P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in tla. Distributed Computing, 1997.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....[5] for a recent workshop. We showed how to port Collier s architectural testing work [19] to model checking [10] and extend Collier s work to weak memory models [20] In [21] event sequences generated by protocol implementations are verified by a much simpler trustworthy protocol processor. In [22, 23], shared memory consistency models are described in an operational style. In [6] sequential consistency verification, including parameterized model checking is addressed. To our knowledge, we are the first to verify eight di#erent protocols against two di#erent weak memory models using a uniform ....

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in TLA. Distributed Computing, 1997.

.... One solution is to input the computation of the concrete system into a transducer, which queues segments of the concrete computation until they can be matched with an abstract execution [21] Similarly, 19] propose a finite state observer that observes and re orders the memory operations, while [22] use an auxiliary queue to record writes which have updated memory but have not yet updated the cache. Step wise refinement, in which the lazy caching system is transformed in a number of steps to a serial system, is used in [5] and [22] Composition [20] and abstraction [16] are two other ....

....that observes and re orders the memory operations, while [22] use an auxiliary queue to record writes which have updated memory but have not yet updated the cache. Step wise refinement, in which the lazy caching system is transformed in a number of steps to a serial system, is used in [5] and [22]. Composition [20] and abstraction [16] are two other methodologies proposed, while in [9] decomposition is coupled with the use of CSP to prove trace inclusion. The paper introducing lazy caching [2] presents a semantic proof that it is sequentially consistent. A WriteCounter is used to assign a ....

[Article contains additional citation context not shown here]

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in TLA. Dist. Comp., 12:151--174, 1999.

....parameter values. A limitation of all these approaches is that they do not explicate the formal connection between the verified invariants and shared memory model for the protocol. There are some papers that have looked at verification of shared memory models. Systematic manual proof methods [LLOR99, PSCH98] and theorem proving [Aro01] have been used to verify sequential consistency for arbitrary parameter values. These approaches require a significant amount of e#ort on the part of the user. Our method is completely automatic and is a good debugging technique which can be applied before ....

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in TLA. Distributed Computing, 12(2/3):151--174, 1999. 27

....A number of papers have looked at verification of invariants, but not abstract memory models, of cache coherence protocols. Model checking has been used for fixed parameter values [MS91, CGH 93, EM95, ID96] while mechanical theorem proving [LD92, PD96] and systematic manual proof methods [LLOR99, PSCH98] have been used for arbitrary parameter values. Methods combining automatic abstraction with model checking [PD95, Del00] have been used to verify invariants for arbitrary number of processors. The serializer approach of [HQR99] similar to the convenient computations approach of ....

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in TLA. Distributed Computing, 12(2/3):151--174, 1999.

....theorem proving. Even approaches based on conventional model checking are impossibly difficult to use in practice. For example, the assertions pertaining to the sequential consistency of lazy caching [11] a simple memory system, expressed in various temporal logics (by [15] in 8CTL [6] and [19] in TLA [21] are highly complex. We do not believe that descriptions of this style will scale up. On the other hand, the test model checking method has not only been able to comfortably handle the memory system defined by the symmetric multiprocessor (SMP) bus called Runway [4] used by ....

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in TLA. Distributed Computing, 1997.

....proving. Even approaches based on conventional model checking are impossibly difficult to use in practice. For example, the assertions pertaining to the sequential consistency of lazy caching [Ger95] a simple memory system, expressed in various temporal logics (by [Gra94] in 8CTL [CES86] and [LLOR97] in TLA [Lam94] are quite complex. In [Gra94] abstract interpretation [CC77] is employed to reduce infinite system verification to finite 8CTL model checking. They apply this technique to verify the sequential consistency of lazy caching with unbounded queues. They recognize that to get an ....

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in tla. Distributed Computing, 1997.

....proving. Even approaches based on conventional model checking are impossibly difficult to use in practice. For example, the assertions pertaining to the sequential consistency of lazy caching [Ger95] a simple memory system, expressed in various temporal logics (by [Gra94] in 8CTL [CES86] and [LLOR97] in TLA [Lam94] are highly complex. We do not believe that descriptions of this style will scale up. On the other hand, the test model checking method has not only been able to comfortably handle the memory system defined by the symmetric multiprocessor (SMP) bus called Runway [BCS96, GGH ....

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in tla. Distributed Computing, 1997.

....Even approaches based on conventional model checking are impossibly difficult to use in practice. For example, the assertions pertaining to the sequential consistency of lazy caching [Ger95] a simple memory system, expressed in various temporal logics (by [Gra94] in 8CTL [CES86] and [LLOR97] in TLA [Lam94] are highly complex. We do not believe that descriptions of this style will scale up. On the other hand, the test model checking method has not only been able to comfortably handle the memory system defined by the symmetric multiprocessor (SMP) bus called Runway [BCS96, GGH ....

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in tla. Distributed Computing, 1997.

....permit a description of the precise class of predicates TLC accepts. In practice, TLC seems able to handle specifications that describe actual systems, but not all abstract, high level specifications. For example: It cannot handle either of the two specifications of sequential consistency in [8] because they are not written in TLA s canonical form with a single initial condition and next state action. The specification SeqDB2, with its use of temporal universal quantification, lies well outside TLC s domain. The specification SeqDB1 is the conjunction of two specifications in canonical ....

....many reachable states. Checking it on a model with about 12M reachable states takes 7.5 hours on a two processor 600MHz work station, and the state queue attains a maximum size of 250M bytes. The model with the most states that TLC has yet checked, which is for the 30 line specification CCache of [8], has over 60M reachable states and takes less than a day to check on a 600MHz uniprocessor work station. 8 Status and Future Work By using a rich language such as TLA , we can have the engineers designing a system write a single TLA specification that serves as a design document, 7 The ....

Peter Ladkin, Leslie Lamport, Bryan Olivier, and Denis Roegel. Lazy caching in TLA. Distributed Computing, 12, 1999. To appear.

....be read. 1 What s the Problem Rob Gerth set the challenge problem to verify formally that the Lazy Caching algorithm of Afek, Brown and Merritt [ABM93] is sequentially consistent [Ger96] We undertook to verify the algorithm completely formally in TLA. The description of our proof appears in [LLRO96], which contains the TLA specifications and the approach on which the work described here is based. I present here part of the formal proof, namely the proof that the lazy caching algorithm implements an intermediate specification called the complete cache. To find out how one goes about ....

Peter Ladkin, Leslie Lamport, Denis Roegel, and Brian Olivier. Lazy caching in TLA. Distributed Computing, 1996. To appear. 68

No context found.

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in tla. Distributed Computing, 1997.

No context found.

P. Ladkin, L. Lamport, B. Olivier, and D. Roegel. Lazy caching in TLA. Distr. Comput., 12:151--174, 1999.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC