Specifying concurrent programs in separation logic: morphisms and simulations

Abstract

In addition to pre-and postconditions, program specifications in recent separation logics for concurrency have employed an algebraic structure of resources-a form of state transition systems-to describe the state-based program invariants that must be preserved, and to record the permissible atomic changes to program state. In this paper we introduce a novel notion of resource morphism, i.e. structure-preserving function on resources, and show how to effectively integrate it into separation logic, using an associated notion of morphism-specific simulation. We apply morphisms and simulations to programs verified under one resource, to compositionally adapt them to operate under another resource, thus facilitating proof reuse. lock = do x ← CAS(r , false, true) while ¬x 1 The idea of bounding the interference is the foundation behind the classic rely-guarantee method [Jones 1983] as well. In fact, resources may be seen as structuring and compactly representing-in the form of transitions-the rely and guarantee relations of the rely-guarantee method. 2 The Compare-and-Set variant of CAS(r, a, b) [Herlihy and Shavit 2008] atomically sets the pointer r to b if r contains a, otherwise leaves r unchanged. It moreover returns a Boolean value denoting the success or failure of the operation.

On algebraic abstractions for concurrent separation logics

“…As morphisms are just a special class of functions, they are particularly well-suited to a formalization as a shallow embedding in a system based on type theory such as Coq. We have thus mechanized all the results from the paper by building on the recent formulation of separation logic in Coq by Nanevski et al [2019]. Morphisms and separating relations integrate very naturally into this ambient theory, and don't require any particular automation by tactics in order to be used effectively.…”

“…Hoare Types. A Hoare type [Nanevski et al 2019[Nanevski et al , 2006] is a dependently typed state and concurrency (and divergence) monad, indexed with a spec in the style of separation logic. Concretely, in the judgment : { }{ } @ V, and , both predicates over state , are respectively the pre-and postcondition of a program , in the sense of partial correctness.…”

“…In these logics the user may introduce various PCMs to model custom notions of ghost state relevant to the verification problem. Examples include PCMs of permissions [Bornat et al 2005], and PCMs of histories [Sergey et al 2015b] for representing temporal (i.e., execution order) properties in the style of linearizability and other consistency criteria [Delbianco et al 2017;Nanevski et al 2019;Sergey et al 2016]. Having arbitrary PCMs also facilitates the verification of graph algorithms [Sergey et al 2015a], which has been notoriously difficult in heap-only separation logics.…”

SteelCore: an extensible concurrent separation logic for effectful dependently typed programs

“…In developing a shallow embedding of CSL in a dependent type theory, SteelCore is similar to FCSL (Nanevski et al 2014(Nanevski et al , 2019Sergey et al 2015). FCSL is shallowly embedded in Coq and relies on Coq's abstraction facilities for some of its expressive power.…”

“…Taking a different approach, FCSL (Nanevski et al 2008(Nanevski et al , 2014(Nanevski et al , 2019) embeds a predicative CSL in Coq enabling proofs of Coq programs (rather than embedded-language programs) within a semantics that accounts for effects like state and concurrency. This allows programmers to use the full power of type theory not just for proving, but also for programming, e.g., building dependently typed programs and metaprograms over inductive datatypes, with typeclasses, a module system, and other features of a full-fledged language.…”