How To Understand The Theory Of Multi-Process Programing

Transcription

1 AnExerciseintheVericationof Multi-ProcessPrograms StanfordUniversityy ZoharManna WeizmannInstituteofScience:z WeizmannInstituteofSciencez AmirPnueli October,1989 and formutualexclusionthatcontainsteststhatrefertomanyshared assumptionthatthesetestsareatomic.wethenconsiderthemore gramconsistingofaxedbutunboundednumberofprocessesexecut- inganidenticalprogram.theapproachisillustratedonanalgorithm variablesatthesametime.weanalyzethealgorithmrstunderthe Wepresentanapproachtothevericationofamulti-processpro- Abstract CCR ,bytheDefenseAdvancedResearchProjectsAgencyundercontractN ThisresearchwassupportedinpartbytheNationalScienceFoundationundergrant algorithmiscorrectonlyforthelimitedimplementationinwhichthe eralsteps,eachreadingasinglesharedvariable.weshowthatthe realisticassumptionthattheyaremolecular,i.e.performedbysev- AFOSR and ,andbytheEuropeanCommunityESPRITBasicResearch Actionproject3096(SPEC). 84-C-0211,bytheUnitedStatesAirForceOceofScienticResearchundercontracts zdepartmentofappliedmathematics,weizmanninstitute,rehovot,israel ydepartmentofcomputerscience,stanforduniversity,stanford,ca94305 variablesarecheckedinascendingorderofindices. 1

2 1Introduction Manyconcurrentprogramsconsistofasetofprocessesthatexecuteanidenticalprogram(whichmayrefertotheprocessidentierasaparameter).A themorerealisticassumptionthatthesetestsaremolecular(see[pz86]), areatomic,i.e.allvariablesarecheckedinasinglestep.wethenconsider anewalgorithmformutualexclusion([szy88]).weanalyzethealgorithm suchasystem,i.e.provingcorrectnessforanynumberofprocesses. rstundertheassumptionthatteststhatrefertomanysharedvariables challengingproblemistoprovidemethodsfortheuniformvericationof showthatthealgorithmiscorrectonlyforthelimitedimplementationin i.e.performedbyseveralsteps,eachreadingasinglesharedvariable.we Wepresentanapproachforsuchuniformvericationandillustrateiton completepaper[mp89])considersothernon-safetyproperties,suchasaccessibilityandprecedence. Weexamineonlythesafetypropertyofmutualexclusion.Themore counter-exampleformoregeneralimplementationsofmoleculartests. whichthevariablesarecheckedinascendingorderofindicesandpresenta setnotationhasbeenintroducedfortheanalysisofprobabilisticalgorithms). andtriedproofmethods,suchas[lam77,mp84](seealso[pz86]wherethis adoptionofasetnotationforexpressingthecontrolstateofasystemwithan unbounded,andevendynamic,setofprocesses,withintheframeworkofold stratingtheacuteneedforformalvericationofconcurrentprograms,as Thealgorithmwehavechosentoverifyisanidealexamplefordemon- Thepapercontainsnonewtheoreticalresults.Rather,itrecommendsthe wellasthestyleandlevelofvericationthatiscurrentlypossible.werefer thereaderto[szy88]forsomeofitsimportantfeatures,suchasusingsinglewriterboundedsharedvariablesandenjoyingthepropertyoflineardelay (whichweverifyin[mp89]asaprecedenceproperty).thesefeaturesmake thisalgorithmasignicantimprovementovermostofitspredecessors. onlywaywecouldconvinceourselvesofitscorrectnesswastoconstruct theformalproofoutlinedinthispaper.szymanskipresentedaninformal proof,whichisasconvincingasinformalproofscanbe.infact,ourformal proofderivesitsmainideasfromaformalizationofhisinformalarguments. However,ifthequestionofcorrectnessiscrucial,suchashavingtodecide whethertoincludethisalgorithmasacontention-resolvingcomponentina Althoughthealgorithmappearstobequitesimpleandinnocuous,the 2

3 hardwarechip,weseenowaybuttocarryoutaformalverication. ativityanddexterityinmanipulatinglogicalformulaetocomeupwiththe Thelessencouraginglessonisthatitrequiresanon-negligibledealofcre- appropriatesetofauxiliaryassertions(andotherconstructsneededforthe proof).thisissoevenifthecorrectintuitionisgivenandallthatisrequiredistoformalizethatintuition.themoreencouraginglessonisthat, oncetheappropriateconstructshavebeenfound,therestoftheverication Wehavelearnedtwolessonsfromcarryingoutthisvericationexercise. analgorithmliketheonewestudyhereconvincedusthatforalargeand Itisnotthatwehavecomeupwithasurprisinglynewautomatictheorem prover.butinspectionofthekindsofassertionsgeneratedforaproofof process,whichrequirestheconstructionofthevericationconditions(proof interestingclassofalgorithmsalltheseassertionsbelongtoadecidableclass. obligations)andprovingtheirvalidity,cantoalargeextentbeautomated. Ourcomputationalmodelisatransitionsystem.Init,aprogramPconsists ofthefollowingcomponents. 2ProgramsandComputations V=fu0;:::;un?1g{Anitesetofstatevariables.Somevariablesrepresentdatavariables,whichareexplicitlymanipulatedbytheprogram text.othersarecontrolvariables,whichrepresent,forexample,the {Asetofstates.Eachstates2isaninterpretationofV,assigning T{Anitesetoftransitions.Eachtransition2Tisassociated locationofcontrolineachoftheprocessesinaconcurrentprogram. Eachvariableisassociatedwithadomainoverwhichitranges. toeachvariabley2vavalueoveritsdomain,whichwedenoteby sors0under.theunprimedversionreferstovaluesins;theprimed s[y]. versiontovaluesins0.forexample,theassertionx0=x+1states tobothanunprimedandaprimedversionofthestatevariables.the withanassertion(v;v0),calledthetransitionrelation,whichrefers thats0[x]isgreaterby1thans[x]. purposeofistoexpresstherelationbetweenastatesanditssucces- 3

4 wherehs;s0iisthejointinterpretationthatinterpretsx2vass[x]andx0 Wedenestates0tobea-successorofstatesif {Theprecondition.Thisisanassertioncharacterizingalltheinitial ass0[x]. states.astateisdenedtobeinitialifitsatises. quenceofstates Astatesisterminalifithasno-successorforany2T. WedeneacomputationofaprogramPtobeanyniteorinnitese- hs;s0ij=(v;v0); ConsecutionForeachj=0;1;:::,statesj+1isa-successorofstatesj, Initiality satisfying: s0isinitial,i.e.s0j=. forsome2t. :s0;s1;s2;:::; TerminationEitherisinniteoritendsinaterminalstatesk. saythatastatesisp-accessibleifitappearsinsomecomputationofp. Clearly,any-successorofaP-accessiblestateisalsoP-accessible. WedenotebyComp(P)thesetofallcomputationsofprogramP.We pholdsons,wesaythatsisap-state. andrelationsoversomeconcretedomains.werefertoaformulaintheassertionallanguageasanassertion.foranassertionpandastatessuchthacatecalculus,andinterpretedsymbolsforexpressingthestandardoperations Weassumeanunderlyingassertionallanguage,whichcontainsthepredi- 3TheProgramasaTransitionSystem Theprogramwewishtostudycanbegivenas MUTEX::flag:array[0::n?1]of0::4whereflag:=0; P[0]jjP[1]jj:::jjP[n?1]4

5 l0:loopforeverdo beginl1:noncritical EachprocessP[i]isgivenby: l3:waituntil8j:0j<n:(flag[j]<3) l2:flag[i]:=1 l8:flag[i]:=4 l4:flag[i]:=3 l9:waituntil8j:0j<i:(flag[j]<2) l5:if9j:0j<n:(flag[j]=1)then l10:critical beginl6:flag[i]:=2 l11:waituntil8j:i<j<n:(flag[j]<2_flag[j]>3) l12:flag[i]:=0 endl7:waituntil9j:0j<n:(flag[j]=4) thefollowingfourcomponents: end V{Thestatevariables,are Viewingtheprogramasatransitionsystemrequirestheidenticationof L0;:::;L12;arecontrolvariablesthatrangeoversubsetsoff0;:::;n? ofthecorrespondingprogramvariables. 1g.Atanystateofthecomputation,Lkcontainstheindicesofthe processesthatcurrentlyarereadytoexecutethestatementlabeledlk. Variablesflag[0];:::;flag[n?1]naturallyrepresentthecurrentvalues L0;:::L12;flag[0];:::;flag[n?1]: {Thepreconditionisgivenbytheassertion {Thestates,consistofallthepossibleassignmentstothestate variablesofvaluesintheirrespectivedomains. :(L0=f0;:::;n?1g)^(L1::12=)^^i=0:n?1(flag[i]=0) 5

6 Clearly,move(i;k;m)describesthemovementofcontrolwithinprocessP[i] Weintroducethefollowingabbreviationsandnotations: Thus,attheinitialstateoftheprogram,allprocessesresideatthe fromlktolm,whilestaydescribesthecasethatcontroldoesnotmovein locationl0,andflag[0];:::;flag[n?1]arezero. anyoftheprocesses.li1;i2;:::;im=li1[li2[:::[lim move(i;k;m):(l0k=lk?fig)^(l0m=lm[fig) Fi1;i2;:::;im=Fi1[Fi2[:::[Fim :Vk=0:12(L0k=Lk) Fk=fi:0i<n:flag[i]=kg Ni=jLij mentl3)asatomic:eachisperformedbyasingletransition.consequently, TheTransitions OurrstanalysisofalgorithmMUTEXtreatsalltests(e.g.theoneinstate- Li::k=Li[Li+1[:::[Lk Fi::k=Fi[Fi+1[:::[Fk wehaveforeachprocessp[i]andeachlocationlkatransitionk[i]anda fori<k correspondingtransitionrelationk[i]. remainatl1ortomovefroml1tol2. Accordingtothisformula,processP[i]maychoosenon-deterministicallyto l5;forthefullsetoftransitions,see[mp89]. Thetransitionrelationforl1isgivenby Wepresentbelowthetwotransitionscorrespondingtolocationsl1and 5[i]:(i2L5)^[(F16=)^move(i;5;6)]_[(F1=)^move(i;5;8)] Thetransitionrelationforl5isgivenby 1[i]:(i2L1)^stay_move(i;1;2) andhencef1=. thereforef16=.itmayproceedtol8ifnoprocesshasitsflagequalto1, Whenatl5,P[i]mayproceedtol6ifsomeprocessP[j]hasflag[j]=1and 6

7 AssertionpisvalidoverprogramP(alsodescribedasbeingP-valid,)written aspj=p,ifpholdsoverallthep-accessiblestates.clearly,ifpisp-valid 4InvarianceProperties itisaninvariantpropertyofp:itholdsoverallthestatesthatariseinany computationoftheprogramp. theinvarianceofanassertionpoveraprogramp,i.e.provingpj=p. N101,whichlimitsthenumberofprocessesthatcanbeconcurrently MUTEX,mutualexclusion.Thispropertycanbeexpressedbytheassertion executingatl10.thus,wehavetoprove Inthissectionwepresentasingleproofrulethatisadequateforproving Wewillillustratethisrulebyprovingthemainsafetypropertyofprogram byitsprimedversionx0. p,whichisobtainedfrompbyreplacingeachvariablex2voccurringinp properties.itusesthenotationp0torefertotheprimedversionofassertion omittheprexpj=andsimplywriteptomeanpj=p. SincemostofourreasoningisdonewithintheP-validityframework,we ThefollowingruleINVisthemainworkingtoolforestablishinginvariance MUTEXj=(N101) Example4.1ConsiderthetrivialtransitionsystemPdenedasfollows. BypremiseI1ofruleINV,pholdsinitially,andbypremiseI2itispropagated fromeachstatetoitssuccessor.hence,pisaninvariantoftheprogram. INVI1.!p Thereisonestatevariable,x.Thereisonetransition,whosetransition I2.(p^)!p0forevery2T relationis:(x0=x+2).thepreconditionis:(x=0).transition Pj=p twopremises claimingthatallthevaluesofxareeven.toprovethisproperty,weuserule INVwithp:even(x).Therulerequiresshowingthevalidityofthefollowing systemphasthesingle(innite)computationhx:0i;hx:2i;hx:4i;:::. Wewishtoproveforthisprogramtheinvariant even(x); 7

8 I1.(x=0)!(even(x)) WenowestablishinvariantsforMUTEX,whichtogetherwillyieldourdesired SimpleInvariantsformutex Clearly,thesepremisesarevalid,whichestablishestheinvarianceofeven(x). I3.(even(x))^(x0=x+2)!(even(x0)) P[i]withflag[i].TheseinvariantscanbeexpressedasrelationsbetweenFk andlrforvariousvaluesofkandr. result.first,weestablishinvariantsthatconnectforeachithelocationof InvariantsIF0,...,IF4restrictthelocationsatwhichP[i]canresidewhen atoneofl9;:::;l12.invariantil8claimsthat,,whenp[i]isatl8,flag[i]is2 flag[i]is0;:::;4.forexample,invariantif4claimsthatflag[i]is4ip[i]is IF0.F0=L0::2 IF1.F1=L3;4 IF2.F2L7;8 IF4.F4=L9::12 IL8.F2;3L8 IF3.F3L5;6;8 toestablishthemaininvariancepropertyofmutex,mutualexclusion. or3.thisistheonlylocationforwhichflag[i]isnotuniquelydetermined. ideasofmutex.hereweextractjustthemainobservation.thetortuous Havingpreparedthemachineryforprovinginvarianceproperties,weproceed ProvingMutualExclusion segmentl8::12,whichcontainsthecriticalsection,astheinnersanctum. pathaprocesshastofollowonitswayfromthenon-criticalsectionatl1 tolocationl4asthedoorway,tosegmentl5::7asthewaitingroom,andto tothecriticalsectionatl10canbebrokenintodierentsegments.werefer Wereferthereaderto[Szy88]foradetailedexplanationofthebasic C1.Wheneveraprocessentersanemptyinnersanctum,thedoorwayis Thebasicclaimsonwhichmutualexclusionisbasedarethefollowing: locked,i.e.l4=.thedoorwayremainslockeduntilthelastprocess leavestheinnersanctum.whilethispropertyisexpressedasevolution intime,itcertainlyimpliestheinvariant 8

9 whichclaimsthatifl8::12isnon-emptythenl4isempty.ifthisis indeedaninvariant,thenthenon-emptinessofl8::12shouldprevent equals3or4.thus,wemustalsohave anynewprocessescomingtol3tocrossoverintol4.theonlything thatcanpreventthemfromcrossingoverisifflag[j]ofsomeprocess A0:L8::126=!L4=; C2.Ifaprocessiisatl10::12,thenithastheleastindexofalltheprocesses Notethatwerequirethatoneoftheprocessesinl8::12hasaagvalue of3or4.thisisbecauseaagvalueof3heldbyaprocessatl5;6is statementatl6. unstableinthesensethatitmayverysoonchangeto2again,bythe A1:L8::126=!L8::12\F3;46=: C3.Ifsomeprocessisatl12,thenalltheprocessesinl5::12musthaveaag inl5::12.thisisexpressedbytheinvariant valueof4.thisisexpressedbytheinvariant A2:(k<i^i2L10::12)!k62L5::12: isolatedfromtherestoftheprocessesandletsthemcompeteontheentry tothecriticalsection.byclaimc2,onlyoneprocessatatimecanresidein regionl10::12,whichincludesthecriticalsection,theprocesswhoseindexis locked.thisleavestheprocessesinthewaitingroomandtheinnersanctum Thus,assoonasaprocessenterstheinnersanctumthedoorwaygets A3:(i2L12^k2L5::12)!k2F4: followsimmediately. whichcanbeshowntobeaninvariant,fromwhichbya2mutualexclusion exclusionismaintained. minimalamongalltheprocessesinl5::12.itfollowsfromc1{c3thatmutual Takingthefourassertionstogether,weobtaintheconjunction p0:a0^a1^a2^a3 9

10 state,variablecicontainsthesetofallindicesjthathavealreadybeen considersuchteststobemolecular.tomodelthemostgeneralformofa moleculartest,weintroduceadditionalstatevariablesc0;:::;cn?1.ineach checkedbyprocessp[i].weillustratethisbyconsideringtwotransition Theassumptionthatcompoundtestsareatomicisnotrealistic,andwenow 5TheMolecularCase relations.2[i]:i2l2^move(i;2;3)^flag0[i]=1^c0i= istoresetthealreadycheckedvariableto,preparingforthetestatl3. Thisrelationshowsthatoneoftheactionsperformedbytransition3[i] Thetransitionrelationforthemoleculartestatl3consistsofthreeoptions,representedbythreeclauses.Therstclausecoversthecasethat jcij=n,whichimpliesthatallindiceshavebeencheckedandwemayproceedfroml3tol4.thesecondclauseidentiesanindexjthatsatises twoextremes,thisallowsbothfortheimplementationinwhichciisemptied flag(j)<3andthatisnotyetinci.thisindexisaddedtoci.thelast wheneverwendabadindexj,andtheimplementationthatignoresbad clausedetectsanuncheckedindexj,whichdoesnotsatisfyflag(j)<3.here indicesandretainsciatitscurrentvalue. weallowanarbitrarychangeofciaslongasitdoesnotincrease.atthe ACounter-Example tests,aspresentedabove.unfortunately,thisisnotpossible.thefollowing counterexampleconsidersaprogramwiththreeprocessesandtracestheir Itwouldhavebeennicetoextendourprooffortheatomiccasetoaprooffor themolecularcase,allowingthemostgeneralimplementationsofmolecular [j62ci^flag(j)<3^stay^c0i=ci[fjg] [j62ci^flag(j)3^stay^c0ici] _ 1CA 10

11 someintermediatestatesthatoccurinthecomputationuntiltheviolating P[2],andflag[2].Notethat,whileatl3,processP[0]checkstheindices locationofp[0],flag[0],c0,thelocationofp[1],flag[1],thelocationof stateisreached.foreachpresentedstatewelist,fromlefttoright,the generalprogressuntiltheyreachastateinwhichp[0]andp[2]executetheir 2;1;0indescendingorder. respectivecriticalsectionsatthesametime,violatingmutualexclusion. Theoendingcomputationispresentedinthefollowingtable,whichlists 02flag[0]C012flag[1]22flag[2] L00 L2 fgl00l00 L31L31 L31 L11 L4 L53 L94 L53 L72 L4 f2g L12 L00 L94 L10 L4 L94 f2;1;0g f2;1g L10 6RestrictedImplementationofMolecular Theremedytotheproblemencounteredaboveistorestricttheimplementationofmoleculartests.Inparticular,weshouldnotallowtheselectionof Tests 11

12 thenextindextobecheckedtobecompletelyarbitrary. intheinnersanctum.itisessentialtoensurethatwhenp[r]departsfrom departfromtheinnersanctumatl12.assumethatp[r]isnotthelastprocess processp[r],whichiscurrentlyintheinnersanctumwithflag[r]=4.this l3attemptingtoproceedtol4.assumealsothatitisblockedatl3by meansthatthatindexj=rhasnotbeencheckedyetbyp[k],andwillnot besuccessfullycheckedaslongasflag[r]=4.eventually,p[r]willwantto Consideratypicalsituation,inwhichsomeprocessP[k]iscurrentlyat theirflagequalto4,andasobservedbefore,musthaveanindexhigher todepart,thenalltheprocessesremainingintheinnersanctummusthave thanr.itfollowsthat,ifwetakecarethatp[k]atl3examinestheindicesin ascendingorder,thenifp[k]isblockedbyrithasnotsuccessfullychecked theinnersanctum,anotherprocessintheinnersanctumwillcontinueto blockp[k].accordingtoclaimc2,processesdepartfromtheinnersanctum inorderofincreasingindices.accordingtoc3,ifp[r]isnotthelastprocess continuingtoblockk. anyindexhigherthanr.consequently,whenrdepartsandleavesbehind someotherprocess,withindext>r,tcanserveasareplacementforr, teststoexaminesflag[j]inorderofincreasingj.todoso,wereplacestate variablesc0;:::;cn?1,bythesimplerintegervariablesj0;:::;jn?1.ineach state,jicontainstheleastvalueofjthathasnotyetbeensuccessfullytested byp[i].thetwotransitionrelationsbelowillustratehowthevariablesare manipulatedbythemoleculartests. Motivatedbythisargument,werestricttheimplementationofmolecular Thisrelationshowsthatonmovingtol3,thetransition3[i]resetsjito0. 2[i]:i2L2^move(i;2;3)^flag0[i]=1^j0i=0 Asbefore,thisrelationconsistsofthreeclauses,correspondingto:completion ofthetest,advancementwhendetectingagoodnextindex,andretreatwhen [ji<n^flag(ji)<3^stay^j0i=ji+1] [ji<n^flag(ji3^stay^j0iji]1ca _ 12

13 Itishelpfultoderivetheassertionsforthemolecularcaseasrenmentsofthe detectingabadnextindex.again,theretreatisgeneralenoughtoallow ReprovingMutualExclusion bothrestartingfromji=0andkeepingjiatitscurrentvalue. assertionsfortheatomiccase.consideranyregionofconsecutivelocations thatifk<iandibelongstol10::12,thenkcannotbeinl5::12.inthe acompoundtest.forexample,l10::12issucharegion.assertiona2states because,bythesimpleinvariantsconnectingagvaluestolocations,that P[i]cannotpasstheatomictestatl9ifk<iisanywhereatl5::12.Thisis thatismentionedinoneoftheassertionsa0;:::;a3andthatisprecededby wouldhaveimpliedflag[k]2. mayresideatl9forseveralsteps,checkingthevaluesofflag[ji]formany valuesofji.theimportantquestionconcerningkiswhetherp[i]hasalready atomiccase,oneoftheconsiderationsusedinprovingthisassertionsisthat testedthevalueofflag[k].thiscanbeobservedbycheckingwhetherji>k. Ifso,thenflag[k]hasalreadybeentestedandfoundsatisfactory,i.e.less than2. Inthemolecularcase,thetestatl9isnotpassedinonestep.ProcessP[i] A0;A2;andA3,weobtainthefollowingassertions: replacethesimpleregionreferencei2l10::12bytheextendedreference i2l10::12_(i2l9^ji>k).byapplyingsuchrangeextensionstoassertions B0:(i2L5^ji>k)!:hk2L4_(k2L3^jk>i)i Consequently,toadaptassertionA2tothemolecularcase,weshould B1:i2L8::12!9r:(r2L8::12\F3;4)::hk2L4_(k2L3^jk>r)i ThebasicideaistoshowforanykthatifP[i]isatl8::12orl5withji>k, i.e.havingalreadycheckedflag[k],thenp[k]cannotbeatl4,andifitisat B3:h(i2L12_(i2L11^ji>k))^(k2L5::12)i!k2F4 B2:h(k<i)^(i2L10::12_i2L9^ji>k)i!k62L5::12 AssertionsB0andB1reneassertionsA0andA1tothemolecularcase. 13

14 l3,thenit'sjkvalueisbelowsomerthatblocksitfromproceedingintol4, byhavingflag[r]>2.ifp[i]isatl5,wecantakertobeiitself.ifp[i]is atl8::12,wecanonlyclaimtheexistenceofsomeblockingr,suchthatp[r] isalsoatl8::12andflag[r]>2. andclaimthatitisaninvariantofmutex.itisbeyondthescopeofthis papertoconsiderallthetransitionsandshowthateachpreserves'.we will,however,considersomeofthemoreinterestingcases. Weformnowtheconjunction tionofp[i]isonethatmovesfroml5tol8.however,duetob0,theright ConsiderwhattransitionsmayaecttheassertionB1.Acriticaltransi- ':B0^B1^B2^B3 jkbeyondr.however,duetoflag[r]>2,suchatransitionisdisabled. handsideoftheimplicationofb1willholdafterthetransitionwithr=i andflag[i]=3.acriticaltransitionofkwouldhavebeenonethatincreases Therefore,ifjkritisalsot.DuetoB3,flag[t]equals4.Consequently, risnotthelast,thereisanotherprocess,sayp[t],inl8::12.then,dueto afterthetransition,b1stillholdsifweusetasasubstituteforr.for afterthetransitionl8::12willbecomeempty,causingb1toholdtrivially.if itsagto0.therearetwopossibilities.ifristhelastprocessinl8::12,then B2,whichstatesthatristheminimalprocessinl8::12,rissmallerthant. Lastly,weconsiderthetransitionofP[r]froml12tol0,whileresetting thisargumenttoholditisessentialthattheindicesjinl3arescannedin Wegratefullyacknowledgetheencouragementandeditorialhelpextendedby increasingorder. Acknowledgement References [Lam77]L.Lamport.Provingthecorrectnessofmultiprocessprograms. DavidGries,whichgreatlyimprovedthestyleandreadabilityofthepaper. IEEETrans.SoftwareEngin.,3:125{143,

15 [MP84]Z.MannaandA.Pnueli.Adequateproofprinciplesforinvariance [PZ86]A.PnueliandL.Zuck.Vericationofmultiprocessprobabilistic [MP89]Z.MannaandA.Pnueli.Toolsforthepracticingverier.Technical andlivenesspropertiesofconcurrentprograms.sci.comp.prog., 32:257{289,1984. [Szy88]B.K.Szymanski.AsimplesolutiontoLamport'sconcurrentprogrammingproblemwithlinearwait.InProc.1988International ConferenceonSupercomputingSystems,pages621{626,St.Malo, France,July1988. report,dept.ofcomputerscience,stanforduniversity,1989. protocols.distributedcomputing,1(1):53{72,