formal methods for software engineering

Formal Methods for

Software Engineering

Lecture 6, Part II: Deadlock & Safety Analysis

Ed Brinksma FMSE, Lecture 6

Contents Deadlock analysis

Distributed deadlocks Dining philosophers Searching by deadlock analysis

Safety analysis Safety properties Single-lane bridge problem

Ed Brinksma FMSE, Lecture 6

Basic DeadlockA deadlock state is a state with no outgoing transitionsIn FSP such states can be directly represented as a STOP process

Trace to DEADLOCK:

northnorth

We can use LTSA to find the shortest trace to such deadlock states.

MOVE = (north-> (south->MOVE |north->STOP)).

MOVE north north

south0 1 2

Deadlock state

Ed Brinksma FMSE, Lecture 6

Distributed DeadlockDeadlock may arise from the parallel composition of processes without deadlock states.

RESOURCE = (get->put->RESOURCE).

P = (printer.get->scanner.get->copy ->printer.put->scanner.put->P).

Q = (scanner.get->printer.get->copy ->scanner.put->printer.put->Q).

||SYS = (p:P||q:Q ||{p,q}::printer:RESOURCE ||{p,q}::scanner:RESOURCE).

printer:RESOURCEgetput

SYS

scanner:RESOURCEgetput

p:Pprinter

scanner

q:Qprinter

scanner

Deadlock Trace? Avoidance?

Ed Brinksma FMSE, Lecture 6

Wait-for Cycle

A

B

CD

E

Has A awaits B

Has B awaits C

Has C awaits DHas D awaits E

Has E awaits A

Ed Brinksma FMSE, Lecture 6

Deadlock Avoidance1. acquire resources in the same order,

or2. introduce a timeout:

P = (printer.get-> GETSCANNER),GETSCANNER = (scanner.get->copy->printer.put ->scanner.put->P |timeout -> printer.put->P).

Q = (scanner.get-> GETPRINTER),GETPRINTER = (printer.get->copy->printer.put ->scanner.put->Q |timeout -> scanner.put->Q).

Deadlock? Progress?

Ed Brinksma FMSE, Lecture 6

Dining PhilosophersFive philosophers sit around a circular table. Each philosopher spends his life alternately thinking and eating. In the centre of the table is a large bowl of spaghetti. A philosopher needs two forks to eat a helping of spaghetti.

0

1

23

40

1

2

3

4

One fork is placed between each pair of philosophers and they agree that each will only use the fork to his immediate right and left.

Ed Brinksma FMSE, Lecture 6

Model Structure Diagram

phil[4]:PHIL

phil[1]:PHIL

phil[3]:PHIL

phil[0]:PHIL

phil[2]:PHIL

FORK FORK

FORK

FORK FORK

leftright

right

right

right

left

left

right

left

left

Each FORK is a shared resource with actions get and put.When hungry, each PHIL must first get his right and left forks before he can start eating.

Ed Brinksma FMSE, Lecture 6

The FSP Model

FORK = (get -> put -> FORK).PHIL = (sitdown -> right.get -> left.get

-> eat -> right.put -> left.put -> arise -> PHIL).

Can this system deadlock?

Table of philosophers:||DINERS(N=5)= forall [i:0..N-1] (phil[i]:PHIL || {phil[i].left,phil[((i-1)+N)%N].right}::FORK ).

Ed Brinksma FMSE, Lecture 6

Dining Philosophers AnalysisTrace to DEADLOCK: phil.0.sitdown

phil.0.right.getphil.1.sitdownphil.1.right.getphil.2.sitdownphil.2.right.getphil.3.sitdownphil.3.right.getphil.4.sitdownphil.4.right.get

This is the situation where all the philosophers become hungry at the same time, sit down at the table and each philosopher picks up the fork to his right. The system can make no further progress since each philosopher is waiting for a fork held by his neighbour i.e. a wait-for cycle exists!

Ed Brinksma FMSE, Lecture 6

Dining Philosophers

Deadlock is easily detected in our model. How easy is it to detect a potential deadlock in an implementation?

Ed Brinksma FMSE, Lecture 6

Deadlock-free PhilosophersDeadlock can be avoided by ensuring that a wait-for cycle cannot exist. How?

PHIL(I=0) = (when (I%2==0) sitdown ->left.get->right.get ->eat

->left.put->right.put->arise->PHIL

|when (I%2==1) sitdown ->right.get->left.get ->eat

->left.put->right.put->arise->PHIL

).

Introduce an asymmetry into our definition of philosophers.Use the identity I of a philosopher to make even numbered philosophers get their left forks first, odd their right first.Other strategies?

Ed Brinksma FMSE, Lecture 6

0 1 2

3 4 5

6 7 8

STOP

north

south

west east

We can exploit the shortest path trace produced by the deadlock detection mechanism of LTSA to find the shortest path out of a maze to the STOP process!

We must first model the MAZE. Each position can be modelled by the moves that it permits. The MAZE parameter gives the starting position.

MAZE(Start=8) = P[Start], P[0] = (north->STOP |east->P[1]), P[1] = (east->P[2] |south->P[4] |west->P[0]), … .

Searching by Deadlock Analysis

Ed Brinksma FMSE, Lecture 6

0 1 2

3 4 5

6 7 8

STOP

north

south

west east

Searching by Deadlock Analysis

Shortest path escape trace from position

7 ?

Run deadlock analysis onprocess MAZE(7)

Trace to DEADLOCK:

eastnorthnorthwestwestnorth

Ed Brinksma FMSE, Lecture 6

Hippies Problem

Germany

Holland

<=2 pers

<= 60 min?

holes

5

.

.

10

.

.

20

.

.

25

.

. coffeeshop

“stoned” hippies

Ed Brinksma FMSE, Lecture 6

Modelling the Hippiesrange H = 1..4 // range of hippie ids.

GERMANY = SIDE[0],

SIDE[i:0..1] =

(at[i] -> SIDE[i] // at gives side id (0=D,1=NL)

|to[1-i] -> SIDE[1-i]). // to is moving to the other side.

||HIPPIES = (hippie[H]:GERMANY). // all hippies start in D.

Ed Brinksma FMSE, Lecture 6

Modelling the Crossing

BRIDGE =

(to[1] -> to[1] -> to[0] -> BRIDGE). // 2 hippies to NL, 1 back

||CROSSING =

(HIPPIES || hippie[H]::BRIDGE). // hippies sharing bridge

Ed Brinksma FMSE, Lecture 6

Modelling Timerange T=0..200

CLOCK = CLOCK[0],CLOCK[t:T] = (time[t] -> CLOCK[t] |addtime[1] -> CLOCK[t+5] |addtime[2] -> CLOCK[t+10] |addtime[3] -> CLOCK[t+20] |addtime[4] -> CLOCK[t+25] ).

TIME = (hippie[i:H].to[1] -> hippie[j:H].to[1] -> if i<j then (addtime[j] -> TIME) else (addtime[i] -> TIME) |hippie[k:H].to[0] -> addtime[k] -> TIME).

Add time to clock according to hippie

id.

Add only time of the least

stoned hippie going to NL

Ed Brinksma FMSE, Lecture 6

Testing the ResultTESTOVER = (hippie[i:H].to[1] -> hippie[j:H].to[1] -> time[t:T] ->

(hippie[1].at[0] -> AGAIN |hippie[1].at[1] -> (hippie[2].at[0] -> AGAIN

|hippie[2].at[1] -> (hippie[3].at[0] -> AGAIN |hippie[3].at[1] -> (hippie[4].at[0] -> AGAIN

|hippie[4].at[1] -> if t<=60 then STOP

else LATE ) ) ) ) ),AGAIN = (hippie[i:H].to[0] -> time[t:T] -> TESTOVER),LATE = (late -> LATE).

Test whether all hippies are in NL

Still hippies in D

Loop on loop to avoid a deadlock that is no solution

Ed Brinksma FMSE, Lecture 6

Searching the Solution

||SOLUTION = (CROSSING || TIME || CLOCK || TESTOVER) <<{addtime[H]} @{hippie[H].to[0..1],time[T],late}.

Priority operator: gives priority to

addtime actions over others if there is a choice. Time must

advance.

Ed Brinksma FMSE, Lecture 6

The SolutionTrace to DEADLOCK:

hippie.1.to.1hippie.2.to.1time.10hippie.1.to.0time.15hippie.3.to.1hippie.4.to.1time.40hippie.2.to.0time.50hippie.1.to.1hippie.2.to.1time.60

Ed Brinksma FMSE, Lecture 6

Safety Properties

ACTUATOR =(command->ACTION),ACTION =(respond->ACTUATOR |command->ERROR).

Trace to ERROR:commandcommand

analysis using LTSA:(shortest trace)

A safety property asserts that nothing bad happens, i.e. no deadlocked state (e.g. STOP or ERROR) is reachable.

command

command

respond

0 1-1respond

Ed Brinksma FMSE, Lecture 6

Safety-property SpecificationERROR conditions state what is not required (cf. exceptions).In complex systems, it is usually better to specify safety properties by stating directly what is required.

property SAFE_ACTUATOR = (command -> respond -> SAFE_ACTUATOR).

Analysis using LTSA as before.

command

command

respond

-1 0 1

All non-specified traces with actions in {command, respond}

lead to ERROR

Ed Brinksma FMSE, Lecture 6

Safety properties

property POLITE =

Property that it is polite to knock before entering a room.Traces: knockenter enter

knockknock

(knock->enter->POLITE).

In all states, all the actions in the alphabet of a property are eligible choices.

knock

enter

knock

enter

-1 0 1

Ed Brinksma FMSE, Lecture 6

TransparencySafety property P defines a deterministic process that asserts that any trace including actions in the alphabet of P, is accepted by P.

Thus, if P is composed with S, then traces of actions in the alphabet of S alphabet of P must also be valid traces of P, otherwise ERROR is reachable.

Transparency of safety properties: Since all actions in the alphabet of a property are eligible choices, composing a property with a set of processes does not affect their correct behaviour. However, if a behaviour can occur which violates the safety property, then ERROR is reachable. Properties must be deterministic to be transparent.

Ed Brinksma FMSE, Lecture 6

QuestionHow can we specify that some action, disaster, never occurs?

property CALM = STOP + {disaster}.

disaster

-1 0

Ed Brinksma FMSE, Lecture 6

Single Lane Bridge problem

A bridge over a river is only wide enough to permit a single lane of traffic. Consequently, cars can only move concurrently if they are moving in the same direction. A safety violation occurs if two cars moving in different directions enter the bridge at the same time.

Ed Brinksma FMSE, Lecture 6

Single Lane Bridge - model

Events or actions of interest?enter and exit

Identify processes.cars and bridge

Identify properties.oneway

Define each process and interactions (structure).

red[ID].{enter,exit}

blue[ID].{enter,exit}

BRIDGE

propertyONEWAY

CARS

SingleLaneBridge

Ed Brinksma FMSE, Lecture 6

Modelling the Carsconst N = 3 // number of each type of carrange T = 0..N // type of car countrange ID= 1..N // car identities

CAR = (enter->exit->CAR).

To model the fact that cars cannot pass each other on the bridge, we model a CONVOY of cars in the same direction. We will have a red and a blue convoy of up to N cars for each direction:

||CARS = (red:CONVOY || blue:CONVOY).

Ed Brinksma FMSE, Lecture 6

Modelling Car ConvoysNOPASS1 = C[1], //preserves entry orderC[i:ID] = ([i].enter -> C[i%N+1]).NOPASS2 = C[1], //preserves exit orderC[i:ID] = ([i].exit -> C[i%N+1]).

||CONVOY = ([ID]:CAR||NOPASS1||NOPASS2).

Permits 1.enter 2.enter 1.exit 2.exitbut not 1.enter 2.enter 2.exit 1.exit

ie. no overtaking.

1.enter 2.enter

3.enter

0 1 21.exit 2.exit

3.exit

0 1 2

Ed Brinksma FMSE, Lecture 6

Modelling the Bridge

BRIDGE = BRIDGE[0][0], // initially emptyBRIDGE[nr:T][nb:T] = // nr is the red count, nb the blue one

(when(nb==0) red[ID].enter -> BRIDGE[nr+1][nb] //nb==0 | red[ID].exit -> BRIDGE[nr-1][nb] |when(nr==0) blue[ID].enter-> BRIDGE[nr][nb+1] //nr==0 | blue[ID].exit -> BRIDGE[nr][nb-1]

).

Cars can move concurrently on the bridge only if in the same direction. The bridge maintains counts of blue and red cars on the bridge. Red cars are only allowed to enter when the red count is zero and vice-versa.

Even when 0, exit actions permit the car counts to be decremented. LTSA maps these undefined states to ERROR.

Ed Brinksma FMSE, Lecture 6

The Oneway Property

property ONEWAY =(red[ID].enter -> RED[1] |blue[ID].enter -> BLUE[1] ),RED[i:ID] = (red[ID].enter -> RED[i+1] |when(i==1)red[ID].exit -> ONEWAY |when(i>1) red[ID].exit -> RED[i-1] ), //i is a count of red cars on the bridge BLUE[i:ID]= (blue[ID].enter-> BLUE[i+1] |when(i==1)blue[ID].exit -> ONEWAY |when( i>1)blue[ID].exit -> BLUE[i-1] ). //i is a count of blue cars on the bridge

We now specify a safety property to check that cars do not collide!While red cars are on the bridge only red cars can enter; similarly for blue cars. When the bridge is empty, either a red or a blue car may enter.

Ed Brinksma FMSE, Lecture 6

Single Lane Bridge model analysis

Is the safety property ONEWAY violated?

||SingleLaneBridge = (CARS|| BRIDGE||ONEWAY).

No deadlocks/errors

Trace to property violation in ONEWAY:

red.1.enterblue.1.enter

Without the BRIDGE contraints, is the safety property ONEWAY violated?

||SingleLaneBridge = (CARS||ONEWAY).