Choice Trees: Representing Nondeterministic, Recursive, and Impure Programs in Coq

Abstract

This paper introduces ctrees, a monad for modeling nondeterministic, recursive, and impure programs in Coq. Inspired by Xia et al.'s itrees, this novel data structure embeds computations into coinductive trees with three kind of nodes: external events, and two variants of nondeterministic branching. This apparent redundancy allows us to provide shallow embedding of denotational models with internal choice in the style of CCS, while recovering an inductive LTS view of the computation. ctrees inherit a vast collection of bisimulation and refinement tools, with respect to which we establish a rich equational theory. We connect ctrees to the itree infrastructure by showing how a monad morphism embedding the former into the latter permits to use ctrees to implement nondeterministic effects. We demonstrate the utility of ctrees by using them to model concurrency semantics in two case studies: CCS and cooperative multithreading.

Provably Fair Cooperative Scheduling

“…It is possible that a transition of the LAGC scheduler semantics has no counterpart in the original LAGC semantics. This is the case for rule (8) and will get more pronounced in the next section, where some tasks might not be able to progress.…”

“…Existence. The application of the rotation rule (10) gives rise to a new case that is completely analogous to that of rule (8). The rest of the existence proof is unchanged.…”

“…Using the conclusion of rule (7) and Lemma 1 we obtain sh, q → sh ′ , M (q ′ ). Rule (8): The rule gives directly sh = sh ′ and we obtain M (q) = M (q ′ ) from its leftmost premise by Lemma 1. Hence, sh, M (q) is already the desired →-configuration.…”

“…The semantics produces a tree where nodes are events to represent the interactions of a given program (for example, memory reads and writes). Interaction trees were extended to deal with non-deterministic events and concurrency [8] with an application to the semantics of cooperative scheduling. Abadi and Plotkin [1] define a denotational semantics based on partial traces and use the memory state explicitly to define the composition of traces.…”

“…Proposition 1. Starting with an initial judgment of the form "〈σ ε 〉, q ini ", consider a wellformed trace sh and non-empty queue q reachable by application of rules (6)- (8). From sh, q exactly one of the rules (6)-( 8) is applicable and the result of the rule application is deterministic up to renaming of variables.…”