Is Parallel Programming Hard, And, If So, What Can You Do About It?

244 APPENDIX E. FORMAL VERIFICATION1 #define NUMPROCS 223 byte counter = 0;4 byte progress[NUMPROCS];56 proctype incrementer(byte me)7 {8 int temp;910 temp = counter;11 counter = temp + 1;12 progress[me] = 1;13 }1415 init {16 int i = 0;17 int sum = 0;1819 atomic {20 i = 0;21 do22 :: i < NUMPROCS ->23 progress[i] = 0;24 run incrementer(i);25 i++26 :: i >= NUMPROCS -> break27 od;28 }29 atomic {30 i = 0;31 sum = 0;32 do33 :: i < NUMPROCS ->34 sum = sum + progress[i];35 i++36 :: i >= NUMPROCS -> break37 od;38 assert(sum < NUMPROCS || counter == NUMPROCS)39 }40 }Figure E.1: Promela Code for Non-Atomic Incrementthe state space, including all possible sequences ofstates, there is no need for the loop that would beused for conventional testing.Lines 15-40 are the initialization block, which isexecuted first. Lines 19-28 actually do the initialization,while lines 29-39 perform the assertion. Bothare atomic blocks in order to avoid unnecessarily increasingthe state space: because they are not partof the algorithm proper, we loose no verification coverageby making them atomic.The do-od construct on lines 21-27 implements aPromela loop, which can be thought of as a C for(;;) loop containing a switch statement that allowsexpressions in case labels. The condition blocks(prefixed by ::) are scanned non-deterministically,though in this case only one of the conditions canpossibly hold at a given time. The first block ofthe do-od from lines 22-25 initializes the i-th incrementer’sprogress cell, runs the i-th incrementer’sprocess, and then increments the variable i. Thesecond block of the do-od on line 26 exits the looponce these processes have been started.The atomic block on lines 29-39 also contains asimilar do-od loop that sums up the progress counters.The assert() statement on line 38 verifiesthat if all processes have been completed, then allcounts have been correctly recorded.You can build and run this program as follows:spin -a increment.spin# Translate the model to Ccc -DSAFETY -o pan pan.c# Compile the model./pan # Run the modelpan: assertion violated ((sum