1. Modeling Mutual Exclusion Algorithms
Timo Wegeler

2. Overview
Example problem formalization
HML modeling
CCS modeling

3. Peterson‘s mutual exclusion algorithm
Ensure mutual exclusion for two processes
Each process executes
j index of other process
b initially false
Milner‘s Calculus of
Communicating Systems
Message passing
No shared variables

4. Peterson‘s mutual exclusion algorithm (cont)
Two processes running concurrently
j index of other process

5. Access of variables in CCS
Encode a boolean as a process with two states
B1t , B1f
Processes read and write variables using communication ports
, b1wf

6. Variables used in Peterson‘s algorithm
Represented in CCS expressions

7. CCS process formalization
Concentrate on entering and exiting the critical section

8. CCS process term representing Peterson‘s algorithm
L: communication channel names
(read and write variables)
Next: specify how to „ensure mutual exclusion“

9. Behaviour analysis: ensuring mutual exclusion in HML
At no point in the execution of the algorithm, P1 and P2 are in their critical sections at the same time.
Next: specify how to „ensure mutual exclusion“

10. Behaviour analysis: ensuring mutual exclusion in HML
At no point in the execution of the algorithm, P1 and P2 are in their critical sections at the same time.
Remember:
Processes are in their critical sections when they can perform the exit action.

11. Ensuring mutual exclusion in HML
Transition system
States are CCS processes
Transitions are weak transitions of the form for any action α including τ
Formula [exit1]ff is satisfied by all processes not affording an transition
No matter how many internal steps

12. HML verification
Does process Peterson satisfy Inv(F)?
Set of states of process Peterson is a post-fixed point of the set function associated with the mapping
or by iteratively computing the largest fixed point
tedious!
Use Edinburgh Concurrency Workbench (CWB)
CHECKPROP

13. Behaviour analysis: ensuring mutual exclusion with CCS
Implementation verification:
Represent actual system and specification as CCS terms
Behavioural equivalence or approximation
No behavioural equivalence to rule them all
Trace equivalence
Strong bisimilarity
Weak bisimilarity
Represent desired behaviour as a CCS term
Choose suitable notion of behavioural equivalence

14. Ensuring mutual exclusion with CCS
Desired behaviour:
Why not trace equivalence or strong bisimilarity? …
Why not observational equivalence?

15. Ensuring mutual exclusion with CCS (cont)
Why not observational equivalence?
Process Peterson affords weak transition
Target state affords any weak enter1 and cannot perform any weak enter2
For process MutexSpec:
Only state reachable by internal transitions: MutexSpec
Both enter transitions are enabled! 

16. Ensuring mutual exclusion with CCS (cont)
Solution? Formalize observable content
Need to show:
Each sequence of action in process Peterson is a trace of MutexSpec
At no point in its behaviour, Peterson performs two exit actions in a row

17. Weak traces and weak equivalence

18. Weak traces and weak equivalence
Peterson and MutexSpec are weak trace equivalent.
Therefore meet our specification.
Check via CWB: MAYEQ
Each weak trace of Peterson can exhibit as a weak trace all of the specification‘s traces.
If this safety condition is enough, it can be proven that Peterson is a weak trace approximation of MutexSpec
Check for existance of a weak simulation using CWB: PRE

19. Weak simulation

20. Weak simulation (cont)

21. Thanks for your attention
Questions?

22. Section not covered
Testing mutual exclusion