A Livelock Freedom Analysis for Infinite State Asynchronous Reactive Systems

Abstract

We describe an incomplete but sound and efficient livelock freedom test for infinite state asynchronous reactive systems. The method abstracts a system into a set of simple control flow cycles labeled with their message passing effects. From these cycles, it constructs a homogeneous integer programming problem (IP) encoding a necessary condition for the existence of livelock runs. Livelock freedom is assured by the infeasibility of the generated homogeneous IP, which can be checked in polynomial time. In the case that livelock freedom cannot be proved, the method proposes a counterexample given as a set of cycles. We apply an automated cycle dependency analysis to counterexamples to check their spuriousness and to refine the abstraction. We illustrate the application of the method to Promela models using our prototype implementation named aLive.

A Uniform Classification of Common Concurrency Errors

“…In [29], progress is associated with operations on the so-called communication objects (such as shared variables, semaphores, FIFO buffers, etc.). In [42,65], progress is defined by reaching a socalled progress action or progress statement, respectively (e.g., delivering output, responding to the environment, etc.). In [34], progress is expressed by a so-called liveness signature, a set of state predicates and temporal rules, specifying which application states determine whether a program is making a progress when they are repeatedly reached.…”

“…This is mostly expected to be done by the user, e.g., by specifying progress actions [42], labelling statements as progress statements [35], annotating the code [34], calling actions of the socalled observer [10], etc. However, some works do not require any user input and use a fixed notion of progress [29].…”

“…In [42], the authors define progress as an execution of a progress action and a progress cycle as a cycle which contains at least one progress action. Then they translate a necessary condition of an existence of a non-progress behaviour, i.e., that there exists an infinite run in which progress cycles are repeated only a finite number of times, into a homogeneous integer programming problem.…”

“…Moreover, many works do not distinguish between livelocks and a nonprogress behaviour [10,63,42,65,34]. Other papers [51,48] take a livelock to be a situation where a task has such a low priority that it does not run (it is not allowed to make any progress) because there are many other, higher priority, tasks which run instead.…”

Local Livelock Analysis of Component-Based Models

“…Static analysis has also been proposed for establishing the absence of livelock for Promela models. Leue et al [55,54] introduced the notion of cycle dependency for control flow analysis.…”