Formal Verification of Lock-Free Algorithms

of the slightly optimized version [28] of Michael and Scott’s
queue [1] implementation. This work also proves lockfreedom
of the queue.
5. Related Work
Our approach is based on an expressive temporal logic,
which is built into the theorem prover. In this sense it is similar
to the formalization of TLA [24] in Isabelle [29] and to
the STEP prover [30] or to + CAL [31]. All these approaches
require to encode programs to a normal form of transition
systems for deduction. Although this is not a drawback for
automated proofs using model checking, we found it very
unintuitive to reason about program counters in interactive
verification. Therefore we avoid such an encoding.
An alternative to using temporal logic and rely-guarantee
reasoning directly, is to use an encoding into higher-order
logic (e.g. [32], [33] or [34]). This has the advantage that
soundness of the logic can be reduced to the soundness
of higher-order logic, but it requires to encode a lot of
the semantics (we are not aware of encodings that support
a full abstract programming language with local variables,
recursion, blocking, and interleaving as KIV does).
Verification of lock-free algorithms is currently an active
research topic. Various algorithms have been proved to be
linearizable, e.g. algorithms working on a global queue [28],
[35], a lazy caching algorithm [36] or a concurrent garbage
collection [37].
The algorithm considered here was taken from Colvin and
Groves [28], [38], who have given a correctness proof using
IO automata and the theorem prover PVS. We have only
studied the core algorithm, their work discusses extending
the algorithm with elimination arrays, and adds modification
counts to avoid the ABA problem. In contrast to this formal
proof our proof is not monolithic, and does not require to
encode programs as automata using program counters.
Recent work by the same authors [39], [40] discusses
incremental development of the algorithm using refinement
calculus and programs very similar to ours. The resulting
steps are rather intuitive for explaining the ideas and possible
variations, but have not been mechanized. Again this
work also discusses various extensions and variations of the
algorithm. Colvin and Dongol [41] have also developed an
mechanized approach to verify lock-freeness.
In [42], Vafeiadis et. al. describe a rely-guarantee approach
for linearizability, that is applied informally on an
implementation of sets using fine-grained locking. [43],
[44], [45] mechanizes verification of the resulting proof
obligations (correctness of the proof obligations is argued
on the semantic level). [46] considers lock-freedom. In
contrast to our approach, the approach mixes the abstract
and concrete layer, by calling the abstract operation at the
linearization point within the concrete code. We have not
used this idea, since it is incompatible with the idea of
developing concrete programs incrementally from abstract
specifications. Nevertheless the technique allows to use a
standard rely-guarantee theorem for a single program. The
approach is fully automatic on a number of examples. It uses
an impressive range of specialized automation techniques:
separation logic [47] is used to reason over pointer structures,
the distinction between local (i.e. modifiable only by
one process) and global references is encoded as boxed and
unboxed formulas. A variant of the abstraction and invariant
generation technique proposed by [48] is used to deal with
loops.
Fully automatic approaches based on static analysis are
given by Amit et. al. in [49] and by Berdine et. al. in [50].
They also specialize on reasoning over pointer structures.
6. Conclusion
Our work aims to define a generic, modular approach
that allows mechanized, interactive verification of lockfree
and other concurrent algorithms. The approach uses
an expressive temporal logic to formalize compositionality
theorems for rely-guarantee reasoning and refinement. The
approach has been applied to simple examples like the one
shown in this paper.
Current work is to use the approach on more complex
examples and to integrate specialized deduction techniques
that help to automate proofs into our generic framework.
References
[1] M. M. Michael and M. L. Scott, “Nonblocking algorithms
and preemption-safe locking on multiprogrammed shared —
memory multiprocessors,” Journal of Parallel and Distributed
Computing, vol. 51, no. 1, pp. 1–26, 1998.
[2] M. M. Michael, “High performance dynamic lock-free hash
tables and list-based sets,” in SPAA 2002. ACM, 2002, pp.
73–82.
[3] M. M. Michael, “Practical lock-free and wait-free ll/sc/vl
implementations using 64-bit cas,” in DISC 04, vol. 3274.
Springer LNCS, 2004.
[4] T. Leonard, “Dragged kicking and screaming:
Source multicore,” Talk at the Game Developers
Conference, San Francisco, March 2007. [Online].
Available: www.valvesoftware.com/publications/2007/
GDC2007 SourceMulticore.pdf
[5] M. Herlihy and J. M. Wing, “Linearizability: A correctness
condition for concurrent objects,” ACM Transactions on Programming
Languages and Systems, vol. 12, no. 3, pp. 463–
492, 1990.
[6] M. Balser, “Verifying concurrent system with symbolic execution
– temporal reasoning is symbolic execution with a
little induction,” Ph.D. dissertation, University of Augsburg,
Augsburg, Germany, 2005.
16
Authorized licensed use limited to: Technische Universitat Kaiserslautern. Downloaded on January 18, 2010 at 11:43 from IEEE Xplore. Restrictions apply.