Safety of Deferred Update
in Transactional Memory

Resolving conflicts in an efficient and consistent manner is the most challenging task in concurrent software design. Transactional memory (TM) [11, 18] addresses this challenge by offering an interface in which sequences of shared-memory instructions can be declared as speculative transactions. The underlying idea, borrowed from databases, is to treat each transaction as an atomic event: a transaction may either commit in which case it appears as executed sequentially, or abort in which case none of its update instructions affect other transactions. The user can therefore design software having only sequential semantics in mind and let the memory take care of conflicts resulting from potentially concurrent executions.

In databases, a correct implementation of concurrency control should guarantee that committed transactions constitute a serial (or sequential) execution [9]. On the other hand, uncommitted transactions can be aborted without invalidating the correctness of committed ones. (In the literature on databases, the latter feature is called recoverability.)

In the TM context, intermediate states witnessed by an incomplete transaction may affect the application through the outcome of its read operations. If the intermediate state is not consistent with any sequential execution, the application may experience a fatal irrecoverable error or sink in an infinite loop. The correctness criterion of opacity [7, 8] addresses this issue by requiring the states observed by uncommitted transactions to be consistent with a global serial execution constituted by committed ones (a serialization).

An opaque TM implementation must, intuitively, ensure that no transaction can read from a transaction that has not started committing yet. This is usually referred to as the deferred-update semantics, and it was in fact explicitly required in some representations of opacity [6]. The motivation of this paper is to capture this intuition formally.

We present a new correctness criterion called du-opacity. Informally, a du-opaque (possibly, non-serial) execution must be indistinguishable from a totally-ordered execution, with respect to which no transaction reads from a transaction that has not started committing.

We further check if our correctness criterion is a safety property, as defined by Owicki and Lamport [17], Alpern and Schneider [2] and refined by Lynch [16]. We show that du-opacity is prefix-closed: every prefix of a du-opaque history is also du-opaque. We also show that du-opacity is, under certain restrictions, limit-closed. More precisely, assuming that, in an infinite execution, every transaction completes each of the operations it invoked (but possibly neither commits nor aborts), the infinite limit of any sequence of ever extending du-opaque histories is also du-opaque. To prove that such an implementation is du-opaque, it is thus sufficient to prove that all its finite histories are du-opaque. To the best of our knowledge, this paper contains the first non-trivial proof of limit-closure for a TM correctness property. We further show that any du-opaque serialization of a history implies a serialization of any of its prefixes that maintains the original read-from relations, which is instrumental in the comparison of du-opacity with opacity.

Opacity, as defined in [8], reduces correctness of an infinite history to correctness of all its prefixes, and thus is limit-closed by definition. In fact, we show that extending opacity to infinite histories in a non-trivial way (i.e., requiring that even infinite histories should have proper serializations), does not result in a limit-closed property. We observe that opacity does not preclude scenarios in which a transaction reads from a future transaction (cf. example in Figure 4), and, thus, our criterion is strictly stronger than opacity. Surprisingly, this is true even if we assume that all transactional operations are atomic, which somewhat attenuates earlier attempts to forcefully introduce the deferred-update in the definition of opacity for atomic operations [6]. However, we show that opacity and du-opacity are equivalent if we assume that no two transactions try to commit identical values on the same data item.

We believe that these results improve our understanding of the very notion of correctness in transactional memory. Our correctness criterion explicitly declares that a transaction is not allowed to read from a transaction that has not started committing yet, and we conjecture that it is simpler to verify. We present the first non-trivial proof for both limit- and prefix-closure of TM histories, which is quite interesting in its own right, for it enables reasoning about possible serializations of an infinite TM history based on serializations of its prefixes.

The paper is organized as follows. In Section 2, we introduce our basic model definitions and recall the notion of safety [17, 2, 16]. In Section 3, we define our criterion of du-opacity and show that it is prefix-closed and under certain restrictions, a limit-closed property. In Section 4, we prove that du-opacity is a proper subset of the original notion of opacity [8], and that it coincides with du-opacity under the “unique-writes” condition.

A transactional memory (in short, TM) supports atomic transactions for reading and writing on a set of transactional objects (in short, t-objects). A transaction is a sequence of accesses (reads or writes) to t-objects; each transaction $T_{k}$ has a unique identifier $k$.

A transaction $T_{k}$ may contain the following t-operations, each being a matching pair of invocation and response events:

1. 1.

   read${}_{k}(X)$ returns a value in some domain $V$ or a special value $A_{k}\notin V$ (abort);

2. 2.

   write${}_{k}(X,v)$, for a value $v\in V$, returns ok_k or $A_{k}$;

3. 3.

   tryC_k returns $C_{k}\notin V$ (commit) or $A_{k}$; and

4. 4.

   tryA_k returns $A_{k}$.

The read set (resp., the write set) of a transaction $T_{k}$, denoted $\textit{Rset}(T_{k})$, is the set of t-objects that $T_{k}$ reads in $H$; the write set of $T_{k}$, denoted $\textit{Wset}(T_{k})$, is the set of t-objects $T_{k}$ writes to in $H$.

We consider an asynchronous shared-memory system in which processes communicate via transactions. A TM implementation provides processes with algorithms for implementing $\textit{read}_{k}$, $\textit{write}_{k}$, $\textit{tryC}_{k}()$ and $\textit{tryA}_{k}()$ of a transaction $T_{k}$.

A history of a TM implementation is a (possibly infinite) sequence of invocation and response events of t-operations.

For every transaction identifier $k$, $H|k$ denotes the subsequence of $H$ restricted to events of transaction $T_{k}$. If $H|k$ is non-empty, we say that $T_{k}$ participates in $H$, and let $\textit{txns}(H)$ denote the set of transactions that participate in $H$. In an infinite history $H$, we assume that each $T_{k}\in\textit{txns}(H)$, $H|k$ is finite; i.e., transactions do not issue an infinite number of t-operations.

Two histories $H$ and $H^{\prime}$ are equivalent if $\textit{txns}(H)=\textit{txns}(H^{\prime})$ and for every transaction $T_{k}\in\textit{txns}(H)$, $H|k=H^{\prime}|k$.

A history $H$ is sequential if every invocation of a t-operation is either the last event in $H$ or is immediately followed by a matching response.

A history is well-formed if for all $T_{k}$, $H|k$ is sequential and has no events after $A_{k}$ or $C_{k}$. We assume that all histories are well-formed, i.e., the client of the transactional memory never invokes a t-operation before receiving a response from the previous one and does not invoke any t-operation $op_{k}$ after receiving $C_{k}$ or $A_{k}$. We also assume, for simplicity, that the client invokes a $\textit{read}_{k}(X)$ at most once within a transaction $T_{k}$. This assumption incurs no loss of generality, since a repeated read can be assigned to return a previously returned value without affecting the history’s correctness.

A transaction $T_{k}\in\textit{txns}(H)$ is complete in $H$ if $H|k$ ends with a response event. The history $H$ is complete if all transactions in $\textit{txns}(H)$ are complete in $H$.

A transaction $T_{k}\in\textit{txns}(H)$ is t-complete if $H|k$ ends with $A_{k}$ or $C_{k}$; otherwise, $T_{k}$ is t-incomplete. $T_{k}$ is committed (resp., aborted) in $H$ if the last event of $T_{k}$ is $C_{k}$ (resp., $A_{k}$). The history $H$ is t-complete if all transactions in $\textit{txns}(H)$ are t-complete.

For t-operations $op_{k},op_{j}$, we say that $op_{k}$ precedes $op_{j}$ in the real-time order of $H$, denoted $op_{k}\prec_{H}^{RT}op_{m}$, if the response of $op_{k}$ precedes the invocation of $op_{j}$.

Similarly, for transactions $T_{k},T_{m}\in\textit{txns}(H)$, we say that $T_{k}$ precedes $T_{m}$ in the real-time order of $H$, denoted $T_{k}\prec_{H}^{RT}T_{m}$, if $T_{k}$ is t-complete in $H$ and the last event of $T_{k}$ precedes the first event of $T_{m}$ in $H$. If neither $T_{k}\prec_{H}^{RT}T_{m}$ nor $T_{m}\prec_{H}^{RT}T_{k}$, then $T_{k}$ and $T_{m}$ overlap in $H$. A history $H$ is t-sequential if there are no overlapping transactions in $H$.

For simplicity of presentation, we assume that each history $H$ begins with an “imaginary” transaction $T_{0}$ that writes initial values to all t-objects and commits before any other transaction begins in $H$.

Let $H$ be a t-sequential history. For every operation $\textit{read}_{k}(X)$ in $H$, we define the latest written value of $X$ as follows:

1. 1.

   If $T_{k}$ contains a $\textit{write}_{k}(X,v)$ preceding $\textit{read}_{k}(X)$, then the latest written value of $X$ is the value of the latest such write to $X$.

2. 2.

   Otherwise, if $H$ contains a $\textit{write}_{m}(X,v)$, $T_{m}$ precedes $T_{k}$, and $T_{m}$ commits in $H$, then the latest written value of $X$ is the value of the latest such write to $X$ in $H$. (This write is well-defined since $H$ starts with $T_{0}$ writing to all t-objects.)

We say that $\textit{read}_{k}(X)$ is legal in a t-sequential history $H$ if it returns the latest written value of $X$, and $H$ is legal if every $\textit{read}_{k}(X)$ in $H$ that does not return $A_{k}$ is legal in $H$.

Notice that the set of histories produced by a TM implementation $M$ is prefix-closed. Therefore, every infinite history of $M$ is the limit of an infinite sequence of ever-extending finite histories of $M$. Thus, to prove that $M$ satisfies a safety property $P$, it is enough to show that all finite histories of $M$ are in $P$. Indeed, limit-closure of $P$ then implies that every infinite history of $M$ is also in $P$.

In this section, we introduce our correctness criterion, du-opacity, and prove that a restriction of it is a limit-closed property.

Let $H$ be any history and $S$ be a legal t-complete t-sequential history that is equivalent to some completion of $H$. Let $<_{S}$ be the total order on transactions in $S$.

For any $\textit{read}_{k}(X)$ that does not return $A_{k}$, let $S^{k,X}$ denote the prefix of $S$ up to the response of $\textit{read}_{k}(X)$ and $H^{k,X}$ denotes the prefix of $H$ up to the response of $\textit{read}_{k}(X)$. Let $S_{H}^{k,X}$ denote the subsequence of $S^{k,X}$ derived by removing from $S^{k,X}$ the events of all transactions $T_{m}\in\textit{txns}(H)$ such that $H^{k,X}$ does not contain an invocation of $\textit{tryC}_{m}()$. We refer to $S_{H}^{k,X}$ as the local serialization for $\textit{read}_{k}(X)$ with respect to $H$ and $S$.

We are now ready to present our correctness condition, du-opacity.

Informally, a history $H$ is du-opaque if there exists a legal t-sequential history $S$ that is equivalent to $H$, respects the real-time ordering of transactions in $H$ and every t-read is legal in its local serialization with respect to $H$ and $S$. The third condition reflects the implementation’s deferred-update semantics, i.e., the legality of a t-read in a serialization does not depend on transactions that start committing after the response of the t-read.

An example of a du-opaque history $H$ is presented in Figure 1. Let $S$ be the t-complete t-sequential history such that $\mathord{\it seq}(S)=T_{2},T_{3},T_{1},T_{4}$ and $S$ is equivalent to $H$ ($H$ is its own completion). It is easy to see that $S$ is legal and respects the real-time order of transactions in $H$. We now need to prove that each t-read performed in $S$ has a local serialization with respect to $H$ in $S$ that is legal. Consider $\textit{read}_{1}(X)$ in $S$; since $T_{2}$ is t-complete in $H^{1,X}$, it follows that $\textit{read}_{1}(X)$ is legal in $T_{2}\cdot\textit{read}_{1}(X)$ (local serialization for $\textit{read}_{1}(X)$ with respect to $H$ and $S$). Similarly, since $T_{1},T_{2},T_{3}$ are t-complete in $H^{4,X}$, $\textit{read}_{4}(X)$ is legal in $T_{2}\cdot T_{3}\cdot T_{1}\cdot\textit{read}_{4}(X)$ (local serialization for $\textit{read}_{4}(X)$ with respect to $H$ and $S$) Thus, $S$ is a du-opaque serialization of $H$.

For a history $H$, let $H^{i}$ be the finite prefix of $H$ of length $i$, i.e., consisting of the first $i$ events of $H$. Now we show a property of du-opaque histories that is going to be instrumental in the rest of the paper.

Lemma 1 implies that every prefix of a du-opaque history has a du-opaque serialization and thus:

We show, however, that du-opacity is, in general, not limit-closed. We present an infinite history that is not du-opaque, but every its prefix is.

We next prove that du-opacity is limit-closed if we assume that, in an infinite history, every transaction eventually completes (but not necessarily t-completes).

The proof uses König’s Path Lemma on a rooted directed graph, $G$. Let $v_{0}$ be the root vertex of $G$. We say that $v_{k}$, a vertex of $G$, is reachable from $v_{0}$, if there is a sequence of vertices $v_{0}\ldots,v_{k}$ such that for each $i$, there exists an edge from $v_{i}$ to $v_{i+1}$. $G$ is connected if every vertex in $G$ is reachable from $v_{0}$. $G$ is finitely branching if every vertex in $G$ has a finite out-degree. $G$ is infinite if the set of vertices in $G$ is not finite.

We first prove the following lemma concerning du-opaque serializations.

For a transaction $T\in\textit{txns}(H)$, we define the live set of $T$ in $H$, denoted $\mathord{\it Lset}_{H}(T)$ ($T$ included) as follows: every transaction $T^{\prime}\in\textit{txns}(H)$ such that neither the last event of $T^{\prime}$ precedes the first event of $T$ in $H$ nor the last event of $T$ precedes the first event of $T^{\prime}$ in $H$ is contained in $\mathord{\it Lset}_{H}(T)$. We say that transaction $T^{\prime}\in\textit{txns}(H)$ succeeds the live set of $T$ and we write $T\prec_{H}^{LS}T^{\prime}$ if in $H$, for all $T^{\prime\prime}\in\mathord{\it Lset}_{H}(T)$, $T^{\prime\prime}$ is complete and the last event of $T^{\prime\prime}$ precedes the first event of $T^{\prime}$.

From Theorem 5, it follows that: