[Paper Review] A Proof of Correctness for the Tardis Cache Coherence Protocol

Xiangyao Yu, Muralidaran Vijayaraghavan+1 more|arXiv (Cornell University)|May 24, 2015

Parallel Computing and Optimization Techniques24 references9 citations

TL;DR

This paper presents a formal proof of correctness for the Tardis cache coherence protocol, demonstrating that it enforces sequential consistency, is deadlock- and livelock-free, and scales efficiently with O(log N) storage per cacheline. The protocol uses logical timestamps instead of full sharer maps, simplifying coherence management and enabling scalable, provably correct operation in large-scale multicore systems.

ABSTRACT

We prove the correctness of a recently-proposed cache coherence protocol, Tardis, which is simple, yet scalable to high processor counts, because it only requires O(logN) storage per cacheline for an N-processor system. We prove that Tardis follows the sequential consistency model and is both deadlock- and livelock-free. Our proof is based on simple and intuitive invariants of the system and thus applies to any system scale and many variants of Tardis.

Motivation & Objective

• To formally prove that the Tardis cache coherence protocol enforces sequential consistency across all executions.
• To establish that Tardis is free from deadlock and livelock, ensuring reliable operation at scale.
• To provide a simple, intuitive invariant-based proof technique that generalizes across protocol variants and system scales.
• To verify correctness of Tardis in systems with main memory, extending the base protocol to realistic shared memory architectures.
• To offer a formal verification method that is more scalable and intuitive than model checking or traditional protocol proofs.

Proposed method

• The authors define a formal model of the Tardis protocol using system components such as L1 and L2 caches, message buffers, and state transitions.
• They introduce logical timestamps (rts and wts) to order memory operations, replacing traditional sharer tracking with timestamp-based ordering.
• The proof relies on three key invariants: (1) timestamp monotonicity, (2) correct ordering of loads and stores, and (3) consistency of main memory state via mts (maximum timestamp).
• The protocol is extended to include main memory operations, with a special mts variable to track the latest timestamp of any cached or main memory block.
• The correctness proof is conducted inductively over system transitions, using lemmas to verify invariants after each state change.
• The proof technique is generalized to handle variants of Tardis, including optimizations and extensions to main memory systems.

Experimental results

Research questions

• RQ1 Does the Tardis protocol enforce sequential consistency across all possible execution sequences?
• RQ2 Can the Tardis protocol be proven deadlock- and livelock-free using a formal, scalable method?
• RQ3 How can the correctness of Tardis be extended to systems that include main memory and persistent storage?
• RQ4 Can the proof technique be generalized to other variants of Tardis without losing simplicity or correctness?
• RQ5 Is the invariant-based proof approach more scalable and intuitive than model checking or traditional protocol verification?

Key findings

• The Tardis protocol correctly enforces sequential consistency by using logical timestamps to order all memory operations, ensuring correct global memory ordering.
• The protocol is provably deadlock-free and livelock-free, as shown by invariants that prevent circular dependencies and infinite message loops.
• The protocol scales efficiently with O(log N) storage per cacheline, significantly reducing directory overhead compared to O(N) full-map protocols.
• The introduction of mts (maximum timestamp) ensures correct ordering of blocks loaded from main memory, preserving consistency in the presence of persistent storage.
• The proof technique based on simple, intuitive invariants is more scalable and practical than model checking for large-scale systems.
• The correctness of Tardis with main memory is formally established by extending the invariants and proving their preservation through induction on system transitions.