1. Example: Infinite Split and Merge #define N 128 #define size 16 chan in = [size] of {short}; chan large = [size] of {short}; chan small = [size] of {short}; proctype split() {short cargo; do :: in?cargo -> if :: (cargo >= N) -> large!cargo :: (cargo small!cargo fi od} proctype merge() { short cargo; do :: if :: large?cargo :: small?cargo fi; in!cargo od} init {in!345; in!12; in!6777; in!32; in!0; run split(); run merge()}

2. 2 Data Types Basic bit 0.. 1 byte0.. 255 short- (2^15)-1.. (2^15)-1 int - (2^31)-1.. (2^31)-1 Arrays byte state[N]state[0].. State[N-1] Enumerated Type mtype = {one, two, three, ok, ready, ack, message} one mtype definition, at most 256 symbolic constants Structures typedef Msg { byte a[3], b; chan p } Msg x; x.a[1]

3. 3 Exercise Develop a Promela description of the following: There are 3 worker processes and 1 hammer. A worker’s arm can be up or down; his/her arm can only go down (i.e. work!) when the worker has the hammer. When the worker has finished working, he/she passes the hammer to another worker. Assume mtype ={hammer, up, down}

4. 4 Workers mtype ={hammer, up, down} chan one= [1] of {mtype}; chan two = [1] of {mtype}; chan three= [1] of {mtype}; proctype worker(chan mine, a, b) {mtype m; mtype arm = up; idle: mine?m; goto work; work: arm = down; if :: atomic {a!hammer; arm = up; goto idle} :: atomic {b!hammer; arm = up; goto idle} fi } init { atomic { run worker(one,two,three); run worker(two, three,one); run worker(three,one,two); one!hammer }

5. 5 Exercise Develop a Promela description of the following: Now a worker needs both a hammer and a mallet to work and must have received the hammer first. He/she can pass the tools one at a time, randomly. Assume mtype ={hammer, up, down,mallet}

6. 6 Workers II mtype ={hammer, mallet, up, down}... proctype worker(chan mine, a, b; bit tools) {mtype m; mtype arm = up; idle: mine?m; if :: m == hammer -> tools = tools+1; goto idle; :: m == mallet -> if :: tools== 0 -> if :: atomic {a!m; goto idle} :: atomic {b!m; goto idle} fi :: tools== 1 -> tools = 0; goto work fi work: arm = down; arm = up; if :: a!hammer; a!mallet :: b!hammer; a!mallet :: a!hammer; b!mallet … /*8 possibilities */ fi goto idle }

7. 7 Process identifiers Every process instance has a unique, positive instantiation number, returned by run: short pid1 = -1; short pid2 = -1; short pid3 = -1; init { run semaphore(); pid1 = run user(); pid2 = run user(); pid3 = run user() } Uses enabled(pid) true if process is enabled cannot use with synchronous communication pcvalue(pid) returns number of state that process with no. pid is in procname[pid]@label remote reference true if process with no. pid of type procname is at label