JPH0883195A - Parallel program verification device - Google Patents

Abstract

PURPOSE: To perform the branch cut processing in a short time in a state where a reduced global state transition graph is produced by providing an auxiliary transition addition means which adds an auxiliary transition to transfer the priority from the transition that secures the synchronization among processes to the transition of the process of the other side. CONSTITUTION: An auxiliary transition addition device 1 transfers the priority from the transition that secures the synchronization among processes as a preprocessing for the production of a reduced global state transition graph to the transition of the process of the other side. When a branch is generated, only the transition of a process selected based on the priority that is previously set is selected, and a reduced global state transition graph generation device 2 generates a reduced global state transition graph from each process to which an auxiliary transition is added by the device 1. Since an auxiliary transition elimination device 3 eliminates the auxiliary transition as an after-processing it is possible to perform the branch cut processing without analyzing the information on a parallel program and also in a short time.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a parallel program verification device for verifying the correctness of a parallel program used by, for example, a distributed processing system, a parallel processing system, or a multitasking system on a single processor.

[0002]

2. Description of the Related Art The approach of expressing a parallel program as a global state transition graph and analyzing it (hereinafter referred to as "global state analysis") is very effective and is effective for verification of sequence control systems and communication protocols. It is applied for verification. Specifically, trace all states in the global state transition graph to see if verification items such as reachability to a certain state and activity of a certain action (that a certain action can occur steadily) are satisfied. Determined by However, the biggest problem of global state transition graph analysis is that the number of states in the global state transition graph increases explosively due to the combination.

A conventional global state analysis technique will be described below using a specific example.

In a parallel program, several processes (tasks) move in parallel while performing synchronous communication. For example, as shown in FIG. 9, a process p1 and a process that move in parallel while performing synchronous communication on the communication channel ch1 and the communication channel ch2.
A parallel program consisting of p2 is represented as shown in FIG. In FIG. 10, the left side of “%” represents a program, and the text on the right side of “%” represents a comment of these programs.

For communication between processes, synchronous communication used in Ada (send processing and receive processing are performed simultaneously) and asynchronous communication represented by UNIX pipes (send processing is receive processing) are used. There may be a time interval (delay) between them, but here, synchronous communication is assumed.

By the way, each process of the parallel program can be modeled by a state transition graph. For example, each process of the parallel program shown in FIG. 10 can be represented by the state transition graph shown in FIG. That is, the local behavior of each process of the concurrent program (individual behavior of each process) can be modeled by a state transition graph.

However, in order to analyze / verify a program, it is necessary to examine how the concurrent program operates as a whole, that is, the global behavior. Therefore, a method of expressing global behavior by a global state transition graph is generally used.

For example, the global state transition graph of the concurrent program shown in FIG. 10 or 11 is as shown in FIG. Each state of the global state transition graph is represented by a set of local states. For example, the initial state (s11, s21) of the global state transition graph is
At s11, it indicates that the state of process p2 is s21. Each transition in the global state transition graph is a combination of local transitions. For example, only "process 11" is executed in the state (s11, s21), and the state at the end of "process 11" is the state (s12, s2) where only process p1 has changed.
1). In the states (s12, s21), synchronous communication between processes is performed by the communication channel ch1, and the processes p1 and p2 simultaneously transit to the states (s13, s22). State (s13, s2
In 2), the "process 12" of the process p1 may be executed, and the determination process of the "condition 21" or "condition 22" of the process p2 may be performed. Thus, when the behavior is non-deterministic, all possible states (s14, s2
The transitions to 2), (s13, s23), and (s13, s24) are represented as branches. The transition is similarly performed thereafter.

With this global state transition graph, all states reachable from the initial state can be examined.
Specifically, it is possible to check whether a deadlock state or a dangerous state can be reached from the initial state. This is called global state analysis. Such global state analysis is a very effective method for verifying whether a concurrent program works correctly. However, when the concurrent program becomes relatively large in scale, the number of states in the global state transition graph explosively increases, and a situation occurs in which the global state analysis does not end in a realistic calculation time.
In principle, the power of the number of states of each process can be the number of states of the global state transition graph. For example, if there are 10 processes with 10 states, there is a possibility that a maximum of 10 billion global state transition graphs can be created. This is called the state explosion problem.

However, in practice, verification of a given verification item does not necessarily require all the states of the global state transition graph. Therefore, the technique of pruning the generation of the state unrelated to the verification is effective.

As a technique for suppressing the state explosion by pruning the generation of the state unrelated to the verification, for example, the document “A. Valmari, Stubborn Sets for Re-duced Sta.
te Space Generation, Proc. 19th International Confer
ence on Application and Theory of Petri Nets (198
9) ”and other proposals have been made. And
The reduced global state transition graph (also called Reduced State Space) generated by such a technique is
It is smaller than the normal global state transition graph, but it is required that the information necessary for verification remains. That is,
A reduced global state transition graph is obtained by pruning a portion unnecessary for verification by a selection device from a normal global state transition graph.

Therefore, in the proposed device, as shown in FIG. 13, the selection device 25 'prunes transitions unrelated to verification based on the information of the parallel program 23, and generates only necessary transitions. There is. Note that the operation of other configurations in FIG. 13 is similar to that of FIG. 6 described later.

However, in the conventional apparatus shown in FIG. 13, since it is necessary to analyze the information of the concurrent program for each state when pruning, there is a problem that it takes a lot of time to prun the state. is there.

[0014]

SUMMARY OF THE INVENTION The present invention has been made under such circumstances, and is a parallel program capable of pruning a state in a short time when generating a reduced global state transition graph. It is intended to provide a verification device.

More specifically, an object of the present invention is to provide a parallel program verification device capable of performing pruning processing without analyzing information of the parallel program.

[0016]

In order to solve the above problems, the present invention comprises two or more processes whose states transit, and each process is made to move in parallel by a transition in synchronization with another process. In a parallel program verifying device that verifies a concurrent program, a branch occurs with an auxiliary transition adding unit that adds an auxiliary transition that gives priority to the transition of the other process to the transition that synchronizes each process. In this case, only one process transition selected based on a predetermined priority is selected,
From a reduced global state transition graph generation means for generating a reduced global state transition graph from each process to which an auxiliary transition is added by the auxiliary transition addition means, and a reduced global state transition graph generated by this reduced global state transition graph generation means An auxiliary transition removing means for removing the auxiliary transition and a global state transition graph verification means for verifying the reduced global state transition graph from which the auxiliary transition is removed by the auxiliary transition removing means are provided.

[0017]

In the present invention, as a pre-process for generating a reduced global state transition graph, an auxiliary transition that gives priority to the transition that synchronizes each process is given to the transition of the other process, and the post-process is performed. Since auxiliary transitions are removed from the reduced global state transition graph, the pruning process can be performed without analyzing the information of the concurrent program when the reduced global state transition graph is generated. It can be done in a short time.

[0018]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 1 is a block diagram showing the configuration of a parallel program verification apparatus according to an embodiment of the present invention.

In FIG. 1, reference numeral 1 denotes an auxiliary transition adding device for adding an auxiliary transition as a preprocess to a transition which is synchronized among the transitions of each process constituting a parallel program. Here, the auxiliary transition is for explicitly "waiting" for execution of the transition for synchronization. Further, 2 is a reduced global state transition graph generation device that generates a reduced global state transition graph by using this auxiliary transition from a process to which an auxiliary transition is added, and 3 is a post-processing assistance from the generated reduced global state transition graph. Auxiliary transition removal devices 4 for removing transitions are global state transition graph verification devices for verifying the correctness of the reduced global state transition graph from which auxiliary transitions have been removed.

FIG. 2 shows an example of each process of the parallel program which is verified by the parallel program verifying device thus constructed.

Each process P of the parallel program shown in FIG.
1 and P2 are represented by a labeled state transition graph.
Each label represents a transition name. Where the alphabetic label transitions (a, b, c, d, k, l, m) represent the internal transitions of the process and the Greek letter labels (α, β, γ).
Indicates external transitions that synchronize with other processes, such as send and receive. External transitions with the same name must occur synchronously and simultaneously. In particular, the external transition γ is assumed to be a transition representing an error state. That is, when the external transition γ occurs, it means that the concurrent program is in an error state. In addition,
The label of the auxiliary transition is expressed as "wait".

FIG. 3 shows each process P of the parallel program.
An example in which 1 and P2 are expressed by a table will be shown. In the method shown in the figure, the state transition graph representing each process P1 and P2 of the parallel program is represented by an array of three sets (start point, end point, label). In this embodiment, the processes P1 and P2 are represented by the method shown in FIG. The same applies to the global state transition graph. In this embodiment, the expression method shown in FIG. 3 is used, but other methods such as the expression method described in “Structure of information (issued by Nihon Hyoronsha in March 1994)” are used. May be.

FIG. 4 is a flowchart showing the operation of the auxiliary transition adding device 1.

The auxiliary transition adding device 1 first judges whether or not there is a set (start point, end point, label) in the table shown in FIG. 3 which has not been read yet (step 401). If there is, read it (step 40)
2). If there is no set to be read, the operation ends.

Next, the auxiliary transition adding device 1 determines whether the label of the read set is a Greek character (step 403). If the label is a Greek letter, then generate a tuple with the label of the auxiliary transition (step 404),
This generated set is written together with the original set (step 4).
05). In the set having the label of auxiliary transition, the value of the starting point of the original set read at the starting point, the value indicating the auxiliary (dummy) state at the end point, and the wait at the label are respectively described. A value indicating the auxiliary (dummy) state is described at the starting point of the read original set. For example, if the read pair is (o, 1, α), it is (0,1 ', wai) as the pair with the auxiliary transition label.
(1 ', 1, α) is written as the original set read from t). Here, 1'indicates an auxiliary (dummy) state for adding an auxiliary transition. If the read set of labels is alphabetic, it is written as it is (step 406). This completes the algorithm of the auxiliary transition adding device 1.

FIG. 5 is a diagram in which an auxiliary transition with the label name "wait" is added to the external transition of each process in FIG.
By the addition of this auxiliary transition, the item “reachability to error state”, which is the item to be verified in this example, is stored in the selection device described later.

FIG. 6 is a block diagram showing the configuration of the reduced global state transition graph generation device 2. In the following description, it is assumed that process priorities are arbitrarily assigned in advance. This priority order is for convenience, and may be determined in any order, and may be determined regardless of the execution priority order of the process used in the so-called OS or the like. Here, it is assumed that the process P1 has a higher priority than the process P2. Of course, the reverse is also acceptable.

First, the reduced global state transition graph generation device 2 initializes (empties) the unprocessed state queue 20 and the state transition database 21.

Next, the initial state extraction device 22 extracts the initial state from the parallel program information 23. The initial state is represented by a set of initial states of each process. In this example, the initial state is (0,0). This initial state is the unprocessed state queue 2
It can be put in 0.

Next, one unprocessed state is selected from the unprocessed state queue 20. If there is no unprocessed state in the unprocessed state queue 20, the processing by this apparatus is terminated.

Next, the ignitable transition extraction device 24 extracts transitions applicable to the selected unprocessed state from the parallel program information 23 and extracts applicable transition sets. In this example, the transition that can be fired in the initial state (0,0) is P
There are only two internal transitions k.

Next, the selecting device 25 selects a transition to be actually applied to the applicable transition set based on the priority of the process, and sets the selected transitionable set. Specifically, for each applicable transition, if there is an applicable transition of a process with a higher priority than the process that makes the transition, the transition of a process with a lower priority is not selected. In the case of this example, since there is no transition applicable to the process P1 having a high priority from the initial state (0,0), the applicable transition k of the process P2 is selected.

Next, the transition execution device 26 executes the selected transition. In the case of this example, when the transition k is executed from the state (0,0), the transition destination state is (0,1).

Next, the state 27 in which the registration device 28 is generated is shown.
And the state transition relationship (that is, a set of (start point, end point, label)) is registered in the state database 21. At this time, if the state is already registered, only the transition relation is registered, and if the state is a new unregistered state, it is registered in the state database 21 and added to the unprocessed state queue 20. Then, the operation returns to the operation of selecting one unprocessed state from the unprocessed state queue 20. In the case of this example, the generated state (0,1) is put into the unprocessed state queue 20 and the operation returns to the operation of selecting one unprocessed state from the unprocessed state queue 20. The above operation is repeated to end the operation of the present apparatus. As described above, in the concurrent program verification device of the present embodiment, the pruning of the selection device 25 generates a reduced global state transition graph having a smaller number of states than the normal global state transition graph. That is, when the process shown in FIG. 2 is expressed in the global state transition graph without pruning, it becomes as shown in FIG. 7, but the verification item is “path (5,4) from initial state to error state (5,4) Does the path exist? ”, Some states (eg states (2,0), (3,0), (2,1), (3,1), etc.) need to be generated. Not. Therefore, the pruning of the selection device 25 of this embodiment produces a reduced global state transition graph with a small number of states as shown in FIG.

For example, the transitions applicable from the state (2,2) are the internal transition b of the process P1 and the internal transition 1 of the process P2. In the normal global state transition graph, as shown in FIG. 7, a transition from state (2,2) to state (3,0) and a transition from state (2,2) to state (2,0) are generated. However, the pruning of the selection device 25 of this embodiment selects only the internal transition b of the process P1 having a high priority, and the internal transition 1 of the process P2 is omitted as a redundant transition.

Here, "redundant transition" means the state (2,2).
In the above, even if the execution of the internal transition 1 of the process P2 is delayed and the internal transitions b and c of the process P1 are executed first, that is, even if they are executed in the order of b → c → l, the process P2 is executed first. Even if the internal transition 1 is executed and then b and c are executed, that is, even if they are executed in the order of l → b → c, the same state (0,0) is eventually reached (this is called "persistent"). Since it is called "sex"), either one can be omitted.

By the way, in such a persistent situation, in the selection based on the priority, only one representative element is selected, and the redundant transitions thereafter are not selected. However, if a transition is simply selected based on the priority, the transition originally required for verification may be deleted. Therefore, by introducing the auxiliary transition “wait” as in the present embodiment, it is possible to select the transition simply by the priority without deleting the transition originally required for the verification.

In the case of this example, if there is no auxiliary transition in the state (1,2), only a of the process P1 having the highest priority is selected from the applicable transitions a and l. At this time, the path to the error state (5,4) you want to verify will not occur.
However, when there is an auxiliary transition “wait” as in the present embodiment, both a and wait of the process P1 are selected from (1,2), and when the auxiliary transition “wait” is executed, after the transition, In the state (4 ′, 2), the process P1 waits, and the process P2 1 is selected. Thus, in this embodiment,
By the auxiliary transition "wait", the high priority process itself
By waiting, an operation such as yielding a transition to a process with a low priority is performed, and the necessary path is saved.

The reduced global state transition graph generated as described above is guaranteed to always include the terminal state (state with no transition destination) of the normal global state transition graph. In this example, the error state is the termination state,
If the reduced global state transition graph waits for an error state, then the normal global state transition graph also waits for an error state. The reverse is also true. In order for the global state transition graph verification device 4 to check the error state, all transitions of the generated reduced global state transition graph are traced, and there is an external transition γ representing error processing. If γ is present, “reachability to error state” is “present”, and if not, “no”. In the example of FIG. 8, it is “present”. The global state transition graph verification device 4 is
Other existing methods can also be used.

As described above, the number of states in the global state transition graph exponentially increases as the number of processes increases, but many states in the global state transition graph are shuffled by the internal transition of each process, for example, as shown in FIG.
(1,2), (1,0), (1,1), (2,2), (2,0), (2,1),
It is generated like (3,2), (3,0), (3,1), and is often irrelevant to what you want to analyze and verify. Therefore, by reducing redundant states unrelated to analysis verification as in the present invention, it is possible to significantly reduce analysis verification time and memory consumption. For example, comparing FIG. 7 and FIG. 8, the number of states is reduced by 24% and the number of transitions is reduced by 32%. Moreover, in the present invention, since auxiliary transitions are added as pre-processing before the generation of the global state transition graph, it is not necessary to analyze the information of the concurrent program when generating the global state transition graph, and the processing time is shortened. be able to.

[0042]

As described above, according to the present invention,
The pruning process can be performed without analyzing the information of the parallel program when the reduced global state transition graph is generated, and the pruning process can be performed in a short time.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a concurrent program verification device according to an embodiment of the present invention.

FIG. 2 is a diagram showing an example of each process of a parallel program verified by the parallel program verification device of FIG.

FIG. 3 is a diagram showing an example in which each process of a parallel program is represented by a table.

FIG. 4 is a flowchart showing an operation of the auxiliary transition adding device of FIG.

FIG. 5 is a diagram showing each process in which an auxiliary transition is added.

6 is a block diagram showing a configuration of the reduced global state transition graph generation device of FIG. 1. FIG.

7 is a diagram showing a reduced global state transition graph generated by the apparatus of FIG.

FIG. 8 is a diagram showing an unreduced global state transition graph.

FIG. 9 is a diagram showing an example of a system using a parallel program.

FIG. 10 is a diagram showing an example of a program of a parallel program.

11 is a diagram showing a state transition graph of FIG.

12 is a diagram showing a global state transition graph of FIG. 10 or FIG.

FIG. 13 is a block diagram showing a configuration of a conventional reduced global state transition graph generation device.

[Explanation of symbols]

 1 ... Auxiliary transition addition device 2 ... Reduced global state transition graph generation device 3 ... Auxiliary transition removal device 4 ... Concurrent program verification device

Claims (4)

[Claims] 1. A parallel program verification device for verifying a concurrent program, which comprises two or more processes whose states transit, each process being made to run in parallel by a transition that synchronizes with other processes, in a concurrent program verification device. For a transition that takes a value, an auxiliary transition adding unit that adds an auxiliary transition that gives priority to the transition of the other process from the transition, and one selected based on a predetermined priority when a branch occurs. Reduced global state transition graph generation means for generating a reduced global state transition graph from each process to which auxiliary transition is added by the auxiliary transition addition means by selecting only process transitions, and this reduced global state transition graph generation Auxiliary transition removing means for removing auxiliary transitions from the reduced global state transition graph generated by the means, Concurrent program verification apparatus characterized by comprising a global state transition graph verifying means for verifying the reduction global state transition graph auxiliary transition has been removed by the auxiliary transition removing means. 2. A global state transition graph generation for generating a global state transition graph from a concurrent program, which is composed of two or more processes whose states transit and each process is made to move in parallel by a transition that synchronizes with other processes. In the device, for transitions that synchronize each process, auxiliary transition addition means that adds an auxiliary transition that gives priority to the transition of the other process from the transition, and a predetermined priority when a branch occurs Reduced global state transition graph generation means for generating a reduced global state transition graph from each process to which auxiliary transition is added by the auxiliary transition addition means by selecting only transitions of one process selected based on Supplement from the reduced global state transition graph generated by this reduced global state transition graph generation means. A global state transition graph generation device comprising: an auxiliary transition removing means for removing an auxiliary transition. 3. A method for verifying a concurrent program, comprising: two or more processes whose states transit, each process being verified to move in parallel by a transition that synchronizes with another process. For a transition to be synchronized, a step of adding an auxiliary transition that gives priority to the transition of the other process from the transition, and one process selected based on a predetermined priority when a branch occurs Generating a reduced global state transition graph from each process to which auxiliary transitions are added by selecting only transitions, removing auxiliary transitions from the generated reduced global state transition graphs, and removing auxiliary transitions For verifying a reduced reduced global state transition graph . 4. A global state transition graph for generating a global state transition graph from a concurrent program, which is composed of two or more processes whose states transit, and in which each process is made to move in parallel by a transition in synchronization with another process. In the generation method, based on the step of adding an auxiliary transition that gives priority to the transition of the other process from the transition that synchronizes each process, and the predetermined priority when a branch occurs A step of generating a reduced global state transition graph from each process to which an auxiliary transition is added so that only one transition of the selected process is selected, and an auxiliary transition is removed from the generated reduced global state transition graph. A method for generating a global state transition graph, comprising: