Hello World. Slides mostly a reproduction of Theo C. Ruys SPIN Beginners Tutorial April 23, Hello() print "Hello"
|
|
- Julia Bradford
- 5 years ago
- Views:
Transcription
1 Hello World CS477 Formal Software Development Methods 11 SC, UIUC inners April 3, 014 /* A "Hello World" Promela model for SPIN. */ active Hello() { printf("hello process, my pid is: %d\n", pid); init { int lastpid; printf("init process, my pid is: %d\n", pid); lastpid = run Hello(); printf("last pid was: %d\n", lastpid); inners April 3, Hello World, Sample Execution Hello Processes bash-3.$ spin hello.pml init process, my pid is: 1 Hello process, my pid is: 0 Hello process, my pid is: last pid was: 3 processes created bash-3.$ spin hello.pml Hello process, my pid is: 0 init process, my pid is: 1 last pid was: Hello process, my pid is: 3 processes created Hello() print "Hello" init() print "init" run Hello() 3 Hello() print "last" print "Hello" inners April 3, Hello Processes Interleavings Interleaving Semantics Hello() init() print "init" print "Hello" run Hello() 3 3 Hello() print "last" print "Hello" Promela processes execute concurrently. Non-deterministic scheduling of the processes. Processes are interleaved Only one process can execute a statement at each point in time. Exception: rendez-vous communication. All statements are Each statement is executed without interleaving it parts with other processes. Each process may have several different possible actions enabled at each point of execution. Only one choice is made, non-deterministically (ranmly). inners April 3, 014 5
2 eo C. Ruys - SPIN 13 September 00 Variables and Types () 13 September 0 Variables should be declared. Variables can be given a value by: assignment argument passing message passing (see communication) Variables can be used in expressions. Most arithmetic, relational, and logical operators of C/Java are supported, including bitshift operators. bb=1; ii=; short s=-1; typedef Foo { ; Foo f; f.bb = 0; f.ii = -; assignment = declaration + initialisation equal test == ii*s+7 == 3; printf( value: %d, s*s); Variables should be declared. Variables can be given a value by: assignment argument passing message passing (see communication) Variables can be used in expressions. o C. Ruys - SPIN 13 September 00 1 Most arithmetic, relational, and logical operators of C/Java are supported, including bitshift operators. Statements () Variables and Types () inners April 3, The skip statement is always executable. es nothing, only changes process process counter Statements (1) A run statement is only executable if a new process can be created (remember: the number of processes is bounded). The body of a process consists of a sequence of statements. A printf statement A statement is always is either executable (but is not executable/blocked evaluated during verification, of course). depends on the global executable: the statement can int x; state of the system. be executed Aap() immediately. blocked: { the statement cannot Executable be executed. if Noot can int y=1; skip; run Noot(); x=; An assignment is always executable. be created Can only become executable An expression x> && y==1; is also a statement; if a some it other is executable process if it evaluates skip; to non-zero. makes x greater than. < 3 always executable 3 x < 7 only executable if value of x is smaller x executable if x is not equal to 3 inners April 3, bb=1; ii=; short s=-1; typedef Foo { ; Foo f; f.bb = 0; f.ii = -; assignment = declaration + initialisation equal test == 13 September 0 ii*s+7 == 3; printf( value: %d, s*s); 113 September 0 Statements are separated by a Xspin in a nutshell semi-colon: ;. Xspin allows the user to edit Promela models (+ syntax check) Statements () simulate Promela models ranm The skip statement is always executable. interactive es guided nothing, only changes process process counter Statements with (1) dialog boxes to set A run verify statement Promelais models only executable if a new process can be created exhaustive (remember: the number of processes is bounded). The body bitstate of hashing a process mode consists of a sequence of statements. A printf statement A statement is always is either executable executable/blocked (but is not additional features evaluated during verification, of course). depends on the global executable: Xspin suggest the abstractions statement to can a Promela model (slicing) int x; state of the system. be Xspin executed can draw immediately. automata for each process Aap() LTL property manager blocked: { the statement cannot Executable be executed. if Noot can int Helpy=1; system (with verification/simulation guidelines) be created An assignment skip; is always executable. Statements are separated by a semi-colon: ;. various options and directives to tune the verification process run Noot(); 7 x=; Can only become executable An expression x> && y==1; is also a statement; if a some it other is executable process if it evaluates skip; to non-zero. makes x greater than. < 3 always executable x Thursday < 7 11-Apr-00 only executable Theo C. Ruys - SPIN if value of x is smaller 7 3 Elsa 3 L+ Gunter x CS477 executable Formal Software if Development x is not Methods equal to 3 IN 00 Workshop, Grenoble, April Statements (3) WRONG! Mutual Exclusion (1) assert(<expr>); The assert-statement is always executable. If <expr> evaluates to zero, SPIN will exit with an error, as the <expr> has been violated. The assert-statement is often used within Promela models, to check whether certain properties are valid in a state. monitor() { assert(n <= 3); receiver() { toreceiver? msg; assert(msg!= ERROR); bit flag; /* signal entering/leaving the section */ byte mutex; /* # procs in the critical section. */ P(bit i) Statements { (3) flag!= 1; models: flag = 1; assert(<expr>); while (flag == 1) /* wait */; The printf("msc: assert-statement P(%d) has is entered always section.\n", executable. i); If <expr> evaluates to zero, SPIN will exit with an error, as flag = 0; the <expr> has been violated. Problem: assertion violation! The assert-statement is often Bothused processes within can Promela pass the models, monitor() { assert(mutex to check whether!= ); certain properties flag!= are 1 at valid the same in a state. time, i.e. before flag is set to 1. monitor() { init { assert(n <= 3); { run P(0); run P(1); run monitor(); receiver() { starts two instances of process P 4 Thursday toreceiver 11-Apr-00? msg; 8 inners assert(msg April 3, 014!= 11 ERROR); Elsa L Gunter IN 00 Workshop, Grenoble, April 00 SPIN 00 Workshop, 1 Grenoble, April 00 4
3 :: Both processes can pass execute x = 1 and y = 1 at the same time, and will then be waiting for each other. 13 September 0 9 o C. Ruys - SPIN 13 September 00 Mutual Exclusion (4) Bakery Mutual Exclusion () bit x, y; /* signal entering/leaving the section */ byte mutex; /* # of procs in the critical section. */ active A() { x = 1; Process A waits for y == 0; process B to end. x = 0; active B() { y = 1; x == 0; y = 0; active monitor() { assert(mutex!= ); Problem: invalid-end-state! Both processes can pass execute x = 1 and y = 1 at the same time, and will then be waiting for each other. 9 WRONG! o C. Ruys - SPIN 13 September 00 byte turn[]; /* who s turn is it? */ byte mutex; /* # procs in critical section */ Dekker [196] Mutual Exclusion (3) P(bit i) { Problem (in Promela/SPIN): turn[i] will overrun after 55. bit x, y; /* signal entering/leaving the section */ :: turn[i] = 1; byte mutex; /* # of procs in the critical section. */ turn[i] = turn[1-i] + 1; byte turn; /* who's turn is it? */ (turn[1-i] == 0) (turn[i] < turn[1-i]); active A() { x = 1; turn turn[i] = B_TURN; = 0; od y == 0 active B() { y = 1; turn = A_TURN; More x == mutual 0 exclusion algorithms (turn == A_TURN); in (turn (good-old) == B_TURN); [Ben-Ari 1990]. monitor() Can be generalised { assert(mutex!= ); x = 0; init { y = 0; to {run a single P(0); process. run P(1); run monitor() active monitor() { Theo C. Ruys - SPIN assert(mutex!= ); 3113 September First software-only solution to the mutex problem (for two processes). 30 if-statement () inners April 3, if Bakery :: (n %!= 0) -> n=1 else inspired by: SPIN 00 Workshop, :: (n Grenoble, >= 0) > n=n- April 00 Mutual Exclusion (4) if-statement (1) Dijkstra s guarded :: (n % 3 == 0) -> n=3 command language :: else -> skip byte turn[]; /* who s turn is it? */ fi if byte mutex; /* # procs in critical section */ Dekker [196] Mutual Exclusion (3) P(bit i) { Problem (in Promela/SPIN): give n:: a ranm value non-deterministic branching turn[i] will overrun after 55. :: choice n -> stat n.1 ; stat n. ; stat n.3 ; bit :: turn[i] x, y; = /* 1; signal entering/leaving the section */ if fi; byte mutex; /* # of procs in the critical section. */ :: skip -> n=0 turn[i] = turn[1-i] + 1; byte turn; /* who's turn is it? */ :: skip -> n=1 (turn[1-i] == 0) (turn[i] < turn[1-i]); :: If skip there -> is at n= least one choice active A() { i (guard) executable, the ifstatement is executable and SPIN non-deterministically active B() { :: skip -> n=3 x = 1; y = 1; fi turn turn[i] = B_TURN; = 0; turn = A_TURN; chooses one of the executable choices. od y == 0 More x == mutual 0 exclusion algorithms skips are redundant, because assignments If no choice i is executable, the if-statement is blocked. (turn == A_TURN); in (turn (good-old) == B_TURN); [Ben-Ari 1990]. are themselves always executable The Thursday operator 11-Apr-00 -> is equivalent Theo C. Ruys to - SPIN ;. By convention, it is used 33 monitor() Can be generalised { assert(mutex!= ); within if-statements to separate the guards from the x = 0; init { y = 0; to {run a single P(0); process. run P(1); run monitor() statements that follow the guards. active monitor() { o C. Ruys - SPIN assert(mutex!= ); 3113 September 00 3 inners April 3, CS477 Formal Software First Development software-only Methods solution to the mutex problem (for two processes). 30 if-statement () if :: (n %!= 0) -> n=1 else inspired by: IN 00 Workshop, :: (n Grenoble, >= 0) > n=n- April if-statement (1) Dijkstra s guarded :: (n % 3 == 0) -> n=3 command language :: else -> skip fi if give n:: a ranm value non-deterministic branching :: choice n -> stat n.1 ; stat n. ; stat n.3 ; if fi; :: skip -> n=0 :: skip -> n=1 :: If skip there -> is at n= least one choice i (guard) executable, the if- is executable and SPIN non-deterministically :: skip -> n=3 fistatement chooses one of the executable choices. skips are redundant, because assignments If no choice are i themselves is executable, always the executable if-statement is blocked. The Thursday operator 11-Apr-00 -> is equivalent Theo C. Ruys to - SPIN ;. By convention, it is used 33 within if-statements to separate the guards from the statements that follow the guards. -statement (1) :: :: choice n -> stat n.1 ; stat n. ; stat n.3 ; With respect to the choices, a -statement behaves in the same way as an if-statement. However, instead of ending the statement at the end of the choosen list of statements, a -statement repeats the choice selection. The (always executable) break statement exits a -loop statement and transfers control to the end of the loop. 34 inners April 3, IN 00 Workshop, Grenoble, April statement (1)
4 ! Sending - putting a message into a channel 13 September o C. Ruys - SPIN 13 September 00 -statement () if- and -statements Example modelling a traffic light are ordinary Promela Communication statements; so they can -statement () be nested. mtype = { RED, YELLOW, GREEN ; if- and -statements Major models of communication mtype (message type) models enumerations in Promela Example modelling a traffic light are ordinary Promela 1 Shared variables statements; so they can active one writes, many read TrafficLight() later { be nested. mtype = { RED, YELLOW, GREEN ; Point-to-Point byte state synchronous = GREEN; message passing one sends, one other receives at the same time mtype (message type) models enumerations in Promela send blocks until receieve can happen :: (state == GREEN) -> state = YELLOW; 3 Point-to-Point asynchronous message passing active TrafficLight() { :: (state == YELLOW) -> state = RED; one sends, one other receives some time later byte state = GREEN; :: (state == RED) -> state = GREEN; send never blocks 4 Point-to-Point buffered message passing :: (state == GREEN) -> state = YELLOW; When buffer not full behaves Note: like this asynchronous -loop es not contain :: (state == YELLOW) -> state = RED; When buffer full, two variations: any non-deterministic block or drop choice. message :: (state == RED) -> state = GREEN; Thursday send never 11-Apr-00 blocks 5 Synchronous broadcast 3513 September 0 Note: this -loop es not contain any non-deterministic choice. one sends, many receive synchronously First variation: send never blocks process may receive if ready to ready Second variation: send blocks until all possible recipients ready to 35 receive Communication () inners April 3, Communication in SPIN Communication (1) With more or less complexity sr each can implement the others Sender Receiver Spin supports 1 and 4 (blocks send when buffer full), but with rs bounded buffers Buffer size = 0 = synchronous communication Large buffer size MSG approximates asynchronous communication sr!msg sr?msg ACK rs!ack Communication between processes is via channels: message passing Communication (1) rendez-vous synchronisation (handshake) sr also called: queue or buffer Sender Receiver chan <name> = [<dim>] of {<t rs 1 >,<t >, <t n >; Both are defined as channels: name of type of the elements that will be the channel transmitted over the channel sr!msg MSG number of elements in the channel dim==0 is special case: rendez-vous sr?msg chan c = [1] of {bit; chan tor = [] of {mtype, bit; ACK rs!ack chan line[] = [1] of {mtype, Record; array of channels rs?ack 37! is sending? is receiving rs?ack eo C. Ruys - SPIN 13 September 00! is sending? is receiving 36 inners April 3, Communication () Both are defined as channels: chan <name> = [<dim>] of {<t 1 >,<t >, <t n >; name of the channel type of the elements that will be transmitted over the channel number of elements in the channel dim==0 is special case: rendez-vous 37 Communication between processes is via channels: channel = FIFO-buffer (for dim>0) IN 00 Workshop, message Grenoble, passing April rendez-vous synchronisation (handshake) also called: queue or buffer chan c = [1] of {bit; chan tor = [] of {mtype, bit; chan line[] = [1] of {mtype, Record; array of channels Communication (3)! Sending - putting a message into a channel ch! <expr 1 >, <expr >, <expr n >; The values of <expr i > should correspond with the types of the channel declaration. A send-statement is executable if the channel is not full.? Receiving - getting a message out of a channel <var> + ch? <var 1 >, <var >, <var n >; message passing <const> If the channel is not empty, the message is fetched from the channel can be and the individual parts of the message are stored into the <var i >s. mixed ch? <const 1 >, <const >, <const n >; message testing If the channel is not empty and the message at the front of the channel evaluates to the individual <const i >, the statement is executable and the message is removed from the channel. 38 inners April 3, Communication (3) channel = FIFO-buffer (for dim>0)
5 Q wants to ch? 1, x Then after the communication, x will have the value eo C. Ruys - SPIN 13 September 00 Communication (4) Alternating Bit Protocol (1) Rendez-vous communication <dim> == 0 The number of elements in the channel is now zero. If send ch! is enabled and if there is a corresponding receive ch? that can be executed simultaneously and the constants match, then both statements are enabled. Both statements will handshake and together take the transition September 0 inners April 3, can be used to group statements into an sequence; Alternating Bit Protocol () all statements are executed in a single step mtype {MSG, (no interleaving ACK; with channel statements of other Receiver(chan processes) in, out) length of { no pure ity { stat 1 ; stat ; stat n is executable if stat 1 is executable chan tos = [] of {mtype, bit; bit recvbit; if a stat can be used to group statements into an sequence; chan tor = [] Alternating of i (with i>1) is blocked, {mtype, bit; Bit the ity token is Protocol (1) (temporarily) lost and other processes :: in? MSG(recvbit) may a step -> all statements are executed in a single step Sender(chan in, out) out! ACK(recvbit); (no interleaving with statements of other processes) od { Alternating (Hardware) solution Bit Protocol the mutual no pure ity exclusion problem: is executable if stat bit sendbit, recvbit; 1 is executable if a stat i (with i>1) is blocked, the ity token is :: out! MSG, sendbit -> (temporarily) lost and other processes may a step To every message, P(bit i) the { sender init adds a bit. {flag!= 1; flag { = 1; in? ACK, recvbit; The run Sender(toS, tor); if receiver acknowledges each message by sending run Receiver(toR, tos); the :: recvbit received == bit sendbit back. -> flag sendbit = = 0; 1-sendbit :: else Alternative notation: To fi receiver only excepts messages ch with! MSG(par1, a bit that ) it excepted to receive. ch? MSG(par1, ) 47 Alternating Bit Protocol To every message, the sender adds a bit. The receiver acknowledges each message by sending the received bit back. To receiver only excepts messages with a bit that it excepted to receive. Example: If the sender is sure that the receiver has correctly chan ch = [0] of {bit, byte; received the previous message, it sends a new eo C. Ruys - SPIN P wants to ch! 1, September 00 message and it alternates the accompanying bit. Q wants to ch? 1, x Then after the communication, x will have the value 10. eo C. Ruys - SPIN 13 September 00 od { stat 1 ; stat ; stat n (Hardware) solution to the mutual exclusion problem: P(bit i) { {flag!= 1; flag = 1; flag = 0; If the sender is sure that the receiver has correctly received the previous message, it sends a new September message and it alternates the accompanying bit. inners April 3, P1() { t1a; t1b; t1c No ity P() { ta; tb; tc init { run P1(); run P() { stat 1 ; stat ; stat n [Ruys & Brinksma 1998] IN 00 Workshop, more Grenoble, efficient version April of 00 : no intermediate states are 0 P1 t1a ta P generated Cookie: and stored hippies problem 0 t1b (1,0) 0 ta t1a (0,1) may only contain deterministic steps t1a { ta stat 1 ; stat(,0) ; stat n tb t1c it is a run-time error if stat i (i>1) blocks. ta t1b (1,1) more efficient version of : no intermediate tb states are Germany is especially :: Rout?i(v) -> { 1 1 t1a (0,) ta Holland generated and stored t1c (,1) tc k++; tb useful to perform t1b <= 60 min? may only tb t1b (1,) e[k].ind = i; contain deterministic (3,1) steps tc t1a (0,3) intermediate computations e[k].val = v; it is a run-time error if stattb i (i>1) blocks. in a single transition i=0; v=0 ; t1c (,) tc t1b (1,3) t1c is tc especially (3,) :: Rout?i(v) -> { tc k++; holes useful to perform t1c (,3) e[k].ind = i; and can be used to lower the number coffee 3 3 of intermediate computations (3,3) e[k].val = v; shop states of the model in a single transition i=0; v=0 ; Not completely correct as each process has an implicit end-transition <= pers 48 inners April 3, and can be used to lower the number of CS477 Formal Software Development Methods states of the model 4 IN 00 Workshop, Grenoble, April IN 00 Workshop, Grenoble, April 00 SPIN 00 Workshop, 1 Grenoble, P1() { April {t1a; 00 t1b; t1c P() { ta; tb; tc init { run P1(); run P()
6 active Receiver() (3,3) Not completely correct as each process has an implicit end-transition eo C. Ruys - SPIN 4913 September 00 P1() { {t1a; t1b; t1c P() { ta; tb; tc init { run P1(); run P() 13 September P1() { {t1a; t1b; t1c P() { ta; tb; tc init { run P1(); (1,0) run P() (0,1) (3,) (,3) 51 Although clauses cannot (3,3) be interleaved, the intermediate states are still constructed. 50 inners April 3, abp-1.pr IN 00 Workshop, Grenoble, April 00 5 perfect lines P1() { {t1a; t1b; t1c P() { ta; tb; tc init { run P1(); run P() (,0) (1,1) (0,) (,1) (1,0) (1,)(0,1) If one of P1 s transitions (1,0) (0,1) (3,1) (0,3) (,0) blocks, these transitions (,)(1,1) (,0) may get executed (1,1) (1,3) (0,) (0,) (3,) (,1) (,1) (,3) (1,) (1,) (3,1) No (0,3) intermediate states will (3,1) (0,3) (3,3) (,) be constructed. (,) (1,3) (1,3) (3,) 13 September (,3) Checking for pure ity (3,3) No intermediate states will be constructed September Alternating Bit Protocol (3) How large should MAX be such that we are sure that the ABP works correctly? timeout (1) abp-.pr only Suppose we want to check that none of the clauses Promela stealing es daemon not have (models real-time lossy features. channels) three! in our model are ever blocked (i.e. pure ity). In how Promela we know we can that only the specify protocol functional works correctly? behaviour. Most Checking protocols, however, for pure use timers ity or a timeout 1. Add a global bit variable:. Change all clauses to: abp-3.pr mechanism to resend messages or acknowledgements. Suppose model different we want messages { to check that by a none sequence of the numberclauses bit aflag; stat 1 ; timeout in assert our model that are the ever protocol blocked works (i.e. correctly pure ity). aflag=1; SPIN s how can timeout we be sure becomes that different executable messages if there are is no being stat 1. Add other a global bit variable:. Change all clauses to: transmitted? process in the system which is executable 3. Check that aflag is always 0. so, { bit timeout aflag; models a global timeout []!aflag timeout provides an escape from deadlock stat 1 ; states aflag=1; stat e.g. active process monitor { n beware of statements Theo that C. Ruys are - SPIN always stat executable 55 assert(!aflag); aflag=0; 3. Check that aflag is always 0. []!aflag eo C. Ruys - SPIN 513 September 00 stat e.g. active process monitor { n 53 inners April 3, assert(!aflag); aflag=0; CS477 Formal Software Development Methods IN 00 Workshop, Grenoble, April 00 6 timeout (1) 5 goto Promela es not have real-time features. goto label In Promela we can only specify functional behaviour. SPIN 00 Workshop, transfers Grenoble, execution April to 00 label timeout () Most protocols, however, use timers or a timeout each Promela statement might be labelled mechanism to resend messages or acknowledgements. quite useful in modelling communication protocols Example to recover from message loss: timeout wait_ack: active Receiver() Timeout modelled by a channel. SPIN stimeout becomes executable if there is no if { :: B?ACK -> ab=1-ab ; goto success other process in the system which is executable :: bit ChunkTimeout?SHAKE recvbit; -> so, timeout models a global timeout if timeout provides an escape from deadlock states :: :: tor (rc <? MAX) MSG, recvbit -> rc++; -> F!(i==1),(i==n),ab,d[i]; tos! ACK, recvbit; :: timeout goto -> wait_ack tos! ACK, recvbit; beware of statements that are always executable :: (rc >= MAX) -> goto error od fi fi ; Part of model of BRP 53 Premature timeouts can be modelled by replacing the timeout by skip (which is always executable). 56 inners April 3, One might want to limit the number of premature timeouts (see [Ruys & Langerak 1997]). 54 timeout () Example to recover from message loss:
7 o C. Ruys - SPIN Theo 13 September C. Ruys - 00 SPIN 13 September unless { <stats> unless { guard; <stats> Statements in <stats> are executed until the first statement (guard) in the escape sequence becomes executable. resembles exception handling in languages like Java Example: MicroProcessor() { { /* execute normal instructions */ unless { port? INTERRUPT; unless { <stats> unless { guard; <stats> Statements in <stats> are executed until the first statement (guard) in the escape sequence becomes executable. resembles exception handling in languages like Java Example: MicroProcessor() { { /* execute normal instructions */ unless { port? INTERRUPT; eo C. Ruys - SPIN 13 September inners April 3, inline poor man s procedures Promela also has its own macro-expansion feature using the inline-construct. macros cpp preprocessor inline init_array(a) { { Promela uses i=0; cpp, the Should C preprocessor be declared somewhere to preprocess Promela models. else (probably as a local variable). This is useful to define: :: i<n -> a[i] = 0; i++ constants :: else -> break All cpp commands start with a hash: #define MAX 4 i=0; #define, #ifdef, #include, etc. macros Be sure to reset temporary variables. #define RESET_ARRAY(a) \ { a[0]=0; a[1]=0; #define a[]=0; a[3]=0; conditional Promela model fragments #define LOSSY 1 59 #ifdef LOSSY Elsactive L Gunter CS477 Formal Daemon() Software Development { /* Methods steal messages */ #endif macros cpp preprocessor Promela uses cpp, the C preprocessor to preprocess Promela models. This is useful to define: constants #define MAX 4 inners April 3, All cpp commands start with a hash: #define, #ifdef, #include, etc. macros #define RESET_ARRAY(a) \ { a[0]=0; a[1]=0; a[]=0; a[3]=0; conditional Promela model fragments #define LOSSY 1 #ifdef LOSSY active Daemon() { /* steal messages */ #endif IN 00 Workshop, Grenoble, April 00 SPIN 00 Workshop, 9 Grenoble, April 00 Properties (1) M M With SPIN one may check the following type of properties: deadlocks (invalid endstates) assertions unreachable code LTL formulae liveness properties non-progress cycles (livelocks) acceptance cycles 60 IN 00 Workshop, Grenoble, April 00 30
CS477 Formal Software Development Methods / 39
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 11, 2018 Hello World /* A "Hello World" Promela model for
More informationCS477 Formal Software Development Methods / 32
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 13, 2018 Assertion Violation: mutextwrong1.pml bit flag;
More informationA Tutorial on Model Checker SPIN
A Tutorial on Model Checker SPIN Instructor: Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: haozheng@usf.edu Phone: (813)974-4757 Fax: (813)974-5456
More informationBeginner s SPIN Tutorial
SPIN 2002 Workshop Beginner s SPIN Tutorial Grenoble, France Thursday 11-Apr-2002 Theo C. Ruys University of Twente Formal Methods & Tools group http://www.cs.utwente.nl/~ruys Credits should go to Gerard
More informationThe SPIN Model Checker
The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini GianLuigi Ferrari Lezione 3 2011 Slides per gentile concessione di Gerard J. Holzmann 2 the do-statement do :: guard 1 -> stmnt 1.1
More informationDesign of Internet Protocols:
CSCI 234 Design of Internet Protocols: George Blankenship George Blankenship 1 Outline Verication and Validation History and motivation Spin Promela language Promela model George Blankenship 2 Verication
More informationLecture 3 SPIN and Promela
Lecture 3 SPIN and Promela 1 What is SPIN(Simple Promela INterpreter) A tool for analyzing mels of concurrent systems Mels described in Promela Language with concurrent processes Communication via shared
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part I Stefan Rührup Summer 2009 Overview In the last lectures: Specification of protocols and data/message formats In this chapter: Building a validation
More informationWhat is SPIN(Simple Promela Interpreter) Elements of Promela. Material About SPIN. Basic Variables and Types. Typical Structure of Promela Model
What is SPIN(Simple Promela Interpreter) Lecture XX SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,
More informationWhat is SPIN(Simple Promela Interpreter) Material About SPIN. Elements of Promela. Basic Variables and Types. Typical Structure of Promela Model
What is SPIN(Simple Promela Interpreter) Lecture 3 SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,
More information4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271
Mel Checking LTL Property System Mel Mel Checking CS 4271 Mel Checking OR Abhik Roychoudhury http://www.comp.nus.edu.sg/~abhik Yes No, with Counter-example trace 2 Recap: Mel Checking for mel-based testing
More informationCopyright 2008 CS655 System Modeling and Analysis. Korea Advanced Institute of Science and Technology
The Spin Model Checker : Part I Copyright 2008 CS655 System Korea Advanced Institute of Science and Technology System Spec. In Promela Req. Spec. In LTL Overview of the Spin Architecture Spin Model pan.c
More informationT Parallel and Distributed Systems (4 ECTS)
T 79.4301 Parallel and Distributed Systems (4 ECTS) T 79.4301 Rinnakkaiset ja hajautetut järjestelmät (4 op) Lecture 3 4th of February 2008 Keijo Heljanko Keijo.Heljanko@tkk.fi T 79.4301 Parallel and Distributed
More informationPatrick Trentin Formal Methods Lab Class, March 03, 2017
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 03, 2017 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationPatrick Trentin Formal Methods Lab Class, Feb 26, 2016
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Feb 26, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt 03 September 2015 SEFM: Promela /GU 150903 1 / 36 Towards Model Checking System Model Promela Program byte n = 0; active
More informationComputer Aided Verification 2015 The SPIN model checker
Computer Aided Verification 2015 The SPIN model checker Grigory Fedyukovich Universita della Svizzera Italiana March 11, 2015 Material borrowed from Roberto Bruttomesso Outline 1 Introduction 2 PROcess
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Bernhard Beckert Mattias Ulbrich SS 2017 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State of Baden-Württemberg
More informationFormal Specification and Verification
Formal Specification and Verification Introduction to Promela Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification and Verification:
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2012 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2010 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt & Richard Bubel & Reiner Hähnle & Wojciech Mostowski 31 August 2011 SEFM: Promela /GU 110831 1 / 35 Towards Model Checking
More informationDesign and Analysis of Distributed Interacting Systems
Design and Analysis of Distributed Interacting Systems Lecture 5 Linear Temporal Logic (cont.) Prof. Dr. Joel Greenyer May 2, 2013 (Last Time:) LTL Semantics (Informally) LTL Formulae are interpreted on
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu Calornia Institute of Technology AFRL, 25 April 2012 Outline Spin model checker: modeling
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part III Stefan Rührup Summer 2009 Overview In the first parts of this chapter: Validation models in Promela Defining and checking correctness claims
More informationSPIN: Introduction and Examples
SPIN: Introduction and Examples Alessandra Giordani agiordani@disi.unitn.it http://disi.unitn.it/~agiordani Formal Methods Lab Class, September 28, 2014 *These slides are derived from those by Stefano
More informationThe Spin Model Checker : Part I/II
The Spin Model Checker : Part I/II Moonzoo Kim CS Dept. KAIST Korea Advanced Institute of Science and Technology Motivation: Tragic Accidents Caused by SW Bugs 2 Cost of Software Errors June 2002 Software
More informationThe SPIN Model Checker
The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini Lezione 1 2013 Slides liberamente adattate da Logic Model Checking, per gentile concessione di Gerard J. Holzmann http://spinroot.com/spin/doc/course/
More informationThe Spin Model Checker : Part I. Moonzoo Kim KAIST
The Spin Model Checker : Part I Moonzoo Kim KAIST Hierarchy of SW Coverage Criteria Complete Value Coverage CVC (SW) Model checking Complete Path Coverage CPC Concolic testing All-DU-Paths Coverage ADUP
More informationDistributed Systems Programming F29NM1 2. Promela I. Andrew Ireland. School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh
Distributed Systems Programming F29NM1 Promela I Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems Programming F29NM1 2 Overview Basic building
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 10, 2017 These slides are derived from those by Stefano Tonetta, Alberto
More informationPromela and SPIN. Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH. Promela and SPIN
Promela and SPIN Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH Promela and SPIN Promela (Protocol Meta Language): Language for modelling discrete, event-driven
More informationSPIN: Part /614 Bug Catching: Automated Program Verification. Sagar Chaki November 12, Carnegie Mellon University
SPIN: Part 1 15-414/614 Bug Catching: Automated Program Verification Sagar Chaki November 12, 2012 What is This All About? Spin On-the-fly verifier developed at Bell-labs by Gerard Holzmann and others
More informationSPIN, PETERSON AND BAKERY LOCKS
Concurrent Programs reasoning about their execution proving correctness start by considering execution sequences CS4021/4521 2018 jones@scss.tcd.ie School of Computer Science and Statistics, Trinity College
More informationSPIN. Carla Ferreira.
SPIN Carla Ferreira http://www.spinroot.com/spin/man/intro.html Introduction PROMELA (PROcess MEta LAnguage) is the input language of SPIN (Simple Promela Interpreter) Inspired by: C and CSP Describes
More informationMulti-Threaded System int x, y, r; int *p, *q, *z; int **a; EEC 421/521: Software Engineering. Thread Interleaving SPIN. Model Checking using SPIN
EEC 421/521: Software Engineering Model Checking using SPIN 4/29/08 EEC 421/521: Software Engineering 1 Multi-Threaded System int x, y, r; int *p, *q, *z; int **a; thread_1(void) /* initialize p, q, and
More informationBlocking Non-blocking Caveat:
Overview of Lecture 5 1 Progress Properties 2 Blocking The Art of Multiprocessor Programming. Maurice Herlihy and Nir Shavit. Morgan Kaufmann, 2008. Deadlock-free: some thread trying to get the lock eventually
More informationIntroduction to Model Checking
Introduction to Model Checking René Thiemann Institute of Computer Science University of Innsbruck WS 2007/2008 RT (ICS @ UIBK) week 4 1/23 Outline Promela - Syntax and Intuitive Meaning Promela - Formal
More informationTool demonstration: Spin
Tool demonstration: Spin 1 Spin Spin is a model checker which implements the LTL model-checking procedure described previously (and much more besides). Developed by Gerard Holzmann of Bell Labs Has won
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Mar 04, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu California Institute of Technology EECI 19 Mar 2013 Outline Spin model checker: modeling
More informationFormal Methods for Software Development
Formal Methods for Software Development Verification with Spin Wolfgang Ahrendt 07 September 2018 FMSD: Spin /GU 180907 1 / 34 Spin: Previous Lecture vs. This Lecture Previous lecture Spin appeared as
More informationDistributed Systems Programming (F21DS1) SPIN: Formal Analysis I
Distributed Systems Programming (F21DS1) SPIN: Formal Analysis I Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce
More informationT Parallel and Distributed Systems (4 ECTS)
T 79.4301 Parallel and Distriuted Systems (4 ECTS) T 79.4301 Rinnakkaiset ja hajautetut järjestelmät (4 op) Lecture 4 11th of Feruary 2008 Keijo Heljanko Keijo.Heljanko@tkk.fi T 79.4301 Parallel and Distriuted
More informationCh 9: Control flow. Sequencers. Jumps. Jumps
Ch 9: Control flow Sequencers We will study a number of alternatives traditional sequencers: sequential conditional iterative jumps, low-level sequencers to transfer control escapes, sequencers to transfer
More informationGenerating Code from Event-B Using an Intermediate Specification Notation
Rodin User and Developer Workshop Generating Code from Event-B Using an Intermediate Specification Notation Andy Edmunds - ae02@ecs.soton.ac.uk Michael Butler - mjb@ecs.soton.ac.uk Between Abstract Development
More informationMP 6 Modeling in Promela and SPIN
MP 6 Modeling in Promela and SPIN CS 477 Spring 2018 Revision 1.0 Assigned April 23, 2018 Due May 2, 2018, 9:00 PM Extension 48 hours (penalty 20% of total points possible) 1 Change Log 1.0 Initial Release.
More informationINF672 Protocol Safety and Verification. Karthik Bhargavan Xavier Rival Thomas Clausen
INF672 Protocol Safety and Verication Karthik Bhargavan Xavier Rival Thomas Clausen 1 Course Outline Lecture 1 [Today, Sep 15] Introduction, Motivating Examples Lectures 2-4 [Sep 22,29, Oct 6] Network
More informationIterative Statements. Iterative Statements: Examples. Counter-Controlled Loops. ICOM 4036 Programming Languages Statement-Level Control Structure
ICOM 4036 Programming Languages Statement-Level Control Structure Selection Statement Iterative Statements Unconditional Branching Guarded Commands This lecture covers review questions 8-16 This lecture
More informationPrinciples of Protocol Design MVP 10A 1
Principles of Protocol Design MVP 10A 1 MVP10 plan Protocol design principles with examples: Lynch s protocol Tanenbaum protocol 2 Tanenbaum protocol 4 Mutual exclusion in a distributed environment: Lamports
More informationBuilding Graphical Promela Models using UPPAAL GUI
Building Graphical Promela Models using UPPAAL GUI Master s Thesis Report by Vasu Hossaholal Lingegowda Software Systems Engineering Group: B2-201 under the guidance of Dr. Alexandre David Department of
More informationModel Requirements and JAVA Programs MVP 2 1
Model Requirements and JAVA Programs MVP 2 1 Traditional Software The Waterfall Model Problem Area Development Analysis REVIEWS Design Implementation Costly wrt time and money. Errors are found too late
More informationEMBEDDED C CODE 17. SPIN Version 4 supports the inclusion of embedded C code into PROMELA models through the following fiv e new primitives:
EMBEDDED C CODE 17 The purpose of analysis is not to compel belief but rather to suggest doubt. (Imre Lakatos, Proofs and Refutations) SPIN Version 4 supports the inclusion of embedded C code into PROMELA
More informationFormal Verification by Model Checking
Formal Verication by Model Checking Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654/17-754: Analysis of Software Artacts Spring 2006 1 CTL Model Checking
More informationChapter 7. - FORTRAN I control statements were based directly on IBM 704 hardware
Levels of Control Flow: 1. Within expressions 2. Among program units 3. Among program statements Evolution: - FORTRAN I control statements were based directly on IBM 704 hardware - Much research and argument
More informationLogic Model Checking
Logic Model Checking Lecture Notes 14:18 Caltech 118 January-March 2006 Course Text: The Spin Model Checker: Primer and Reference Manual Addison-Wesley 2003, ISBN 0-321-22862-6, 608 pgs. Logic Model Checking
More informationChapter 8. Statement-Level Control Structures
Chapter 8 Statement-Level Control Structures Levels of Control Flow Within expressions Among program units Among program statements Copyright 2012 Addison-Wesley. All rights reserved. 1-2 Control Structure
More informationUsing Spin to Help Teach Concurrent Programming
Using Spin to Help Teach Concurrent Programming John Regehr May 1, 1998 1 Introduction and Motivation Writing correct concurrent programs is very difficult; race conditions, deadlocks, and livelocks can
More informationSymmetric Multiprocessors: Synchronization and Sequential Consistency
Constructive Computer Architecture Symmetric Multiprocessors: Synchronization and Sequential Consistency Arvind Computer Science & Artificial Intelligence Lab. Massachusetts Institute of Technology November
More informationFORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY
FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY Pamela Zave AT&T Laboratories Research Florham Park, New Jersey, USA
More informationChapter 8. Statement-Level Control Structures
Chapter 8 Statement-Level Control Structures Chapter 8 Topics Introduction Selection Statements Iterative Statements Unconditional Branching Guarded Commands Conclusions Copyright 2009 Addison-Wesley.
More informationControl Structures. Outline. In Text: Chapter 8. Control structures Selection. Iteration. Gotos Guarded statements. One-way Two-way Multi-way
Control Structures In Text: Chapter 8 1 Control structures Selection One-way Two-way Multi-way Iteration Counter-controlled Logically-controlled Gotos Guarded statements Outline Chapter 8: Control Structures
More informationDistributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter
Distributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview
More informationThe Design of a Distributed Model Checking Algorithm for Spin
The Design of a Distributed Model Checking Algorithm for Spin Gerard J. Holzmann http://eis.jpl.nasa.gov/lars http://spinroot.com/gerard/ Presented at FMCAD 2006, San Jose, California November 14, 2006
More informationAutomated Reasoning. Model Checking with SPIN (II)
Automated Reasoning Model Checking with SPIN (II) Alan Bundy page 1 Verifying Global Properties Assertions can be used to verify a property locally For example, place assert(memreturned) at the end of
More informationPrinciples of Protocol Design. MVP10 plan. What is a protocol? Typical SPIN applications. The three parts of a protocol description
Principles of Protocol Design MVP10 plan Protocol design principles with examples: Lynch s protocol Tanenbaum protocol 2 Tanenbaum protocol 4 Mutual exclusion in a distributed environment: Lamports algorithm
More informationSPIN part 2. Verification with LTL. Jaime Ramos. Departamento de Matemática, Técnico, ULisboa
SPIN part 2 Verification with LTL Jaime Ramos Departamento de Matemática, Técnico, ULisboa Borrowed from slides by David Henriques, Técnico, ULisboa LTL model checking How Spin works Checks non-empty intersection
More informationModel checking Timber program. Paweł Pietrzak
Model checking Timber program Paweł Pietrzak 1 Outline Background on model checking (spam?) The SPIN model checker An exercise in SPIN - model checking Timber Deriving finite models from Timber programs
More informationTHE MODEL CHECKER SPIN
THE MODEL CHECKER SPIN Shin Hong, KAIST 17 th April,2007 1/33 Contents Introduction PROMELA Linear Temporal Logic Automata-theoretic software verification Example : Simple Elevator 2 SPIN is a software
More informationTemporal Logic and Timed Automata
Information Systems Analysis Temporal Logic and Timed Automata (5) UPPAAL timed automata Paweł Głuchowski, Wrocław University of Technology version 2.3 Contents of the lecture Tools for automatic verification
More informationUsing Model Checking with Symbolic Execution for the Verification of Data-Dependent Properties of MPI-Based Parallel Scientific Software
Using Model Checking with Symbolic Execution for the Verification of Data-Dependent Properties of MPI-Based Parallel Scientific Software Anastasia Mironova Problem It is hard to create correct parallel
More informationExamples of Code Roaches. First Draft List Cem Kaner September 11, 2005
Examples of Code Roaches First Draft List Cem Kaner September 11, 2005 Why a Potential-Bug List? Given a potential error, you can develop a method to test for it Foundation for Code inspections Glass box
More informationwant turn==me wait req2==0
Uppaal2k: Small Tutorial Λ 16 October 2002 1 Introduction This document is intended to be used by new comers to Uppaal and verification. Students or engineers with little background in formal methods should
More informationCOMP322 - Introduction to C++ Lecture 02 - Basics of C++
COMP322 - Introduction to C++ Lecture 02 - Basics of C++ School of Computer Science 16 January 2012 C++ basics - Arithmetic operators Where possible, C++ will automatically convert among the basic types.
More informationA Fast Review of C Essentials Part I
A Fast Review of C Essentials Part I Structural Programming by Z. Cihan TAYSI Outline Program development C Essentials Functions Variables & constants Names Formatting Comments Preprocessor Data types
More informationProving Dekker with SPIN and PROMELA
15-410...fairness disabled... Proving Dekker with SPIN and PROMELA Joshua Wise With help from Greg Hartman L36_SPIN 1 Synchronization Project 4 due Wednesday Everyone having fun? Kernel interviews If you
More informationChapter 8. Statement-Level Control Structures
Chapter 8 Statement-Level Control Structures Chapter 8 Topics Introduction Selection Statements Iterative Statements Unconditional Branching Guarded Commands Conclusions 1-2 Levels of Control Flow Within
More informationLectures 5-6: Introduction to C
Lectures 5-6: Introduction to C Motivation: C is both a high and a low-level language Very useful for systems programming Faster than Java This intro assumes knowledge of Java Focus is on differences Most
More informationLecture 2: Intro to Concurrent Processing
Lecture 2: Intro to Concurrent Processing The SR Language. Correctness and Concurrency. Mutual Exclusion & Critical Sections. Software Solutions to Mutual Exclusion. Dekker s Algorithm. The Bakery Algorithm.
More informationModel-Checking Concurrent Systems. The Model Checker Spin. The Model Checker Spin. Wolfgang Schreiner
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at 1.
More informationModeling Language Control Flow Advanced Usage Spin Summary Appendix: Building a Verification Suite References Japanese translation of this page Spin is a tool for analyzing the logical consistency of concurrent
More informationCSE 153 Design of Operating Systems
CSE 153 Design of Operating Systems Winter 19 Lecture 7/8: Synchronization (1) Administrivia How is Lab going? Be prepared with questions for this weeks Lab My impression from TAs is that you are on track
More informationFormal Specification and Verification
Formal Specification and Verification Model Checking with Temporal Logic Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification
More informationAlgorithmic Verification. Algorithmic Verification. Model checking. Algorithmic verification. The software crisis (and hardware as well)
Algorithmic Verification The software crisis (and hardware as well) Algorithmic Verification Comp4151 Lecture 1-B Ansgar Fehnker Computer become more powerful (Moore s law) The quality of programs cannot
More informationChapter 8. Statement-Level Control Structures ISBN
Chapter 8 Statement-Level Control Structures ISBN 0-321-49362-1 Chapter 8 Topics Introduction Selection Statements Iterative Statements Unconditional Branching Guarded Commands Conclusions Copyright 2012
More informationModel-Checking Concurrent Systems
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at Wolfgang
More informationAppendix. Grammar. A.1 Introduction. A.2 Keywords. There is no worse danger for a teacher than to teach words instead of things.
A Appendix Grammar There is no worse danger for a teacher than to teach words instead of things. Marc Block Introduction keywords lexical conventions programs expressions statements declarations declarators
More informationModeling a Cache Coherence Protocol with the Guarded Action Language
Modeling a Cache Coherence Protocol with the Guarded Action Language Quentin Meunier, Yann Thierry-Mieg, Emmanuelle Encrenaz Laboratoire d Informatique de Paris 6, Sorbonne Université, Paris. The TeraScale
More informationUNIX Input/Output Buffering
UNIX Input/Output Buffering When a C/C++ program begins execution, the operating system environment is responsible for opening three files and providing file pointers to them: stdout standard output stderr
More informationLECTURE 18. Control Flow
LECTURE 18 Control Flow CONTROL FLOW Sequencing: the execution of statements and evaluation of expressions is usually in the order in which they appear in a program text. Selection (or alternation): a
More informationLecture 2: Intro to Concurrent Processing. A Model of Concurrent Programming
Lecture 2: Intro to Concurrent Processing The SR Language. Correctness and Concurrency. Mutual Exclusion & Critical Sections. Software Solutions to Mutual Exclusion. Dekker s Algorithm. The Bakery Algorithm.
More informationSPIN s Promela to Java Compiler, with help from Stratego
SPIN s Promela to Java Compiler, with help from Stratego Master s Thesis Edwin Vielvoije SPIN s Promela to Java Compiler, with help from Stratego THESIS submitted in partial fulfillment of the requirements
More informationFormal Methods for Software Development
Formal Methods for Software Development Model Checking with Temporal Logic Wolfgang Ahrendt 21st September 2018 FMSD: Model Checking with Temporal Logic /GU 180921 1 / 37 Model Checking Check whether a
More informationCS 326 Operating Systems C Programming. Greg Benson Department of Computer Science University of San Francisco
CS 326 Operating Systems C Programming Greg Benson Department of Computer Science University of San Francisco Why C? Fast (good optimizing compilers) Not too high-level (Java, Python, Lisp) Not too low-level
More informationTopic 6: A Quick Intro To C
Topic 6: A Quick Intro To C Assumption: All of you know Java. Much of C syntax is the same. Also: Many of you have used C or C++. Goal for this topic: you can write & run a simple C program basic functions
More informationCOMP 3430 Robert Guderian
Operating Systems COMP 3430 Robert Guderian file:///users/robg/dropbox/teaching/3430-2018/slides/06_concurrency/index.html?print-pdf#/ 1/76 1 Concurrency file:///users/robg/dropbox/teaching/3430-2018/slides/06_concurrency/index.html?print-pdf#/
More informationCS 4240: Compilers and Interpreters Project Phase 1: Scanner and Parser Due Date: October 4 th 2015 (11:59 pm) (via T-square)
CS 4240: Compilers and Interpreters Project Phase 1: Scanner and Parser Due Date: October 4 th 2015 (11:59 pm) (via T-square) Introduction This semester, through a project split into 3 phases, we are going
More informationTRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270. Only dictionaries may be used. Other aids are not allowed!
TRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270 Extra aid: Only dictionaries may be used. Other aids are not allowed! Please observe the following: This exam has 14 numbered
More informationSWEN-220 Mathematical Models of Software. Process Synchronization Critical Section & Semaphores
SWEN-220 Mathematical Models of Software Process Synchronization Critical Section & Semaphores 1 Topics The critical section Synchronization using busy-wait Semaphores 2 The Critical Section Processes
More informationTRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270. Only dictionaries may be used. Other aids are not allowed!
TRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270 Extra aid: Only dictionaries may be used. Other aids are not allowed! Please observe the following: This exam has 15 numbered
More information