Characteristic Formulae for Session Types

Self Cite

Asynchronous session subtyping has been studied extensively in [9, 10, 28-31] and applied in [23, 32, 33, 35]. An open question was whether this subtyping relation is decidable. This paper settles the question in the negative. To prove this result, we first introduce a new subclass of two-party communicating finite-state machines (CFSMs), called asynchronous duplex (ADs), which we show to be Turing complete. Secondly, we give a compatibility relation over CFSMs, which is sound and complete wrt. safety for ADs, and is equivalent to the asynchronous subtyping. Then we show that the halting problem reduces to checking whether two CFSMs are in the relation. In addition, we show the compatibility relation to be decidable for three sub-classes of ADs. c Fig. 1. Asynchronous subtyping and compatibility: examples. precise taking the standard interpretation of type T as the set of processes typed by T [9, 16]. An open question in [9, 10, 28-31] was whether the asynchronous subtyping relation is decidable, i.e., is there an algorithm to decide whether two types are in the relation. The answer to that question was thought to be positive, see [10, § 7] and § 6. Asynchronous subtyping, informally. In this work, we consider session types in the form of CFSMs [4], along the lines of [3, 14, 15, 25]. This enables us to characterise the asynchronous subtyping in CFSMs and reduce the undecidability problem to the Turing completeness of CFSMs. Consider a system of CFSMs consisting of machines M s (server) and M c (client) in Figure 1, which communicate via two unbounded queues, one in each direction. A transition !a represents the (asynchronous) emission of a message a, while ?a represents the receptions of a message a from a buffer. For instance, the transition labelled by !req in M c says that the client sends a request to the server M s , later the server can consume this message from its buffer by firing the transition labelled by ?req. We say that the system pM s , M c q, i.e., the parallel composition of M s and M c , is safe if (i) the pair never reaches a deadlock and (ii) whenever a message is sent by one party, it will eventually be received by the other. The key property of session subtyping is that, e.g., if the system pM s , M 1 c q is safe and M c is a subtype of M 1 c , the system pM s , M c q is also safe. We write ď a for the asynchronous subtyping relation, which intuitively requires that, if, e.g., M c ď a M 1 c , then M c is ready to receive no fewer messages than M 1 c and it may not send more messages than M 1 c. For instance, M c can receive all the messages that M 1 c can handle, plus the message err. Observe that M c is an optimised version of M 1 c wrt. asynchrony: the output action !data is performed in advance of the branching. Thus in the system pM s , M c q, when both machines are in state 2 (respectively), both queues contain messages. Instead, in the system pM s , M 1 c q, it is never the case that both queues are non-empty. Note that anticipating the sending of data in M c does not affect safety as ...

Section: Conclusion and Related Workmentioning

confidence: 99%

On the Undecidability of Asynchronous Session Subtyping

Lange

Yoshida

2017

Self Cite

“…Our work uses logic not for a proof-theoretic types-as-proposition theorem, but to use a model-theoretic notion of protocol adherence and to integrate static analysis and dynamic logic. Lange and Yoshida [33] also characterize session types as formulas, but their characterization characterizes the subtyping relation, not the execution traces as in our work.…”

Section: Related Workmentioning

confidence: 94%

Stateful Behavioral Types for Active Objects

Kamburjan

Chen

2018

It is notoriously hard to correctly implement a multiparty protocol which involves asynchronous/concurrent interactions and constraints on states of multiple participants. To assist developers in implementing such protocols, we propose a novel specification language to specify interactions within multiple object-oriented actors and the sideeffects on heap memory of those actors. A behavioral-type-based analysis is presented for type checking. Our specification language formalizes a protocol as a global type, which describes the procedure of asynchronous method calls, the usage of futures, and the heap side-effects with a firstorder logic. To characterize runs of instances of types, we give a modeltheoretic semantics for types and translate them into logical constraints over traces. We prove protocol adherence: If a program is well-typed w.r.t. a protocol, then every trace of the program adheres to the protocol, i.e., every trace is a model for the formula of the protocol's type.

“…The refinement from [13] does not support examples such as those in Figure 1. Concerning previous notions of synchronous subtyping, Gay and Hole [17,18] first introduced the notion of subtyping for synchronous session types, which is decidable in quadratic time [22]. This subtyping only supports covariance of outputs and contravariance of inputs, but does not address anticipation of outputs.…”

Section: Related and Future Workmentioning

confidence: 99%

Fair Refinement for Asynchronous Session Types

Bravetti

Lange

Zavattaro

2021

Self Cite

Session types are widely used as abstractions of asynchronous message passing systems. Refinement for such abstractions is crucial as it allows improvements of a given component without compromising its compatibility with the rest of the system. In the context of session types, the most general notion of refinement is the asynchronous session subtyping, which allows to anticipate message emissions but only under certain conditions. In particular, asynchronous session subtyping rules out candidates subtypes that occur naturally in communication protocols where, e.g., two parties simultaneously send each other a finite but unspecified amount of messages before removing them from their respective buffers. To address this shortcoming, we study fair compliance over asynchronous session types and fair refinement as the relation that preserves it. This allows us to propose a novel variant of session subtyping that leverages the notion of controllability from service contract theory and that is a sound characterisation of fair refinement. In addition, we show that both fair refinement and our novel subtyping are undecidable. We also present a sound algorithm, and its implementation, which deals with examples that feature potentially unbounded buffering.