PrideMM: Second Order Model Checking for Memory Consistency Models

Abstract

We present PrideMM, an efficient model checker for second-order logic enabled by recent breakthroughs in quantified satisfiability solvers. We argue that second-order logic sits at a sweet spot: constrained enough to enable practical solving, yet expressive enough to cover an important class of problems not amenable to (non-quantified) satisfiability solvers. To the best of our knowledge PrideMM is the first automated model checker for second-order logic formulae.

We demonstrate the usefulness of PrideMM by applying it to problems drawn from recent work on memory specifications, which define the allowed executions of concurrent programs. For traditional memory specifications, program executions can be evaluated using a satisfiability solver or using equally powerful ad hoc techniques. However, such techniques are insufficient for handling some emerging memory specifications.

We evaluate PrideMM by implementing a variety of memory specifications, including one that cannot be handled by satisfiability solvers. In this problem domain, PrideMM provides usable automation, enabling a modify-execute-evaluate pattern of development where previously manual proof was required.

Appendix A Reformulation of Happens Before

Lahav et al.  [24] define happens before, , in terms of sequenced before $\texttt {sb}$, the C++ name for program order, and synchronises with, , inter-thread synchronisation. Their and relations match and in our vocabulary. Fixed sequences of memory events initiate and conclude synchronisation, and these are captured by and . In the definition below, semicolon represents forward relation composition.

For efficiency we over-approximate transitive closures in the SO logic, but the nesting over-approximation that follows from the structure of does not perform well. Instead we over-approximate a reformulation of .

By unpacking the definition of , the reformulation flattens the nested closures into a single one. The closure combines fragments of happens before where at the start and end of the fragment, a synchronisation edge has been initiated but not concluded. Within the closure, the synchronisation edge can be concluded and a new one opened, or some number of read-modify-writes can be chained together with .

We explain the definition of by considering the number of edges that constitute a particular edge. If a edge contains no edge, then because $\texttt {sb}$ is transitive, the edge must be a single $\texttt {sb}$ edge. Otherwise, the edge is made up of a sequence of one or more edges with $\texttt {sb}$ edges before, between and after some of the edges. The first edge is itself a sequence of edges starting with . This is followed by any number of edges. At the end of the edge there are two possibilities: this edge was the final edge, or there is another in the sequence to be initiated next. The first conjunct of the closure, captures the closing and opening of edges, the second captures the chaining of read-modify-writes. The end of the definition closes the final edge with .