Starling:** simpler*concurrency*proofs* Ma#$Windsor (1),$ Mike$Dodds - PowerPoint PPT Presentation

Starling:** simpler*concurrency*proofs* Ma#$Windsor (1),$ Mike$Dodds (1) ,$$$$$$$Ma#hew$Parkinson (2)$ (1) University$of$York$$$$$$$$$$$$$$$$$$$$$$$$$(2)$Microso>$Research$

Sturnus'vulgaris' (common$starling)$

Ticketed*Lock global&int&ticket;&&//&The&next&ticket&to&hand&out.& global&int&serving;&//&The&current&ticket&holding&the&lock.& & method&unlock()&{& method&lock()&{& &&<serving++>;& &&<t&=&ticket++>;& } $ &&do&{& &&&&<s&=&serving>;& &&}&while&(s&!=&t);& }& &

Ticketed*Lock method&lock()&{& method&unlock()&{& &&{|&emp&|}& &&{|&holdLock()&|}& &&<t&=&ticket++>;& &&<serving++>;& &&do&{& &&{|&emp&|}& } $ &&&&<s&=&serving>;& &&}&while&(s&!=&t);& &&{|&holdLock()&|}& }& & constraint&holdLock()&&&*&holdLock()&&&G>&false;&

method&lock()&{& method&unlock()&{& &&{|&emp&|}& &&{|&holdLock()&|}& &&<t&=&ticket++>;& &&<serving++>;& &&{|&holdTick(t)&|} ! &&{|&emp&|}& &&do&{& } $ &&&&{|&holdTick(t)&|}& &&&&<s&=&serving>;& &&&&{|&if&s==t&then&holdLock()&else&holdTick(t)&|}& &&}&while&(s&!=&t);& &&{|&holdLock()&|}& }& & constraint&holdLock()&&&*&holdLock()&&&G>&false;& & constraint&emp&&&&&&&&&&&&&&&&&&&&&&&&&G>&ticket&>=&serving;& constraint&holdTick(t)&&&&&&&&&&&&&&&&&G>&ticket&>&t;& constraint&holdLock()&&&&&&&&&&&&&&&&&&G>&ticket&!=&serving;& constraint&holdLock()&&&*&holdTick(t)&&G>&serving&!=&t;& constraint&holdTick(ta)&*&holdTick(tb)&G>&ta&!=&tb;&

Demo

Views Establish$post;$ Context$asserGons$ preserve$context$ ReificaGon$ Program$ Hoare$triples$ semanGcs$

method&unlock()&{& method&lock()&{& &&{|&holdLock()&|}& &&{|&emp&|}& &&<t&=&ticket++>;& &&<serving++>;& &&{|&holdTick(t)&|} ! &&{|&emp&|}& &&do&{& } $ &&&&{|&holdTick(t)&|}& &&&&<s&=&serving>;& &&&&{|&if&s==t&then&holdLock()&else&holdTick(t)&|}& &&}&while&(s&!=&t);& &&{|&holdLock()&|}& }& &

method&unlock()&{& method&lock()&{& &&{|&holdLock()&|}& &&{|&emp&|}& &&<t&=&ticket++>;& &&<serving++>;& &&{|&holdTick(t)&|} ! &&{|&emp&|}& &&do&{& } $ &&&&{|&holdTick(t)&|}& &&&&<s&=&serving>;& &&&&{|&if&s==t&then&holdLock()&else&holdTick(t)&|}& &&}&while&(s&!=&t);& &&{|&holdLock()&|}& }& & Views$= ! {&holdTick(1),&&holdTick(2),&&holdTick(1)*holdTick(2),&...}&& U&{&holdLock(),&&holdLock()*holdLock(),&...}&& $ U&{&holdLock()*holdTick(1),&&holdLock()*holdTick(2),&&...}&& U&{&emp&}&& $

method&unlock()&{& method&lock()&{& &&{|&holdLock()&|}& &&{|&emp&|}& &&<t&=&ticket++>;& &&<serving++>;& &&{|&holdTick(t)&|} ! &&{|&emp&|}& &&do&{& } $ &&&&{|&holdTick(t)&|}& &&&&<s&=&serving>;& &&&&{|&if&s==t&then&holdLock()&else&holdTick(t)&|}& &&}&while&(s&!=&t);& &&{|&holdLock()&|}& }& & Axioms$=$$${$ {|&emp&|}&<t&=&ticket++>&{|&holdTick(t)&|},& ! $ {|&holdLock()&|}&<serving++>&{|&emp&|},&& ... } & {|&holdTick(t)&|}&<s&=&serving>&{|&if&s==t&then&holdLock()&else&holdTick(t)&|},&&

method&unlock()&{& method&lock()&{& &&{|&holdLock()&|}& &&{|&emp&|}& &&<t&=&ticket++>;& &&<serving++>;& &&{|&holdTick(t)&|} ! &&{|&emp&|}& &&do&{& } $ &&&&{|&holdTick(t)&|}& &&&&<s&=&serving>;& &&&&{|&if&s==t&then&holdLock()&else&holdTick(t)&|}& &&}&while&(s&!=&t);& &&{|&holdLock()&|}& }& & ReificaGon$=$$ constraint&holdLock()&&&*&holdLock()&&&G>&false;& constraint&emp&&&&&&&&&&&&&&&&&&&&&&&&&G>&ticket&>=&serving;& constraint&holdTick(t)&&&&&&&&&&&&&&&&&G>&ticket&>&t;& constraint&holdLock()&&&&&&&&&&&&&&&&&&G>&ticket&!=&serving;& constraint&holdLock()&&&*&holdTick(t)&&G>&serving&!=&t;& constraint&holdTick(ta)&*&holdTick(tb)&G>&ta&!=&tb;&

Checking*proof*outline Infinite!!!' Eg.&& holdLock()&*&holdTick(1)&*&holdTick(2)&*&holdTick(3)&*&holdTick(4)& *&holdTick(5)&*&holdTick(6)&*&holdTick(7)&*&holdTick(8)&*& holdTick(9)&*&holdTick(10)&*&holdTick(11)&*&holdTick(12)&*&... $ $ $ $

Defining*views constraint&holdLock()&*&holdLock()&&&G>&&&false; $ MulGset$subset$

Defining*views View$adjoint$ (mulGset$minus)$ finite$ ⇒ =

Example Axiom:$$ {|&emp&|}&<t&=&ticket++>&{|&holdTick(t)&|} $ Defining$view:$$ holdLock() $ Proof$obligaGon:$$ J t = ticket + + K b emp ⇤ ( holdLock () \ m holdTick ( t )) c ✓ D ( holdLock ()) J t = ticket + + K b emp ⇤ holdLock () c ✓ D ( holdLock ()) J t = ticket + + K ( ticket � serving ) ✓ ticket 6 = serving

Making*proofs*simpler! Horn$clause!$

Demo*#2

Synergies • More$powerful$backTend$solvers$ needed$to$verify$heap$programs.$ $ • CounterTexample$finding$needed$if$ Starling$is$to$be$used$for$find/fix$loop.$ $$ • Starling$approach$useful$as$a$backT end$for$other$verificaGon$tools?$$

Open*Development Follow$Starling$on$GitHub:$ $h#p://github.com/septract/starlingTtool/$

Proof*of*approximaHon