1. Verifying GME with JPF
COSC6490A
Zhenyu Pan
York University
2007

2. GME Algorithm & Properties
P1: Mutual Exclusion (ME)
P2: Deadlock-Freedom (DF)
P3: Lockout-Freedom (LF)
P4: First-Come-First-Served (FCFS)
P5: Concurrent Entering (CE)
Feb-19
Verifying GME with JPF

3. Verification First Try
Applet
navy 306 % jpf Balls
[SEVERE] JPF exception, terminating: no main() method in Balls
gov.nasa.jpf.JPFException: no main() method in Balls
at gov.nasa.jpf.jvm.JVM.pushMain(JVM.java:366)
at gov.nasa.jpf.jvm.JVM.initialize(JVM.java:226)
at gov.nasa.jpf.JPF.run(JPF.java:365)
at gov.nasa.jpf.JPF.main(JPF.java:297)
Feb-19
Verifying GME with JPF

4. Verification Pre-process
Objective
Verify the 5 properties of the Hadzilacos algorithm
Not verify the whole implementation (the applet)
Pre-processing
Remove irrelevant code
java.awt.*; java.applet.*;
balls’ speeds; balls’ colors;
3 Classes -> 2 Classes;
applet -> console application
Rewrite compact code
java.util.*, Vector -> array
Feb-19
Verifying GME with JPF

5. Verification Simplification
Why Simplify
JPF speed and PC memory limitation
Original Version
N processes, M groups;
Main loop
Trying Protocol
Critical Section
Exit Protocol
Simplified Version
2 processes, 1 or 2 groups;
Main loop is the same
Feb-19
Verifying GME with JPF

6. Verifying Mutual Exclusion
P1: Mutual Exclusion
Definition
If two processes are in the CS at the same time, then they request the same session.
Case 1: 2 processes, 2 groups
Code modification in red
doorway();
cs = 1; // set cs = 1 to indicate that the process is in the CS
for (int i = 0; i < BALL_NUM; i++) { // loop for all the processes
if (b[i].id != id) // except the current process
assert (b[i].cs==0); //assert if other processes in the CS }
cs = 0; // reset cs = 0 to indicate that the process is out of the CS
exit();
// Processes belong to different groups
Feb-19
Verifying GME with JPF

7. Verifying Mutual Exclusion (cont.)
Result
No errors found;
Running time: 1m30s
Conclusion
Verified
Feb-19
Verifying GME with JPF

8. Verifying Deadlock Freedom
P2: Deadlock Freedom
Definition
If a set of processes are in the trying protocol, then eventually at least one process enters the CS.
Case 1: 2 processes, 2 groups
No errors found;
Running time: 1m
Case 2: 2 processes, 1 group
No result in 2h
Conclusion
Partly verified
Feb-19
Verifying GME with JPF

9. Verifying Concurrent Entering
P5: Concurrent Entering
Definition
If some processes request a same session and no process requests a different session, then they enter the CS concurrently.
Case 1: 2 processes, 1 group
Code modification is the same as the ME verification
Processes belong to one group
doorway();
cs = 1; // set cs = 1 to indicate that the process is in the CS
for (int i = 0; i < BALL_NUM; i++) { // loop for all the processes
if (b[i].id != id) // except the current process
assert (b[i].cs==0); //assert if other processes in the CS }
cs = 0; // reset cs = 0 to indicate that the process is out of the CS
exit();
// Processes belong to one group
Feb-19
Verifying GME with JPF

10. Verifying Concurrent Entering (cont.)
Result
Lots of CE cases
Running time: No result in 2h
Conclusion
There are lots of CE, but can not verify it’s always true
Partly verified
Feb-19
Verifying GME with JPF

11. Lockout-Freedom & First-Come-First-Served
P3: Lockout-Freedom (LF)
Definition
Every process in the trying protocol eventually enters the CS
P4: First-Come-First-Served (FCFS)
When a process wants to enter the CS, it first executes the doorway code of the trying protocol. If Pi exits the doorway before Pj enters the doorway, then Pi enters the CS before Pj enters the CS
Verification
It is hard to design plans to verify P3 and P4
Feb-19
Verifying GME with JPF

12. Verification Conclusion
P1: ME verified
P2: DF partly verified
P3: LF not verified
P4: FCFS not verified
P5: CE partly verified
Conclusion
JPF is a useful tool for verification
JPF is limited by speed and memory
Feb-19
Verifying GME with JPF

13. Thank You! ???
Feb-19
Verifying GME with JPF