A synchronous program algebra: a basis for reasoning about shared-memory and event-based concurrency

Abstract

This research started with an algebra for reasoning about rely/guarantee concurrency for a shared memory model. The approach taken led to a more abstract algebra of atomic steps, in which atomic steps synchronise (rather than interleave) when composed in parallel. The algebra of rely/guarantee concurrency then becomes an instantiation of the more abstract algebra. Many of the core properties needed for rely/guarantee reasoning can be shown to hold in the abstract algebra where their proofs are simpler and hence allow a higher degree of automation. The algebra has been encoded in Isabelle/HOL to provide a basis for tool support for program verification.In rely/guarantee concurrency, programs are specified to guarantee certain behaviours until assumptions about the behaviour of their environment are violated. When assumptions are violated, program behaviour is unconstrained (aborting), and guarantees need no longer hold. To support these guarantees a second synchronous operator, weak conjunction, was introduced: both processes in a weak conjunction must agree to take each atomic step, unless one aborts in which case the whole aborts. In developing the laws for parallel and weak conjunction we found many properties were shared by the operators and that the proofs of many laws were essentially the same. This insight led to the idea of generalising synchronisation to an abstract operator with only the axioms that are shared by the parallel and weak conjunction operator, so that those two operators can be viewed as instantiations of the abstract synchronisation operator. The main differences between parallel and weak conjunction are how they combine individual atomic steps; that is left open in the axioms for the abstract operator.Milner's process algebra SCCS also includes a synchronous parallel operator and (again) the main difference between it and Aczel's synchronous parallel operator is how it combines individual atomic steps. Milner's parallel can be seen as another instance of the abstract synchronisation operator. Moreover, the realisation that the synchronisation mechanisms of standard process algebras, such as CSP and CCS/SCCS, can be interpreted in our abstract algebra gives evidence of its unifying power.Correspondence and offprint requests to: Ian J. Hayes,

Encoding Fairness in a Synchronous Concurrent Program Algebra

“…The first point is important for devising a compositional approach to reasoning about the fairness properties of concurrent systems in terms of the fairness properties of their components. The second point allows us to utilise the synchronous concurrent refinement algebra [3,7,8] (which has similarities to Milner's SCCS [14,13]) to encode fairness in an existing theory with no built-in fair-parallel operator. The third point shows that no expressive power is lost compared to starting with a fair-parallel operator, in fact, there is a gain in expressiveness as one can define a parallel composition which imposes fairness on only one of its components: ((c ⋓ fair) skip) d.…”

“…The synchronous concurrent refinement algebra is defined in [7,8]. In this section we introduce the aspects that are used to define and reason about fairness in this paper.…”

“…Let π specify the nondeterministic command that executes a single atomic program step and then terminates, but does not constrain the state-transition made by that step, that is, π could take Π(σ, σ ′ ) for any possible states σ and σ ′ . Similarly, let ǫ represent the non-deterministic command that executes any single atomic environment step and then terminates [3,7,8]. Neither π nor ǫ is allowed to fail: they do not contain aborting behaviour.…”

Unifying Theories of Programming

“…KAT [45], Kleene algebras with domain [10,11], and demonic refinement algebras [78] have been established as abstract semantics and verification methods for sequential programs and linked with concrete program semantics such as relations or predicate transformers. Hayes and co-workers have recently developed concurrent refinement algebras, which are inspired by CKA, and support relyguarantee style reasoning with shared-variable concurrent programs [27,28] and CCS/CSP-style reasoning [52,31]. Similar applications in the semantics of concurrent programming languages remain to be explored.…”

Some Challenges of Specifying Concurrent Program Components

“…In Fig. 1 the relies and guarantees are represented as rely and guarantee commands [2,5,7]. The guarantee command (guar g) restricts every atomic program step of the thread to satisfy g. The rely command (rely r) represents an assumption that every environment step satisfies r; if an execution trace performs an environment step not satisfying r, any behaviour whatsoever is allowed from that point (i.e.…”