Modular Reasoning about Separation of Concurrent Data Structures

Svendsen, Kasper; Birkedal, Lars; Parkinson, Matthew

doi:10.1007/978-3-642-37036-6_11

Cited by 48 publications

(54 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since O'Hearn introduced the original concurrent separation logic (CSL) [24], many more CSLs have been developed [12,11,16,14,29,28,30,9,27,18,17]. Though these logics have explored different techniques for reasoning about concurrency, they have one thing in common: their proof rules and models are complicated.…”

Section: Related Workmentioning

confidence: 99%

“…It was, however, far from the last word on the subject. Rather, it spawned a new breed of logics with ever more powerful fictional-separation mechanisms for reasoning modularly about interference [11,16,29,9,30,27]. Several of these also incorporated support for impredicative invariants [28,18,17,4], which are needed if one aims to verify code in languages with semantically cyclic features (such as ML or Rust, which support higher-order state).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

The Essence of Higher-Order Concurrent Separation Logic

Krebbers

Jung

Bizjak

et al. 2017

Programming Languages and Systems

Self Cite

102

View full text Add to dashboard Cite

Abstract. Concurrent separation logics (CSLs) have come of age, and with age they have accumulated a great deal of complexity. Previous work on the Iris logic attempted to reduce the complex logical mechanisms of modern CSLs to two orthogonal concepts: partial commutative monoids (PCMs) and invariants. However, the realization of these concepts in Iris still bakes in several complex mechanisms-such as weakest preconditions and mask-changing view shifts-as primitive notions.In this paper, we take the Iris story to its (so to speak) logical conclusion, applying the reductionist methodology of Iris to Iris itself. Specifically, we define a small, resourceful base logic, which distills the essence of Iris: it comprises only the assertion layer of vanilla separation logic, plus a handful of simple modalities. We then show how the much fancier logical mechanisms of Iris-in particular, its entire program specification layer-can be understood as merely derived forms in our base logic. This approach helps to explain the meaning of Iris's program specifications at a much higher level of abstraction than was previously possible. We also show that the step-indexed "later" modality of Iris is an essential source of complexity, in that removing it leads to a logical inconsistency. All our results are fully formalized in the Coq proof assistant. IntroductionIn his paper The Next 700 Separation Logics, Parkinson [26] observed that "separation logic has brought great advances in the world of verification. However, there is a disturbing trend for each new library or concurrency primitive to require a new separation logic." He argued that what is needed is a general logic for concurrent reasoning, into which a variety of useful specifications can be encoded via the abstraction facilities of the logic. "By finding the right core logic," he wrote, "we can concentrate on the difficult problems."The logic he suggested as a potential candidate for such a core concurrency logic was deny-guarantee [12]. Deny-guarantee was indeed groundbreaking in its support for "fictional separation"-the idea that even if threads are concurrently manipulating the same shared piece of physical state, one can view them as operating on logically disjoint pieces of it and use separation logic to reason modularly about those pieces. It was, however, far from the last word on the subject. Rather, 2 Krebbers, Jung, Bizjak, Jourdan, Dreyer, Birkedal it spawned a new breed of logics with ever more powerful fictional-separation mechanisms for reasoning modularly about interference [11,16,29,9,30,27]. Several of these also incorporated support for impredicative invariants [28,18,17,4], which are needed if one aims to verify code in languages with semantically cyclic features (such as ML or Rust, which support higher-order state).Although exciting, the progress in this area has come at a cost: as these new separation logics become ever more expressive, each one accumulates increasingly baroque and bespoke proof rules, which are primitive in the sense that their sou...

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

The Essence of Higher-Order Concurrent Separation Logic

Krebbers

Jung

Bizjak

et al. 2017

Programming Languages and Systems

Self Cite

102

View full text Add to dashboard Cite

show abstract

“…Several recent approaches that use advanced program logics [9,10,22,29,31] employ relyguarantee reasoning to verify inter-thread interference. Although our approach is type-based rather than logic-based, there are several underlying similarities.…”

Section: Related Workmentioning

confidence: 99%

Rely-Guarantee Protocols

Militão¹,

Aldrich²,

Caires³

2014

View full text Add to dashboard Cite

Public reporting burden for the collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. The use of shared mutable state, commonly seen in object-oriented systems, is often problematic due to the potential conflicting interactions between aliases to the same state. We present a substructural type system outfitted with a novel lightweight interference control mechanism, relyguarantee protocols, that enables controlled aliasing of shared resources. By assigning each alias separate roles, encoded in a novel protocol abstraction in the spirit of rely-guarantee reasoning our type system ensures that challenging uses of shared state will never interfere in an unsafe fashion. In particular, rely-guarantee protocols ensure that each alias will never observe an unexpected value, or type, when inspecting shared memory regardless of how the changes to that shared state (originating from potentially unknown program contexts) are interleaved at run-time. Keywords: aliasing, interference control, rely-guarantee, typestates AbstractThe use of shared mutable state, commonly seen in object-oriented systems, is often problematic due to the potential conflicting interactions between aliases to the same state. We present a substructural type system outfitted with a novel lightweight interference control mechanism, relyguarantee protocols, that enables controlled aliasing of shared resources. By assigning each alias separate roles, encoded in a novel protocol abstraction in the spirit of rely-guarantee reasoning, our type system ensures that challenging uses of shared state will never interfere in an unsafe fashion. In particular, rely-guarantee protocols ensure that each alias will never observe an unexpected value, or type, when inspecting shared memory regardless of how the changes to that shared state (originating from potentially unknown program contexts) are interleaved at run-time.

show abstract

“…Specification and Verification of Atomic Operations in GPGPU Programs. In SEFM 2015, pages [69][70][71][72][73][74][75][76][77][78][79][80][81][82][83]2015..…”

Section: Thesismentioning

confidence: 99%

“…Inspired by Jacobs and Piessens [48], and Dodds et al [35], CAP was extended by Svendsen and Birkedal resulting in Higher-Order CAP (HOCAP) [82] and later Impredicative CAP (iCAP) [81] to specify client usage protocols, suitable for synchronisers. iCAP is an important step towards reasoning about synchronisation mechanisms that protect client defined external states.…”

Section: Conclusion and Related Workmentioning

confidence: 99%

Specification and verification of synchronisation classes in Java : a practical approach

Amighi¹

View full text Add to dashboard Cite

Modular Reasoning about Separation of Concurrent Data Structures

Cited by 48 publications

References 24 publications

The Essence of Higher-Order Concurrent Separation Logic

The Essence of Higher-Order Concurrent Separation Logic

Rely-Guarantee Protocols

Specification and verification of synchronisation classes in Java : a practical approach

Contact Info

Product

Resources

About