17112661
QB or Not QB: An Efficient Execution Verification Tool for Memory Orderings
We study the problem of formally verifying shared memory multiprocessor executions against memory consistency models—an important step during post-silicon verification of multiprocessor machines. We employ our previously reported style of writing formal specifications for shared memory models in higher order logic (HOL), obtaining intuitive as well as modular specifications. Our specification consists of a conjunction of rules that constrain the global visibility order. Given an execution to be checked, our algorithm generates Boolean constraints that capture the conditions under which the execution is legal under the visibility order. We initially took the approach of specializing the memory model HOL axioms into equivalent (for the execution to be checked) quantified boolean formulae (QBF). As this technique proved inefficient, we took the alternative approach of converting the HOL axioms into a program that generates a SAT instance when run on an execution. In effect, the quantifications in our memory model specification were realized as iterations in the program. The generated Boolean constraints are satisfiable if and only if the given execution is legal under the memory model. We evaluate two different approaches to encode the Boolean constraints, and also incremental techniques to generate and solve Boolean constraints. Key results include a demonstration that we can handle executions of realistic lengths for the modern Intel Itanium memory model. Further research into proper selection of Boolean encodings, incremental SAT checking, efficient handling of transitivity, and the generation of unsatisfiable cores for locating errors are expected to make our technique practical.
61052099
Memory-Model-Sensitive Data Race Analysis
We present a “memory-model-sensitive” approach to validating correctness properties for multithreaded programs. Our key insight is that by specifying both the inter-thread memory consistency model and the intra-thread program semantics as constraints, a program verification task can be reduced to an equivalent constraint solving problem, thus allowing an exhaustive examination of all thread interleavings precisely allowed by a given memory model. To demonstrate, this paper formalizes race conditions according to the new Java memory model, for a simplified but non-trivial source language. We then describe the implementation of a memory-model-sensitive race detector using constraint logic programming (CLP). In comparison with conventional program analysis, our approach does not offer the same kind of performance and scalability due to the complexity involved in exact formal reasoning. However, we show that a formal semantics can serve more than documentation purposes — it can be applied as a sound basis for rigorous property checking, upon which more scalable methods can be derived.
1466008
Analyzing the Intel Itanium Memory Ordering Rules Using Logic Programming and SAT
We present a non-operational approach to specifying and analyzing shared memory consistency models. The method uses higher order logic to capture a complete set of ordering constraints on execution traces, in an axiomatic style. A direct encoding of the semantics with a constraint logic programming language provides an interactive and incremental framework for exercising and verifying finite test programs. The framework has also been adapted to generate equivalent boolean satisfiability (SAT) problems. These techniques make a memory model specification executable, a powerful feature lacked in most non-operational methods. As an example, we provide a concise formalization of the Intel Itanium memory model and show how constraint solving and SAT solving can be effectively applied for computer aided analysis. Encouraging initial results demonstrate the scalability for complex industrial designs.
14603294
UMM: an operational memory model specification framework with integrated model checking capability
Given the complicated nature of modern shared memory systems, it is vital to have a systematic approach to specifying and analyzing memory consistency requirements. In this paper, we present the UMM specification framework, which integrates two key features to support memory model verification: (i) it employs a simple and generic memory abstraction that can capture a large collection of memory models as guarded commands with a uniform notation, and (ii) it provides built-in model checking capability to enable formal reasoning about thread behaviors. Using this framework, memory models can be specified in a parameterized style—designers can simply redefine a few bypassing rules and visibility ordering rules to obtain an executable specification of another memory model. We formalize several classical memory models, including Sequential Consistency, Coherence, and PRAM, to illustrate the general techniques of applying this framework. We then provide an alternative specification of the Java memory model, based on a proposal from Manson and Pugh, and demonstrate how to analyze Java thread semantics using model checking. We also compare our operational specification style with axiomatic specification styles and explore a mechanism that converts a memory model definition from one style to the other. Copyright © 2005 John Wiley & Sons, Ltd.
6730244
Nemos: a framework for axiomatic and executable specifications of memory consistency models
Summary form only given. Conforming to the underlying memory consistency rules is a fundamental requirement for implementing shared memory systems and developing multiprocessor programs. In order to promote understanding and enable automated verification, it is highly desirable that a memory model specification be both declarative and executable. We present a specification framework called Nemos (Nonoperational yet Executable Memory Ordering Specifications), which supports precise specification and automatic execution in the same framework. We employ a uniform notation based on predicate logic to define shared memory semantics in an axiomatic as well as compositional style. We also apply constraint logic programming and SAT solving to make the axiomatic specifications executable for memory model analysis. To illustrate our approach, we formalize a collection of classical memory models, including sequential consistency, coherence, PRAM, causal consistency, and processor consistency.
1536411
Specifying Java thread semantics using a uniform memory model
Standardized language level support for threads is one of the most important features of Java. However, defining the Java Memory Model (JMM) has turned out to be a major challenge. Several models produced to date are not as easily comprehensible and comparable as first thought. Given the growing interest in multithreaded Java programming, it is essential to have a sound framework that would allow formal specification and reasoning about the JMM.This paper presents the Uniform Memory Model (UMM), a generic memory model specification framework. Based on guarded commands, UMM can be easily integrated with a model checking utility, providing strong built-in support for formal verification and program analysis. With a flexible and simple architecture, UMM is configurable to capture different memory consistency requirements for both architectural and language level memory models. An alternative formal specification of the JMM, primarily based on the semantics proposed by Manson and Pugh, is implemented in UMM. Systematic analysis has revealed interesting properties of the proposed semantics. Inconsistencies from the original specification have also been uncovered.
15017783
On the Computational Complexity of Sensor Network Localization
Determining the positions of the sensor nodes in a network is essential to many network functionalities such as routing, coverage and tracking, and event detection. The localization problem for sensor networks is to reconstruct the positions of all of the sensors in a network, given the distances between all pairs of sensors that are within some radius r of each other. In the past few years, many algorithms for solving the localization problem were proposed, without knowing the computational complexity of the problem. In this paper, we show that no polynomial-time algorithm can solve this problem in the worst case, even for sets of distance pairs for which a unique solution exists, unless RP = NP. We also discuss the consequences of our result and present open problems.
39342835
Guaranteed Mutually Consistent Checkpointing in Distributed Computations
In this paper, we explore the isomorphism between vector time and causality to characterize consistency of a set of checkpoints in a distributed computing. A necessary and sufficient condition, to determine if a set of local checkpoints can form a consistent global checkpoint, is presented and proved using the isomorphic power of vector time and causality. To the best of our knowledge, this is the first attempt to use the isomorphism for this purpose. This condition leads to a simple and straightforward algorithm for a guaranteed mutually consistent global checkpointing. In our approach, a process can take a checkpoint whenever and wherever it wants while other related process may be asked to take an additional checkpoint for ensuring the mutual consistency. We also show how this condition and the resulting algorithm can be used to obtain a maximum and minimum global checkpoints, another important paradigm for distributed applications.
2707132
Resource constraints analysis of workflow specifications
A workflow specification is a formal description of business processes in the real world. Its correctness is critical to the workflow execution and hence the realisation of business objectives. In addition to structural and temporal constraints, resource constraints are also implied in workflow specifications. Therefore, they should be analysed to ensure that the workflow specification is resource consistent at build-time. In this paper, we first identify the problem of resource constraints in a workflow specification. Then we propose an innovative approach with corresponding algorithms to the checking of resource consistency for a workflow specification. Furthermore, we extend our analysis work to timed workflow specifications, where time information is taken into consideration for the checking of the resource consistency of a workflow specification. The work reported in this paper provides a theoretical foundation for workflow modeling and analysis in workflow management.
4332805
Stable egress route selection for interdomain traffic engineering: model and analysis
We present a general model of interdomain route selection to study interdomain traffic engineering. In this model, the routing of multiple destinations can be coordinated. Thus the model can capture general traffic engineering behaviors such as load balancing and link capacity constraints. We first identify potential routing instability and inefficiency of interdomain traffic engineering. We then derive a sufficient condition to guarantee convergence. We also show that the constraints on local policies imposed by business considerations in the Internet can guarantee stability without global coordination. Using realistic Internet topology, we evaluate the extent to which routing instability of interdomain traffic engineering can happen when the constraints are violated
6183487
Practical routing and torus assignment for RDT
The connection topology of interconnection networks and the routing algorithm often dominate system performance in MPCs. RDT has already been proved to be one of the best interconnection networks used in such systems. It supports a smaller diameter and degree than most at the size of one thousand to tens of thousands nodes. The floating vector routing algorithm is very effective for transferring messages, which also shows good performance. In this paper, a descending vector routing algorithm is proposed. We also proposed a practical torus assignment named RDT(2,2,1)/a and the deadlock-free routing algorithm. RDT(2,2,1)/a mainly focuses on the MPC that has about one thousand nodes. With a simplified simulation and comparison, the results show that RDT(2,2,1)/a has a better performance at the size of one thousand nodes.