Is Parallel Programming Hard, And, If So, What Can You Do About It?

Appendix EFormal VerificationParallel algorithms can be hard to write, and evenharder to debug. Testing, though essential, is insufficient,as fatal race conditions can have extremelylowprobabilitiesofoccurrence. Proofsofcorrectnesscan be valuable, but in the end are just as prone tohuman error as is the original algorithm.It would be very helpful to have a tool that couldsomehow locate all race conditions. A number ofsuch tools exist, for example, the language Promelaand its compiler Spin, which are described in thischapter. Section E.1 provide an introduction toPromela and Spin, Section E.2 demonstrates use ofPromela and Spin to find a race in a non-atomicincrement example, Section E.3 uses Promela andSpin to validate a similar atomic-increment example,Section E.4 gives an overview of using Promelaand Spin, Section E.5 demonstrates a Promelamodel of a spinlock, Section E.6 applies Promelaand spin to validate a simple RCU implementation,Section E.7 applies Promela to validate an interfacebetween preemptable RCU and the dyntick-idleenergy-conservation feature in the Linux kernel, SectionE.8 presents a simpler interface that does notrequire formal verification, and finally Section E.9sums up use of formal-verification tools for verifyingparallel algorithms.E.1 What are Promela andSpin?Promela is a language designed to help verify protocols,but which can also be used to verify small parallelalgorithms. You recode your algorithm and correctnessconstraints in the C-like language Promela,and then use Spin to translate it into a C programthat you can compile and run. The resulting programconducts a full state-space search of your algorithm,either verifying or finding counter-examplesfor assertions that you can include in your Promelaprogram.This full-state search can extremely powerful, butcan also be a two-edged sword. If your algorithmis too complex or your Promela implementation iscareless, there might be more states than fit in memory.Furthermore, even given sufficient memory, thestate-space search might well run for longer than theexpected lifetime of the universe. Therefore, use thistool for compact but complex parallel algorithms.Attempts to naively apply it to even moderate-scalealgorithms (let alone the full Linux kernel) will endbadly.Promela and Spinmay bedownloaded fromhttp://spinroot.com/spin/whatispin.html.The above site also gives links to Gerard Holzmann’sexcellent book [Hol03] on Promela andSpin, as well as searchable online references startingat: http://www.spinroot.com/spin/Man/index.html.The remainder of this article describes how to usePromela to debug parallel algorithms, starting withsimple examples and progressing to more complexuses.E.2 Promela Example: Non-Atomic IncrementFigureE.1demonstratesthetextbookraceconditionresulting from non-atomic increment. Line 1 definesthe number of processes to run (we will vary thisto see the effect on state space), line 3 defines thecounter,andline4isusedtoimplementtheassertionthat appears on lines 29-39.Lines 6-13 define a process that increments thecounter non-atomically. The argument me is theprocess number, set by the initialization block laterin the code. Because simple Promela statementsare each assumed atomic, we must break the incrementinto the two statements on lines 10-11. Theassignment on line 12 marks the process’s completion.Because the Spin system will fully search