Developing safe multithreaded software systems is difficult due to the potential unwanted interference among concurrent threads. This paper presents a flexible methodology for object-oriented programs that protects object structures against inconsistency due to race conditions. It is based on a recent methodology for single-threaded programs where developers define aggregate object structures using an ownership system and declare invariants over them. The methodology is supported by a set of language elements and by both a sound modular static verification method and run-time checking support. The paper reports on preliminary experience with a prototype implementation. A primary aim of a reliable software system is ensuring that all objects in the system maintain consistent states: states in which all fields, and all fields of other objects on which they depend, contain legal meaningful values. In this paper, we formalize consistency constraints as object invariants, which are predicates over fields. It is hard to maintain object invariants in sequential programs, and it is even harder in concurrent programs. For example, consider the following method: Suppose this method is to maintain the invariant that for all dual accounts d : In a concurrent setting, this invariant can be violated in several ways. Even if the programming system ensures that each read or write of a field is atomic, the interleavings might cause the invariant to be violated. For example, consider two threads that both perform a transfer on the same dual accounts. If one transfer occurs either at point 0 or 1 during the other transfer, then the invariant is not maintained. In a concurrent setting, consistency of an object can be ensured by exclusion at a level coarser than individual reads and writes. For example, while one thread updates an object, another is not allowed to perform any operation on the object. In contemporary object-oriented languages, exclusion is implemented via locking. Guaranteed exclusion simplifies the automatic verification of multithreaded code greatly. It means that we can simply split the proof of the concurrent program into a proof for exclusion and a proof for a sequential program [24] . In this paper, we present a new programming methodology for multithreaded object-oriented programs with object invariants. The methodology not only guarantees that every object protects itself from consistency violations, but it also allows aggregates of objects to define leak-proof ownership domains. These domains guarantee that only one thread at a time can access an object of the aggregate. The methodology achieves sound modular static verification by requiring methods to be annotated with simple ownership requirements; as an alternative, it also provides run-time checking support that does not require any method annotations. The methodology is an extension of the Spec# methodology for sequential code, as described in our previous work [3] . We see the proposed methodology as a basis for a comprehensive approach to the specification and verification of multithreaded programs. In this paper, we focus on the core safe concurrency methodology; we are also investigating extensions for increased parallelism and deadlock prevention, but we do not consider those in this paper The paper proceeds as follows. The next four sections 1
Jacobs et al. REF propose a methodology for preserving object invariants in a concurrent program with fine grained locking mechanism through an ownership system supported by a modular verification methodology.
Safe concurrency for aggregate objects with invariants
Third IEEE International Conference on Software Engineering and Formal Methods (SEFM'05)
Third IEEE International Conference on Software Engineering and Formal Methods (SEFM'05)
Computer Science