Corecursion in Session-Typed Processes
Total Page:16
File Type:pdf, Size:1020Kb
Corecursion in Session-Typed Processes Bernardo Toninho∗y, Lu´ıs Caires∗ and Frank Pfenningy ∗CITI and FCT - Universidade Nova de Lisboa yCarnegie Mellon University Abstract—Session types are widely accepted as a useful expres- has sparked a renewed interest in session types and their foun- sive discipline for structuring communications in concurrent and dations [5], and in the idea of exploiting logically motivated distributed systems. In order to express infinitely unbounded approaches for providing powerful reasoning techniques about sessions, as required to model the behaviour of realistic dis- tributed systems, session typed languages often introduce general concurrent and distributed systems. This line of work has recursion operators at both the program and the type level. addressed concepts such as value-dependent types [6], proof- Unfortunately, general recursion, in particular when combined carrying code [7] behavioural polymorphism [8], and higher- with name passing and mobility, may easily introduce undesirable order computation [9], approaching a general type theory for divergence, e.g., infinite unobservable reduction sequences. session-based concurrency, with strong guarantees by virtue In this paper we address, by means of typing, the challenge of ensuring non-divergence in a session-typed π-calculus with of typing such as deadlock freedom and session fidelity. general (co)recursion, while still allowing interesting infinite Although in the untyped case infinite behavior is potentially behaviours to be definable, as necessary to model realistic open encodable using replication in the π-calculus, to express process networks and distributed systems. Our approach builds infinitely unbounded session exchanges, as required to model on a Curry-Howard correspondence between our type system the behaviour of realistic distributed systems, session typed and a standard system of linear logic extended with co-inductive types, for which our non-divergence property implies consistency. languages often introduce general recursion operators at both We prove type safety for our framework, implying protocol the program and the type level. In a typed setting, replication compliance and global progress of well-typed processes. Remark- can only capture finite session behavior that can be replicated ably, we also establish - through a logical relations argument - (shared) arbitrarily often. It is not rich enough to model infinite that well-typed processes are compositionally non-divergent, in session behavior, nor repeating behavioral patterns that depend the sense that no well-typed composition of processes, including compositions dynamically assembled through name passing, can on evolving state. result in divergent behaviour, a property of practical relevance. Unfortunately, existing session type systems for (channel- passing, higher-order) systems equipped with general recur- I. INTRODUCTION sion operators do not avoid validating systems exhibiting un- This work addresses, by means of a logically motivated desirable divergence, e.g., infinite sequences of unobservable typing discipline, the problem of ensuring compositional non- internal reduction steps. While this issue already arises at the divergence in session-based process systems with infinite level of individual systems, it but becomes more serious when behaviour defined using (co)recursive types. one needs to consider realistic dynamically linked distributed We live in an age of concurrent and distributed software, systems. For example, plugging together subsystems, e.g. as a meant to run not only as local applications but as cooperating result of dynamic channel passing or of linking downloaded parts of larger, distributed and mobile services, meant to run (higher-order) code to local services, may undesirably result indefinitely with multiple independent clients, which are hard in a system actually unable to offer its intended services due to build and ensure correct. Process models combined with to divergent behavior, even if the component subsystems are techniques for precisely characterising and analysing system well-typed and divergence-free, and this may be caused by behavior have been exploited to verify properties such as simple programming error or by malicious intentions (e.g. a deadlock freedom, protocol compliance, and availability of denial of service attack). distributed and service based systems. Among type-based In this work, we tackle the challenge of reconciling general approaches to verification, a rather successful technique has recursion, thus enabling potentially infinite behaviour to be been that of session types [1], [2], [3]. expressed, with local termination and strong normalization Session types structure message-based concurrency around within a session typed framework. As a toy example, consider the notion of a session, which is a precise description of the a web service from Twitter offering a replicated service trends interaction patterns of two (or more) communicating agents which is intended to produce a stream of current trends, with an intrinsic notion of protocol state (e.g. input a string according to some custom metrics. To that end, the service and then output an integer) and duality. Thus, session types are is parametrized by a filter process that given a stream of a form of protocol descriptions that can be statically checked tweets produces a stream of trends. The code implementing for compliance. The recent discovery of a correspondence be- the service is: tween (all linear and shared features of) session types and pure Serv !trends(x):x(f):(νy)fhyi:(TweetSrc j [f $ x]) Linear Logic in the style of Curry-Howard [4], linking proofs , y with typed processes and proof reduction as communication, When invoked, the Serv replicated service creates a new session on fresh channel x, inputs on session x the appropriate to a divergent behavior), an important property out of the scope filter function f, links it to the internal tweet source TweetSrcy of existing session type systems with recursive types. and then repeatedly forward the results back on session x. The We summarise the contributions of our work: session types involved are: • We introduce a session type system for our process calculus based on linear logic with coinductive types, as- TrendService , !((Tweets ( Trends) ( Trends) sociating corecursive process definitions with coinductive Tweets , νX:(tweet ^ X) Trends , νY:(trend ^ Y ) session types which encode potentially infinite session A possible client for the service Serv is behavior. • We show that well-typed processes enjoy very strong Joe , (νx)trendshxi:(νk)xhki:(Fkj(corec Z:x(y):phyi:Z)) safety properties such as type preservation (or session This process invokes the shared server, resulting in a fresh fidelity) and progress, even in the presence of corecursion. session in channel x, sends (access to) a custom analytics • We prove that well-typed processes are compositionally package Fk, and then sits in a loop printing out (on session p) non-divergent by employing a logical relations argument, each trend received from the server in session x. In our type extended to coinductive session types, which combined system, we may derive the typing judgment with type safety ensures that any well-typed, distributed trends:TrendService ` Joe :: p:Trends service implemented in our calculus will not only never “get stuck”, but will also never become unavailable Notice that we build on the intuitionistic formulation of through divergent behavior. linear logic based session types [4], where typing judgments have the form Γ; ∆ ` P :: x:U. This states of process P II. PROCESS MODEL that it provides a session of type U at x, when composed In this section we introduce our process calculus, essentially with services / sessions as specified by Γ; ∆. Using the cut consisting of a (synchronous) π-calculus with basic data types rule, we may compose the server with a client in a system for convenience, input-guarded replication, labelled choice and Sys , (νtrends)(Serv j Joe). System Sys will (unboundedly) selection and corecursion. The syntax of processes is given print out trends on channel p, actually, system Sys is typed as below: ` Sys :: p:Trends . Being typed in our system, and although it M; N ::= ::: (basic data constructors) generates an infinite stream of trends at p, involves higher- P; Q ::= xhMi:P j x(y):P j xhyi:P j (νy)P order name passing, dynamic linking, and occurrences of j !x(y):P j P jQ j x:case(l ) P ) j x:l ; P recursive calls, Sys will never get into internal divergence. It j j i j (corec X(y):P ) c j X(c) j [x $ y] j 0 is challenging to obtain an expressive typing discipline ensur- ing the compositional non-divergence property. For instance, We range over basic data with M; N and processes with P; Q. consider the very similar looking processes We write y and c for a list of variables and channels, respec- tively. We write fn(P ) for the free names of process P . Basic Loop corec L(c):c(x):(νd)(L(d) j dhni:[d $ c]) , data type constructors include the typical constructs for ma- Good , corec G(c):chxi:(νd)(G(d) j chni:[d $ c]) nipulating data such as numbers, strings and lists. The process These two processes do not autonomously eventually diverge. language is a synchronous π-calculus with term input x(y):P It is possible to type Good, thus ensuring that it will never and output xhMi:P , channel output chyi:P , input-guarded diverge, even when composed with arbitrary (well-typed) replication !x(y):P , n-ary labelled choice x:case(lj ) Pj) processes. However, this is not the case for process Loop, and selection x:li; P , channel forwarding [x $ y] and, cru- which gets into an infinite internal reduction sequence after cially, a parametrized corecursion operator (corec X(y):P ) c, the first communication on c, and (of course) is not typeable enabling corecursive process definitions (the variables y are in our type system. bound in P ). The parameters are used to instantiate channels Our work has important practical and foundational con- (and values) in recursive calls accordingly.