VDM-10 Language Manual

Chapter 15
Synchronization Constraints (VDM++ and
VDM-RT)
In general a complete system contains objects of a passive nature (which only react when their
operations are invoked) and active objects which ‘breath life’ into the system. These active objects
behave like virtual machines with their own processing thread of control and after start up they do
not need interaction with other objects to continue their activities. In another terminology a system
could be described as consisting of a number of active clients requesting services of passive or
active servers. In such a parallel environment the server objects need synchronization control to be
able to guarantee internal consistency, to be able to maintain their state invariants. Therefore, in a
parallel world, a passive object needs to behave like a Hoare monitor with its operations as entries.
If a sequential system is specified (in which only one thread of control is active at a time) only a
special case of the general properties is used and no extra syntax is needed. However, in the course
of development from specification to implementation more differences are likely to appear.
The following default synchronization rules for each object apply in VDM++ and VDM-RT:
• operations are to be viewed as though they are atomic, from the point of the caller;
• operations which have no corresponding permission predicate are subject to no restrictions
at all;
• synchronization constraints apply equally to calls within an object (i.e. one operation within
an object calls another operation within that object) and outside an object (i.e. an operation
from one object calls an operation in another object);
• operation invocations have the semantics of a rendez-vous (as in Ada, see [Ada LRM]) in
case two active objects are involved. Thus if an object O 1 calls an operation o in object
O 2 , if O 2 is currently unable to start operation o then O 1 blocks until the operation may
be executed. Thus invocation occurs when both the calling object and the called object are
ready. (Note here a slight difference from the semantics of Ada: in Ada both parties to the
rendez-vous are active objects; in VDM++ and VDM-RT only the calling party is active)
137