Owicki–Gries Logic for Timestamp Semantics

Modern computer architectures have multiple cores. Because using multiple cores is significant in computational performance, we cannot ignore weak memory models. On a weak memory model, delays in the effects of store instructions are allowed. For example, let us consider the example program called Store Buffering:

On the strongest memory model called strict consistency, $r_{0}=0\wedge r_{1}=0$ does not hold finally. If $r_{0}=0$ holds, $r_{0}\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}y$ is executed earlier than $y\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}1$. It implies that $x\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}1$ is executed earlier than $r_{1}\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}x$ and therefore $r_{1}=1$ holds, and vice versa. On a weak memory model that allows delays in the effects of store instructions, $r_{0}=0\wedge r_{1}=0$ is allowed.

Because the example program has just six execution traces on strict consistency, the so-called exhaustive search enables us to confirm that $r_{0}=0\wedge r_{1}=0$ does not finally hold. Even if we cannot assume strict consistency, model checking with weak memory models is still a promising verification method (e.g., [1, 10]). However, we would like to focus on program logic sound to weak memory models in this paper.

Owicki–Gries logic is well-known to be sound to the standard state semantics based on strict consistency [15]. The logic is an extension for concurrent programs of Hoare logic for sequential programs [7]. Owicki and Gries invented the notion of non-interference to repair the unsoundness of the parallel composition rule without any side condition. They also invented the notion of auxiliary variables to enhance the provability of their logic.

Because Owicki–Gries logic fits strict consistency, it is too strong to be sound to weak memory models. In this paper, we modify the non-interference and propose program logic sound to a weak memory model that allows delays in the effects of store instructions.

In this paper, we adopt timestamp semantics as a weak memory model. Timestamp semantics are obtained by extending messages on memory to messages with timestamps and letting threads have the so-called vector clock, which has one clock at each shared variable [12, 14]. It is known that it expresses delays in the effects of store instructions. For example, because the store instructions that occur in Store Buffering send the messages $x=1$ and $y=1$ with timestamp $1$ to the memory as follows:

In this paper, we modify the non-interference in Owicki–Gries logic and construct concurrent program logic sound to timestamp semantics. The key idea is to formalize different observations of shared variables by threads. Also, this study provides three theoretically interesting techniques clarified by the novel non-interference. The author believes that broadly sharing the techniques contributes to a better understanding of constructing logic. The techniques are explained in detail in Section 4 and clearly described in Section 6 that concludes the paper.

We introduce notation for describing the standard state semantics for concurrent programs and remember Owicki–Gries logic, which is sound to the semantics.

Expression $E$ and sequential program $s$ are defined as follows:

where $n$ and $v$ denote a numeral and a variable, respectively. Expressions denoting arithmetic operations are appropriately defined.

In this paper, we do not adopt the so-called fork-join paradigm for parallel executions but fix the number of threads to $N$. A concurrent program is denoted by

We also omit conditional and loop statements for the simplicity of the presentation.

State $M$ is a function from variables to numerals in a standard manner. Configurations consist of pairs $\mathord{\langle s,M\rangle}$ of programs and states. We define operational semantics as follows:

where $[\![E]\!]_{M}$ means the interpretation $E$ by $M$ that is defined as follows:

and the update function $M[v\mapsto n](v^{\prime})$ is defined as follows:

To describe properties that concurrent programs enjoy, we define an assertion language as follows:

We use abbreviations $\top$, $\varphi\vee\psi$, and $\varphi\supset\psi$ in the standard manner.

We interpret $\varphi$ by $M$ as follows:

Owicki and Gries provided logic that is sound to the state semantics [15]. Owicki–Gries logic consists of the so-called Hoare triples. A triple $\varphi\>\{\mathord{s}\}\>\psi$ means that an execution of the program $s$ under the pre-condition $\varphi$ implies that the post-condition $\psi$ holds.

The following is a subset of their inference rules:

Formula $[E/v]\varphi$ in the assignment axiom denotes the formula obtained by replacing $v$ that occurs in $\varphi$ by $E$. Symbol $\vDash$ occurring in the third inference rule denotes the standard satisfaction relation as seen in the first-order predicate logic. If there exists a derivation tree of the root $\varphi\>\{\mathord{s_{0}\parallel\cdots\parallel s_{N-1}}\}\>\psi$, we write $\vdash\varphi\>\{\mathord{s_{0}\parallel\cdots\parallel s_{N-1}}\}\>\psi$.

Owicki and Gries defined that $\varDelta_{1}$ does not interfere with $\varDelta_{0}$ if $\vdash\varphi_{1}\wedge\varphi_{0}\>\{\mathord{v_{1}\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}E_{1}}\}\>\varphi_{0}$ and $\vdash\varphi_{1}\wedge\psi_{0}\>\{\mathord{v_{1}\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}E_{1}}\}\>\psi_{0}$ hold for any $\varphi_{0}\>\{\mathord{v_{0}\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}E_{0}}\}\>\psi_{0}$ in $\varDelta_{0}$ and $\varphi_{1}\>\{\mathord{v_{1}\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}E_{1}}\}\>\_$ in $\varDelta_{1}$. In this paper, we write $\varphi_{1}\>\{v_{0}\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}E_{1}\}\Vdash\varphi_{0}$ for $\vdash\varphi_{1}\wedge\varphi_{0}\>\{\mathord{v_{1}\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}E_{1}}\}\>\varphi_{0}$, for short, and call that $\varphi_{0}$ is stable under $\varphi_{1}\>\{v_{1}\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}E_{1}\}\Vdash\_$. We call $\varDelta_{i}$s $(0\leq i<N)$ non-interference if $\varDelta_{i_{0}}$ does not interfere with $\varDelta_{i_{1}}$ for any $i_{0}\neq i_{1}$.

In a standard manner, we define $\vDash\varphi\>\{\mathord{s}\}\>\psi$ if $M\vDash\varphi$ and $\mathord{\langle s,M\rangle}\to\mathord{\langle\texttt{skip},M^{\prime}\rangle}$ implies $M^{\prime}\vDash\psi$ for any $M$ and $M^{\prime}$. Similarly, we define $\vDash\varphi\>\{\mathord{s_{0}\parallel\cdots\parallel s_{N-1}}\}\>\psi$. The logic is sound to the state semantics, as shown in Figure 1.

Let us see an example derivation. In this paper, we assume that initial values of variables are $0$. Figure 2 shows a derivation of Coherence for ensuring the property $\mathop{\neg}{(r_{0}=2\wedge r_{1}=1)}$. In this paper, we write $x$ and $y$ for shared variables and write $r$ for a thread-local variable.

Notably, the shared variable $x$ acts as an intermediary between $r_{0}$ and $r_{1}$ and ensures finally $r_{0}\leq r_{1}$ as shown in the derivation. Such variables often enable us to describe assertions.

We checked all the derivations described in this paper by the Boogie program verifier [4].

The provability of the logic still needs to be improved. Figure 3 shows the concurrent program $x\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}x+1\parallel x\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}x+2$ and a derivation for ensuring that $x=3$ finally holds. A reason that we can construct the derivation is that the assertions have sufficient information about the execution traces of the program. Specifically, the value of $x$ tells us how far the program is executed.

On the other hand, the value of $x$ in the parallel composition $x\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}x+1\parallel x\stackrel{{\scriptstyle\smash{}\rule{0.0pt}{3.0pt}}}{{\coloneqq}}x+1$ does not tell us. Therefore, we cannot add appropriate assertions that do not interfere with each other to the as-is program.

Owicki and Gries invented auxiliary variables, which are write-only in programs, atomically updated with existing assignments, described in assertions, and removed from programs later. Figure 4 shows a derivation for ensuring that $x=2$ finally holds. The auxiliary variables $a_{0}$ and $a_{1}$ enable us to describe the assertions.

Figure 5 shows a derivation of Store Buffering with auxiliary variables.

We formally define timestamp semantics.

In the following, we formally distinguish thread-local variables $r$ from shared variables $x$. We also divide assignments into three kinds, thread-local, load, and store instructions as follows:

and each assignment has a thread identifier denoting the thread that executes the assignment. A sequentially compound statement contains a unique thread identifier.

On timestamp semantics, thread-local states $S$ are separated from the shared memory $M$. Thread-local state $S$ is a function from thread-local variables to numerals. We define the interpretations of expressions by $S$ as follows:

The shared memory possesses messages with timestamps $\mathord{\langle\mathord{\langle x,t\rangle},n\rangle}$, differently from physical memories that we know. In this paper, timestamps are rationals, i.e., elements of $\mathbb{Q}$. It is known that a set of timestamps should be dense (e.g. [9]). The shared memory $M$ is a function from pairs of shared variables and timestamps to numerals. Notably, $M$ is a function; a shared memory cannot possess multiple messages for the same shared variable and the same timestamp.

Each thread has a vector clock [12, 14]. A vector clock takes a shared variable and returns a timestamp. Differences between vector clocks that threads have express observations of shared variables by threads.

Thread-local configurations $C$ consist of triples $\mathord{\langle s,S,T\rangle}$ of programs, thread-local states, and vector clocks. Thread-local configurations with memory consist of pairs $\mathord{\langle C,M\rangle}$ of thread-local configurations $C$ and memories. Global Configurations consist of pairs $\mathord{\langle\mathfrak{C},M\rangle}$ of thread-local configurations $\mathfrak{C}$ and memories $M$ where $\mathfrak{C}$ takes a thread identifier $i$ and returns a configuration $C$. Operational semantics are as shown in Figure 6.

No explanation for thread-local assignments is needed. An assignment of a load instruction takes any message in the memory whose timestamp is equal to or larger than the timestamp that the vector clock indicates. Furthermore, it updates the vector clock. An assignment of a store instruction sends a message whose timestamp is strictly larger than the timestamp that the vector clock indicates, and updates the vector clock. Timestamp semantics express a modern memory model on which effects of store instructions may be delayed (e.g. [9]).

In this section, we provide concurrent program logic for timestamp semantics.