Design and Verification of Adaptive Cache Coherence Protocols ...

Intuitively, \2P " means that \P is true all the times". We can de ne temporal operators
such as\3" (eventually) and \" (leads-to) using the operator \2".
3P : 2: P . This predicate asserts that P will be true at some future time (that is,
P is not always false). Note that by \future time" we also include the \present time".
PQ 2(P ) 3Q ). This predicate asserts that whenever P is true, Q will be true
at some later time. This operator is transitive, meaning that any sequence satisfying
\PQ "and\QG " also satis es \PG ".
To ensure liveness, we need to enforce some fairness throughout the system execution.
Intuitively, fairness means that if a rule is applicable, it must be applied eventually. The
fairness of concurrent systems can be expressed in terms of weak fairness and strong fairness
conditions. Weak fairness means that if a rule is applicable, it must be applied eventually or
will become impossible to apply at some later time. Strong fairness means that if a rule is
applicable, it must be applied eventually or will become impossible to apply forever.
Let Enabled(R) be the predicate that determines whether the rule R is applicable. We can
de ne weak fairness and strong fairness as follows:
WF(R) (23R) _ (23:Enabled(R))
SF(R) (23R) _ (32:Enabled(R))
The fairness of a rule actually refers to the fairness of the application of the rule on a
speci c redex. Note that a rule can often be applied on di erent redexes at the same time.
Unless otherwise speci ed, weak or strong fairness of a rule means the application of the rule
on any redex is weakly or strongly fair.
Theorem-WF Given predicates P and Q , PQ if the following conditions are true:
8s (P (s) )9R 9s 0 (WF(R) ^ s R !s 0 ^ Q (s 0 )))
8s (P (s) )8R 8s 0 (s R !s 0 ) (Q (s 0 ) _ P (s 0 )))).
Theorem-SF Given predicates P and Q , PQ if the following conditions are true:
8s (P (s) )9R 9s 0 (SF(R) ^ s R !s 0 ^ Q (s 0 )))
8s (P (s) )8R 8s 0 (s R !s 0 ) (Q (s 0 ) _9G (G (s 0 ) ^ (GP ))))).
Although the operator \2" can be used to specify properties such as what will happen
eventually, it does not allow us to express properties such as what will happen in the next term
of a sequence. This constraint is deliberate because an implementation can often take various
number of steps to achieve the semantic e ect of a single step in a speci cation. Therefore, it
makes little sense for a speci cation to require that something must happen in the next step of
an execution.
However, some additional temporal operators can be used to simplify the liveness proof.
The operator \ " (next) is introduced for this purpose: the predicate ( P )(hs1, s2, s3, :::i)
41