Literature survey · black-box transactional consistency checking

Which checker checks which isolation level

Sixteen tools that take a client-observed history and decide whether it satisfies an isolation level — from dbcop and Cobra through the 2025–26 generation. The matrix is the point; the entries below say what each tool assumes to get there.

The lattice, and where checking gets hard

Levels in increasing strength, following the axiomatic framework of Biswas & Enea. The colour break is the complexity boundary for checking a given history: everything left of it is polynomial, everything right of it is NP-complete in general, and becomes polynomial only when history width (roughly, concurrently-live sessions) is fixed.

RCRead Committed
RARead Atomic
CC / TCC(Transactional) Causal
PCPrefix Consistency
SISnapshot Isolation
SERSerializability
SSERStrict / strong-session SER
weakerstronger
PTIME for arbitrary histories NP-complete; PTIME at fixed width

Coverage matrix

Repeatable read (RR) sits outside the lattice above — it is Adya's PL-2.99, incomparable to SI — so it gets its own column.

sound & complete for this level supported with caveats — a variant only, or conditional on extra information anomaly detection only; sound, not complete · not supported
Marks reflect what each paper claims and proves, not what the tool might be extended to do.
Checker RC RA CC / TCC RR PC SI SER SSER
The founding generation · 2019–2020
dbcopBiswas & Enea · OOPSLA 2019 · ·
ElleKingsbury & Alvaro · VLDB 2020 · ·
CobraTan et al. · OSDI 2020 ··· · ··
Scaling the NP-hard core · 2023–2024
PolySIHuang et al. · VLDB 2023 ··· · ·· ·
ViperZhang et al. · EuroSys 2023 ··· · · ·
LeopardLiu et al. · ICDE 2023 / CIDR 2024 ·· ·· ·
EmmeClark et al. · EuroSys 2024 ··· · · ·
PlumeLiu et al. · OOPSLA 2024 · ··· ·
IsoVistaGu et al. · VLDB 2024 (demo) · ·
The 2025–26 generation
AWDITMøldrup & Pavlogiannis · PLDI 2025 · ··· ·
Chronos / AionLi, Wei et al. · ICDE 2025 ··· · · ·
MTCWei et al. · ICDE 2025 ··· · ·
VboxSun & Zou · arXiv 2025 ··· · ·· ·
Enne / King CobraClark et al. · TOCS 2026 ··· · ··
VeriStrongCai, Liu, Wei et al. · VLDB 2026 ··· · · ·

What each tool assumes to get there

Every entry in the matrix is bought with an assumption. These are the ones that decide whether a checker applies to your system.

dbcop

The paper that fixed the complexity landscape. Six levels defined axiomatically over the write-read relation plus a commit order; RC, RA and CC are decided by saturation in polynomial time, while PC, SI and SER are NP-complete and fall to polynomial only when history width is fixed — or, more generally, when the biconnected components of the communication graph are bounded. Found violations in CockroachDB, Galera and AntidoteDB.

RC RA CC PC SI SER unique writes one write per key per txn no internal reads evaluated to ~15 sessions

Elle

Deliberately trades completeness for speed: it infers an Adya dependency graph directly from observed values and detects cycles, so it is linear-to-log-linear in history length and near-independent of concurrency, but may miss anomalies. Coverage is expressed as Adya anomaly classes (G0, G1a/b/c, G-single, G2) which the library maps onto named models. The list-append datatype is what makes it work — appends are traceable, so each version has one trace and write-write order is recoverable. With no predicate support it cannot separate repeatable read from serializability.

RC RR MAV cursor-stability SI SER strict-SER list-append preferred unique values incomplete by design no predicates

Cobra

Serializability only, and the non-strict variant deliberately — the harder problem. Encodes the history as a polygraph, prunes impossible constraint choices with GPU-accelerated transitive closure, then decides acyclicity in MonoSAT. The encoding is provably equivalent to the existence of an acyclic serialization graph, so the gap is termination time, not missed anomalies. Periodic fence transactions make epoch-based garbage collection safe, which is what allows continuous checking at ~2K txn/s.

SER · strict SER via real-time edges unique writes ≤1 read + 1 write per key per txn session order fence txns for GC GPU for pruning

PolySI

Cobra's approach retargeted at SI. The generalized polygraph compacts the uncertain dependencies inherent to black-box observation into one structure; reachability pruning then SAT/MonoSAT decides it, and a recovery pass turns the counterexample into a readable anomaly. Complete for histories of determinate transactions. Scales to a billion keys and a million transactions in under four hours; reproduced all 2,477 known SI anomalies and found new ones in Dgraph, MariaDB-Galera and YugabyteDB.

strong-session SI unique values session order total per session determinate txns for completeness no predicates

Viper

Introduces the BC-polygraph, adding begin/commit constraint edges so that acyclicity is exactly SI. Sound and complete for Adya SI; the real-time variants (generalized SI, strong SI) need wall-clock timestamps with a bounded-drift assumption, and if drift exceeds it Viper may reject an SI history. Notable among this group for handling range queries via tombstones — deletes become markers carrying write IDs.

Adya SI · GSI · strong SI · strong-session SI unique writes range queries via tombstones clock-drift bound for RT variants

Leopard

A test suite rather than a decision procedure, and the only entry here with no formal soundness or completeness claim. It collects interval-timestamped client traces and replays them through a local mirror of DBMS concurrency-control machinery — lock tables, version chains — applying four abstracted checks (consistent read, mutual exclusion, first-updater-wins, serialization certifier) instead of cycle detection. Designed for sharded, pipelined, garbage-collected operation on long runs. 24 bugs reported in commercial DBMSs; Vbox's comparison scores its anomaly coverage low, so treat it as a bug-finder.

RC RR SER interval timestamps no soundness/completeness proof

Emme · Enne · King Cobra

Not black-box, and that is the whole idea. Version certificate recovery pulls the expected version order out of the DBMS — Debezium CDC on Postgres, CHANGEFEED on CockroachDB, heap scans on TiDB — which removes the search for a version order and, uniquely in this survey, makes predicate dependencies tractable (O(P·W)). Soundness is conditional on the certificate being right. The TOCS extension adds Enne, which replays in an expected serialization order for a further 34–430× over Emme, and King Cobra, a version-order-informed Cobra.

SER SI · Enne: SER · King Cobra: SER/session/strict predicates & range queries needs DBMS-internal version order per-DBMS recovery code

Plume

The first sound and complete checker for the HAT family. Its contribution is a set of 14 transactional anomalous patterns with the theorem that a history satisfies a level exactly when it contains no instance of that level's patterns — so checking is graph construction plus pattern matching, no solver. Vector-clock reachability with tree clocks gives O(1) amortized clock operations. Catches things the strong-isolation checkers structurally miss: intra-transactional anomalies, future reads, monotonic-read violations.

CI RC RA TCC O(n³·ℓ²·k) 1M txns in <5 min bugs in AntidoteDB, Galera, YugabyteDB

IsoVista

Not a new algorithm — an integration platform that wraps sound-and-complete checkers for six levels behind one interface over MySQL, PostgreSQL and MariaDB, with counterexample visualization (the core transactions and their dependencies drawn out) and CPU/memory benchmarking. Useful as the practical front-end for the Nanjing/ETH line of checkers.

RC RR RA TCC SI SER register & list-append models counterexample visualization

AWDIT

Closes the complexity question at the weak end. Builds a minimal saturated partial commit relation and checks acyclicity: Θ(n3/2) for RC and RA — matching conditional lower bounds under the combinatorial BMM hypothesis — and O(n·k) for CC, dropping to linear when transactions are O(1)-sized. Sessions barely help: RA keeps the n3/2 bound with just two sessions. Against Plume it is a mean 245× (RC), 193× (RA), 62× (CC) on large histories — polynomial degree ~6 down to 1.5.

RC RA CC Θ(n^3/2) RC/RA · O(nk) CC provably optimal up to 2²⁰ txns

Chronos / Aion

Buys its way out of NP-hardness by asking the database for start and commit timestamps. Those directly give the arbitration and visibility relations, so there is no polygraph to search — correctness reduces to checking the SESSION, INT, EXT and NOCONFLICT axioms incrementally. Chronos is offline at O(N log N + M); Aion is online, amortized O(log N + M) per transaction, sustaining ~12K txn/s alongside a live system. Grey-box, not black-box.

SI · SER (Aion-SER) online checking requires DB-exposed timestamps 1M txns in tens of seconds

MTC (mini-transactions)

Restricts the workload instead of the algorithm. A mini-transaction is a read-modify-write with at most four operations; under that restriction checking collapses out of NP-hardness — O(n) for SER and SI, O(n²) for SSER. Sound and complete for MT histories, so it is a bug-finding guarantee rather than a general decision procedure. ~1600× over PolySI on SI under Zipfian keys, ~5× over GPU-Cobra on SER.

SER SI SSER · linearizability for LWTs O(n) SER/SI · O(n²) SSER ≤4 ops per txn unique write values

Vbox

Extends the Cobra framework with predicate constraints and client-side timestamps for time-dependency inference, plus incremental reachability (Purdom + Italiano) so transitive closure costs O(|V| + |E∖T|) rather than O(|V|³). Reports 60–100× over Cobra with 20–70× less memory at 10K transactions, and constraint counts cut from ~500K to a few tens of thousands. Claims 13/13 read-after-transaction anomalies against Cobra's 6/13.

SER predicate reads/writes protocol-agnostic (SSI, 2PL, OCC, TO, Percolator) preprint; no repo stated

VeriStrong

The current state of the art on the NP-hard side, and the one that drops the unique-value assumption that Cobra, PolySI, Viper and Elle all require — so it applies to general workloads with duplicate written values. Hyper-polygraphs represent certain and uncertain dependencies together; small-width cycle preprocessing and order-guided polarity picking from a pseudo-topological order tune the SMT search. Up to 4.4× over GPU-Cobra and 4× over PolySI, at 100K transactions / 2M operations.

SER SI no UniqueValue requirement hyper-polygraph + tailored SMT 100K txns / 2M ops

Four things the matrix doesn't show