Synthesis of large dynamic concurrent programs from dynamic specifications

Abstract

We present a tractable method for synthesizing arbitrarily large concurrent programs, for a shared memory model with common hardware-available primitives such as atomic registers, compare-and-swap, load-linked/store conditional, etc. The programs we synthesize are dynamic: new processes can be created and added at run-time, and so our programs are not finite-state, in general. Nevertheless, we successfully exploit automatic synthesis and model-checking methods based on propositional temporal logic. Our method is algorithmically efficient, with complexity polynomial in the number of component processes (of the program) that are "alive" at any time. Our method does not explicitly construct the automata-theoretic product of all processes that are alive, thereby avoiding state explosion. Instead, for each pair of processes which interact, our method constructs an automata-theoretic product (pair-machine) which embodies all the possible interactions of these two processes. From each pair-machine, we can synthesize a correct pair-program which coordinates the two involved processes as needed. We allow such pair-programs to be added dynamically at run-time. They are then "composed conjunctively" with the currently alive pair-programs to re-synthesize the program as it results after addition of the new pair-program. We are thus able to add new behaviors, which result in new properties being satisfied, at run-time. This "incremental composition" step has complexity independent of the total number of processes, it only requires the mechanical analysis of the two processes in the pair-program, and their immediate neighbors, i.e., the other processes which they interact directly with. We establish a "large model" theorem which shows that the synthesized large program inherits correctness properties from the pair-programs.

Global and Local Deadlock Freedom in BIP

“…The notions of wait-for-graph and supercycle [7,8] were initially defined for a shared memory program P = P 1 ∥ • • • ∥ P K in pairwise normal form [4,5]: a binary symmetric relation I specifies the directly interacting pairs ("neighbors") {P i , P j } If P i has neighbors P j and P k , then the code in P i that interacts with P j is expressed separately from the code in P i that interacts with P k . These synchronization codes are executed synchronously and atomically, so the grain of atomicity is proportional to the degree of I .…”

Specification and Verification in Integrated Model of Distributed Systems (IMDS)

“…The inspect tool [46] is based on runtime model checking, which does not accept cyclic reachability spaces. In pairwise model checking [47], the general temporal formula is used for every pair of mutually-related processes operating in shared memory.…”

Siphon-based deadlock detection in Integrated Model of Distributed Systems (IMDS)

“…Some other approaches to partial deadlock detection use temporal formulas that are not related to the structure of a verified model. However, such model-unrelated formulas require the system to have specific properties [15] [16]. If a system is non-terminating (cycling), a discontinuation of a process is obviously a deadlock [3].…”

“…As in typical programming language, server types are introduced (lines 3, 12), with formal parameters that specify agents and other servers used in actions. Every server has sets of its states (l.4, 13), services (l.5, 14) and actions (l.7-10, [16][17][18][19]. An action in Dedan is denoted {a.s.r, s.v}{a.s'.r', s.v'}.…”