Distributed causal memory: modular specification and verification in higher-order distributed separation logic

Abstract

We present the first specification and verification of an implementation of a causally-consistent distributed database that supports modular verification of full functional correctness properties of clients and servers. We specify and reason about the causally-consistent distributed database in Aneris, a higher-order distributed separation logic for an ML-like programming language with network primitives for programming distributed systems. We demonstrate that our specifications are useful, by proving the correctness of small, but tricky, synthetic examples involving causal dependency and by verifying a session manager library implemented on top of the distributed database. We use Aneris's facilities for modular specification and verification to obtain a highly modular development, where each component is verified in isolation, relying only on the specifications (not the implementations) of other components. We have used the Coq formalization of the Aneris logic to formalize all the results presented in the paper in the Coq proof assistant.

Verified Causal Broadcast with Liquid Haskell

“…Our causal broadcast implementation is a Haskell library that can be used in a variety of applications, including key-value stores, CRDTs, distributed snapshot algorithms, and peer-to-peer applications, and can be extended into a totally-ordered broadcast protocol that also preserves the causal order of messages [Birman et al 1991]. 2 While previous work has mechanically verified the correctness of applications of causal ordering in distributed systems (such as causally consistent distributed key-value stores [Gondelman et al 2021;Lesani et al 2016]), factoring the causal broadcast protocol out into its own standalone, verified component means that it can be reused in each of these contexts. There is a need for such a standalone component: for instance, recent work on mechanized verification of CRDT convergence [Gomes et al 2017] assumes the existence of a correct causal broadcast mechanism for its convergence result to hold.…”

“…Lesani et al's verification approach effectively bakes a notion of causal message delivery into an abstract causal operational semantics that specifies how a causally consistent KVS should behave, then used the Chapar framework to check that a KVS implementation satisfies that specification. More recently, Gondelman et al [2021] used the Coq-based Aneris separation logic framework [Krogh-Jespersen et al 2020] to specify and verify the causal consistency of a distributed KVS and further verify the correctness of a session manager library implemented on top of the KVS. Both Lesani et al and Gondelman et al are specific to the KVS use case, whereas our verified causal broadcast implementation factors out causal message delivery into a separate layer, agnostic to the content of messages, that can be used as a standalone component in a variety of applications.…”

A type system for extracting functional specifications from memory-safe imperative programs

“…These tools use powerful higher-order concurrent separation logics that can support reasoning over complex concurrent data structures. For instance, Iris was recently used to verify a distributed database [Gondelman et al 2021]. With this power comes a high degree of complexity, however, and these tools often require a high degree of time and expertise to effectively use them.…”