Reference. Verifying Wait-Freedom for Concurrent Higher-Order Programs
Wait-freedom is the strongest non-blocking progress guarantee for concurrent data structures, ensuring that every operation completes in a finite number of steps regardless of interference from other threads. While verification of wait-freedom has been studied for first-order languages, verifying it for higher-order programming languages with general references remains an open challenge. In such languages, operations may be used by arbitrary, unverified higher-order clients, making it unclear how to even define wait-freedom formally in terms of programs’ semantics, let alone prove it. In this paper, we present the first framework for verifying wait-freedom of concurrent programs written in a higher-order language with general references. Our approach is based on the Lawyer concurrent separation logic which has been recently introduced for termination verification. We identify a specification pattern in the Lawyer logic that captures wait-freedom. To establish this connection formally, we prove a novel adequacy theorem for Lawyer which states that programs which are proven correct in the Lawyer logic against a specification in the aforementioned specification pattern are wait-free. Proving wait-freedom requires to show that all calls made to operations by any arbitrary client terminate. Thus, as a part of proving the adequacy theorem above, we need to prove that the behavior of the client of the data structure is safe in the sense that it does not break the internal invariants of the data structure, e.g., by directly manipulating the data structure’s internal state. To this end, we develop a logical relations model that establishes safety for all clients once and for all. We demonstrate the effectiveness of our approach by proving wait-freedom for several representative examples, including a higher-order list map function, and a memory-efficient single-producer, single-consumer queue. For the latter, wait-freedom is conditional in that, as the name suggests, there can be at most one enqueuer thread and one dequeuer thread. To capture this formally, we introduce the notion of restricted wait-freedom as a variant of wait-freedom that restricts the number of concurrent threads, and show how our approach can support reasoning about restricted wait-freedom. All our results have been mechanized on top of the Rocq Prover and using the Iris separation logic framework that Lawyer is also based on.
Cite
Cites 38 works (6 here)
With notes (6)
Lawyer: Modular Obligations-Based Liveness Reasoning in Higher-Order Impredicative Concurrent Separation Logic namakonov-2026-lawyer
Higher-order concurrent separation logics, such as Iris, have been tremendously successful in verifying safety properties of concurrent programs. However, state-of-the-art attempts to verify liveness properties in such logics have so far either lacked modularity (the ability to compose specifications of independent modules), or they have been far too complex to mechanize in a proof assistant. In this work, we introduce Lawyer — a mechanized program logic for modular verification of (fair) termination of concurrent programs. Lawyer draws inspiration from state-of-the-art approaches that use obligations for specifying and proving termination. However, unlike these approaches, which incorporate obligations by instrumenting the source code with erasable auxiliary code and state, Lawyer avoids such instrumentations. Instead, Lawyer incorporates obligations into the logic by embedding them into a purely logical labeled transition system that the program is shown to refine — this makes Lawyer far more amenable to mechanization. We demonstrate the expressivity of Lawyer by verifying termination of a range of examples, including modular verification of a client program whose termination relies on correctness of a fair lock library, and (separately) proving that a ticket lock implementation implements that library’s interface. To the best of our knowledge, Lawyer is the first mechanized program logic that supports modular higher-order impredicative liveness specifications of program modules. All the results that appear in the paper have been mechanized in the Rocq proof assistant on top of the Iris separation logic framework.
Trillium: Higher-Order Concurrent and Distributed Separation Logic for Intensional Refinement timany-2024-trillium
Expressive state-of-the-art separation logics rely on step-indexing to model semantically complex features and to support modular reasoning about imperative higher-order concurrent and distributed programs. Stepindexing comes, however, with an inherent cost: it restricts the adequacy theorem of program logics to a fairly simple class of safety properties. In this paper, we explore if and how intensional refinement is a viable methodology for strengthening higher-order concurrent (and distributed) separation logic to prove non-trivial safety and liveness properties. Specifically, we introduce Trillium, a language-agnostic separation logic framework for showing intensional refinement relations between traces of a program and a model. We instantiate Trillium with a concurrent language and develop Fairis, a concurrent separation logic, that we use to show liveness properties of concurrent programs under fair scheduling assumptions through a fair liveness-preserving refinement of a model. We also instantiate Trillium with a distributed language and obtain an extension of Aneris, a distributed separation logic, which we use to show refinement relations between distributed systems and TLA + models.
Transfinite Iris: resolving an existential dilemma of step-indexed separation logic spies-2021-transfinitex
Iris from the ground up: A modular foundation for higher-order concurrent separation logic jung_etal_iris_ground_up_2018
Iris is a framework for higher-order concurrent separation logic, which has been implemented in the Coq proof assistant and deployed very effectively in a wide variety of verification projects. Iris was designed with the express goal of simplifying and consolidating the foundations of modern separation logics, but it has evolved over time, and the design and semantic foundations of Iris itself have yet to be fully written down and explained together properly in one place. Here, we attempt to fill this gap, presenting a reasonably complete picture of the latest version of Iris (version 3.1), from first principles and in one coherent narrative.
Iris: Monoids and Invariants as an Orthogonal Basis for Concurrent Reasoning jung-2015-iris
Verified Software Toolchain appel_vst_2011
External (32)
- Verifying wait-freedom for concurrent higher-order programs (artifact) (2026)
- Verifying wait-freedom for concurrent higher-order programs (technical appendix) (2026)
- Designing and proving robust safety of efficient capability machine programs (2023)
- Theorems for free from separation logic specifications (2021)
- Non-blocking synchronization in operating systems (2021)
- A wait-free universal construction for large objects (2020)
- An Efficient Universal Construction for Large Objects (2020)
- The future is ours: prophecy variables in separation logic (2019)
- Practical progress verification of descriptor-based non-blocking data structures (2019)
- Lecture notes on Iris: Higher-order concurrent separation logic (2017)
- A wait-free hash map (2017)
- Robust and compositional verification of object capability patterns (2017)
- Modular termination verification for non-blocking concurrency (2016)
- A wait-free stack (2016)
- A program logic for concurrent objects under fair scheduling (2016)
- Tada: A logic for time and data abstraction (2014)
- Compositional verification of termination-preserving refinement of concurrent programs (2014)
- A methodology for creating fast wait-free data structures (2012)
- Wait-free linked-lists (2012)
- A highly-efficient wait-free universal construction (2011)
- Expressive modular fine-grained concurrency specification (2011)
- Wait-free queues with multiple enqueuers and dequeuers (2011)
- The impact of higher-order state and control effects on local relational reasoning (2010)
- Proving that nonblocking algorithms don’t block (2009)
- Modular fine-grained concurrency verification (2008)
- Deriving linearizable fine-grained concurrent objects (2008)
- Logarithmic-time single deleter, multiple inserter wait-free queues and stacks (2005)
- Simple, fast, and practical non-blocking and blocking concurrent queue algorithms (1996)
- Wait-freedom vs. bounded wait-freedom in public data structures (extended abstract) (1994)
- Wait-free synchronization (1991)
- Linearizability: A correctness condition for concurrent objects (1990)
- Tentative steps toward a development method for interfering programs (1983)