[PPT] - On Verifying Causal Consistency Ahmed Bouajjani, Constantin Enea, PowerPoint Presentation

SLIDE 1

On Verifying Causal Consistency

Ahmed Bouajjani, Constantin Enea, Rachid Guerraoui, Jad Hamza

IRIF, Universit´ e Paris Diderot

May 2017

SLIDE 2

Geo-Replicated Data Structures

Strong (sequential) consistency

1S. Gilbert and N. A. Lynch. Brewer’s conjecture and the feasibility of consistent,

available, partition-tolerant web services.

1 / 28

SLIDE 3

Geo-Replicated Data Structures

Strong (sequential) consistency write(x, 1) write(x, 2)

1S. Gilbert and N. A. Lynch. Brewer’s conjecture and the feasibility of consistent,

available, partition-tolerant web services.

1 / 28

SLIDE 4

Geo-Replicated Data Structures

Strong (sequential) consistency write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

1S. Gilbert and N. A. Lynch. Brewer’s conjecture and the feasibility of consistent,

available, partition-tolerant web services.

1 / 28

SLIDE 5

Geo-Replicated Data Structures

Strong (sequential) consistency is impossible while being available and tolerating network partitions: the CAP theorem 1 write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

1S. Gilbert and N. A. Lynch. Brewer’s conjecture and the feasibility of consistent,

available, partition-tolerant web services.

1 / 28

SLIDE 6

Geo-Replicated Data Structures

Tolerating faults while preserving availability leads to anomalies w.r.t. strong (sequential) consistency

2 / 28

SLIDE 7

Geo-Replicated Data Structures

Tolerating faults while preserving availability leads to anomalies w.r.t. strong (sequential) consistency write(x, 1) write(x, 2)

2 / 28

SLIDE 8

Geo-Replicated Data Structures

Tolerating faults while preserving availability leads to anomalies w.r.t. strong (sequential) consistency write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 1 read(x) ◮ 2 Updates are seen in different orders

2 / 28

SLIDE 9

Goal: Verifying Causal Consistency

The set of allowed anomalies are defined by weak consistency criteria, e.g., eventual consistency, causal consistency. Algorithmic methods for checking causal consistency. Single-Trace Verification: Check if one trace is causally consistent Application to testing, monitoring (by enumerating traces) All-Traces Verification: Check if all traces are causally consistent Static verification

3 / 28

SLIDE 10

Comparison with other Consistency Criteria

Single-Trace Verification: NP-complete for most consistency criteria2

3Memory Model-aware Testing. Furbach et al. 2014. 4Model-Checking of Correctness Conditions. Alur et al. 1996. 5On the complexity of linearizability. H. 2015. 6Verifying Eventual Consistency of ORS. Bouajjani et al. 2014.

4 / 28

SLIDE 11

Comparison with other Consistency Criteria

Single-Trace Verification: NP-complete for most consistency criteria2 NP-complete for causal consistency as well

3Memory Model-aware Testing. Furbach et al. 2014. 4Model-Checking of Correctness Conditions. Alur et al. 1996. 5On the complexity of linearizability. H. 2015. 6Verifying Eventual Consistency of ORS. Bouajjani et al. 2014.

4 / 28

SLIDE 12

Comparison with other Consistency Criteria

Single-Trace Verification: NP-complete for most consistency criteria2 NP-complete for causal consistency as well All-Traces Verification: EXPSPACE-complete for linearizability3,4

Causal consistency. ??

Linearizability. EXPSPACE-complete.3,4

3Memory Model-aware Testing. Furbach et al. 2014. 4Model-Checking of Correctness Conditions. Alur et al. 1996. 5On the complexity of linearizability. H. 2015. 6Verifying Eventual Consistency of ORS. Bouajjani et al. 2014.

4 / 28

SLIDE 13

Comparison with other Consistency Criteria

Single-Trace Verification: NP-complete for most consistency criteria2 NP-complete for causal consistency as well All-Traces Verification: EXPSPACE-complete for linearizability3,4 Undecidable for sequential consistency5,6

Causal consistency. ?? Sequential consistency. Undecidable.1

Linearizability. EXPSPACE-complete.3,4

3Memory Model-aware Testing. Furbach et al. 2014. 4Model-Checking of Correctness Conditions. Alur et al. 1996. 5On the complexity of linearizability. H. 2015. 6Verifying Eventual Consistency of ORS. Bouajjani et al. 2014.

4 / 28

SLIDE 14

Comparison with other Consistency Criteria

Single-Trace Verification: NP-complete for most consistency criteria2 NP-complete for causal consistency as well All-Traces Verification: EXPSPACE-complete for linearizability3,4 Undecidable for sequential consistency5,6 Decidable for eventual consistency7

Eventual consistency. Decidable.5 Causal consistency. ?? Sequential consistency. Undecidable.1

Linearizability. EXPSPACE-complete.3,4

3Memory Model-aware Testing. Furbach et al. 2014. 4Model-Checking of Correctness Conditions. Alur et al. 1996. 5On the complexity of linearizability. H. 2015. 6Verifying Eventual Consistency of ORS. Bouajjani et al. 2014.

4 / 28

SLIDE 15

Comparison with other Consistency Criteria

Single-Trace Verification: NP-complete for most consistency criteria2 NP-complete for causal consistency as well All-Traces Verification: EXPSPACE-complete for linearizability3,4 Undecidable for sequential consistency5,6 Decidable for eventual consistency7 Undecidable for causal consistency

Eventual consistency. Decidable.5 Causal consistency. Undecidable. Sequential consistency. Undecidable.1

Linearizability. EXPSPACE-complete.3,4

3Memory Model-aware Testing. Furbach et al. 2014. 4Model-Checking of Correctness Conditions. Alur et al. 1996. 5On the complexity of linearizability. H. 2015. 6Verifying Eventual Consistency of ORS. Bouajjani et al. 2014.

4 / 28

SLIDE 16

What About Usual Data Structures?

Key-value store (read/write operations):

ne of the simplest and most widely used data structures.

5 / 28

SLIDE 17

What About Usual Data Structures?

Key-value store (read/write operations):

ne of the simplest and most widely used data structures.

Theorem (All-Traces Verification) Checking if all traces of an implementation are causally consistent is undecidable.

5 / 28

SLIDE 18

What About Usual Data Structures?

Key-value store (read/write operations):

ne of the simplest and most widely used data structures.

Theorem (All-Traces Verification) Checking if all traces of an implementation are causally consistent is undecidable. Even with the following restrictions: For key-value stores For a bounded number of sites For finite-state implementations For a bounded number of variables For a bounded variables’ domain

5 / 28

SLIDE 19

What About Usual Data Structures?

Key-value store (read/write operations):

ne of the simplest and most widely used data structures.

Theorem (All-Traces Verification) Checking if all traces of an implementation are causally consistent is undecidable. Even with the following restrictions: For key-value stores For a bounded number of sites For finite-state implementations For a bounded number of variables For a bounded variables’ domain (Input: finite-state automaton representing all traces)

5 / 28

SLIDE 20

Key Observation: Implementations Are Data Independent

Key-value store implementations are data independent The behaviors do not depend on the particular values stored in the KVS.

6 / 28

SLIDE 21

Key Observation: Implementations Are Data Independent

Key-value store implementations are data independent The behaviors do not depend on the particular values stored in the KVS. ⇒ Writes can be assumed to be unique

6 / 28

SLIDE 22

Results: Causal Consistency Violations Using Bad Patterns

Bad Pattern: A set of operations related in a particular way

7 / 28

SLIDE 23

Results: Causal Consistency Violations Using Bad Patterns

Bad Pattern: A set of operations related in a particular way Identify a set of bad patterns X such that: Theorem (Bad Patterns) A trace is not causally consistent iff it contains some bad pattern from X

7 / 28

SLIDE 24

Results: Causal Consistency Violations Using Bad Patterns

Bad Pattern: A set of operations related in a particular way Identify a set of bad patterns X such that: Theorem (Bad Patterns) A trace is not causally consistent iff it contains some bad pattern from X X contains 4-6 bad patterns

7 / 28

SLIDE 25

Results: Complexity/Decidability and Reduction to Reachability

Bad patterns implications for data-independent implementations: Theorem (Single-Trace Verification) Singe-Trace Verification of causal consistency is polynomial when writes are unique.

8 / 28

SLIDE 26

Results: Complexity/Decidability and Reduction to Reachability

Bad patterns implications for data-independent implementations: Theorem (Single-Trace Verification) Singe-Trace Verification of causal consistency is polynomial when writes are unique. Theorem (Reduction to Reachability) All-Traces Verification can be reduced to reachability or invariant checking. (by building a monitor (state machine) M that tracks bad patterns)

8 / 28

SLIDE 27

Results: Complexity/Decidability and Reduction to Reachability

Bad patterns implications for data-independent implementations: Theorem (Single-Trace Verification) Singe-Trace Verification of causal consistency is polynomial when writes are unique. Theorem (Reduction to Reachability) All-Traces Verification can be reduced to reachability or invariant checking. (by building a monitor (state machine) M that tracks bad patterns) Theorem (All-Traces Verification) Checking whether all traces of a data-independent finite-state implementation are causally consistent is decidable.

8 / 28

SLIDE 28

Outline

Definition(s) of causal consistency

9 / 28

SLIDE 29

Outline

Definition(s) of causal consistency Characterize all causal consistency violations using bad patterns

9 / 28

SLIDE 30

Outline

Definition(s) of causal consistency Characterize all causal consistency violations using bad patterns Using bad patterns for verifying data-independent implementations

Single-Trace Verification: polynomial time Bad patterns can be recognized with state machines Generic reduction from causal consistency to reachability All-Traces Verification: decidable

9 / 28

SLIDE 31

Outline

Definition(s) of causal consistency Characterize all causal consistency violations using bad patterns Using bad patterns for verifying data-independent implementations

Single-Trace Verification: polynomial time Bad patterns can be recognized with state machines Generic reduction from causal consistency to reachability All-Traces Verification: decidable

9 / 28

SLIDE 32

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

10 / 28

SLIDE 33

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 34

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 35

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 36

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 37

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 38

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 39

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 40

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

write(x, 1) write(x, 2) write(x, 1) write(x, 2) read(x) ◮ 2 read(x) ◮ 1 There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 41

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 42

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Definition of Causal Consistency

write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

program order

write(x, 1) write(x, 2) write(x, 1) write(x, 2) read(x) ◮ 2 read(x) ◮ 1 There exists a causality order CO such that the causal past of every read can explain its value CO includes the program (site) order

10 / 28

SLIDE 43

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Causal Consistency Violations

Causally related writes must be seen by all sites in the same order. write(x, 1) read(x) ◮ 1 write(x, 2) write(y, 3)

11 / 28

SLIDE 44

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Causal Consistency Violations

Causally related writes must be seen by all sites in the same order. write(x, 1) read(x) ◮ 1 write(x, 2) write(y, 3) read(y) ◮ 3

11 / 28

SLIDE 45

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Causal Consistency Violations

Causally related writes must be seen by all sites in the same order. write(x, 1) read(x) ◮ 1 write(x, 2) write(y, 3) read(y) ◮ 3 read(x) ◮ 1

11 / 28

SLIDE 46

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Formalizing Causal Consistency

Specification = a set of sequences of operations write(x, 1) · write(y, 2) · read(x) ◮ 1 · read(y) ◮ 2

12 / 28

SLIDE 47

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Formalizing Causal Consistency

Specification = a set of sequences of operations write(x, 1) · write(y, 2) · read(x) ◮ 1 · read(y) ◮ 2 A history h = (O, PO) is causally consistent w.r.t. a specification S iff there exists a strict partial order CO s.t.

12 / 28

SLIDE 48

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Formalizing Causal Consistency

Specification = a set of sequences of operations write(x, 1) · write(y, 2) · read(x) ◮ 1 · read(y) ◮ 2 A history h = (O, PO) is causally consistent w.r.t. a specification S iff there exists a strict partial order CO s.t. AxCausal : PO ⊆ CO

12 / 28

SLIDE 49

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Formalizing Causal Consistency

Specification = a set of sequences of operations write(x, 1) · write(y, 2) · read(x) ◮ 1 · read(y) ◮ 2 A history h = (O, PO) is causally consistent w.r.t. a specification S iff there exists a strict partial order CO s.t. AxCausal : PO ⊆ CO AxCausalValue : ∀o ∈ O. CausalPast(CO, o) ⊑ S

12 / 28

SLIDE 50

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Formalizing Causal Consistency

Specification = a set of sequences of operations write(x, 1) · write(y, 2) · read(x) ◮ 1 · read(y) ◮ 2 A history h = (O, PO) is causally consistent w.r.t. a specification S iff there exists a strict partial order CO s.t. AxCausal : PO ⊆ CO AxCausalValue : ∀o ∈ O. CausalPast(CO, o) ⊑ S

(CausalPast(CO, o) = the restriction of CO to CO−1(o) ∪ {o}

CO

CausalPast(CO, o)

12 / 28

SLIDE 51

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Formalizing Causal Consistency

Specification = a set of sequences of operations write(x, 1) · write(y, 2) · read(x) ◮ 1 · read(y) ◮ 2 A history h = (O, PO) is causally consistent w.r.t. a specification S iff there exists a strict partial order CO s.t. AxCausal : PO ⊆ CO AxCausalValue : ∀o ∈ O. CausalPast(CO, o) ⊑ S

(CausalPast(CO, o) = the restriction of CO to CO−1(o) ∪ {o}

CO

CausalPast(CO, o)

⊑ means “can be linearized to”)

12 / 28

SLIDE 52

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Causal Convergence8

Conflicts are resolved using a global arbitration order Strong eventual consistency: If two sites see the same writes, they are in the same state7

7A comprehensive study of CRDTs. 2011. Shapiro et al. 8Understanding Eventual Consistency. Burckhardt et al. 2013.

13 / 28

SLIDE 53

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Causal Convergence8

Conflicts are resolved using a global arbitration order Strong eventual consistency: If two sites see the same writes, they are in the same state7 Not allowed by causal convergence: write(x, 1) write(x, 2) read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2 read(x) ◮ 1

7A comprehensive study of CRDTs. 2011. Shapiro et al. 8Understanding Eventual Consistency. Burckhardt et al. 2013.

13 / 28

SLIDE 54

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Causal Convergence

A history h = (O, PO) is causally convergent w.r.t. a specification S iff there exists a strict partial order CO and a strict total order ARB (arbitration) s.t.

14 / 28

SLIDE 55

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Causal Convergence

A history h = (O, PO) is causally convergent w.r.t. a specification S iff there exists a strict partial order CO and a strict total order ARB (arbitration) s.t. AxCausal : PO ⊆ CO AxArb : CO ⊆ ARB AxCausalArb : ∀o ∈ O. CausalPast(CO, o) ⊕ ARB ∈ S

(CausalPast(CO, o) = the restriction of CO to CO−1(o) ∪ {o} “⊕ ARB” means adding the constraints in ARB)

14 / 28

SLIDE 56

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Satisfying Causal Convergence

write(x, 1) write(x, 2)

ARB

read(x) ◮ 1 read(x) ◮ 1 read(x) ◮ 2 read(x) ◮ 2

15 / 28

SLIDE 57

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Satisfying Causal Convergence but not Sequential Consistency

write(x, 1) read(y) ◮ 0 write(y, 1) read(x) ◮ 0

16 / 28

SLIDE 58

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Causal Consistency

Different Notions of Causal Consistency

Eventual consistency Causal memory Causal convergence Causal consistency Sequential consistency

Causal memory = Causal consistency + local arbitration

17 / 28

SLIDE 59

Outline

Definition(s) of causal consistency Characterize all causal consistency violations using bad patterns Using bad patterns for verifying data-independent implementations

Single-Trace Verification: polynomial time Bad patterns can be recognized with state machines Generic reduction from causal consistency to reachability All-Traces Verification: decidable

17 / 28

SLIDE 60

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Data Independent Implementations

Observation: Written values do not influence behaviors. ⇒ We can assume written values are unique.

18 / 28

SLIDE 61

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Data Independent Implementations

Observation: Written values do not influence behaviors. ⇒ We can assume written values are unique. write(x, 1) write(x, 2) write(x, 3) write(x, 4) read(x) ◮ 3

18 / 28

SLIDE 62

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Data Independent Implementations

Observation: Written values do not influence behaviors. ⇒ We can assume written values are unique. write(x, 1) write(x, 2) write(x, 3) write(x, 4) read(x) ◮ 3

18 / 28

SLIDE 63

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Data Independent Implementations

Observation: Written values do not influence behaviors. ⇒ We can assume written values are unique. write(x, 1) write(x, 2) write(x, 3) write(x, 4) read(x) ◮ 3 Unicity of writes implies a canonical causality relation (included in every other causality relation).

18 / 28

SLIDE 64

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Bad Patterns to Characterize Violations

Bad pattern: set of operations related is a particular way

19 / 28

SLIDE 65

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Bad Patterns to Characterize Violations

Bad pattern: set of operations related is a particular way Defined using the following orders: PO (program order): connects operations from the same site

19 / 28

SLIDE 66

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Bad Patterns to Characterize Violations

Bad pattern: set of operations related is a particular way Defined using the following orders: PO (program order): connects operations from the same site RF (reads-from relation): connects write to read

19 / 28

SLIDE 67

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Bad Patterns to Characterize Violations

Bad pattern: set of operations related is a particular way Defined using the following orders: PO (program order): connects operations from the same site RF (reads-from relation): connects write to read CO (causal order): defined as (PO ∪ RF)+

19 / 28

SLIDE 68

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Bad Pattern for Causal Consistency: WriteCORead

Two writes w1 and w2, and one read r1 on the same variable:

r1 reads-from w1 w1 <CO w2 <CO r1

20 / 28

SLIDE 69

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Bad Pattern for Causal Consistency: WriteCORead

Two writes w1 and w2, and one read r1 on the same variable:

r1 reads-from w1 w1 <CO w2 <CO r1

Example: write(x, 1) write(y, 2) read(y) ◮ 2 write(x, 2) read(x) ◮ 2 read(x) ◮ 1

20 / 28

SLIDE 70

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

WriteCORead: Litmus tests

w1 <PO w2 <PO r1: write(x, 1) write(x, 2) read(x) ◮ 1

21 / 28

SLIDE 71

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

WriteCORead: Litmus tests

w1 <PO w2 <PO r1: write(x, 1) write(x, 2) read(x) ◮ 1 w1 <PO w2 <CO r1: write(x, 1) read(y) ◮ 3 write(x, 2) || read(x) ◮ 1 write(y, 3)

21 / 28

SLIDE 72

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

WriteCORead: Litmus tests

w1 <PO w2 <PO r1: write(x, 1) write(x, 2) read(x) ◮ 1 w1 <PO w2 <CO r1: write(x, 1) read(y) ◮ 3 write(x, 2) || read(x) ◮ 1 write(y, 3) w1 <CO w2 <PO r1: write(x, 1) read(y) ◮ 3 write(y, 3) || write(x, 2) read(x) ◮ 1 w1 <CO w2 <CO r1: write(x, 1) read(y) ◮ 3 read(z) ◮ 4 write(y, 3) || write(x, 2) || read(x) ◮ 1 write(z, 4)

21 / 28

SLIDE 73

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Bad Patterns for Causal Consistency

WriteCORead: two writes w1 and w2, and one read r1 on some x s.t.

r1 reads-from w1 w1 <CO w2 <CO r1

CyclicCO: CO = (PO ∪ RF)+ is cyclic ThinAir: a read operation r = read(x) ◮ v with v = 0 s.t.

w <RF r for every write w

WriteCOInit: a read operation r = read(x) ◮ 0 s.t.

w <CO r for some write w on x

22 / 28

SLIDE 74

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Bad Patterns for Causal Consistency Variants

Causal Consistency Causal Memory Causal Convergence CyclicCO CyclicCO CyclicCO WriteCOInitRead WriteCOInitRead WriteCOInitRead ThinAirRead ThinAirRead ThinAirRead WriteCORead WriteCORead WriteCORead WriteHBInitRead CyclicCF CyclicHB

23 / 28

SLIDE 75

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Data Independent Implementations Bad Patterns

Bad Patterns for Causal Consistency Variants

Causal Consistency Causal Memory Causal Convergence CyclicCO CyclicCO CyclicCO WriteCOInitRead WriteCOInitRead WriteCOInitRead ThinAirRead ThinAirRead ThinAirRead WriteCORead WriteCORead WriteCORead WriteHBInitRead CyclicCF CyclicHB Theorem (Bad Patterns) A trace doesn’t satisfy the criterion X iff it contains a bad pattern for X.

23 / 28

SLIDE 76

Outline

Definition(s) of causal consistency Characterize all causal consistency violations using bad patterns Using bad patterns for verifying data-independent implementations

Single-Trace Verification: polynomial time Bad patterns can be recognized with state machines Generic reduction from causal consistency to reachability All-Traces Verification: decidable

23 / 28

SLIDE 77

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

Polynomial-Time Single-Trace Verification

Theorem (Single-Trace Verification) Singe-Trace Verification of causal consistency is NP-complete.

24 / 28

SLIDE 78

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

Polynomial-Time Single-Trace Verification

Theorem (Single-Trace Verification) Singe-Trace Verification of causal consistency is NP-complete. Theorem (Single-Trace Verification) Singe-Trace Verification of causal consistency is polynomial when writes are unique. (By checking the absence of bad patterns.)

24 / 28

SLIDE 79

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

Recognizing Bad Patterns with Register Automata

By data independence, we can use a bounded number of values Registers are needed to store variable names while tracking causality paths WriteCORead:

q1 CausalPath [d → 3] CausalPath [d → 4] qerr p, wr(x, 1) wit := x var := x site := p p, wr(x, 2) wit == x var := x site == p p, rd(x) ◮ 1 wit == x site == p

25 / 28

SLIDE 80

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

Recognizing Bad Patterns with Register Automata

By data independence, we can use a bounded number of values Registers are needed to store variable names while tracking causality paths WriteCORead:

q1 CausalPath [d → 3] CausalPath [d → 4] qerr p, wr(x, 1) wit := x var := x site := p p, wr(x, 2) wit == x var := x site == p p, rd(x) ◮ 1 wit == x site == p

CausalPath tracks alternations

f PO and RF

qb qa p, rd(x) ◮ d site := p var == x p, wr(x, d) var := x site == p

CausalPath

25 / 28

SLIDE 81

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

Recognizing Bad Patterns with Register Automata

By data independence, we can use a bounded number of values Registers are needed to store variable names while tracking causality paths WriteCORead:

q1 CausalPath [d → 3] CausalPath [d → 4] qerr p, wr(x, 1) wit := x var := x site := p . . . 5 . . . 5 . . . 5 p, wr(x, 2) wit == x var := x site == p p, rd(x) ◮ 1 wit == x site == p

CausalPath tracks alternations

f PO and RF

qb qa p, rd(x) ◮ d site := p var == x p, wr(x, d) var := x site == p

CausalPath

. . . 5 . . . 5

25 / 28

SLIDE 82

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

(PTime) Reduction to Reachability/Invariant Checking

Machine M tracking all bad patterns. Theorem (Reduction to Reachability) An implementation I is causally consistent iff I × M cannot reach an error state.

26 / 28

SLIDE 83

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

(PTime) Reduction to Reachability/Invariant Checking

Machine M tracking all bad patterns. Theorem (Reduction to Reachability) An implementation I is causally consistent iff I × M cannot reach an error state. Holds for any data-independent implementation

26 / 28

SLIDE 84

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

(PTime) Reduction to Reachability/Invariant Checking

Machine M tracking all bad patterns. Theorem (Reduction to Reachability) An implementation I is causally consistent iff I × M cannot reach an error state. Holds for any data-independent implementation Reuse of existing tools that solve reachability

26 / 28

SLIDE 85

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

(PTime) Reduction to Reachability/Invariant Checking

Machine M tracking all bad patterns. Theorem (Reduction to Reachability) An implementation I is causally consistent iff I × M cannot reach an error state. Holds for any data-independent implementation Reuse of existing tools that solve reachability Manual or semi-automated proofs

26 / 28

SLIDE 86

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

All-Traces Verification

Setting: Finite number of finite-state sites. (All traces are modelled by a finite-state automaton)

27 / 28

SLIDE 87

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

All-Traces Verification

Setting: Finite number of finite-state sites. (All traces are modelled by a finite-state automaton) Theorem (All-Traces Verification) Checking whether all traces of a finite-state implementation are causally consistent is undecidable.

27 / 28

SLIDE 88

Definitions of Causal Consistency Characterization of Causal Consistency using Bad Patterns Using Bad Patterns for Verification Application to Single-Trace Verification Application to All-Traces Verification

All-Traces Verification

Setting: Finite number of finite-state sites. (All traces are modelled by a finite-state automaton) Theorem (All-Traces Verification) Checking whether all traces of a finite-state implementation are causally consistent is undecidable. Theorem (All-Traces Verification) Checking whether all traces of a data-independent finite-state implementation are causally consistent is decidable.

27 / 28

SLIDE 89

Summary and Future Work

Summary: Difficult to verify causal consistency in general (Single-Trace: NP-complete, All-Traces: Undecidable)

28 / 28

SLIDE 90

Summary and Future Work

Summary: Difficult to verify causal consistency in general (Single-Trace: NP-complete, All-Traces: Undecidable) Bad patterns for data-independent implementations

28 / 28

SLIDE 91

Summary and Future Work

Summary: Difficult to verify causal consistency in general (Single-Trace: NP-complete, All-Traces: Undecidable) Bad patterns for data-independent implementations

Single-Trace: PTime, All-Traces: Decidable

28 / 28

SLIDE 92

Summary and Future Work

Summary: Difficult to verify causal consistency in general (Single-Trace: NP-complete, All-Traces: Undecidable) Bad patterns for data-independent implementations

Single-Trace: PTime, All-Traces: Decidable Polynomial-time reduction to reachability: approach for verifying causal consistency

28 / 28

SLIDE 93

Summary and Future Work

Summary: Difficult to verify causal consistency in general (Single-Trace: NP-complete, All-Traces: Undecidable) Bad patterns for data-independent implementations

Single-Trace: PTime, All-Traces: Decidable Polynomial-time reduction to reachability: approach for verifying causal consistency

Future work: Bad patterns for other criteria (FIFO consistency, . . . ) for other specifications (Multi-Value Register, CRDTs, . . . )

28 / 28

SLIDE 94

Summary and Future Work

Summary: Difficult to verify causal consistency in general (Single-Trace: NP-complete, All-Traces: Undecidable) Bad patterns for data-independent implementations

Single-Trace: PTime, All-Traces: Decidable Polynomial-time reduction to reachability: approach for verifying causal consistency

Future work: Bad patterns for other criteria (FIFO consistency, . . . ) for other specifications (Multi-Value Register, CRDTs, . . . ) Application to existing causally consistent systems to prove their correctness (or find bugs)

28 / 28

SLIDE 95

Summary and Future Work

Summary: Difficult to verify causal consistency in general (Single-Trace: NP-complete, All-Traces: Undecidable) Bad patterns for data-independent implementations

Single-Trace: PTime, All-Traces: Decidable Polynomial-time reduction to reachability: approach for verifying causal consistency

Future work: Bad patterns for other criteria (FIFO consistency, . . . ) for other specifications (Multi-Value Register, CRDTs, . . . ) Application to existing causally consistent systems to prove their correctness (or find bugs) Thank you

28 / 28