Verifying Asynchronous Interactions via Communicating Session Automata

Abstract

This paper proposes a sound procedure to verify properties of communicating session automata (csa), i.e., communicating automata that include multiparty session types. We introduce a new asynchronous compatibility property for csa, called k-multiparty compatibility (k-mc), which is a strict superset of the synchronous multiparty compatibility used in theories and tools based on session types. It is decomposed into two bounded properties: (i) a condition called k-safety which guarantees that, within the bound, all sent messages can be received and each automaton can make a move; and (ii) a condition called k-exhaustivity which guarantees that all k-reachable send actions can be fired within the bound. We show that k-exhaustivity implies existential boundedness, and soundly and completely characterises systems where each automaton behaves equivalently under bounds greater than or equal to k. We show that checking k-mc is pspace-complete, and demonstrate its scalability empirically over large systems (using partial order reduction).Definition 5 (Stable). S has the stable property ( sp) if @s P RS pSq : Dpq; ǫq P RS pSq : s Ý Ñ˚pq; ǫq.A system has the stable property if it is possible to reach a stable configuration from any reachable configuration. This property is called deadlock-free in [22]. The stable property implies the eventual reception property, but not safety (e.g., an automaton may be waiting for an input in a stable configuration, see Example 2), and safety does not imply the stable property, see Example 4.Example 2. The following system has the stable property, but it is not safe. M s : pq!b pq!a M q : pq?a pq?b qr!c M r : qr?cNext, we define two properties related to bound independence. They specify classes of csa whose branching behaviours are not affected by channel bounds.Definition 6 (k-obi). S is k-output bound independent (k-obi), if @s " pq; wq P RS k pSq and @p P P, if s pq!a ÝÝÑ k , then @pq p , pr!b, q 1 p q P δ p : s pr!b ÝÝÑ k .

Fair Refinement for Asynchronous Session Types

“…. The notion of successful configuration is formalised by a predicate s √ defined as follows: Observe that our definition of compliance is stronger than what is generally considered in the literature on session types, e.g., [16,23,24], where two types are deemed compliant if all messages that are sent are eventually received, and each non-terminated type can always eventually make a move. Compliance is analogous to the notion of correct session in [29] but in an asynchronous setting.…”

“…Concretely, these subtyping relations allow for anticipation of emissions (output) only when they are preceded by a bounded number of receptions (input), but this does not hold between T G and T G because the latter starts with a loop of inputs. Note that the composition of T G and T S is not existentially bounded, hence it cannot be verified by related communicating finite-state machines techniques [4,19,20,24].…”

Implementing Multiparty Session Types in Rust

“…Since we are code-generating the local types, the chance of misspelling is significantly reduced. Another viable option for our framework is to take the bottom-up approach: to check directly whether a set of manuallywritten Rust local types satisfy safety/liveness properties by a model checker [14] or the multiparty compatibility (a property which guarantees deadlock-freedom of communicating automata, which are equivalent to local session types) [2,11].…”

Exploring Type-Level Bisimilarity towards More Expressive Multiparty Session Types

“…Multiparty compatibility. Closest to this paper is existing literature on multiparty compatibility [6,24,40,42]. The key idea, initially developed by Deniélou and Yoshida for the original MPST [23,24], is to represent (groups of) local types operationally as (systems of) communicating finite state machines (CFSM) [8].…”

“…Multiparty compatibility is a sufficient condition to guarantee safety and liveness, but not necessary: there exist safe/live systems that are not multiparty compatible. Therefore, several generalisations have been proposed to cover timed behaviour [6], undirected choice [40], and non-synchronisability [42]. The main similarities between our method in this paper and the multiparty compatibility approach are: (1) we also use an operational interpretation of local types; (2) we guarantee similar liveness/safety properties; (3) and we also neatly factor out the act of checking conformance of processes to local types (resp.…”