iris a framework for higher order concurrent separation
play

Iris: a framework for higher-order concurrent separation logic in - PowerPoint PPT Presentation

Feb 21, 2024 •236 likes •1.49k views

Iris: a framework for higher-order concurrent separation logic in Coq Robbert Krebbers 1 Delft University of Technology, The Netherlands January 15, 2017 @ TTT, Paris, France 1 Iris is joint work with: Ralf Jung, Jacques-Hendri Jourdan, Ale s

  1. Invariants in action Let us consider a simpler problem first: { True } let x = ref (0) in { x �→ 0 } fetchandadd ( x , 2) fetchandadd ( x , 2) ! x { n . even ( n ) } 12

  2. Invariants in action Let us consider a simpler problem first: { True } let x = ref (0) in { x �→ 0 } allocate ∃ n . x �→ n ∧ even ( n ) fetchandadd ( x , 2) fetchandadd ( x , 2) ! x { n . even ( n ) } 12

  3. Invariants in action Let us consider a simpler problem first: { True } let x = ref (0) in { x �→ 0 } allocate ∃ n . x �→ n ∧ even ( n ) { True } { True } fetchandadd ( x , 2) fetchandadd ( x , 2) { True } { True } ! x { n . even ( n ) } 12

  4. Invariants in action Let us consider a simpler problem first: { True } let x = ref (0) in { x �→ 0 } allocate ∃ n . x �→ n ∧ even ( n ) { True } { True } { x �→ n ∧ even ( n ) } fetchandadd ( x , 2) fetchandadd ( x , 2) { x �→ n + 2 ∧ even ( n + 2) } { True } { True } ! x { n . even ( n ) } 12

  5. Invariants in action Let us consider a simpler problem first: { True } let x = ref (0) in { x �→ 0 } allocate ∃ n . x �→ n ∧ even ( n ) { True } { True } { x �→ n ∧ even ( n ) } { x �→ n ∧ even ( n ) } fetchandadd ( x , 2) fetchandadd ( x , 2) { x �→ n + 2 ∧ even ( n + 2) } { x �→ n + 2 ∧ even ( n + 2) } { True } { True } ! x { n . even ( n ) } 12

  6. Invariants in action Let us consider a simpler problem first: { True } let x = ref (0) in { x �→ 0 } allocate ∃ n . x �→ n ∧ even ( n ) { True } { True } { x �→ n ∧ even ( n ) } { x �→ n ∧ even ( n ) } fetchandadd ( x , 2) fetchandadd ( x , 2) { x �→ n + 2 ∧ even ( n + 2) } { x �→ n + 2 ∧ even ( n + 2) } { True } { True } { x �→ n ∧ even ( n ) } ! x { n . x �→ n ∧ even ( n ) } { n . even ( n ) } 12

  7. Invariants in action Let us consider a simpler problem first: { True } let x = ref (0) in { x �→ 0 } allocate ∃ n . x �→ n ∧ even ( n ) { True } { True } { x �→ n ∧ even ( n ) } { x �→ n ∧ even ( n ) } fetchandadd ( x , 2) fetchandadd ( x , 2) { x �→ n + 2 ∧ even ( n + 2) } { x �→ n + 2 ∧ even ( n + 2) } { True } { True } { x �→ n ∧ even ( n ) } ! x { n . x �→ n ∧ even ( n ) } { n . even ( n ) } Problem: still cannot prove it returns 4 12

  8. Ghost variables Consider the invariant: ∃ n . x �→ n ∗ . . . How to relate the quantified value to the state of the threads? 13

  9. Ghost variables Consider the invariant: ∃ n . x �→ n ∗ . . . How to relate the quantified value to the state of the threads? Solution: ghost variables 13

  10. Ghost variables Consider the invariant: ∃ n . x �→ n ∗ . . . How to relate the quantified value to the state of the threads? Solution: ghost variables Ghost variables are allocated in pairs: ∗ True ≡ − ∃ γ. γ ֒ → ∗ γ ֒ → • n ◦ n � �� � � �� � in the invariant in the Hoare triple 13

  11. Ghost variables Consider the invariant: ∃ n 1 , n 2 . x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 How to relate the quantified value to the state of the threads? Solution: ghost variables Ghost variables are allocated in pairs: ∗ True ≡ − ∃ γ. γ ֒ → ∗ γ ֒ → • n ◦ n � �� � � �� � in the invariant in the Hoare triple 13

  12. Ghost variables Consider the invariant: ∃ n 1 , n 2 . x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 How to relate the quantified value to the state of the threads? Solution: ghost variables Ghost variables are allocated in pairs: ∗ True ≡ − ∃ γ. γ ֒ → ∗ γ ֒ → • n ◦ n � �� � � �� � in the invariant in the Hoare triple When you own both parts you obtain that the values are equal and can update both parts: γ ֒ → • n ∗ γ ֒ → ⇒ n = m ◦ m ∗ • n ′ ∗ γ ֒ ◦ n ′ γ ֒ → • n ∗ γ ֒ → ◦ m ≡ − γ ֒ → → 13

  13. Ghost variables in action { True } let x = ref (0) in fetchandadd ( x , 2) fetchandadd ( x , 2) ! x { n . n = 4 } 14

  14. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } fetchandadd ( x , 2) fetchandadd ( x , 2) ! x { n . n = 4 } 14

  15. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } fetchandadd ( x , 2) fetchandadd ( x , 2) ! x { n . n = 4 } 14

  16. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 fetchandadd ( x , 2) fetchandadd ( x , 2) ! x { n . n = 4 } 14

  17. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } fetchandadd ( x , 2) fetchandadd ( x , 2) ! x { n . n = 4 } 14

  18. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } fetchandadd ( x , 2) fetchandadd ( x , 2) ! x { n . n = 4 } 14

  19. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } ! x { n . n = 4 } 14

  20. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } ! x { n . n = 4 } 14

  21. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } ! x { n . n = 4 } 14

  22. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } ! x { n . n = 4 } 14

  23. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } ! x { n . n = 4 } 14

  24. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } ! x { n . n = 4 } 14

  25. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } ! x { n . n = 4 } 14

  26. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } ! x { n . n = 4 } 14

  27. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } { γ 1 ֒ → ◦ 2 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } ! x { n . n = 4 } 14

  28. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } { γ 1 ֒ → ◦ 2 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } ! x { n . n = 4 } 14

  29. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } { γ 1 ֒ → ◦ 2 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } ! x { n . n = 4 } 14

  30. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } { γ 1 ֒ → ◦ 2 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ 4 ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • 2 } ! x { n . n = 4 } 14

  31. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } { γ 1 ֒ → ◦ 2 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ 4 ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • 2 } ! x { n . n = 4 } 14

  32. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } { γ 1 ֒ → ◦ 2 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ 4 ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • 2 } ! x { n . n = 4 ∧ γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ 4 ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • 2 } { n . n = 4 } 14

  33. Ghost variables in action { True } let x = ref (0) in { x �→ 0 } { x �→ 0 ∗ γ 1 ֒ → • 0 ∗ γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → • 0 ∗ γ 2 ֒ → ◦ 0 } allocate ∃ n 1 , n 2 . x �→ n 1 + n 2 ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 { γ 1 ֒ → ◦ 0 ∗ γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 } { γ 2 ֒ → ◦ 0 } { γ 1 ֒ → ◦ 0 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 0 ∗ x �→ n 2 ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) { γ 1 ֒ → ◦ 0 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 0 ∗ γ 2 ֒ → • n 2 } { . . . } { γ 1 ֒ → ◦ 2 ∗ x �→ (2+ n 2 ) ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 } { γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ ( n 1 + n 2 ) ∗ γ 1 ֒ → • n 1 ∗ γ 2 ֒ → • n 2 } { γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ 4 ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • 2 } ! x { n . n = 4 ∧ γ 1 ֒ → ◦ 2 ∗ γ 2 ֒ → ◦ 2 ∗ x �→ 4 ∗ γ 1 ֒ → • 2 ∗ γ 2 ֒ → • 2 } { n . n = 4 } 14

  34. Ghost variables with fractional permissions [Boyland] What if we have n threads? Using n different ghost variables, results in different proofs for each thread. That is not modular. Better way: ghost variables with a fractional permission (0 , 1] Q : π 1 + π 2 π 1 π 2 γ ֒ − − − → ◦ ( n 1 + n 2 ) ⇔ γ ֒ − → ◦ n 1 ∗ γ ֒ − → ◦ n 2 15

  35. Ghost variables with fractional permissions [Boyland] What if we have n threads? Using n different ghost variables, results in different proofs for each thread. That is not modular. Better way: ghost variables with a fractional permission (0 , 1] Q : π 1 + π 2 π 1 π 2 γ ֒ − − − → ◦ ( n 1 + n 2 ) ⇔ γ ֒ − → ◦ n 1 ∗ γ ֒ − → ◦ n 2 You only get the equality when you have full ownership ( π = 1): 1 γ ֒ → • n ∗ γ ֒ − → ◦ m ⇒ n = m 15

  36. Ghost variables with fractional permissions [Boyland] What if we have n threads? Using n different ghost variables, results in different proofs for each thread. That is not modular. Better way: ghost variables with a fractional permission (0 , 1] Q : π 1 + π 2 π 1 π 2 γ ֒ − − − → ◦ ( n 1 + n 2 ) ⇔ γ ֒ − → ◦ n 1 ∗ γ ֒ − → ◦ n 2 You only get the equality when you have full ownership ( π = 1): 1 γ ֒ → • n ∗ γ ֒ − → ◦ m ⇒ n = m Updating is possible with partial ownership (0 < π ≤ 1): ∗ π π γ ֒ → • n ∗ γ ֒ − → ◦ m ≡ − γ ֒ → • ( n + i ) ∗ γ ֒ → − ◦ ( m + i ) 15

  37. Ghost variables with fractional permissions [Boyland] What if we have n threads? Using n different ghost variables, results in different proofs for each thread. That is not modular. Better way: ghost variables with a fractional permission (0 , 1] Q : π 1 + π 2 π 1 π 2 γ ֒ − − − → ◦ ( n 1 + n 2 ) ⇔ γ ֒ − → ◦ n 1 ∗ γ ֒ − → ◦ n 2 You only get the equality when you have full ownership ( π = 1): 1 γ ֒ → • n ∗ γ ֒ → − ◦ m ⇒ n = m Updating is possible with partial ownership (0 < π ≤ 1): ∗ π π γ ֒ → • n ∗ γ ֒ → − ◦ m ≡ − γ ֒ → • ( n + i ) ∗ γ ֒ − → ◦ ( m + i ) � n i π i Keeps the invariant that all γ ֒ − → ◦ n i sum up to γ ֒ → • 15

  38. Fractional ghost variables in action { True } let x = ref (0) in fetchandadd ( x , 2) fetchandadd ( x , 2) . . . ! x { n . n = 2 k } 16

  39. Fractional ghost variables in action { True } let x = ref (0) in { x �→ 0 } fetchandadd ( x , 2) fetchandadd ( x , 2) . . . ! x { n . n = 2 k } 16

  40. Fractional ghost variables in action { True } let x = ref (0) in { x �→ 0 } � � 1 x �→ 0 ∗ γ ֒ → • 0 ∗ γ ֒ − → ◦ 0 fetchandadd ( x , 2) fetchandadd ( x , 2) . . . ! x { n . n = 2 k } 16

  41. Fractional ghost variables in action { True } let x = ref (0) in { x �→ 0 } � � 1 x �→ 0 ∗ γ ֒ → • 0 ∗ γ ֒ − → ◦ 0 allocate ∃ n . x �→ n ∗ γ ֒ → • n fetchandadd ( x , 2) fetchandadd ( x , 2) . . . ! x { n . n = 2 k } 16

  42. Fractional ghost variables in action { True } let x = ref (0) in { x �→ 0 } � � 1 x �→ 0 ∗ γ ֒ → • 0 ∗ γ ֒ − → ◦ 0 allocate ∃ n . x �→ n ∗ γ ֒ → • n � � � � 1 / 1 / k k γ ֒ − → ◦ 0 γ ֒ − → ◦ 0 fetchandadd ( x , 2) fetchandadd ( x , 2) . . . � � � � 1 / 1 / k k γ ֒ − → ◦ 2 γ ֒ − → ◦ 2 ! x { n . n = 2 k } 16

  43. Fractional ghost variables in action { True } let x = ref (0) in { x �→ 0 } � � 1 x �→ 0 ∗ γ ֒ → • 0 ∗ γ ֒ − → ◦ 0 allocate ∃ n . x �→ n ∗ γ ֒ → • n � � � � 1 / 1 / k k γ ֒ − → ◦ 0 γ ֒ − → ◦ 0 � � 1 / k γ ֒ − → ◦ 0 ∗ x �→ n ∗ γ ֒ → • n fetchandadd ( x , 2) fetchandadd ( x , 2) . . . � � � � 1 / 1 / k k γ ֒ − → ◦ 2 γ ֒ − → ◦ 2 ! x { n . n = 2 k } 16

  44. Fractional ghost variables in action { True } let x = ref (0) in { x �→ 0 } � � 1 x �→ 0 ∗ γ ֒ → • 0 ∗ γ ֒ − → ◦ 0 allocate ∃ n . x �→ n ∗ γ ֒ → • n � � � � 1 / 1 / k k γ ֒ − → ◦ 0 γ ֒ − → ◦ 0 � � 1 / k γ ֒ − → ◦ 0 ∗ x �→ n ∗ γ ֒ → • n fetchandadd ( x , 2) fetchandadd ( x , 2) . . . � � 1 / k γ ֒ − → ◦ 2 ∗ x �→ (2+ n ) ∗ γ 1 ֒ → • (2+ n ) � � � � 1 / 1 / k k γ ֒ − → ◦ 2 γ ֒ − → ◦ 2 ! x { n . n = 2 k } 16

  45. Fractional ghost variables in action { True } let x = ref (0) in { x �→ 0 } � � 1 x �→ 0 ∗ γ ֒ → • 0 ∗ γ ֒ − → ◦ 0 allocate ∃ n . x �→ n ∗ γ ֒ → • n � � � � 1 / 1 / k k γ ֒ − → ◦ 0 γ ֒ − → ◦ 0 � � 1 / k γ ֒ − → ◦ 0 ∗ x �→ n ∗ γ ֒ → • n { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) . . . � � 1 / { . . . } k γ ֒ − → ◦ 2 ∗ x �→ (2+ n ) ∗ γ 1 ֒ → • (2+ n ) � � � � 1 / 1 / k k γ ֒ − → ◦ 2 γ ֒ − → ◦ 2 ! x { n . n = 2 k } 16

  46. Fractional ghost variables in action { True } let x = ref (0) in { x �→ 0 } � � 1 x �→ 0 ∗ γ ֒ → • 0 ∗ γ ֒ − → ◦ 0 allocate ∃ n . x �→ n ∗ γ ֒ → • n � � � � 1 / 1 / k k γ ֒ − → ◦ 0 γ ֒ − → ◦ 0 � � 1 / k γ ֒ − → ◦ 0 ∗ x �→ n ∗ γ ֒ → • n { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) . . . � � 1 / { . . . } k γ ֒ − → ◦ 2 ∗ x �→ (2+ n ) ∗ γ 1 ֒ → • (2+ n ) � � � � 1 / 1 / k k γ ֒ − → ◦ 2 γ ֒ − → ◦ 2 � � 1 γ ֒ − → ◦ 2 k ∗ x �→ n ∗ γ ֒ → • n ! x { n . n = 2 k } 16

  47. Fractional ghost variables in action { True } let x = ref (0) in { x �→ 0 } � � 1 x �→ 0 ∗ γ ֒ → • 0 ∗ γ ֒ − → ◦ 0 allocate ∃ n . x �→ n ∗ γ ֒ → • n � � � � 1 / 1 / k k γ ֒ − → ◦ 0 γ ֒ − → ◦ 0 � � 1 / k γ ֒ − → ◦ 0 ∗ x �→ n ∗ γ ֒ → • n { . . . } fetchandadd ( x , 2) fetchandadd ( x , 2) . . . � � 1 / { . . . } k γ ֒ − → ◦ 2 ∗ x �→ (2+ n ) ∗ γ 1 ֒ → • (2+ n ) � � � � 1 / 1 / k k γ ֒ − → ◦ 2 γ ֒ → − ◦ 2 � � 1 γ ֒ − → ◦ 2 k ∗ x �→ n ∗ γ ֒ → • n ! x � � 1 n . n = 2 k ∧ γ ֒ − → ◦ 2 k ∗ x �→ 2 k ∗ γ ֒ → • 2 k { n . n = 2 k } 16

  48. Part #2: generalizing ownership [Ralf Jung, David Swasey, Filip Sieczkowski, Kasper Svendsen, Aaron Turon, Lars Birkedal and Derek Dreyer. Iris: Monoids and Invariants as an Orthogonal Basis for Concurrent Reasoning. In POPL’15] [Ralf Jung, Robbert Krebbers, Lars Birkedal and Derek Dreyer. Higher-Order Ghost State. In ICFP’16] 17

  49. Mechanisms for concurrent reasoning We have seen so far: N ◮ Invariants R ◮ Ghost variables γ ֒ → • n and γ ֒ → ◦ n π ◮ Fractional ghost variables γ ֒ → • n and γ ֒ − → ◦ n Where do these mechanisms come from? 18

  50. There are many CSLs with more powerful mechanisms. . . Owick i-Gries (1976) RS L (2013) Rely -Gua ra ntee (1983) CS L (2004) Borna t-a l (2005) FS L (2016) RGS ep (2007) Bell-a l (2010) S AGL (2007) Hobor -a l (2008) Den y -Gua ra ntee (2009) Gots m a n-a l (2007) LRG (2009) CAP (2010) Ja cobs -Pies s ens (2011) HLRG (2010) RGS im (2012) HOCAP (2013) S CS L (2013) Lia ng -Feng (2013) T a DA (2014) iCAP (2014) Ca ReS L (2013) FTCS L (2015) CoLoS L (2015) FCS L (2014) Iris (2015) GPS (2014) T ota l-T a DA (2016) LiLi (2016) Iris 2.0 (2016) Iris 3 .0 (2016) Picture by Ilya Sergey 19

  51. . . . and very complicated primitive rules 20

  52. The Iris story Owick i-Gries (1976) RS L (2013) Rely -Gua ra ntee (1983) CS L (2004) Borna t-a l (2005) FS L (2016) RGS ep (2007) Bell-a l (2010) S AGL (2007) Hobor -a l (2008) Den y -Gua ra ntee (2009) Gots m a n-a l (2007) LRG (2009) CAP (2010) Ja cobs -Pies s ens (2011) HLRG (2010) RGS im (2012) HOCAP (2013) S CS L (2013) Lia ng -Feng (2013) T a DA (2014) iCAP (2014) Ca ReS L (2013) FTCS L (2015) CoLoS L (2015) FCS L (2014) Iris (2015) GPS (2014) T ota l-T a DA (2016) LiLi (2016) Iris 2.0 (2016) Iris 3 .0 (2016) Picture by Ilya Sergey The Iris story: all of these mechanisms can be encoded using a simple mechanism of resource ownership 21

  53. Generalizing ownership All forms of ownership have common properties: ◮ Ownership of different threads can be composed For example: π 1 + π 2 π 1 π 2 γ ֒ − − − → ◦ ( n 1 + n 2 ) ⇔ γ ֒ − → ◦ n 1 ∗ γ ֒ − → ◦ n 2 22

  54. Generalizing ownership All forms of ownership have common properties: ◮ Ownership of different threads can be composed For example: π 1 + π 2 π 1 π 2 γ ֒ − − − → ◦ ( n 1 + n 2 ) ⇔ γ ֒ − → ◦ n 1 ∗ γ ֒ − → ◦ n 2 ◮ Composition of ownership is associative and commutative Mirroring that parallel composition and separating conjunction is associative and commutative 22

  55. Generalizing ownership All forms of ownership have common properties: ◮ Ownership of different threads can be composed For example: π 1 + π 2 π 1 π 2 γ ֒ − − − → ◦ ( n 1 + n 2 ) ⇔ γ ֒ − → ◦ n 1 ∗ γ ֒ − → ◦ n 2 ◮ Composition of ownership is associative and commutative Mirroring that parallel composition and separating conjunction is associative and commutative ◮ Combinations of ownership that do not make sense are ruled out For example: 1 / 1 / 2 2 γ ֒ → • 5 ∗ γ ֒ − → ◦ 3 ∗ γ ֒ − → ◦ 4 ⇒ False (because 5 � = 3 + 4) 22

  56. Resource algebras Resource algebra with carrier M : ◮ Composition ( · ) : M → M → M ◮ Validity predicate V ⊆ M Satisfying: a · b = b · a a · ( b · c ) = ( a · b ) · c ( a · b ) ∈ V ⇒ a ∈ V 23

  57. Resource algebras Resource algebra with carrier M : ◮ Composition ( · ) : M → M → M ◮ Validity predicate V ⊆ M Satisfying: a · b = b · a a · ( b · c ) = ( a · b ) · c ( a · b ) ∈ V ⇒ a ∈ V γ for each resource algebra M Iris has ghost variables a : M ∗ ∃ γ. a γ ∗ b γ ⇔ a · b γ ⇒ V ( a ) γ γ a ∈ V ≡ − a a ∀ a f . a · a f ∈ V ⇒ b · a f ∈ V ∗ b γ ≡ γ a − 23

  58. Ghost variables revisited Resource algebra for ghost variables: M � • n | ◦ n | ⊥ | • ◦ n V � { a � = ⊥ | a ∈ M } � if n = n ′ • ◦ n • n · ◦ n ′ = ◦ n ′ · • n � ⊥ otherwise other combinations � ⊥ And define: γ γ • n � • n ◦ n � ◦ n γ ֒ → γ ֒ → 24

  59. Ghost variables revisited Resource algebra for ghost variables: M � • n | ◦ n | ⊥ | • ◦ n V � { a � = ⊥ | a ∈ M } � if n = n ′ • ◦ n • n · ◦ n ′ = ◦ n ′ · • n � ⊥ otherwise other combinations � ⊥ And define: γ γ • n � • n ◦ n � ◦ n γ ֒ → γ ֒ → The ghost variable rules follow directly from the general rules: ∗ ∃ γ. γ ֒ True ≡ − → • n ∗ γ ֒ → ◦ n 24

  60. Ghost variables revisited Resource algebra for ghost variables: M � • n | ◦ n | ⊥ | • ◦ n V � { a � = ⊥ | a ∈ M } � if n = n ′ • ◦ n • n · ◦ n ′ = ◦ n ′ · • n � ⊥ otherwise other combinations � ⊥ And define: γ γ • n � • n ◦ n � ◦ n γ ֒ → γ ֒ → The ghost variable rules follow directly from the general rules: ∗ ∃ γ. • ∗ ∃ γ. γ ֒ γ ≡ True ≡ − ◦ n − → • n ∗ γ ֒ → ◦ n 24

  61. Ghost variables revisited Resource algebra for ghost variables: M � • n | ◦ n | ⊥ | • ◦ n V � { a � = ⊥ | a ∈ M } � if n = n ′ • ◦ n • n · ◦ n ′ = ◦ n ′ · • n � ⊥ otherwise other combinations � ⊥ And define: γ γ • n � • n ◦ n � ◦ n γ ֒ → γ ֒ → The ghost variable rules follow directly from the general rules: ∗ ∃ γ. • ∗ ∃ γ. γ ֒ γ ≡ True ≡ − ◦ n − → • n ∗ γ ֒ → ◦ n γ ֒ → • n ∗ γ ֒ → ◦ m ⇒ n = m 24

  62. Ghost variables revisited Resource algebra for ghost variables: M � • n | ◦ n | ⊥ | • ◦ n V � { a � = ⊥ | a ∈ M } � if n = n ′ • ◦ n • n · ◦ n ′ = ◦ n ′ · • n � ⊥ otherwise other combinations � ⊥ And define: γ γ • n � • n ◦ n � ◦ n γ ֒ → γ ֒ → The ghost variable rules follow directly from the general rules: ∗ ∃ γ. • ∗ ∃ γ. γ ֒ γ ≡ True ≡ − ◦ n − → • n ∗ γ ֒ → ◦ n γ ֒ → • n ∗ γ ֒ → ◦ m ⇒ ( • n · ◦ m ) ∈ V ⇒ n = m 24

  63. Updating resources Resources can be updated using frame-preserving updates: ∀ a f . a · a f ∈ V ⇒ b · a f ∈ V ∗ b γ ≡ γ a − Key idea: a resource can be updated if the update does not invalidate the resources of concurrently-running threads Thread 1 Thread 2 . . . Thread n · · . . . · ∈ V a 1 a 2 a n � · · . . . · ∈ V b 1 a 2 a n 25

  64. Updating resources Resources can be updated using frame-preserving updates: ∀ a f . a · a f ∈ V ⇒ b · a f ∈ V ∗ b γ ≡ γ a − Key idea: a resource can be updated if the update does not invalidate the resources of concurrently-running threads Thread 1 Thread 2 . . . Thread n · · . . . · ∈ V a 1 a 2 a n � · · . . . · ∈ V b 1 a 2 a n ∗ γ ֒ • n ′ ∗ γ ֒ ◦ n ′ follows directly The rule γ ֒ → • n ∗ γ ֒ → ◦ m ≡ − → → 25

  65. In the papers ◮ The full definition of a resource algebra (RA) ◮ Combinators (fractions, products, finite maps, agreement, etc.) to modularly build many RAs ◮ Encoding of state transition systems as RAs γ in terms of something even simpler ◮ Encoding of a ◮ Higher order ghost state : RAs that circularly depend on iProp , the type of propositions Iris: Monoids and Invariants as an Higher-Order Ghost State Orthogonal Basis for Concurrent Reasoning Ralf Jung Robbert Krebbers Lars Birkedal Derek Dreyer MPI-SWS, Germany Aarhus University, Denmark Aarhus University, Denmark MPI-SWS, Germany Ralf Jung David Swasey Filip Sieczkowski Kasper Svendsen jung@mpi-sws.org mail@robbertkrebbers.nl birkedal@cs.au.dk dreyer@mpi-sws.org MPI-SWS & MPI-SWS Aarhus University Aarhus University Saarland University swasey@mpi-sws.org filips@cs.au.dk ksvendsen@cs.au.dk jung@mpi-sws.org f a r t i c t Abstract Aaron Turon Lars Birkedal Derek Dreyer A were tied to a “conditional critical region” construct for synchro- t n * o C m p t e l * * e t s e * A nization. Since O’Hearn’s pioneering (and Gödel-award-winning) i n s e W E The development of concurrent separation logic (CSL) has sparked a Mozilla Research Aarhus University MPI-SWS L C o l l C paper, there has been an avalanche of follow-on work extending O P * o D * long line of work on modular verification of sophisticated concurrent P e u s m u c aturon@mozilla.com birkedal@cs.au.dk dreyer@mpi-sws.org * R e o n t e E CSL with more sophisticated mechanisms for modular reasoning, d t s y E a d * e a v programs. Two of the most important features supported by several e t a u l which allow shared state to be accessed at a finer granularity ( e.g., existing extensions to CSL are higher-order quantification and atomic compare-and-swap instructions) and which support the ver- custom ghost state . However, none of the logics that support both ification of more “daring” (less clearly synchronized) concurrent of these features reap the full potential of their combination. In programs [40, 17, 16, 13, 18, 38, 35, 27, 11, 24]. Abstract TaDA [ 8 ], and others. In this paper, we present a logic called Iris that particular, none of them provide general support for a feature we explains some of the complexities of these prior separation logics in In this paper, we focus on two of the most important extensions We present Iris, a concurrent separation logic with a simple premise: dub “higher-order ghost state” : the ability to store arbitrary higher- to CSL— higher-order quantification and custom ghost state —and monoids and invariants are all you need . Partial commutative terms of a simpler unifying foundation, while also supporting some order separation-logic predicates in ghost variables. new and powerful reasoning principles for concurrency. observe that, although several logics support both of these exten- monoids enable us to express—and invariants enable us to enforce— In this paper, we propose higher-order ghost state as a interesting sions, none of them reap the full potential of their combination. In user-defined protocols on shared state, which are at the conceptual Before we get to Iris, however, let us begin with a brief overview and useful extension to CSL, which we formalize in the framework particular, none of them provide general support for a feature we of some key problems that arise in reasoning compositionally about of Jung et al. ’s recently developed Iris logic. To justify its soundness, core of most recent program logics for concurrency. Furthermore, shared state, and how prior approaches have dealt with them. dub “higher-order ghost state”. through a novel extension of the concept of a view shift , Iris supports we develop a novel algebraic structure called CMRAs (“cameras”), Higher-order quantification is the ability to quantify logical the encoding of logically atomic specifications , i.e., Hoare-style which can be thought of as “step-indexed partial commutative 1.1 Invariants and their limitations assertions (universally and existentially) over other assertions and, 26

  66. Part #3: encoding Hoare triples [Robbert Krebbers, Ralf Jung, Aleˇ s Bizjak, Jacques-Henri Jourdan, Derek Dreyer, and Lars Birkedal. The Essence of Higher-Order Concurrent Separation Logic. In ESOP’17] 27

  67. Encoding Hoare triples Step 1: define Hoare triple in terms of weakest preconditions: { P } e { w . Q } � � ( P − ∗ wp e { w . Q } ) where wp e { w . Q } gives the weakest precondition under which: ◮ all executions of e are safe ◮ all return values v of e satisfy the postcondition Q [ v / w ] 28

  68. Encoding Hoare triples Step 1: define Hoare triple in terms of weakest preconditions: { P } e { w . Q } � � ( P − ∗ wp e { w . Q } ) where wp e { w . Q } gives the weakest precondition under which: ◮ all executions of e are safe ◮ all return values v of e satisfy the postcondition Q [ v / w ] Step 2: define weakest precondition:  Q [ e / w ] if e ∈ Val       ∀ σ. red ( e , σ ) ∧ if e �∈ Val wp e { w . Q } � ⊲ ( ∀ e 2 , σ 2 . ( e , σ ) → ( e 2 , σ 2 , ǫ ) − ∗       wp e 2 { w . Q } ) Recursive occurrence guarded by a later ⊲ 28

  69. Adding the points-to connective How to connect the states to ℓ �− → v ?  Q [ e / w ] if e ∈ Val       ∀ σ. if e �∈ Val   wp e { w . Q } � red ( e , σ ) ∧    ⊲ ( ∀ e 2 , σ 2 . ( e , σ ) → ( e 2 , σ 2 , ǫ ) − ∗      wp e 2 { w . Q } ) → v � ??? ℓ �− 29

  70. Adding the points-to connective How to connect the states to ℓ �− → v ?  Q [ e / w ] if e ∈ Val       ∀ σ. if e �∈ Val   wp e { w . Q } � red ( e , σ ) ∧    ⊲ ( ∀ e 2 , σ 2 . ( e , σ ) → ( e 2 , σ 2 , ǫ ) − ∗      wp e 2 { w . Q } ) → v � ??? ℓ �− Solution: ghost variables 29

  71. Adding the points-to connective How to connect the states to ℓ �− → v ?  ⇛ Q [ e / w ] | if e ∈ Val     γ −  ⇛  ∀ σ. • σ ∗ | if e �∈ Val   wp e { w . Q } � red ( e , σ ) ∧   ⇛  ⊲ ( ∀ e 2 , σ 2 . ( e , σ ) → ( e 2 , σ 2 , ǫ ) − ∗ |    γ ∗ wp e 2 { w . Q } )   • σ 2 γ → v � ◦ [ ℓ := v ] ℓ �− Solution: ghost variables Using an appropriate resource algebra we can obtain: γ ∗ ◦ [ ℓ := w ] γ ⇒ σ ( ℓ ) = w • σ γ ∗ ◦ [ ℓ := v ] γ ≡ ∗ • σ [ ℓ := w ] γ ∗ ◦ [ ℓ := w ] γ • σ − ∗ • σ [ ℓ := w ] γ ≡ γ ∗ ◦ [ ℓ := w ] γ • σ − if ℓ / ∈ dom ( σ ) 29

Recommend

Iris Proof Mode Interactive Proofs in Higher-Order Concurrent Separation Logic Robbert Krebbers 1

Iris Proof Mode Interactive Proofs in Higher-Order Concurrent Separation Logic Robbert Krebbers 1

Iris Proof Mode Interactive Proofs in Higher-Order Concurrent Separation Logic Robbert Krebbers 1 Delft University of Technology, The Netherlands June 12, 2017 @ MFPS, Ljubljana, Slovenia 1 Iris is joint work with: Ralf Jung, Jacques-Henri

1.16k views • 87 slides
Higher-Order Concurrent Separation Logic: Why and How Lars Birkedal Aarhus University Nijmegen,

Higher-Order Concurrent Separation Logic: Why and How Lars Birkedal Aarhus University Nijmegen,

Higher-Order Concurrent Separation Logic: Why and How Lars Birkedal Aarhus University Nijmegen, Netherlands Dec, 2015 Modular Reasoning about Higher-Order Concurrent Imperative Programs 1 / 33 Introduction Goal Program logics for

1.02k views • 63 slides
Interactive Proofs in Higher-Order Concurrent Separation Logic Robbert Krebbers 1 Amin Timany 2

Interactive Proofs in Higher-Order Concurrent Separation Logic Robbert Krebbers 1 Amin Timany 2

Interactive Proofs in Higher-Order Concurrent Separation Logic Robbert Krebbers 1 Amin Timany 2 Lars Birkedal 3 1 Delft University of Technology, The Netherlands 2 imec-Distrinet, KU Leuven, Belgium 3 Aarhus University, Denmark January 18, 2017 @

953 views • 71 slides
Iron: Managing Obligations in Higher-Order Concurrent Separation Logic s Bizjak 1 Daniel Gratzer 1

Iron: Managing Obligations in Higher-Order Concurrent Separation Logic s Bizjak 1 Daniel Gratzer 1

Iron: Managing Obligations in Higher-Order Concurrent Separation Logic s Bizjak 1 Daniel Gratzer 1 Ale Robbert Krebbers 2 Lars Birkedal 1 1 Aarhus University 2 Delft University of Technology January 17, 2019 POPL 2019

566 views • 38 slides
Charge! a framework for higher-order separation logic in Coq Lars Birkedal Logic and Semantics

Charge! a framework for higher-order separation logic in Coq Lars Birkedal Logic and Semantics

Charge! a framework for higher-order separation logic in Coq Lars Birkedal Logic and Semantics Group Dept. of Comp. Science, Aarhus University (Joint work with J. Bengtson, J.B. Jensen, H. Mehnert, P . Sestoft, F . Sieczkowski) April 2013

499 views • 34 slides
Reasoning over Permissions Regions in Concurrent Separation Logic James Brotherston, Diana Costa,

Reasoning over Permissions Regions in Concurrent Separation Logic James Brotherston, Diana Costa,

Reasoning over Permissions Regions in Concurrent Separation Logic James Brotherston, Diana Costa, Aquinas Hobor and John Wickerson IRIS Day OScience, Coronavirus Lockdown Edition Tuesday 7th April, 2020 1/ 13 Concurrent separation logic (

164 views • 13 slides
On Congruence Property of Scope Equivalence for Concurrent Programs with Higher-Order

On Congruence Property of Scope Equivalence for Concurrent Programs with Higher-Order

On Congruence Property of Scope Equivalence for Concurrent Programs with Higher-Order Communication Masaki Murakami Okayama University JAPAN A Formal Model of Concurrent Systems the model presented here is a translation of asynchronous

847 views • 31 slides
A Simple Model of Separation Logic for Higher-order Store Lars Birkedal IT University of

A Simple Model of Separation Logic for Higher-order Store Lars Birkedal IT University of

A Simple Model of Separation Logic for Higher-order Store Lars Birkedal IT University of Copenhagen Joint work with B. Reus, J. Schwinghammer, H. Yang July, 2008 Lars Birkedal (ITU) Sep. Logic for Higher-order Store ICALP 1 / 20

457 views • 20 slides
Demonstration of the Iris separation logic in Coq Robbert Krebbers 1 Delft University of

Demonstration of the Iris separation logic in Coq Robbert Krebbers 1 Delft University of

Demonstration of the Iris separation logic in Coq Robbert Krebbers 1 Delft University of Technology, The Netherlands January 21, 2017 @ Coq PL, Paris, France 1 Iris is joint work with: Ralf Jung, Jacques-Hendri Jourdan, Ale s Bizjak, David

948 views • 51 slides
HO in Coq Guillaume Ambal, Sergue Lenglet and Alan Schmitt Higher-Order -calculus

HO in Coq Guillaume Ambal, Sergue Lenglet and Alan Schmitt Higher-Order -calculus

HO in Coq Guillaume Ambal, Sergue Lenglet and Alan Schmitt Higher-Order -calculus Model of concurrent and communicating systems First-order: inert data (channel names, . . . ) Higher-order: executable processes

866 views • 57 slides
Verifying a hash table and its iterators in higher-order separation logic Franois Pottier

Verifying a hash table and its iterators in higher-order separation logic Franois Pottier

Verifying a hash table and its iterators in higher-order separation logic Franois Pottier Vocal meeting Paris, November 10, 2016 Motivation Why verify a hash table implementation ? a simple and useful data structure implements an

499 views • 19 slides
York University www.cs.york.ac.uk/~ndm First order vs Higher order Higher order:

York University www.cs.york.ac.uk/~ndm First order vs Higher order Higher order:

First Order Haskell Neil Mitchell York University www.cs.york.ac.uk/~ndm First order vs Higher order Higher order: functions are values Can be passed around Stored in data structure Harder for reasoning and analysis More

483 views • 15 slides
Concurrent separation logic and operational semantics Viktor Vafeiadis MPI-SWS What is the

Concurrent separation logic and operational semantics Viktor Vafeiadis MPI-SWS What is the

Concurrent separation logic and operational semantics Viktor Vafeiadis MPI-SWS What is the paper about? Soundness proof for CSL Simple Extensible Permissions RGSep Storable locks [Buisse, Birkedal, Stvring, MFPS 2011] Concurrent

270 views • 14 slides
Mechanized proofs in higher-order separation logic Robbert Krebbers Delft University of

Mechanized proofs in higher-order separation logic Robbert Krebbers Delft University of

Mechanized proofs in higher-order separation logic Robbert Krebbers Delft University of Technology, The Netherlands February 5, 2019 @ Vrije Universiteit, Amsterdam, The Netherlands 1 Tactic-style proofs (as in LCF/Coq/HOL/ etc. ) have shown to

978 views • 97 slides
Prophecy Variables in Separation Logic (Extending Iris with Prophecy Variables) Ralf Jung,

Prophecy Variables in Separation Logic (Extending Iris with Prophecy Variables) Ralf Jung,

Prophecy Variables in Separation Logic (Extending Iris with Prophecy Variables) Ralf Jung, Rodolphe Lepigre , Gaurav Parthasarathy, Marianna Rapoport, Amin Timany, Derek Dreyer, Bart Jacobs 1/18 What is Iris?! What are prophecy variables?! The

431 views • 18 slides
Let's try to understand (part of) Iris Willem Penninckx The Paper Iris: Monoids and Invariants

Let's try to understand (part of) Iris Willem Penninckx The Paper Iris: Monoids and Invariants

Let's try to understand (part of) Iris Willem Penninckx The Paper Iris: Monoids and Invariants as an Orthogonal Basis for Concurrent Reasoning Ralf Jung, David Swasey, Filip Sieczkowski, Kasper Svendsen, Aaron Turon, Lars Birkedal, and Derek

647 views • 25 slides
Relaxed separation logic Viktor Vafeiadis Chinmay Narayan MPI-SWS IIT Delhi Concurrent program

Relaxed separation logic Viktor Vafeiadis Chinmay Narayan MPI-SWS IIT Delhi Concurrent program

Relaxed separation logic Viktor Vafeiadis Chinmay Narayan MPI-SWS IIT Delhi Concurrent program logics Goal: Understand concurrent programs. Tool: Concurrent program logics: C oncurrent S eparation L ogic OG, RG, RGSep, LRG, DG, CAP, CaReSL.

345 views • 16 slides
Why higher-order logic? Higher-Order logic Expressive Mathematics Verification

Why higher-order logic? Higher-Order logic Expressive Mathematics Verification

Extending SMT solvers to higher-order logic Haniel Barbosa Andrew Reynolds Daniel El Ouraoui Clark Barrett Cesare Tinelli SMT 2019 20190707, Lisbon, PT To be published in the proceedings of CADE 2019 Why higher-order logic?

569 views • 25 slides
SteelCore: An Extensible Concurrent Separation Logic for Effectful Dependent Programs Nikhil

SteelCore: An Extensible Concurrent Separation Logic for Effectful Dependent Programs Nikhil

SteelCore: An Extensible Concurrent Separation Logic for Effectful Dependent Programs Nikhil Swamy, Aseem Rastogi, Aymeric Fromherz , Denis Merigoux, Danel Ahman, Guido Martinez ICFP 2020 1/12 Verifying Concurrent Programs Lots of recent work

556 views • 37 slides
Cosmo: a concurrent separation logic for Multicore OCaml Glen Mvel , Jacques-Henri Jourdan,

Cosmo: a concurrent separation logic for Multicore OCaml Glen Mvel , Jacques-Henri Jourdan,

Cosmo: a concurrent separation logic for Multicore OCaml Glen Mvel , Jacques-Henri Jourdan, Franois Pottier August, 2020 ICFP, New York LRI &amp; Inria, Paris, France This talk Our aim: Verifying fine-grained concurrent

511 views • 38 slides
Prophecy Variables in Separation Logic (Extending Iris with Prophecy Variables) Ralf Jung,

Prophecy Variables in Separation Logic (Extending Iris with Prophecy Variables) Ralf Jung,

Prophecy Variables in Separation Logic (Extending Iris with Prophecy Variables) Ralf Jung, Rodolphe Lepigre, Gaurav Parthasarathy, Marianna Rapoport, Amin Timany, Derek Dreyer, Bart Jacobs MPI-SWS, KU Leuven, ETH Zrich, University of Waterloo

1.02k views • 52 slides
Higher order complexity Hugo Fre Mathieu Hoyrup CCA 2013 Hugo Fre Higher order

Higher order complexity Hugo Fre Mathieu Hoyrup CCA 2013 Hugo Fre Higher order

Background &amp; motivation Higher order strategies Higher order Turing machines Computable analysis Conclusion Higher order complexity Hugo Fre Mathieu Hoyrup CCA 2013 Hugo Fre Higher order complexity 1/12 Background &amp;

383 views • 15 slides
Higher-order Interpretations for Higher-order Complexity Emmanuel Hainry &amp; Romain Pchoux

Higher-order Interpretations for Higher-order Complexity Emmanuel Hainry &amp; Romain Pchoux

Higher-order Interpretations for Higher-order Complexity Emmanuel Hainry &amp; Romain Pchoux DICE-FOPARA, 22-23 april 2017 CNRS, INRIA, Universit de Lorraine &amp; LORIA, Nancy, France 1 Introduction First-order computability and

801 views • 46 slides
Higher-order Interpretations for Higher-order Complexity Emmanuel Hainry &amp; Romain Pchoux

Higher-order Interpretations for Higher-order Complexity Emmanuel Hainry &amp; Romain Pchoux

Higher-order Interpretations for Higher-order Complexity Emmanuel Hainry &amp; Romain Pchoux LPAR, 11 may 2017 CNRS, INRIA, Universit de Lorraine &amp; LORIA, Nancy, France 1 Introduction First-order computability and complexity

665 views • 39 slides

More recommend