13 research outputs found
Grove: a Separation-Logic Library for Verifying Distributed Systems (Extended Version)
Grove is a concurrent separation logic library for verifying distributed
systems. Grove is the first to handle time-based leases, including their
interaction with reconfiguration, crash recovery, thread-level concurrency, and
unreliable networks. This paper uses Grove to verify several distributed system
components written in Go, including GroveKV, a realistic distributed
multi-threaded key-value store. GroveKV supports reconfiguration,
primary/backup replication, and crash recovery, and uses leases to execute
read-only requests on any replica. GroveKV achieves high performance (67-73% of
Redis on a single core), scales with more cores and more backup replicas
(achieving about 2x the throughput when going from 1 to 3 servers), and can
safely execute reads while reconfiguring.Comment: Extended version of paper appearing at SOSP 202
Asynchronous Probabilistic Couplings in Higher-Order Separation Logic
Probabilistic couplings are the foundation for many probabilistic relational
program logics and arise when relating random sampling statements across two
programs. In relational program logics, this manifests as dedicated coupling
rules that, e.g., say we may reason as if two sampling statements return the
same value. However, this approach fundamentally requires aligning or
"synchronizing" the sampling statements of the two programs which is not always
possible.
In this paper, we develop Clutch, a higher-order probabilistic relational
separation logic that addresses this issue by supporting asynchronous
probabilistic couplings. We use Clutch to develop a logical step-indexed
logical relational to reason about contextual refinement and equivalence of
higher-order programs written in a rich language with higher-order local state
and impredicative polymorphism. Finally, we demonstrate the usefulness of our
approach on a number of case studies.
All the results that appear in the paper have been formalized in the Coq
proof assistant using the Coquelicot library and the Iris separation logic
framework
A Formal Proof of PAC Learnability for Decision Stumps
We present a formal proof in Lean of probably approximately correct (PAC)
learnability of the concept class of decision stumps. This classic result in
machine learning theory derives a bound on error probabilities for a simple
type of classifier. Though such a proof appears simple on paper, analytic and
measure-theoretic subtleties arise when carrying it out fully formally. Our
proof is structured so as to separate reasoning about deterministic properties
of a learning function from proofs of measurability and analysis of
probabilities.Comment: 13 pages, appeared in Certified Programs and Proofs (CPP) 202
Verifying concurrent, crash-safe systems with Perennial
This paper introduces Perennial, a framework for verifying concurrent, crash-safe systems. Perennial extends the Iris concurrency framework with three techniques to enable crash-safety reasoning: recovery leases, recovery helping, and versioned memory. To ease development and deployment of applications, Perennial provides Goose, a subset of Go and a translator from that subset to a model in Perennial with support for reasoning about Go threads, data structures, and file-system primitives. We implemented and verified a crash-safe, concurrent mail server using Perennial and Goose that achieves speedup on multiple cores. Both Perennial and Iris use the Coq proof assistant, and the mail server and the framework’s proofs are machine checked.NSF (Awards CNS-1563763 and CCF- 1836712
Verifying vMVCC, a high-performance transaction library using multi-version concurrency control
Multi-version concurrency control (MVCC) is a widely used, sophisticated approach for handling concurrent transactions. vMVCC is the first MVCC-based transaction library that comes with a machine-checked proof of correctness, providing clients with a guarantee that it will correctly handle all transactions despite a complicated design and implementation that might otherwise be error-prone. vMVCC is implemented in Go, stores data in memory, and uses several optimizations, such as RDTSC-based timestamps, to achieve high performance (25–96% the throughput of Silo, a state-of-the-art in-memory database, for YCSB and TPC-C workloads). Formally specifying and verifying vMVCC required adopting advanced proof techniques, such as logical atomicity and prophecy variables, owing to the fact that MVCC transactions can linearize at timestamp generation prior to transaction execution