Concurrent Semantics Research Articles

Program Equivalence in the Erlang Actor Model

This paper presents the formal semantics of concurrency in Core Erlang, an intermediate language for Erlang, along with a notion of program equivalence (based on barbed bisimulation) that is able to model equivalence between programs that have different communication structures but the same observable behaviour. The novelty in our formalisation is its extent: it includes semantics for messages and exit and link signals, in addition to most of Core Erlang’s sequential features. Furthermore, unlike previous studies, this work formalises message receipt using primitive operations, consistent with the standard as of Erlang/OTP 23. In this novel formalisation, we show some generally applicable program equivalences (such as process identifier renaming and silent evaluation) and present a practical case study featuring the equivalence of sequential and concurrent list processing.

Optimal Reads-From Consistency Checking for C11-Style Memory Models

Over the years, several memory models have been proposed to capture the subtle concurrency semantics of C/C++. One of the most fundamental problems associated with a memory model M is consistency checking: given an execution X , is X consistent with M ? This problem lies at the heart of numerous applications, including specification testing and litmus tests, stateless model checking, and dynamic analyses. As such, it has been explored extensively and its complexity is well-understood for traditional models like SC and TSO. However, less is known for the numerous model variants of C/C++, for which the problem becomes challenging due to the intricacies of their concurrency primitives. In this work we study the problem of consistency checking for popular variants of the C11 memory model, in particular, the RC 20 model, its release-acquire ( RA ) fragment, the strong and weak variants of RA ( SRA and WRA ), as well as the Relaxed fragment of RC 20. Motivated by applications in testing and model checking, we focus on reads-from consistency checking. The input is an execution X specifying a set of events, their program order and their reads-from relation, and the task is to decide the existence of a modification order on the writes of X that makes X consistent in a memory model. We draw a rich complexity landscape for this problem; our results include (i) nearly-linear-time algorithms for certain variants, which improve over prior results, (ii) fine-grained optimality results, as well as (iii) matching upper and lower bounds (NP-hardness) for other variants. To our knowledge, this is the first work to characterize the complexity of consistency checking for C11 memory models. We have implemented our algorithms inside the TruSt model checker and the C11Tester testing tool. Experiments on standard benchmarks show that our new algorithms improve consistency checking, often by a significant margin.

Isla: integrating full-scale ISA semantics and axiomatic concurrency models (extended version)

Architecture specifications such as Armv8-A and RISC-V are the ultimate foundation for software verification and the correctness criteria for hardware verification. They should define the allowed sequential and relaxed-memory concurrency behaviour of programs, but hitherto there has been no integration of full-scale instruction-set architecture (ISA) semantics with axiomatic concurrency models, either in mathematics or in tools. These ISA semantics can be surprisingly large and intricate, e.g. 100k+\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$+$$\\end{document} lines for Armv8-A. In this paper we present a tool, Isla, for computing the allowed behaviours of concurrent litmus tests with respect to full-scale ISA definitions, in the Sail language, and arbitrary axiomatic relaxed-memory concurrency models, in the Cat language. It is based on a generic symbolic engine for Sail ISA specifications. We equip the tool with a web interface to make it widely accessible, and illustrate and evaluate it for Armv8-A and RISC-V. The symbolic execution engine is valuable also for other verification tasks: it has been used in automated ISA test generation for the Arm Morello prototype architecture, extending Armv8-A with CHERI capabilities, and for Iris program-logic reasoning about binary code above the Armv8-A and RISC-V ISA specifications. By using full-scale and authoritative ISA semantics, Isla lets one evaluate litmus tests using arbitrary user instructions with high confidence. Moreover, because these ISA specifications give detailed and validated definitions of the sequential aspects of systems functionality, as used by hypervisors and operating systems, e.g. instruction fetch, exceptions, and address translation, our tool provides a basis for developing concurrency semantics for these. We demonstrate this for the Armv8-A instruction-fetch and virtual-memory models and examples of Simner et al.

Choice Trees: Representing Nondeterministic, Recursive, and Impure Programs in Coq

This paper introduces ctrees, a monad for modeling nondeterministic, recursive, and impure programs in Coq. Inspired by Xia et al.'s itrees, this novel data structure embeds computations into coinductive trees with three kind of nodes: external events, and two variants of nondeterministic branching. This apparent redundancy allows us to provide shallow embedding of denotational models with internal choice in the style of CCS, while recovering an inductive LTS view of the computation. ctrees inherit a vast collection of bisimulation and refinement tools, with respect to which we establish a rich equational theory. We connect ctrees to the itree infrastructure by showing how a monad morphism embedding the former into the latter permits to use ctrees to implement nondeterministic effects. We demonstrate the utility of ctrees by using them to model concurrency semantics in two case studies: CCS and cooperative multithreading.

The Unfolding: Origins, Techniques, and Applications within Discrete Event Systems

This article aims to provide a perspective on the foundations and developments of the net unfolding techniques and their applications to discrete event systems. The numerous methods applied to concurrency presented in the literature can be roughly divided into two classes: those that assume concurrency can be represented by means of a non-deterministic form, and those that represent concurrency by means of causal relations. This study serves as an ideal starting point for researchers interested in true concurrency semantics by offering a concise literature review of one of the major streams of research towards concurrency and interleaving problems. In order to cope with the state-explosion problem, the unfolding approach is used. Based on the findings of concurrency theory, interleaving semantics are replaced with a unique partially ordered occurrence net. In this paper, we aim to provide a comprehensive review on the history of net unfoldings, the methods that are based on these unfoldings, and how they are used in discrete event systems for automatic verification and compact representations purposes.

Posets with interfaces as a model for concurrency

We introduce posets with interfaces (iposets) and generalise their standard serial composition to a new gluing composition. In the partial order semantics of concurrency, interfaces and gluing allow modelling events that extend in time and across components. Alternatively, taking a decompositional view, interfaces allow cutting through events, while serial composition may only cut through edges of a poset. We show that iposets under gluing composition form a category, which generalises the monoid of posets under serial composition up to isomorphism. They form a 2-category when a subsumption order and a lax tensor in the form of a non-commutative parallel composition are added, which generalises the interchange monoids used for modelling series-parallel posets. We also study the gluing-parallel hierarchy of iposets, which generalises the standard series-parallel one. The class of gluing-parallel iposets contains that of series-parallel posets and the class of interval orders, which are well studied in concurrency theory, too. We also show that it is strictly contained in the class of all iposets by identifying several forbidden substructures.

Veracity: Declarative Multicore Programming with Commutativity

There is an ongoing effort to provide programming abstractions that ease the burden of exploiting multicore hardware. Many programming abstractions (e.g., concurrent objects, transactional memory, etc) simplify matters, but still involve intricate engineering. We argue that some difficulty of multicore programming can be meliorated through a declarative programming style in which programmers directly express the independence of fragments of sequential programs. In our proposed paradigm, programmers write programs in a familiar, sequential manner, with the added ability to explicitly express the conditions under which code fragments commute. Putting such commutativity conditions into source code offers a new entry point to exploit the known connection between commutativity and parallelism. We give sequential and concurrent semantics for commute statements, as well as a correctness condition called scoped serializability and discuss how it can be enforced when combined with commutativity conditions. We next describe a technique for automatically synthesizing commute conditions directly from source code via a new reduction to commutativity of object methods. We implemented our work in a new language called Veracity, implemented in Multicore OCaml and on top of Servois and the libcuckoo concurrent hashtable. We provide the first benchmarks programs with commute blocks. We show that commute conditions can be synthesized even for non-linear programs; we confirm the expectation that concurrency speedups can be seen as the computation increases; and we apply our work to a small in-memory filesystem and a crowdfund blockchain smart contract.

Combining state- and event-based semantics to verify highly available applications

Replicated databases are attractive for managing the data of distributed applications. To achieve high availability, low latency, and high throughput for such applications, consistency has to be weakened. This comes at a price: it is harder to prove application correctness. In this paper, we describe a new and powerful specification and verification technique for highly available applications together with the tool Repliss that partially automates its use. The verification technique is based on existing event-based semantics for database replication and embeds the semantics into a classical state-based verification approach for application programs. As a central contribution, we carefully designed the specification and programming framework in such a way, that the complex concurrent semantics are reduced to sequential verification, which is much easier to handle and provide a better basis for automated tool support. We prove the soundness of this reduction and a restricted form of completeness. All these proofs and the underlying semantics of the system have been formalized in Isabelle/HOL. • Composable proof technique for working with weak consistency. • Expressible specifications with history invariants. • Semantics, technique, and soundness proof verified in Isabelle/HOL. • Implementation of a prototype verification tool to support the technique.

Concurrent semantics for fusions: Weak prime domains and connected event structures

Stable event structures, and their duality with prime algebraic domains, represent a landmark of concurrency theory, since they provide a neat characterisation of causality in computations. As such, they have been used for defining the concurrent semantics of many formalisms, from Petri nets to (linear) graph rewriting systems.Stability however is restrictive for formalisms with “fusion”, where a computational step may merge parts of the state. This happens e.g. for graph rewriting systems with non-linear rules, which are used to cover some relevant applications (such as the graphical encoding of calculi with name passing).Guided by the need of giving semantics to such formalisms, we leave aside stability and characterise a class of domains, referred to as weak prime domains, naturally generalising prime algebraic domains. We then identify a corresponding class of event structures, that we call connected event structures, via a duality result formalised as an equivalence of categories.

Verification of concurrent code from synchronous specifications

• Methodology to generate concurrent code automatically from SIGNAL specifications. • New clock calculus method to explore the clock relations among signals. • Verification of concurrent code from SIGNAL specifications. The synchronous language SIGNAL is a formal specification formalism for developing safety-critical real-time systems. It is a multi-clocked data-flow modeling language suitable for specifying deterministic concurrent behaviors. Its model of computation and communication very well matches recent trends to utilize multi-core processors for executing real-time systems, by taking advantage of its concurrent semantics. The SIGNAL compiler generates code from data-flow specifications while analyzing and verifying safety properties of the system under design: deadlock-freedom, determinism. However, most of recent works have focused on generating sequential code from SIGNAL. Choosing the parallel library OpenMP as the target, this paper proposes a methodology to generate and verify concurrent code automatically from SIGNAL specifications. This is done by first exploring clock relations among signals by application of a so-called clock calculus. Then, specifications are translated into EDGs (Equation-Dependency Graphs) to analyze global data-dependency relations. An EDG is then partitioned into concurrent tasks to help explore parallelism in the original specification while preserving its semantic. Combined with clock relations, parallel tasks are finally mapped onto the OpenMP structures. The proposed approach is illustrated by a realistic case study.

Mechanized Theory of Event Structures: A Case of Parallel Register Machine

The true concurrency models, and in particular event structures, have been introduced in the 1980s as an alternative to operational interleaving semantics of concurrency, and nowadays they are regaining popularity. Event structures represent the causal dependency and conflict between the individual atomic actions of the system directly. This property leads to a more compact and concise representation of semantics. In this work-in-progress report, we present a theory of event structures mechanized in the COQ proof assistant and demonstrate how it can be applied to define certified executable semantics of a simple parallel register machine with shared memory.

Reactive programming in Ada 2012 with RxAda

Abstract The ReactiveX API, also known as the Reactive Extensions in the .NET world, is a popular functional reactive programming framework for asynchronous, event-based, multithreaded programming. Although Ada built-in tasking reduces the dire needs for additional multithreading support of some other languages, the reactive approach has properties that are well-suited to the safety and maintainability culture predominant in the Ada world, such as complexity reduction, well-defined concurrency semantics, and enhanced legibility by means of concise and explicit information flows appealing to imperative reasoning. This work presents the design of a ReactiveX Ada implementation that aims to balance desirable library properties such as compile-time type-safety, amount of user-required generic instantiations, and a smooth learning curve for both library clients and maintainers. Concurrency design aspects of the library are detailed, showing how the Flat_Map and Thread abstractions have been implemented following Ada programming expectations, in particular with regard to task termination. In the intervening time from its first presentation, the library has gained implemented operators to the point of having all fundamental building blocks available. With RxAda, the Ada programmer can henceforth benefit from the abundant documentation existing for the language-agnostic ReactiveX approach without stepping out of the Ada tool chain.

An Operational Semantics for True Concurrency in BDI Agent Systems

Agent programming languages have proved useful for formally modelling implemented systems such as PRS and JACK, and for reasoning about their behaviour. Over the past decades, many agent programming languages and extensions have been developed. A key feature in some of them is their support for the specification of ‘concurrent’ actions and programs. However, their notion of concurrency is still limited, as it amounts to a nondeterministic choice between (sequential) action interleavings. Thus, the notion does not represent ‘true concurrency’, which can more naturally exploit multi-core computers and multi-robot manufacturing cells. This paper provides a true concurrency operational semantics for a BDI agent programming language, allowing actions to overlap in execution. We prove key properties of the semantics, relating to true concurrency and to its link with interleaving.

Automated Generation of Synchronous Formal Models from SystemC Descriptions

SystemC is one of the most popular electronic system-level design language and it is embraced by a growing community that seeks to move to a higher level of abstraction. It lacks however a standard way of integrating formal methods and formal verification techniques into a SystemC design flow. In this paper, we show how SystemC descriptions are automatically transformed into the formal synchronous language Signal, while conserving the original structure and enabling the application of formal verification techniques. Signal provides a simple semantics of concurrency and time, and allows verification with an existing theorem prover and model checker. The approach that we propose consists of two steps: the extraction of the structure and the transformation of the behavior. In the first step, SystemC model is analyzed and the structural information is extracted. In the second step, for each SystemC module, the corresponding Signal behavior is generated and filled into the already prepared Signal structure.

Grounding thin-air reads with event structures

The key challenge in defining the concurrency semantics of a programming language is how to enable the most efficient compilation to existing hardware architectures, and yet forbid programs from reading thin-air values, i.e., ones that do not appear in the program. At POPL'17, Kang et al. achieved a major breakthrough by introducing the `promising' semantics that came with results showing that it was a good candidate solution to the problem. Unfortunately, however, the promising semantics is rather complicated, and due to its complexity it contains some flaws and limitations that are very hard to address. In response, we present an alternative solution to this problem based on event structures. We show that it is indeed a solution by establishing the standard results about the semantics (DRF theorems, implementation and optimization correctness) as well as a formal connection to the semantics of Kang et al. Further, we show that it is easier to adapt, by extending the semantics to cover features (such as SC accesses) that are not supported by Kang et al. and to rule out some dubious behaviors admitted by the promising semantics.

Formal semantics and transformation of BPMN models

Business process modelling notation (BPMN) represents an industrial standard created in order to provide a graphical semi-formal notation that is readily understandable by all business users, from the business analyst to the technical developers, and, finally, to the business people who will manage those processes. However, BPMN models are expressed in a semi-formal modelling language and need a well-defined formal semantics base for their notations. This formalisation enables analysis and verification tasks. Some efforts have been made to transform BPMN models into formal representations including Petri nets, but, to the best of our knowledge, no work has been done for transforming BPMN models into a language that supports a true concurrency semantics, DD-LOTOS. The DD-LOTOS language is defined for the formal specification of distributed real-time systems and has been defined on a semantic model of true concurrency. The main goal of this paper is to propose a formal semantics for a subset of BPMN, defined in terms of DD-LOTOS code. The paper also proposes a model transformation approach to generate DD-LOTOS code from BPMN models. This approach has been implemented using Eclipse Sirius and Eclipse Acceleo. Two well-known case studies are given to illustrate the transformation.

Toward a Uniform Approach to the Unfolding of Nets

In this paper we introduce the notion of spread net. Spread nets are (safe) Petri nets equipped with vector clocks on places and with ticking functions on transitions, and are such that vector clocks are consistent with the ticking of transitions. Such nets generalize previous families of nets like unfoldings, merged processes and trellis processes, and can thus be used to represent runs of a net in a true concurrency semantics through an operation called the spreading of a net. By contrast with previous constructions, which may identify conflicts, spread nets allow loops in time

A general method for rendering static analyses for diverse concurrency models modular

Shared-memory multi-threading and the actor model both share the notion of processes featuring communication, respectively by modifying shared state and by sending messages. Existing static analyses for concurrent programs either model every possible process interleavings and therefore suffer from the state explosion problem, or feature modularity but lack in precision or in their support for dynamic processes. In this paper we present a general method for obtaining a scalable analysis of concurrent programs featuring dynamic process creation. Our ModConc method transforms an abstract concurrent semantics modeling processes and communication into a modular static analysis treating the behavior of processes separately from their communication. We present ModConc in a generic way and demonstrate its applicability by instantiating it for multi-threaded and actor-based programs. The resulting analyses are evaluated in terms of precision, performance, scalability, and soundness. While a typical non-modular static analysis time out on half of our 56 benchmarks with a 30 min timeout, ModConc analyses successfully analyze all of them in less than 30 s, while remaining on par in terms of precision. Analyzing concurrent processes in isolation while modeling their communications is the key ingredient in supporting scalable analysis of concurrent programs featuring dynamic process communication.

Simplifying ARM concurrency: multicopy-atomic axiomatic and operational models for ARMv8

ARM has a relaxed memory model, previously specified in informal prose for ARMv7 and ARMv8. Over time, and partly due to work building formal semantics for ARM concurrency, it has become clear that some of the complexity of the model is not justified by the potential benefits. In particular, the model was originally non-multicopy-atomic : writes could become visible to some other threads before becoming visible to all — but this has not been exploited in production implementations, the corresponding potential hardware optimisations are thought to have insufficient benefits in the ARM context, and it gives rise to subtle complications when combined with other ARMv8 features. The ARMv8 architecture has therefore been revised: it now has a multicopy-atomic model. It has also been simplified in other respects, including more straightforward notions of dependency, and the architecture now includes a formal concurrency model. In this paper we detail these changes and discuss their motivation. We define two formal concurrency models: an operational one, simplifying the Flowing model of Flur et al., and the axiomatic model of the revised ARMv8 specification. The models were developed by an academic group and by ARM staff, respectively, and this extended collaboration partly motivated the above changes. We prove the equivalence of the two models. The operational model is integrated into an executable exploration tool with new web interface, demonstrated by exhaustively checking the possible behaviours of a loop-unrolled version of a Linux kernel lock implementation, a previously known bug due to unprevented speculation, and a fixed version.

Detecting Data Inconsistency Based on the Unfolding Technique of Petri Nets

The errors of data inconsistency occur in a concurrent system when some concurrent operations are conducted improperly. The model-checking technique is widely used to detect them based on the state transition graph. However, the state space explosion problem is the biggest obstacle for this technique, since the state transition graph is based on the interleaving semantics that can result in a rapid increase of the graph scale. In addition, data inconsistency is closely related with concurrent operations, but the state transition graph hardly characterizes concurrency due to its interleaving semantics. The unfolding technique of Petri nets can both alleviate the state explosion and characterize concurrency because it is based on the concurrent semantics. In this paper, we define Petri net with data to model concurrent systems with three kinds of data operations: read , write, and delete , and then formalize data inconsistency . We propose an unfolding method to produce a finite complete prefix (FCP) for each PD-net. Then, a matrix that represents all concurrency relations of transitions is constructed in view of FCP. Furthermore, the error of data inconsistency can be detected via this matrix. The related algorithms and the developed tool are introduced, and experiments illustrate their effectiveness and advantages. An example of industrial information system shows the usefulness of our study.