Controlled Owicki-Gries Concurrency Framework

• The Controlled Owicki-Gries Concurrency Framework is a formal method that extends Owicki-Gries proofs to model hardware-level concurrency and nested preemption in embedded operating systems.
• It uses explicit AT guards and atomic update operations to enforce interference freedom and simplify verification conditions.
• Mechanized in Isabelle/HOL, the framework automates the verification of scheduling and system call behaviors, significantly reducing manual proof effort.

The Controlled Owicki–Gries (COG) Concurrency Framework extends the classical Owicki–Gries proof method to enable rigorous modelling and verification of embedded operating systems with fine-grained, hardware-level concurrency and nested preemption. COG provides a detailed and faithful abstraction of the ARM-style interrupt interface, supporting the analysis of systems like the preemptible eChronos OS, where most interrupts remain enabled even during core OS and scheduling operations. Mechanized in Isabelle/HOL, COG systematically reduces verification effort while preserving formal soundness, enabling high degrees of automation in the verification of real-time, responsive operating systems (Andronick et al., 2015).

1. Formal Machine Model and Execution State

COG models an ARM-style uniprocessor architecture supporting nested interrupts and two supervisor-call levels (synchronous $SVC_s$, asynchronous $SVC_a$). The global machine state $\Sigma$ is structured as a record:

$$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$

where:

• $EIT \subseteq \mathit{Routine}$: enabled interrupts;
• $AT \in \mathit{Routine}$: current "active task";
• $ATstack \in \mathit{Routine}^*$: stack of suspended $AT$s;
• $EITstack \in \mathcal{P}(\mathit{Routine})^*$: stack of previous $EIT$s;
• $SVC_a$0: async SVC request bit;
• $SVC_a$1: maps each user task to its saved async-SVC enable flag and $SVC_a$2-stack;
• $SVC_a$3: marks runnable tasks;
• $SVC_a$4, $SVC_a$5: OS event sets;
• $SVC_a$6: scheduler's next-task choice.

Hardware-relevant operations—such as interrupt enable/disable, supervisor calls, interrupt entry ($SVC_a$7) and return ($SVC_a$8)—are modelled as atomic updates on $SVC_a$9. For instance, $\Sigma$0 pushes the current $\Sigma$1 and $\Sigma$2 to their respective stacks and switches to interrupt $\Sigma$3 (conditional on hardware and policy). Supervisor calls cause stack manipulation and changes of $\Sigma$4 to $\Sigma$5 or request entry to $\Sigma$6 as atomic assignments.

2. Extended Owicki–Gries Proof Rules

The framework generalizes the parallel composition of $\Sigma$7 sequential processes $\Sigma$8 as:

$\Sigma$9

Each atomic command in process $$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$0 is augmented with a guard:

$$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$1

This guard enforces that commands execute only when process $$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$2 owns the $$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$3 slot.

The central reasoning principle is the COG-parallel rule:

$$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$4

The side condition "interference freedom"—that every atomic step preserves every other's invariant—is typically trivial under explicit $$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$5 guards, as $$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$6 contains $$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$7 which cannot be true for atomic steps guarded by $$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$8 when $$\Sigma = (EIT,\, AT,\, ATstack,\, EITstack,\, SVC_aReq,\, contexts,\, R,\, E,\, E_{tmp},\, nextT)$$9.

3. Explicit Concurrency Control and System Structure

COG enforces explicit control over the interleaving of user processes, the OS, interrupt handlers, and the scheduler. Every process body $EIT \subseteq \mathit{Routine}$0 is recursively rewritten via

$EIT \subseteq \mathit{Routine}$1

producing a guarded form. System composition in Isabelle/HOL follows the skeleton: $ATstack \in \mathit{Routine}^*$5 Each OS logic component has a control block with one call to schedule, one to context_switch, and a concluding IRet.

4. Scheduler Semantic Abstraction and Context Switching

Scheduling is separated into a policy-abstract functional selection and a concrete context-switch mechanism within $EIT \subseteq \mathit{Routine}$2.

• Task Selection: The scheduler policy,

$EIT \subseteq \mathit{Routine}$3

and OS event handler

$EIT \subseteq \mathit{Routine}$4

remain nondeterministic, enabling abstraction over scheduling and event handling strategies.

• Context Switching: When a new task $EIT \subseteq \mathit{Routine}$5 is scheduled, the current user's context is saved:
  • $EIT \subseteq \mathit{Routine}$6
  • $EIT \subseteq \mathit{Routine}$7
  • $EIT \subseteq \mathit{Routine}$8
  • The $EIT \subseteq \mathit{Routine}$9 interrupt is (re)enabled or disabled according to $AT \in \mathit{Routine}$0.

This formal decomposition aligns with real-world hardware, accurately handling nested interrupts and SVC semantics on ARM Cortex-M architectures.

5. Key Theoretical Properties and Verification Experience

COG's soundness is established via a formalization in Isabelle/HOL. The main theorem states:

$AT \in \mathit{Routine}$1

where $AT \in \mathit{Routine}$2 encapsulates all required interference-freedom conditions. Automation discharges most verification conditions (VCs); the explicit $AT \in \mathit{Routine}$3 guards reduce the number of non-trivial VCs from $AT \in \mathit{Routine}$4 to $AT \in \mathit{Routine}$5, yielding $AT \in \mathit{Routine}$6 VCs initially, with $AT \in \mathit{Routine}$7 remaining after filtering, $AT \in \mathit{Routine}$8 of which are auto-solved.

The framework establishes liveness properties such as the guarantee that, under fairness, every interrupt arrival is serviced ($AT \in \mathit{Routine}$9 executes), and that after a user yields via $ATstack \in \mathit{Routine}^*$0, scheduling occurs within at most one nested interrupt. The mechanized eChronos model, with approximately 10 tasks and 16 IRQs, type-checks and verifies in under one minute of automated proof on a mid-range laptop; remaining VCs require less than one person-day of interactive proof development.

6. Application: Formal Specification of System Calls

COG supports precise specification and verification of OS system calls. For example, the "block" call for user task $ATstack \in \mathit{Routine}^*$1 is rendered:

$ATstack \in \mathit{Routine}^*$2

To verify: $ATstack \in \mathit{Routine}^*$3

COG’s explicit guards and atomic step invariants directly support mechanized Hoare-logic proofs. In the eChronos Isabelle/HOL development, such proofs are compact and efficient (20 lines of script for the blocking call).

7. Accuracy, Usability, and Performance

The COG framework models all hardware atomicity at the register or single-instruction level matching ARM Cortex-M4 semantics, ensuring fidelity to real systems. Key usability features include:

• Substantial reduction in manual proof burden through explicit $ATstack \in \mathit{Routine}^*$4 control.
• Automation of verification conditions with proof tactics in Isabelle/HOL.
• Performance enabling end-to-end type-checking and automated VC discharge in under a minute for moderately sized OS instances.

This rigorous mechanization demonstrates that even fully preemptible, nested-interrupt kernels can be verified at scale, with high assurance, through an explicit concurrency control discipline derived from classical Owicki–Gries reasoning but adapted to the realities of real-time, preemptible OS programming (Andronick et al., 2015).