.9. C L S is short for "clauses" and encodes the mechanism responsible for mapping variable assignments to satis-fied clauses. • Finally, the trace C A is defined as follows. C A stands for "check assignment", and intuitively is responsible for checking that the current variable assignment satisfies all clauses (and hence / ) . 1 Repetition of literals in clauses can always make this so. 16eva&(i) is a similar widget to the trace eva(i) used in Sect. 2.4. However, the former makes the assign-ment Xi := b and existentially selects an assignment for j/j, while the latter simply existentially selects an assignment for Xj . (2.6) 2.6. Complexity of Model Checking DSC 41 On an intuitive level, our reduction works as follows. If <p evaluates to true, then it has an assignment function, and we show how any assignment function can be used to construct a D S C -reordering of any trace of V^. Roughly, each time the transition of Fig. 2.7 labeled "CLS C A " is followed, there is a notion of the "current" assignment to the variables X; this current assignment is dictated by the path previously taken through the states of Vv. The assignment function maps the current assignment of X to an assignment to the existential variables Y, and produces a total assignment that satisfies all clauses, hence allowing for a DSC-reordering. Sect. 2.6.2 proves this direction of the reduction. Conversely, if Vv is D S C , then so too is a particular trace of that we call the intended trace. The intended trace corresponds to a run through Vv such that each of the 2 n possible assignments to the universally quantified variables X is explored. We show that from any DSC-reordering of the intended trace one can extract an assignment function for t p . This direction of the reduction is argued in Sect. 2.6.3. The fact that our reduction can be computed in polynomial time is now asserted. L e m m a 11. For any tp, can be constructed in time polynomial in |</?|. Proof. Each of the traces labeling transitions in Fig. 2.7 has polynomial length. In particular, |evaft(z)| = 0(m + n), (CLSj = C ( m ) , a n d | C A | = 0(m + n). Since eva&(i) occurs 2n times, and C L S and C A both occur once, Vv has size 0(|</>|2) and the result follows. • We now discuss the processors and addresses used in and provide intuition for what role they play. Addresses Here we outline the various addresses used. The intuition attached should be read in the context of some DSC-reordering TT of a trace of £(Pip). • For each V{ € X UY, there is an address v*. i>* can hold one of the values T , F, or X , which respectively denote the variable Vi being assigned T , assigned F, or unassigned. The unassigned value X is used to prevent "old" assignments to persist past certain points in a reordering. At any point in a reordering, there is the notion of a current variable assignment, which corresponds to the value written by the most recent write to each Vi. Pc Pi T , l T,2 F , l F,2 xi Xi Xi Xi T , l T,2 F , l F,2 Vi Vi Vi Vi ( n } = i ^ > h b ^ 2 ) ) t , (W,Xi,X)(W,yi,X) \ ( UT=i(w,Cj,x) ) \ (W,hbuO) 1 (W.hbi.l) (W,hbi,2) (R,hbi,Q) (W,xuT) (i2,hb i,0)t (R,hbi,0) (W,xuF) {R,hbi,0)t (R,hbul) (R,hbuO) (R,hbul) (R, X i , T ) (i?,hbi,0) (R, hbt, 1) (R, Xi, F) (R,hbi,0) (W,yi,T) (R,bbi,l) (R,hbi,0) (W,yi,F) (R, hbi, 1) (i2,hbi,0) (i2,hbi,l) (R,Vi,T) (R,bbi,0) (R,bbi,l) {R,Vi, F) Figure 2.8: The trace eva^z), where 6 G B and i £ 1 , . . . , n. The trace is listed vertically, i.e. events higher on the page precede lower events. If b = T , the events marked f are included while the event marked $ is not; if b — F, the event T is included while those marked with t are not. Note the processor names are omitted from events; all events in each column are performed by the processor heading the column. tsj 2.6. Complexity of Model Checking DSC 43 < ( f l , U ) p o L » ) (W,Cj,J)) < ( i 2 , u p o L » ) (W,Cj,T)) ((R,w,po\j(w)) (W,Cj,T)) Figure 2.9: The trace ec'(j). Here the variables of Cj are it, v, w £ X UY, and polj(u) (resp. po\j(v), po\j(w)) is the polarity of the literal of u (resp. v, w) in Cj, i.e. T or F. The events of each row are all done by the processor named on the left, hence processor names are omitted from the events. We note that ec'(j) is the same (modulo variable renaming) as the trace eva^Q of Fig. 2.4 employed in Sect. 2.4 and the two traces serve similar roles in their respective reductions. • For each i £ {1 , . . . , n}, there is a heartbeat address h b j . In any reordering, these cycle through the values 0, 1, and 2. The phases of h b j play an important role in our reasoning about reordering. • For each 1 < j < m, there is an address Cj. This address can hold the values T or X . Cj will only store T if the current variable assignment satisfies the clause Cj. When X is written to Cj, this serves to prevent future events from reading a previous T . Processors Vtp involves the following five classes of processors: • A single processor named pc. This processor performs all events in C A , and a few events in each evat(z). • For each i £ {1 , . . . , n}, a processor p j . Processor pi is the only writer to address h b j . This ensures that in any reordering, the sequence of values in address h b j is 0 ,1 ,2 ,0 ,1 ,2 , T l T2 Hi F 2 • For each i € {1 , . . . , n} four processors named xi' , x{' , xt' , and xi' . These are the processors involved in the mechanism that performs an assignment to the variable X j . T l T2 F l F2 • For each i e {1 , . . . , n}, four processors named yi ' , yi ' , yi' , and yi' . These are analo-gous to the previous item. • For each j £ {1 , . . . , m} such that variable X{ (yi) appears in clause Cj, a processor named x\ (y\). These are the processors involved in C L S ; see Fig. 2.9. Intuitively, processor vj tries to read the polarity that clause Cj has for variable Vi (either T or F) from the current assignment to V{. If it can, then it indicates that clause Cj is satisfied by writing T to address Cj. 2.6. Complexity of Model Checking DSC 44 2.6.2 Proof that P - is DSC Implies ; In this section, we assume that Vv G D S C , and show that this implies ip evaluates to T . A high-level view of the proof is as follows. We identify a specific trace i t v G C(V^) that we call the intended trace. 1 7 Since it^ , is D S C , it has at least one D S C reordering. Most of this subsection is devoted to arguing that from any D S C reordering TT of it^, one can extract an assignment function for <p, hence by Lemma 10, cp is true. Rigor is paramount here; we must ensure that it^ doesn't have any reorderings other than those from which we can extract an assignment function. Definition 16 (intended trace i t v ) . For i e {I,... ,n}, define the trace itj, recursively as follows f CLS C A ifi = 0 it1 = < (2.7) V \ evaF(z) i t j , - 1 eva T («) i t j , - 1 ifi > 0 We define it^ , to be it™. L e m m a 12. it^ G C(V<p) • Proof. Follows easily from the definitions of it^ , and Vv. • For the remainder, let TT be an arbitrary DSC-reordering of i t v . Extending our phase terminology introduced in section 2.2, we say that o is in the most recent r-phase o/hbj if 1. o is in a r-phase of hbj, and 2. the occurrence of the last write of r to address hbj before o in it ¥ , 7 r is also the the last write of r to hbj before o in it^,. Definition 17 (sees). For an atomicity construct a in it^ and an address a, we say that o sees v for a if in it<p7r, the last write to a before o writes value v. 1 7 The reason it is the intended trace is that ideally we would map (p to a protocol with i t v and its prefixes being the only traces. However, since the length of it^ , is exponential in \ip\, this would not constitute a polynomial time reduction. Hence we must "role-up" it^ into the automaton which only has a polynomial number of states. Because "rolling-up" entails cycles, has many traces other than the intended trace and its prefixes; these superfluous traces add to the complexity of the proof of the converse implication of Sect. 2.6.3. 2.6. Complexity of Model Checking DSC 45 Definition 18 (observes). For an occurrence o of CA, and some Ax • X —» B, we say that o observes Ax if far each £ j € X, o either sees Ax(xi)for X j or sees X.for X j . The term is used in an analogous sense for assignments in Y —* B. Definition 19 (consistent observation). Let 0 <£<£'< 2n, and let yi e Y. We say that the [£, £']-occurrences of C A share1^ a consistent observation of yi if there are no k,k' € [£, £'] such that the kth and k'th occurrences ofCk respectively see T and F for y ^ We now present the main theorem, followed by its proof and several supporting lemmas. Theorem 9. 7/it^ € DSC then evalq(v?) = T. Proof. Given a DSC-reordering TT of it^, we show how to construct an assignment function for <p; the result then follows from Lemma 10. If we identify any X-assignment Ax with the binary number Ax(xn)Ax(xn-i)... Ax(x\), then from Lemma 15 we will see that the A x t h occurrence of C A observes Ax; we refer to this occurrence as the Ax-occurrence. For each i £ {1 , . . . , n}, let ki be the unique natural such that ki2l~l < Ax < (ki + l ) 2 t _ 1 — 1. From Lemma 17 we will find that the fc,2I_1 through (ki + 1 ) 2 I _ 1 — 1 occurrences of C A share a consistent observation of j/j. Now, define the function assign : (X —> B) —> (Y —> B) such that assign (Ax )(y%) is T (F) if any of these occurrences of C A see T (F) for y$, and set assign(Ax)(yi) = F i f 1 9 all occurrences see X for yi. That assign is well-defined follows from Lemma 17. To see that assign is an assignment function, we note that Lemma 19 will ensure that condition 1 of Def. 15 is satisfied, i.e. that for any Ax, assign ( A x ) U Ax satisfies / . Also, condition 2 is clearly satisfied by our definition of assign. • Lemma 13. For any Vi £ X U Y, there can be at most one write to Vi in any 0-phase o / h b j , and the value written is in B. Proof. Let HQ be a 0-phase of h b , , and let Hi be the immediately next phase of h b j , which is necessarily a 1-phase, by (2.8) below. Assume V{ = yf, the case v\ = X j is similar. Observe that hVT(W,*,hb i ; *) = ( ( W , p i , h b i , 0 ) ( W ; p i ) h b i , l ) ( W , p i , h b i ) 2 ) ) 2 n - i + 1 = iVTW*,hbi ,* ) 1 8 where the occurrences of CA are numbered starting from 0. 1 9 The choice of F here is arbitrary; T would work too. 2.6. Complexity of Model Checking DSC 46 Note that any write of X to V{ occurs in an atomicity construct in the 2nd column of Fig. 2.8. Because of this atomicity construct and (2.8), these writes always occur in a 2-phase of h b j . 2 0 Therefore any write to V{ in HQ must write a value in B. Now the events in the 7th and 9th columns of Fig. 2.8 ensure all writes in (W, *, j/i, B) are in either the most recent 0-phase or the most recent 1-phase of hbj. This follows from the fact that for each b e B, MO*,*/?'1,*,*) = ((R,yt'\hbi,0)(W,y^\yi,b)(R,y^\hbl,l)r-i+1 b 1 \^") Hence the inheritance relation induces a one-to-one correspondence between the reads of 0 (resp. reads of 1) from hbj in (2.9) and the writes of 0 (resp. writes of 1) to hbj in (2.8). Because of the "sandwiching" of the writes in (2.9), exactly one occurrence of each of (W, y f ' 1 , j/i, F) and (W, yj'1', yj, T ) occurs in HQ U HI. However, in a similar manner, the events of the 8th and 10th columns of Fig. 2.8 enforce that the reads of yj in these columns occur in the most recent 1-phase of hbj. Thus, if HQ contains an occurrence of both writes ( W , y f ' 1 , yj, F) and ( W , yj^^i, T ) , one of the reads of yj in columns 8 and 10 will fail to inherit the correct value. Hence HQ contains at most one of these writes. • L e m m a 14. Each occurrence of C A in it ¥, 7 r is in the most recent 0-phase of hbj, for all i € { l , . . . , n } . Proof. We first note that for each i e {1 , . . . , n}, every occurrence of C A is in some 0-phase of hbj; this follows from the atomicity of C A (2.6) and its read of 0 from hbj. Hence we must argue that it is always the most recent 0-phase. There are 2" occurrences of C A in it v , 7 r . We index these from left to right by n-bit binary num-bers, starting at all-zeros, and counting in binary up to all-ones. We prove the lemma by induction on the index. For the it^-leftmost (i.e. all-zeros) occurrence, the lemma holds trivially, since there is only a single prior occurrence of (W,pi, hbj, 0 ) . For the inductive step, let £ = £ n , . . . , £ \ be the index of an occurrence such that £ > 0 and the lemma holds for index £ — 1. Let k be minimal such that £k — 1. From Def. 16, in-between occurrence £ — 1 and £ (in it^) is precisely the trace fc-i evaT(/c) Y[evaF(k-i) (2.10) i = i 20' This is not quite true; the very first write of X to Vi will occur before hbj is assigned. 2.6. Complexity of Model Checking DSC 47 It follows that for each i e {k + 1,..., n}, the £th occurrence of C A is certainly in the most recent 0-phase of hbj, since (by IH) this is true of the (I — l)th occurrence, and, in it^,, there are no writes to hbj between the two occurrences. For the case of z € {!,..., k}, we note that a prefix of (2.10) is This atomicity construct must occur in i t v 7 r in the most recent 2-phase of each of h b i , . . . , hbfc. This follows from the fact that the processor of (2.11) is pc, which is also the processor of the (£ — l)th occurrence of C A , which (by IH) is in the most recent 0-phases of these addresses. Now we note that in i t v there is exactly one write of value 0 to each of h b i , . . . , hb^ between the {£ — l)th and the £th occurrence of C A (i.e. the writes that occur in (2.10). But since these occur after (2.11), these are the only writes of 0 to each of h b i , . . . , hbfc that could possibly impart values to the £th occurrence of C A . O f importance here is the fact that all writes to any hbj are performed by the same processor, pi. Therefore, for i 6 {1 , . . . , k}, the £th occurrence of C A is in the most recent 0-phase of hbj. • L e m m a 15. Let £ = £n ... £\ be a binary number?1 Then the £th occurrence of C A observes the assignment Ax defined by Ax(xi) = £%for all i € {1, . . . , n}. Proof. Let o be the £th occurrence of C A . We show that for any i 6 {1, . . . , n}, o either sees £i or X for X{\ the lemma follows. From Lemma 14, o occurs in the most recent 0-phase of hbj; call this phase Ho. Immediately preceding Ho is a 2-phase of hbj which we call H2, and immediately superseding H0 is a 1-phase we call H\. From the structure of i t v , the most recent instance of eva;,(i) prior to o in it^ , has b = £f, for the rest of this proof, eva^i) refers to this specific instance of the trace. The event (W,pi, hbj, 0) in eva&(z) is the first event of H0. By Lemma 16, for each r € {0,1}, all events of (R, *, hbj, r) in eva&(i) are in Hr. From Lemma 13, there is at most one write to X j in H Q , and the value written is in B. Now if b = T , then the event marked t in Fig. 2.8 is present, thus forcing (W, xj'1, X j , T ) to be in H Q . Similarly, if b = F, then the event marked \ forces (W, x f ' 1 , X j , F) to be in Ho. In either case, there is exactly one write w to X j in H Q , and the value written is 6. Now, if o sees w, then we are done. Otherwise, it must be that in it ¥, 7 r, o is prior 2 1It is convenient here to index the bits of £ such that £\ ( rather than the traditional £ 0 ) is the lowest order bit (2.11) 2.6. Complexity of Model Checking DSC 48 to w. In this case, since o is in Ho, the only write to X j that o can see is the event (W,pi,Xj,X) performed in H2, immediately prior to entering Ho (see column for pt in Fig. 2.8). Therefore Ax is observed. • Lemma 16. For any b £ B, r £ {0,1}, i £ {1, . . . ,n}, an^ occurrence o o/evaj^) in it^, a// ( i ? , * , h b j , r) events in o are in their most recent r-phase o / h b j . Proof. In o, any (R, * , h b j , r ) event is performed by a processor in the set P = {xj'1,xj'2,x^,1,xl'2,yj'1,yj'2,y^'1,y^'2y Note that for any p £ P, by Fig. 2.8 we have either \tvUR,p,hbu*) = ((R,p,hbi,0)(R,p,hbi,0)(R,p,hbi,l))2'l~i+1 or k V T ( # , P , h b j , * ) = ( ( i ? , p , h b j , 0 ) ( i ? , p , h b j , l ) ) 2 n _ i + 1 and in both cases i t p T C R .P .hb j , * ) = it,/ T(-R,P, h b j , * ) since all events in the projection are performed by the same processor. The lemma follows by (2.8). • Lemma 17. For any i £ {1 , . . . , n}, and natural number k such that 0 < k2i~l < (k + l ) 2 i _ 1 - 1 < 2" - 1 the [k2l~1, (k + l ) 2 l _ 1 — 1]-occurrences of CA share a consistent observation ofyi. Proof. From Lemma 14, each of the [ & 2 1 - 1 , (k + 1)21"1 — 1]-occurrences of C A are in their most recent O-phases of h b j . Furthermore, from Def. 16, these occurrences must therefore be in the same 0-phase of h b j ; call this phase H Q . From Lemma 13, there can be at most one write to j / j in H Q , and this write writes some value b £ B. Also, the most recent write to y j prior to Ho writes value X ; see the second column of Fig. 2.8. Thus each of the [k2l~1, (k + l)2l~1 — 1]-occurrences of C A see either X or 6 for y j . • Lemma 18. For each event (R,Pc, Cj,T), there exists an event (W, vhfl, Vi, b), where b £ B such that 2.6. Complexity of Model Checking DSC 49 ((R,v},vub) (W,vi i ' inhi (R,PC,CJ,T) (W%v\'\Vi,b) Figure 2.10: The inheritance edges discussed in the proof of Lemma 18 1. the read event sees bfor and 2. Vi appears in Cj in polarity b. Proof. Throughout the proof, the read (resp. the write) will refer to the events in the lemma state-ment. The read must inherit from some write (W, vlj,Cj,T), which is atomically coupled with some read (R, Vj,Vi, b), for some b E B, which inherits from the write. We let a refer to this two-event atomic subtrace. See Fig. 2.10 for an illustration, along with labellings of the two inheritance edges involved. We first argue that the write and the read are in the same 0-phase of hbj. From Lemma 14, the read is in its most recent 0-phase of hbj; call this phase H Q . Now suppose the write is in some phase of hbj that is prior to HQ. Consider the inheritance edges inhi and inhi of Fig. 2.10. If a occurs prior to HQ, then inh2 cannot hold, while if a occurs in HQ, then inhi cannot hold; these facts follow from the writes atomically coupled with (W, pi, hbj, 0) (see second column of Fig. 2.8). Hence we conclude that the write is in HQ also. From Lemma 13, the write is the only write to V{ in HQ, and clearly because of inhi and inh2, the write must occur prior to the read in H Q . Therefore, the read sees 6 for D J . The fact that Vi appears in Cj in polarity 6 follows from the definition of ec'(j) in Fig. 2.9. • L e m m a 19. Let A : (X UY) —> B be an assignment that is observed by some occurrence of CA. Then A satisfies f. Proof. We argue that an arbitrary clause Cj is satisfied by A. Let o be the occurrence of (R, pc, Cjr, T ) in the occurrence of C A that observes A. From Lemma 18, there exists an event 2.6. Complexity of Model Checking DSC 50 (W, vbfl, Vi, b), where b G B such that conditions 1 and 2 of Lemma 18 hold. Since condition 1 holds, we have that A(vi) = b. Since condition 2 holds, Cj is satisfied when Vi = b. • 2.6.3 Proof that <p Implies Vv is DSC For this section, we assume that ip is true, and fix an assignment function assign for <p, which exists thanks to Lemma 10. Let Kv C £ ( 7 - ^ ) be the set of traces that leave Vv in state Sfm. First, we note that any trace of C{VV) is a prefix of some trace of Kv. Since D S C is a prefix-closed property, we thus need only consider traces in i.e. Kv D S C implies G D S C . Any trace a G uniquely defines a run (i.e. sequence of states) of V^; we let #(cr) be the number of occurrences of Sfi n in this run. We will prove that for all a G Kv, a is D S C , by induction on #(<T). In fact, we will prove the stronger assertion that all traces of Kv have a D S C reordering with certain properties; these properties are defined subsequently in Def. 21. Throughout, we will identify a reordering TT of a trace r with r 7 7 . Definition 20 (final assignment). Suppose a G Kv, has DSC-reordering TT. Then the final X-assignment ofir is the function fa 7^ : X —> (B U {X}) defined as follows. For each i G {1,..., n), fax (x^ is the value written by the ir-most recent event of(W, *, X j , *) prior to the last occurrence of C A in TT. The final y-assignment fay is defined analogously. If both X ^ fa7^ (X) and X G- f a y (F ) , we say that the final assignments ofir are well defined. Definition 21 (preferred reordering). A reordering TT of a G Kv is called a preferred reordering if the following all hold. 1. TT is a DSC-reordering of a 2. A trace of the form n C A nWw.hbi.l) ^ (3i (W,pu hbu 2) (2.12) is a suffix ofir, where T l T 2 F l F 2 T l T 2 F l F 2 • ai includes only events of processors x i ' ,xi' , x i ' , xi' ,yi' ,yt' ,y{' , yi' , and • Pi includes only events of processors x\, y\,..., x™, y™, and all reads of Pi inherit from events in ai. 2.6. Complexity of Model Checking DSC 51 3. The final assignments of IT are well-defined, and furthermore assign (fa x ) = fay. Definition 22. Let A be an assignment that interprets the variables ofY.22 For each i € {1 , . . . , n} and b € IB, the traces eva^i)^ and eva^i)^ are defined in Fig. 2.11. We now state and prove the main result of this section. Theorem 10. For all o 6 K^, a has a preferred reordering. Proof. B y induction on #(cr). Base Case. There is a unique trace o\ G Kv such that # (CTI) = 1, namely o\ = evap(n) eva F (n — 1 ) . . . evaF(l) CLS C A We argue that o\ has a preferred reordering. Let AF : X —> B be the function that is constantly F, and let A = assign(A F) U Af. Then TT is defined by T - ^ ^ ( ( ^ ^ . ^ ( ^ ^ . ^ ( n ^ C W i c ^ X ^ W i h b i . O ) ) nr=ievaF(i)0 4 C L S Q C A nr=i (WiPi . hbj, lJevapWfCLSWiWpi, hbj, 2) We leave it as an exercise for the reader to verify that there exists a shuffling of C L S into the n + 1 traces CLSo, C L S ( l ) i , . . . , CLS(rc)i such that TT is a preferred reordering of o\, for a hint on how this is done, see the analogous traces in the inductive step. Inductive Step. Let a € K be such that > 1. Then o can be factored as o = a'a", where cr' e K, #(cr') = #(cr) - 1, and cr' has a preferred reordering TT'. Furthermore, from the structure of Vtp, we have that cr" = evaT(/c) evaF(A; - 1) evaF(A; - 2) . . . eva F(l) C L S C A for some k € {1 , . . . , n}. We will construct a preferred reordering TT of a by inserting the events of cr" into TT'. Let A x : X -> B be defined by fax(xi) if A; < i < n Ax{xi)= { T i f i = fc (2.13) F if 1 < i < ]fc 2 2 In other words, Y is contained in the domain of A. 2.6. Complexity of Model Checking DSC 52 We will define TT such that the final X-assignment of TT is Ax- Factor TT' = TT'ITT'2 where n A = II ( ( W i p i . h b i . ^ a i A C W . p i . h b i ^ ) ) (2.14) i=fc+l That this factoring can be done follows from the inductive hypothesis. We now shuffle the events of CLS into n + 1 traces CLSo, CLS(l)i,..., CLS(n)i. Let A = assign ( A x ) U Ax- CLS involves 3m atomicity constructs (each of two events). Each of these atomicity constructs is performed by a processor v\, where variable v\ appears in clause Cj. Let CLSo be a trace (order is irrelevant) of all such atomicity constructs performed by any v\ such that variable V{ appears in clause Cj in polarity A(vi), i.e. clause Cj is satisfied by the assignment A. Also, for each i € {1,..., n}, let CLS(i)i be a trace (order is irrelevant) of all atomicity constructs performed by vj, where variable v appears in clause Cj in polarity -iA(vi). Note that since assign is an assignment function, we have that for each j e {1,..., m}, CLSo contains at least one write of T to Cj (and no other values to Cj are written in CLSo). We now define TT. T O assist comprehension, events of TT' are underlined, while events of a" are not underlined. TT = TT[ (n?=i(fl>PC.hbi,2)) n t i ( W ^ , X ) ( P / , y i , X ) (n™i(W,c,,X)) (W.hbi.O)) nt^evapWo 4 e V 3 T ( A ; ) o (2.15) CLSo CA Ui=i(W,Pi, hbi, l)waF(i)?CLS(i)i(W,Pi, hbj, 2) (W,Pk, hb fc, l)eva T(fc)f CLS(fc)i(W,p f c, hbfc,2) nr=fc+i ( W l p f . h b ^ ^ O i A C L S W i (W,pj, hbj, 2) 7r can easily be seen to satisfy condition 2 of Def. 21, and the inductive hypothesis along with the structure of TT imply that condition 3 is satisfied. That TT is a DSC-reordering (condition 1 of Def. 21) can be proved by a detailed case analysis, which we leave to the reader. However, the following "hints" are relevant: 2.7. Undecidability of Prefix-Closed SC 53 • TT[ has a suffix of the form: fc-i C A YI ( ( W . p i . h b i . l ) a* A ( W , P i , h b i , 2 ) ) 2=1 • For each j € {1 , . . . , m}, the read of T from CJ in the last occurrence of C A in TT inherits from a write in CLSo. • For each v\ € X UY, the reads of Vi in CLSo inherit from events of o" (red events) if 1 < i < k, and from events of TT' if k < i < n. • 2.7 Undecidability of Prefix-Closed SC In this section, we show that S C , under our prefix-closed protocol semantics, is undecidable. The proof is via a nontrivial modification of Alur et al.'s proof that S C is undecidable for arbitrary (i.e. not necessarily prefix-closed) finite automata [8]. Note that our reduction depends heavily on SC's ability to radically change witness reorderings at the drop of a hat. Therefore it is unlikely that this proof could be adapted to handle the open problem pertaining to the (un)decidability of D S C . We reduce an undecidable problem about counter-machines, which are defined now. Definition 23 (n-counter machine). For n > 1, an n-counter machine is a finite automaton over the alphabet En = ( J n = 1 {Ij, Dj, Zj}. A n n-counter machine can be thought of as a finite automaton endowed with n unbounded (integer) counters. A n occurrence of Ij (resp. Dj) increments (resp. decrements) counter i, while the symbol Zj tests if the ith counter is zero. In the "counter-endowed" semantics, a Zj transition may only be taken if counter i stores zero. Definition 24 (admitted string), o € S* is said to be admitted if, for each 1 < i < n and each prefix o' of o such that o' = o"Zifor some a", we have that \o' \ {lj}| = \o' | {Dj}|. Therefore, if we view a string a € E£ as a sequence of increment, decrement, and test-for-zero operations on n counters, o is admitted if and only if every occurrence of a test-for-zero Zj occurs when counter i stores value 0. Hence, the term admitted means legality under the counter-endowed semantics. V T,2 V xi F,2 a,l a,2 -.a,l -.a,2 OR, hb i ; 0) (i2,hb»,0) (fl,hbi,0) (W,xuF) (i?,hbi,0) (i2,hbi,0) (i?,hbi,0) (W,yi,a) (fl,hbi,0) (fi,hbi ,0) (i?,hbi,0) (W.ori.T) hbi, 1) ( i? ,hbi , l) (R, Xi,J) ( i i , hbi, 1) (i?,hbi, l) (R, xu F) (R, hbi, 1) (fi, hbi, 1) (R,yi,a) (w,yi, (R,hbi ->a) ,1) (i?,hbi, l) (.R,yi,-.a) Figure 2.11: The trace eva F ( i ) 0 4 (top half of table) and eva F ( i )^ (bottom half of table). Here, a = A(yi) is the value assigned to the existentially quantified variable y i . Note that these two traces can be seen as being obtained by permuting eva F(i) while preserving per-processor order, and then factoring the result into two subtraces. The traces evaj(i)o and eva T ( i ) f are defined similarly; in particular (W, Xi, T ) occurs in evaj(0o > a n d (W> x i , F ) occurs in evajii)^ . We also note that any eva b(z)^ has all its reads of hbi reading value r. 2.7. Undecidability of Prefix-Closed SC 55 Definition 25 (n-Z). For each fixed n > 1 the decision problem n-Z asks, given an n-counter machine A, if there exists o G C(A) such that a is admitted. The problem n - Z is closely related to the halting problem for Minsky's so-called program ma-chines, which also manipulate unbounded counters [101]. Program machines are Turing-complete when endowed with at least 2 counters. For n - Z we have a similar result, due to Alur et al. [8]. Lemma 20 (Alur et al.'s Theorem 1 [8]). n - Z is undecidable for any n > 3. 2.7.1 The Protocol Vc In this section we show how, given any n-counter machine C, to construct a protocol Vc such that C has no admitted string if and only if Vc is S C ; our theorem then follows by Lemma 20. The construction borrows heavily from the proof of Alur et al. [8] that S C is undecidable when the protocols are not restricted to be prefix-closed. 2 3 Key to the construction is the observation that cr G E * is not admitted if and only if there is a way to shuffle o into a string a' such that the following two conditions hold. Condition 1. cr' is a member ofthe regular language Condition 2. For each 1 < i < n, we have that a' \ {Ij, Z j } = cr \ {Ij, Z j } and o' | { D j , Z j } = a | { D j , Z j } . Equivalently, the shuffling cannot commute Ij with Z j nor D j with 7-i, but may commute any other pairs of symbols. Let J be a finite automaton such that C(J) is (2.16). It is convenient if we add an end of string marker symbol $ to all strings in both C(C) and C(J). This can be done by simply adding 2 30ther than the cosmetic, there are two primary differences between our construction and that of Alur et al. First, nontrivial modifications have been made so that the reduction works when protocols are defined to be prefix-closed. The original proof need only concern itself with defining a map <j) such that </>(cr) has properties corresponding (roughly) to our Conditions 1 and 2 whenever a G C(C). Here we must be careful to ensure that our <f> has the further attribute that all prefixes of 4>(a) are SC. The most salient modifications in support of this end are the use of the symbol placeholder 7 ' , the prefix 60, and the use of a second "heartbeat" address hb'. Second, Alur et al. give a very general definition of SC that encompasses concurrent objects other than shared memory addresses; let us call this GSC. Alur et al.'s reduction from n-Z to SC takes a detour through GSC, i.e they reduce n-Z to GSC, and then GSC is reduced to SC. To avoid introducing GSC in this thesis, our reduction is directly from n-Z to SC. n (2.16) 2.7. Undecidability of Prefix-Closed SC 56 a fresh final state, and creating a transition on $ from each of the "old" final states to the new final state. Hence, we may assume that both C and J are finite automata over the alphabet Y?n = £ „ U {$} and each have unique final states, and we write C = (SQ, , 8c, SQ, {fc}), a n d J = {Sj,Ti,8j,sj,{fj}). The protocol Vc will be defined so that its language is the prefix-closure of {0(a) | cr € C{C)}, where <f> : * —> A4* has the property that for any cr G £ ( C ) , • 0(<T) is S C if and only if a is not admitted, and • any proper prefix of (f)(a) is always S C . Intuitively, 4>(a) maps each symbol a in a to a string of reads and writes that encode both a and all transitions that J has on a. This is done in such a way so that if a contains no $, then cf)(a) is trivially S C . However, if a = cro$ (where OQ G £ * ) , then 4>{a) will have a serial-reordering TT if and only if 0(cr) 7 r represents an accepting run of J7 on a shuffling a' of cr (i.e. a' satisfies Condition 1) such that cr' also obeys Condition 2. We will now define our mapping cf) '• —• in terms of several other functions. A l l of these definitions call upon the atomicity construct, previously described in Def. 8. The first, p, encodes a transition (s, a, s') of J as follows. p((s,a,s')) = ({R,st,s)(R,sym,a)(W,st,s'){W,5ym,e)){safi) The two read operations guarantee that if (s, a, s') is used in the accepting run of J on cr', then the transition must only occur when J is in state s (indicated by s residing in address st) and the next symbol is a (indicated by a residing in address sym). The two writes ensure that, after the transition, the state is s' (by storing s' to address st) and the symbol a is consumed (by storing the null symbol e at sym). Unused transitions require place-holders to satisfy their reads, and to ensure that they occur in the 1-phase of hb. The placeholder of a transition is built using the function p', where p'((s,a,s>)) = ( ( ^ ^ ^ ^ ( ^ s t . ^ ^ s y m ^ ) ) ^ ) 2.7. Undecidability of Prefix-Closed SC 57 The encoding of a symbol a G E n is accomplished via the function 7, defined here. 7 (a ) = { ( ( f l , s y m , e ) ( f l , h b , 0 ) ( i y , s y m , l j ) ) 2 . ( ( f l , s y m , e ) ( f l , h b , 0 ) ( W , s y m , D j ) ) if a = Ij if a = Dj ((fl, sym, e)(fl, hb, 0)(W, sym, Z\))2i ((fl, sym, ZJ ((fl, sym, e)(fl, hb, 0)(W, sym, $)) x ) ( iy ,sym,Zj)) 2i+l if a = Zj if a = $ For any a , 7 (a ) involves a reading of e from sym; this ensures that in any reordering, 7 (a ) follows a transition encoding (rather than another symbol encoding). The read of hb ensures that all symbol encodings occur in the 0-phase of hb. Encoding Zj involves actions of both the processors 2i and 2i + 1 so that encodings of neither Ij nor Dj can commute with Zj in a reordering. The writing and reading of the new symbol Z't forces the actions of the two different processors to be paired up in any reordering. Unlike the proof in [8], we will require place-holders for symbols. The effect of these place-holders is to ensure that for any proper prefix OQ of a string o G C(C), <P((TQ) is trivially S C . The symbol place-holders must occur in the 1-phase of hb', and are used to satisfy the reads of the symbols encodings. The same symbol placeholder is used for all symbols, and is where {£1, . . . , are all the transitions of J on a ; Each symbol a in o is expanded into a place-holder for a , the encoding of a , and ipp(a) as follows: Finally we are equipped to define c6 0(a) = eQrp(a(\))^(a(2))... ip(o(\o\))(R, v, hb', 0) where the prefix 9Q is y = ( ( W ; s y m , e ) > Given a a G E n , we define il>p(<*) = p'(ti)p(t1)...p'(tk)p(tk) 60 = ((W, hb, 0)(W, hb', 0)(W, st, SJ)(W, sym, e))^ ((W, hb, 1 ) ) , ((W, hb', 1 ) ) ^ 2.7. Undecidability of Prefix-Closed SC 58 To define Vc , we allow our protocols to have strings over M labeling their transitions. Clearly such a protocol can be easily transformed into one that has only single memory actions labeling its transitions by adding more states. Vc is defined by (Sc U {r, /} , M*, —>, r) , where r and / are new states not in Sc, and -> = {(s,ip(a),s') | (s,a,s') € 6C} U {(r, 0O, s C ) , (/c, (#, ^, hb', 0),/)} Lemma 21. traces(Vc) — {T \3a € C(C) : T is a prefix of <p(o)} Proof. Easy. • 2.7.2 The Proof Here we state and prove our main result of this section. Theorem 11. Given a protocol V, the problem of checking ifV is SC is undecidable. Proof. By a reduction from n - Z . Given an n-counter machine C where n > 3, we construct a protocol Vc as described in Sect. 2.7.1. By Lemma 22, Vc is S C if and only if C(C) contains no admitted strings. The theorem follows from the fact that n - Z is undecidable (Lemma 20). • Lemma 22. Let C be an n-counter machine for some n. Then Vc is SC if and only if C(C) contains no admitted strings. Proof. We first show that a certain set of traces of Vc (the "unconsummated" traces) are always S C , regardless of whether or not C(C) contains admitted strings, hence we need only consider traces outside of this set. We say that r 6 traces (Vc) is consummated if r = c6(cr) for some a € C(C), otherwise we will say that T is unconsummated. By Lemma 21, any unconsummated T € traces (Vc) is the prefix of some consummated trace of Vc- Clearly, r € traces (Vc) is consummated if and only if the final event of T is (R, u, hb', 0). Let T be a maximal unconsummated trace of Vc, i-e <f)(o) = T(R, u, hb', 0) for some o € C(C). Then the following specifies a serial 2.7. Undecidability of Prefix-Closed SC 59 reordering of r ((W, hb, 0)(W, hb', 0)(W, st, S ( 7 ) ( W , sym, e <(w,hbM)>M <(W,hb,l)>„ (2.17) The reader may confirm that (2.17) is not only a serial-reordering of r , but is in fact a D S C -reordering. Hence, restricting (2.17) to any prefix r' of r gives a DSC-reordering for T'. Since any unconsummated trace is a prefix of some consummated trace, we conclude that all unconsum-mated traces of Vc are S C (in fact they are DSC) . Thus we need only concern ourselves with consummated strings. We will argue that for any consummated r G traces(Vc), r is S C if and only if a is not admitted, where r = </>(cr). (=>) Let us suppose that r is S C , and consider some serial reordering T 7 R . Because of the existence of the event (R, u, hb', 0), the 0-phase of hb and the 1-phase of hb' are disjoint, and the latter appears later. A l l occurrences of 7(a) must occur in the 0-phase of hb, and all occurrences of 7' must occur in the 1-phase of hb'. Hence all symbol place-holders occur after all symbol encodings. Furthermore, for any 1 < i < n, each occurrence of 7(Zj) must occur atomically in T 7 1 - . To see this, let 71 (Zj) and 7 2 (Zj) respectively be the first and second atomicity construct of 7(Zj). The only writes of Z[ to sym in rn happen in occurrences of 71 (Zj). The read and write of sym in 72(Zj) thus ensure that all occurrences of 71 (Zj) and 72(Zj) strictly alternate in r 7 r . Since each 71 (Zj) must occur in the 0-phase of hb, the only possible atomicity construct that could occur between an occurrence of 71 (Zj) the the following 7 2 (Zj) is a transition encoding p or some other symbol encoding 7. However, either of these would overwrite the Z[ stored in sym, which would prohibit the read of sym in 72(Zj) from receiving the value written by 71 (Zj). 2.7. Undecidability of Prefix-Closed SC 60 It follows that r * = {(W, hb, 0)(W, hb', 0)(W, st, S > 7 ) ( W ; sym, e))^ n i 2 i 7(<K*j)M(sj-i> Sj ) ) < W h " ' 1 ) > ' ( 2 , 8 , (77, i/,hb',0) (WhbM))^ Here cr' = cr(zi)cr(z 2) • • • o(i\a\) is a reordering of cr that satisfies both Condition 1 and Condition 2, and rj is a string involving: all symbol place-holders, all transition place-holders, and all transition encodings except the \o\ transitions used prior to (W, v, hb, 1). To see that Condition 1 holds, note that S 0 , cr(i i ) , S i , cr(z 2), S 2 , • • • , Cr(i\a\), S\a\ is a run of J on a'. That so = sj follows from the fact that the initial write to st stores sj. That S|CT| = fj follows from the fact that cr has exactly one occurrence of $, and all transitions of J on $ have fj as the final component. Furthermore, there are no transitions with fj in the first component. Thus the reordering only works if o-{i\a\) = $ and s\a\ = fj. Condition 2 is guaranteed by the processor names used in defining 7 , and the fact that TT preserves per-processor order. Therefore o is not admitted. (<=) Conversely if a is not admitted, then Conditions 1 and 2 holds of o, and it follows that we can construct a serial-reordering of r of the form (2.18). • Chapter 3 A d d r e s s and Value Parameterization 3.1 Introduction In Chapter 2, we defined a restriction of S C called D S C , and considered the computational com-plexities of several related verification problems. A protocol was defined to be a prefix-closed finite state automaton, having some transitions labelled with memory events (page 12). Furthermore, a protocol only includes memory events pertaining to a fixed, finite number of processors, addresses, and data values. A real protocol description, however, is typically parameterized by these (and typ-ically other) quantities, meaning that the description defines a protocol for any arbitrary numbers of processors, addresses, and data values. This chapter presents a method for proving sequential consistency of an infinite family of proto-cols parameterized in two dimensions: the number of addresses, and the number of data values. We consider the number of processors to be a fixed constant. The approach is abstraction-based, and we show that an appropriate abstraction can be extracted automatically from the protocol family description. Using the assumption of data independence, verification over the data value parameter is relatively straightforward; our main contribution is a means to handle parameterized addresses. In theory, handling a parameterized number of processors is most interesting, because shared memory protocols are intended to facilitate complex interactions among processors (later, in Chap-ter 4, we develop an approach that can be used for processor-parameterized model checking in some circumstances). In practice, however, handling parameterized numbers of addresses and data values is a higher priority, because real shared-memory multiprocessors have few processors and many addresses and data values. Indeed, many multiprocessors are chip multiprocessors in which 2 or 4 61 3.2. Preliminaries 62 p i ( W , a 2 , l ) ( W , a i , 2 ) {R,a2,l){R,a2,2) ( W , a i , l ) ( W , a 2 , 2 ) ( i 2 , a i , l ) ( i 2 , a i , 2 ) Figure 3.1: Example trace r that is not S C . The values seen by the two reads on one processor imply that the other processor's second write appears to have occurred between the two reads; no reordering can satisfy this property for both processors simultaneously. However, both of T f (*, *, a i , *) and r | (*, *, a2, *) satisfy the stronger property of S S C (see Def. 27). This demonstrates nothing interesting (for our purposes!) can be inferred about a trace from the fact that its projection onto each address is always S S C . C P U s are collocated on the same die. In contrast, the smallest and most common configurations have 2 3 2 data values and hundreds of millions of physical addresses — far beyond the reach of the direct application of model checking. Our method leverages a few common, practical assumptions about memory system protocols. Three of these — data independence, processor symmetry, and address symmetry — are standard and easily enforced syntactically. We impose some additional syntactic constraints to simplify the automatic generation of a finite-state abstract protocol from the parameterized protocol description; these are described in Sect. 3.4. We prove that correctness of this abstract protocol implies that of the infinite family of protocols. Checking correctness of the abstract protocol can be dispatched to any of the existing techniques. The bulk of this chapter represents work published by the author et al. [19] with several nontriv-ial notational and terminological changes along with a clean-up of the exposition. Also, Sect. 3.7 provides some relevant insights that did not appear in that publication. 3.2 Preliminaries Def. 5 defined the value-parameterized protocol family; here we make a similar definition to capture protocols parameterized both by the number of addresses and number of data values. Definition 26 (address and value-parameterized protocol family). An address and value param-eterized protocol family (AVPPF) is a function JF such that for any m, v > 1 we have that 3(m, v) is a protocol involving n processors, m addresses, and v data values, where n > 1 is constant. Our method verifies a stronger form of S C in which writes to the same address cannot be re-3.2. Preliminaries 63 ordered. To our knowledge, all implemented S C protocols implement this stronger form. (The canonical example of a protocol that is S C , but violates this assumption is Lazy Caching [6], which was described in Sect. 2.3.3) With these restrictions, our method is, in principle, fully automatic. Definition 27 (simple serial reordering, simple SC). A serial reordering it of a trace r is said to be a simple serial reordering (ofr) if for each address a appearing in r we have T" T (W, *, a, *) = r t ( W , * , o , * ) A trace is said to be simple sequentially consistent (SSC) if it has a simple serial reordering. Intuitively, S C says that there must exist a reordering that is serial and preserves the per-processor order. S S C adds the requirement that the ordering of writes to each address is also preserved in the reordering. A s is expected, a protocol is deemed S S C if all its traces are S S C . Similarly an A V P P F is said to be S S C if all protocols in its image are S S C . The notion of S S C has appeared previously as the real-time store reordering property of Condon and H u [36] and as the simple witness of Qadeer [113]; both of these works employ S S C as a simplifying assumption in their respective verification methods (as do we). We note that, like S C , S S C cannot be checked on a "per-address" basis. In fact, there exist non-SC traces involving only two addresses such that projecting onto either address yields an S S C trace. Fig. 3.1 provides such a trace. Hence verifying S S C for an arbitrary number of addresses is a formidable challenge. We now define three common protocol assumptions we make on AVPPFs: address symmetry, processor symmetry, and data independence. For defining the symmetries, let us fix a finite set of processors P and a finite set of addresses A. For any permutation A on P, define A p r o c to be the function on M(P, A, N) specified by A p r o c ( ( o , p , a, d)) = (o, X(p), a, d). Similarly, if A is a permutation on A , define Xaddr((o,p,a, v)) = (o,p, A(a), v). We extend A p r o c and Xaddr to have domain and range M* in the obvious way. Definition 28 (address and processor symmetry). Let V be a protocol involving the set of proces-sors P and the set of addresses A. Then V is address symmetric if for every permutation X : A —> A we have r € traces (V) implies A a d d r ( r ) € traces(V). Similarly, V is processor symmetric if for 'in Chapter 6 we propose a method that might be able to lift this restriction. 3.3. Verification Approach 64 every permutation A : P —> P we have r € traces(P) implies XPTOC(T) £ traces(V). An AVPPF is said to be address symmetric or processor symmetric if all protocols in its image have the respective property. Data independence was defined with respect to value-parameterized protocol families in Def. 7 on page 17. The definition extends naturally to the A V P P F 3\ For each ra > 1, let 3m be the value-parameterized protocol family defined by Imiv) = ^ ( m , v) for all v > 1. Then we say that 3" is data independent if for each m > 1, 3m is data independent according to Def. 7. 3.3 Verification Approach Our aspiration is to verify that an A V P P F !F is S S C . This section presents Theorem 12, which states that S S C of 9" can be soundly reduced to S S C of a single protocol Q involving n processors, n addresses, and 3 data values, provided that an infinite number of projected trace containments hold between certain members of 1 and Q (see condition 2 of Theorem 12). Here and throughout the remainder of the chapter, n denotes the fixed number of processors of 3r. Thus (roughly) we reduce correctness for an arbitrary number of addresses and data values to correctness for only n addresses and 3 data values. In Sect. 3.5 we will show that if "5 is expressed in a certain formalism, then we can effectively produce a Q for which these containments hold "by construction". Then, S S C of Q can be checked using known methods based on model-checking [18,22,36,113]. The proof of Theorem 12 relies on machinery developed by Nalumasu [103] and later Qadeer [113] to show that, under the address symmetry, processor symmetry, and data indepen-dence assumptions, any trace r that is not S S C can be "proven" not S S C by considering only its projection onto the addresses in some set A, where | A | is bounded by the number of processors in r . Since our family has a fixed number of processors n, this means that for a trace with an arbitrarily large number of addresses, we need only to consider its projection onto a small set of addresses. By exploiting the symmetry assumptions, a violating trace can always be found such that A = Nn. Furthermore, using data independence, we can ensure that a violating trace exists with 3 data values. Hence, if we can construct a protocol Q such that traces (Q) contains all projections of traces of our family involving m > n addresses and 3 data values, then S S C of Q implies that of jF(m, v) for all m > n and all v > 1. This reduction from S S C of an A V P P F J to that of a 3.3. Verification Approach 65 single finite state protocol Q is formally stated in Theorem 12. We now develop the definitions and lemmas that support the proof of this theorem. Recall from Sect. 2.3.2 that an unambiguous trace is one in which no two writes to the same address write the same value. Given an unambiguous trace, we can construct a digraph that com-pletely captures all ordering constraints any simple serial reordering of the trace must respect. The following definition is based on the notion of a trace constraint graph [36,66,113]. Definition 29 (simple constraint graph). Given an unambiguous trace r, the simple constraint graph ofr is the digraph scg(r) = (V, E) where V = N | T | , and E C V x V is the least relation such that: i) x < y and proc(T(X)) = proc(r(y)) imply (x,y) G E ii) whenever op(r(x)) = W, op(r(y)) = R, addr(r(x)) = addr(T(y)), and val(r(x)) = val(r(y)), we have (x,y) € E iii) for any x and y such that there exists x' and y' such that x' < y', op(r(x')) = op(r(y')) = W, addr(r(x)) = addr(r(x')) = addr(r(y)) = addr(r(y')), and val(r(x)) = val(j(x')) ^ val(r(y)) = val{r(y')), we have (x,y) 6 E We say an edge in a constraint graph is of type t if it is included as a result of item t € {i, ii, iii} from Def. 29. 2 Intuitively, type i edges enforce the constraint that serial reorderings must preserve the per-processor order. Type ii edges enforce the constraint that whenever a read inherits its value from a write, the read must be reordered after the write; note that because of unambiguity, there is a unique write that any read can inherit from. A type iii edge enforces the constraint that in a simple serial reordering, writes to the same address cannot be reordered, and furthermore, any two events with the same address but different data values must come in the same order as the two unique writes with the respective values. L e m m a 23. An unambiguous trace r is SSC if and only ifscg(r) is acyclic. Proof. (=4>) If scg(r) has a cycle it follows that any reordering of r will either not be serial, not respect per-processor order, or not respect the per-address write order of r . (<=) If scg(r) is acyclic 2Simple constraint graph edges don't necessarily have a unique type. For example, the edge between two writes by the same processor to the same address is both of type i and iii. 3.3. Verification Approach 66 then it is an irreflexive partial order. Any total order on N | r | that extends this partial order defines a simple serial reordering of r . • It turns out that if a simple constraint graph has a cycle then it has a certain type of cycle called a k-nice cycle [113]. A A;-nice cycle is a cycle of length 2k with edges alternating between type i edges and edges of any type having endpoints with the same address. Also, each processor and each address appears in either exactly 0 or exactly 2 nodes in the cycle, and in the latter case the 2 nodes are consecutive. Definition 30 (A>nice cycle [113]). Let r be an unambiguous trace, and let k be a positive integer. A fc-nice cycle in scg(r) is a cycle u\, v i , u2, v2,..., uk, vk of length 2k such that 1. for each x £ we have PWC(T(Ux)) = proc(r(vx)) and addr{r(vx)) = addr(r(u(x m o c j k)+i 2. for each x, y 6 we have x ^ y implies Proc(r(ux)) ^ proc(r(uy)) 3. for each x,y 6 we have x ^ y implies addr(r(vx)) ^ addr(T(vy)) Lemma 24. Let r £ A ^ N n , N m , N ) * be unambiguous. Then scg(r) has a cycle if and only if scg(r) has a k-nice cycle for some k £ {1 , . . . , min(n, m)}. Proof. This lemma is a special case of Qadeer's Theorem 6.1 [113]. The proof uses the fact that any cycle can be reduced to a fc-nice cycle by "cutting-out" extraneous segments of the cycle. • Our proof of Theorem 12 below uses the fact that under the assumptions of processor and address symmetry, the existence of a cycle entails the existence of a fc-nice cycle that is canonical in the following sense. Definition 31 (canonical A>nice cycle). A k-nice cycle ui,vi,... ,Uk,Vk is said to be a canonical fc-nice cycle if for each x £ we have proc(r(ux)) = addr(T(ux)) = x . A canonical A;-nice cycle only involves processors and addresses in the set Nfc. Essential to our proof of Theorem 12 is the fact that a canonical fc-nice cycle will still exist if we project out (of the trace) events of processors and addresses that are not in N^; this is formalized by Lemma 25 below. Lemma 26, in some sense, does for data values what Lemma 25 does for addresses and processors. Lemma 26 asserts that given any unambiguous trace that has a cycle in its simple constraint graph, 3.3. Verification Approach 67 one can rename the data values in the trace using only 3 values such that the resulting trace also violates S S C . Note that in general, the trace obtained through this renaming will be ambiguous, thus it does not have a well-defined simple constraint graph. Nevertheless, it can be proven that the renamed trace is not S S C . L e m m a 25. Let r be an unambiguous trace and k > 1 be such that scg(r) has a canonical k-nice cycle. Then for any n > kwe have that r f (*, *, N n , *) is unambiguous and not SSC. Proof. Let r ' = r | ( * , N n , N n , * ) . Clearly T' is unambiguous, since removing events cannot create ambiguity. We show that scg(r') has a canonical A;-nice cycle, thus the lemma follows by Lemma 23. Let / : N | T | —> N | r / | be the partial function that takes the index of each occurrence of an event of (*, N n , N n , *) in r to its index in r'; thus f(i) is undefined iff r(i) £ (*, N n , N n , *). Let c = (u\,vi,... ,Uk, Vk) be the canonical A>nice cycle of scg(r). Since n > k, f is defined for all vertices of c. We claim that d = (f(u{), /(vf),..., f(uk), f(vk)) is a canonical fc-nice cycle in scg(r'). Let E and E' be the set of edges of scg(r) and scg(r'), respectively. By condition i of Def. 29 we have {f (ut), f (vi)) € E' for each i e N f c . Now let e = (v^u^ m o d fc)+1) and m o d fc)+l )) for some i e Nk. e is included in E because of (at least) one of conditions i, ii , or iii of Def. 29. Since addr(T(vi)) = addr(r(u^ m o d whichever of these three conditions places e in E will also place e' in E'. Hence d is a cycle in scg(r'), and is clearly a canonical fc-nice cycle. • L e m m a 26. Let T € . M ( N n , N m , Nv) be an unambiguous trace and let k > 1 be such that scg(r) has a k-nice cycle. Then there exists a renaming function3 A : Nm x N „ —> N 3 such that A(r) is not SSC. Proof. The renaming function defined in the (=>) direction of the proof of Qadeer's Theorem 8.1 [ 113] has this property 4. • Assuming data independence, any value-parameterized protocol family can be concluded to be S S C if either all its unambiguous traces are S S C , or if its protocol with 3 data values is S S C . Lemmas 27 and 28 phrase these two results in terms of AVPPFs . 3Renaming functions were defined back in Def. 6. 3.3. Verification Approach 68 L e m m a 27. Let 7 be a data independent AVPPF, and let m be a positive integer. If every unam-biguous trace ofJ(m, v) is SSC for all v > 1, then lim, v) is SSC for all v > 1. Proof. This lemma is essentially Qadeer's Theorem 4.1 [113] with "sequentially consistent" re-placed with "SSC" and the proof is similar. Suppose for all v > 1, every unambiguous trace of ^(m, v) is S S C . Let r be any trace of 9 r(m, v) for some fixed v. By data independence, there exists a u ' > 1, an unambiguous trace r ' G traces(1(m, v')), and a renaming function A : N m x N „ ' —> N „ such that T = A(r') . Since r ' is S C C , it has a simple serial reordering TT. Clearly TT is also a simple serial reordering of r . • L e m m a 28. Let J be a data independent AVPPF, and let mbe a positive integer. If3(m, 3) is SSC then !y(m, v) is SSC for all v > 1. Proof. Suppose there exists v > 1 such that 9 r(m, v) is not S S C . By Lemma 27, there exists an unambiguous trace r of J(m, v') for some v' such that r is not S S C . From Lemma 24, scg(r) has a A;-nice cycle for some 1 < k < min(n, m). Using a construction similar to that of the proof of Qadeer's Theorem 5 [113], we can define a renaming function that maps r to a (possibly ambiguous) trace T ' G M(Nn, N T O , N 3 ) that is not S S C . 4 By data independence, r ' is a trace of 3(m, 3), hence ^ ( m , 3) is not S S C . • Theorem 12. Let J be an AVPPF that is processor symmetric, address symmetric, and data inde-pendent. If there exists a protocol Q such that 1. Q is SSC, and 2. For allm > n we have that traces(3:(m, 3)) T A 4 ( N „ , N n , N 3 ) C traces(Q) then ^(m, v) is SSC for all v > 1 and m > n. Proof. We argue that if conditions 1 and 2 hold, then for all m > n we have ^ ( m , 3) is S S C , which implies the consequence of the theorem by Lemma 28. Fig. 3.2 depicts the relationships between 4 Roughly, this renaming function does the following. For any address not involved in the cycle, the renaming function always maps to data value 1. Let ^ 1,^ 1,^ 2,^ 2, • • •, Uk, Vk, w*:+i — « i be the fc-nice cycle. It follows from our definitions that for each x e Nfc, there exists a unique wx e N | T | such that OP(T(Wx)) = W and VO,1(T(Wx)) = val(r(ux)). For x G Nfc the renaming function maps the values written to address addr(T(ux)) to the set {1,2,3} as follows: values of writes that are prior (in r) to T(WX) are mapped to 1, the value written by T(WX) maps to 2, and values of writes occurring after T(WX) map to 3. 3.3. Verification Approach 69 permute processors and addresses projection^/ N^rename with A' r2 T 4 rename w i t h A X ^ ^ / p r o j e c t i o n T3 Figure 3.2: Relationship between the traces mentioned in the proof of Theorem 12. TQ is an unam-biguous trace of ^ ( m , v) that is not S S C . T\ is TQ with processors and addresses permuted so that scg(ri) has a canonical /c-nice cycle. In the proof we reduce T\ to a trace T3 such that T3 is not S S C (proven by way of T2), and T3 is a trace of Q (proven by way of T4). This implies that Q is not S S C . the five traces TO, . . . , T4 involved in this proof. Suppose jF(m, 3) is not S S C for some m > n. Then by Lemma 27, there exists v > 1 and an unambiguous trace TO G traces (3 (m,v)) such that TO is not S S C . By Lemmas 23 and 24, there exists a fc-nice cycle in scg(To), for some k such that 1 < k < n = min(n, m). Since 9^ is both location symmetric and processor symmetric, by permuting the processors and addresses in TO we can obtain an unambiguous trace T\ of ^(m, v) such that scg(Ti) contains a canonical fc-nice cycle. By Lemma 25, r2 = TI | ( * , N „ , N n , * ) is unambiguous and not S S C . By Lemma 26, there exists a renaming function A : Nn x N „ —> N 3 . such that T 3 = A(T 2 ) is not S S C . Let A' : N m x N „ -> N 3 be any renaming function that agrees with A over the domain N „ x N „ . Then, because of data independence, T4 = A'(TI) is a trace of 3(m, 3). Note that T 3 = T 4 | (*, N n , N n , N 3 ) . Now if condition 2 holds, we have T 3 e traces(Q), and thus Q is not S S C and condition 1 fails. • We note that Theorem 12 does not allow us to conclude that 3 r(m, v) is S S C when m <n. This is not a serious deficiency, since we may verify correctness of these members via a finite number of model checks. Practically, these are the uninteresting cases, since multiprocessors always have many more addresses than processors. Theorem 12 is extremely useful, provided we have available to us a protocol Q satisfying the two conditions of the theorem's antecedent. The question remains, how do we concoct QI One obvious possibility is to try Q = ^ (n , 3). This Q satisfies the first condition, otherwise J is buggy. 3.3. Verification Approach 70 The second condition does not necessarily hold, however, it does hold of "Jin, 3) assuming that 5" is location monotonic (LM) . L M means that for all m, v > 1 and for all j such that 1 < j < m we have traces(5(m,u)) T A 4 ( N n , N j , N „ ) C traces (3X7>)) L M seems to be a property one might expect of real families. However, in contrast to our three assumptions of Sect. 3.2, it is not clear how one might either prove L M or enforce L M through syntactic restrictions. L M is used as an unproved assumption by Henzinger et al. [74], i.e. sound-ness of their verifications are contingent on L M holding and no guarantees of L M are made. Nalumasu [103] also employs L M , 5 and provides a formalism for describing protocols that are guaranteed to have this property, however the expressiveness of this framework is unclear. Instead of using Q = 3 r(n, 3) along with L M , we advocate a different approach: Q is con-structed as an abstraction of 7(m, 3) for all m > n, such that the second condition of Theorem 12 is guaranteed to hold. The automatic construction of our Q is possible because of the formalism we use to describe 3 which is presented in Sect. 3.4. The first condition of the theorem is then checked algorithmically using known methods based on model-checking [18,22,36,113]. If this check is successful, the conclusion of Theorem 12 follows. Otherwise, the approach has failed, and we can draw no conclusions; in other words the approach is sound but incomplete. Hence, to argue for the applicability of this approach, one must argue that real protocol families have the following properties: Property 1. They are address symmetric, processor symmetric, and data independent Property 2. They are expressible in the formalism of Sect. 3.4 Property 3. They will not yield false negatives; Le. if the family is indeed SSC then the approach succeeds It is widely accepted that real protocols satisfy Property 1 [113], especially at the high level where we model. 6 With regard to Property 2, we note that our formalism of Sect. 3.4 is quite general, encompassing all real protocols that we have encountered. For instance, many published 5Nalumasu calls L M projectability 6 Even protocols that utilize some total order on processor names (a feature that seemingly breaks proces-sor symmetry), can, in principle, be made processor symmetric by having the total order selected nondeter-ministically in the initial state. 3.4. A Protocol Description Formalism 71 protocols [6,13,16,69,84,93] are expressible in our formalism. In support of Property 3, we present successful experiments on two challenging protocols in Sect. 3.6. Furthermore, in Sect. 3.7.2 we describe a simple protocol family that does not have Property 3, and propose a work-around for such families requiring modest user assistance. 3.4 A Protocol Description Formalism We present our A V P P F description formalism as a restricted first-order logic inspired by the bounded-data parameterized systems of Pnueli et al. [109]. It is not our intent that protocols are to be written in this logic, rather, that one describes the protocol in a typical formal modeling language (eg. Mur<^ [46], S M V [94], T L A + [89], etc.) and our logic manifests as a set of syntactic restrictions on the language of choice. The formalism is tuned to provide enough expressiveness for the real protocol descriptions we have encountered, while still allowing the efficient and automatic generation of a candidate abstraction Q. Theorem 12 requires the A V P P F to be processor symmetric, address symmetric, and data inde-pendent. A l l three of these properties can be enforced straightforwardly at the syntactic level. For instance, data independence can easily be enforced by restricting the operations performed on data values as observed by Wolper [124] and others [103,113], while symmetric types such as Mur</? scalarsets [79] can be used to ensure processor and address symmetry. Our challenge in defining our protocol description logic, then, is not in enforcing these properties, but in allowing for the automatic construction of Q such that the trace containments of condition 2 of Theorem 12 hold. This serves as our justification for several simplifications we make in presenting our formal-ism. We do not provide special types for processor names and data values; we assume that this is done externally and in a manner that yields processor symmetry and data independence (address symmetry, however, is intrinsic to our syntax). In fact, other than the type of addresses and arrays indexed by addresses, we only support variables of boolean type. Hence processor names, data values, and other enumerated types must be encoded as booleans. Furthermore, since our proposed Q will abstract J(m, 3) for all m > n, we treat the number of data values as fixed at 3. Again, the understanding is that in the real description, data values will be of a parameterized type that is manipulated in a data independent manner. Therefore we are really only handling parameterization by the number of addresses, i.e. given any m > 1, our logic characterizes the protocol ^ ( m , 3) 3.4. A Protocol Description Formalism 72 involving a constant n processors, m addresses, and a constant 3 data values. 3.4.1 Syntax We assume three disjoint sets of variables X — [x\,... ,x\x\}, Y — {yi, • • • i3/|y|}> a n d Z = {zi,..., Z|2|}; and denote X U Y U Z by Vars. Priming any of these sets has the effect of priming all constituent variables; semantically, primed variables will represent the variable in the next state. The variables of X, Y, and Z are respectively of type Boolean, address, and array of Boolean indexed by address. We call the variables of Y address ranged variables (ARVs). We employ two auxiliary A R V s a and a\ that will (effectively) be quantified over, and use ARVars to denote the set f u y ' U {a, ai}. In shared memory protocols, typical (though by no means exhaustive) usages of the variables in X, Y, and Z, are respectively: fields corresponding to processor IDs or data values or message types in messages, fields storing addresses in messages, and the permission bits and data value associated with each address in a local cache or a directory. Note that we include a special "null address" value nul in the range of variables in Y U Y'. This is convenient in uniquely defining an initial state, and also in directly handling languages (such as Mur</? [46]) that support undefined values. At the heart of our logic is the quantifier-free action, which is roughly analogous to a Mury? rule or a T L A + action. Definition 32 (quantifier-free action). A quantifier-free action (QFA) is a formula with the syntax defined by: Atom ::= x \ z[a] | z[a\] \ a=3 | y=nul $ ::= Atom | ->$ | ($ V $) | ($ A $) where x € X U X', y£YLlY',z€ZLlZ', and a, 3 € ARVars. Also, terms ofthe syntax Atom are called atoms, and atoms of the form a=@ are called A R V equality tests. The transition relation of our family is expressed by a finite set of Q F A s , each associated with a unique element from a finite set of action labels L such that {R, W} x N n x N 3 C L. Formally, the transition relation is expressed by {<t>e\ee L} where, for each £ 6 L, (pe is a Q F A . Aside from the transition relation, we must describe also the initial state of our A V P P F . This is done by a function init : X U Z - > B , which takes each variable 3.4. A Protocol Description Formalism 73 in X U Z to an initial boolean value. For x £ X, init(x) specifies the initial value of x, while for z G Z, init(z) is the initial value of every entry in the array z. The variables of Y are not interpreted by init because their initial values are required to be nu l . As we will see in Sect. 3.4.2, a transition (i.e. state/next-state pair) can be made only if it sat-isfies some fa, with a existentially quantified and a\ universally quantified. Thus a can be viewed as a distinguished address pertaining to the transition, while all other addresses a\ are treated in a uniform manner. This restriction accords exactly with what we have observed in real protocol descriptions: typically, this uniform treatment of the "other" addresses a\ asserts that state asso-ciated with a\ (i.e. any array entry that doesn't correspond to a) remains fixed. However, several transitions in the WIS protocol we experiment with in Sect. 3.6 have a more involved effect on the other addresses, i.e. a certain state change for one address forces all other addresses to abandon an optimization mode in the relevant cache. A limitation of our formalism immediately evident from Def. 32 is that the auxiliary A R V s a and a\ are the only A R V s that can be used to index into arrays. However, typical instances of indexing into some z G Z using an A R V y EY can be performed by, for example, y=a A ->z[a]. 3.4.2 Semantics In this section we assume we have the ingredients detailed in the previous subsection: a finite set of action labels L such that {R, W} x Nn x N 3 C L, a set of Q F A s {fa \ £ e L}, and an initial state function init. For any m > 1, these ingredients define the protocol 3(m, 3). The states of 3(m, 3) are interpretations of Va rs called m-states: Definition 33 (m-state). For m > 1, an m-state is a mapping s that interprets each v G Vars , with typing as follows 1 ifv G X s ( v ) S < N m U {nul } ifv G Y ^ N m - » 1 ifv G Z If s is an m-state, then s' is the interpretation of'Vars' defined by s'(v') — s(v)for all v G Vars . Let s and t be m-states, let (j> be a Q F A , and let j , k G N m be integers. Then we write s,t' N <p\j/a,k/ai] 3.5. A Candidate Q 74 if 4> holds when unprimed variables are interpreted by s, primed variables are interpreted by t', and a and a\ are respectively interpreted as the constants j and k? We may now define the protocol 7(m,3) = (S,E,5,s0) : • S is the set of all m-states. • S = L x N m . In a slight abuse, we identify each ((o,p,v),j) G £ where (o,p,v) G {Ti, x N n x N 3 . with the memory event (o,p,j,v) G M • <5 is the set of all triples (s, (£,j),t') such that s and t are m-states, ( £ , 7 ) G 2 , and for all k G N m we have s, t' 1= <pg\j/a, k/a{\. • SQ is the unique m-state such that for each v G Vars we have 8 3.5 A Candidate Q Our candidate Q is formed by a syntactic transformation on the description of 9\ A n important aspect of Q is the inclusion of a designated abstract address, denoted £, in the range of the non-auxiliary A R V s YUY'. £ abstracts the infinite set of addresses N \ Nn. The states of Q are n-states with A R V s extended to include £ in their domain. Definition 34 (abstract state). An abstract state is an m-state where m — n, with the exception that the range of variables in Y is extended to included £. Note that abstract states have the arrays in Z still indexed by N n , rather than Nn U { £ } . This is because the "£th" array entries will be, in effect, existentially quantified away. Thus the abstract states are a superset of the n-states, since the latter are simply the abstract states in which no y G Y is assigned £. A n important notion in defining Q is a syntactic substitution operator sub(), defined here. 7 O f course this definition is somewhat informal. The formal definition of N would be done inductively over the syntax of Def. 32, and essentially follow the standard semantics of first-order predicate logic with equality. 8In defining so(v), the expression \a.init(v) denotes the function that takes each address to the constant boolean value init(v). 3.5. A Candidate Q 75 Definition 35 (substitution operator). Given a QFA ip, sub(tp) is the QFA obtained via the follow-ing three substitutions. 1. each occurrence of a=P falling under an odd number of negations (where a, (3 G A R Vars) is replaced with ( a = / 3 A - i ( a = £ A / 3 = 0 ) (3-D 2. for each z G Z U Z', each occurrence of z[a] is replaced with z, where z is a fresh boolean variable. 3. each occurrence of a remaining after the previous substitution is performed* is replaced with e We also define subi(ip) to be the formula obtained by performing only the first of these three substi-tutions. The motivation for the first substitution is as follows. Semantically, we expect £ = £ to be true, since clearly the symbol £ is equal to itself. However, the purpose of £ is to abstract multiple (in fact infinite) concrete addresses. In actuality we simply don j know if the two occurrences of £ on either side of "=" abstract the same concrete address or not. It turns out that to ensure the transition relation of the abstraction Q is conservative, i.e. over-approximates the transitions of each ?(m, 3) where m > n, an A R V equality test in which both operands evaluate to £ should evaluate to false if the test falls under an odd number of negations (in the Q F A ) . One can easily confirm that the substitutive expression (3.1) is false whenever a = (3 = £ and has the truth value of a=(3 otherwise (i.e. equality tests not involving two £ s are unaffected by the substitution). This first substitution is done on all Q F A s when defining Q. The second and third substitutions are only used to construct the abstract transitions of Q, which pertain to the abstract address £. The second facilitates the existential quantification of the £th entries of arrays via the introduction of fresh variables, while the third performs the necessary substitution of £ for the "distinguished" auxiliary A R V a. We now formally define Q to be the protocol (SQ, Y,Q,5Q, SOQ) with components as follows. • SQ is the set of all abstract states. 9Note that after the previous substitution, the only occurrences of a will be in A R V equality tests. 3.5. A Candidate Q 76 • S Q = L x ( N n U { £ } ) . A s in the semantics of !F(m, 3), we identify ((o,p, v), j ) € L x N „ where (o,p, v) € {i?, x N „ x N 3 with the memory event (o,p,j,v) 6 M. However, for the purposes of defining traces(Q), no actions in L x { £ } are considered to be memory actions. • 5Q is the set of all triples (s, (£, j),t') such that s and t are abstract states, £ e L, and either (abstract transition) j = £ and for each k € N n we have 1 0 s,f' N 3zs.sub(0/)[fc/ai] (3.2) where £s is the vector of variables z~i,..., zjz\, z[,..., z'^, or (concrete transition) j € N n and for each k e N n we have s, i ' N subi(^)[j ' /a , fc/ai]. • SOQ is the initial state of ?"(n, 3). Several modeling languages have direct support for the existential quantification in (3.2), for exam-ple T L A + [89] and Mur<p , courtesy of the ruleset construct [46]. In practice we find that only a small number of the variables zs are actually mentioned in each <pi. Thus the number of distinct tran-sitions induced by the existential quantification in (3.2) is typically much less than the worst-case exponential bound of 22^ZK In the later Sects. 3.7.1 and 3.7.2 we give examples of the abstraction used to define Q. We conclude this section by proving Theorem 13, which asserts that traces(Q) over-approximates a projected version of traces(3(m, 3)) for all m > n , i.e. Q satisfies condition 2 of Theorem 12. To prove Theorem 13, we show that there is a natural abstraction function that takes the concrete states of 3(m, 3) to abstract states of Q. Furthermore, the transitions of Q are conservative with respect to this abstraction function. Though the proof of Theorem 13 is conceptually straightforward, careful consideration of the multitude of base-cases in the proofs of the supporting Lemmas 30 and 31 causes them to be somewhat tedious. Theorem 13. traces(J(m, 3)) tM(N n , Nn, N 3 ) C traces(Q)for all m > n. Proof. Immediate from Lemmas 32 and 29 below. • 1 0Here the existential quantification of boolean variables has the usual semantics that 3x.ip is equivalent to ip[T/x] V il>[F/x]. 3.5. A Candidate Q 77 Lemmas 32 and 29 make use of the notion of simulation relation, which is an association be-tween states of two different systems used to prove that one system in some sense over-approximates the other. Simulation is a common theme across many papers on formal verification, and appears in many guises and variants. The literature tends to attribute the origin of the idea to Milner [100]. Simulation relations often imply certain language containments; ours being no exception. Here we craft a notion of simulation relation that suits our needs. Definition 36 (S-simulation). Given two automata11 A\ = (Si, S i , 8X, soi) and A2 = (S2, S2, Si, S 0 2 ) and an alphabet S, a relation R C Si x S2 is said to be a S-simulation relation from A\ to A2 if we have both of the following. 1. for all (si,s2) G R, for each transition (si,ai,s'i) G 61, there exists s'2 such that (s2, a2, s'2) 6 52 and (s\, s'2) G R. Furthermore, we require that ai G S implies a2 = a\, while ai 0 S implies a2 S. 2. (SQI,S02) G R. If there exists a T,-simulation relation from Ai to A2 we say that A2 S-simulates Ai. Intuitively, we can think of S as specifying a set of observable symbols. Whenever Ax can transition on an observable, A2 must be able to transition on the same observable. Also, whenever Ai can transition on an unobservable, then A2 must be able to transition on some unobservable, not necessarily the same one. A straightforward lemma relating S-simulation to projected language containment is the following. L e m m a 29. If automaton A2 T,-simulates automaton A\ then C(Ai) T S C C(A2) j S . Proof. Let R be a S-simulation relation from A i to A2, and let T = T(1) . . . r(m) be a string in C(A\) | S . Then there exists a string pi = pi(l) •.. pi(k) of length k > m such that pi G C(Af) and pi T S = r. It follows that there exists a sequence of states s\,...,s\ of A i such that s\ is the initial state of A i , and for each 1 < i < k, we have that (s^ - 1 , pi(i), s\) is a transition of A\. From Def. 36, there exists a string p2 = 2^(1) • • • P2(k) and a sequence of states sP>,..., s2 of A2 such that "Restricting attention to automata having all states accepting simplifies this definition. Furthermore, we only apply E-simulation to protocols (in which all states are inherently "accepting"). Hence we have inten-tionally neglected to specify the accepting states (normally the fifth component) for these automata. 3.5. A Candidate Q 78 • s2 i s t n e initial state of A2, and • for each 1 < i < k, we have that (s; J 2 \ P2(i), s2) is a transition of A 2 , and • for each 0 < i < k, we have that (s\, sl2) G fi, and • p 2 TS = r Hence p 2 € C(A2) and r G £ ( A 2 ) T E . • We now define a function H that, for any fixed m > n, takes the set of m-states to the set of abstract states, and then we prove that H is in fact a A 4 ( N n , N n , N3)-simulation relation from 3"(m, 3) to Q. For any j G N U {nul}, we define j — £ if j G N \ N n , otherwise we define j = j. Definition 37 ( H ). Le? 5 be ?ne 0/ m-states for some fixed m > n. Define the function H : S —> SQ such that for each s G S we have 1. for each x G X, H(s)(x) = s(x) 2. for each y £Y, H(s)(y) = s(y) 3. for each z G Z, H(s)(z) is the restriction of s(z) to the domain Nn. Before stating that i f is a simulation relation below in Lemma 32, we first present the two supporting Lemmas 30 and 31. Lemma 30 states that a transition of ^ ( m , 3) on address j < n is simulated by a concrete transition of Q, while Lemma 31 states that a transition on an address j > n is simulated by an abstract transition of Q. L e m m a 30. For any QFA cj), m-states s and t, and j, k G N n , s,t; \= (f)[j/a,k/ai] (3.3) implies ff(s),ff(t)'l=subi(0)[j/a,fc/ai] (3.4) 3.5. A Candidate Q 79 Proof. Without loss of generality, let us assume that <f> is written in negation normal form. 1 2 The proof is by induction on the structure of <f>. The base cases correspond to <f> being an atom or the negation of an atom. When the atom is an A R V equality test, the argument for the non-negated and negated variants are nonanalogous; thus these are handled separately below. A l l other negated atoms are not considered because their proofs are analogous to that of their non-negated versions. We also omit treatment of the primed variable versions, again because of analogy. As usual, x 6 X, y,w E Y , and z £ Z . 1. <j) = x. Trivial, since H preserves the values of the X variables. 2. 4> = z[a]. Then subi((f>)[j/a, k/af\ = (f>\j/a, k/a\] = z[j], thus (3.3) implies (3.4). 3. <\> — z[a\). Then subi (0 ) [ j /a , k/af\ — <fi\j/a, k/a{\ = z[k], thus (3.3) implies (3.4). 4. (j> = y=nul. Trivial, since H preserves equality with nul. 5. <f> = y=a. Then subi(<j>)[j/a, k/a\] — 4>[j/a, k/a\] — y=j, thus (3.3) implies that s(y) — j, and thus H(s)(y) = j, yielding (3.4). 6. 0 = ->y = a. Then subi 0)[j /a , k/ai] = -> (y=j A -> ( y = £ A j = £ ) ) , which, since £ ^ j, reduces to -^y = j. Thus (3.3) implies s(y) E N m \ {j}, and it follows that H(s)(y) E { ( } U ( N „ \ {j}) and thus (3.4). 7. (p = y=a\. Then subi (0 ) [ j /a , k/af\ = y=k, and <t>\j/a, k/a{\ = y=k. Thus (3.3) implies s(y) = k < n, and hence H(s)(y) = k, yielding (3.4). 8. <f> = ->y=a\. Similar to item 6. 9. 4> = a=a\. Then subi((p)\j/a, k/a{\ — 4>[j/a, k/a\] = j=k. Thus (3.3) implies (3.4). 10. cj) = -^a=a\. Then subi(0)[j'/a, k/a{\ = -< (j=k A -< ( j = £ A fc=£)), which reduces to ->j=k, and <f>\j/a, k/a\) = ->j=k. Thus (3.3) implies (3.4). 11. <j) = y = w. Then subi(4>)[j/a,k/a{\ = (f>[j/a,k/a\] = y = w. Thus (3.3) implies that s(y) = s(w), which always implies H(s)(y) = H(s)(w), and hence (3.4). 1 2 A QFA is in negation normal form if negations are only applied to atoms. Any QFA can be rewritten in negation normal form by pushing negations inwards using De Morgan's law. 3.5. A Candidate Q 80 12. cp = ->y = w. Then subi(<f>)\j/a, k/a\] = -> (y=w A - i ( y = £ A w=()) and <p\j/a, k/ai] = ->y=w. Assuming (3.3), we case split depending on the propositions s(y) < n and s(w) < n. • s(y) < n and s(w) < n. Then H(s)(y) = s(y) ^ H(s)(w) = s(w) and thus (3.4). • s(y) > n and s(w) < n. Then H(s)(y) = £ ^ H(s)(w) and thus (3.4). • s(y) < n and s(w) < n. Analogous to the previous sub-case. • s(y) > n and s(w) > n. Then H(s)(y) = H(s)(w) = £, and again we have (3.4). For the inductive step, note that if <fi = <f>o A <f>\ and (3.3) holds of cp, then clearly (3.3) holds of both 4>o and <p\. By our inductive hypothesis (3.4) holds of both (po and <p\, and hence also <p. The inductive step for disjunction is analogous. • L e m m a 31. For any QFA <j>, m-states s and t, integer j G N m \ N n , and k € N n , s,l/\=<j>\j/a,k/ai] (3.5) implies H(s),H(t)' l= 3zs.sub((f))[k/ai] (3.6) Proof. For any m-state u, let H3 (u) be the interpretation of the variables X U Y U Z U i s that is equivalent to H ( u ) for the variables X U Y U Z, and, for each F G is , we set HJ(u)(z) = ^(^( j ) . We prove that for any k G N „ , we have i? J'(s), ZF'(£)' N sub(^ )[fc/oi] (3.7) which clearly implies (3.6). The proof is by induction on the structure of <f>, and, as in the proof of Lemma 30, we assume that <p is in negation normal form. Many of the base cases are very similar to cases of the proof of Lemma 30. Here we only treat those that have a significant difference; the cases are numbered according to the corresponding cases of Lemma 30. As usual, x G X, y, w G Y, and z G Z. 2. (j> = z[a]. Then sub(0)[fc/ai] = z, and <p\j/a, k/a{\ = z[j], thus (3.5) implies (3.7). 6. cp = y=a. Then sub(cf))[k/ai] = y = £ , and <p[j/a, k/a\\ = y=j. Thus, s(y) = j > n, and hence HJ(s)(y) = £, yielding (3.7). 3.6. Experimental Results 81 1. (p = ~>y=a. Then sub (<£)[fc /a i ] = -> (y=f A -> ( y = £ A £ = £ ) ) > which is a tautology, thus we have (3.7). 9. (p = ->y=ai. Then sub(0)[fc /ai] = - i (y=fc A - i ( y = £ A fc=0), which is semantically equiv-alent to -<y=k. Also, (p\j/a, k/a{\ = ^y=k, thus (3.5) implies that s(y) ^ k, which implies that W(s){y) ^ A;, and hence (3.7). 10. <f> = a=a,i. Then <j>\j/a, k/a{\ = j=A:, and therefore (3.5) cannot hold, since k < n < j. 1 1 . 0 = ->a=ai. Then sub(0)[/c/ai] = -> (£=/c A - i ( £ = £ A fc=£)), which is a tautology. Hence (3.7). The inductive step is analogous to that of the proof of Lemma 30. • L e m m a 32. H is a AA(Nn, Nn, N^-simulation relation from y ( m , 3) to Q. Proof. First, we note that condition 2 of Def. 36 is satisfied, since H(SQ) = SOQ , where SQ is the initial state of 7(m, 3). The remainder of the proof is devoted to condition 1 of Def. 36. Let s and t be m-states, and j G N m . We will show that if (s, (£, j), t') is a transition of 3(m, 3), then (H(s), (£, j), H(t)') is a transition of Q . This implies the lemma because (£, j) G M(Nn, N n , N 3 ) iff (£,j) G A 4 ( N n , Nn , N 3 ) , and if j G N „ then j = j. Now, assuming (s, (£,j),f) is a transition of ^ ( m , 3), then for all k G N m we have s, t' \= <pt\j/a,k/a\\; in particular this is true for all k G N n , since n < m. We case-split on whether j < n. If j < n, then by Lemma 30 we have H(s),H(t)' \= subi(<f>e)\j/a,k/ax) for all k G N „ , and thus (H(s),(£,j),H(t)') G <5Q. Now suppose that j > n. Then, by Lemma 31, we have that H(s),H(t)' t= 3is.sub(0^)[A;/ai] for all A: G Nn, and thus (77(s), ( £ , £ ) , H(t)') e <JQ- Note that neither (^,j) nor (^,f) are in - M ( N n , N „ , N 3 ) , thus Def. 36 is satisfied in this case. • 3.6 Experimental Results To evaluate our technique, we experimented with two protocols, which we call PIR and WIS. Both of these protocols are S S C but not serial, hence trace reordering requirements are nontrivial. PIR is a simplified abstraction of the Piranha protocol [13] as presented by Qadeer [113]. WIS is a sim-plification of a directory based protocol with Scheurich's optimization [116]. Our implementation 3.6. Experimental Results 82 is based on, but is simpler than, the description verified by Braun et al. [22], which was designed by the University of Wisconsin Multifacet group. We discuss aspects of both protocols here and describe the ways in which our implementation of WIS is simpler than the version used by Braun et al. [22]. In both PIR and WIS, each processor p has a cache that contains, for certain memory locations j, a data value data[p]\j] and an access permission access\p]\j]. The permission may be modifiable (M), shared (S), or invalid (I). Processor p may read the data value for location j if access[p]\j] is S or M , and may write (change) the data value if access\p][j] is M . In addition to the caches, PIR has an incoming response queue for each processor and an owner processor for each memory location. A n invariant of PIR is that the owner of location j is either some processor p for which access[p][j] € {S, M}, or the owner is null. Requests by a processor to change its access level or to get a data value for a location are not modeled explicitly. Rather, if owner\j] — p, in one transition of the protocol an exclusive request acknowledgment message ( A C K X , data\p}[j], j) may be placed on the queue of any processor p' ^ p, in which case an invalidate message (INV, j) is placed on the queues of any processor p" (other than p and p') with access\p"][j] ^ I. Also, owner\j] is set to null and access [p][j] is set to I. In a later transition, when triple ( A C K X , d, j) is at the head of p''s queue, the triple may be removed from the queue, in which case (Ma[p'][j] is set to d, access\p']\j\ is set to M , and owner\j] is set top'. Also, if (INV, j) is at the head of the queue of p", the message may be removed from the head of the queue, in which case access[p"][j] is set to I. Other access permission changes are modeled similarly. The state space of PIR is relatively small because requests of processors are not modeled explicitly, and moreover, no directory is used to store the set of processors with shared access to a memory location. However, the use of queues ensures that the traces of PIR are interesting in the sense that they are S S C but not serial. The WIS protocol contains many details that are not present in PIR. Each processor and the di-rectory has both a request and a response input queue, with different uses. For example, invalidate messages to processors are placed on the request input queue, whereas messages containing data values are placed on the response input queue. A directory maintains information regarding which processors have exclusive or shared access to a memory location. Requests for exclusive permis-sions received by the directory are redirected to the current owner if it is owned with permissions M . 3.6. Experimental Results 83 Because of the multiple queues, several race conditions can arise. For example, the directory might receive a request from processor p' to have exclusive access to location j after exclusive access was granted to another processor p. It is possible that p receives the request to send j's data value to p' before p has even received the message granting exclusive access, which also contains the data value for j. A s a result, a processor has 9 permission types per location in its cache in addition to the I ,S, and M types. For example, access[p][j] may be IMS, indicating that p requested M access when access [p][j] was I, p has not yet transitioned to M access, but already another request to p to downgrade to S access has been received. To keep the state space within manageable proportions, our implementation of the WIS protocol does not model a certain queue of Braun et al. [22]. This queue is used for transmission of data within a processor, rather than between processors, and its removal does not significantly change the protocol. Both PIR and WIS were modeled using the Mur</? language and involved 165 and 1397 lines of code, respectively (excluding comments). The Mxxnp language, of course, is more expressive than the formalism of Sect. 3.4, but the implementations only involve constructs that conform to this formalism. Although the construction in Sect. 3.5 is obviously automatable, we do not yet have an implementation for the Mur<p language, so we performed the construction by hand, following the described syntactic transformations. In many instances we applied obvious optimizations to the code resulting from the syntactic transformation of Sect. 3.5; in all cases we believe these optimizations could be performed algorithmically. For WIS, the model checking runs against the "automatically"-generated Q spaced out, so the protocol was manually abstracted further, yielding Q'\ the numbers in Table 3.1 refer to the com-pleted verification runs against Q'. The essential difference between Q and Q' is that in the lat-ter, all fields (except for the address field) in messages pertaining to the abstracted address £ are abstracted.1 3 The same approach was taken with a local record at each processor called the trans-action buffer. Since Q' is an over-approximation of Q, the fact that the verification succeeded for Q' proves that verification would have succeeded for Q, had we had sufficient memory resources. In other words, our automatic construction of Q was accurate enough to prove S S C of the protocol family. In general, one could envision a tool that automatically attempts such additional abstractions 1 3Here, by abstracted, we mean that certain state variables v are, on occasion, assigned a "no-information" value (akin to J_ discussed in Sect. 3.7.1). Whenever v is compared to some constant, the code is changed so that if v is the no-information value, then the comparison succeeds. 3.7. Comments on our Abstraction 84 Protocol k #states time depth prob PIR (g = 1) 1 49365 7 18 « 0 2 138621 9 20 « 0 PIR (q = 2) 1 3782880 100 21 « 0 2 10558306 278 23 « 0 PIR3(g = 1) 1 125865495 9244 36 < 0.000024 2 374557312 25640 38 < 0.021101 WIS (g = 1) 1 171088424 49660 53 < 0.000013 2 375967684 110211 59 < 0.000324 Table 3.1: Results for the PIR (Piranha) and WIS (Wisconsin Directory) Protocols. A l l runs are with the number of processors n = 2, except for PIR3 with n = 3. We experimented with two versions of PIR: with processors' queue depth g = 1 and g = 2. We use a method of Qadeer [113] to prove S S C of our generated finite-state abstract protocol Q. For each k £ Nn, Qadeer's method requires a separate model-checking run that checks for the presence of A>nice cycles. Times are in seconds, on a 2Ghz Intel Xeon with 4 G B memory running Linux, "prob" is an upper-bound on the probability of missing states due to hash compaction, as reported by Mur</? [121] (40 bit hashes for PIR; 42 bits for WIS). The n = 2 runs concluded successfully, enabling us to conclude S S C for each example over all address counts m and data value counts v where m > n = 2. The PIR3 results are a preliminary attempt with n = 3 processors. For PIR3 with k = 2, we used 35-bit hashes. We have not yet completed a k = 3 run at press time. if model checking the original Q is intractable. Table 3.1 details our experimental verification efforts for three configurations of PIR and one configuration of WIS. The 2-processor runs were successful, showing that our generated abstrac-tion is accurate enough, even for these protocols with non-trivial reordering properties (which are therefore hard-to-prove sequentially consistent). 3.7 Comments on our Abstraction In this section we consider two points of interest related to our abstraction of 2f into Q. First we defend our choice by showing that a better-known and perhaps simpler abstraction can be too coarse, while ours succeeds. Second, we observe that though our abstraction is successful against the two example protocols in Sect. 3.6, it is capable of failing because of its inherent incompleteness; this deficiency is typical of abstraction-based verification approaches. We provide a simple and reasonable protocol for which our approach fails, and we suggest a possible solution to this problem. 3.7. Comments on our Abstraction 85 3.7.1 Comparison to Other Abstractions Similar abstraction approaches such as those of McMil lan [95,96] and Chou et al. [28], differ in a subtle but important way from ours. 1 4 In effect, they use three-valued logic to define the abstracted system. Any reference to an abstracted array entry z[£] evaluates to a "no-information" logic value ± . Equality comparisons with ± always yield _L, and boolean connectives involving J_ are evaluated according to the usual three-valued logic rules. 1 5 If a transition between two states evaluates to T or _L, then the transition is admitted by the abstraction. For the purposes of this discussion, we will call this approach L-abstraction, while our approach will be called 3-abstraction. The difference between -L-abstraction and 3-abstraction is that the former, in general, is coarser. One can easily construct an example to illustrate this; suppose our system has a Q F A where ip is some constraint on the primed variables. This transition is guarded by z[a] A ~^z[a\. Using 3-abstraction, we (essentially) get the abstract transition The guard of (3.9) always evaluates to F, as does that of the concrete transition (3.8), therefore neither transition can ever occur. However, if we apply ± - a b s t r a c t i o n , the guard of the transition becomes _L A ->J_, which evaluates to _L in the three-valued logic. This, in effect, means that the transition becomes unguarded. 1 6 Hence the transition, which cannot fire in either of the concrete system or the 3-abstraction, is always enabled in the J_-abstraction, and thus _L-abstraction is strictly coarser. In general, 3-abstraction will likely be finer for rules that syntactically mention the abstracted entry of the same array multiple times. In such circumstances, 3-abstraction ensures that all oc-currences are considered to have the same value, while J_-abstraction makes no such guarantee. O f course, one would not expect to see syntactic constructs resembling the guard of (3.8) in real 1 4 O f course, they differ in the not-so-subtle fact that they abstract processes rather than addresses in their applications. I 5 Which are defined b y T A J . = ± A J . = F V J _ = _LV_L = - i _ L = _L, F A J . = F, and T V _L = T 1 6 To see this, note that (_L A ->_L) Aip = ( 1 A 1 ) A = ± Aip, which is either ± or F, depending on the value of ip. Therefore, as long as the next state satisfies the constraints imposed by ip, the transition is admitted independently of the current state. (z[a] A ->z[a]) A ip (3.8) 3z.(z A ->z) A sub(ip) (3.9) 3.7. Comments on our Abstraction 86 Guard Command buffer.msg Type=G E T X A buffer.address=a A dir[a].state=M A -irequestQfull(dir[a\.owner) SendGETX(a, dir [a], owner); buffer := empty; dir[a].owner := buffer.processor; dir [a], state ~ M t o M (a) The unabstracted QFA / Guard Command 3do G {1,2}. buffer, msg Type=Q E T X A buffer .address=^ \ A -irequestQfull(do) SendGETX(£, do) buffer := empty (b) Our 3-abstraction of the QFA Guard Command buffer, msg Type=G E T X (SendGETX(£, 1) © SendGETX(£, 1)); A buffer.address=£ buffer := empty A (-irequestQfull(l) V ^requestQfull{2)) (c) A J_-abstraction of the QFA Figure 3.3: Example of a Q F A (expressed in guarded commands) for which _L-abstraction is too coarse descriptions. However, more elaborate and subtle examples in which ± - a b s t r a c t i o n is too coarse exist. Fig. 3.3 gives an example of a Q F A , based on a rule appearing in the Wisconsin directory pro-tocol (one of the experimental protocols of Sect. 3.6), along with its 3-abstracted and ^-abstracted versions. For this Q F A , in contrast with 3-abstraction, _L-abstraction is too coarse for a typical verification goal to succeed. Fig. 3.3(a) is the unabstracted Q F A , expressed in guarded commands. 1 7 In this example, we assume that there are n = 2 processors with names 1 and 2. Roughly, this Q F A models a protocol transition occurring when the directory receives a request for modify (M) access to an address a, but the directory has previously granted modify access to another processor (called the owner). The directory handles the request by forwarding it to the owner, if possible. The variable buffer stores the message incoming to the directory. The name of the current owner of address a is stored in dir [a], owner. The guard ensures that the owner has room in its incoming request queue to receive 1 7 The correspondence between our guarded commands and the AVPPF formalism described in Sect. 3.4 is straightforward. Roughly, to convert a guarded command into a QFA, one primes all the left-hand sides of as-signments, adds constraints fixing all variables that are left unassigned, and conjoins the resulting expression with the guard. 3.7. Comments on our Abstraction 87 a message. The command, among other things, actually sends the message to dir[a]. owner, via the macro SendGETX (a, p), which appends a message to p's queue requesting that it relinquish M access to address a. Fig. 3.3(b) depicts the result of applying our 3-abstraction to the Q F A of Fig. 3.3(a), after some modest simplifications. Note that the two updates to array entries at the £ index (i.e. the last two lines of the command of Fig. 3.3(a)) vanish as a result of the existential quantification of the "primed and hatted" variables corresponding to this state. However, since the unprimed array entry dir[a].owner is mentioned more than once, we must keep the quantification. We use do for the hatted variable substituted in for dir[a].owner as a result of the second substitution of Def. 35. Note that even though do can nondeterministically be either of 1 or 2, from the scope of the quantification we see that the processor that is confirmed (by the guard) to have room in its request queue is the same processor that is actually sent the message in the command. -L-abstraction can be performed on the Q F A of Fig. 3.3(a) in several equivalent ways, one of which is shown in Fig. 3.3(c). The boolean exclusive-OR © in the command enforces that exactly one of the two processors is forwarded the request message. The crux of the matter is that the processor confirmed to have room in its request queue can differ from the processor that the message is actually sent to. This can clearly be problematic if the latter has a full queue. For instance, depending on how the macro SendGETX (a, p) is "implemented", an earlier message lingering in p's queue could be overwritten when the _L-abstracted Q F A fires. 3.7.2 Example of Verification Failure Fig. 3.4 describes a A V P P F C that is S S C (in fact it is serial) for which the verification approach of this chapter fails. Though this A V P P F was concocted by the author, it is by no means unrealistic. Fig. 3.4(a) specifies the transitions of C using guarded commands and Fig. 3.4(b) defines the initial state predicate. As specified in Fig. 3.4 the description is parameterized by the number of data values, addresses, and processors. However, in keeping with the theme of the chapter, we consider the number of processors to be fixed at some n. Fig. 3.4(c) gives the architecture of C (when n = 2) annotated with the state variables. Behaviorally, the A V P P F is relatively uncomplicated, here we give only a brief description. Each processor p has a cache, and each address a in each cache has an associated valid bit; when Comments on our Abstraction Action Label Guard Command (R,p,a,d) cache\p][a\.valid Acache\p][a].data = d (W,p,a,d) cache\p][a\.valid cache\p][a].data := d Request (p, a) - i cache \p] [a]. valid Areq_addr\p] = nul req[a]\p] := T ; req_addr\p] := a WriteBack(p, a) cache\p][a\.valid cache\p][a\.valid := F; mem[a] := cache\p][a].data; granted[a] := F Grant (p, a) ^granted[a] Areq [a]\p] granted[a] := T ; reg[a][p] := F; buffer\p] := m e m [a] ReceiveGrant(p, a) req_addr\p] = a Abuffer\p] 7^ empty cac/ie[p][a].rfota := buffer\p\; cache\p][a\.valid := T ; req_addr\p] := nul; buffer\p] := empty (a) Transitions of C / -icac/ie[p][a].uaZic? ^ A -reg[a][p] V a , p . A req_addr\p] = nul A -i5franiec?[p] \ A buffer\p] = empty / (b) Initial state predicate of C. Note that this predicate can easily be trans-lated into an initial state function init as required by our formalism. cache[l] cache[2] req_addr[l] req_addr[2] buffer[\]\ \buffer[2\ 11 If req granted mem (c) Architecture of C instantiated with 2 processors Figure 3.4: Example A V P P F C for which our 3-abstraction is too coarse to verify S S C 3.7. Comments on our Abstraction 89 this bit is set, we will say that p has access to a. When a processor has access to an address, it is guaranteed to be the only such processor, and is hence permitted to both read and write the address. A central directory coordinates access requests. When processor p wants access to an address a, it makes a record of the address locally (in req_addr\p\), and a bit recording the request is set in the directory (reo[a][p]); note that a processor can have at most one outstanding request at any time. Using the bit granted[a], the directory remembers if some processor has access to address a. If not, it can nondeterministically choose a processor p that has previously requested access to a, and grant access to p. This is achieved by writing the data value the directory holds for a into a buffer for p. When p sees that there is data in its buffer, it "knows" the relevant address by reading its local variable req_addr\p\. It may then clear req_addr\p], empty its buffer, and update its cache appropriately. Note that the usage of req_addr\p] eliminates the need for an address field in buffer\p\. To see that our approach fails to verify C, consider the abstracted version of the action Grant occurring in Q, call it absGrant. Translated into our logic and simplified, absGrant looks like absGrant = 3nu7m.buffer\p]'=ml>rh A ipfix (3.10) where ipfix simply expresses that all primed state variables other than buffer\p]' are left fixed. In particular, (3.10) has no guard (i.e. constraint on unprimed variables), and hence is always enabled. If processor p has previously requested access to a non-abstract address j , i.e. req_addr\p] = j , firing absGrant will result in p "thinking" that it has received data (and thus access) for address j . The data value mem introduced by the existential quantifier in (3.10) can clearly be a value that has never been written to address j , thus S S C will be violated when p subsequently reads address j . How then can we handle AVP P F s for which our abstraction is too coarse, such as C? One possible solution is to require the user to provide so-called noninterference lemmas [28,95,96]. A noninterference lemma is an invariant used to refine the abstraction when verification fails as a result of an abstracted component provoking erroneous behavior in a concrete component. Deploying a noninterference lemma involves both proving that the lemma is an invariant and restricting the behavior of an abstracted component according to the lemma. In our case, the abstracted component corresponds to all the £th entries of arrays, and the inter-ference stems from the fact that the existentially quantified state of such entries can behave as if a 3.7. Comments on our Abstraction 90 processor has an outstanding access request for the address £ , when in fact it does not. A nonin-terference lemma can be surmised by contemplating the question of why this interference doesn't arise in the concrete protocol. The answer: an invariant of the A V P P F is that a processor p is only ever sent data for the address named in req_addr\p\. Further reasoning leads us to the following noninterference lemma, where p and a respectively range over processors and addresses. Va,p.(req[a]\p] —> req_addr\p]=a) (3.11) To refine our abstraction, we may strengthen any abstract transition with the noninterference lemma (3.11). Doing so to the guard of Grant (p, a) (and applying universal instantiation and modus po-nens) yields the strengthened guard: -^granted[a] A reg[a][p] A req_addr\p]=a (3.12) Now using our 3-abstraction on Grant with the guard strengthened to (3.12) gives us a refined absGrant: absGrant' = 3mem.req_addr\p]=^ A buffer\p]'=mem /\ipfix (3.13) The reader may confirm that the verification failure induced by using (3.10) as the abstraction of Grant is abolished by instead using (3.13). O f course, if we apply a noninterference lemma such as (3.11), we are obligated to prove it. This can be done using the surprising and powerful result that a noninterference lemma can be proven in the abstracted system that has been refined by the very same lemma we aim to prove [28,95,96]. In our example, this equates to verifying that (3.11) holds (for a ranging over concrete addresses only) in the abstraction that has been refined with absGrant1. Chapter 4 Process Parameterized Verification us ing B D D s 4.1 Introduction This chapter develops an approach for performing automatic verification of protocols parameterized by processors. The technique is applicable to a certain class of systems involving an arbitrary number of interacting finite state clients. Since these clients do not necessarily model processors, we will use the more general term process to refer to a client. Because of the difficulty inherent in this problem, we turn attention away from the verification of sequential consistency. Instead we handle only assertional verification, wherein one characterizes the "bad" states and strives to verify that no such states are reachable in the system. To motivate the approach of this chapter, consider the following simple verification strategy. First model check the system restricted to one process, then two processes, then three, etc.; if a bug is found, then terminate the procedure. The obvious drawback is that if no bug is found, in general there is no way of determining if the system truly is bug-free, or if we simply have not analyzed enough processes for a bug to manifest itself. The situation is analogous to an attempt to solve the halting problem for a Turing machines by exploring computations with ever increasing time bounds; there is no computable "cut-off" bound at which one can conclude that if the Turing machine has not yet halted, then it never will. This analogy between the halting problem and parameterized verification has been formalized by Apt and Kozen [10], their result being that the latter, like the 91 4.1. Introduction 92 former, is undecidable. Our primary contribution is the definition of a class of systems equipped with a Convergence Theorem which allows us to dynamically determine when we have "seen enough" to conclude cor-rectness in the above verification strategy. Our class of systems, called nicely sliceable WSTS, is contained in the class of well-structured transition systems (WSTSs) [2,56,57] and our development borrows heavily from W S T S theory. The problem we solve via our approach is known to be decid-able via the previous work on W S T S . The advantage we claim over the classical algorithm is empir-ical; since our approach involves model-checks on only finite state truncations of the full unbounded (infinite-state) parameterized system, we can employ BDD-based symbolic model checking [23,24]. B D D s are well-known to have the ability to represent large state spaces succinctly, which we be-lieve to give our algorithm an advantage when processes have large "local" state spaces. We note that though our nicely sliceable W S T S s encompass many types of infinite state systems [20], in this chapter we focus on petri nets and the richer broadcast protocols, which both model systems composed of an arbitrary number of communicating finite-state processes. Broadcast protocols in particular can model certain simple shared memory protocols. For nicely sliceable W S T S s , our algorithm is both a sound and complete verification method. There are several system attributes possessed by common shared memory protocols that are pre-cluded by broadcast protocols. One of these is the so-called conjunctive guard [49,51], which refers to a transition in a parameterized system of processes that may only occur if the local state of each process satisfies some predicate. To further extend the applicability of our algorithm, we introduce a new reduction that soundly converts the verification of parameterized systems with con-junctive guards into a verification problem on broadcast protocols. The reduction is proved to be complete if a certain decidable side condition holds. This allows us to access industrially relevant challenge problems from parameterized memory system verification. Our empirical results show that, although our new method performs worse than the classical approach on small petri net ex-amples, it is capable of efficiently verifying systems with large local state. The classical W S T S algorithm is either much slower or incapable of handling such systems. This chapter, which is mostly based on two papers of the author's [17, 20], is organized as follows. Sect. 4.2 introduces well-structured transition systems and the classical algorithm for their verification. Our approach to the problem is developed in Sect. 4.3, and Sect. 4.4 presents the 4.2. Well-Structured Transition Systems 93 aforementioned conjunctive guard reduction. The chapter concludes with Sect. 4.5, which strives to evaluate the strengths and weaknesses of our approach. 4.2 Well-Structured Transition Systems Here we survey the relevant concepts and previous results for well-structured transition systems, which were first proposed by Finkel [56]. Sect. 4.2.1 gives preliminary definitions. Sect. 4.2.2 presents two examples of W S T S s , namely, petri nets and broadcast protocols. Sect. 4.2.3 defines a verification problem on W S T S s and outlines the classical algorithm for its decision. 4.2.1 Definitions A transition system (S, —>) can be thought of as a stripped-down automaton in which the notions of symbol alphabet, accepting states, and initial state are all removed. We are left with two compo-nents: the state space S and the transition relation —>C S x S. A transition system is deemed to be well-structured if there exists a certain ordering on the state space such that the transition relation is in some sense monotonic with respect to this ordering. We are interested in an ordering called a well-quasi-ordering, which is a special type of preorder. A preorder1 is a reflexive and transitive relation. We will typically use =<: to denote a preorder and -< to denote the strict counterpart of ^ , i.e. x -< y means x =<: y A y ^ x. Definition 38 (well-quasi-ordering). A well-quasi-ordering (wqo) is a preorder on a set X such that for any infinite sequence XQ,X\,X2, • • • over X, there exists i,j € N such that i < j and Xi =^ Xj. In the verification problems we will be tackling, we will require a wqo over the state space, and the set of "bad" states that we wish to check avoidance of will be characterized by sets that are upward-closed with respect to the wqo. Upward closure and other relevant notions are now defined, mostly following the terminology of Finkel and Schnoebelen [57]. We note that Defs. 39 and 40 assume a preorder =<! over some set X. Definition 39 (upward-closure,upward-closed set). For 7 C I , the upward-closure ofY is the set ]Y = {x | 3y € Y.y =4 x}. A setU C X is said to be upward-closed ifU = |C7-1 also called a quasi-ordering in some literature 4.2. Well-Structured Transition Systems 94 Definition 40 (basis,canonical basis). If sets U,Y C X are such that U = ]Y we say that Y is a basis ofU. Further, if Y has the property that for all distinct y\,y2 G Y we have that y\ and y2 are incomparable under =<!, then we say that Y is a canonical basis ofU. Lemma 33 below asserts that any upward-closed set has a finite basis. Since upward-closed sets are typically infinite, this affords one a finite representation of such infinite sets. Lemma 33 ( [76]). For a wqo, any upward-closed set U has a unique canonical basis basis(C7), and this basis is finite. We are now equipped to define well-structured transition systems. Note that Fig. 4.1 graphically depicts the relationship between the wqo and the transition relation required by item 3 of Def. 41. Definition 41 (well-structured transition system). A well-structured transition system (WSTS) is a triple (5, —>, =<:) such that 1. (S, —>) is a transition system 2. =4 is a wqo over S 3. For all x,x',y G S such that x —> x' and x =4 y, there exists y' G S such that y —> y' and x' * y'2 4.2.2 Examples There are many types of WSTSs . In fact, by selecting the appropriate wqo, any transition system can be made into a W S T S [57].3 As this thesis concentrates on shared-memory protocols, here we describe two classes of W S T S s that are perhaps the most relevant in this domain: petri nets and broadcast protocols. 2This requirement is called monotonicity by Abdulla et al. [2] and strong compatibility by Finkel and Schnoebelen [57]. The latter paper gives a slightly weaker definition of WSTS, requiring that y' only satisfy y ->* y'-3However, the verification algorithms require the bad states to be upward-closed with respect to the wqo, and as Finkel and Schnoebelen [57] point out, the wqo constructed in the proof of their ubiquity theorem cannot express a very interesting class of errors. 4.2. Well-Structured Transition Systems 95 y V Y Y X X \ Figure 4.1: The relationship between =^ and —• required by Def. 41 Petri Nets The most widely studied class of W S T S s are petri nets,4 which have been accused of causing the deforestation of Europe. 5 Murata [102] gives a comprehensive survey of petri net research up to 1989; Esparza [54] surveys results on complexities and computability of petri net problems. Our development follows the definitions used by Finkel and Schnoebelen [57]. Definition 42 (petri net). A petri net is a triple (P, T, F) where P = { p \ , P m } is a finite set of places which is disjoint from the finite set T of transitions. F : ( ( P x T ) U ( T x P ) ) - » N i s called the flow matrix. A marking of a petri net is an element ofNm. Intuitively, a marking v assigns a number of tokens (zero or more) to each place of the petri net; the number of tokens on place Pi is specified by v(i). Transitions may fire, causing some tokens to move between places, be destroyed, or be created; the flow matrix defines both the guard and the resultant token activity for the firing of each transition. Before formally defining petri net semantics, we introduce the wqo on petri net markings that we will employ. Definition 43 (inclusion ordering). For m > 1, the inclusion ordering =4MQ N m x N m is defined by v u iff far all i € N m we have v(i) < u(i). 4Petri nets are very closely related to the vector addition systems of Karp and Miller [81]; the two for-malisms are of equal computational power. 5This joke is attributed to David Dill. 4.2. Well-Structured Transition Systems 96 Lemma 34 (Dickson's Lemma [44]). For any m > 1, the inclusion ordering 4M over Nm is a wqo. Two markings are related by the inclusion ordering if one is greater or equal than the other component-wise. We also define addition and subtraction on markings to happen component-wise; note that the result of a subtraction operation can yield negative components, hence markings are not closed under subtraction. To give semantics to petri nets, we first require the following notions. The pre-vector of tran-sition t € T is the vector t defined by *t(i) = F((pi,t)) for each i e N m . Analogously, the post-vector t* of t is defined by t'(i) = F((t,pi)). For a marking v and transition t, we will say that t may fire from v if *t 4M V. If t may fire from v, and v' = v —'t +1', we say that v' is obtained from v by firing t. Definition 44 (petri net semantics). The semantics of a petri net (P, T, F) is the transition system (N' p l , —>), where v —> v' iff there exists t &T such that v' is obtained from v by firing t. Lemma 35 ([2,57]). Let ( N m , —>) be the semantics of a petri net. Then ( N m , —>, 4M) is a WSTS. Petri nets have a well-known graphical representation where places are circles, transitions are rectangles, and the flow matrix is indicated by arcs between places and transitions The arcs are possibly annotated with positive integers if the flow matrix has value greater than 1 for its endpoints. Figures 4.5, 4.6, and 4.7 later in this chapter are examples of this representation. Broadcast Protocols Broadcast protocols were first proposed by Emerson and Namjoshi [53] as a model of systems composed of an unbounded number of identical communicating finite state processes. Broadcast protocols are closely related to a generalization of petri nets called petri nets with transfer arcs [57, 72]. Here we roughly follow the definitions of Esparza et al. [55] and Emerson et al. [53]. Definition 45 (Broadcast protocol). A broadcast protocol (BP) is a triple (L, E , R), where L is the set of local states, E is the set of labels, and R C L x E x L. E is required to be of the form E ; U E r x {!, ?} U Ef, x {!!, ??}, where E ; , E r > and £(, are disjoint sets of primitive labels called actions, and are respectively called local, rendezvous, and broadcast actions. 4.2. Well-Structured Transition Systems 97 Labels of the form (a, d) are written simply as ad, i.e. (a, 11) is written all. Intuitively, labels of the form a! and a!!, are outputs, while those of the form al and all are inputs; here output and input refers to inter-process communication. We make the following restriction on R: for any a\\ G £ and any s G L, there exists s1 G L such that (s, all, s1) G i?. A state of our broadcast protocols is a finite word over L, the symbols of which specify the local state of each process. In the transition system defined by a broadcast protocol there are three types of transitions, corresponding to the three types of actions of Def. 45. Local transitions allow a single process to autonomously change its local state. Rendez-vous transitions model a pair-wise directional communication event between two processes. Broadcast transitions, the most powerful communication mechanism, involve a single process sending a message to all other processes. We now formalize these concepts. Definition 46 (BP semantics). The semantics of a BP (L, E, R) is the transition system (L*, —>) where s —* s' iff s = £\... £n and s' = £[ ... £'nfor some n > 1, and one of the following hold. • local transition: there exists t 6 I f„ and an action a G such that (£i,a,£[) G R, and £'j = £j for all j effn\{i}. • rendezvous transition: there exist distinct i,k G N n and an action a G E r such that (£i, a\, £\) G R and ( 4 , a?, £'k) G R, and ^ = £jfor all j G N n \ {i, k}. • broadcast transition: there exists i e N n and an action a G E& such that (£i, a!!, £'t) G R and, for each j G N n \ {i}, we have (£j,all, £'f) G R. We note that our B P semantics differ from that of other authors [53, 55] in what is taken to constitute a state. Here we define a B P state to be an element of L*. However, since B P processes are identical, any two words that have the same number of processes in each local state are obviously equivalent under a symmetry reduction. In other works [53,55], this symmetry reduction is rolled into the definition of the B P semantics: a state s is a vector of N'L', with the interpretation that the component s(i) counts the number of processes in local state i. The two points of view are equivalent; we have chosen the "states-as-words" semantics simply because our algorithm is more amenable for use with this representation.6 6Indeed, a petri net can be seen as the composition of a finite number of identical processes; our devel-opment of petri nets in Sect. 4.2.2 could very well have also used the states-as-words semantics by viewing each token as a process whose local state is its place. 4.2. Well-Structured Transition Systems 98 The wqo used for our BPs is the subword ordering, which is defined such that w\ =4w W2 if and only if wi can be obtained from wi by deleting 0 or more symbols. The fact that =<!vv is a wqo is known as as Higman's Lemma [76]. That a B P with states in N m along with =4M is a W S T S was shown by Esparza et al. [55]; their result clearly applies also to our definition of B P semantics with the wqo =^w 4.2.3 The Classical Algorithm Before describing the classical algorithm, we must define the verification problem under consider-ation. Given a W S T S (S, —>, =^ ), an upward closed set U C S of bad states, and an initial state so E S, we wish to decide if there exists a path through —> from so to a state in U. We will call this decision problem the WSTS covering problem, and we call a path from so to U an error. The classi-cal algorithm for deciding this problem [2,57] exploits the following lemma about WSTS-preimages of upward-closed sets. L e m m a 36. In a WSTS, ifU is upward-closed, then so too are pre({7) = {x \ 3u E U.x —* u} and IXoPre^) -Proof. Choose any x E pre(U), and let y be any state such that x =4 y. Then there exists x' E U such that x —> x'. From item 3 of Def. 41, there exists y' such that y —> y' and x' =^ y', which implies that y' E U since (7 is upward-closed. Therefore y € pre({7) also, and pre(C/) is upward-closed. To see that U £ o Prel(U) is upward-closed, note that by induction, pre1 ((7) is upward-closed for any i > 0. B y Lemma 37 below, there exists some k > 0 such that for a l i i > fc we have pre^f/) = prek(U), thus {J^oPre^U) = Uf=o pre'(C7). That this set is upward-closed follows from the fact that upward-closed sets are closed under finite union. • Also required for the decidability of the W S T S covering problem is a side-condition called the effective pred-basis:1 given any finite subset Y C S, we must be able to compute a finite set pb(F) satisfying8 Tpb(Y) = pre(m (4.1) 7Abdulla et al. [2] actually roll this condition into their definition of WSTS; we follow Finkel et al. [57] and keep it separate. 8Note that (4.1) does not necessarily require that pb(Y) = basis(pre( 1Y)), only that pb(Y) D basis(pre( |Y) ) . 4.2. Well-Structured Transition Systems 99 1: LastReach, Reach : finite subset of S 2: LastReach := 0 3: Reach := basis(f/) 4: while \Reach %. ^LastReach do 5: if so 6 ]Reach then 6: exit "error found" 7: end if 8: LastReach := Reach 9: Reach := Reach U pb(Reach) 10: end while 11: exit "verification successful" Figure 4.2: The classical algorithm for the W S T S covering problem That the R H S of (4.1) is upward-closed follows from Lemma 36. In the case that such a function pb is computable, the W S T S is said to have an effective pred-basis. A l l W S T S s we consider in this chapter have effective pred-basis, therefore this assumption is implicit from now on. The classical algorithm for the W S T S covering problem [2,55,57] is given in Fig. 4.2. On the surface, this algorithm resembles the well-known finite-state backward reachability analysis, i.e. least fix-point computation [24], the difference being that the involved sets are upward-closed (and hence not necessarily finite), so a symbolic representation via a finite basis is necessary. Note that the conditional expressions of lines 4 and 5 are both clearly decidable; for line 4 one simply checks that for all x e Reach there exists y e LastReach such that y 4 x; if so then the containment holds and the loop terminates. Similarly, for line 5 one checks if there exists x G Reach such that x 4 SQ. Analogously to finite-state reachability analysis, the algorithm of Fig. 4.2 has the following invariant: after the ith iteration of the while loop, Reach is a finite basis for the set of states that can reach U in at most i steps. It is easy to see that the algorithm is correct if it terminates. Furthermore, if there exists an error, clearly line 6 will eventually be executed, terminating the algorithm. That termination is always guaranteed in the absence of errors follows from Lemma 36 and the following Lemma 37. Lemma 37 ( [57]). With respect to a wqo, for any infinite sequence of upward-closed sets UQ C UI C V~2 C • • •, there exists i such that Ui = Ujfor all j > i. Since Reach grows monotonically at each iteration of the while-loop of Fig. 4.2, so too does ]Reach grow monotonically. Lemma 37 thus guarantees that we will eventually have 4.3. Our Approach 100 "[Reach — "[LastReach, causing the while-loop to terminate. Necessary for practical implementation of the classical algorithm is an efficient representation of Reach, since this set can become very large. Delzanno et al. propose using a data structure called covering sharing trees (CSTs) for this purpose [42,43]. C S T s are applicable when the state space is N m ; they represent a finite subset of N m similarly to how a B D D [23] represents a subset of B m . We will discuss C S T s and the classical algorithm further in Sect. 4.5.2. 4.3 Our Approach In this section we present our approach to deciding the W S T S covering problem. We handle a sub-class of W S T S s we call nicely sliceable WSTSs (NSWs), which are defined in Sect. 4.3.1. Sect. 4.3.2 develops our algorithm that solves the W S T S covering problem for NSWs, along with its support-ing Convergence Theorem and Termination Theorem. Sects. 4.3.3 and 4.3.4 improve our algorithm by respectively accommodating certain infinite sets of initial states and performing an important optimization. Finally, Sect. 4.3.5 shows that the Convergence Theorem is near-optimal, however determining exact optimality is left as an open problem. 4.3.1 Nicely Sliceable WSTS To be deemed a N S W , a W S T S must satisfy three properties. We first describe each intuitively and provide some motivation for why they are required, and then we present the formal definitions. • Discrete: The wqo must be discrete, meaning that for any element x, there is a bound on the length of any strictly decreasing sequence starting with x. We call the length of the longest such sequence x's weight. Furthermore, discreteness requires that the number of elements of a given weight be finite. Discreteness allows for finite-state model checking to be applied to the subsystem formed by bounding the weight of states. • Weight-respecting: When a transition changes the weight, the same change in weight can be effected by the transition relation for elements greater than (in the wqo) the starting state of the transition. Weight-respectfulness is a technical requirement needed for the proof of our Convergence Theorem, which gives a termination condition for our algorithm. 4.3. Our Approach 101 • Deflatable: Whenever we have a transition from outside an upward-closed set U to a state in U, deflatability asserts the existence of a similar transition involving states of bounded weight. Deflatability is similar to downward compatibility [57], though the two are incompa-rable. Deflatability, like weight-respectfulness, is essential in the proof of our Convergence Theorem. We now formalize these properties, using petri nets as a running example. Definition 47 (dwqo,weight function,base weight,discrete WSTS). A wqo is a discrete wqo (dwqo) over X if for all x E X there exists k E N such that for any sequence xo -< x\ -< • • • -< X(_ = x we have £ < k. Associated with a dwqo =4 is the weight function w : X —> N that maps each x to the minimum such k. We also require that {x E X | w ( x ) = i} be finite for each i E N . For upward-closed U, the base weight ofU is bw(£7) = max({w (x ) | x € basis(f7)}). A discrete W S T S (DWSTS) is a WSTS (S, =$) where ^ is a dwqo. The inclusion ordering =4M over N m is a dwqo, and it is easy to show that the induced weight function is such that w(t>) = YALI V(^)- Thus petri nets are D W S T S , and the weight of a marking is simply the number of tokens. The set {0,1/2, 2 / 3 , 3 / 4 , . . . } U {1} along with < is an example of a wqo that is not a dwqo, since taking x = 1 violates Def. 47. If X is a dwqo ordered set and i > 0 is an integer, we denote by X<i the set {x E X \ w ( x ) < i}\ note that it follows from Def. 47 that X<i is always finite. Definition 48 (weight respecting DWSTS). A DWSTS is said to be weight respecting if we may strengthen condition 3 of Def. 41 to require thatw(x') — w ( x ) = w(y') — w(y). Petri nets are weight respecting D W S T S s . Suppose x —* x ' by firing transition t, and y is such that x =4M y. Then t =4M x and x' = x —mt + P, which implies *t =4M y by the transitivity of =<IM-Let y' = x' + (y — x ) , then clearly y' 6 Nm (i.e. y' has no negative components) since y — x€ N m , and further y' = x — *t + P + (y — x ) = y — *t + P . Thus y' is obtained from y by firing t, and y -> y'-Definition 49 (<5-deflatable DWSTS). A DWSTS (S, 4) is said to be 5-deflatable for 6 E N if whenever x —> x ' and z =4 x', there exist y and y' such that all of the following hold: 1- y <x 4.3. Our Approach 102 z w(z)+5 Figure 4.3: A diagrammatic presentation of Def. 49. A D W S T S (5, —4) is said to be o"-defiatable (for 6 e N) if for all x, x',z € 5 that satisfy the depicted relations, there exist y,y' e S that satisfy the depicted relations, and also both w(y) and w(y') are not greater than w(z) + 5. 2. y^y1 3. z4y' 4. w(y) < w(z) + 5 5. w(y') < \N(Z) + S Fig. 4.3 shows the requirements of a 5-deflatable D W S T S . z should be thought of as an element in some upward-closed set with relatively low weight. Viewed contrapositively, C'-deflatability asserts that if there is no transition y —* y' into a state y' that is above z in the dwqo such that the weights of y and y' do not exceed that of z by more than 5, then there is no transition (involving states of any weight) into a state above z. Intuitively, this implies that upward-closed U can be shown to be a fixpoint of pre (meaning U — pre(U)) by only considering states of weight at most bw(L7) + S. Our running example of petri nets are deflatable. The proof of this is sufficiently involved to warrant its own lemma. Lemma 38. Under =4M, CI petri net (P, T, F) is 5-deflatable, where 6 = max ({w('t) | t € T} U {w(f) | t € T}) 4.3. Our Approach 103 Proof. Suppose we have x, x', and z as in Def. 49, and let t be the transition that fires to take x to x'. For the purposes of this proof, we introduce the monus operator 0 : N l p l x N l p l — > N l p l where v © u is the vector w such that Let us define y = (z © t*) +'t and y' = (z © t') +1'. It is easy to see that conditions 2-5 of Def. 49 hold of these y and y'\ the remainder of the proof is devoted to showing condition 1. Since we can fire t from x to get x', we have that *t =^M % and x' = x —'t + t* > M z. Thus Now since the L H S of (4.2) has no negative components, we may safely replace the — in the R H S with © , since this replacement simply increases all negative components to 0. Hence x — 't )?M Definition 50 (NSW). A J - N S W is a DWSTS that is weight-respecting and 5-deflatable. A N S W is a 5-NSWfor some 5. From our earlier discussion and Lemma 38 we find that petri nets are 5-NSWs, where 6 is as in the statement of Lemma 38. In a previous paper [20] we argued that two other classes of W S T S s are NSWs, namely context-free grammars and lossy channel systems. Since this thesis is about shared-memory protocols, here we show that broadcast protocols are also NSWs. Theorem 14. Broadcast protocols along with the subword ordering are 2-NSWs. Proof. Clearly the sub-word ordering =^ w is discrete and the weight of a word is simply its length. Noting that all B P transition types of Def. 45 preserve the length of the word, we see that BPs are trivially weight-respecting. We now show that any B P ( L , S , R) is 2-deflatable. Suppose we have words x, x', and z as in Def. 49. Let and x' = x[ . . . x'n; we will automatically expand the words y, y', and z similarly. For D = {d\,d2,..., de} C N n where d\ < d2 < • • • < de, let XD be the word x^x^ • • • Xde; we apply the same notation to the other words also. Then we have z = x'D for some D C N „ , and w(z) = \D\. Also, for X C Nn and % e X, let r(X, i) = \X (1 N j | . The importance of r in this proof is summarized by the fact that for any word w, X C N | w | , and i G l w e have Wi = u r ( X , i ) , where u — u>x-x —*t )pu z — t' (4.2) z Q t*, which implies x ^ = M (Z © t') +'t = y. • 4.3. Our Approach 104 We case-split on the type of the transition x —> x'. In all cases conditions 1 and 3 of Def. 49 will obviously hold of the y and y' we select, hence we focus on conditions 2, 4, and 5. Note that local and broadcast cases are very similar; the rendezvous case is slightly different. • local transition. Let i and a be as in the local transition case of Def. 46. Then let y — x D u ^ , let y' = x'Du^y and let i = r(D U {i} It follows that (yj, a, y4) G R and yj — y'j for all j G N | y | \ {i}, and thus y —> y' is a local transition. Since w(y') = w(y) = \D U < w(z) + 1, conditions 4 and 5 of Def. 49 hold. • rendezvous. Let i, k, and a be as in the rendezvous transition case of Def. 46. Then let y = z.Du{i,fc}> let y' = xDu{i,ky l e t * = r(jD u {*>fc) >*) a n d l e t ^ = r(-° u {*>k} > 1 1 follows that (yj, a!, yi) € R and (y^, a?, y^) G i? and y^ = y'j for all j € N\y\ \ {i, k] and thus y —» y' is a rendezvous transition. Since w(y') = w(y) = | D U {i, k}\ < w(z) + 2, conditions 4 and 5 of Def. 49 hold. • broadcast. Let i and a be as in the broadcast transition case of Def. 46. Then let y = xDu{i}> l e t y' = x bu{i}' a n d ^ e t * = r ^ u {*)'*)• ^ f ° l l ° w s that (y ,^ a!!,yi) G R and (yj, all, y'j) G i? for all j G N | y | \ {i}, and thus y —> y' is a broadcast transition. Since w(y') = w(y) = \DU{i}\< w(z) + 1, conditions 4 and 5 of Def. 49 hold. In each case we have w(y'), w(y) < w(z) + 2. • 4.3.2 Our Algorithm This section develops our algorithm for the W S T S covering problem, which is shown in Fig. 4.4. The inputs are the same as for the classical algorithm of Sect. 4.2.3: a W S T S (S, —>, 4), an initial state so £ S, and an upward-closed (w.r.t =<;) set of bad states U. We assume that the W S T S is in fact a 5-NSW for some 5; to emphasize this assumption we will call the problem we solve the NSW covering problem. Note that the actual value of 5 will depend on the N S W description according to some predetermined rule (such as our Theorem 14). For each i — bw(U), bw(L7)-f-l, bw(U)+2,..., our algorithm computes the backward reachable set br(U,i), which is the set of states from which U is reachable along a path that never exceeds weight i, and is defined now. 4.3. Our Approach 105 Definition 51 (br). Given a DWSTS (5,->, 4), a set Y C S, and i e N U {oo} we let br(Y,i) denote the set of all x € S such that there exists a sequence xo —> x i —>•••—+ x^ such that xo = x, X£ € Y , and for allO < j <l we have W ( X J ) < i. We also define br(Y) = br(Y, oo).9 Since br(U, i) is necessarily finite for all i > 0, this set can be computed using classical finite-state symbolic model checking [24] based on B D D s [23]. Our algorithm computes br(U, i) for increasingly large values of i, and terminates upon either of the following events: • Convergence occurs. By convergence, we mean that we have reached an i such that f br(?7, i) = br(U). How we decide if this equality holds for a given i is articulated in Theorem 15 below. The existence of such an i is guaranteed by Theorem 16. • A n error is detected, i.e. we reach an i such that SQ 6 br(i7, i). We now present two theorems. Theorem 15 gives us a necessary and sufficient condition for convergence, while Theorem 16 guarantees that our algorithm will always terminate. Theorem 15 (Convergence). For a 5-NSW an upward-closed set U, and n > bw(U), br(U, n + 6)C tbr(C/, n) (4.3) if and only if br(U) = !>([/, n) (4.4) Proof. (<=) Trivial, since br (JJ, n + 5) C br(C7). (=>) br(U) D |br(C/, n) follows from Lemma 36 and the fact that br(U) D br(U,n). To prove the converse containment, suppose that (4.3) holds, but there exist i > 1 and x € br(C7, i) such that x £ ]br(U, n). Since br(U,j) C br(U, k) whenever j < k, i < n + 6 implies x e br(U, n + 5) C |br(?7, n), thus we need only consider i > n + 5. Let x = xo —> x i —> • • • —> x^ e f/ be a path from x to C7. Since f/ C tbr(LV, n), there must exist A; G {1 , . . . , £ } such that xk € |br(17, n) and x f c _ i 0 Tbr(c7, n). Then there exists z € br(C7, n) such that z =<I Xk- Now because the system is 5-deflatable, there exist y and y' satisfying the five conditions of Def. 49, i.e. y 4 a ^ - i . y —> y', z 4 y', w(y) < w(2;) + (5, and w(y') < w ( z ) + <5. From Lemma 39 below, we have that y' € br({7, n + 6) which implies y e br(U,n + 5) since w ( y ) < n + 6. Since y =<; X f c _ i , this implies x ^ - i G |br(c7, n), which is a contradiction. • 9Note that br(y) is also equal to (J^o pre^Y). 4.3. Our Approach 106 Lemma 39. For a weight respecting DWSTS and an upward-closed set U, z E br(U, n) and z =4 y' imply y' E br(£7, n + w(y') — w(z)). Proof. Let d = w(y') — w(z). z E br([7, n) implies there exists a sequence zn —> z i z^ where zn = z and zt E 17, and W ( Z J ) < n for all 0 < j < I. We show by induction on I that y' E br(f/, n + d). If ^ = 0, then z EU and thus y' EU and we are done since w(y') < n + d. For the inductive step, we note that z —> z i implies that there exists yi such that w(yi) = w(zi) + c?, y' —+ y i , and z i =<; y i since the system is weight respecting. Note that z\ E br(U,n), thus, by our inductive hypothesis, y\ E br(U,n + w(yi) — w(zi)) = br(U, n + d), which implies y' E br(U,n + d). • One can show that (4.3) is equivalent to having for a l H E {n + 1 , . . . , n + 5}. We will refer to values of i for which (4.5) holds as being stable. Hence Theorem 15 states that if we find 5 consecutive stable values, then we have convergence. The next theorem guarantees that this will eventually happen. Theorem 16 (Termination). For any DWSTS and upward-closed set U, there exists an n satisfying Proof. For any x E br(U), let g(x) denote the minimum j such that x E br(U,j). Since by Lemma 36 br(U) is upward-closed, there exists a finite set B = basis(br(C/)). Now take n = max({p(x) | x E B}). To see that this n satisfies (4.4), note that for any i > n, if there exists x E br(f7, i) such that x £ Tbr((7, n), then this contradicts B being a basis for br([7), since B C In order to use Theorem 15 in our algorithm, we must have a means to decide (4.3). Our approach requires the use of a computable lifting operator, which intuitively "lifts" a set br(U, i) to a truncated version of its upward-closure. The truncation omits everything with weight strictly greater than some given d e N ; hence finiteness is preserved. Definition 52 (lifting operator). Given a dwqo 4 over a set X, the associated lifting operator is the function Lift : X x N —> 2X defined by br{U,i) C tbr(l7,i- 1) (4.5) (4.4). br{U,n). • Lift(x, d) = {y | x 4 y A w(y) < d} 4.3. Our Approach 107 1: To, T i , T 2 , . . . : finite subset of S 2: i,n : integer 3: i := bw(C7) 4: n := i 5: Ti-! := 0 6: while (n > i — S) do 7: rV.= br([/,0 8: if s 0 G tr* then 9: exit "error found" 10: end if 11: if (Ti £ Lift(IVi,2)) then 12: n := i 13: end if 14: z : = i + l 15: end while 16: exit "verification successful" Figure 4.4: Our algorithm for the N S W covering problem. Its inputs are a £ - N S W (5, —>, =<!), a basis of an upward-closed set U, and an initial state SQ. We extend Lift to act on sets by decreeing Lift(Y, d) = \Jy€y Lift(y, d). The following theorem explains how the lifting operator is relevant to deciding containments along the lines of (4.3) or (4.5). For a finite set X, let maxw(X) = max({w(s) | x G X}) Theorem 17. Let 4 be a dwqo over a set X, and let X{-\ and Xi be finite subsets of X such that maxw (Xj_i) < i — 1 and maxw(X;) < i. Then Xi C if and only if Xi C L i f t (X i_ i , i ) . Proof. (<=) Trivial, since L i f t ( X i_ i , i ) C T ^ i - i - (=>) Suppose Xi C t X j _ ! , and let x 6 X j . Then there exists y £ such that y =4 x. Since w(cc) < z, this implies a: e L i f t (Xj_i , i). • Our algorithm for the N S W covering problem is given in Fig. 4.4. A s inputs, the algorithm takes a 5-NSW, a basis of an upward-closed set U, and an initial state so. The variable i represents the maximum weight of the states computed in each iteration of the while-loop, i is initially the base weight of U and is incremented each iteration. The variable n tracks the last value of i for which "new" states were found in br(c7, i), i.e. states x that weren't already "covered" by the existence of y G br(C7, i — 1) such that y 4 x. The condition of the while loop (line 6) will only fail when (4.3) holds, which by Theorem 15 indicates convergence. Each iteration of the loop involves computing br(U, i), which is done in a nested preimage fix-point computation (implicit in line 7). Line 8 tests 4.3. Our Approach 108 to see if the initial states have been reached, and line 9 terminates if so. Line 11 determines if something "new" was found this iteration, if so n is updated to be i. If the condition of line 11 fails 8 times consecutively, by Theorem 17 we have all of br(U, n + S) C }br(U, n + 8-1) br(C7, n + 8-1) C |br(c7, n + S-2) br(U, n + 1) C tbr(C7, n) (i.e. we are stable for a l H € {n + 1 , . . . , n + 8}) which implies br(C7, n + S) C |br(f/, n) Thus, by Theorem 15, (4.3) holds and verification is successful. Theorem 16 guarantees that this will eventually happen. We now give an example of our algorithm running on the petri net (P,T,F), where P = {pi,P2,Ps}, T = {tut2lt3}, F(tltPl) = F ( p i , t 2 ) = F(p2,t2) = F(t2,p3) = F(p3,t3) = P{HIVT) = P(HiP\) = 1. ar>d all other entries of F are 0. Fig. 4.5 shows this petri net using the usual graphical representation. We will write markings by juxtaposing the token counts at p\, p2, and p3, for example 123 is the marking with j tokens at Pj, for each 1 < j < 3. We desire to check if a marking placing 3 or more tokens at p3 is reachable from the initial state so = 720. The set of bad markings is thus the upward-closed set U = T{003}. Note that from Lemma 38 we have 8 = 2. Table 4.1 summarizes the execution of our algorithm, given this petri net, so. a n d U. The rows correspond to the state of the program each time line 6 is visited. The final column gives the values computed for T2, T3, We see that convergence occurs after 4 iterations of the while-loop, and since so = 720 is not in the upward-closure of any of the computed i y s , the verification is successful. The next subsection explains how our algorithm can be generalized to handle a certain class of infinite initial state sets. 4.3.3 Parametric Initial States In Sect. 4.2.3 we defined the W S T S covering problem to check if the bad states are reachable from a single initial state. For systems such as petri nets and BPs, we typically desire to perform this check 4.3. Our Approach 109 V L 6 n i i V i 1 3 3 r 2 = 0 2 3 4 r 3 = {003} 3 4 5 T 4 = Lift(r3,4) U {030,130,040,031} 4 4 6 r 5 = Lift(r4,5) 5 4 7 r 6 = Lift(r5,6) Table 4.1: Summary of the execution of our algorithm (Fig. 4.4) against example petri net of Fig. 4.5. V L 6 stands for "visit to line 6"; the rows give the values of the variables n, i, and T j - i for the first, second, etc. visit to line 6. Figure 4.5: Example petri net with respect to an infinite set of initial states. In fact, B P verification relative to a single initial state reduces to finite-state model checking, since all B P transitions preserve weight. In other words, BPs are only interesting when dealing with infinite initial state sets. Both the classical algorithm of 4.2.3 and our algorithm of Sect. 4.3.2 can easily be adapted to handle an infinite set of initial states called a parametric set [55]; 1 0 this section explains this adaptation for our algorithm. Here we define parametric sets of words, which can be used to express typical initial state configurations for broadcast protocols. 1 1 Definition 53 (parametric set). Let L = {£\,..., tm} be a finite alphabet. A subset I ofL* is said to be a parametric set if it can be written as I = {w | #(w, if) ~ i a i A • • • A #(w, tm) ~ m am} (4.6) where # ( « ; , tf) is the number of occurrences oftj in w, each ~ j is either = or >, and each aj G N. l 0 Our notion of parametric set is slightly more general than the parameterized configuration of Esparza et al. [55]. 1 1 One can also define parametric sets of petri net markings, and our algorithm can be used for these too. A parametric set of markings specifies for each place p a constraint of the form v(p) ~p np, where ~ p is either > or =, np G N, and v(p) is the number of tokens p may have in an initial state. 4.3. Our Approach UO For example, consider the M S I caching protocol. This is a simple B P with three local states M , S, and I. If the initial state is required to have all processes in the invalid state I, we can express this as the parametric set Similar to an upward-closed set, a parametric set has a finite representation via the ~j's and afs of (4.6). If the N S W s state space is a set of words, and the wqo is the sub-word ordering, our algorithm can be adapted to check if a parametric set of initial states is backwards reachable from the upward-closed bad states. The following Theorem 18 shows how this is done, and states that a parametric set / intersects an update-closed set U if and only if U contains a word x that doesn't include too many occurrences of the £iS involved in equality constraints in (4.6). This is because since U is upward-closed, if the number of £i's is too few, occurrences of £i can be added to x as necessary while remaining in U. Furthermore the theorem states that only the finite number of x with weight at most bw(Y) need be considered. Theorem 18. Let I,Y C L* be such that I is a parametric set of the form (4.6) and Y is upward-closed, and let r > bw(Y). Then I fl Y = 0 if and only if {x 6 Y \ w(x) < r} does not contain x such that #(x, £f) < ajfor all j such that ~ j is =. Proof. Let E = {j € N m | ~ j is =} and let m = \L\. (=>) Suppose Y<r contains some x as in the statement of the theorem. We define a function Now let x' = xs\S2 • • • sm, where Sj is the string consisting of f(£j) copies of £j. Then clearly x 4 x', thus x' £ Y. Now since # ( x , £ j ) < aj for all j G E, we find that #(x',£j) = aj for all j £ E. Furthermore, #(x', £j) > aj for all j e N m \ E. Therefore x' e I, and I Pi Y is nonempty. (< )^ Now suppose there exists x € I Pi Y. If w(x) < r we are done, since then #(x, £j) = aj for all j € E and x € Y<r. Otherwise, there exists x' £ basis(Y) such that x' =4 x, which implies #(x', £j) < #(x, £j) = aj for all j 6 E. But since w(x') < bw(Y) < r, we have x' € Y<r. • Let us assume we are given initial states of the form (4.6), and let E be as in the proof of {w | #(w, M) = 0 A # ( « ; , S) = 0 A #(w, I) > 1} / : L -> N by 4.3. Our Approach 111 Theorem 18. To use Theorem 18 in our algorithm, we simply modify the conditional of the if-statement of line 8 of our algorithm to read: 3x e Ti.Vj € E.#{x,lj) < aj (4.7) That (4.7) is decidable follows from the fact that Tj is finite. Correctness of this modification follows from the facts that Tj C br(U)<i is an invariant of our algorithm, and furthermore, assuming no error is found, Theorems 15 and 16 ensure that we will eventually arrive at a value of i for which br(U) = t r v 4 . 3 . 4 An Optimization In this section we propose an optimization to the algorithm of Fig. 4.4. Note that in Fig 4.4, the computation of br(U,i) of line 7 involves an iterative fix-point computation, starting with the set U<i. In some sense, much of the work of this computation was already performed when computing br(U, i — 1); since this is a subset of br(L7,i), it is redundant to "rediscover" these states. Further-more, many of the states with weight i in br(U,i), though not in br(U, i — 1), are in the upward closure of br(U, i — 1). Exerting computational effort to find such states is also redundant, since we know that br(U) is upward-closed (Lemma 36). Our optimization serves to eliminate this computational redundancy, and involves replacing lines 5 and 7 of Fig. 4.4 with the following, respectively: 5' : I V i := basis(LO (4.8) 7': := br(Lift(ri_i,i),i) Note that the fix-point now starts with Lift(rj_i,i)\ however this does not incur any additional computational costs as this set must be computed anyway for the containment check of line 11. This optimization has the potential to greatly reduce the number of iterations performed in the fix-point computations. A n extreme example are the stable values of i, for which the computation of Fi will always involve only a single preimage computation. In contrast, for the same value of i, the computation of Tj in the unoptimized algorithm will generally require many preimage iterations. Theorem 19. The optimization (4.8) preserves correctness of our algorithm. 4.3. Our Approach 112 Proof. Let b = bw(U), and let Fi,-i, Ft, T t + i , . . . and T'b_v Fb, F'b+1,... be the sequences of val-ues assigned to the variables Tj by the algorithm of Fig. 4.4 and the optimized version, respectively. We first show that for a l H > b we have ^ C T'i C br(C7) (4.9) (4.9) clearly holds when i = b, since Fb = F'b. Assume that (4.9) holds for i > b. F[ C br(U) implies that Lift(r^i + 1) C br(U) (since, by Lemma 36, br(U) is upward-closed), and hence F'i+1 = br(Lift(r<,i + + C br(U). Thus the second containment of (4.9) holds for i + 1. Also, since £ /< , C Ti and i > bw([7), we have T i + i = br(U<i+i,i + l) . = br(L\h(U<i,i + l),i + l) C br(Lift(ri,i + l ) , i + 1) C br(Lift(rj,i + l ) , i + 1) - r' - 1 i+i Therefore the first containment of (4.9) holds for i + 1. Now let A 7 be the final value of the variable n in the unoptimized algorithm. Then, by Theo-rem 15, we have ]FN = br(J7), which, along with (4.9) implies ]T'N = br(U). Since F'k C F'j when k < j , it follows that for each i € {A^ + 1 , . . . , N + 5} we have r , i = Lift(r;_1)i) = br(r/)<i (4.io) Therefore the optimized version also terminates with the final value of n being N, and computes F'N such that T I ^ = br(U). • 4 . 3 . 5 Near Necessity of the Convergence Theorem We conclude this section with a note on our Convergence Theorem (Theorem 15). The theorem can be intuitively described as stating that if we are stable for 6 consecutive values of i, then we never will find any states outside of the upward closure of the current set of backwards reachable states, regardless of how high we take i. One may wonder if this is overkill; perhaps being stable just a single time is sufficient for convergence. In other words, one wonders if the theorem can be strengthened to say that br(U,n + 1) C Tbr (£ / ,n) 4.3. Our Approach 113 >0 >1 Figure 4.6: The petri net and upward-closed set of markings U discussed in the proof of Theorem 20. U is indicated by constraints above the two places, i.e. p\ must have at least 0 tokens while p2 must have at least 1 token. The single transition t may only fire if there are at least 5 tokens at p\, and firing t results in 5 tokens moving from p\ to p2. is equivalent to (4.4). Here we show that such a strengthening cannot be done; there are pathological W S T S s that nearly demonstrate the necessity of the Convergence Theorem. Our demonstration is only near for the following reason. To show full necessity, for arbitrary 5 > 1 one must exhibit a W S T S , an upward-closed set U, and some n > bw(C7) such that Such an example would demonstrate that our algorithm can potentially be stable over all of 5 — 1 consecutive values of i, yet then again be unstable on the 5th value. We would then conclude that our Convergence Theorem is optimal. Our Theorem 20 below nearly achieves such a demonstration; it falls short because we show that a W S T S exists that is stable over 5 — 2 iterations, and then is unstable on the (5 — l)th. This at least shows an asymptotic necessity, and we leave open the problem of whether or not the Convergence Theorem can be slightly improved by replacing (4.3) with (4.11). Theorem 20. For each 5 > 2, there exists a 5-deflatable petri net, an upward-closed set of markings U, and n > bw(f7) such that br(U, n + 5 - 1) C |br(C7, n) (4.11) yet (4.4) fails, i.e. br(C7) + tbr(C7, n) br(C/, n + 5 - 2) C |br(C/, n) (4.12) 4.4. Conjunctive Guard Reduction 114 and br(U) + \bx(XJ, n) (4.13) Proof. Taking 8 to be fixed but arbitrary, define the petri net (P, T, F) by P = {pi,p2}, T = {t}, and F((Pl,t)) = 8 F((p2,t))=0 F ( ( t , P l ) ) = 0 F((t,p2)) = 8 Let U = T{(0, 1)} be the set of markings that puts at least 1 token on p2. Fig. 4.6 depicts this petri net and U. Note that bw(C7) = 1; let us define n = 1. It is easy to see that for each j € {1,2,... ,6 — 1} we have br(U,j) = U<j, since the sole transition t cannot fire unless there are at least 8 tokens. It follows that tbr([7, j) =]U = U for all j e {1,2,... ,5 - 1}, therefore (4.12) holds for n = 1. However, br(U, 8) = U<s U {(5,0)}, and noting that (8,0) g U, we have br(U, 8) <£U = Tbr(C7,1). This implies (4.13) for n = 1. • 4.4 Conjunctive Guard Reduction Though W S T S s (and indeed NSWs) encompass a broad and important class of infinite state sys-tems, there are common system attributes that preclude well-structuredness. A n example of such an attribute is the so-called conjunctive guard (CG). C G are used in parameterized systems of pro-cesses when a transition is enabled only if the local states of all processes satisfy some predicate. This contrasts with petri net or broadcast protocols, in which only a fixed, finite number of processes may guard a transition. Unfortunately, endowing petri nets or broadcast protocols with C G renders even safety property verification undecidable [51]. In this section we develop a sound reduction that reduces a broadcast protocol with C G s to a broadcast protocol without C G s . BPs were defined in Def. 45; here we extend that definition to define conjunctively guarded broadcast protocols (CGBP) . A C G B P is a tuple ( L , E , R, 7 ) , where (L, E , R) is a BP, and 7 : E ; —-> 2L. For each action a € £ / , 7(a) is the conjunctive guard of a. The semantics are changed so that a local transition on a may occur only if all other processes are in states that satisfy the conjunctive guard of a. 1 2 Formally, the semantics of a C G B P are the same as that of a B P (Def. 46), 1 2 Our definition of CGBP allows only local actions to have conjunctive guards. The definition and the reduction can be generalized to support conjunctively guarded rendezvous and broadcasts. 4.4. Conjunctive Guard Reduction 115 except that we strengthen the local transition requirements of Def. 46 as follows. • CGBP local transition: there exists i € N n and an action a € £ ; such that (£i, a, £[) € R, and, for all j e N n \ we have both £'j = £j and ^ € 7 (a) . A local action a is said to be properly conjunctively guarded (PCG) if 7 (a ) C L. Hence a B P can be viewed as a C G B P in which no actions are P C G , since in this case the additional requirement on each local transition is a tautology. Our reduction transforms a C G B P B = (L , E , R, 7 ) into a B P B' = [V, £', R'). Intuitively B' replaces P C G local actions with broadcasts. These new broadcasts allow all processes to check if they would have permitted the transition in B, i.e. if their local state satisfies the C G . Whenever a process detects a violation of a C G , it refuses to participate in any future actions by "resigning"; resigned processes are stuck in that state forever. Formally, we define B' as follows. We denote by E p C 9 the set of P C G actions in B, i.e. E p c s = {a I a E Ei A 7 (a ) C L}. • L' = L U {resigned}, where resigned is a new local state not in L. A process will enter resigned if it notices (through a broadcast) that a conjunctive guard was violated. • S ' - EJ U EJ. x {!, ?} U E'b x {!!, ??}, where — = \ E p c s — Yi'r = E r — S^ = £ 5 U E p C j Thus E ' is the same as E , except that all P C G local actions are turned into broadcasts. • R' contains exactly the following transitions — for each {£,a,£') € R such that a G £ ' \ (Epcg x {??,!!}) we have (£,a,£') € R'. Hence all rendezvous, broadcast, and non-PCG local transitions are unchanged. — for each (£, a, £') € R such that a 6 E p C 3 we have (£, a\\, £') e R'. Hence P C G local actions become broadcasts. 4.4. Conjunctive Guard Reduction 116 - for each £ £ L and a 6 T,vcg we have (£, all, £' ) € R', where £' = £ if Be 7(a) resigned otherwise Hence, upon receiving a broadcast corresponding to a P C G action, a process is unaf-fected if its local state satisfies the conjunctive guard, otherwise it enters resigned. - for each a € S'b we have (resigned, all, resigned) € R'. These transitions serve only to satisfy the restriction that broadcasts must always be received. Consider an upward-closed set of states U of a C G B P B = (L,H,R, 7 ) and let B = basis(C7) be the canonical basis of U in the subword ordering over L*. Let U' be the upward closure of B in the subword ordering over the set (L U {resigned})*. Alternatively, U' can be defined by where d(w) is w with all occurrences of the symbol resigned deleted. This set U' will be the bad states we wish to avoid in B'. If 5 = (S, —>) is a transition system, we call a sequence of states xo —+ x\ —>•••—> %n a path of S. Also, given state sets I,J C S, we say that J is (unreachable from I in S if there exists (does not exist) a path of S that starts in I and ends in J. The following theorem states that B' is a sound reduction of B, in that the unreachability of U' in B' implies that of U in B. Theorem 21. Let Bbea CGBP, and let I and U be sets of states ofB such that U is upward-closed. IfU' is unreachable from I in B', then U is unreachable from I in B. Proof. By Lemma 40, the set of states reachable from I in B' over-approximates the set of states reachable in B. Thus, if U' is unreachable from I in B', then U is unreachable from I in B, since Lemma 40. a is a path ofB if and only if o is a path ofB' in which no process is ever in the local state resigned. Proof. Follows from the simple observations that any transition of B is a transition of B', and, conversely, any transition B' in which no process starts or finishes in resigned is a transition of w eU' d(w) e U U c U'. • B. • 4.4. Conjunctive Guard Reduction 117 Theorem 21 suggests the following verification approach. In order to verify that a C G B P B cannot reach an upward closed set U from the initial states / , one constructs B' and checks that U' is unreachable from I in B'. O f course, decidability of this proposition about B' depends on the form of I; if / is a parameterized set then we have decidability. Similar to our verification approach of Chapter 3, this approach to verifying C G B P s is incomplete, meaning that if we find that U' is reachable from I in B', we cannot make any conclusions about the correctness of B. Our C G reduction is complete, however, if a certain decidable side condition holds. For each P C G local action a of the C G B P B = (L, E , R, 7 ) , let 7 (a) C L be the set of local states £ such that there exists a sequence of zero or more non-PCG local transitions taking £ to a state £' € 7 (a ) ; note that 7 (a) C 7 (a ) . We construct a broadcast protocol B" that modifies B' as follows. A new local state fail is added, and when a process in local state £ receives the broadcast a\\ where a e E p c s (i.e. a broadcast corresponding to a P C G action in B), its next local state £' is given by ( fail if 7(a) resigned if £ € 7 (a ) A £ $ 7(0) £ ifeey(a) A s before, the process remains in the same state if it satisfies the C G . Otherwise, if it could have satisfied the C G by making (non-PCG) local transitions only, then it resigns. However, if the process could not have reached a state in the C G "on its own", then it enters fail. Let Fail be the set of all finite words w over L U {resigned, fail} such that w contains at least one occurrence of fail. Note that Fail is clearly upward-closed. The following theorem states that if Fail is unreachable in B", then our conjunctive guard reduction is both sound and complete. Theorem 22. Let B be a CGBP, and let I and U be sets of states ofB such that U is upward-closed, and suppose Fail is unreachable from I in B". Then U' is reachable from I in B' if and only ifU is reachable from I in B. Proof. (<=) Follows by Theorem 21. (=*•) Since in all three transition systems we are interested in the same set of initial states I, the term (unreachable will always implicitly be with respect to I in this proof. We assume that U' is reachable in B' and that Fail is unreachable in B", and show that U is reachable in B. Call a path unsafe if it starts in I and ends in UorU'. 4.4. Conjunctive Guard Reduction 118 For a path a of B' and a process p, let rsl (cr, p) be the length of the suffix of a in which p is in state resigned. Note that rsl(cr,p) = 0 precisely in the case that p never resigns. Letting n be the number of processes involved in cr, we show how, given an unsafe path a of B', we can construct another unsafe path r of B' such that Property 1 for all p £ N „ we have rs l ( r , p) < rsl (cr, p), and Property 2 there exists g € N n such that rs l ( r , g) < rsl (cr, g), By iterating this construction, one can transform any unsafe path of B' into an unsafe path of B' in which no process resigns, which, by Lemma 40, is an unsafe path of B. We now describe the construction. Suppose we have an unsafe path of B' x0 -> x i -> • • • -> xk (4.14) in which some process resigns. Let q be an earliest resigning process, i.e. q is such that there exists i > 1 where £j_i(g) ^ resigned = Xi(q), and further no process is resigned in Xi-\. Then there exists a € S p c g (i.e. a is a P C G local action of B and hence a is a broadcast action of B') such that Xi-i —s- Xi is a broadcast transition on the action a. Since Fail is unreachable in 5", we have that xi-i(q) S 7( a ) - Thus there exists a path of B' z t i - s L i - ( 4 - 1 5 ) such that • xi—\ — Xi—i, • for each j € {1 , . . . , m}, a^ 'jJi —* xj_i involves a local transition of process g, and • x™i(<?) e 7(a) Hence Xj_i and differ only in the local state of q, and therefore the broadcast of a may occur from x ™ i , yielding a state yj which differs from Xi only in that j/i(g) = x^li(g) ^ resigned = Xi(q). Note that no process is resigned in any state of (4.15). Starting from yi, there exists a path of B' yi -> Vi+i -> • (4.16) 4.5. Evaluation 119 such that for each j e {i,... ,k}, yj differs from Xj in (at most) the local state of process q. For each j £ {i + 1 , . . . , k}, the transition yd-\ —> yj involves the same local, rendezvous, or broadcast action as Xj-i —> Xj, which is always possible because Xj_i(g) = resigned and thus q never performs an output in these transitions. Intuitively, in (4.16) q is passive in the sense that it only receives inputs from broadcasts, possibly resigns at some point, but is definitely not resigned in yi. Since replacing any occurrence of resigned in a word of JJ' with any other element of L will yield another word of JJ', and xk & JJ', we have yk e JJ'. We may construct the desired path r by concatenating the first i states of (4.14), all of (4.15), and all of (4.16), as follows. x 0 -> xi -> > Xi-i -> x-_! -> > x™_x -> j / , -> >ye (4.17) It is easy to see that (4.17) is unsafe and satisfies properties 1 and 2 above, hence this completes the proof. • 4.5 Evaluation In this section we describe our implementation of our algorithm (Sect. 4.5.1) and then provide an informal comparison with the classical algorithm (Sect. 4.5.2). The remaining subsections present experimental results for several petri nets (Sect. 4.5.3), for a M E S I cache protocol over multiple cache blocks (Sect. 4.5.4), and for a more elaborate caching protocol (Sect. 4.5.5). The latter two systems both involve properly conjunctively guarded transitions; our C G reduction of Sect. 4.4 was successfully applied in both cases. A l l experiments were run on a machine with an Intel Pentium 4 at 2.6GHz and 4 G B total memory. The implementation of the classical approach we compare against is based on an extension of C S T s called interval sharing trees [59]. 4.5.1 Implementation Our proof-of-concept implementation assumes a N S W in which states are words over a finite alpha-bet L, and the wqo is the subword ordering =^w A s mentioned in the proof of Theorem 14, in this ordering, the weight of a word is simply its length. Given a binary encoding of L, we can naturally represent a subset of Ln for some n > 1 using a B D D [23]. The ensuing discussion is simplified if 4.5. Evaluation 120 we pretend that the B D D variables are xi,X2, • •., where each Xj ranges over L; of course in reality each Xj corresponds to many boolean variables that encode elements of L. For each i > 1, our implementation requires an S M V description of both the transition relation for the system restricted to i processes and the bad states involving i processes. These descriptions are generated beforehand up to a small guessed maximum value of i. Also, the Lift operation is expressed by an S M V transition relation such that the postimage of the relation is the result of applying Lift; (4.19) below demonstrates how this is done. Given these S M V descriptions, line 7 of our algorithm (Fig. 4.4) or the optimized version 7' of Sect. 4.3.4 is computed using standard finite state backward reachability analysis. This yields a B D D representation of I V Line 8 of Fig. 4.4 checks if the initial states have been reached. Here we explain how our implementation handles the generalization of Sect. 4.3.3 for infinite parametric sets. Thus our initial states are expressed by (4.6) and we must decide (4.7) for each i. This is achieved by building the B D D for: Ti A I A V A + li ) <4-18) \j€E KQNi A\K\=max(i-aj,0) k€K J It is straightforward to show that (4.7) holds if and only if (4.18) is not the empty B D D , i.e. false. Though the computation of the B D D (4.18) has the potential to blow up, in practice this is not a huge concern, since typically \E\ is small, as is a,- for all j G E. Line 11 involves an application of the Lift operator and a set containment check, the latter is decided simply using B D D implication. The Lift operation is computed as 1 3 i Lift(ri_i,i) = \ / r e n a m e d ) (4.19) fc=i where, for each k G Ni, renamefc(Fi_i) is simply Tj-i with the following variable renamings: for each j G {k,..., i — 1} we rename Xj with X j + \ . O f course renamefc(rj_i) will be isomorphic to (and hence exactly the same size as) the B D D for Ti_i; the potential for B D D blow up stems from the z-way disjunction of (4.19). 1 3In our make-believe world where B D D variables range over L, (4.19) is accurate. However in reality, where variables are boolean, we must prevent the disjunction from introducing variable assignments not corresponding to elements of L. This is handled by simply conjoining a B D D for U to the RHS of (4.19). 4.5. Evaluation 121 4.5.2 Comparison to Standard Approach Here we provide an informal comparison between our algorithm and the classical algorithm, specif-ically the implementation of the classical algorithm based on C S T s [42,43] which was briefly dis-cussed on page 100. C S T s are similar to B D D s in spirit, however, the fact that semantically a C S T denotes the upward-closure of its constituent vectors complicates the manipulation algorithms. For example, checking subsumption (i.e. upward-closed set containment) between two C S T s is co-NP hard in their sizes. Unfortunately, checking subsumption is an integral part of the classical algorithm (cf. the condition of the while-loop in Fig. 4.2). To combat this problem, Delzanno et al. develop a sophisticated heuristic solution in which certain C S T simulation relations facilitate pruning of an (exponential time) exact subsumption check [43]. In contrast, subsumption between two B D D s can be decided in time proportional to the product of their sizes [23]. In fact, we can correctly replace the containment of line 11 of Fig. 4.4 with an equality test: T , ^ Li f t (Fj_ i , i). This test can be done in constant time using a reasonable B D D library, such as C U D D [119]. On the other hand, the potential for B D D blow-up, especially in computing the Lift operator a la (4.19), is always a looming concern. The main efficiency difference between the two approaches is likely to derive from the sizes of the underlying data structures. Predicting the dynamics of these sizes is a complex problem. Though B D D s compactly represent many practical boolean functions, the worst case size is exponential in their height (i.e. the number of boolean variables). Similarly, although bounds on the size of C S T s have not been derived in the literature (to our knowledge), any such bound is at least exponential in the height of the structure. Here, we consider data structure height as a coarse measure of worst-case size. The CST-based classical algorithm assumes that states of the W S T S are vectors of Nm, and can be applied to both petri nets and broadcast protocols. Let L be the set of local states (in the case of broadcast protocols) or the set of places (in the case of petri nets). Then we call | L | the dimensionality of the system. The height of the C S T s is fixed and equal to the dimensionality, while if we employ L* as the state space and use our algorithm, the height of the involved B D D s is at most (rif + 6) |~log2 \L\], where n / is the final value of n in our algorithm. This suggests that our approach might be superior when (rif + 8) f log 2 \L\] is much less than the dimensionality, since 4.5. Evaluation 122 Petri net Our runtime C S T runtime Max B D D height C S T height (dimensionality) Multipool 3010 2.09 50 18 C S M 95 0.06 36 14 Mesh(2 x 2) >1300 1.30 >40 32 Table 4.2: Experimental results for selected petri nets from a paper of Delzanno et al. [43]. For Mesh(2 x 2), our implementation spaced out. Figure 4.7: The petri net ME(h) under such circumstances the C S T s are more likely to blow-up. O f course predicting tif a priori is likely intractable. However, \L\ and 8 are known a priori, and hence even an estimated value of rif could be used to determine which approach to apply. We now present our experimental results. For those where both approaches are used, the results tend to confirm our hypothesis that data structure height is a good predictor of performance. 4 . 5 . 3 P e t r i N e t s Delzanno et al. [43] have run their CST-based implementation of the classical approach against several petri nets. These nets have small dimensionality, so, as discussed in Sect. 4.5.2, we do not expect our approach to perform well. Indeed, Table 4.2 shows that the CST-based implementation outperforms our approach by several orders of magnitude. Recall that we anticipate our approach to have an advantage when the height of our B D D s is dwarfed by the height of the CSTs , which is not the case here. In fact, for all three petri nets, the C S T s enjoy a shorter height than the B D D s . In hopes of confirming our hypothesis about data structure height, we constructed the "param-4.5. Evaluation 123 eterized petri net" ME(h) depicted in Fig. 4.7. The parameter h dictates the width of the chain of places xi,...,Xh along the top of the figure, h allows us to control dimensionality, which is equal to h + 3. For any h, the parametric set of initial markings for ME(h) places a single token at the place notin, and an arbitrary number k on XQ. A token can move from xo to x\ when there is a token at notin by firing transition a. This will move the token at notin to in, which will disallow any more tokens from entering x\. The token that is in the chain can move along the chain, and at any point it may hop back to jcn, which will result in the token at in being moved back to notin. Hence ME(h) implements mutual exclusion in the sense that at most one token can be in the chain at any time. For our experiments, we verified that there can only be at most one token at x^; i.e. the upward-closed set of markings {m \ m(xh) > 2} is not reachable. We measured execution times for h = 2 5 , 5 0 , . . . , 250; the results are plotted in Fig. 4.8. The plot labelled " C S T " gives the runtime for the Delzanno et al.'s C S T approach [42,43]. 1 4 The plot labelled " B D D " gives the total runtime for our implementation and a translation step to take the original petri net description to the S M V required of our tool; " B D D minus translation" disregards this translation time. The latter is presented because the translation phase is suboptimal; in a sophis-ticated implementation there would be no need for the intermediate S M V files and hence the time in this phase would be highly mitigated. From Fig. 4.8 we see that for ME(h) our algorithm is almost two orders of magnitude faster than the state-of-the art implementation of the standard approach (for large h). The probable trend for h > 250 is clear. With regard to data structure height, we note that for M E (250), the C S T s are a towering 253 levels high, while the largest B D D processed by our algorithm had a height of merely 48. 1 5 4.5.4 MESI Protocol M E S I is a common variety of shared-memory protocol. In a M E S I protocol, each client has a cache block in one of four states: Modified, Exclusive, Shared, or Invalid. Although many M E S I protocols are conceivable, here we use the standard version used by computer architects (as presented by 1 4 In fact, the reported run-times are those of software based on interval sharing trees (1ST) which are an extension of CSTs to handle two-sided constraints [59]. The 1ST software used is a constant 3 or 4 times slower than a pure CST implementation. I 5Here we found n / = 4, 6 = 2, and \L\ = 253. 4.5. Evaluation 124 1e+06 100000 10000 o 1000 Si 100 10 1 0 50 100 150 200 250 chain width h Figure 4.8: Execution times for the two approaches against the petri net ME(h) of Fig. 4.7. The vertical axis gives the runtime in seconds; the horizontal axis gives the petri net parameter h. Our approach is labelled " B D D " , while the C S T approach of Delzanno et al. is labelled "CST". Culler et al. [38]), which has a P C G transition, so we use our reduction from Sect. 4.4. As for ME(h) of Sect. 4.5.3, we desired a "knob" that would give us control over the dimen-sionality. Since shared-memory protocols are used to orchestrate the sharing of multiple addresses, we instantiated the M E S I protocol over m addresses,1 6 for m e {1,2,3,4}. The results are given in Table 4.3. Our C G reduction allowed the verification to succeed, so there was no need to verify the side condition. We compare our result against both the CST-based classical approach and another variant of the classical approach based on the polyhedral model checker Hytech [40,73]. The results clearly indicate the superior scalability of our approach as the local state (dimensionality) grows. The Ffytech-based approach aborts even for m = 3, reporting "Out of memory". The parser of the C S T tool cannot handle the size of the description of M E S I with 4 blocks, which is 5.9 M B s . This large size arises because the broadcast matrices used by the classical approach grow quadratically in the dimension of the problem. This contrasts with the mere 30 K B of S M V that constitutes our tool's input. 1 6 In this case, since the "sub-protocols" controlling each address are independent, correctness for m = 1 entails correctness for all m > 1. In practice, however, such a simplification is often not possible, because real protocols can exhibit nontrivial interactions between different addresses. This experiment measures how our approach handles the explosive growth in local state resulting from analyzing multiple addresses. 4.5. Evaluation 125 # of blocks Our runtime C S T runtime Hytech runtime Max B D D height dimension 1 0.0 0.0 0.0 9 5 2 0.1 0.2 380.0 18 25 3 0.7 131.9 >7989.0 27 125 4 4.6 36 625 Table 4.3: Results for the M E S I protocol with P C G over multiple blocks. Run times are in seconds. The column dimension indicates the height of the C S T data structures in the C S T approach, and also the width of the real vectors processed by Hytech in Delzanno's polyhedral approach. Property (all passed) Runtime (sec) Encoding of curPtr 3 C G reduction completeness 214 Data coherence 63 Table 4.4: Results for German's Protocol. To convert the protocol to a C G B P , we needed to re-encode the curPtr variable. Although this encoding was straightforward, we verified that encoding is one-hot as a sanity check. The main verification task was "data coherence", which verified that the value of each read is the most recently written data value. Since the C G reduction is sound and the verification succeeded, we actually did not need to run the " C G reduction completeness" verification task, which performs the completeness check suggested by Theorem 22. We have provided the run time simply to illustrate that the side condition is verifiable in practice. 4.5.5 German's Protocol German's protocol [62] is a challenge problem for parameterized verification that has been previ-ously tackled in several papers [28,86,109]. A s done by Chou et al. [28], we include a one bit data path. The original description [62] is a Murip model, and is almost a C G B P : the Marip description involves a variable that is a pointer to a process; such variables are not directly supported by C G B P s . We've encoded this variable by simply giving each process an extra bit, which is true at a process iff the original variable would point to the process. This system is a C G B P , to which we applied our C G reduction to obtain a broadcast protocol. As mentioned in Sect. 4.5.4, even describing a B P in a format suitable for the classical approach is problematic when the dimension is large. Due to its various channels and the presence of data variables, our model of German's protocol has a dimensionality of 6144. For this reason, we were unable even to run the CST-tool against this example. The results for our tool are given in Table 4.4. Chapter 5 Related Work In this chapter we survey previous research on verification of shared memory protocols, memory models, and parameterized verification. In Sect. 5.1 we look at early efforts to model check shared memory protocols that tackle safety properties (e.g. at all times, at most one processor has exclusive permissions to a block) or, more generally, properties expressed in some standard temporal logic. Typically, these properties are chosen to imply, or at least increase confidence, that the system adheres to the intended shared memory model, but the memory model is not verified per se. Like S C , most memory models are defined in terms of the existence of certain reorderings of the memory traces, notions that typical temporal logics are too weak to capture.1 In Sects. 5.2 and 5.3, we summarize works that do strive to verify the memory model directly. Sect. 5.2 summarizes approaches involving hand-proofs and theorem provers, while Sect. 5.3 considers memory model verification that involves model checking. Techniques involving hand proofs or theorem proving typically verify correctness across all configurations of interest, of course this thoroughness comes at the expense of human labor. In-deed, many of the papers of Sect. 5.2 prove correctness over all parameterizations. Sect. 5.4 looks at parameterized verification research that is automated or at least semi-automated. Under this par-titioning of the literature, contributions that do (automated) parameterized verification with respect to a memory model could either be listed in Sect. 5.3 or 5.4; we have elected to include them in the latter. ' A n obvious counterexample here is Lamport's T L A [89], which is undecidable. 126 5.7. General Protocol Verification 127 The final Sect. 5.5 mentions several avenues of related that do not fall under any of the previous four section headings. 5.1 General Protocol Verification Shared memory protocol verification was one of the early successes of symbolic model checking when S M V was employed by McMil lan and Schwalbe [97] to the industrial Gigamax multiproces-sor memory system, by Clarke et al. [30] to the Future+ cache coherency protocol (an I E E E stan-dard), and by Eiriksson and McMil lan [48] to the SGI Origin 2000 protocol. A l l three verification efforts revealed several previous unknown defects in the respective designs. Explicit state model checking was also shown to be effective at protocol analysis by Di l l et al. [46], who developed the Muup language and model checker. Later, Hu et al. [78] applied Mur</? to another industrial shared-memory system, carefully tracking human effort, and concluded that such endeavors are worthwhile from an economic standpoint. 5.2 Memory Model Verification: No Model Checking Here we discuss works wherein the specification is a memory model, but do not use model checking as the primary means of verification. Some approaches are hand-proof methodologies or case-studies, others are unsound but useful for catching bugs, and others are formally sound thanks to a automated theorem prover, but still require a large component of human effort. Perhaps the earliest effort that turned attention to testing adherence to a memory model was that of Collier [33]. The work, which formalized the memory event abstraction used in this thesis and elsewhere, spawned a set of software tests called ArchTest [32] that test a multiprocessor for conformance to various ordering rules. O f course, these tests can only reveal defects rather than prove correctness. Nevertheless, ArchTest has been beneficial enough to both I B M and Intel to warrant worldwide licensing by these industry leaders. Proving that the Lazy Caching protocol is S C was the subject of a special issue of the journal Distributed Computing [99], which contains six different hand proofs. A s highlighted in Merritt's introduction, the proofs encompass a broad range of techniques: automata, temporal logics, process algebras, transducers, and refinements. None of the proofs use any automation or are mechanically 5.2. Memory Model Verification: No Model Checking 128 checked. However, Graf's proof [71] involves a set of V C T L * formulas that together imply S C ; these formulas are broad enough to verify Lazy Caching. Thus in principle one could model check these properties and infer S C of a given finite state instantiation of the protocol. Condon et al. [34,108] have employed a hand-proof methodology based on Lamport clocks [87] to prove S C , as well as the weaker models T S O and Alpha. This framework involves the human (on paper) time-stamping memory events with logical time triples; these timestamps must respect temporal causality and are used to prove the existence of the necessary reordering of events. The same group have applied their technique to prove S C of a more complex directory protocol (very similar to the WIS protocol we experimented with in Sect. 3.6), and have developed an intuitive, table-based protocol specification methodology [120]. Several major efforts to verify memory model adherence using Lamport's temporal logic of actions ( T L A ) have been conducted [7,90]. The goal of these projects was to verify Compaq's complex E V 6 (a.k.a wildfire) and E V 7 multiprocessor memory protocols, which implement the A l -pha memory model. Manual T L A proofs that the protocols implement an operational specification of the Alpha memory model, also written in T L A , were attempted. Although only the proof for the later and simpler E V 7 was completed, deep bugs were found in both protocols. Further, an inconsistency between the E V 6 implementation and the memory model exposed by the project was ultimately deemed to be an error in the memory model itself; this induced a change in the Alpha Architecture Reference Manual. T L A was also used to construct a detailed hand-proof that Lazy Caching is S C [85]. The T L C model checker [127] was reported to be a valuable tool in the E V 7 and Lazy Caching verification projects. The P V S theorem prover was employed by Arons [11] to verify S C of both Lazy Caching [6] and a ring protocol of Collier [33]. The approach is based on ideas from the original hand proof for Lazy Caching [6], but is mechanically checked in P V S . The use of theorem proving allowed for parameterization over processors, addresses, values, and queue depths. Strangely, for Lazy Caching, Arons proves S C with respect to the internal MemoryWrite events, rather than the usual W events that occur on the protocol's interface (see our Fig. 2.3). Viewed in this light, Lazy Caching looses its status of being S C and not simple S C (see our Def. 27), an attribute that makes the protocol a challenge to verify. Other papers that employ P V S are those of Park and Di l l [105,106], who define a compelling technique called aggregation of distributed transactions to verify the F L A S H 5.3. Memory Model Verification: Model Checking 129 protocol, and Stoy et al. [123], who use a T L A implementation in P V S and also handle liveness. Park and Dill's work verifies that F L A S H (in "delayed" mode) is S C by showing that it is serial. Related to our Sect. 2.4, there are several papers that consider the question of whether a given trace adheres to a some memory model. Analogous to our result that checking a trace for D S C is N P -complete, Gibbons and Korach [66] have proven the same result with respect to S C . Furthermore, they consider many restrictions of this problem, for example traces involving at most 3 processors, traces in which no processor performs more than 2 events, and traces involving only 2 addresses; all of these remain NP-complete. Our reductions of Sect. 2.4 and Sect. 2.6 are in the spirit of this work. Later, Cantin [26] showed that the problem is NP-complete for a single address, i.e. the trace problem for per-address S C 2 is NP-complete. Gopalakrishnan and Yang et al. [70,126] have tackled the problem of making practical tools for solving the trace problem with respect to an arbitrary memory model. Their work has explored techniques of compiling a trace/memory model pair into a boolean satisfiability instance, a quantified boolean formula instance, or a constraint programming problem, which are satisfiable if and only if the trace is admittable under the memory model. In this thesis, S C (and D S C , etc.) are taken to be properties of finite traces. Glusman and Katz [67] have studied the implications of extending S C to a property of infinite traces. They show that S C is not a safety property by giving an example of an infinite trace that is not S C , yet all finite prefixes are S C . 3 Hence, one cannot infer that a protocol is S C in the infinite sense by verifying that it is S C in the finite sense. To remedy this situation, Glusman and Katz propose a reasonable set of protocol conditions that are sufficient for the above inference to hold. Considering S C as a property of infinite traces essentially adds an aspect of liveness to the property. Sezgin, who's work is discussed in the next section, also amalgamates liveness properties with S C . 5 .3 Memory Model Verification: Model Checking This section considers model checking-based approaches to verification of various memory models. 2per-address SC is called both coherency and cache consistency throughout the literature 3The infinite trace is (essentially) (W,Pi,x,l)(W,pi,x,2)(R,p2,x,l)",i.e. (R,P2,x,l) is repeated ad infinitum. For any finite prefix, a serial reordering is obtained by simply placing (W,Pi,x, 2) after all events of P2- However, the whole infinite trace does not have a serial reordering, since wherever (W,Pi,x, 2) is placed, there will be an infinite number of instances of (R, P2,x, 1) after it. 5.3. Memory Model Verification: Model Checking 130 Nalumasu et al.'s test model checking [104] is a fusion of the ArchTest rules with model check-ing. Test model checking is sound and complete for several memory models, however, the approach is unsound for S C [68]. In his thesis, Nalumasu [103] pioneered much of the constraint graph theory we employ in Chapter 3. Ghughal et al. [65] subsequently concocted new ArchTest-style rules for several weak memory models, and showed how the test model checking paradigm could be used to test these properties. Park and Di l l have implemented maximally general models for the S P A R C architecture memory models ( T S O / P S O / R M O ) using Mur</? [45,107]. The goal of this research is to construct an exe-cutable specification which can be used to verify that a given parallel program fragment is correct under a memory model, as opposed to verification that a given protocol hardware design implements the model. Our protocol Gk(n, tn, v) defined in Sect. 2.5 is also an example of a maximally general model, since it completely captures the traces of D S C / . . A verification technique is proposed by Chatterjee and Gopalakrishnan [27] that exploits a natu-ral architectural partitioning found in most modern memory system designs. The approach replaces the so-called external partition (consisting of caches, interconnect, and main memory) with an abstracted, simplified structure. The resulting system must be shown to be both refined by the im-plementation and correct with respect to the memory model. The latter task is facilitated by splitting single write events into local and global instances. Handling of differing logical and temporal orders is done in an ad hoc manner. A recent and fresh look at the problem of memory model verification has been taken by Sez-gin [117,118], who has developed an alternate means of both defining S C and modeling protocols. Sezgin is critical of the standard trace-based approach to modeling protocols taken in this thesis and elsewhere, and advocates a transducer-based model. These transducers distinguish protocol inputs (i.e. memory access instructions) from outputs (i.e. responses to the instructions). Both alphabets are identical to our set of memory actions, with the exceptions that symbols are annotated according to whether they are inputs or outputs, and input reads do not have a data value component. This scheme allows for making assertions not only about reorderings of events, but relationships between inputs and outputs. One such requirement, which is reminicient of our disallowing of "prophetic inheritance" in D S C (see Sect. 2.1), is that a data value d may be read from an address a via a read response only after some write instruction has written d to a. Also, protocols are defined to have the 5.3. Memory Model Verification: Model Checking 131 desirable properties that any sequence of input instructions is accepted, and all inputs are eventually responded to with outputs. Whereas in the trace-based formalism a system with the empty set of behaviors is trivially S C , Sezgin precludes such systems from even achieving the status of being legal implementations. His perspective contrasts with a viewpoint implicitly taken in this thesis: S C is a safety property, and only one of several properties that a correct shared memory protocol is possibly expected to possess. Philosophically, we feel that formal verification should strive to dissect properties as much as possible, rather than amalgamate them into monolithic correctness criteria. However, if a certain amalgamation can be shown to reduce verification complexity or shed light on the difficult problem of shared memory protocol verification, then clearly it is a worthwhile endeavor. Perhaps the most salient parallel between the work of Sezgin and this thesis are his class of finite state protocols 4 SC-pfi(j,k) and our class Gk{n,m,v) of Sect. 2.5. Both serve as maxi-mally general protocols from which decidability results are obtained by appealing to automata lan-guage containment. We feel that (modulo the differing transducer/trace formalisms used) our class DSCfc captured by Qk(n,m,v) is more expressive (with respect to reorderings admitted) than the SC-pfi(j, k) machines. Behaviors of the latter have the property that the "distance" in logical time (i.e. the reordering) that any two processors can become out of sync is bounded; this bound is a function of j , k, and \C\. At the level we model protocols, any non-serial S C protocol with which we are familiar does not have such a bound. Indeed, Sezgin's thesis [117] shows that only a fair version of Lazy Caching (see Sect. 2.3.3) has behaviors contained in some SC-p,c(J, k). The notion of fairness called upon is much more restrictive than the usual notion. For example, whenever the queue outi is nonempty, it is required that a MemoryWritej event must occur within a bounded number of protocol transitions.5 In contrast, in Theorem 3 we argue that the unadulterated Lazy Caching is D S Q t for some k (a function of the number of processors and queue depths). We close our summary of Sezgin's work by mentioning that, due to the fundamental differences in the frameworks, the undecidability results of Alur et al. [8] and this thesis (Sect. 2.7) do not directly apply to his notion of S C . Indeed, in a recent paper he asserts that "the decidability of 4 O f course his notion of protocol differs from ours; his is a finite state transducer while our is a finite state automaton. 5Whereas usual notions of fairness would only require that outi being nonempty implies that the event MemoryWrite i occurs eventually, with no imposed bound on when the event transpires. 5.3. Memory Model Verification: Model Checking 132 checking the sequential consistency of a finite-state memory system is still an open problem" [118, page 7]. The work of Braun et al. [22] presents a semi-automated S C verification technique that uses model checking. The idea is that the user annotates the protocol description to maintain auxil-iary state called a window, which summarizes the intended reordering of the trace. When model checking, a finite state automaton called a checker is composed with the augmented protocol. The checker verifies that all updates to the window follow a specific set of rules that imply S C . Our view windows (VW) of Sect. 2.5.1 are similar to and were inspired by the windows of Braun et al, and could be used in the same manner that windows are employed. V W are somewhat more expressive in terms of reorderings admitted, however. In particular, if a read event r precedes a write event w temporally, then windows insist that r must also preceed w in the reordering. V W admit D S C traces that must break this restriction in their reorderings. Condon and Hu's approach [36] automates a variant of Braun et al.'s method [22]. The protocol is automatically augmented to dynamically construct an abbreviated version of the constraint graph (see Def. 29 for a related definition) of the trace thus far. The approach requires that the protocol has the attributes of tracking labels and a store order generator. Tracking labels allow on-the-fly inference of the inheritance relation. The store order generator is an automaton which determines the ordering edges between writes to the same address. In the case that the protocol is simple S C (the property we handle in Chapter 3; see Def. 27), the store order generator is trivial. Otherwise, by bounding the number of store order generator states by the cardinality of the state space of the protocol, the method can theoretically still proceed without user intervention, since all of the finite number of possible store order generators can be enumerated and attempted. Qadeer's work [113] also automatically verifies simple S C , 6 and inherently supports parame-terized verification of a value-parameterized protocol family (see our Def. 5). A s in Chapter 3, the family must satisfy the assumptions of data independence, processor symmetry, and address symmetry. A n appealing aspect of his framework, which is fully automatic, is that the violating behaviors are specified by a set of relatively small finite automata. Collectively, these automata dynamically detect the existence of a canonical A;-nice cycle (see our Def. 31) in the trace of the protocol. Model checking is then done on the composition of the (undeterminized) automata with 6Qadeer [113] refers to simple SC as SC with the simple witness. 5.4. Parameterized Verification 133 the protocol, the result of which will have a state space of size at most the product of that of the protocol and the automata. Qadeer's approach was used in this thesis to verify S S C of the abstrac-tion Q in the experiments of Chapter 3. Prior to this work, Qadeer made a more ambitious effort to handle a broad class of memory models (not just SC) in a similar framework [112]. 5.4 Parameterized Verification The term parameterized verification refers to any verification endeavor that proves correctness of a family of systems parameterized by one or more quantities. Parameterized verification is a special case of infinite state verification, since an infinitude of systems typically entails an infinitude of states. A s mentioned in the introduction to this chapter, hand-proofs and theorem proving proofs usually verify correctness over all parameterizations, however the burden on the human expert is large. Parameterized model checking (PMC) attempts to alleviate this burden by automating all or most of the parameterized verification process. This section summarizes work on P M C . We note that most P M C efforts target systems in which the parameter specifies the number of process components. These are components that are active and have strong interactions with each other, as opposed to components that are less active and usually easier to deal with, such as addresses or data items. Thus the work discussed in this section is more closely related to our Chapter 4 than Chapter 3, a notable exception being a paper by Henzinger et al. [74] discussed below. Well-structured transition systems (WSTS), which are a central notion of Chapter 4, were first proposed by Finkel [56]. The upward-closed set backward reachability algorithm for W S T S (i.e. what we call the classical approach) was first articulated by Abdulla et al. [2], in which the applica-tion to petri nets is observed. Later, Finkel and Schnoebelen generalized the notion and provided an assortment of examples [57]. Recently, Geeraerts et al. [61] have proposed a compelling approach to verification of W S T S based on forward reachability. This is the first sound and complete algorithm that performs forward analysis of W S T S . Similar to our approach, theirs is based on a framework in which a sequence of finite-state subsystems of increasing size are examined until either a coun-terexample is found, or a certain convergence condition is reached. Convergence occurs when an abstraction, which becomes more and more precise, is tight enough to verify non-reachability. Broadcast protocols (BP) were introduced by Emerson and Namjoshi [53]. Their procedure for verifying B P safety properties, which is based on the Karp-Miller petri net covering graph [81], 5.4. Parameterized Verification 134 was shown to not necessarily terminate by Esparza et al. [55]. Decidability of safety properties for broadcast protocols was established by Esparza et al. [55], who show how the backward reachability algorithm of Abdulla et al. [2] can be applied to this problem. Delzanno et al. have investigated means of symbolically representing upward-closed sets in the backward reachability algorithm [41-43] with encouraging results. Delzanno advances the standard algorithm for broadcast protocols in two ways [40]. First the permitted transition guards are generalized (though this generalization causes the approach to be only semi-algorithmic) , and second, he shows how efficient real (as opposed to integer) constraint solvers can be used to implement the algorithm. Our Sect. 4.5.4 presented some experimental results that use Delzanno's approach. So-called cut-off results are those that reduce the correctness of a class of parameterized system to the correctness of the system with only n processes. The cut-off n is typically a function of the size of a single process. German and Sistla consider C C S style processes and prove exponentially sized cut-offs for regular properties among other P M C results [63]. For protocols with either con-junctive or disjunctive guards, Emerson and Kahlon give cut-offs for checking L T L \ X formula [49]. Our approach of Chapter 4 can be viewed as computing the minimal cut-off for the system protocol being model checked, whereas these previous works infer cut-offs for entire classes of systems. Pnueli et al. have developed smaller cut-off results for a more expressive class of systems [12,109], but this benefit comes at a cost since completeness is sacrificed. Emerson and Kahlon [51] have also contributed a thorough study of P M C decidability for vari-ous combinations of properties and communication primitives, which includes broadcasts, and have proposed a sound and complete verification technique for a class of protocols with C G [52]. How-ever it is unclear if the latter approach will scale beyond systems with small local state. For ex-ample, their subsequent treatment of German's protocol requires a nontrivial amount of manual reasoning [50]. Network invariants are a semi-automatic approach to P M C [29, 31, 82, 83, 91,125]. Given a process template P, the goal is to verify that for all n, the composition of n copies of P, denoted Pn = P\ \ • • • | |.P (where there are n Ps), satisfies some property <f>. The user provides a process I called the network invariant, that attempts to abstract the behavior on the interface of Pn for arbitrary n. Proof obligations typically involve verifying that P\\I is abstracted by / , that P is abstracted by I, and that I \= cf>. A l l three of these obligations can typically be dispatched to finite 5.4. Parameterized Verification 135 state model checking. From these premises one can conclude the verification goal V n : Pn t= (p. A drawback of using network invariants is that they are often a challenge to produce. Furthermore, network invariants are not guaranteed to exist in general [3,125]. The only other approach known to us that uses model checking to verify sequential consistency of address-parameterized families of protocols is that of Henzinger et al. [74]. Their semi-automatic method, is based on network invariants, can handle families of protocols that are parameterized in the number of processors, in addition to the number of addresses and data values, but only works for protocols whose traces can be reordered by a finite state automaton to form serial traces, a restriction that typically holds in practice only for protocols that are already fully serial. A limitation of their method is that its soundness relies on the assumption that the protocol to be verified is location monotonic, meaning that any trace of the system projected onto a subset of addresses is a trace of the smaller system involving just those addresses. Henzinger et al. do not provide a method (automated or otherwise) for testing location monotonicity of a parameterized family of protocols, i.e. it is only confirmed by manual inspection [115]. In his thesis, Nalumasu [103] does provide a framework for constructing protocols that guarantees location monotonicity, but the framework seems to have limited expressiveness. McMil lan has employed the S M V proof assistant [95] to verify the Stanford F L A S H multipro-cessor's shared memory protocol [96] for an arbitrary number of processors. The proof demonstrates that the protocol is per-address S C . Verification proceeds through user-guided model checking; this guidance comes in the form of case splitting, noninterference lemma writing, and inclusion of auxil-iary variables. Chou et al. [28] also use noninterference lemmas in the context of the Mur</? verifier. These works were discussed at length in Sect. 3.7 of this thesis. Abstraction [37] has been used to tackle P M C ; such approaches are usually incomplete. Sev-eral works use replication abstraction to reduce a parameterized system to finite state [80,110,111]. These involve abstracting global states by tracking if there are zero, exactly one, or some multi-plicity of processes in each local state. O f these three works, only Pong and Dubois [111] verify a (nontrivial) memory model. A n interesting aspect of their work is that verification is restricted to parallel programs that have the property data race free 1 [5], rather than all possible programs. This is achieved by having automata (one per processor) restrict the sequence of issued memory events to be data race free 1. The memory model release consistency is verified by augmenting data 5.5. Other Related Work 136 copies with certain tags; verification checks that these tags are always consistent with protocol state semantics. Predicate abstraction has also been successfully applied to P M C , for example in Das et al.'s "experiences" [39]. Regular model checking [21] is a compelling approach to P M C , wherein state sets and the transition relation of the parameterized system are represented by finite automata. Standard fix point algorithms are not guaranteed to converge for this representation, hence more sophisticated techniques must be employed, such as widening [37]. Several papers have employed decidable logics to develop algorithms for P M C . Baukus et al. [14] use the Weak Second Order Theory of One Successor, while Fribourg and Olsen [58] and Maidl [92] employ Presberger Arithmetic. 5 .5 Other Related Work Issues surrounding the interplay between memory model and the compiler, hardware design, pro-grammability, etc. are subtle and have received significant attention. For a general survey we refer the reader to the tutorial by Adve and Gharachorloo [4]. Several researchers in the multiprocessor community have looked at the problem of dynamic verification of memory model conformance. The idea here is to augment the multiprocessor mem-ory system hardware with checker hardware that detects violations of the memory model. Two papers [25,98] detect violations of S C arising from fabrication faults, transient faults, and design bugs, while another paper [64] detects violations of S C on a release consistent system arising from data races in the parallel code. S C can be generalized to pertain to arbitrary concurrent objects (i.e. not just memories) being accessed by multiple clients. Another correctness condition for concurrent objects is linearizability, which was introduced by Herlihy and Wing [75]. When applied to shared memories, linearizability is stronger than S C but weaker than seriality. Unlike S C , linearizability is shown to be local, which means that a behavior is linearizable if and only if the behavior projected onto each individual object is linearizable. This is of course a desirable trait from a verification standpoint. For the case of shared memories, locality means that linearizability can be check on a per-address basis. From a computability perspective, linearizability is easier to handle than S C ; Alur et al. [8] have shown linearizability to be decidable in exponential space. Chapter 6 Conclusions and Future Work This thesis has looked at two different goals related to formal verification of multiprocessor shared memory protocols, namely memory model verification and parameterized verification, with empha-sis on model checking-based techniques. Chapter 2 defined a subset of the memory model sequential consistency (SC), called decisive sequential consistency (DSC), that disallows read events to inherit values from writes that occur in their temporal futures. D S C can also be characterized as those S C traces that have serial reorderings that are also serial reorderings when restricted to any prefix of the trace. By colouring a prefix of a D S C trace black and the corresponding suffix white, and observing the number of black stripes in the reordering, we obtain a metric we called the shuffle degree. A trace is deemed DSCfc if it has a DSC-reordering such that the shuffle degree never exceeds k over all prefixes. The chapter showed that checking D S C or DSCfc for each k > 2 of a single trace is NP-complete. Also, the model checking problem for DSCfc was shown to be decidable in E X P S P A C E , while the problem for full D S C is PSPACE-hard; the decidability of the latter problem was left open. We also demonstrated that checking S C of our prefix-closed protocols is undecidable, refining a previous result of Alur et al. [8]. In support of the broadness of D S C , we argued that Lazy Caching, which is a well-known S C protocol that requires complex reorderings to witness, is DSCfc for some k. Chapter 3 tackled parameterized model checking (PMC) of S C . We presented an approach that uses an automatically generated abstraction to verify simple SC (SCC) of a family of protocols parameterized by the number of addresses and the number of data values per address. The number of processors is left fixed, however the number of addresses in the abstraction is dependent on 137 6.1. Decidability of DSC 138 the number of processors. We defined a logic for describing protocols that supports the automatic generation of the abstraction. The abstraction always has the property that if it is S S C , then so too is the whole parameterized family. The approach was successfully applied to two interesting protocols. Finally, we contrasted our abstraction with a slightly different abstraction used by other authors, and showed how one might employ noninterference lemmas if the abstraction is too coarse. Our final contribution was Chapter 4, where we looked at parameterization across the processor dimension. We verify properties that can be formulized as the unreachability of a set of error states. Since the technique is not specific to shared memory protocols, we refer to the components by the more general term processes. We define a class of systems called nicely sliceable well-structured transition systems (NSWs), which are a subclass of the well-studied well-structured transition sys-tems (WSTSs). We showed that N S W s include petri nets and broadcast protocols (BP), which can model certain compositions of an arbitrary number of processes. B P are especially apt for modeling simple memory protocols. Roughly, our algorithm analyzes the system restricted to 1 process, then 2 processes, then 3, etc., until either a bug is found or a certain convergence condition is reached. Since each of these truncated systems is finite state, we can employ BDD-based symbolic model checking. We argued that when the constituent processes have large local state, our method can out-perform the classical W S T S algorithm. This is confirmed by several experiments. We also defined a transformation that soundly reduces a system with conjunctive guards into a BP. The efficacy of our algorithm as along with the conjunctive guard reduction are demonstrated by successful verification of German's protocol with data paths. The rest of this chapter presents several open questions arising from the work of this thesis, and, to various degrees, offers promising directions for their solution. Note that we designate statements as conjectures liberally; the conjectures we write in this chapter discuss notions that are at best defined only informally. Therefore, they are to be understood to have the implicit prefix "There is some way to formalize all this stuff such that 6.1 Decidability of DSC A s mentioned at the beginning of Sect. 2.6, the decidability of model checking D S C is an open problem. O f course, we have demonstrated its PSPACE-hardness, so resolving this question is of 6.1. Decidability of DSC 139 theoretical interest only; even if it is decidable, the procedure will clearly be far from practical. A s asserted by Theorem 11 on page 58, requiring prefix-closure of protocols leaves S C un-decidable. The proof, however, exploits the ability of an S C protocol to "change its mind" about reorderings, which is disallowed by D S C . Hence there is no obvious means of adapting the proof of Theorem 11 to handle D S C . In an earlier paper of the author et al. [18], we conjectured that one could associate with any state of a D S C protocol a finite set of V W s that serve to summarize all traces that pass through the state. This would imply that every D S C protocol is D S C ^ for some k. Assuming that the bound k was computable, this would imply decidability of D S C . Here we take a different approach, and suggest attempting to prove that an important subclass of D S C protocols are D S C f c . As observed by Condon and H u [36], real protocol descriptions involve a finite number L of storage locations that are variables having the type of data values. These storage locations are typically fields in cache entries, main memory, queue slots, or network messages. Data values are moved around the protocol by copying between storage locations. Let us call a protocol or trace k-inheritance bounded if at any point in time at most k write events occurring in the past can be inherited by read events occurring in the future. 2' 3 Then clearly protocols with L storage locations are .L-inheritance bounded. The following theorem relates the inheritance bound to the D S C bound for a very simple class of protocols. Theorem 23. Let V be a L-inheritance bounded DSC protocol involving 2 processors and 1 ad-dress. Then V is DSCQ{L)-Proof. (Sketch) Let pi and p2 be the two processors, let r be a trace of V, let ir be a DSC-reordering of r , let ^ € N | T | , and let c( be as in Def. 3. The top part of Fig. 6.1 depicts the effect ofthe colouring Q on rn. Without loss of generality, one can prove that the rightmost black event of p\ must occur in the leftmost black stripe, while the rightmost black event of p2 must be the rightmost event of 'We emphasize that DSC is PSPACE-hard in the size ofthe protocol encoded as an automaton, which is already huge. So, in contrast to other PSPACE-hard problems which might have interesting yet small instances (for example, QBF), it is unlikely that any algorithm would be useful for any interesting examples. 2We are being a little sloppy here, since the inheritance relation is defined relative to a DSC-reordering (see page 11). What we really mean is that there exists a DSC-reordering TT such that the inheritance relation induced by n is fc-inheritance bounded. 3Condon and Hu [36] employ this property in their argument that certain protocols have node bandwidth bounded (constraint) graphs. 6.1. Decidability of DSC 140 Figure 6.1: The stripe rearrangement described in the proof of Theorem 23 the rightmost black stripe. In Fig. 6.1, e\ and e 2 respectively indicate the rightmost black events of processors p\ and p 2 - It follows that all black (resp. white) stripes except the leftmost (resp. rightmost) consist entirely of events of p 2 (resp. p\). Since V is L-inheritance bounded, TW has at most L black writes that are inheritted by white reads. Let w and w' be consecutive black writes that are inheritted by white reads, and let w" be the the first black write right of w (w" is not necessarily distinct from w'). Fig. 6.1 depicts w, w' and w". It can be shown that if all white stripes between w and w' are merged into a single white stripe, and this stripe is placed immediately prior to w", the result is still a DSC-reordering. The bottom trace of Fig. 6.1 is an example of how this is done; the arrows show how stripes are shuffled and the dotted lines mark specific events . By iterating this stripe rearrangement we can reduce the number of black stripes, and therefore the shuffle degree, to be at most (approximately) L. We have sketched how the shuffle degree of (r, TT, £) can be reduced by using a new reordering TT'. The DSC-bound is the maximum shuffle degree over all i € N | T | . One can show that for any i, the shuffle degree of (r, TT', i) is not greater than (r, TT, i). Thus we can iterate our "reordering reordering" for all positions i that have shuffle degrees that are too high, yielding a final reordering with DSC-bound approximately equal to L. • We believe that Theorem 23 can be easily generalized to an arbitrary number of processors. However, generalization to an arbitrary number of addresses will require a different proof technique, and probably require more assumptions. To illustrate the difficulty, consider the following trace. (W,P2,x, 2) [(W,p2,y,2)(R,P2,x,2)(W,p2,x, 2)(R,p2,y, 2)}n (R,Pux,2) [{W,Pl,x, l)(W,Pl,y, l)]n (R,Pl,x,2) For any n > 1, the trace (6.1) can be shown to be D S C 2 n and not D S C 2 n _ i . However, with respect 6.2. Hardness of DSCk 141 to any DSC-reordering, (6.1) is a constant 3-inheritance bounded. The proof sketch of Theorem 23 argued that for single address traces, the inheritance bound and the DSC-bound (roughly) agree. The trace (6.1) demonstrates that this does not generalize for 2 or more addresses. However, it is possible that invoking data independence along with a pumping type argument, one could prove the following. Conjecture 2. If a protocol is DSC, data independent, and L-inheritance bounded, then it is DSC0fLy 6.2 Hardness of DSC ; In Sect. 2.5 we showed that for any fixed k > 1, checking if a protocol is DSCfc can be decided in exponential space. We have not explicitly provided any complexity theoretic lower bound for this problem. However, we note that since given any single trace r , one can construct a protocol with trace set being precisely r and its prefixes, a corollary of Theorem 5 is that for any k > 2, model checking DSCfc is NP-hard. Here we suggest how our reduction of Sect. 2.6 (used to prove the PSPACE-hardness of full D S C ) might be adapted to yield tighter lower bounds for DSCfc. A caveat: the following is very "hand wavy". Recall that our reduction of Sect. 2.6 handles 3 Q B F formulae of the form (2.5), repeated here for convenience. V x „ 3 y „ • • • V x i 3 y i : / We believe that our reduction can be adapted to handle the more general form wherein the first quantifier may be either V or 3, and there can be an arbitrary number of variables at each level of quantification (we still require that / is a 3 C N F formula). Let us call such a formula a generalized 3QBF (G3QBF) formula. 4 Hence, let us suppose that the reduction of Sect. 2.6 can be generalized to map any G 3 Q B F formula ip to a protocol 7-^ such that the notion of intended trace (see Def. f 6) analogously gen-eralizes; i.e. Vif, always has a trace it^ , such that Theorem 9 (which states that if i t v is D S C then evalq(yj) = T ) is preserved. Conversely, we envision that Theorem 10, which essentially states that 4 Our notion of a G3QBF formula, in fact, coincides with the typical definition of a 3QBF formula; the terminology is simply meant to emphasize that we are generalizing the restricted form considered in Sect. 2.6 6.2. Hardness of DSC\ 142 evalq(</>) = T implies that is D S C , can be strengthened as follows, where q(ip) is the number of quantifier alternations in (p. Conjecture 3. There exists some linearly bounded function f : N —» N such that for any G3QBF formula <p we have evalq(<£>) = T implies £ DSCf^^y Assuming Conjecture 3, we find that given any G 3 Q B F formula ip, we may construct a protocol V(p such that • if Vtp £ DSCf^foY), then it^ £ D S C and hence by (the alleged generalization of) Theorem 9 we have evalq(y?) = T . • if evalq(y?) = T then Vv £ DSCf{g{(p)) In a mild abuse, let us define f~l by f~l{k) = max({n | f(n) < k}), and let / m i n be the minimum value of / . We could therefore conclude that, for each k > fm-m, the problem of model checking DSCfc is hard for the f~l(k)th level of the polynomial time hierarchy [1,47]. Analogously to our reduction for 3 Q B F in Sect. 2.6, the reduction we are proposing would use G 3 Q B F restricted to I quantifiers, which is complete for the £th level of the polynomial time hierarchy [47]. For the remainder of this section, we marshal evidence to support the feasibility of this reduction. To persuade the reader of Conjecture 3, we refer him or her to the proof of Theorem 10 on page 51, in particular the reordering (2.15). Fundamentally, (2.15) prescribes how any trace a of Vv is reordered; the underlined events are "older" events, which have a D S C reordering thanks to the inductive hypothesis of the proof, while the non-underlined events are the new events that are being shuffled into the reordering of the old. A key observation is that, if we let u be the length of the prefix of o constituting the underlined events, then the shuffle degree (see Def. 3) of (cr, TT, U) can easily be read off of (2.15): it is precisely the number of contiguous underlined subtraces, which is 1 + 2(n — k). Since k > 1, this shuffle degree is at most 2n — 1. Note that the number of alternations in the 3 Q B F formula being considered in the proof of Theorem 10 is 2n. Therefore, at least at the old/new interfaces of (2.15), the shuffle degree is less than the quantifier alternation. There are two obvious outstanding issues hindering our furtherance of this proposal. First, we haven't considered all the other interfaces obtained by underlining TT' and some nonempty prefix of a", and observing the number of underlined stripes induced in (2.15). In fact this number is 6.3. Universal DSC 143 not even well-defined, since in the proof of Theorem 10 we allow the traces CLSo and CLS(z)i to arbitrarily order their constituent atomicity constructs. Clearly, if the DSC-bound of the reordering is to be curtailed, this ambiguity must be resolved. Likely, these traces must maintain the relative order of their atomicity constructs in CLS. Other components of (2.15) will need to be considered, and possibly reordered in a more "DSC-bound friendly" manner. Second, we have not even defined how one reduces a G 3 Q B F formula to a protocol, and once defined, the DSC-bound must also be shown to hold for this extended reduction. We believe that the reduction can be generalized, and the DSC-bound is likely preserved, modulo an additive or multiplicative constant. A key insight into how such a generalized reduction might work stems from a feature of the current reduction. Note that for formulas of the form (2.5), a pair of variables Xi and yi "share" a heartbeat variable and all the surrounding widgets. These heartbeat variables allow for the unsatisfied clause widgets to have their reads satisfied, are responsible for coordinating the nested structure of the reorderings, and are responsible for the shuffling discussed above (one heartbeat variable contributes 2 to the shuffle degree). In the generalized reduction, it is probable that two entire groups of variables bound by consecutive universal and existential quantifiers can also share the same heartbeat address. Hopefully this can be arranged so that the additional variables at each level of quantification do not substantially increase the DSC-bound, and any increase is independent of the number of variables (which is unbounded). 6.3 Universal DSC A primary result of this thesis is that model checking S C for our prefix-closed protocols is undecid-able, and restricting attention to D S C does not appear amenable to (practical) algorithmic solution. Further, assuming that the hardness results hypothesized in Sect. 6.2 hold water, even considering the bounded DSCfc will be of little benefit. If we want to model check an interesting subset of S C then, we must adopt further real-world assumptions. One such assumption, formalized in Sezgin's work [117], is that of universality. A n artifact of modeling protocols as general automata involving memory events is that we can define protocols that force events to happen with certain values. O f course, as observed by Sezgin, real protocols are slaves to the processors; if at some point in time a processor can write some value to an address, then it should be allowed to write any value to that address. Also, at any time there should be some computation path that allows a processor to read or 6.4. Extending/Improving Chapter 3 144 write any address. One way this property could be defined for our automata-based protocols is as follows. Definition 54 (Strong Universality). A protocol has strong universality if for any (reachable?) protocol state s, any processor p, and any address a, we have that for any data value d (resp. for some data value d), there exists a path starting from s such that the first memory event on the path is (W, p, a, d) (resp. (R, p, d, a)). Our experience with protocol descriptions suggests that Def. 54 might in fact be too strong. For example, in the Token Coherence protocol [93] when a processor has been granted a so-called persistent request, it will always perform at least one memory event to that address once it receives sufficient tokens. Hence, once the arbitration mechanism determines that a processor p is the "win-ner" for such a request, no other processor can perform a memory event to the address until after p does so. This suggests the following weaker notion of universality. Definition 55 (Weak Universality). A protocol has weak universality if for any (reachable?) pro-tocol state s, any processor p, and any address a, we have that for any data value d (resp. for some data value d), there exists a path starting from s such that (W, p, a, d) (resp. (R, p, a, d)) eventually occurs on the path, and furthermore this is the first event by processor p on the path. Pinning down the "right" notion of universality, and exploring how this property can be both proved and exploited to assist in memory model verification could be an interesting and useful direction of research. 6 .4 Extending/Improving Chapter 3 In Chapter 3 we presented a technique to do parameterized verification of a property called S S C , the parameters being addresses and data values. Aside from that fact that the number of processors is left fixed, we identify two weaknesses with this technique. • Recall that our abstraction Q requires n concrete addresses, plus 1 abstracted address, where n is the number of processors. Hence the approach scales miserably with processors; adding a processor entails adding an address. Since most protocols have caches, which are modelled as two dimensional arrays indexed by processors and addresses, this has a dramatic impact 6.4. Extending/Improving Chapter 3 145 on the size of the state space. Ideally, the number of addresses in the abstraction would be a small constant, independent of the number of processors. • S S C is quite a restricted version of S C ; we would like to be able to handle protocols that are S C but not S S C , such as Lazy Caching. Here we present the seed of an idea that, with some minor assistance from the user, could potentially attend to both of these concerns. Our idea handles the second weakness above, but with respect to only value-parameterized families. It is quite plausible that A V P P F s can also be handled, though here we do not make this argument. The method only involves observation of two addresses, regard-less of the number of processors, therefore if it can be applied to A V P P F s , it will probably handle the first weakness also. One way to characterize S C is as follows: a trace is S C if there exists a total order on the writes (that agrees with processor order) such that all processors observe (via their read events) this write order. Any S C protocol likely has a mechanism through which this intended write order is made explicit. If two write events of such a protocol are nondeterministically selected to have distinguished data values, it is possible that the description could be (manually) augmented so that a flag is set to indicate which of the two events should be ordered first. Presumably this augmentation, which we will call the write order mechanism, would involve non-interfering code that checks which of the two distinguished data values gets ordered first as they propagate through the protocol. Assuming data independence, we may distinguish the two write events by considering the fam-ily member with the three data values {1,2,3}, and restricting the protocol so that at most one event writes value 2, and at most one event writes value 3. Code to perform this restriction can easily and automatically be inserted into the description. The write order mechanism is responsible for observ-ing the protocol, and updating a fresh variable order. This variable has initial value U (meaning unknown), and is updated to 23 (resp. 32) once it is determined that the write with value 2 (resp. 3) should be reordered prior to the write with value 3 (resp. 2) The write order mechanism is expected to have the following five properties, which we believe can be all be model checked; furthermore processor and address symmetry can likely be exploited to reduce the complexity of these checks. Transitivity. For any three write events w\, w2, and w3 occurring in a run, if the write order mech-6.4. Extending/Improving Chapter 3 146 anism would order w\ prior to w2, and w2 prior to 103, then it must order w\ prior to 1113. Eventual order judgment. Any run in which both values 2 and 3 are written can be extended into a run where order ^ U; and this extension involves no memory events. Respectfulness of processor order. If the writes with values 2 and 3 are performed by the same processor, then the write order mechanism updates order according to the temporal order in which writes appear. Read order agreement. Let a2 and 03 respectively be the addresses that the data values 2 and 3 are written to. If a2 ^ 03 then along any run where eventually order = 23 (resp. 32), no processor may read 3 from as (resp. read 2 from a2) and then later read 1 from a2 (resp. read 1 from 03). Otherwise (i.e. a2 = 03) along any run where eventually order = 23 (resp. 32), no processor may read 3 (resp. 2) from a 3 and then later read 2 (resp. 3) Order judgments are irrevocable. Once order ^ U, order must remain fixed forever. For illustration, we return to our example of Lazy Caching. Referring to Fig. 2.3 on page 19, a write order mechanism satisfying all of the above can be realized by appending the following to the action for the event MemoryWrite^ (a, d): if d E {2,3} A order = U then order := (if d = 2 then 23 else 32) ; endif The following expresses our anticipation that these properties are sufficient to conclude S C . Conjecture 4. If a data independent value-parameterized protocol family restricted to 3 data values has a write order mechanism with the above five properties, then the family is SC. A s demonstrated by the fact that a write order mechanism can be used to prove Lazy Caching S C , the approach can work for non-simple S C protocols. Thus, assuming the details can be suc-cessfully fleshed out, we have addressed our second concern regarding Chapter 3. Furthermore, noting that the approach only requires observation of two distinct addresses, if the approach can be shown to be compatible with our address abstraction then the first concern is addressed. In other words, it is our hope that the proposed approach of this section would enable one to perform address 6.5. Future Directions for Chapter 4 147 parameterized verification of S C by model checking on an abstract protocol with 2 concrete and 1 abstract addresses, independent of the number of processors. Whether this can be done is unclear. 6.5 Future Directions for Chapter 4 For our work of Chapter 4, there are several obvious directions for further research. First, the current implementation is fairly naive. We believe more sophisticated symbolic model checking techniques might produce better results. We also require a thorough theoretical and empirical study of the behavior of our "lifting" operator on B D D s ; a naive upper bound on the size of the B D D (4.19) on page 120 is |r,_i | \ where |rj_i | is the size of the B D D for Ti-\. Clearly, this bound does not yield good publicity for our approach. Other directions include finding additional N S W applications, and finding ways to apply our method either semi-algorithmically or incompletely to systems that are not NSW. For example, in Sect. 4.4 we developed our so-called conjunctive guard reduction, which soundly eliminated a system trait that precluded classification as NSW. Another common trait in compositions of pro-cesses is having each process with one or more "pointers" to other processes. For example, the F L A S H protocol [84], which has been used as an example in several papers on parameterized ver-ification [28,96,105], has such state, as does the WIS protocol used in Sect. 3.6. Formally, these pointers are variables of type P —> P, where P is the type of processes. Unlike German's protocol, which has a single global process pointer, the process pointers of F L A S H cannot be emulated by a variable of type P —> B and encoded in the finite process state. A sound reduction for state variables of the form P —> P that allows our N S W approach of Chapter 4 to handle protocols such as F L A S H would be a valuable contribution. Furthermore, state variables of type Px P —>M also have a place in industrial protocols. Bibliography [1] S. Aaronson. The complexity zoo website, http://www.complexityzoo.com, 2005. [2] P. A . Abdulla, K . Cerans, B . Jonsson, and T. Yih-Kuen. General decidability theorems for infinite-state systems. In 11th IEEE Symposium on Logic in Computer Science (LICS), pages 313-321, 1996. [3] P. A . Abdulla and B . Jonsson. On the existence of network invariants for verifying parame-terized systems. In Correct System Design - Recent Insights and Advances, LNCS, volume 1710, 1999. [4] S. V. Adve and K . Gharachorloo. Shared memory consistency models: a tutorial. IEEE Computer, 29(12):66-76, 1996. [5] S. V. Adve and M . D . Hi l l . A unified formalization of four shared-memory models. IEEE Transactions on Parallel and Distributed Systems, 4(8):613-624, August 1993. Tech Report #1051, Univ. of Wisconsin. [6] Y. Afek, G Brown, and M . Merritt. Lazy caching. ACM Transactions on Programming Languages and Systems, 15(1): 182-205, 1993. [7] H . Akhiani, D . Doligez, P. Harter, L . Lamport, M . Tuttle, and Y. Yu. T L A + verification of cache-coherence protocols. unpublished, available at http://research.microsoft.eom/users/lamport/pubs/pubs.html#fm99, 1999. [8] R. Alur, K . L . McMi l lan , and D . Peled. Model-checking of correctness conditions for concur-rent objects. In 11th IEEE Symposium on Logic in Computer Science (LICS), 1996. Journal version is [9]. [9] R. Alur, K . L . McMil lan , and D . Peled. Model-checking of correctness conditions for con-current objects. Information and Computation, 160(1-2): 167-188, 2000. [10] K . Apt and D . Kozen. Limits for automatic verification of finite-state concurrent systems. Information Processing Letters, 15:307-309, 1986. [11] T. Arons. Using timestamping and history variables to verify sequential consistency. In 13th International Conference on Computer Aided Verification (CAV), pages 423^4-25, 2001. 148 Bibliography 149 [12] T. Arons, A . Pnueli, S. Ruah, J. X u , and L . Zuck. Parameterized verification with automat-ically computed inductive assertions. In 13th International Conference on Computer Aided Verification (CAV), pages 221-234, 2001. [13] L . A . Barroso, K . Gharachorloo, R. McNamara, A . Nowatzyk, S. Qadeer, B . Sano, S. Smith, R. Stets, and B . Verghese. Piranha: a scalable architecture based on single-chip multipro-cessing. In 27th Annual International Symposium on Computer Architecture (ISCA), pages 282-293, 2000. [14] K . Baukus, Y. Lakhnech, and K . Stahl. Verification of Parameterized Protocols. Journal of Universal Computer Science, 7(2): 141-158, Feb 2001. [15] M . Ben-Ari . Principles of Concurrent Programming. Prentice/Hall, 1982. [16] E . E . Bilir, R. M . Dickson, Y. Hu , M . Plakal, D . J. Sorin, M . D . Hi l l , and D . A . Wood. Multicast snooping: a new coherence method using a multicast address network. In 26th Annual International Symposium on Computer Architecture (ISCA), pages 294-304, 1999. [17] J. Bingham. A new approach to upward closed set backward reachability analysis. In 6th International Workshop on Verification of Infinite-State Systems (INFINITY), 2004. Extended version: U B C Dept. of Computer Science Tech. Report TR-2004-07. [18] J. Bingham, A . Condon, and A . J. Hu. Toward a decidable notion of sequential consistency. In 15th Annual Symposium on Parallel Algorithms and Architectures (SPAA), pages 304-313, June 2003. [19] J. Bingham, A . Condon, A . J. H u , S. Qadeer, and Z . Zhang. Automatic verification of sequen-tial consistency for unbounded addresses and data values. In 16th International Conference on Computer Aided Verification (CAV), pages 427^139, 2004. [20] J. Bingham and A . J. Hu. Empirically efficient verification for a class of infinite-state systems. In 11th International Conference on Tools and Algorithms for Construction and Analysis of Systems (TACAS), pages 77-92, 2005. Extended version: U B C Dept. of Computer Science Tech. Report TR-2005-07. [21] A . Bouajjani, B . Jonsson, M . Nilsson, and T. Touili. Regular model checking. In 12th International Conference on Computer Aided Verification (CAV), 2000. [22] T. Braun, A . Condon, A . J. Hu , K . S. Juse, M . Laza, M . Leslie, and R. Sharma. Proving sequential consistency by model checking. In IEEE International High Level Design Valida-tion and Test Workshop (HLDVT), 2001. Extended version: U B C Dept. of Computer Science Tech. Report TR-2001-03. [23] R. E . Bryant. Graph-based algorithms for boolean function manipulation. IEEE Transactions on Computers, C-35(8):677-691, August 1986. Bibliography 150 [24] J. R. Burch, E . M . Clarke, K . L . McMil lan , D . L . Di l l , and L . J. Hwang. Symbolic model checking: 1 0 2 0 states and beyond. Information and Computation, 98(2), 1992. [25] H . W. Cain and M . H . Lipasti. Verifying sequential consistency using vector clocks. In 14th Annual Symposium on Parallel Algorithms and Architectures (SPAA), 2002. [26] J. F. Cantin, M . H . Lipasti, and J. E . Smith. The complexity of verifying memory coherence. In 15th Annual Symposium on Parallel Algorithms and Architectures (SPAA), June 2003. [27] R Chatterjee and G . Gopalakrishnan. A specification and verification framework to design weak shared memory consistency protocols. In 4th International Conference on Formal Methods in Computer-Aided Design (FMCAD), 2002. [28] C T . Chou, R K . Mannava, and S. Park. A simple method for parameterized verification of cache coherence protocols. In 5th International Conference on Formal Methods in Computer-Aided Design (FMCAD), 2004. [29] E . M . Clarke, O. Grumberg, and M . Browne. Reasoning about networks with many identical finite state processes. In 5th ACM Symposium on Principles of Distributed Computing, pages 240-248, 1986. [30] E . M . Clarke, O. Grumberg, H . Hiraishi, S. Jha, D . E . Long, K . L . McMil lan , and L . A . Ness. Verification of the Futurebus+ cache coherence protocol. In 11th International Symposium on Computer Hardware Description Languages and their Applications, 1993. [31] E . M . Clarke, O. Grumberg, and S. Jha. Verifying parameterized networks. ACM Transac-tions on Programming Languages and Systems, 19(5):726-750, 1997. [32] W. W. Collier. Multiprocessor diagnostics website, http://www.mpdiag.com/. [33] W. W. Collier. Reasoning About Parallel Architectures. Prentice-Hall, Englewood Cliffs, NJ , 1992. [34] A . Condon, M . Hi l l , M . Plakal, and D . Sorin. Using lamport clocks to reason about relaxed memory models. In 5th International Symposium On High Performance Computer Architec-ture (HP C A), 1999. [35] A . Condon and A . J. Hu. Automatable verification of sequential consistency. In 13th Annual Symposium on Parallel Algorithms and Architectures (SPAA), pages 113-121, July 2001. [36] A . Condon and A . J. Hu. Automatable verification of sequential consistency. Theory of Computing Systems, 36(5) :431^460, 2003. Originally appeared as [35]. [37] P. Cousot and R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In 4th Annual ACM S1GPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), pages 238-252, 1977. Bibliography 151 [38] D . E . Culler, J. P. Singh, and A . Gupta. Parallel Computer Architecture: A Hard-ware/Software Approach. Morgan Kaufmann, 1998. [39] S. Das, D . L . Di l l , and S. Park. Experience with predicate abstraction. In 11th International Conference on Computer Aided Verification (CAV), 1999. [40] G . Delzanno. Automatic verification of parameterized cache coherence protocols. In 12th International Conference on Computer Aided Verification (CAV), July 2000. [41] G . Delzanno, J. Esparza, and A . Podelski. Constraint-based analysis of broadcast protocols. In Annual Conference of the European Association for Computer Science Logic, pages 50-66, 1999. [42] G . Delzanno and J. F. Raskin. Symbolic representation of upward-closed sets. In 6th Interna-tional Conference Tools and Algorithms for Construction and Analysis of Systems (TACAS), pages 426-440, 2000. [43] G . Delzanno, J. F. Raskin, and L . Van Begin. Attacking symbolic state explosion. In 13th International Conference on Computer Aided Verification (CAV), pages 298-310, 2001. [44] L . E . Dickson. Finiteness of the odd perfect and primitive abundant numbers with r distinct prime factors. American Journal of Mathematics, 35:413-422, 1913. [45] D . Di l l , S. Park, and A . Nowatzyk. Formal specification of abstract memory models. In Symposium on Research on Integrated Systems, pages 38—52, 1993. [46] D . L . Di l l , A . J. Drexler, A . J. Hu , and C . H . Yang. Protocol verification as a hardware design aid. In IEEE International Conference on Computer Design: VLSI in Computers and Processors, pages 522-525, 1992. [47] D . - Z . D u and K . Ko . Theory of Computational Complexity. John Wiley and Sons, 2000. [48] A . Th . Eiriksson and K . L . McMil lan. Using formal verification/analysis methods on the critical path in system design: A case study. In 7th International Conference on Computer Aided Verification (CAV), pages 367-380, 1995. [49] E . A . Emerson and V. Kahlon. Reducing model checking of the many to the few. In 17th International Conference on Automated Deduction (CADE), pages 236-254, 2000. [50] E . A . Emerson and V. Kahlon. Exact and efficient verification of parameterized cache coher-ence protocols. In Correct Hardware Design and Verification Methods (CHARME), 2003. [51] E . A . Emerson and V. Kahlon. Model checking guarded protocols. In 18th IEEE Symposium on Logic in Computer Science (LICS), pages 361-370, June 2003. [52] E . A . Emerson and V. Kahlon. Rapid parameterized model checking of snoopy cache proto-cols. In 9th International Conference on Tools and Algorithms for Construction and Analysis of Systems (TACAS), pages 144-159, 2003. Bibliography 152 [53] E . A . Emerson and K . S. Namjoshi. On model checking for non-deterministic infinite-state systems. In 13th IEEE Symposium on Logic in Computer Science (LICS), pages 70-80, 1998. [54] J. Esparza. Decidability and complexity of petri net problems - an introduction. In Lectures on Petri Nets I: Basic Models. Advances in Petri Nets, pages 374-428, 1998. [55] J. Esparza, A . Finkel, and R. Mayr. On the verification of broadcast protocols. In 14th IEEE Symposium on Logic in Computer Science (LICS), pages 352-359, 1999. [56] A . Finkel. Reduction and covering of infinite reachability trees. Information and Computa-tion, 89(2): 144-179, f990. [57] A . Finkel and Ph. Schnoebelen. Well structured transition systems everywhere! Theoretical Computer Science, 256(l-2):63-92, 2001. [58] L . Fribourg and H . Olsen. Proving safety properties of infinite state systems by compilation into presburger arithmetic. In 8th International Conference on Concurrency Theory (CON-CUR), pages 213-227, 1997. [59] P. Ganty and L . Van Begin. Nondeterministic automata for the efficient verification of infinite-state. In CP+CV Workshop at European Joint Conferences on Theory and Practice of Soft-ware (ETAPS), 2004. [60] D . Geer. Chip makers turn to multicore processors. IEEE Computer, 38(5): 11-13, 2005. [61] G . Geeraerts, J.-F. Raskin, and L . Van Begin. Expand, enlarge and check: new algorithms for the coverability problem of W S T S . In 24th International Conference on Foundations of Software Technology and Theoretical Computer Science (FSTTCS), pages 287-298, 2004. [62] S. German. Personal correspondence. 2003. [63] S. M . German and A . P. Sistla. Reasoning about systems with many processes. Journal of the ACM, 39(3):675-735, July 1992. [64] K . Gharachorloo and P. B . Gibbons. Detecting violations of sequential consistency. In 3rd Annual Symposium on Parallel Algorithms and Architectures (SPAA), 1991. [65] R. Ghughal and G . Gopalakrishnan. Verification methods for weaker shared memory consis-tency models. In Workshop on Formal Methods for Parallel Programming, pages 985-992, 2000. Workshop affiliated with the 14th International Parallel & Distributed Processing Sym-posium (IPDPS). [66] P. B . Gibbons and E . Korach. Testing shared memories. SIAM Journal of Computing, 26(4): 1208-1244, August 1997. [67] M . Glusman and S. Katz. Extending memory consistency of finite prefixes to infinite compu-tations. In 12th International Conference on Concurrency Theory (CONCUR), pages 411-425, 2001. Bibliography 153 [68] G . Gopalakrishnan. A formalization of test model-checking, completeness results, and case studies. In Workshop on Advances in Verification, 2000. Workshop affiliated with the 12th International Conference on Computer Aided Verification (CAV) . [69] G . Gopalakrishnan, R. Ghughal, R. Hosabettu, A . Mokkedem, and R. Nalumasu. Formal Modeling and Validation Applied to a Commercial Coherent Bus: A Case Study. In Correct Hardware Design and Verification Methods (CHARME), pages 48-62, 1997. [70] G . Gopalakrishnan, Y. Yang, and H . Sivaraj. Q B or not Q B : A n efficient execution verification tool for memory orderings. In 16th International Conference on Computer Aided Verification (CAV), pages 401^113, 2004. [71] S. Graf. Characterization of a sequentially consistent memory and verification of a cache memory by abstraction. Distributed Computing, 12(2 - 3):75-90, 1999. [72] B . Heinemann. Subclasses of self-modifying nets. In Applications and Theory of Petri Nets (Selected Papers from the First and Second European Workshop). Springer, 1982. [73] T. A . Henzinger, P.-H. Ho, and H . Wong-Toi. Hytech: A model checker for hybrid systems. Software Tools for Technology Transfer, 1:110-122, 1997. [74] T. A . Henzinger, S. Qadeer, and S. K . Rajamani. Verifying sequential consistency on shared-memory multiprocessor systems. In 11th International Conference on Computer Aided Veri-fication (CAV), 1999. [75] M . Herlihy and J. Wing. Linearizability: a correctness condition for concurrent objects. ACM Transactions on Programming Languages and Systems, 12(3):463^192, 1990. [76] G . Higman. Ordering by divisibility in abstract algebras. Proceedings of the London Mathe-matical Society (3), 2(7):326-336, 1952. [77] M . D . Hi l l . Multiprocessors should support simple memory-consistency models. IEEE Com-puter, pages 28-34, August 1998. [78] A . J? Hu, M . Fujita, and C . Wilson. Formal verification of the H A L SI system cache co-herence protocol. In International Conference on Computer Design, pages 438-444. I E E E , 1997. [79] C . N . Ip and D . L . Di l l . Better verification through symmetry. In International Conference on Computer Hardware Description Languages, pages 87-100, Apri l 1993. [80] C . N . Ip and D . L . Di l l . Verifying systems with replicated components in murphi. In 8th International Conference on Computer Aided Verification (CAV), 1996. [81] R. M . Karp and R. E . Miller. Parallel program schemata. Journal of Computer and System Sciences, 3:147-195, 1969. Bibliography 154 [82] Y. Kesten, A . Pnueli, E . Shahar, , and L . Zuck. Network invariants in action. In 13th Inter-national Conference on Concurrency Theory (CONCUR), 2002. [83] R. P. Kurshan and K . L . McMil lan . A structural induction theorem for processes. Information and Computation, 117(1), February 1995. [84] J. Kuskin, D . Ofelt, M . Heinrich, J. Heinlein, R. Simoni, K . Gharachorloo, J. Chapin, D . Nakahira, J. Baxter, M . Horowitz, A . Gupta, M . Rosenblum, and J. Hennessy. The S t a n f o r d F L A S H multiprocessor. In 21st Annual International Symposium on Computer Architecture (ISCA), pages 302-313, 1994. [85] P. Ladkin, L . Lamport, B . Olivier, and D . Roegel. Lazy caching in T L A . Distributed Com-puting, 12(2 - 3): 151-174, 1999. [86] S. K . Lahiri and R. E . Bryant. Constructing quantified invariants via predicate abstraction. In 5th International Conference on Verification, Model Checking and Abstract Interpretation (VMCAI), pages 267-281, 2004. [87] L . Lamport. Time, clocks, and the ordering of events in a distributed system. Communica-tions ofthe ACM, 21(7):558-565, July 1978. [88] L . Lamport. How to make a multiprocessor computer that correctly executes multiprocess programs. IEEE Transactions on Computers, C-28(9):690-691, September 1979. [89] L . Lamport. Specifying Systems: The TLA + Language and Tools for Hardware and Software Engineers. Addision-Wesley, 2002. [90] L . Lamport, J. Matthews, M . Tuttle, and Y. Yu. Specifying and verifying systems with T L A + . In Proceedings ofthe Tenth ACM SIGOPS European Workshop, pages 45^18, 2002. [91] D . Lesens, N . Halbwachs, and P. Raymond. Automatic verification of parameterized net-works of processes. Theoretical Computer Science, 256:113-144, 2001. [92] M . Maidl . A unifying model checking approach for safety properties of parameterized sys-tems. In 13th International Conference on Computer Aided Verification (CAV), 2001. [93] M . M . K . Martin, M . D . Hi l l , and D . A . Wood. Token coherence: Low-latency coherence on unordered interconnects. In 30th Annual International Symposium on Computer Architecture (ISCA), pages 182 - 193, June 2003. [94] K . L . McMil lan . Symbolic model checking - an approach to the state explosion problem. PhD thesis, Carnegie Mellon University, 1992. [95] K . L . McMil lan . Verification of infinite state systems by compositional model checking. In Correct Hardware Design and Verification Methods (CHARME), pages 219-234, 1999. Bibliography 155 [96] K . L . McMil lan . Parameterized verification of the F L A S H cache coherence protocol by compositional model checking. In Correct Hardware Design and Verification Methods (CHARME), pages 179-195, 2001. [97] K . L . McMi l lan and J. Schwalbe. Formal verification of the Gigamax cache consistency protocol. In International Symposium on Shared Memory Multiprocessing, pages 242-251. Information Processing Society of Japan, 1991. [98] A . Meixner and D . J. Sorin. Dynamic verification of sequential consistency. In 32nd Annual International Symposium on Computer Architecture (ISCA), 2005. [99] M . Merritt. Distributed Computing, 12(2-3), 1999. [100] R. Milner. A n algebraic definition of simulation between programs. In 2nd International Joint Conference on Artificial Intelligence, pages 481—489, 1971. [101] M . L . Minsky. Computation: Finite and Infinite Machines. Prentice-Hall Inc., 1967. [102] T. Murata. Petri nets: Properties, analysis and applications. Proceedings of the IEEE, 77(4), Apri l 1989. [103] R. Nalumasu. Formal Design and Verification Methods for Shared Memory Systems. PhD thesis, University of Utah, 1999. [104] R. Nalumasu, R. Ghughal, A . Mokkedem, and G . Gopalakrishnan. The 'test model-checking' approach to the verification of formal memory models of multiprocessors. In 10th Interna-tional Conference on Computer Aided Verification (CAV), pages 464—476, 1998. [105] S. Park and D . Di l l . Verification of the F L A S H cache coherence protocol by aggregation of distributed transactions. In 8th Annual Symposium on Parallel Algorithms and Architectures (SPAA), pages 288-296, June 1996. [106] S. Park and D . Di l l . Verification of cache coherence protocols by aggregation of distributed transactions. Theory of Computing Systems, 31(4):355-376, July 1998. [107] S. Park and D . L . Di l l . A n executable specification and verifier for relaxed memory order. IEEE Transactions on Computers, 48(2):227-235, February 1999. [108] M . Plakal, D . J. Sorin, A . E . Condon, and M . D . Hi l l . Lamport clocks: Verifying a directory cache-coherence protocol. In 10th Annual Symposium on Parallel Algorithms and Architec-tures (SPAA), 1998. [109] A . Pnueli, S. Ruah, and L . Zuck. Automatic deductive verification with invisible invariants. In Proceedings of Tools and Algorithms for the Construction and Analysis of Systems (TACAS), pages 82-97, 2001. Bibliography 156 [110] F. Pong and M . Dubois. A new approach for the verification of cache coherence protocols. IEEE Transactions on Parallel and Distributed Systems, 6(8), August 1995. [111] F. Pong and M . Dubois. Formal automatic verification of cache coherence in multiproces-sors with relaxed memory models. IEEE Transactions on Parallel and Distributed Systems, 11(9):989-1006, September 2000. [112] S. Qadeer. On the verification of memory models of shared-memory multiprocessors. In Workshop on Formal Specification and Verification Methods for Shared Memory Systems, October 2000. Workshop affiliated with 3th International Conference on Formal Methods in Computer-Aided Design ( F M C A D ) . [113] S. Qadeer. Verifying sequential consistency on shared-memory multiprocessors by model checking. Technical report, 2001. Compaq Systems Research Center Report 176, published later as [114]. [114] S. Qadeer. Verifying sequential consistency on shared-memory multiprocessors by model checking. IEEE Transactions on Parallel and Distributed Systems, 14(8):730 - 741, August 2003. [115] S. Qadeer and S. Rajamani. Personal correspondence. 2003. [116] C . E . Scheurich. Access ordering and coherence in shared memory multiprocessors. PhD thesis, University of Southern California, 1989. Tech report C E N G 89-19. [117] A . Sezgin. Formalization and Verification of Shared Memory. PhD thesis, University of Utah, 2004. [118] A . Sezgin and G . Gopalakrishnan. On the decidability of shared memory consistency ver-ification. In 3rd ACM-IEEE International Conference on Formal Methods and Models for Codesign (MEMOCODE), 2005. [119] F. Somenzi. Colorado university decision diagram package ( C U D D ) webpage. http://vlsi.colorado.edu/~fabio/CUDD/cuddIntro.html. [120] D . J. Sorin, M . Plakal, A . E . Condon, M . D . Hi l l , M . M . K . Martin, and D . A . Wood. Spec-ifying and verifying a broadcast and a multicast snooping cache coherence protocol. IEEE Transactions on Parallel and Distributed Systems, 13(6), June 2002. [121] U . Stern and D . L . Di l l . Improved probabilistic verification by hash compaction. In Correct Hardware Design and Verification Methods (CHARME), pages 206-224, 1995. [122] L . Stockmeyer and A . Meyer. Word problems requiring exponential time. In 5th ACM Symposium on Theory of Computing, pages 1-9, 1973. [123] J. E . Stoy, X . Shen, and Arvind. Proofs of correctness of cache-coherence protocols. In Formal Methods Europe (FME), pages 43-71, 2001. Bibliography 157 [124] P. Wolper. Expressing interesting properties of programs in propositional temporal logic. In 13th ACM Symposium on Principles of Programming Languages (POPL), pages 184-192, 1986. [125] P. Wolper and V. Lovinfosse. Verifying properties of large sets of processes with network invariants. In International Workshop on Automatic Verification Methods for Finite State Systems, pages 68-80, 1989. [126] Y. Yang, G . Gopalakrishnan, G . Lindstrom, and K . Slind. Nemos: A framework for axiomatic and executable specifications of memory consistency models. In 18th International Parallel and Distributed Processing Symposium (IPDPS), 2004. [127] Y. Yu, P. Manolios, and L . Lamport. Model checking T L A + specifications. In Correct Hardware Design and Verification Methods (CHARME), pages 54-66, 1999.
Thesis/Dissertation
eng
Computer Science
Vancouver : University of British Columbia Library
For non-commercial purposes only, such as research, private study and education. Additional conditions apply, see Terms of Use https://open.library.ubc.ca/terms_of_use.
Graduate
Model checking sequential consistency and parameterized protocols
Text