Problem 1 (verification)
Three processes share a global variable x, and each process (named P; in a mixed syntax) performs the following:
int k; /* local variable */
for (k = 0; k < 5; k++) {
LOAD(x); INCREMENT(x); STORE(x);
}
That is, each process executes “x++;” five times, but each assignment is realized in three steps using its own register. Now consider the following parallel program:
x = 0;
run P(); run P(); run P();
What is the smallest possible value of x upon program termination? Make a conjecture and verify that using Spin.
51
Hints for Problem 1
1. Model the three processes and the main (init) program in Prolmela
by implementing the behavior of LOAD, INCREMENT, and STORE using the constructs of Promela.
2. Suppose your conjecture is x==5. Two steps are necessary: a. Verify that x==5 is a possible outcome upon termination.
This can be done by asserting that, when only one process (the main process) remains active after three run P(); x cannot be 5.
The number of active processes can be obtained by the _nr_pr special variable or by counting them explicitly.
b. Verify that x < 5 is not a possible outcome upon termination.
52
Problem 2 (verification)
Two global int variables, x and y, are initialized to 10 and 0.
Two threads execute the following statements (in mixed syntax):
Thread1: while (x != y) {x = x - 1; y = y + 1;} Thread 2: await (x == y); atomic{x = 8; y = 2;}
Like in Promela, each assignment is an atomic action. Write a Promela model that captures the behavior of this system and
1. Use Spin to check if both threads always terminate, and to show what the final values of x and y can be.
2. Explain what happens if the two assignments in Thread 2 are not done atomically, and confirm your explanation using Spin.
Note: There may (and may not) be two or more final values.
53
Hints for Problem 2
Suppose you think that the possible final values are (𝑥 , 𝑦 )
and 𝑥2, 𝑦2 . Then you need to verify two things:
1. Both (𝑥 , 𝑦 ) and 𝑥 , 𝑦 are possible outcomes.
11
54
11 22
2. Any pair of values other than (𝑥 ,𝑦 ) and 𝑥 ,𝑦 are
not possible.
11 22
Problem 3* (simulation)
Our “Small Set of Integers” program maintains a set of integers using a linear list of processes. An alternative representation of sets would use an ordered binary tree of processes in order to achieve better response to ‘has’ messages.
5 37
55
Write a Promela model of this binary tree representation, and check if it correctly responds to a sequence of ‘insert’ and ‘has’ messages.
11 is sufficient for this problem, but make 8
sure that your test data cover all possible branches. Note: It is not required to balance the tree.
Note: Testing (rather than verification)
Problem 4 (verification)
A counting semaphore allows N (rather than one) client processes to enter a critical section at the same time.
Extend our binary semaphore model (Version 2, slide 24)
to a counting semaphore with a general N, where N is given as a parameter upon process creation.
Then, create a counting semaphore with N=3, run it with five client processes wanting to enter critical sections infinitely often, and check that
1. it never lets more than three processes enter the critical sections, and that
2. it may let three processes enter the critical sections.
Note: You may have to change the algorithm of slide 24.
56
Problem 5* (verification)
The semaphores in the course slides may cause starvation
(i.e., some process cannot enter a critical section in finite time). To avoid it will require a different design. Design and implement a counting semaphore that won’t cause starvation.
Then, create a counting semaphore with N=3, run it with five client processes wanting to enter critical sections infinitely often, and check that
1. it never lets >3 processes enter the critical sections,
2. it may let three processes enter the critical sections, and
3. a process wanting to enter a critical section will enter it eventually.
Hint: Consider using a channel with non-zero capacity.
57
Assignment #1 (1/2)
Solve Problems 1 to 5 (Problems 3 and 5 are optional, but choose at least one of them). Your report should include:
problem analysis (i.e., how you reached your solutions),
the Promela models you wrote,
execution results (for verification problems, copy and paste the first dozen or so lines up to “atomic steps”), and
discussions.
Notes:
(1) You must use the verification mode except for Problem 3. (2) You can add auxiliary variables, expressions, statements,
and processes for the purpose of verification.
(3) To solve each problem, you may run your program(s)
several times using different assertions or parameter values.
58