The C11 and C++11 Concurrency Model

178
| Load mo → (mo ∈ {NA, Seq cst})
| Store mo → (mo ∈ {NA, Seq cst})
| RMW mo → (mo ∈ {Seq cst})
| Fence mo → false
| Blocked rmw → true
end
Theorem 13.
(∀ opsem p.
opsem assumptions opsem ∧
statically satisfied tot condition opsem p −→
(rf behaviour SC memory model SC condition opsem p =
rf behaviour tot memory model tot condition opsem p))
sc only
total
Equivalence proof overview
This proof of equivalence is rather more involved than those that have already been
presented. The form of candidate executions differs between the two models: they have
different execution witnesses and different calculated relations, so the equivalence that
projectsonlyrffromtheexecutionwitnessisused. Theproofreliesonseveralassumptions
on the thread-local semantics that enable induction over partial executions.
At the highest level, the proof involves showing that one can translate an execution
from one model into an execution in the other. These translations will rely on the absence
of undefined behaviour, and are supported by complementary proofs showing that
undefined behaviour in one model implies undefined behaviour in the other.
The translation from a total order execution to a partial one is straightforward: each
of the partial relations, lo, mo and sc is projected out of tot, and a translated execution
witness gathers these translated relations together. In the other direction, a linearisation
of the union of hb and sc forms the translated total order of the execution witness. Then,
as we shall see in greater detail later, in the absence of faults, these translations produce
consistent executions in their target models.
The treatment of faults that lead to undefined behaviour forms a large part of the
proof effort. The line of argument relies on the notion of a prefix, a partial execution
that includes all actions that are ordered before any action within the prefix. In either
direction, the general form of the proof follows the same series of steps. Given a faulty
execution in one model:
1. choose some order over the actions and find a minimal fault in that order,
2. construct a prefix of that fault that contains no other faults,
3. show that this prefix is consistent,