All for One and One for All: Program Logics for Exploiting Internal Determinism in Parallel Programs

2025-11-28

AI Summary

Non-determinism in parallel programs severely impedes formal verification. To address this, we propose a novel verification paradigm grounded in *internal determinism*: first, we define the notion of *schedule-independent safety*, reducing correctness of parallel programs to verification over a single execution path; second, we develop Musketeer Separation Logic to establish its theoretical foundation and design Angelic Logic to support dynamic single-path verification; third, we devise the affine type system MiniDet, fully machine-verified within the Iris framework in Rocq (a Coq-based proof assistant), enabling verified deterministic primitives such as concurrent hash sets. This work is the first to systematically exploit internal determinism to simplify concurrent verification. All theoretical results—including syntax, semantics, soundness proofs, and implementation—are end-to-end formally verified in Coq (Rocq), yielding the first fully verified, end-to-end framework for deterministic parallel programming.

Technology Category

• Planning, Routing, and Scheduling: Deterministic Planning
• Data Mining & Knowledge Management: Scalability, Parallel & Distributed Systems
• Multiagent Systems: Multiagent Systems under Uncertainty

Application Category

• Security and Privacy: Data transparency and provenance
• Systems and Infrastructure for Web, Mobile and WoT: Decentralized Web and Fediverse systems
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

Nondeterminism makes parallel programs challenging to write and reason about. To avoid these challenges, researchers have developed techniques for internally deterministic parallel programming, in which the steps of a parallel computation proceed in a deterministic way. Internal determinism is useful because it lets a programmer reason about a program as if it executed in a sequential order. However, no verification framework exists to exploit this property and simplify formal reasoning about internally deterministic programs. To capture the essence of why internally deterministic programs should be easier to reason about, this paper defines a property called schedule-independent safety. A program satisfies schedule-independent safety, if, to show that the program is safe across all orderings, it suffices to show that one terminating execution of the program is safe. We then present a separation logic called Musketeer for proving that a program satisfies schedule-independent safety. Once a parallel program has been shown to satisfy schedule-independent safety, we can verify it with a new logic called Angelic, which allows one to dynamically select and verify just one sequential ordering of the program. Using Musketeer, we prove the soundness of MiniDet, an affine type system for enforcing internal determinism. MiniDet supports several core algorithmic primitives for internally deterministic programming that have been identified in the research literature, including a deterministic version of a concurrent hash set. Because any syntactically well-typed MiniDet program satisfies schedule-independent safety, we can apply Angelic to verify such programs. All results in this paper have been verified in Rocq using the Iris separation logic framework.

Problem

• Lack of verification framework for internally deterministic parallel programs
• Defining schedule-independent safety to simplify formal program reasoning
• Developing Musketeer logic to prove safety and Angelic logic for verification

Innovation

• Separation logic Musketeer for schedule-independent safety
• Angelic logic verifies one sequential ordering
• Affine type system MiniDet enforces internal determinism