A comparison of two synchronizing concepts

Proving the Correctness of Multiprocess Programs

“…Other proof procedures have been proposed which are more specific than ours, and assume some type of synchronization primitive (4], [10], [11], [15]. The basic reason for their assumptions is to insure that data cannot be accessed by one process while they might be modified by another process.…”

“…We will do this by proving the invariance of an interpretation containing the indicated assertions, where Dk and Ek, will be defined later. We assume that Dk is also attached to all arcs of subroutine 8, and A{Ek,:j = i,* , N} is attached to all arcs in subroutine 4 Our example showed how the program and the proof can be designed together in a top-down hierarchical fashion. At each stage, our proof required that the following conditions be satisfied by each subroutine: 1) the assertions attached to its input and output arcs are consistent, and 2) certain assertions are monotone under that subroutine.…”

“…4 We next sketched a proof of the following liveness property of their second solution: if a writer wants to write, then some writer will eventually enter its writing section. 5 The level of detail in this sketch was analogous to specifying the set of assertions (d (4) and the statements of Lemmas 1-6 and conditions l)-3) in our liveness proof for the bakery algorithm, but not writing down the proofs of the lemmas or the conditions. Starting from when we chose our informal liveness property, this took about 1-hours.…”

Limitations of synchronization primitives with conditional branching and global variables

“…Let D be a set of the form DlX ... XDk, and let "(Xl,...,Xk)" be a typical element of D. Then f(2,3) = (3,2). Moreover, we will delete "assignments" of the form "x ÷ x."…”

“…(Dijkstra [i]; Courtois, Heymans, Parnas [2]; Brinch Hmlsen [3]; Habermann [4]; and Dijkstra [5]) This approach has two drawbacks. First, the inability to find a solution does not prove that a given solution does not exist.…”