Aneris: A Mechanised Logic for Modular Reasoning about Distributed Systems

Krogh-Jespersen, Morten; Timany, Amin; Ohlenbusch, Marit Edna; Gregersen, Simon Oddershede; Birkedal, Lars

doi:10.1007/978-3-030-44914-8_13

Cited by 31 publications

(22 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another related area is the extension of separation logic to distributed systems, which necessarily involves reasoning about communication with external entities. The most closely related such logic is Aneris [14], which is built on Iris, the inspiration for VST's approach to ghost state. The adequacy theorem of Aneris proves the connection between higher-order separation logic specifications of socket operations and a language that includes first-order operational semantics for those functions.…”

Section: Related Workmentioning

confidence: 99%

Connecting Higher-Order Separation Logic to a First-Order Outside World

Mansky

Honoré

Appel

2020

Programming Languages and Systems

View full text Add to dashboard Cite

Separation logic is a useful tool for proving the correctness of programs that manipulate memory, especially when the model of memory includes higher-order state: Step-indexing, predicates in the heap, and higher-order ghost state have been used to reason about function pointers, data structure invariants, and complex concurrency patterns. On the other hand, the behavior of system features (e.g., operating systems) and the external world (e.g., communication between components) is usually specified using first-order formalisms. In principle, the soundness theorem of a separation logic is its interface with first-order theorems, but the soundness theorem may implicitly make assumptions about how other components are specified, limiting its use. In this paper, we show how to extend the higher-order separation logic of the Verified Software Toolchain to interface with a first-order verified operating system, in this case CertiKOS, that mediates its interaction with the outside world. The resulting system allows us to prove the correctness of C programs in separation logic based on the semantics of system calls implemented in CertiKOS. It also demonstrates that the combination of interaction trees + CompCert memories serves well as a lingua franca to interface and compose two quite different styles of program verification.

show abstract

Section: Related Workmentioning

confidence: 99%

Connecting Higher-Order Separation Logic to a First-Order Outside World

Mansky

Honoré

Appel

2020

Programming Languages and Systems

View full text Add to dashboard Cite

show abstract

“…Outside the realm of process calculi, various works tackle the problem of protocol-aware verification, e.g., [40,71,74]. We share similar goals, although we adopt a different theory and design, leading to different tradeoffs: crucially, the works above develop new languages, or build upon a powerful dependently-typed host language (Coq) with interactive proofs, to support rich representations of protocol state.…”

Section: Conclusion and Related Workmentioning

confidence: 99%

Verifying message-passing programs with dependent behavioural types

Scalas

Yoshida

Benussi

2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

Concurrent and distributed programming is notoriously hard. Modern languages and toolkits ease this difficulty by offering message-passing abstractions, such as actors (e.g., Erlang, Akka, Orleans) or processes (e.g., Go): they allow for simpler reasoning w.r.t. shared-memory concurrency, but do not ensure that a program implements a given specification.To address this challenge, it would be desirable to specify and verify the intended behaviour of message-passing applications using types, and ensure that, if a program type-checks and compiles, then it will run and communicate as desired.We develop this idea in theory and practice. We formalise a concurrent functional language λ π ⩽ , with a new blend of behavioural types (from π -calculus theory), and dependent function types (from the Dotty programming language, a.k.a. the future Scala 3). Our theory yields four main payoffs: (1) it verifies safety and liveness properties of programs via typelevel model checking; (2) unlike previous work, it accurately verifies channel-passing (covering a typical pattern of actor programs) and higher-order interaction (i.e., sending/receiving mobile code); (3) it is directly embedded in Dotty, as a toolkit called Effpi, offering a simplified actor-based API; (4) it enables an efficient runtime system for Effpi, for highly concurrent programs with millions of processes/actors.

show abstract

“…In high-level languages messages cannot get lost, are ensured to be delivered in order, and are allowed to contain many types of data, including functions, references, and even channel endpoints. Two examples of network logics are the Disel logic by Sergey et al [2018] and the Aneris logic by Krogh-Jespersen et al [2019]. Second, there has been work on the use of separation logic to prove compiler correctness of high-level message-passing languages.…”

Section: Message Passing In Concurrent Separation Logicmentioning

confidence: 99%

Actris: session-type based reasoning in separation logic

Hinrichsen

Bengtson

Krebbers

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Message passing is a useful abstraction to implement concurrent programs. For real-world systems, however, it is often combined with other programming and concurrency paradigms, such as higher-order functions, mutable state, shared-memory concurrency, and locks. We present Actris: a logic for proving functional correctness of programs that use a combination of the aforementioned features. Actris combines the power of modern concurrent separation logics with a first-class protocol mechanismÐbased on session typesÐfor reasoning about message passing in the presence of other concurrency paradigms. We show that Actris provides a suitable level of abstraction by proving functional correctness of a variety of examples, including a distributed merge sort, a distributed load-balancing mapper, and a variant of the map-reduce model, using relatively simple specifications. Soundness of Actris is proved using a model of its protocol mechanism in the Iris framework. We mechanised the theory of Actris, together with tactics for symbolic execution of programs, as well as all examples in the paper, in the Coq proof assistant.

show abstract

Aneris: A Mechanised Logic for Modular Reasoning about Distributed Systems

Cited by 31 publications

References 40 publications

Connecting Higher-Order Separation Logic to a First-Order Outside World

Connecting Higher-Order Separation Logic to a First-Order Outside World

Verifying message-passing programs with dependent behavioural types

Actris: session-type based reasoning in separation logic

Contact Info

Product

Resources

About