Building Extensible Program Logics through Effect Handlers
This paper proposes an approach for building extensible program logics by implementing effect handlers within a base logic to model complex behaviors like concurrency and crash recovery, thereby enabling the derivation of expressive reasoning rules and relational refinements in a modular and reusable manner.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are trying to build a super-secure fortress to protect a digital castle. In the world of computer science, these fortresses are called program logics. They are sets of strict rules that mathematicians and programmers use to prove a piece of software will never crash, leak secrets, or do anything weird.
For a long time, building these fortresses was like hand-carving every single brick. If you wanted to add a new feature—like a way for the software to handle a power outage (crash recovery) or talk to other computers across the ocean (distributed systems)—you had to start from scratch. You needed a special kind of "brick-layer" skill that was totally different from the skill needed to just use the fortress. It was hard, slow, and you couldn't easily reuse bricks from an old fortress to build a new one.
The Big Idea: The "Effect Handler" Toolkit
This paper, written by Zichen Zhang, Simon Oddershede Gregersen, and Joseph Tassarotti, proposes a new way to build these fortresses. Instead of hand-carving bricks, they use a magical tool called effect handlers.
Think of an effect handler like a customizable rulebook for a game. In a standard video game, the rules for jumping or shooting are hard-coded into the engine. But with effect handlers, the game engine says, "I don't know what 'jumping' means yet; I'll just wait for someone to tell me." Then, a programmer can write a little script (a handler) that says, "Okay, when the player tries to jump, I'll make them float for a second."
The authors built a tiny, empty language called FicusLang that has no rules at all, except for this "wait for instructions" feature. Then, they wrote handlers to create the rules for things like:
- Memory: How the program remembers things (like a sticky note).
- Concurrent Threads: How the program does many things at once (like a chef juggling multiple pans).
- Crashes: What happens when the power goes out and comes back on.
- Distributed Systems: How computers talk to each other over a shaky network.
The Magic Trick: Building Up
The coolest part is that they didn't just make these rules; they proved them. They started with the empty language, wrote a handler for "memory," and used a logic system called Ficus to prove that their memory handler worked correctly. Once that was proven, they could use that "memory" handler to build a "concurrency" handler.
It's like building a house. First, you prove your foundation is solid. Then, you use that solid foundation to build the first floor. Once the first floor is proven safe, you use it to build the second floor. Because they built it this way, they could mix and match features easily. If you wanted a house with both a pool and a garage, you just combined the "pool handler" and the "garage handler" without having to rebuild the whole foundation.
Stronger Rules and New Tricks
Because they built these rules from the ground up using handlers, they found they could make stronger rules than previous methods.
- The "Pause" Trick: In standard concurrent programming, the computer can stop a task at any tiny moment to switch to another task. This creates a huge mess of possibilities that is hard to track. The authors' handler only switches tasks when a specific "effect" happens (like a request to read a file). This reduces the chaos. They proved that this "pause only when asked" method is just as safe as the "pause anytime" method, but it's much easier to reason about.
- The "Crystal Ball" (Prophecy Variables): Sometimes, to prove a program is safe, you need to know what a random event will do before it happens. The authors created a "crystal ball" effect handler. It lets the proof say, "I predict this random number will be 5," and then checks later if it was right. They showed you can build local crystal balls (for one specific variable) out of a giant global one, and even make them appear automatically for memory operations without the programmer having to write extra code.
The "Relational" Logic: The Twin Test
The paper also introduces a new tool called RelFicus. Imagine you have two identical twins, Program A and Program B. You want to prove that if you give them the same input, they will always behave the same way, even if one of them is a slightly different version of the other.
RelFicus is a logic that lets you run these two programs side-by-side in your head (using "ghost state" or imaginary resources) to prove they are twins. This is crucial for proving that their new "pause-only-when-asked" concurrency handler is actually safe. They used this twin test to prove that adding extra "pause points" (preemption) wouldn't change the outcome of the program, which justifies their simpler, easier-to-use model.
What They Didn't Do (and What They Rejected)
It's important to know what this paper is not.
- They are not saying that the old way of building logics (the "hand-carved brick" method) is useless. They are just saying it's hard to reuse and hard to build upon.
- They reject the idea that you need to understand complex, abstract math structures (like "ITrees" mentioned in previous work) to build these logics. They argue that their approach is more accessible because it uses standard programming concepts (handlers) that are already familiar to developers.
- They do not claim to have solved every problem in computer security. They specifically built handlers for memory, concurrency, crashes, and distributed systems, but they acknowledge that other features might need new handlers.
How Sure Are They?
The authors are very confident, but they are precise about it. They didn't just "suggest" this might work; they proved it.
- They wrote the entire logic system in a tool called Rocq Prover (a computer program that checks math proofs).
- They proved a theorem called Adequacy, which guarantees that if their logic says a program is safe, the program will actually run without getting stuck.
- They proved that their new concurrency model is equivalent to the standard, more complex models.
- They showed that their "crystal ball" (prophecy) features work by deriving them from a global version, proving the math holds up.
The Takeaway
This paper is like giving computer scientists a set of Lego bricks instead of a pile of wet clay. Before, if you wanted to build a new type of castle, you had to mix the clay yourself. Now, you have pre-made, pre-tested bricks for "memory," "crashes," and "networks." You can snap them together, and the math guarantees the castle won't fall down. It makes building complex, safe software less like a solo art project and more like a collaborative construction site where everyone can reuse the best parts.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.