Nondeterministic Programs Research Articles

Disentanglement with Futures, State, and Interaction

Recent work has proposed a memory property for parallel programs, called disentanglement, and showed that it is pervasive in a variety of programs, written in different languages, ranging from C/C++ to Parallel ML, and showed that it can be exploited to improve the performance of parallel functional programs. All existing work on disentanglement, however, considers the "fork/join" model for parallelism and does not apply to "futures", the more powerful approach to parallelism. This is not surprising: fork/join parallel programs exhibit a reasonably strict dependency structure (e.g., series-parallel DAGs), which disentanglement exploits. In contrast, with futures, parallel computations become first-class values of the language, and thus can be created, and passed between functions calls or stored in memory, just like other ordinary values, resulting in complex dependency structures, especially in the presence of mutable state. For example, parallel programs with futures can have deadlocks, which is impossible with fork-join parallelism. In this paper, we are interested in the theoretical question of whether disentanglement may be extended beyond fork/join parallelism, and specifically to futures. We consider a functional language with futures, Input/Output (I/O), and mutable state (references) and show that a broad range of programs written in this language are disentangled. We start by formalizing disentanglement for futures and proving that purely functional programs written in this language are disentangled. We then generalize this result in three directions. First, we consider state (effects) and prove that stateful programs are disentangled if they are race free. Second, we show that race freedom is sufficient but not a necessary condition and non-deterministic programs, e.g. those that use atomic read-modify-operations and some non-deterministic combinators, may also be disentangled. Third, we prove that disentangled task-parallel programs written with futures are free of deadlocks, which arise due to interactions between state and the rich dependencies that can be expressed with futures. Taken together, these results show that disentanglement generalizes to parallel programs with futures and, thus, the benefits of disentanglement may go well beyond fork-join parallelism.

Calculational Design of [In]Correctness Transformational Program Logics by Abstract Interpretation

We study transformational program logics for correctness and incorrectness that we extend to explicitly handle both termination and nontermination. We show that the logics are abstract interpretations of the right image transformer for a natural relational semantics covering both finite and infinite executions. This understanding of logics as abstractions of a semantics facilitates their comparisons through their respective abstractions of the semantics (rather that the much more difficult comparison through their formal proof systems). More importantly, the formalization provides a calculational method for constructively designing the sound and complete formal proof system by abstraction of the semantics. As an example, we extend Hoare logic to cover all possible behaviors of nondeterministic programs and design a new precondition (in)correctness logic.

Omnisemantics: Smooth Handling of Nondeterminism

This article gives an in-depth presentation of the omni-big-step and omni-small-step styles of semantic judgments. These styles describe operational semantics by relating starting states to sets of outcomes rather than to individual outcomes. A single derivation of these semantics for a particular starting state and program describes all possible nondeterministic executions (hence the name omni ), whereas in traditional small-step and big-step semantics, each derivation only talks about one single execution. This restructuring allows for straightforward modeling of both nondeterminism and undefined behavior as commonly encountered in sequential functional and imperative programs. Specifically, omnisemantics inherently assert safety (i.e., they guarantee that none of the execution branches gets stuck), while traditional semantics need either a separate judgment or additional error markers to specify safety in the presence of nondeterminism. Omnisemantics can be understood as an inductively defined weakest-precondition semantics (or more generally, predicate-transformer semantics) that does not involve invariants for loops and recursion but instead uses unrolling rules like in traditional small-step and big-step semantics. Omnisemantics were previously described in association with several projects, but we believe the technique has been underappreciated and deserves a well-motivated, extensive, and pedagogical presentation of its benefits. We also explore several novel aspects associated with these semantics, in particular, their use in type-safety proofs for lambda calculi, partial-correctness reasoning, and forward proofs of compiler correctness for terminating but potentially nondeterministic programs being compiled to nondeterministic target languages. All results in this article are formalized in Coq.

Safety enforcement via programmable strategies in Maude

This work aims to provide a general mechanism for safety enforcement in rewriting logic computations. Our technique relies on an assertion-guided model transformation that leverages the newly defined Maude strategy language for ensuring rich safety policies in non-deterministic programs. The transformed system is guaranteed to comply with user-defined invariants that are expressed in a strategy-based, pattern-matching logic, thus preventing the concurrent system to reach any unsafe states. The performance and scalability of the technique is empirically evaluated and benchmarked on a set of realistic programs.

Non-Deterministic Bitwise Programming to Solve the Eurobalise Telegram Encoding Problem

Eurobalise is a transmitter placed on railroad tracks to transmit information on a railway state to a passing train. The transmitted messages are here called Eurobalise telegrams. To transmit telegrams over the air, it is necessary to provide error-resistant encoding and corresponding decoding, which is carried out in accordance with an open standard. In this article, we continue our study of encoding such telegrams using languages ​​with formal semantics intended for verification purposes. We present ways to apply non-deterministic programming for this task and discuss issues of implementing an encoder in the Promela language.

From Actions to Programs as Abstract Actual Causes

Causality plays a central role in reasoning about observations. In many cases, it might be useful to define the conditions under which a non-deterministic program can be called an actual cause of an effect in a setting where a sequence of programs are executed one after another. There can be two perspectives, one where at least one execution of the program leads to the effect, and another where all executions do so. The former captures a ''weak'' notion of causation and is more general than the latter stronger notion. In this paper, we give a definition of weak potential causes. Our analysis is performed within the situation calculus basic action theories and we consider programs formulated in the logic programming language ConGolog. Within this setting, we show how one can utilize a recently developed abstraction framework to relate causes at various levels of abstraction, which facilitates reasoning about programs as causes.

Quantitative strongest post: a calculus for reasoning about the flow of quantitative information

We present a novel strongest-postcondition-style calculus for quantitative reasoning about non-deterministic programs with loops. Whereas existing quantitative weakest pre allows reasoning about the value of a quantity after a program terminates on a given initial state, quantitative strongest post allows reasoning about the value that a quantity had before the program was executed and reached a given final state. We show how strongest post enables reasoning about the flow of quantitative information through programs. Similarly to weakest liberal preconditions, we also develop a quantitative strongest liberal post. As a byproduct, we obtain the entirely unexplored notion of strongest liberal postconditions and show how these foreshadow a potential new program logic - partial incorrectness logic - which would be a more liberal version of O'Hearn's recent incorrectness logic.

The Algebra of Non-deterministic Programs: Demonic Operations, Orders and Axioms

Abstract Demonic composition, demonic refinement and demonic union are alternatives to the usual ‘angelic’ composition, angelic refinement (inclusion) and angelic (usual) union defined on binary relations. We first motivate both the angelic and the demonic via an analysis of the behaviour of non-deterministic programs, with the angelic associated with partial correctness and demonic with total correctness, both cases emerging from a richer algebraic model of non-deterministic programs incorporating both aspects. Zareckiĭ has shown that the isomorphism class of algebras of binary relations under angelic composition and inclusion is finitely axiomatized as the class of ordered semigroups. The proof can be used to establish that the same axiomatization applies to binary relations under demonic composition and refinement, and a further modification of the proof can be used to incorporate a zero element representing the empty relation in the angelic case and the full relation in the demonic case. For the signature of angelic composition and union, it is known that no finite axiomatization exists, and we show the analogous result for demonic composition and demonic union by showing that the same axiomatization holds for both. We show that the isomorphism class of algebras of binary relations with the ‘mixed’ signature of demonic composition and angelic inclusion has no finite axiomatization. As a contrast, we show that the isomorphism class of partial algebras of binary relations with the partial operation of constellation product and inclusion (also a ‘mixed’ signature) is finitely axiomatizable.

Pallet Scheduling Models Under Deterministic and Non-Deterministic Scenarios Using a Hybrid GA Method

This study examines the pallet scheduling problem considering random demands under the novel pallet operation mechanism by resources sharing among the pallet sharing system. Two nonlinear integer pallet scheduling models under deterministic and non-deterministic environment are formulated in terms of the pallet demand variable. To solve the pallet programming model, the hybrid genetic algorithm (HGA) integrating local search strategy is designed to derive the optimal pallet scheduling solution. Besides, the fixed sample size sampling strategy is employed to deal with the uncertain demand during the non-deterministic programming model, realized by the Monte Carlo simulation. The two models can assist decision makers arrange a scientific pallet scheduling solution under deterministic and non-deterministic atmosphere. Finally, the numerical case is implemented to testify the effectiveness of the two models and efficiency of the hybrid algorithms.

On Tseitin Formulas, Read-Once Branching Programs and Treewidth

We show that any nondeterministic read-once branching program that decides a satisfiable Tseitin formula based on an n × n grid graph has size at least 2Ω(n). Then using the Excluded Grid Theorem by Robertson and Seymour we show that for an arbitrary graph G(V, E) any nondeterministic read-once branching program that computes a satisfiable Tseitin formula based on G has size at least $2^{\Omega (\text {tw}(G)^{\delta })}$ for all δ < 1/36, where tw(G) is the treewidth of G (for planar graphs and some other classes of graphs the statement holds for δ = 1). We apply the mentioned results to the analysis of the complexity of derivations in the proof system OBDD(∧,reordering) and show that any OBDD(∧,reordering)-refutation of an unsatisfiable Tseitin formula based on a graph G has size at least $2^{\Omega (\text {tw}(G)^{\delta })}$ . We also show an upper bound O(|E|2pw(G)) on the size of OBDD representations of a satisfiable Tseitin formula based on G and an upper bound $O(|E||V| 2^{\text {pw}(G)}+|\text {TS}_{G,c}|^{2})$ on the size of OBDD(∧)-refutation of an unsatisifable Tseitin formula TSG, c, where pw(G) is the pathwidth of G.

Effects Without Monads: Non-determinism – Back to the Meta Language

We reflect on programming with complicated effects, recalling an undeservingly forgotten alternative to monadic programming and checking to see how well it can actually work in modern functional languages. We adopt and argue the position of factoring an effectful program into a first-order effectful DSL with a rich, higher-order 'macro' system. Not all programs can be thus factored. Although the approach is not general-purpose, it does admit interesting programs. The effectful DSL is likewise rather problem-specific and lacks general-purpose monadic composition, or even functions. On the upside, it expresses the problem elegantly, is simple to implement and reason about, and lends itself to non-standard interpretations such as code generation (compilation) and abstract interpretation. A specialized DSL is liable to be frequently extended; the experience with the tagless-final style of DSL embedding shown that the DSL evolution can be made painless, with the maximum code reuse. We illustrate the argument on a simple but representative example of a rather complicated effect -- non-determinism, including committed choice. Unexpectedly, it turns out we can write interesting non-deterministic programs in an ML-like language just as naturally and elegantly as in the functional-logic language Curry -- and not only run them but also statically analyze, optimize and compile. The richness of the Meta Language does, in reality, compensate for the simplicity of the effectful DSL. The key idea goes back to the origins of ML as the Meta Language for the Edinburgh LCF theorem prover. Instead of using ML to build theorems, we now build (DSL) programs.

Static Backward Slicing of Non-deterministic Programs and Systems

A theory of slicing non-deterministic programs and systems is developed. Non-deterministic programs and systems are represented as non-deterministic program graphs (NDPGs) that allow arbitrary non-deterministic branching to be expressed. Structural and semantic relationships that must exist between an NDPG and (1) its non-termination insensitive (weak) slices and (2) its non-termination sensitive (strong) slices are defined. Weak and strong commitment closure are introduced. These are the NDPG equivalents of being closed under non-termination sensitive and non-termination insensitive control dependence; properties defined on subsets of vertices of the equivalent deterministic structure: the control flow graph. It is proved that if a subset of the vertices of an NDPG is both data dependence closed and (weak/strong) commitment closed, then the resulting induced graph will, indeed, satisfy our structural and semantic requirements. O ( n 3 ) algorithms for computing minimal data and weak/strong commitment closed sets are given. The resulting induced graphs are thus guaranteed to be weak and strong slices, respectively. It is demonstrated, with examples, that programs written in Dijkstra's non-deterministic guarded command language (DNGCL) can be converted to NDPGs to which our slicing algorithms can then be applied. It is proved that the resulting slices (NDPGs) can always be converted back to valid DNGCL programs, highlighting the applicability of our approach to slicing at the source code level.

Editor's Foreword to “Static Backward Slicing of Non-Deterministic Programs and Systems”

Editor's Foreword to “Static Backward Slicing of Non-Deterministic Programs and Systems”

A new model and algorithm for uncertain random parallel machine scheduling problem

The paper presents a new model for uniform parallel machine scheduling problem with uncertainty and randomness simultaneously for processing times of jobs based on chance theory. The objective of the model is to minimize expected completion time. The constraint of the model is that uncertain random completion time of scheduling is less than or equal to expected completion time. The model is transformed to a crisp non-deterministic polynomial hard mathematical programming model based on chance theory. Firstly, simulation techniques of the objective function and the left chance constraint are proposed. Then, two heuristic methods to solve the crisp model are presented. Finally, they are integrated into two hybrid intelligent algorithms for searching the quasi-optimal schedule. Besides, the effectiveness of the model and its hybrid intelligent algorithms are verified by a numerical example generated randomly.

Learning efficient logic programs

When machine learning programs from data, we ideally want to learn efficient rather than inefficient programs. However, existing inductive logic programming (ILP) techniques cannot distinguish between the efficiencies of programs, such as permutation sort (n!) and merge sort O(n;log;n). To address this limitation, we introduce Metaopt, an ILP system which iteratively learns lower cost logic programs, each time further restricting the hypothesis space. We prove that given sufficiently large numbers of examples, Metaopt converges on minimal cost programs, and our experiments show that in practice only small numbers of examples are needed. To learn minimal time-complexity programs, including non-deterministic programs, we introduce a cost function called tree cost which measures the size of the SLD-tree searched when a program is given a goal. Our experiments on programming puzzles, robot strategies, and real-world string transformation problems show that Metaopt learns minimal cost programs. To our knowledge, Metaopt is the first machine learning approach that, given sufficient numbers of training examples, is guaranteed to learn minimal cost logic programs, including minimal time-complexity programs.

Unconventional Parallelization of Nondeterministic Applications

The demand for thread-level-parallelism (TLP) on commodity processors is endless as it is essential for gaining performance and saving energy. However, TLP in today's programs is limited by dependences that must be satisfied at run time. We have found that for nondeterministic programs, some of these actual dependences can be satisfied with alternative data that can be generated in parallel, thus boosting the program's TLP. Satisfying these dependences with alternative data nonetheless produces final outputs that match those of the original nondeterministic program. To demonstrate the practicality of our technique, we describe the design, implementation, and evaluation of our compilers, autotuner, profiler, and runtime, which are enabled by our proposed C++ programming language extensions. The resulting system boosts the performance of six well-known nondeterministic and multi-threaded benchmarks by 158.2% (geometric mean) on a 28-core Intel-based platform.

Pardis: a process calculus for parallel and distributed programming in Haskell

Parallel programming and distributed programming involve substantial amounts of boilerplate code for process management and data synchronisation. This leads to increased bug potential and often results in unintended non-deterministic program behaviour. Moreover, algorithmic details are mixed with technical details concerning parallelisation and distribution. Process calculi are formal models for parallel and distributed programming but often leave details open, causing a gap between formal model and implementation. We propose a fully deterministic process calculus for parallel and distributed programming and implement it as a domain-specific language in Haskell to address these problems. We eliminate boilerplate code by abstracting from the exact notion of parallelisation and encapsulating it in the implementation of our process combinators. Furthermore, we achieve correctness guarantees regarding process composition at compile time through Haskell’s type system. Our result can be used as a high-level tool to implement parallel and distributed programs.

Efficient parallel determinacy race detection for two-dimensional dags

A program is said to have a determinacy race if logically parallel parts of a program access the same memory location and one of the accesses is a write. These races are generally bugs in the program since they lead to non-deterministic program behavior --- different schedules of the program can lead to different results. Most prior work on detecting these races focuses on a subclass of programs with fork-join parallelism. This paper presents a race-detection algorithm, 2D-Order, for detecting races in a more general class of programs, namely programs whose dependence structure can be represented as planar dags embedded in 2D grids. Such dependence structures arise from programs that use pipelined parallelism or dynamic programming recurrences. Given a computation with T 1 work and T ∞ span, 2D-Order executes it while also detecting races in O ( T 1 / P + T ∞ ) time on P processors, which is asymptotically optimal. We also implemented PRacer, a race-detection algorithm based on 2D-Order for Cilk-P, which is a language for expressing pipeline parallelism. Empirical results demonstrate that PRacer incurs reasonable overhead and exhibits scalability similar to the baseline (executions without race detection) when running on multiple cores.

Relatively complete refinement type system for verification of higher-order non-deterministic programs

This paper considers verification of non-deterministic higher-order functional programs. Our contribution is a novel type system in which the types are used to express and verify (conditional) safety, termination, non-safety, and non-termination properties in the presence of ∀-∃ branching behavior due to non-determinism. For instance, the judgement ⊢ e :{ u : int | φ( u ) } ∀∀ says that every evaluation of e either diverges or reduces to some integer u satisfying φ( u ), whereas ⊢ e :{ u : int | ψ( u ) } ∃∀ says that there exists an evaluation of e that either diverges or reduces to some integer u satisfying ψ( u ). Note that the former is a safety property whereas the latter is a counterexample to a (conditional) termination property. Following the recent work on type-based verification methods for deterministic higher-order functional programs, we formalize the idea on the foundation of dependent refinement types , thereby allowing the type system to express and verify rich properties involving program values, branching behaviors, and the combination thereof. Our type system is able to seamlessly combine deductions of both universal and existential facts within a unified framework, paving the way for an exciting opportunity for new type-based verification methods that combine both universal and existential reasoning. For example, our system can prove the existence of a path violating some safety property from a proof of termination that uses a well-foundedness termination argument. We prove that our type system is sound and relatively complete, and further, thanks to having both modes of non-determinism, we show that our types are closed under complement.

Improving the performance of reverse debugging

Reverse debugging is the software development technique that effectively helps fix bugs occurring at the nondeterministic program behavior. It allows one to examine the past states of the program without rerunning it. An implementation of reverse debugging based on deterministic replay in the QEMU 2.0 emulator is described. A number of techniques improving the debugging performance due to reducing the amount of saved data, optimized storage of system snapshots, indexing, and compressing of the event log are proposed. The emulator can work together with the interactive GDB debugger, which makes it possible to use the reverse-continue, reverse-nexti, reverse-stepi and reverse-finish commands in the course of debugging. The execution time of these commands depends on the frequency of recording the system's state snapshots. An estimate of the optimal frequency for the reverse-continue command is obtained.