Exact and Efficient Verification of Parameterized Cache Coherence Protocols

A new method is proposed for parameterized reasoning about snoopy cache coherence protocols. The method is distinctive for being exact (sound and complete), fully automatic (algorithmic), and tractably efficient. The states of most cache coherence protocols can be organized into a hierarchy reflecting how tightly a memory block in a given cache state is bound to the processor. A broad framework encompassing snoopy cache coherence protocols is proposed where the hierarchy implicit in the design of protocols is captured as a pre-order. This yields a new solution technique that hinges on the construction of an abstract history graph where a global concrete state is represented by an abstract state reflecting the occupied local states. The abstract graph also takes into account the history of local transitions of the protocol that were fired along the computation to get to the global state. This permits the abstract history graph to exactly capture the behaviour of systems with an arbitrary number of homogeneous processes. Although the worst case size of the abstract history graph can be exponential in the size of the transition diagram describing the protocol, the actual size of the abstract history graph is small for standard cache protocols. The method is applicable to all 8 of the most common snoopy cache protocols described in Handy’s book [19] from Illinois-MESI to Dragon. The experimental results for parameterized verification of each of those 8 protocols document the efficiency of this new method in practice, with each protocol being verified in just a fraction of a second. It is emphasized that this is parameterized verification.

We develop a specification methodology that documents and specifies a cache coherence protocol in eight tables: the states, events, actions, and transitions of the cache and memory controllers. We then use this methodology to specify a detailed, modern three-state broadcast snooping protocol with an unordered data network and an ordered address network that allows arbitrary skew. We also present a detailed specification of a new protocol called multicast snooping (Bilir et al., 1999) and, in doing so, we better illustrate the utility of the table-based specification methodology. Finally, we demonstrate a technique for verification of the multicast snooping protocol, through the sketch of a manual proof that the specification satisfies a sequentially consistent memory model.

Techniques for Improving Performance of Hybrid Snooping Cache Protocols

Existing cache coherence protocols incur high overheads to shared memory systems and significantly reduce the system efficiency. For example, the widely used snooping protocol broadcasts messages at the expense of high network bandwidth overheads, and the directory protocol requires massive storage spaces to keep track of sharers. Furthermore, these coherence protocols have numerous transient states to cover various races, which increase the difficulty of implementation and verification. To mitigate these issues, this paper proposes a simple and efficient, two-state (Valid and Invalid) cache coherence protocol, VISU, for data-race-free programs. We adopt two distinct schemes for the private and shared data to simplify the design. Since the private data does not need to maintain coherence, we apply a simple write-back policy. For shared data, we leverage a write-through policy to make the last-level cache always hold the up-to-date data. A self-updating mechanism is deployed at synchronization points to update stale copies in L1 caches; this obviates the need for the broadcast communication or the directory.

Self-pruning is an effective scheme for efficient broadcasting in ad hoc wireless networks. In a self-pruning broadcast protocol, a node may not forward a broadcast packet if a certain self-pruning condition is satisfied based on the neighborhood information. In a static network with an ideal MAC layer, only a subset of nodes forward the broadcast packet and still guarantee the complete network delivery. Various protocols have been proposed with different self-pruning conditions. Recently, a generic self-pruning protocol was proposed by Wu and Dai (2003), which combines the strength of previous conditions and is more effective. In this paper, we first propose an enhanced version of the generic protocol, which is more elegant in interpreting existing protocols and has a simpler correctness proof. Then, we evaluate the performance of the family of self-pruning protocols under various network situations with ns2. The objective is to observe the efficiency and reliability of these protocols as a function of network density, congestion, and mobility, and provide a guideline of implementation in the "real world". Our performance analysis reveals that the protocol reliability is barely affected by packet collision. However, most self-pruning protocols suffer from low delivery ratio in highly mobile networks. We further explore various techniques that improve the delivery ratio and show that both high efficiency and reliability can be achieved in highly mobile networks.

We introduce the notion of array-based system as a suitable abstraction of infinite state systems such as broadcast protocols or sorting programs. By using a class of quantified-first order formulae to symbolically represent array-based systems, we propose methods to check safety (invariance) and liveness (recurrence) properties on top of Satisfiability Modulo Theories solvers. We find hypotheses under which the verification procedures for such properties can be fully mechanized.

The demonstration presents a network coding broadcast protocol experiment running on a remote open testbed, IoT-LAB. The emphasis is on both parts, that are ideally fitting and complementary: the use of testbed IoT-LAB, and a protocol for broadcast with network coding. IoT-LAB is a very large scale testbed, remotely accessible, and includes a total of 2728 nodes (in 6 sites), the nodes are mostly of type "wireless sensor nodes" with one wireless radio transceiver, and are well suited to perform wireless protocol experiments. On the other hand, network coding is a technique perfectly fitted to multi-hop wireless networks with lossy links, in some cases and conditions, it may even outperform any scheme using routing (non-coding): we had designed a generic broadcast protocol, called DRAGONCAST based on network coding for such networks, and which minimizes the assumptions made of the networks. A variant of this protocol was run on IoT-LAB: some results were presented previously. The demonstration is a live demonstration of the protocol on the newer nodes of IoT-LAB.

Many replicated data services utilize majority quorums to safely replicate data changes in the presence of server failures. Majority quorum-based services require a simple majority of the servers to be operational for the service to stay available. A key limitation of the majority quorum is that if a service is composed of just two servers, progress cannot be made even if a single server fails because the majority quorum size is also two. This is called the Two-Server problem. A problem similar to the Two-Server problem occurs when a service’s servers are spread across only two failure domains. Servers in a failure domain can fail together. When one of the two failure domains fails, the servers in the other failure domain may not be able to form a majority quorum, rendering the service unavailable. We call this the Two-Site Problem, where each site is one failure domain. We propose to solve the Two-Server problem by using witnesses, lightweight servers that only store metadata required to participate in a quorum. We show that the solution to the Two-Server problem is also applicable to the Two-Site problem. We tested this solution in the context of Zookeeper, a replicated coordination service. Zookeeper utilizes the Zookeeper Atomic Broadcast (Zab) protocol to replicate its coordination data. We designed and incorporated witnesses in Zab. We show that our solution has increased the liveness of Zookeeper in the two-server scenario. We also show that Zab’s safety properties are not affected by these changes.

In this paper, we present a successful application of a simulation-based sequential Automatic Test Pattern Generation (ATPG) for safety property verification, with the target on verifying safety property of large, industrial strength, hardware designs for which current formal methods fail. Several techniques are developed to increase the effectiveness and efficiency during state exploration and justification of the test generator for verification, including (1) incorporation of a small combinational ATPG engine, (2) reset signal masking, (3) threshold-value simulation, and (4) weighted Hamming distance. Experimental results on both ISCAS89 benchmark circuits and real industry circuits have shown that this simulation-based verifier achieves better or comparable results to current state-of-the-art formal verification tools BINGO and CHAFF.

A cache coherence protocol is a vital component of a multiprocessor to maintain the data consistency. In this paper, we proposed VFCC, which is a simulation framework to validate a cache-coherence protocol implementation of a commercial 64-bit superscalar multiprocessor. It exploits multiple-level parallelism to accelerate validation without overheads among threads. Our experimental results demonstrate VFCC has a 5.0× speedup than a traditional simulator on a conventional 16-core host machine.

It is now commonly accepted that the unit disk graph used to model the physical layer in wireless networks does not reflect real radio transmissions, and that a more realistic model should be considered for experimental simulations. Previous work on realistic scenarios has been focused on unicast, however broadcast requirements are fundamentally different and cannot be derived from the unicast case. Therefore, the broadcast protocols must be adapted in order to still be efficient under realistic assumptions. In this paper, we study the well-known multipoint relay broadcast protocol (MPR), in which each node has to choose a set of 1-hop neighbors to act as relays in order to cover the whole 2-hop neighborhood. We give experimental results showing that the original strategy used to select these multipoint relays does not suit a realistic model. On the basis of these results, we propose new selection strategies solely based on link quality. One of the key aspects of our solutions is that our strategies do not require any additional hardware and may be implemented at the application layer, which is particularly relevant to the context of ad hoc and sensor networks where energy savings are mandatory. We finally provide new experimental results that demonstrate the superiority of our strategies under realistic physical assumptions.

The civil aviation information system should be formally verified because it is a safety-critical system. Formal verification method is a vital approach to ensure the system safety. In this paper the civil aviation business system is modeled using business process modeling notation (BPMN) language, in order to satisfy the safety verification requirements of the civil business logic in China. Six safety properties are then defined by analyzing the built model, and a forward reasoning algorithm for safety verification is designed and implemented. Finally, an example of civil aviation ticketing system is demonstrated to verify the complete verification procedure and support the validity of the present method.

Most deep neural network (DNN) verification research focuses on qualitative verification, which answers whether or not a DNN violates a safety/robustness property. This paper proposes an approach to convert qualitative verification into quantitative verification for neural networks. The resulting quantitative verification method not only can answer YES or NO questions but also can compute the probability of a property being violated. To do that, we introduce the concept of a probabilistic star (or shortly ProbStar), a new variant of the well-known star set, in which the predicate variables belong to a Gaussian distribution and propose an approach to compute the probability of a probabilistic star in high-dimensional space. Unlike existing works dealing with constrained input sets, our work considers the input set as a truncated multivariate normal (Gaussian) distribution, i.e., besides the constraints on the input variables, the input set has a probability of the constraints being satisfied. The input distribution is represented as a probabilistic star set and is propagated through a network to construct the output reachable set containing multiple ProbStars, which are used to verify the safety or robustness properties of the network. In case of a property is violated, the violation probability can be computed precisely by an exact verification algorithm or approximately by an overapproximate verification algorithm. The proposed approach is implemented in a tool named StarV and is evaluated using the well-known ACASXu networks and a rocket landing benchmark.

: When a distributed systems protocol is used in a particular context as part of a solution to a larger problem, additional information may be generated from the context. Such information may be used for optimization of the system, and, in the case of security protocols, may be of use to the adversary for attacks. The project conducted a case study of the application of the epistemic model checker MCK to automatically detect such optimization opportunities, and to verify that the protocol remains secure in the mode of use. The particular protocol studied was Chaum's Dining Cryptographers protocol, a security protocol that allows a single agent to anonymously transmit a signal. The context of use considered was a more general 2-phase protocol for anonymous broadcast by an arbitrary number of agents, also proposed by Chaum. The aims of the 2-phase anonymous broadcast protocol were formulated as a knowledge-based program, and an iterative process of model checking and manual counter-example guided refinement was followed to converge on implementations of this knowledge-based program in which local predicates were identified that correspond precisely to the knowledge conditions in the knowledge-based program. This analysis demonstrated that the 2-phase protocol contains some quite subtle flows of information that can be used to optimize its performance, but no violation of the anonymity property was found. As an additional contribution of the research, a formal abstraction technique was developed, and proved correct, for epistemic model checking of protocols that call the Dining Cryptographers protocol as a subroutine. Experimental results show that the optimization improves epistemic model checking performance by orders of magnitude and enables problems of larger scale to be attacked.

Functional programs are well suited for concurrent execution due to the Church-Rosser property. However, for many applications there is still need to explicitly specify process systems instead of relying on compilers. Coordination languages provide one viable solution to the problem of specifying concurrent process systems, since they do not interfere with the properties of the language used for the algorithmic specification of the processes. The coordination language K2 to be proposed in this paper is based on a variant of colored Petri nets. It primarily defines process systems with deterministic behavior, but also allows for controlled forms of non-determinism. Specifications based on Petri nets offer several advantages. An underlying net calculus facilitates formal analysis and verification of basic safety and liveness properties. Graphical representations clearly expose structural dependencies among system components. Our variant of colored Petri nets provides several forms of net abstractions which facilitate the systematic construction of complex systems from small subsystems by composition. Recursive specifications can be used to adapt the structure of a process system to actual problem sizes or to varying input parameters.KeywordsInput StreamOutput StreamLiveness PropertyRecursive ProcessHierarchical ProcessThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.