Modular Termination Verification for Non-blocking Concurrency

Abstract

Abstract. We present Total-TaDA, a program logic for verifying the total correctness of concurrent programs: that such programs both terminate and produce the correct result. With Total-TaDA, we can specify constraints on a thread's concurrent environment that are necessary to guarantee termination. This allows us to verify total correctness for nonblocking algorithms, e.g. a counter and a stack. Our specifications can express lock-and wait-freedom. More generally, they can express that one operation cannot impede the progress of another, a new non-blocking property we call non-impedance. Moreover, our approach is modular. We can verify the operations of a module independently, and build up modules on top of each other.

Automatic cyclic termination proofs for recursive procedures in separation logic

“…Boström et al [7] have also recently described a termination analysis for concurrent imperative programs via an encoding to Boogie which requires explicit arithmetical measures, and includes termination of sequential programs as a special case. Pinto et al consider an alternative approach based on explicit ordinalvalued measures [17]. However, to our knowledge, neither of these latter two analyses have been implemented.…”

Reducing Total Correctness to Partial Correctness by a Transformation of the Language Semantics

“…Logics that prove total correctness directly (e.g., [25,19]) are used more rarely. This is despite the fact that relatively recent work in automated termination proving (e.g., [5,3,13,6,12]) shows that it is beneficial to use information obtained by proving a program (e.g., invariants) in the termination argument: in [5], a cooperation graph is used to enable the cooperation between a safety prover and the rank synthesis tool, in [3], a variance analysis is introduced that is parametric in an invariance analysis and Ramsey-based termination arguments are improved with lexicographic ordering in [13].…”

“…More rarely, logics that can directly prove total correctness (e.g., [25,19]) are used. However, recent work in automated termination proving (e.g., [5,3,13,6,12]) shows that it is beneficial to use information obtained by proving properties of a program (e.g., invariants) in the termination argument.…”

A perspective on specifying and verifying concurrent modules

“…Various approaches, such as RGSep [17], LRG [18], CAP [20], VCC [34], Verifast [10] and HOCAP [25], have localised the notion of protocols to specific shared resources, often as regions or other similar constructs. CaReSL [24], SCSL [23] and iCAP [26] extended the concept of regions with a notion of abstract state and a transition system over those abstract states: in CaReSL these protocols are called islands; in SCSL they are called concurroids; and in iCAP and, following iCAP, TaDA [5], Total-TaDA [35] and Caper [36], they are called shared regions. Iris [7] encodes regions with state transition systems using unary invariants and partial commutative monoids.…”