Is Parallel Programming Hard, And, If So, What Can You Do About It?

248 APPENDIX E. FORMAL VERIFICATIONbit each to indicate completion. This gives 32states. In contrast, a simple counter would haveonly six states, more than a five-fold reduction.That factor of five might not seem like a problem,at least not until you are struggling with averification program possessing more than 150million states consuming more than 10GB ofmemory!7. One of the most challenging things both in Ctorture-test code and in Promela is formulatinggood assertions. Promela also allows neverclaims that act sort of like an assertion replicatedbetween every line of code.8. Dividing and conquering is extremely helpful inPromela in keeping the state space under control.Splitting a large model into two roughlyequal halves will result in the state space ofeach half being roughly the square root of thewhole. For example, a million-state combinedmodel might reduce to a pair of thousand-statemodels. Not only will Promela handle the twosmaller models much more quickly with muchless memory, but the two smaller algorithms areeasier for people to understand.E.4.2 Promela Coding TricksPromela was designed to analyze protocols, so usingit on parallel programs is a bit abusive. The followingtricks can help you to abuse Promela safely:1. Memory reordering. Suppose you have a pairof statements copying globals x and y to localsr1 and r2, where ordering matters (e.g., unprotectedby locks), but where you have no memorybarriers. This can be modeled in Promelaas follows:1 if2 :: 1 -> r1 = x;3 r2 = y4 :: 1 -> r2 = y;5 r1 = x6 fiThe two branches of the if statement will beselected nondeterministically, since they bothare available. Because the full state space issearched, both choices will eventually be madein all cases.Of course, this trick will cause your state spaceto explode if used too heavily. In addition, itrequires you to anticipate possible reorderings.1 i = 0;2 sum = 0;3 do4 :: i < N_QRCU_READERS ->5 sum = sum + (readerstart[i] == 1 &&6 readerprogress[i] == 1);7 i++8 :: i >= N_QRCU_READERS ->9 assert(sum == 0);10 break11 odFigure E.6: Complex Promela Assertion1 atomic {2 i = 0;3 sum = 0;4 do5 :: i < N_QRCU_READERS ->6 sum = sum + (readerstart[i] == 1 &&7 readerprogress[i] == 1);8 i++9 :: i >= N_QRCU_READERS ->10 assert(sum == 0);11 break12 od13 }Figure E.7: Atomic Block for Complex Promela Assertion