Questions tagged [promela]

Process/Protocol Meta Language is a verification modelling language used to verify the logic of parallel systems.

PROMELA is a process modeling language whose intended use is to verify the logic of parallel systems. Given a program in PROMELA, Spin can verify the model for correctness by performing random or iterative simulations of the modeled system's execution, or it can generate a C program that performs a fast exhaustive verification of the system state space. During simulations and verifications SPIN checks for the absence of deadlocks, unspecified receptions, and unexecutable code. The verifier can also be used to prove the correctness of system invariants and it can find non-progress execution cycles. Finally, it supports the verification of linear time temporal constraints; either with Promela never-claims or by directly formulating the constraints in temporal logic. Each model can be verified with Spin under different types of assumptions about the environment. Once the correctness of a model has been established with Spin, that fact can be used in the construction and verification of all subsequent models.

PROMELA programs consist of processes, message channels, and variables. Processes are global objects that represent the concurrent entities of the distributed system. Message channels and variables can be declared either globally or locally within a process. Processes specify behavior, channels and global variables define the environment in which the processes run.

via: Wikipedia

159 questions
1
vote
1 answer

Using Spin / Promela to model heartbeat protocol?

I'm new to Spin, and would like to know if Spin can be used, or has been used, to model a heartbeat protocol in the face of intermittent or failed networks. One reason I'm struggling with this problem is that Spin abstracts the time dimension (only…
Larry Ruane
  • 137
  • 6
1
vote
0 answers

Channel design: many specific channels vs fewer general channels

When designing models in Promela, what are the design trade-offs for channels when there are a many different types of messages being sent? Many examples in documentation use a simple case with something like this mtype { M1, M2, M3 } chan req = [0]…
Noah Watkins
  • 5,446
  • 3
  • 34
  • 47
1
vote
1 answer

send message to set of channels in non-deterministic order

I'm building a Promela model in which one process send a request to N other processes, waits for the replies, and then computes a value. Basically a typical map-reduce style execution flow. Currently my model sends requests in a fixed order. I'd…
Noah Watkins
  • 5,446
  • 3
  • 34
  • 47
1
vote
1 answer

How can I bind the given input to another proctype function?

I need some help according to follow problem which I have to implemented it using jSpin and promela language. A home alarm system can be activated and deactivated using a personal ID key or password, after activation the system enters a waiting …
Mihai Alexandru-Ionut
  • 47,092
  • 13
  • 101
  • 128
1
vote
1 answer

how to model a queue in promela?

Ok, so I'm trying to model a CLH-RW lock in Promela. The way the lock works is simple, really: The queue consists of a tail, to which both readers and writers enqueue a node containing a single bool succ_must_wait they do so by creating a new node…
User1291
  • 7,664
  • 8
  • 51
  • 108
1
vote
2 answers

correct use of ``progress`` label

According to the man pages, Progress labels are used to define correctness claims. A progress label states the requirement that the labeled global state must be visited infinitely often in any infinite system execution. Any violation of this…
User1291
  • 7,664
  • 8
  • 51
  • 108
1
vote
1 answer

How to implement repeat untill (condition) loop in promela?

Which would be right approach to do : repeat{ ... } until() in Promela ? I have tried : do:: //.. (condition) -> break; od and do :: //.. if::(condition) -> break; else fi; od
djay
  • 375
  • 2
  • 18
1
vote
0 answers

How to prove a C program to LTL formulas with Frama-C Aoraï corresponding to my Promela program?

I have a test Promela program (a model of UI) that can be verified with Spin: int secrets = 0; int success = 0; int fails = 0; int total = 0; //variables to control bool windowLogin = false; bool windowSecret = false; bool windowNoSecret =…
1
vote
0 answers

Dijkstra's token termination algorithm in Promela

My teacher has assigned us to program Dijkstra's token termination algorithm in Promela. Here is the algorithm: "Every node maintains a counter c. Sending a message increases c by one; the receipt of a message decreases c by one. The sum of all…
tclaw46
  • 25
  • 1
  • 6
1
vote
2 answers

Referencing previous state in Promela LTL statement

I'm getting started with Promela, and I'm having trouble expressing some LTL formulas. An example is the following sequence value that I'd like to assert is monotonically increasing. Intuitively I want to write that in the next state, sequence is >=…
Noah Watkins
  • 5,446
  • 3
  • 34
  • 47
1
vote
1 answer

Testing Multiple LTL Formulae with SPIN

I have many LTL formulae that I am trying to test on the same .pml file. My issue is that when an error is found in any single ltl formula, the trail file is written (or overwrites) to the same trail file name. I have not been able to find a way to…
cmoses
  • 196
  • 1
  • 2
  • 16
1
vote
1 answer

Bug in select() statement with inlining?

I would have posted this in the spinroot Bug Reports, but the spinroot forum is not currently accepting new users... If someone out there in charge of that is reading this, please let me in :) Something very odd is happening when I try to use the…
cmoses
  • 196
  • 1
  • 2
  • 16
1
vote
1 answer

How does SPIN decide the order of process execution in atomic processes?

I am trying to figure out how SPIN chooses the order in which to execute and terminate processes in the following example. I realize that a main focus of SPIN is analyzing concurrent processes, but for my purposes I am just interested in simple…
cmoses
  • 196
  • 1
  • 2
  • 16
1
vote
1 answer

What kind of states and transitions does Spin's "depth reached" consider?

For verifications (with ispin) that use never claims, I get outputs with depth reached larger than the number of states and the number of transitions, e.g.: Full statespace search for: never claim + (REQ5) assertion violations …
DaveFar
  • 7,078
  • 4
  • 50
  • 90
1
vote
1 answer

Why is the promela model timing out?

I am working on a promela model that it fairly simple. Using two different modules, it acts as a crosswalk/Traffic light. The first module is the traffic light that outputs the current signal (green, red, yellow, pending). This module also receives…
Flower
  • 381
  • 1
  • 6
  • 17