Type systems for formal verification of concurrent programs

Writing reliable concurrent programs is said to be more difficult than sequential programs because of the possibility of deadlocks and races. Moreover, the state-explosion problem caused by non-deterministic interleaving of threads makes it difficult to track program states. One of the promising approaches for high software reliability is formal verification, statically verifying software before executing it. However, though static verification methods have been extensively studied for sequential programs so far, verification for concurrent programs is still immature, in that many important software features such as interrupts and dynamic creation of communication channels, which often appear in practical software, have not been investigated. Because the debugging-by-testing approach for concurrent programs is less useful than for sequential programs, static verification methods that can deal with concurrent programs with such primitives are of significant importance. As a step to verification methods that can deal with practical programs, we propose type-based verification of two important security properties of concurrent programs: deadlock-freedom and resource usage. The presented deadlock-freedom verification is equipped with three features: (1) non-blockstructured mutex primitives (2) mutable references to mutexes and (3) interrupts. Those three features, which are heavily used in real-world programs, have not been dealt with in the deadlock-freedom analyses proposed so far. In order to design a deadlock-freedom verification for such programs, we define a concurrent calculus with those three features and a type system for the calculus. Our type system guarantees deadlockfreedom (1) by verifying that there are not circular dependencies among locking/unlocking operations and (2) by guaranteeing that an acquired lock is released exactly once. For guaranteeing the first condition, the type system assigns a natural number called lock level to each lock type and verifies that locks are acquired in a strict increasing order of those numbers. For the verification of the second condition in the presence of aliasing and references to a mutex, we use a kind of linear types called capabilities/obligations, and ownerships, a technique to control accesses to a reference to a mutex. We also report the result of a verification experiment of an implementation of a network protocol stack. We next present a type-based resource usage analysis for the π-calculus. The goal of the resource usage analysis is to statically check that various resources (e.g., files, memory and sockets) are accessed according to an access protocol associated to each resource. Though resource usage analysis for sequential programs is extensively studied so far, it is not well investigated for concurrent programs, especially those involving dynamic creation/passing of communication channels and resources, which often appears in practical software. To this end, we design a type system for a π-calculus extended with resource creation/access primitives, as an extension of the behavioral type system by Igarashi and Kobayashi. The type system guarantees the safety property that no invalid access is performed, as well as the property that necessary accesses (such as the close operation for a file) are eventually performed unless the program diverges. A sound type inference algorithm for the type system is also developed to free the programmer from the burden of writing complex type annotations. Based on the algorithm, we have implemented a prototype resource usage analyzer for the π-calculus. To the authors’ knowledge, ours is the first type-based resource usage analysis that deals with an expressive concurrent language like the π-calculus.