Design and Verification of Adaptive Cache Coherence Protocols ...

although various techniques have been proposed to reduce the state space.
While nite-state veri ers can be used for initial sanity checking on small scale examples,
theorem provers can be of great help for veri cation of sophisticated protocols. Akhiani et al.
[7] employed a hierarchical proof technique to verify sophisticated cache coherence protocols for
the Alpha memory model. The protocols are speci ed in TLA+ [74, 75], a formal speci cation
language based on rst-order logic and set theory. Plakal et al. [31, 100] proposed a technique
based on Lamport's logical clocks that can be used to reason about cache coherence protocols.
The method associates a counter with each host and provides a time-stamping scheme that to-
tally orders all protocol events. The total order can then be used to verify that the requirements
of speci c memory models are satis ed.
Most protocol veri cation methods verify certain invariants for cache coherence protocols.
However, it is often di cult to determine all the necessary invariants in a systematic manner,
especially for sophisticated protocols that implement relaxed memory models and incorporate
various optimizations. While some invariants are obvious (for example, two caches at the same
level should not contain the same address in the exclusive statesimultaneously), many others
are motivated by particular protocol implementations instead of the speci cations of memory
models. Sometimes it is not even clear if the chosen invariants are necessary or su cient for the
correctness. This means that for the same memory model, we mayhave toprove very di erent
properties for di erent implementations. Therefore, these techniques are more like a bag of
useful tools for debugging cache coherence protocols, rather than for verifying them.
The di culty ofprotocol veri cation with current approaches can be largely attributed to
the fact that protocols are designed and veri ed separately. In our approach, both the memory
model and the protocol are expressed in the same formalism, and there is a notion that one
system implements another. We begin with the operational speci cation of the memory model,
and then develop protocols using the Imperative-&-Directive design methodology. Protocols
are designed and veri ed iteratively throughout the successive process. The invariants that
need to be veri ed usually show up systematically as lemmas that can be veri ed by induction
and case analysis on rewriting rules.
1.3 Contributions of the Thesis
This thesis presents a mechanism-oriented memory model and associated adaptive cache coher-
ence protocols that implement the memory model for DSM systems. The major contributions
of the thesis are as follows:
Using TRSs to model computer architectures and distributed protocols. TRSs o er a
convenient way to describe asynchronous systems and can be used to prove the correct-
ness of an implementation with respect to a speci cation. To prove its soundness, the
speci cation is shown to be able to simulate the implementation with respect to a map-
ping function based on the notion of drained terms. To prove its liveness, temporal logic
is employed to reason about time-varying behaviors of TRSs.
23