Design and Verification of Adaptive Cache Coherence Protocols ...

4.5 Soundness Proof of the Base Protocol
Soundness of a cache coherence protocol means that the TRS specifying the protocol can be
simulated by the TRS specifying the memory model. In this section, we prove the soundness
of the Base protocol by showing that CRF can simulate Base. We de ne a mapping function
from Base to CRF, and show thatany imperative rule of Base can be simulated in CRF with
respect to the mapping function. The soundness of the Base protocol follows from the fact that
all the Base rules can be derived from the Base imperative rules.
Before delving into the proof, we present some invariants that will be used throughout the
proof. The invariants also help us understand the behavior of the protocol.
4.5.1 Some Invariants of Base
Lemma 1 consists of two invariants that describe the correspondence between cache states and
messages in transit. An address is cached in the CachePending state, if and only if there is a
CacheReq or Cache message between the cache and the memory. An address is cached in the
WbPending state, ifandonlyifthereis a Wb or WbAck message between the cache and the
memory.
Lemma 1 Given a Base term s,
(1) Cell(a,-,CachePending) 2 Cache id(s) ,
Msg(id ,H,CacheReq,a) 2 MinCout id (s) _ Msg(H,id ,Cache,a,-) 2 MoutCin id (s)
(2) Cell(a,v,WbPending) 2 Cache id(s) ,
Msg(id ,H,Wb,a,v) 2 MinCout id (s) _ Msg(H,id ,WbAck,a) 2 MoutCin id (s)
Proof The proof is based on induction on rewriting steps. The invariants hold trivially for
the initial term where all caches and queues are empty. It can be shown by checking each rule
that, if the invariants hold for a term, they still hold after the term is rewritten according to
that rule. 2
Lemma 2 means that there exists at most one message in transit between the same source and
destination regarding the same address. This implies that the soundness and liveness of the
Base protocol are not contingent upon the FIFO order of message passing.
Lemma 2 Given a Base term s,
msg1 2 s ^ msg2 2 s )
Src(msg1) 6=Src(msg2) _ Dest(msg1) 6= Dest(msg2) _ Addr(msg1) 6=Addr(msg2)
Proof The proof is based on induction on rewriting steps. The invariant holds trivially for
the initial term where all queues are empty. It can be shown by checking each rule that, if the
invariant holds for a term, it still holds after the term is rewritten according to that rule. Note
that a cache can send a message only when the address is uncached or cached in a stable state
(which means there is no message between the cache and the memory regarding the address),
while the memory can send a message only when it receives an incoming message. 2
76