Communicating State Transition Systems for Fine-Grained Concurrent Resources

Abstract

Abstract. We present a novel model of concurrent computations with shared memory and provide a simple, yet powerful, logical framework for uniform Hoarestyle reasoning about partial correctness of coarse-and fine-grained concurrent programs. The key idea is to specify arbitrary resource protocols as communicating state transition systems (STS) that describe valid states of a resource and the transitions the resource is allowed to make, including transfer of heap ownership. We demonstrate how reasoning in terms of communicating STS makes it easy to crystallize behavioral invariants of a resource. We also provide entanglement operators to build large systems from an arbitrary number of STS components, by interconnecting their lines of communication. Furthermore, we show how the classical rules from the Concurrent Separation Logic (CSL), such as scoped resource allocation, can be generalized to fine-grained resource management. This allows us to give specifications as powerful as Rely-Guarantee, in a concise, scoped way, and yet regain the compositionality of CSL-style resource management. We proved the soundness of our logic with respect to the denotational semantics of action trees (variation on Brookes' action traces). We formalized the logic as a shallow embedding in Coq and implemented a number of examples, including a construction of coarse-grained CSL resources as a modular composition of various logical and semantic components.

Reasoning about Fences and Relaxed Atomics

“…[24], [8], [7], [3], [13], [6], [21], [17], [19], [4], [11]), namely ghost states, protocols and separation logic, and adapts them in a novel way to support modular weak memory reasoning. We shall first give a brief introduction about GPS, focusing on atomic writes/reads and escrows, which are essential for synchronisations.…”

Mechanized verification of fine-grained concurrent programs

“…Finally, the most important invariant is that a node x is contained in either self or other subjective view iff it's marked in the joint graph. The metatheory of FCSL [Nanevski et al 2014, §4] requires the coherence predicates to satisfy several properties that we omit here, but prove in our implementation. The most important property is the fork-join closure, stating that the state space is closed under realignment of self and other components.…”

“…The span algorithm uses only one concurroid SpanTree, allocated by hide out of the concurroid Priv for thread-local state. In general, FCSL specs can span multiple primitive concurroids, of the same or different kinds, which are entangled by interconnecting special channel-like transitions [Nanevski et al 2014]. The interconnection implements synchronized communication, by which concurroids exchange heap ownership.…”

“…In this paper, we present a framework for mechanized verification of fine-grained concurrent programs based on the recently proposed Fine-grained Concurrent Separation Logic (FCSL) by Nanevski et al [2014].…”

A perspective on specifying and verifying concurrent modules

“…Modern program logics, such as TaDA [5,6], Iris [7] and FCSL [8,9], combine these techniques, allowing us to prove effective modular specifications for concurrent modules such as the counter. We compare two approaches: a first-order approach used in TaDA (Section 3.6.2), and a higher-order approach introduced by Jacobs and Piessens [10] and used in Iris (Section 3.6.1).…”