  Many online transaction scheduler architectures and algorithms for various
software transactional memories have been designed in order to maintain good
system performance even for high concurrency workloads. Most of these
algorithms were directly implemented in a target programming language, and
experimentally evaluated, without theoretical proofs of correctness and
analysis of their performance. Only a small number of these algorithms were
modeled using formal methods, such as process algebra CSP, in order to verify
that they satisfy properties such as deadlock-freeness and starvation-freeness.
However, as this paper shows, using solely formal methods has its
disadvantages, too. In this paper, we first analyze the previous CSP model of
PSTM transaction scheduler by comparing the model checker PAT results with the
manually derived expected results, for the given test workloads. Next,
according to the results of this analysis, we correct and extend the CSP model.
Finally, based on PAT results for the new CSP model, we analyze the performance
of PSTM online transaction scheduling algorithms from the perspective of
makespan, number of aborts, and throughput. Based on our findings, we may
conclude that for the complete formal verification of trustworthy software,
both formal verification and it's testing must be jointly used.
