Verifying GME with JPF COSC6490A Zhenyu Pan York University 2007

GME Algorithm & Properties P1: Mutual Exclusion (ME) P2: Deadlock-Freedom (DF) P3: Lockout-Freedom (LF) P4: First-Come-First-Served (FCFS) P5: Concurrent Entering (CE) Feb-19 Verifying GME with JPF

Verification First Try Applet navy 306 % jpf Balls [SEVERE] JPF exception, terminating: no main() method in Balls gov.nasa.jpf.JPFException: no main() method in Balls at gov.nasa.jpf.jvm.JVM.pushMain(JVM.java:366) at gov.nasa.jpf.jvm.JVM.initialize(JVM.java:226) at gov.nasa.jpf.JPF.run(JPF.java:365) at gov.nasa.jpf.JPF.main(JPF.java:297) Feb-19 Verifying GME with JPF

Verification Pre-process Objective Verify the 5 properties of the Hadzilacos algorithm Not verify the whole implementation (the applet) Pre-processing Remove irrelevant code java.awt.*; java.applet.*; balls’ speeds; balls’ colors; 3 Classes -> 2 Classes; applet -> console application Rewrite compact code java.util.*, Vector -> array Feb-19 Verifying GME with JPF

Verification Simplification Why Simplify JPF speed and PC memory limitation Original Version N processes, M groups; Main loop Trying Protocol Critical Section Exit Protocol Simplified Version 2 processes, 1 or 2 groups; Main loop is the same Feb-19 Verifying GME with JPF

Verifying Mutual Exclusion P1: Mutual Exclusion Definition If two processes are in the CS at the same time, then they request the same session. Case 1: 2 processes, 2 groups Code modification in red doorway(); cs = 1; // set cs = 1 to indicate that the process is in the CS for (int i = 0; i < BALL_NUM; i++) { // loop for all the processes if (b[i].id != id) // except the current process assert (b[i].cs==0); //assert if other processes in the CS } cs = 0; // reset cs = 0 to indicate that the process is out of the CS exit(); // Processes belong to different groups Feb-19 Verifying GME with JPF

Verifying Mutual Exclusion (cont.) Result No errors found; Running time: 1m30s Conclusion Verified Feb-19 Verifying GME with JPF

Verifying Deadlock Freedom P2: Deadlock Freedom Definition If a set of processes are in the trying protocol, then eventually at least one process enters the CS. Case 1: 2 processes, 2 groups No errors found; Running time: 1m Case 2: 2 processes, 1 group No result in 2h Conclusion Partly verified Feb-19 Verifying GME with JPF

Verifying Concurrent Entering P5: Concurrent Entering Definition If some processes request a same session and no process requests a different session, then they enter the CS concurrently. Case 1: 2 processes, 1 group Code modification is the same as the ME verification Processes belong to one group doorway(); cs = 1; // set cs = 1 to indicate that the process is in the CS for (int i = 0; i < BALL_NUM; i++) { // loop for all the processes if (b[i].id != id) // except the current process assert (b[i].cs==0); //assert if other processes in the CS } cs = 0; // reset cs = 0 to indicate that the process is out of the CS exit(); // Processes belong to one group Feb-19 Verifying GME with JPF

Verifying Concurrent Entering (cont.) Result Lots of CE cases Running time: No result in 2h Conclusion There are lots of CE, but can not verify it’s always true Partly verified Feb-19 Verifying GME with JPF

Lockout-Freedom & First-Come-First-Served P3: Lockout-Freedom (LF) Definition Every process in the trying protocol eventually enters the CS P4: First-Come-First-Served (FCFS) When a process wants to enter the CS, it first executes the doorway code of the trying protocol. If Pi exits the doorway before Pj enters the doorway, then Pi enters the CS before Pj enters the CS Verification It is hard to design plans to verify P3 and P4 Feb-19 Verifying GME with JPF

Verification Conclusion P1: ME verified P2: DF partly verified P3: LF not verified P4: FCFS not verified P5: CE partly verified Conclusion JPF is a useful tool for verification JPF is limited by speed and memory Feb-19 Verifying GME with JPF

Thank You! ??? Feb-19 Verifying GME with JPF