鐃緒申文鐃緒申蓮鐃�Spin Model Checker 鐃塾醐申鐃緒申鐃緒申鐃緒申鐃緒申 http://spinroot.com 鐃祝わ申鐃緒申 Basic Spin Manual 鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申里任鐃緒申鐃緒申鐃緒申鐃淑醐申鐃熟￥申Gerard J. Holzmann 鐃祝居申鐃縦わ申鐃緒申鐃銃醐申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃淑どわ申鐃緒申泙鐃緒申鐃緒申蕁�https://github.com/masateruk/BasicSpinManual鐃祝わ申Issue鐃殉わ申鐃緒申PR鐃祝てわ申鐃緒申陲い鐃緒申鐃緒申鐃緒申鐃夙刻申鐃緒申鐃叔わ申鐃緒申
Spin 鐃緒申鐃渋行ワ申鐃緒申鐃銃ワ申鐃緒申鐃叔わ申如鐃緒申鐃緒申命鐃緒申廛鐃緒申肇鐃緒申鐃祝わ申鐃緒申鐃緒申的鐃緒申鐃緒申鐃緒申鮓‐擇鐃緒申鐃縦￥申鐃緒申任鐃緒申鐃緒申鐃緒申鐃緒申謄鐃塾随申鐃緒申鐃書いは￥申Promela鐃緒申Process Meta Language鐃祝と呼ばわ申鐃緒申妊鐃藷グ醐申鐃緒申砲鐃獣て居申鐃述わ申鐃殉わ申鐃緒申鐃緒申鐃塾醐申鐃緒申任蓮鐃緒申孫團廛鐃緒申鐃緒申鐃緒申鐃銃暗�鐃緒申鐃緒申鐃薯記述わ申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申鐃粛ワ申鐃署しわ申鐃緒申奪鐃緒申鐃緒申鐃緒申命鐃緒申鐃銃縁申鐃緒申命鐃緒申淵鐃緒申妊屐法鐃緒申鐃銃縁申鐃緒申命鐃緒申淵鐃緒申紂種申砲鐃緒申丱奪侫鐃緒申鐃藷グ）わ申両鐃緒申鐃薯記述わ申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申鐃熟￥申Spin 鐃緒申箸鐃� Promela 鐃叔居申鐃述わ申鐃緒申鐃緒申鐃緒申鐃銃ワ申鐃緒申鐃緒申鐃準シ鐃淳ワ申譟種申鐃緒申鐃藷しわ申鐃所、鐃殉わ申鐃緒申Promela 鐃叔居申鐃述わ申鐃緒申鐃緒申妊襪�鐃緒申 C 鐃緒申鐃緒申慮鐃緒申撻廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申謄鐃緒申鐃緒申鐃緒申鐃緒申鐃塾醐申鐃准わ申圓鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申潺紂種申譟種申鐃緒申鐃緒申筝￥申擇隆屐鐃�Spin 鐃熟デッドワ申鐃獣ワ申鐃緒申鐃淑わ申鐃緒申鐃緒申嫂泙鐃緒申覆鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申覆鐃緒申鐃緒申鐃緒申泙鐃緒申孫圓鐃緒申討鐃緒申覆鐃緒申鐃緒申鐃緒申匹鐃緒申覆鐃緒申鐃緒申鐃緒申覆疋鐃緒申鐃緒申奪鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申撻廛鐃緒申鐃緒申鐃緒申呂泙鐃緒申鐃緒申鐃緒申謄鐃緒申鐃緒申鐃術常申錣�鐃楯誌申鐃緒申鐃緒申討鐃緒申襪�鐃宿わ申鐃緒申鐃薯検証わ申鐃緒申鐃所、鐃塾ワ申廛鐃緒申鐃緒申譽刻申鐃緒申鐃緒申鐃緒申鐃緒申non-progress execution cycles鐃祝わ申鐃淑わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃所、鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申Linear Temporal Logic鐃祝で居申鐃述わ申鐃緒申鐃緒申鐃緒申飽鐃夙随申鐃緒申討鐃緒申覆鐃緒申鐃緒申鮓‐擇鐃緒申泙鐃緒申鐃�
鐃緒申鐃准プワ申鐃緒申鐃緒申鐃熟醐申率鐃緒申鐃祝わ申鐃緒申鐃曙、鐃緒申鐃緒申鐃緒申鐃緒申未鐃渋随申鐃緒申鐃緒申鐃殉わ申鐃緒申Spin 鐃祝わ申鐃緒申鐃獣居申鐃緒申鐃緒申擇侶鐃縮￥申鐃緒申鐃緒申鐃熟￥申鐃緒申鐃緒申鐃銃ワ申凌鐃緒申鐃緒申颪い縫鐃緒申蕁種申鐃緒申覆鐃緒申鐃緒申匹鐃緒申鐃緒申砲弔鐃緒申董鐃緒申鐃緒申鐃重�鐃緒申裏鐃春わ申鐃緒申鐃曙た鐃塾証わ申鐃緒申鐃暑こ鐃夙わ申鐃叔わ申鐃緒申里任鐃緒申鐃緒申鐃緒申鐃峻ュー鐃緒申鐃塾リソ鐃緒申鐃緒申鐃緒申鐃緒申鐃渋わ申鐃緒申鐃縮常申鐃緒申垈鐃叔緒申箸鐃緒申鐃緒申鐃順き鐃淑ワ申鐃緒申鐃銃ワ申慮鐃緒申擇癲�"鐃俊ット常申鐃瞬駈申鐃瞬種申法" 鐃夙わ申鐃緒申鐃緒申鐃藷技術わ申鐃緒申鐃塾醐申鐃准わ申鐃叔緒申箸鐃緒申討鐃緒申泙鐃緒申鐃緒申鐃緒申亮鐃祝￥申任蓮鐃緒申鐃緒申鐃緒申僂鐃叔常申鐃渋わ申鐃殉わ申鐃淑わ申鐃初、鐃緒申達鐃緒申能鐃淑各常申鐃瞬わ申鐃緒申咼奪箸飽鐃緒申未鐃緒申襪鰹申箸鐃緒申任鐃緒申泙鐃緒申鐃�
鐃緒申鐃塾ワ申鐃緒申鐃緒申 1 鐃緒申鐃叔わ申 Promela 鐃塾紹駕申鐃緒申鐃� 2 鐃緒申鐃叔わ申 Spin 鐃塾誌申鐃緒申鐃緒申法鐃祝つわ申鐃銃とりあ鐃緒申鐃殉わ申鐃緒申Promela 鐃塾簡件申淵鐃春ワ申鐃緒申鵐垢鐃�鐃緒申鐃緒申鐃緒申鐃祝わ申鐃緒申泙鐃緒申鐃緒申鐃熟随申任蓮鐃緒申鐃緒申鐃緒申弔鐃緒申鐃緒申鐃薯示わ申鐃緒申Spin 鐃叔醐申鐃准わ申鐃暑た鐃緒申鐃� Promela 鐃緒申箸辰鐃緒申鐃緒申鐃重�鐃淑ワ申妊鐃塾削申鐃緒申鐃緒申法鐃祝つわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申
鐃緒申鐃塾マニュア鐃緒申任蓮鐃�Spin 鐃塾種申鐃緒申鐃緒申分鐃塾みにつわ申鐃銃居申鐃緒申鐃緒申鐃殉わ申鐃緒申Promela 鐃緒申鐃緒申粒鐃縦ワ申鐃縦￥申鐃緒申虜廼鐃塾バ￥申鐃緒申鐃緒申鐃祝関わ申鐃緒申鐃緒申鐃緒申砲弔鐃緒申討録鐃緒申鐃銃わ申鐃殉わ申鐃緒申幣椶鐃緒申鐃緒申蓮鐃緒申鐃緒申離泪縫絅�鐃緒申虜埜鐃薯参照わ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃祝￥申鐃殉わ申鐃緒申LTL 鐃叔居申鐃述わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃術わ申鐃緒申鐃緒申鐃准につわ申鐃銃わ申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃�
Promela 鐃熟醐申鐃緒申鐃術のワ申妊鐃藷グ醐申鐃緒申任鐃緒申鐃緒申鐃緒申慮鐃緒申鐃叔は￥申鐃緒申鐃准わ申鐃緒申鐃叔関随申鐃塾なわ申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申澪鐃緒申僂鐃塾象わ申鐃緒申櫺鐃緒申鐃緒申鐃緒申廛鐃緒申肇鐃緒申鐃淑まわ申鐃熟￥申鐃緒申鐃緒申的鐃緒申分鐃緒申鐃緒申鐃緒申鐃銃ワ申砲魑�述わ申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申Spin 鐃塾誌申鐃緒申鐃緒申的鐃熟￥申鐃緒申鐃緒申鐃縦わ申鐃緒申鐃緒申由鐃祝わ申蟲随申錣件申鐃緒申隼廚鐃緒申訃�鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃塾随申鐃緒申鐃書いを検証わ申鐃暑こ鐃夙でわ申鐃緒申 Promela 鐃叔関随申鐃塾わ申鐃暑振鐃緒申鐃緒申鐃緒申分鐃祝つわ申鐃銃居申鐃述わ申鐃緒申鐃緒申鐃准わ申鐃殉わ申鐃緒申Promela 鐃緒申妊鐃緒申鐃淑鰹申的鐃祝詳細駕申鐃緒申鐃銃わ申鐃緒申鐃緒申鐃緒申連鐃塾ワ申鐃銃ップわ申个童鐃緒申擇魎扱襪居申鐃緒申泙鐃緒申鐃緒申董鐃緒申離鐃叔ワ申鐃緒申个鐃緒申鐃緒申超鐃緒申砲鐃獣て異なわ申鐃粛￥申鐃淑駕申鐃緒申覆鐃緒申箸鐃緒申弌鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃夙わ申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃淑ｏ申鐃緒申鐃夙わ申鐃祝わ申鐃緒申鐃所し鐃銃￥申鐃緒申鐃准わ申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃駿￥申Spin 鐃祝わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔ワ申鐃緒申曚鐃緒申襪鰹申箸鐃緒申任鐃緒申鐃出￥申鐃緒申鐃塾醐申離鐃叔ワ申虜鐃緒申鐃緒申噺鐃緒申擇蓮鐃緒申鐃緒申了鐃緒申造鐃緒申箸某覆鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申
Promela 鐃緒申妊鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃�鐃緒申鐃緒申優鐃�鐃緒申鐃術随申鐃緒申鐃緒申覆鐃殉わ申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃熟ワ申鐃緒申鐃緒申鐃出ルオ鐃瞬ワ申鐃緒申鐃緒申鐃夙でわ申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃粛ワ申鐃緒申竸鐃緒申魯鐃緒申鐃緒申鐃緒申丱襦�鐃盾し鐃緒申鐃熟￥申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申僂鐃緒申襪鰹申箸鐃緒申任鐃緒申泙鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申録鐃緒申鐃緒申颪い魑�述わ申鐃緒申鐃緒申鐃緒申優鐃夙ワ申鐃緒申鐃緒申鐃出ワ申鐃術随申鐃熟プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申超鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申
Promela 鐃祝は￥申鐃緒申鐃緒申文鐃塾間になにわ申磴わ申呂鐃緒申鐃殉わ申鐃緒申単鐃夙のブ￥申鐃緒申鐃緒申鐃獣縁申鐃淑醐申箸鐃緒申動鐃緒申鐃緒申泙鐃緒申鐃緒申鐃淑醐申亮孫圓蓮鐃緒申鐃緒申鐃�鐃渋行駕申能鐃緒申鐃祝わ申鐃殉わ申鐃緒申文鐃熟実行駕申能鐃叔わ申鐃暑か鐃緒申鐃渋刻申鐃峻駕申能鐃叔ブワ申鐃獣ワ申鐃緒申鐃緒申襪�鐃塾どわ申鐃緒申砲覆鐃殉わ申鐃緒申鐃渋行駕申能鐃緒申鐃熟￥申同鐃緒申鐃緒申箸鐃緒申鐃緒申的鐃緒申鐃緒申法鐃叔わ申鐃緒申鐃瞬ワ申鐃獣ワ申鐃緒申鐃曙た鐃竣ワ申鐃緒申鐃緒申鐃熟￥申鐃渋行駕申能鐃祝なるイ鐃駿ワ申箸鐃夙�鐃緒申鐃緒申鐃緒申里鐃緒申圓鐃緒申泙鐃緒申鐃緒申鐃緒申箸鐃緒申弌鐃緒申焚鐃緒申里茲�鐃祝ビワ申鐃緒申鐃暑ー鐃竣で緒申鐃緒申鐃緒申鐃�
while (a != b) skip /* wait for a==b */
Promela 鐃叔は駕申鐃塾よう鐃祝書いて￥申同鐃緒申鐃緒申鐃縮わ申鐃緒申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申
(a == b)
鐃緒申鐃熟￥申鐃緒申鐃塾常申錣�鐃緒申鐃緒申鐃緒申鐃緒申鐃夙わ申鐃塾み実行駕申能鐃祝なわ申泙鐃緒申鐃緒申發件申鐃緒申鐃緒が鐃緒申鐃緒申鐃緒申鐃緒申覆鐃緒申箸鐃緒申蓮鐃緒申鐃緒申両鐃緒が鐃緒申鐃緒申鐃緒申鐃緒申鐃殉でブワ申鐃獣ワ申鐃緒申鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申鐃緒申鐃出ワ申鐃術随申鐃熟ワ申鐃緒申鐃銃ワ申亡悗鐃緒申襯逸申鐃緒申鐃緒申丱鐃淑常申鐃緒申鐃緒申飮鐃緒申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申鐃塾ワ申鐃緒申鐃緒申鐃緒申鐃術随申鐃熟各プワ申鐃緒申鐃緒申鐃塾常申鐃瞬わ申鐃楯誌申鐃緒申鐃殉わ申鐃緒申鐃術随申鐃緒申鐃緒申鐃緒申蓮鐃�
bool flag; int state; byte msg;
鐃塾よう鐃祝居申鐃述わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申里茲�鐃緒申 Promela 鐃緒申鐃粛逸申琉曚覆鐃�3鐃縦わ申鐃緒申鐃緒申鐃緒申鐃薯サポ￥申鐃夙わ申鐃銃わ申鐃殉わ申鐃緒申鐃術随申鐃塾ワ申鐃緒申鐃緒申鐃竣は￥申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申粒鐃渋�鐃緒申鐃緒申鐃緒申鐃緒申譴随申鐃塾はわ申鐃駿てワ申鐃緒申鐃緒申鐃出ワ申砲覆蝓�鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申里魯廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申砲覆鐃殉わ申鐃緒申
鐃緒申鐃緒申鐃緒申表鐃熟￥申32-bit 鐃緒ー鐃宿ワ申鐃緒申鐃緒申鐃塾ワ申鐃緒申團紂種申鐃緒申砲鐃緒申鐃緒申鐃緒申鐃旬デ￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾ワ申鐃緒申鐃緒申鐃緒申鐃熟囲わ申泙箸瓩随申鐃塾でわ申鐃緒申鐃叔￥申鐃緒申鐃緒申鐃緒申鐃夙）￥申
|
Typename byte short int |
C-equivalent bit-field uchar short int |
Macro in limits.h - CHAR_BIT (width in bits) SHRT_MIN..SHRT_MAX INT_MIN..INT_MAX |
Typical Range 0..1 0..255 -2^15 - 1 .. 2^15 - 1 -2^31 - 1 .. 2^31 - 1 |
bit 鐃緒申 bool 鐃緒申 1 鐃俊ットの常申鐃緒申鐃宿緒申鐃銃縁申鐃緒申鐃叔わ申鐃緒申byte 鐃緒申 0 鐃緒申鐃緒申 255 鐃殉でわ申鐃粛わ申箸鐃緒申鐃緒申覆鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃�shot 鐃緒申 int 鐃熟わ申鐃緒申蕕�鐃夙りう鐃緒申鐃粛わ申鐃熟囲わ申鐃純う鐃緒申鐃緒申鐃叔￥申鐃夙わ申鐃緒申鐃緒申鐃春わ申鐃緒申鐃緒申鐃叔わ申鐃緒申
mtype 鐃熟￥申mtype = { ... } 鐃夙わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鷏燭任鐃緒申鐃緒申鐃緒申鐃祝つわ申鐃銃は￥申鐃緒申劼鐃緒申泙鐃緒申鐃�
鐃術随申鐃熟￥申鐃緒申鐃緒申箸鐃緒申討鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃夙わ申鐃出￥申
byte state[N]
鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃順、state 鐃緒申 N 鐃縦わ申 byte 鐃緒申鐃緒申鐃術随申鐃緒申鐃縦わ申鐃夙わ申鐃叔わ申鐃緒申鐃緒申鐃緒申任鐃緒申鐃緒申鐃緒申鐃塾鰹申鐃緒申鐃叔へわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申佑了鐃緒申箸蓮鐃�
state[0] = state[3] + 5 * state[3*2/n]
鐃塾よう鐃祝居申鐃述わ申鐃緒申鐃緒申鐃緒申妊奪鐃緒申鐃緒申砲鐃緒申竸鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申僂鐃緒申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃緒申離鐃緒申鐃叔ッワ申鐃緒申鐃熟ワ申法鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申佑鐃宿緒申鐃緒申鐃緒申鐃緒申鐃術わ申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申楼蓮鐃�0 .. N-1鐃祝鰹申鐃塾ワ申鐃緒申妊奪鐃緒申鐃緒申鐃緒申鐃所し鐃緒申鐃緒申隋�鐃緒申鐃緒申鐃粛わ申未鐃緒申鐃緒申任鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申魯鐃藷タワ申鐃準エ鐃初ー鐃夙なわ申泙鐃緒申鐃渋随申鐃緒申鐃緒申鐃緒申鐃緒申 typedef 鐃緒申鐃緒申僂鐃緒申鐃緒申鐃祝わ申鐃緒申鐃緒申的鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�WhatsNew.html 2.1.7 鐃潤参鐃夙）￥申
鐃術随申鐃緒申鐃緒申鐃� 2 鐃縦のワ申鐃緒申鐃竣わ申文鐃緒申鐃瞬￥申鐃緒申鐃緒申文鐃緒申鐃緒申鐃緒申文鐃緒申鐃緒申鮓�てわ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申肋鐃緒申鐃渋行駕申能鐃叔わ申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃淑醐申呂鐃緒申譴�鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申鐃夙わ申鐃塾み実行駕申能鐃叔わ申鐃緒申
鐃術随申鐃緒申鐃緒申鐃粛ワ申両鐃緒申屬了鐃緒申箸鐃緒申儿鐃緒申鐃緒申任鐃緒申鐃塾は￥申鐃竣ワ申鐃緒申鐃緒申鐃塾みでわ申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃塾随申鐃緒申鐃書いわ申 proctype 鐃緒申鐃緒申砲鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申箸鐃緒申弌鐃�1 鐃縦のワ申鐃緒申鐃緒申鐃緒申鐃術随申 state 鐃緒申鐃縦プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃薯下居申鐃祝種申鐃緒申鐃殉わ申鐃緒申
proctype A()
{ byte state;
state = 3
}
鐃緒申鐃塾常申隋�鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申名鐃緒申鐃緒申 A 鐃夙なわ申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾わ申鐃緒申鐃緒申 {} 鐃叔囲みまわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申里蓮鐃�0鐃縦以常申離鐃緒申鐃緒申鐃緒申鐃緒申竸鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申咫鐃淑醐申離螢刻申箸鐃緒申鐃淑わ申泙鐃緒申鐃緒申綉�鐃緒申鐃緒申鐃緒申蓮鐃�1 鐃縦のワ申鐃緒申鐃緒申鐃緒申鐃術随申鐃緒申鐃緒申鐃緒申竸鐃� state 鐃緒申鐃緒申 3 鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申劼箸弔鐃淑醐申鐃緒申鐃淑わ申泙鐃緒申鐃�
文鐃熟￥申鐃緒申鐃淳ワ申鐃緒申鐃緒申砲鐃緒申分鐃緒申鐃緒申鐃殉わ申鐃淑ワ申鐃淳ワ申鐃緒申鐃緒申鐃淑醐申僚鐃塾誌申鐃緒申鐃叔はわ申鐃緒申泙鐃緒申鵝�わ申鐃塾わ申鐃潤、鐃叔醐申鐃淑醐申里鐃緒申鐃緒申鐃緒申離鐃緒申潺鐃緒申鐃緒申鐃熟逸申味鐃緒申鐃緒申鐃緒申泙鐃緒申鐃祝￥申Promela 鐃緒申 2 鐃縦の異なわ申文鐃緒申分離鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃� '->' 鐃夙ワ申鐃淳ワ申鐃緒申鐃緒申 ';'鐃祝わ申鐃緒申鐃緒申泙鐃緒申鐃�2 鐃縦の違い鐃熟わ申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申呂箸鐃緒申匹鐃� 2 鐃縦わ申文鐃塾逸申鐃縮関件申鐃緒申表鐃緒申鐃塾に使わ申鐃殉わ申鐃緒申鐃緒申鐃夙わ申鐃出￥申鐃淑駕申鐃緒申鐃緒申里茲�鐃祝使わ申鐃殉わ申鐃緒申
byte state = 2;
proctype A()
{ (state == 1) -> state = 3
}
proctype B()
{ state = state - 1
}
鐃緒申鐃緒申鐃緒申任蓮鐃�2 鐃縦のプワ申鐃緒申鐃緒申鐃緒申 A 鐃緒申 B 鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃緒申竸鐃� state 鐃熟ワ申鐃緒申鐃緒申鐃出ワ申鐃術随申鐃夙わ申鐃緒申鐃緒申鐃緒申鐃緒申譟�鐃緒申 2 鐃祝わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申 A 鐃緒申鐃緒申鐃緒申鐃緒申鐃祝わ申鐃淑�鐃緒申鐃緒申譴� 2 鐃縦わ申文鐃緒申鐃緒申覆鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申任蓮鐃緒申廛鐃緒申鐃緒申鐃緒申鐃� B 鐃緒申鐃術随申 state 鐃緒申鐃粛わ申 1 鐃緒申鐃初す鐃述とつわ申文鐃緒申鐃緒申覆鐃殉わ申鐃緒申鐃緒申鐃緒申文鐃熟常申房孫垈鐃叔緒申覆里如鐃�B 鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃熟ブワ申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃淑わ申鐃緒申砲鐃緒申鐃銃逸申鐃緒申了鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申鐃� A 鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃緒申鐃術随申 state 鐃緒申鐃粛わ申適鐃准わ申鐃粛わ申箸鐃殉で常申鐃淑醐申里箸鐃緒申鐃緒申妊屮鐃緒申奪鐃緒申鐃緒申鐃殉わ申鐃緒申
proctype 鐃祝わ申鐃緒申鐃緒申鐃熟プワ申鐃緒申鐃緒申鐃塾随申鐃緒申鐃書いわ申鐃緒申鐃緒申鐃緒申鐃塾みで￥申鐃渋行はわ申鐃殉わ申鐃緒申Promela 鐃緒申妊鐃叔ははわ申鐃潤、鐃緒申鐃緒申鐃緒申 init 鐃塾ひとつのプワ申鐃緒申鐃緒申鐃塾みわ申鐃渋行わ申鐃緒申泙鐃緒申鐃緒申鐃緒申離廛鐃緒申鐃緒申鐃緒申鐃緒申呂鐃緒申戮討鐃� Promela 鐃緒申妊鐃緒申鐃緒申鐃緒申鐃緒申鐃重�鐃緒申鐃緒申鐃緒申鐃緒申鐃宿�鐃竣わ申鐃緒申鐃緒申泙鐃�*1鐃緒申Promela 鐃緒申鐃緒申鐃緒申任鐃緒申鐃叔も小鐃緒申鐃緒申鐃緒申妊鐃熟￥申鐃淑駕申鐃塾わ申里任鐃緒申鐃�
init { skip }
skip 鐃熟駕申鐃盾し鐃淑わ申鐃緒申鐃淳￥申鐃緒申文鐃叔わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申味鐃緒申鐃緒申鐃緒申鐃祝￥申鐃緒申鐃塾緒申鐃緒申廛鐃緒申鐃緒申鐃緒申魯鐃緒申鐃緒申鐃緒申丱鐃緒申竸鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申離鐃緒申鵐好鐃緒申鵐垢鐃緒申鐃緒申鐃緒申鐃緒申襪鰹申箸鐃緒申任鐃緒申泙鐃緒申鐃緒申綉�鐃塾ワ申鐃緒申鐃銃ワ申鐃術わ申 init 鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申楼焚鐃緒申里茲�鐃祝なわ申泙鐃緒申鐃�
init
{ run A(); run B()
}
run 鐃熟プワ申鐃緒申鐃緒申鐃緒申名鐃緒申鐃緒申鐃純え鐃出￥申A鐃祝わ申鐃緒申鐃緒申砲箸鐃獣縁申鐃初算鐃述でわ申鐃緒申run 鐃熟￥申鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃銃ワ申鐃藷スワ申鐃藷スわ申鐃緒申鐃緒申鐃叔わ申鐃緒申箸鐃緒申里濕孫垈鐃叔緒申任鐃緒申鐃緒申鐃緒申箸鐃緒申个鐃緒申任砲鐃緒申鐃緒申鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃獣てわ申鐃銃随申鐃緒申鐃淑ワ申鐃藷スワ申鐃藷スわ申鐃緒申鐃緒申鐃叔わ申鐃淑わ申鐃夙わ申鐃熟￥申鐃渋刻申鐃峻駕申能鐃夙なわ申泙鐃緒申鐃�
run 鐃熟￥申鐃緒申鐃緒申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申鐃緒申个鐃緒申鐃緒申椒如鐃緒申鐃緒申鐃緒申離僖鐃潤ー鐃緒申鐃緒申鐃熟わ申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃夙わ申鐃出￥申鐃淑駕申鐃塾よう鐃緒申鐃緒申鐃緒申魑�述わ申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�
proctype A(byte state; short foo)
{
(state == 1) -> state = foo
}
init
{
run A(1, 3)
}
鐃叔￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申鐃緒申鐃術ワ申瓠種申鐃緒申箸鐃緒申鐃緒申呂鐃緒申鐃緒申呂任鐃緒申泙鐃緒申鵝８鐃叔醐申鐃緒申茲�鐃祝￥申鐃緒申鐃旬デ￥申鐃緒申鐃緒申鐃淑鰹申鐃祝パワ申瓠種申鐃緒申箸鐃緒申鐃緒申呂鐃緒申鐃塾は￥申唯鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申優鐃塾みでわ申鐃緒申
鐃緒申鐃緒申鐃淑プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申 run 鐃緒申 init 鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔なわ申鐃緒申鐃駿てのプワ申鐃緒申鐃緒申鐃叔誌申鐃術駕申能鐃叔わ申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃熟￥申run 鐃祝わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃熟￥申鐃緒申了鐃緒申鐃緒申鐃夙わ申鐃祝（わ申鐃淑わ申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申分鐃塾最醐申泙鐃緒申鐃獣ｏ申鐃緒申鐃夙）姿わ申辰鐃緒申泙鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申麓鐃緒申箸鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申鐃緒申鐃塾誌申鐃緒申討鐃緒申藹�了鐃緒申鐃殉わ申鐃緒申
run 鐃祝わ申鐃竣ワ申鐃緒申鐃緒申鐃緒申 A 鐃緒申 B 鐃塾ワ申鐃峻￥申鐃薯いわ申鐃縦でわ申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申劼箸聴幣鐃緒申鐃渋行プワ申鐃緒申鐃緒申鐃緒申鐃述とつのワ申鐃緒申鐃緒申鐃出ワ申鐃術随申鐃緒申鐃宿み書きわ申鐃緒申鐃順、鐃処く鐃塾わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃粛まわ申鐃緒申鐃�[2] 鐃緒申鐃純が鐃緒申鐃緒申泙鐃緒申法鐃緒申鐃緒申箸鐃緒申弌鐃緒申焚鐃緒申里茲�鐃緒申 2 鐃縦のプワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃出ワ申鐃術随申 state 鐃緒申有鐃緒申鐃暑シ鐃緒申鐃銃ワ申鐃粛わ申鐃殉わ申鐃順う鐃緒申
byte state = 1;
proctype A()
{ byte tmp;
(state==1) -> tmp = state; tmp = tmp+1; state = tmp
}
proctype B()
{ byte tmp;
(state==1) -> tmp = state; tmp = tmp-1; state = tmp
}
init
{ run A(); run B()
}
鐃盾し 2 鐃縦のわ申鐃緒申鐃述とつのプワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃夙わ申鐃緒申鐃緒申鐃祝器申了鐃緒申鐃銃わ申鐃殉わ申鐃夙￥申鐃盾う鐃緒申鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃熟はわ申鐃緒申両鐃緒申文鐃塾とわ申鐃緒申鐃叔永縁申縫屮鐃緒申奪鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃殉わ申鐃緒申鐃盾し 2 鐃縦のプワ申鐃緒申鐃緒申鐃緒申同鐃緒申鐃祝常申鐃淑醐申鐃緒申未鐃夙器申鐃緒申鐃緒申蕁�2 鐃縦とも完了鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃叔わ申鐃順う鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾とわ申鐃緒申 state 鐃緒申鐃粛わ申予測鐃峻駕申能鐃叔わ申鐃緒申state 鐃緒申鐃粛わ申 0, 1, 2 鐃塾わ申鐃緒申鐃塾どれか鐃祝なわ申任鐃緒申腓�鐃緒申
鐃緒申鐃緒申鐃緒申鐃緒申砲呂鐃緒申鐃緒申鐃緒申鐃塾解が考わ申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃出ワ申鐃術随申鐃緒申箸鐃淑わ申鐃夙わ申鐃緒申鐃処う鐃緒申鐃緒申法鐃緒申鐃初、鐃緒申有鐃術随申鐃塾テワ申鐃夙とワ申鐃獣トわ申鐃峻駕申分鐃叔行わ申鐃緒申鐃緒申鐃楯証わ申鐃緒申鐃緒申鐃縮なマワ申鐃緒申鐃緒申鐃緒申鐃術わ申鐃緒申鐃緒申法鐃殉で￥申鐃緒申鐃緒申鐃緒申鐃緒申郎能鐃祝醐申鐃緒申鐃緒申鐃曙た鐃緒申里劼箸弔任鐃緒申鐃緒申鐃緒申鐃熟ドワ申鐃縦の随申鐃舜種申 Dekker 鐃祝わ申鐃緒申里任鐃緒申鐃緒申鐃緒申離鐃緒申襯器申螢削申鐃祝わ申蝓�3 鐃縦のワ申鐃緒申鐃緒申鐃出ワ申鐃術随申鐃緒申箸鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任鐃春わ申鐃緒申鐃緒申謄鐃緒申鐃緒申襯誌申鐃緒申鐃緒申鐃緒申鐃舜の随申鐃緒申鐃緒申 2 鐃縦のプワ申鐃緒申鐃緒申鐃緒申鐃緒申他的鐃祝行わ申鐃緒申鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申Promela 鐃緒申妊鐃塾最緒申鐃� 4 鐃峻は￥申C 鐃緒申鐃曙ス鐃緒申鐃緒申鐃緒申離泪鐃緒申鐃緒申鐃緒申鐃叔わ申鐃緒申鐃叔緒申鐃� 2 鐃縦のマワ申鐃緒申鐃緒申 true 鐃緒申鐃緒申鐃� 1鐃緒申false 鐃緒申鐃緒申鐃� 0 鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃銃縁申佑法鐃�Aturn, Bturn 鐃緒申鐃緒申鐃緒申箸鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃緒申
#define true 1
#define false 0
#define Aturn false
#define Bturn true
bool x, y, t;
proctype A()
{ x = true;
t = Bturn;
(y == false || t == Aturn);
/* critical section */
x = false
}
proctype B()
{ y = true;
t = Aturn;
(x == false || t == Bturn);
/* critical section */
y = false
}
init
{ run A(); run B()
}
鐃緒申鐃塾ワ申鐃暑ゴ鐃所ズ鐃緒申蓮鐃緒申鐃緒申鐃緒申屬鐃緒申孫圓鐃緒申鐃緒申鐃緒申鐃叔わ申鐃緒申2鐃縦のプワ申鐃緒申鐃緒申鐃塾実行ワ申鐃峻￥申鐃宿にはまっわ申鐃緒申鐃緒申存鐃緒申鐃銃わ申鐃殉わ申鐃緒申
Promela 鐃祝はわ申鐃緒申鐃銃ワ申鐃緒申 & 鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃薯すわ申鐃縮の種申鐃淑わ申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃熟￥申atomic 鐃叔わ申鐃緒申鐃緒申鐃緒申鐃緒ー鐃緒申 atomic 鐃叔囲まわ申鐃淑醐申離鐃緒申鐃緒申鐃緒申鵐垢蓮鐃渋常申離廛鐃緒申鐃緒申鐃緒申砲鐃獣てワ申鐃藷タ￥申鐃所ー鐃瞬わ申鐃曙ず鐃緒申鐃峻駕申分鐃祝実行わ申鐃緒申泙鐃緒申鐃�atomic 鐃緒申鐃緒申鐃緒申鐃藷スわ申鐃緒申虜能鐃緒申文鐃淑鰹申鐃塾とわ申鐃緒申鐃叔ブワ申鐃獣ワ申鐃緒申鐃曙た鐃緒申隋�鐃緒申鵐織鐃緒申爛�鐃初ー鐃夙なわ申泙鐃�*2鐃緒申鐃緒申鐃塾よう鐃緒申 atomic 鐃緒申鐃緒申鐃緒申鐃藷スわ申箸鐃緒申鐃緒申砲鐃所、鐃緒申鐃緒申鐃祝種申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃出ワ申鐃術随申 state 鐃緒申鐃出わ申鐃緒申鐃渋行ワ申鐃緒申鐃緒申鐃緒申鐃祝関わ申鐃緒申鐃緒申鐃緒申鐃緒申匹鐃緒申鐃緒申箸鐃緒申任鐃緒申泙鐃緒申鐃�
byte state = 1;
proctype A()
{ atomic {
(state==1) -> state = state+1
}
}
proctype B()
{ atomic {
(state==1) -> state = state-1
}
}
init
{ run A(); run B()
}
鐃緒申鐃塾ワ申鐃緒申鐃緒申鐃叔わ申 state 鐃塾最醐申鐃緒申佑蓮鐃緒申匹鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃緒申鐃渋行わ申鐃緒申鐃緒申鐃祝わ申鐃� 0 鐃殉わ申鐃緒申 2 鐃祝なわ申泙鐃緒申鐃緒申發�鐃緒申鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃熟永縁申縫屮鐃緒申奪鐃緒申鐃緒申鐃殉わ申鐃緒申
atomic 鐃緒申鐃緒申鐃緒申鐃藷スは醐申鐃准わ申鐃緒申鐃叔ワ申鐃淑ｏ申鐃緒申鐃緒申鐃准醐申鐃緒申鐃緒申鐃緒申廚鐃銃誌申鐃叔わ申鐃緒申atomic 鐃緒申鐃緒申鐃緒申鐃藷スわ申分鐃緒申鐃緒申鐃緒申鐃銃ムが鐃夙りう鐃暑イ鐃藷タ￥申鐃所ー鐃俊ングわ申鐃緒申鐃渋わ申鐃暑こ鐃夙わ申鐃緒申鐃春わ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃純え鐃出￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃術随申鐃緒申鐃出わ申鐃緒申鐃緒申鐃緒申 atomic 鐃緒申鐃緒申鐃緒申鐃藷スとわ申鐃暑こ鐃夙にわ申辰董鐃淑ｏ申鐃緒申淵鐃叔ワ申魄靴鐃緒申鐃緒申鐃緒申任鐃緒申鐃処う鐃祝なわ申泙鐃緒申鐃緒申鐃緒申鐃祝わ申鐃淑ｏ申鐃緒申鐃緒申鐃緒申的鐃祝醐申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�
鐃緒申奪鐃緒申鐃緒申鐃�鐃緒申鐃緒申優鐃�鐃熟ひとつのプワ申鐃緒申鐃緒申鐃緒申鐃緒申他鐃塾プワ申鐃緒申鐃緒申鐃舜のデ￥申鐃緒申転鐃緒申鐃緒申鐃叔ル化鐃緒申鐃緒申里忙鐃緒申僂鐃緒申鐃殉わ申鐃緒申鐃淑駕申鐃叔種申鐃緒申鐃処う鐃祝￥申鐃緒申鐃緒申優鐃熟ワ申鐃緒申鐃緒申鐃緒申鐃術随申鐃叔もグ鐃緒申鐃緒申鐃出ワ申鐃術随申鐃叔わ申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�
chan qname = [16] of { short }
鐃遵記鐃緒申 short 鐃緒申鐃塾ワ申奪鐃緒申鐃緒申鐃緒申鐃� 16 鐃緒申鐃楯誌申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃緒申鐃緒申優鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃緒申鐃緒申鐃粛ワ申鐃縮常申鐃緒申魯鐃緒申鐃粛ワ申鐃緒申未鐃緒申鐃渋常申離廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申辰鐃緒申蝓�鐃竣ワ申鐃緒申鐃緒申鐃塾ワ申鐃藷スワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾パワ申瓠種申鐃緒申箸鐃緒申鐃緒申呂鐃緒申鐃緒申蠅刻申襪鰹申箸鐃緒申任鐃緒申泙鐃緒申鐃緒申發件申鐃緒申離鐃緒申鐃粛ワ申任鐃緒申鐃所さ鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申劼箸聴幣鐃塾フワ申鐃緒申鐃緒申匹鐃緒申鐃縦常申鐃緒申鐃緒申鐃緒申楼焚鐃緒申里茲�鐃祝なわ申泙鐃緒申鐃�
chan qname = [16] of { byte, int, chan, byte }
鐃緒申鐃塾とわ申鐃緒申鐃塾ワ申鐃緒申優鐃熟￥申鐃緒申鐃曙ぞ鐃緒申 2 鐃縦わ申 8 bit鐃緒申鐃粛￥申1 鐃縦わ申 32 bit鐃緒申鐃粛￥申鐃緒申鐃緒申優鐃緒申名鐃緒申鐃緒申鐃縦ワ申奪鐃緒申鐃緒申鐃緒申鐃� 16 鐃緒申鐃楯誌申鐃緒申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申
鐃緒申鐃緒申文鐃緒申
qname!expr
鐃熟￥申鐃緒申 expr 鐃緒申鐃粛わ申綉�鐃緒申鐃緒申悩鐃獣わ申鐃緒申鐃緒申優鐃� qname 鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申優鐃塾（ワ申鐃遵ー鐃塾￥申鐃緒申鐃緒申鐃祝わ申鐃緒申鐃粛わ申鐃宿加わ申鐃殉わ申鐃緒申
qname?msg
鐃緒申鐃淑醐申蓮鐃緒申鐃緒申鐃粛ワ申鐃緒申鐃銃�鐃緒申鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申竸鐃� msg 鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申優鐃緒申 first-in-first-out 鐃緒申妊鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申箸蠅件申泙鐃緒申鐃緒申綉�鐃塾ワ申鐃緒申鐃緒申鐃叔はひとつわ申鐃粛わ申鐃緒申鐃緒申優鐃緒申鐃縮わ申鐃銃わ申鐃夙りさ鐃緒申討泙鐃緒申鐃緒申發件申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃夙わ申 2 鐃縦以常申鐃緒申佑鐃緒申鐃夙りし鐃緒申鐃緒申鐃緒申鐃熟￥申鐃緒申鐃緒申鐃塾よう鐃祝ワ申鐃緒申泙廼鐃緒申擇辰鐃緒申螢刻申箸鐃緒申鐃緒申優鐃緒申続鐃緒申鐃緒申鐃述わ申鐃殉わ申鐃緒申
qname!expr1,expr2,expr3 qname?var1,var2,var3
鐃緒申鐃緒申優鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申離僖鐃潤ー鐃緒申鐃緒申多鐃緒申鐃獣わ申鐃所、鐃緒申鐃淑わ申鐃獣わ申鐃所し鐃緒申鐃緒申鐃熟ワ申鐃初ー鐃夙なわ申泙鐃緒申鐃�
鐃舜居申鐃塾わ申鐃潤、鐃緒申奪鐃緒申鐃緒申鐃緒申虜能鐃塾フワ申鐃緒申鐃緒申匹呂茲�鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申廚鐃宿緒申鐃緒申鐃緒申鐃祝使わ申鐃殉わ申鐃淑つまり、鐃緒申鐃緒申鐃緒申箸鐃緒申鐃緒申鐃緒申多鐃緒申鐃塾でわ申鐃祝￥申鐃緒申鐃塾よう鐃淑常申鐃緒申鐃縮の緒申鐃緒申鐃夙わ申鐃銃￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾パワ申瓠種申鐃緒申髻▲鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃竣わ申続鐃緒申鐃緒申未任鐃緒申鐃緒申辰謄鐃獣ワ申鐃緒申鐃緒申鐃春ワ申鐃緒申鐃緒申匹離螢刻申箸鐃渋鰹申鐃緒申襪鰹申箸鐃緒申鐃緒申鐃殉わ申鐃緒申
qname!expr1(expr2,expr3) qname?var1(var2,var3)
鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申蓮鐃緒申鐃緒申鐃粛ルが鐃緒申鐃獣ぱわ申鐃叔なわ申鐃夙わ申鐃渋行駕申能鐃夙なわ申泙鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申麓鐃緒申鐃緒申鐃緒申茲�鐃夙わ申鐃銃わ申鐃緒申鐃緒申鐃粛ルが鐃緒申鐃叔なわ申鐃夙わ申鐃渋行駕申能鐃夙なわ申泙鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申離僖鐃潤ー鐃緒申鐃塾わ申鐃緒申鐃縦わ申鐃緒申鐃緒申鐃緒申箸鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�
qname?cons1,var2,cons2
鐃緒申鐃塾常申隋�鐃緒申鐃緒申濃鐃緒申蠅件申鐃緒申鐃緒申戮討離鐃獣ワ申鐃緒申鐃緒申鐃春ワ申鐃緒申鐃緒申匹鐃緒申佑鐃緒申鐃緒申鐃粛ワ申鐃緒申鐃銃�鐃塾ワ申奪鐃緒申鐃緒申鐃緒申醗鐃緒申廚鐃緒申鐃緒申隋�鐃緒申鐃緒申鐃緒申鐃熟実行駕申能鐃夙なわ申泙鐃緒申鐃緒申鐃緒申鐃緒申屬鐃緒申砲覆鐃殉わ申鐃緒申鐃緒申鐃渋刻申鐃峻駕申能鐃叔わ申鐃獣わ申鐃夙わ申鐃銃わ申覆砲皸�鐃緒申鐃緒申鐃熟わ申鐃緒申鐃殉わ申鐃藷。プワ申鐃緒申鐃緒申鐃熟わ申鐃緒申文鐃緒申鐃渋行駕申能鐃祝なわ申泙妊屮鐃緒申奪鐃緒申鐃緒申鐃暑か鐃緒申他鐃塾実行駕申能鐃緒申文鐃緒申孫圓鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申鐃祝わ申鐃殉まで紹介しわ申鐃緒申鐃緒申鐃縦わ申鐃塾居申鐃緒申鐃緒申箸辰鐃緒申鐃薯示わ申鐃殉わ申鐃順う鐃緒申
proctype A(chan q1)
{ chan q2;
q1?q2;
q2!123
}
proctype B(chan qforb)
{ int x;
qforb?x;
printf("x = %d\n", x)
}
init {
chan qname = [1] of { chan };
chan qforb = [1] of { int };
run A(qname);
run B(qforb);
qname!qforb
}
鐃竣ワ申鐃夙わ申鐃緒申鐃緒申佑蓮鐃�123 鐃夙なわ申泙鐃緒申鐃�
鐃緒申鐃緒申僂澆隆愎鐃� len(qname) 鐃熟パワ申瓠種申鐃緒申鐃緒申呂鐃緒申鐃縮常申鐃緒申鐃緒申張鐃緒申鐃粛ワ申妨鐃緒申鐃緒申鐃渋醐申鐃緒申鐃銃わ申鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃塾随申鐃緒申鐃瞬わ申鐃殉わ申鐃緒申鐃盾し鐃緒申鐃緒申文鐃塾縁申鐃春ではなわ申単鐃祝ひとつわ申文鐃夙わ申鐃銃使わ申譴随申鐃順、鐃緒申鐃緒申優襪�鐃緒申鐃塾常申鐃熟実刻申鐃峻駕申能鐃祝なわ申鐃緒申鐃緒申鐃緒申佞鐃緒申討鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申覆鐃緒申覆蕁�鐃緒申鐃塾常申鐃緒申 0 鐃緒申鐃瞬わ申鐃緒申鐃緒申鐃緒申砲鐃所そ鐃緒申楼鐃緒申的鐃祝実刻申鐃峻駕申能鐃夙なるか鐃緒申任鐃緒申鐃緒申泙鐃緒申鐃�
(qname?var == 0) /* syntax error */
鐃殉わ申鐃緒申
(a > b && qname!123) /* syntax error */
鐃塾よう鐃祝￥申Promela 鐃叔は常申鐃淑醐申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申箸濆鐃緒せ鐃暑こ鐃夙はでわ申鐃殉わ申鐃緒申覆鐃緒申里茲�鐃淑常申鐃淑醐申鐃緒申鐃緒申鐃緒申僂覆鐃緒申砲鐃宿常申鐃緒申任鐃緒申覆鐃緒申鐃緒申鐃緒申鐃緒申佞鐃緒申討鐃緒申鐃緒申鐃緒申鐃緒申法鐃緒申綉�鐃塾よう鐃淑種申鐃緒申文鐃緒申鐃緒申鐃緒申法鐃�? 鐃塾わ申鐃緒申鐃緒申鐃緒申 [] 鐃緒申箸鐃緒申鐃緒申箸鐃緒申任鐃緒申泙鐃緒申鐃�
qname?[ack,var]
鐃緒申鐃緒申文鐃熟￥申鐃緒申鐃淑醐申箸鐃緒申鐃宿常申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃盾し鐃淑駕申鐃緒申文鐃緒申鐃渋行駕申能鐃緒申鐃獣わ申鐃緒申鐃�qname 鐃緒申鐃緒申優鐃緒申鐃緒申頭鐃緒申 ack 鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申辰鐃緒申鐃祝￥申1 鐃緒申鐃瞬わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃叔なわ申鐃緒申弌鐃�0 鐃緒申鐃瞬わ申鐃殉わ申鐃緒申
qname?ack,var
鐃淑駕申鐃緒申文鐃熟￥申鐃緒申鐃緒申鐃叔わ申鐃暑か鐃宿わ申鐃緒申評鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申茲件申銅鐃緒申鐃緒申鐃緒申覆鐃緒申鐃緒申鐃緒申鐃緒申僂里覆鐃淑醐申任鐃緒申鐃�
qname?[ack,var]
鐃淑駕申鐃塾よう鐃緒申 non-atomic 鐃淑ワ申鐃緒申鐃緒申鐃藷スわ申鐃緒申鐃春わ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申
(len(qname) < MAX) -> qname!msgtype
鐃殉わ申鐃緒申
qname?[msgtype] -> qname?msgtype
鐃緒申鐃緒申鐃緒申文鐃熟￥申2 鐃緒申鐃旬わ申文鐃緒申鐃述とわ申鐃旬わ申文鐃塾わ申鐃夙わ申必鐃緒申鐃渋行わ申鐃緒申鐃夙は限わ申泙鐃緒申鐃淑ｏ申鐃緒申離廛鐃緒申鐃緒申鐃緒申屬廼鐃粛�鐃緒申鐃緒申鐃緒申鐃粛ワ申縫鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃熟レー鐃緒申鐃緒申鐃緒申妊鐃緒申鐃緒申鐃緒申存鐃淳わ申鐃暑か鐃盾し鐃緒申泙鐃緒申鵝�最緒申離鐃緒申鐃緒申鐃緒申任蓮鐃緒申鐃緒申離廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃粛ルが鐃緒申鐃獣ぱわ申鐃叔はなわ申鐃夙件申鐃所し鐃緒申直鐃緒申鐃渋常申離廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申離鐃緒申鐃粛ワ申悒鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申泙鐃緒申鐃�2 鐃緒申鐃旬のワ申鐃緒申鐃緒申鐃熟￥申鐃緒申鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃渋醐申澆鐃緒申認鐃緒申鐃緒申直鐃緒申法鐃渋常申離廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申離鐃獣ワ申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申襪鰹申箸鐃緒申任鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申鐃殉ではワ申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃粛ワ申鐃署しわ申鐃緒申同鐃緒申鐃縮随申鐃祝つわ申鐃銃醐申鐃銃わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申 N 鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃夙わ申鐃緒申函鐃緒申丱奪侫鐃緒申鐃緒申鐃緒申鐃� N 鐃塾ワ申鐃緒申優鐃緒申焚鐃緒申里茲�鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃緒申鐃�
chan qname = [N] of { byte }
鐃緒申鐃塾とわ申鐃緒申鐃緒申鐃緒申的鐃祝は以駕申鐃塾よう鐃緒申鐃緒申鐃緒申鐃叔э申鐃緒申鐃殉わ申鐃緒申
chan port = [0] of { byte }
鐃緒申鐃緒申蓮鐃�byte 鐃緒申奪鐃緒申鐃緒申鐃緒申劼箸弔鐃緒申鐃夙りす鐃緒申鐃緒申妊屮檗鐃緒申箸鐃緒申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃緒申鐃緒申鐃緒申優鐃塾ワ申鐃緒申鐃緒申鐃緒申 0 鐃叔わ申鐃緒申箸鐃緒申鐃緒申鐃緒申箸蓮鐃緒申鐃緒申鐃�鐃楯￥申鐃緒申鐃熟ワ申奪鐃緒申鐃緒申鐃緒申鐃緒申飮鐃緒申鐃緒申討鐃緒申鐃緒申鐃緒申呂任鐃緒申泙鐃緒申鵝�わ申鐃塾よう鐃淑ワ申鐃叔ブポ￥申鐃夙わ申陲靴討離鐃獣ワ申鐃緒申鐃緒申鐃塾わ申鐃緒申鐃緒申同鐃緒申鐃祝なわ申泙鐃緒申鐃緒申弔鐃緒申里茲�鐃緒申鐃緒申鐃粛わ申鐃銃みまわ申鐃順う鐃緒申
#define msgtype 33
chan name = [0] of { byte, byte };
proctype A()
{ name!msgtype(124);
name!msgtype(121)
}
proctype B()
{ byte state;
name?msgtype(state)
}
init
{ atomic { run A(); run B() }
}
鐃緒申鐃緒申優鐃� name 鐃熟ワ申鐃緒申鐃緒申鐃出ワ申淵鐃緒申妊屮檗鐃緒申箸箸鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃�2 鐃縦のプワ申鐃緒申鐃緒申鐃熟最緒申鐃淑醐申鐃銃縁申鐃緒申鐃緒申銅孫圓鐃緒申泙鐃緒申鐃�msgtype 鐃祝わ申鐃熟ワ申疋鐃緒申鐃緒申鐃緒申鐃緒申砲鐃所、124 鐃緒申 B 鐃塾ワ申鐃緒申鐃緒申鐃緒申鐃術随申 state 鐃緒申転鐃緒申鐃緒申鐃緒申泙鐃緒申鐃�A 鐃緒申 2 鐃緒申鐃旬わ申文鐃熟実行でわ申鐃殉わ申鐃藷、なわ申鐃淑わ申廛鐃緒申鐃緒申鐃� B 鐃祝わ申鐃緒申鐃緒申弍鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申遒�鐃淑わ申鐃緒申鐃緒申任鐃緒申鐃�
鐃盾し鐃緒申鐃緒申優鐃� name 鐃緒申 0 鐃叔はなわ申鐃出ッフワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃緒申函鐃緒申鐃緒申鐃緒申颪い楼曚覆鐃殉わ申鐃緒申鐃出ッフワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃淑わ申鐃夙わ申 2 鐃緒申鐃緒申弌鐃緒申廛鐃緒申鐃緒申鐃� B 鐃緒申鐃緒申鐃緒申鐃緒申鐃夙わ申鐃緒申鐃緒申鐃叔わ申鐃獣わ申鐃夙わ申鐃銃わ申廛鐃緒申鐃緒申鐃� A 鐃熟実行わ申了鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃緒申任鐃緒申腓�鐃緒申鐃出ッフワ申鐃緒申鐃緒申鐃緒申鐃緒申 1 鐃塾常申鐃熟￥申鐃緒申鐃塾よう鐃淑ワ申鐃緒申鐃緒申鐃藷スとなわ申任鐃緒申腓�鐃緒申鐃竣ワ申鐃緒申鐃緒申 A 鐃緒申鐃叔緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃峻っわ申鐃遵、2 鐃緒申鐃旬わ申鐃緒申鐃緒申鐃緒申鐃叔ワ申鐃緒申優襪�鐃春ワ申里鐃緒申鐃瞬ワ申鐃獣ワ申鐃緒申鐃緒申泙鐃緒申鐃渋鰹申鐃緒申董鐃緒申廛鐃緒申鐃緒申鐃� B 鐃緒申鐃叔緒申離鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申了鐃緒申鐃緒申妊廛鐃緒申鐃緒申鐃� A 鐃熟再び実行駕申能鐃夙なり、鐃宿のプワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申覆鐃粛省�鐃淑ワ申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃�
鐃緒申鐃叔ワ申鐃縮随申鐃熟￥申2 鐃峻間で行わ申鐃殉わ申鐃緒申鐃緒申鐃叔ワ申鐃縮随申鐃祝わ申鐃銃縁申鐃緒申鐃緒申箸鐃緒申里蓮鐃緒申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申伴鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申鐃� 2 鐃縦のプワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔わ申鐃緒申鐃緒申半鐃叔はワ申鐃殉フワ申鐃塾刻申鐃循わ申鐃暑た鐃緒申砲鐃緒申離鐃緒申妊鐃緒申命鐃緒申鐃緒申鐃緒申僂鐃緒申鐃緒申鐃薯見まわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃祝￥申鐃緒申鐃塾�鐃緒申鐃緒申鐃緒申鐃淑わ申鐃緒申鐃縦わ申鐃緒申鐃緒申鐃醇構造鐃祝つわ申鐃銃紹介しわ申鐃緒申鐃夙思わ申鐃殉わ申鐃緒申
鐃緒申鐃緒申泙任法鐃淑醐申鐃熟�鐃暑、鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃渋行実行￥申鐃緒申鐃夙ミッワ申鐃緒申鐃緒申鐃緒申鐃藷スわ申 3 鐃縦わ申鐃緒申鐃醇構造鐃薯見てわ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔は￥申鐃緒申鐃緒申鐃� Promela 鐃叔とりあ鐃緒申鐃緒申戮鐃� 3 鐃縦わ申鐃緒申鐃醇構造鐃祝つわ申鐃銃紹介しまわ申鐃緒申鐃緒申鐃緒申反鐃緒申鐃緒申無鐃緒申錺醐申鐃緒申廚鐃� 3 鐃縦でわ申鐃緒申
鐃叔わ申単鐃緒申聞鐃渋わ申鐃�鐃緒申鐃緒申造鐃叔わ申鐃緒申鐃緒申鐃夙わ申鐃出￥申2 鐃縦わ申鐃術随申 a 鐃緒申 b 鐃塾関件申鐃緒申箸辰鐃� 2 鐃縦のワ申鐃竣ワ申鐃緒申鐃緒申颪�誌申鐃緒申鐃叔わ申鐃殉わ申鐃緒申
if :: (a != b) -> option1 :: (a == b) -> option2 fi
鐃緒申鐃緒申造鐃緒申 2 鐃縦の実行ワ申鐃緒申鐃緒申鐃藷スわ申鐃緒申覆鐃殉わ申鐃緒申鐃緒申鐃曙ぞ鐃緒申鐃銃�鐃祝はワ申鐃緒申鐃緒申 2 鐃縦をおわ申鐃殉わ申鐃緒申鐃所ス鐃夙わ申鐃醇か鐃緒申孫圓鐃緒申鐃暑シ鐃緒申鐃緒申鐃藷スはひとつわ申鐃緒申鐃叔わ申鐃緒申鐃叔緒申鐃淑醐申鐃緒申孫垈鐃叔緒申覆鐃塾のわ申鐃緒申鐃述とつわ申鐃渋行わ申鐃緒申泙鐃緒申鐃緒申能鐃緒申文鐃緒申鐃緒申鐃緒申鐃緒申鐃夙呼ばわ申泙鐃緒申鐃�
鐃遵記鐃緒申鐃緒申任蓮鐃緒申鐃緒申鐃緒申匹鐃緒申鐃渋湘�鐃祝なってわ申鐃殉わ申鐃緒申鐃緒申必鐃緒申鐃緒申鐃盾そ鐃緒申鐃叔なわ申鐃緒申个覆蕕わ申箸鐃緒申鐃緒申錣縁申任呂鐃緒申鐃殉わ申鐃藷。もし鐃述とつ以常申離鐃緒申鐃緒申匹鐃緒申孫垈鐃叔緒申幣鐃順、鐃渋行駕申能鐃淑わ申里里鐃緒申鐃緒申匹離鐃緒申鐃緒申鐃緒申鵐垢鐃緒申孫圓鐃緒申鐃暑か鐃緒申鐃緒申鐃緒申鐃重�鐃叔わ申鐃緒申鐃盾し鐃緒申鐃駿てのワ申鐃緒申鐃宿わ申鐃渋刻申鐃峻駕申能鐃緒申鐃獣わ申鐃緒申隋�鐃竣ワ申鐃緒申鐃緒申鐃熟わ申鐃緒申鐃淑わ申鐃夙わ申劼箸弔離鐃緒申鐃緒申匹鐃緒申鐃緒申鐃叔わ申鐃緒申茲�鐃祝なわ申泙妊屮鐃緒申奪鐃緒申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃宿とわ申鐃銃誌申鐃術でわ申鐃緒申文鐃塾種申鐃緒申鐃緒申鐃緒申造呂鐃緒申鐃殉わ申鐃藷。以駕申鐃祝種申鐃緒申鐃処う鐃祝￥申鐃緒申奪鐃緒申鐃緒申鐃緒申亮鐃緒申鐃緒申鐃緒申鐃書く誌申鐃緒申鐃叔わ申鐃殉わ申鐃緒申
#define a 1
#define b 2
chan ch = [1] of { byte };
proctype A()
{ ch!a
}
proctype B()
{ ch!b
}
proctype C()
{ if
:: ch?a
:: ch?b
fi
}
init
{ atomic { run A(); run B(); run C() }
}
鐃緒申鐃緒申鐃緒申任鐃� 3 鐃縦のプワ申鐃緒申鐃緒申鐃夙ひとつのワ申鐃緒申優鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃緒申廛鐃緒申鐃緒申鐃� C 鐃緒申鐃緒申鐃緒申造鐃塾最緒申離鐃緒申廛鐃緒申鐃緒申魯鐃緒申鐃粛ワ申縫鐃獣ワ申鐃緒申鐃緒申 a鐃淑わ申鐃緒申鐃叔わ申 a 鐃熟マワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃緒申茲�鐃緒申鐃緒申鐃� 1鐃祝わ申鐃殉まわ申鐃夙わ申鐃渋行駕申能鐃祝なわ申泙鐃緒申鐃�2 鐃緒申鐃旬のワ申鐃竣ワ申鐃緒申鐃熟ワ申奪鐃緒申鐃緒申鐃� b鐃緒申a 鐃緒申同鐃粛にわ申鐃緒申鐃緒申鐃緒申鐃祝わ申鐃殉まわ申鐃夙わ申鐃渋行駕申能鐃祝なわ申泙鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申亮孫團鐃緒申圈鐃緒申匹亡悗鐃緒申鐃緒申辰鵬鐃緒申盖�鐃所し鐃銃わ申鐃淑わ申鐃緒申鐃潤、鐃宿わ申鐃緒申離鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃叔緒申鐃緒申呂鐃緒申鐃緒申鐃淑�鐃緒申鐃緒申泙鐃緒申鐃�
鐃淑駕申鐃塾プワ申鐃緒申鐃緒申鐃緒申鐃術随申 count 鐃緒申鐃緒申戮鐃緒申鐃� +1 鐃緒申鐃暑か鐃緒申-1 鐃緒申鐃殉わ申鐃緒申
byte count;
proctype counter()
{
if
:: count = count + 1
:: count = count - 1
fi
}
鐃緒申鐃緒申造鐃緒申鐃緒申鐃緒申的鐃緒申長鐃緒申鐃緒申鐃�反鐃緒申鐃緒申造鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申綉�鐃緒申鐃緒申納鐃緒申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申房鐃緒申辰鐃緒申董鐃緒申竸鐃緒申鐃緒申佑魴�わ申鐃瞬わ申鐃緒申鐃緒申鐃緒申縫鐃緒申奪廛鐃緒申鐃緒申鵑気鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申
byte count;
proctype counter()
{
do
:: count = count + 1
:: count = count - 1
:: (count == 0) -> break
od
}
鐃渋行のわ申鐃俊にひとつのワ申鐃竣ワ申鐃緒申鐃緒申鐃緒申个鐃殉わ申鐃緒申鐃緒申鐃塾ワ申鐃竣ワ申鐃緒申鐃緒申孫圓鐃緒申鐃緒申鐃緒申函鐃緒申鐃緒申旅鐃渋わ申魴�わ申鐃瞬わ申鐃渋行わ申鐃殉わ申鐃緒申反鐃緒申鐃緒申造鐃緒申了鐃緒申鐃緒申砲鐃緒申名鐃� break 文鐃緒申鐃緒申僂鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃叔は￥申鐃緒申鐃緒申鐃術随申 count 鐃緒申鐃粛わ申 0 鐃塾とわ申鐃祝ルー鐃竣わ申鐃緒申抜鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�count 鐃緒申 0 鐃塾とわ申鐃緒申必鐃緒申鐃緒申鐃緒申 break 鐃緒申孫圓鐃緒申鐃緒け鐃叔はなわ申鐃夙わ申鐃緒申鐃緒申鐃夙わ申鐃緒申鐃春わ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申他鐃緒申 2 鐃縦のワ申鐃竣ワ申鐃緒申鐃熟常申房孫垈鐃叔緒申覆里如鐃�count 鐃緒申 0 鐃祝なっわ申鐃緒申鐃緒申箸鐃緒申辰鐃宿�鐃緒申鐃緒申鐃緒申 break 鐃緒申鐃緒申鐃緒け鐃叔はなわ申鐃塾でわ申鐃緒申count 鐃緒申 0 鐃祝なっわ申鐃夙わ申鐃緒申必鐃緒申 break 鐃緒申鐃緒申茲�鐃祝わ申鐃緒申砲蓮鐃緒申焚鐃緒申里茲�鐃祝プワ申鐃緒申鐃緒申鐃緒申鐃術刻申鐃緒申鐃緒申必鐃竣わ申鐃緒申鐃緒申泙鐃緒申鐃�
proctype counter()
{
do
:: (count != 0) ->
if
:: count = count + 1
:: count = count - 1
fi
:: (count == 0) -> break
od
}
鐃暑ー鐃竣わ申鐃緒申抜鐃緒申鐃緒申發�鐃緒申弔鐃緒申鐃祝￥申蓮鐃縮居申鐃緒ジ鐃緒申鐃竣￥申鐃緒申名鐃盾い goto 文鐃緒申鐃緒申鐃緒申僂鐃緒申鐃緒申鐃祝￥申任鐃緒申鐃緒申焚鐃緒申鐃緒申鐃熟￥申0 鐃叔はなわ申 2 鐃縦わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾削申鐃緒申鐃緒申鐃緒申鐃薯見つわ申鐃緒申罅種申鐃緒申鐃獣ドのワ申鐃暑ゴ鐃所ズ鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申里任鐃緒申鐃�
proctype Euclid(int x, y)
{
do
:: (x > y) -> x = x - y
:: (x < y) -> y = y - x
:: (x == y) -> goto done
od;
done:
skip
}
鐃緒申鐃緒申鐃緒申鐃� goto 鐃叔はワ申戰鐃� done 鐃舜ワ申鐃緒申鐃竣わ申鐃殉わ申鐃緒申鐃緒申戰鐃緒申文鐃緒申鐃緒申鐃祝わ申鐃緒申必鐃竣わ申鐃緒申鐃緒申泙鐃緒申鐃緒申綉�鐃叔はプワ申鐃緒申鐃緒申鐃塾最醐申縫鐃緒申鐃緒申廚鐃緒申鐃緒申鐃緒申鐃緒申里任鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申辰鐃緒申鐃緒申鐃緒申鐃緒申任魯鐃緒申漾鐃淑醐申鐃� skip 鐃緒申鐃緒申鐃塾�鐃緒申鐃殉わ申鐃緒申skip 鐃熟わ申鐃縦でわ申孫垈鐃叔緒申焚鐃緒申鐃緒申鐃術わ申擇椶鐃緒申覆鐃淑醐申任鐃緒申鐃緒申泙鐃� goto 鐃熟常申房孫垈鐃叔緒申任鐃緒申鐃�
鐃淑駕申鐃緒申鐃緒申任魯鐃緒申鐃粛ワ申 in 鐃緒申鐃緒申鐃獣てわ申鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃薯そわ申鐃順き鐃緒申鐃祝わ申蠅緒申譴常申鐃� large 鐃緒申鐃緒申優鐃緒申 small 鐃緒申鐃緒申優鐃緒申分鐃循わ申鐃緒申侫鐃緒申襯随申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃緒申鐃殉ワ申鐃緒申鐃祝わ申鐃緒申鐃緒申 N 鐃緒申 128 鐃祝￥申size 鐃緒申 16 鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃緒申
#define N 128
#define size 16
chan in = [size] of { short };
chan large = [size] of { short };
chan small = [size] of { short };
proctype split()
{ short cargo;
do
:: in?cargo ->
if
:: (cargo >= N) ->
large!cargo
:: (cargo < N) ->
small!cargo
fi
od
}
init
{ run split()
}
鐃淑駕申鐃祝種申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申 merge 鐃熟￥申2鐃縦のワ申鐃夙リー鐃緒申鐃銃びひとつにまとわ申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申屬呂鐃夙のわ申里楼曚覆襪鰹申箸砲覆鐃叔わ申鐃順う鐃緒申
proctype merge()
{ short cargo;
do
:: if
:: large?cargo
:: small?cargo
fi;
in!cargo
od
}
鐃盾し init 鐃竣ワ申鐃緒申鐃緒申鐃緒申焚鐃緒申里茲�鐃祝わ申鐃緒申鐃初、split 鐃緒申 merge 鐃竣ワ申鐃緒申鐃緒申鐃熟永縁申鐃緒申鐃緒申鐃渋鰹申鐃緒申鐃叔わ申鐃順う鐃緒申
init
{ in!345; in!12; in!6777;
in!32; in!0;
run split();
run merge()
}
鐃叔醐申鐃緒申鐃熟￥申鐃緒申鐃叔ワ申鐃縮随申鐃緒申箸辰謄鐃緒申鐃緒申鐃緒申鐃緒申肇鐃塾ワ申鐃殉フワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾でわ申鐃緒申
#define p 0
#define v 1
chan sema = [0] of { bit };
proctype dijkstra()
{ byte count = 1;
do
:: (count == 1) ->
sema!p; count = 0
:: (count == 0) ->
sema?v; count = 1
od
}
proctype user()
{ do
:: sema?p;
/* critical section */
sema!v;
/* non-critical section */
od
}
init
{ run dijkstra();
run user();
run user();
run user()
}
鐃緒申鐃殉フワ申鐃熟ワ申鐃緒申謄鐃緒申鐃緒申襯誌申鐃緒申鐃緒申鐃緒申鐃� 2 鐃縦以常申離廛鐃緒申鐃緒申鐃緒申鐃銃縁申鐃緒申砲鐃緒申覆鐃緒申鐃緒申箸鐃緒申歉磴件申討鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃述とつのプワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申謄鐃緒申鐃緒申襯誌申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃重�鐃祝ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃暑こ鐃夙わ申鐃緒申鬚靴討鐃緒申鐃緒申錣縁申任呂鐃緒申鐃殉わ申鐃緒申
鐃緒申続鐃緒申鐃熟￥申鐃緒申鐃夙わ申鐃銃居申的鐃叔も、鐃竣ワ申鐃緒申鐃緒申鐃祝わ申辰謄鐃叔ル化鐃緒申能鐃叔わ申鐃緒申鐃瞬わ申鐃粛はワ申鐃緒申鐃緒申鐃出ワ申鐃術随申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申砲鐃獣て呼び出わ申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃瞬わ申鐃緒申泙鐃緒申鐃緒申焚鐃緒申離廛鐃緒申鐃緒申鐃緒申呂鐃緒申鐃薯示わ申鐃緒申鐃緒申里任鐃緒申鐃�
proctype fact(int n; chan p)
{ chan child = [1] of { int };
int result;
if
:: (n <= 1) -> p!1
:: (n >= 2) ->
run fact(n-1, child);
child?result;
p!n*result
fi
}
init
{ chan child = [1] of { int };
int result;
run fact(7, child);
child?result;
printf("result: %d\n", result)
}
鐃竣ワ申鐃緒申鐃緒申 fact(n, p) 鐃熟￥申n 鐃塾鰹申鐃緒申鐃銃居申的鐃祝計誌申鐃緒申鐃緒申鐃銃プワ申鐃緒申鐃緒申 p 鐃舜ワ申奪鐃緒申鐃緒申鐃緒申砲鐃緒申鐃縮わ申鐃瞬わ申鐃殉わ申鐃緒申
鐃緒申鐃緒申泙任鐃� Promela 鐃叔わ申鐃緒申鐃緒申僂澆鐃淑醐申鐃� 2 鐃縦￥申skip 鐃緒申 break 鐃祝つわ申鐃銃紹介しまわ申鐃緒申鐃緒申鐃盾う鐃述とつわ申鐃緒申鐃緒申僂澆鐃淑醐申鐃� timeout 鐃叔わ申鐃緒申timeout 鐃熟￥申鐃緒申鐃塾ワ申鐃緒申優襪�鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃峻つよう鐃淑￥申鐃処し鐃銃随申鐃祝はなわ申覆鐃緒申鐃緒申鐃緒申圓弔里鐃緒申鐃緒申任鐃緒申襪随申鐃祝つわ申鐃緒申譴随申鐃緒申鐃緒申未幣鐃緒申鐃緒申妊覯緒申鐃緒申鐃緒申鐃塾でわ申鐃緒申timeout 鐃緒申鐃緒申鐃緒ー鐃宿は￥申鐃緒申鐃緒申鐃銃ムが鐃熟ングわ申鐃緒申鐃緒申鐃瞬わ申鐃緒申鐃獣�鐃出わ申 Promela 鐃叔ワ申妊覯緒申鐃緒申襪随申鐃塾わ申里任鐃緒申鐃�timeout 鐃緒申鐃熟￥申分鐃緒申鐃緒申鐃緒申鐃銃ワ申鐃緒申鐃渋常申里鐃緒申戮討鐃淑醐申鐃緒申孫鐃緒申垈鐃叔緒申砲覆辰鐃緒申箸鐃緒申某鐃緒申砲覆鐃殉わ申鐃緒申鐃緒申鐃緒申的鐃淑ワ申鐃緒申鐃淳ングわ申鐃塾醐申砲鐃緒申鐃銃わ申鐃淑わ申鐃緒申鐃夙わ申鐃緒申鐃春わ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申聾鐃緒申攤鐃夙にわ申鐃緒申鐃銃極わ申峠鐃緒申廚覆鐃緒申箸任鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃� timeout 鐃緒申鐃宿のよう鐃祝種申鐃緒申鐃緒申鐃緒申鐃駿わ申鐃緒申鐃祝つわ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃藷。以駕申鐃祝￥申鐃緒申鐃緒申鐃銃ムが鐃峻わ申鐃粛まっわ申鐃夙わ申鐃祝はわ申鐃縦でわ申 guard 鐃緒申鐃緒申優鐃緒申 reset 鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鮗┐鐃緒申泙鐃緒申鐃�
proctype watchdog()
{
do
:: timeout -> guard!reset
od
}
Promela 鐃緒申多鐃緒申鐃緒申鐃緒申鐃緒申必鐃竣な緒申鐃竣なもう鐃述とつの醐申鐃曙構鐃緒申鐃緒申鐃叔わ申 assert 文鐃叔わ申鐃緒申鐃緒申鐃緒申文鐃熟以駕申鐃塾件申鐃緒申鐃緒申箸鐃殉わ申鐃緒申
assert(any_boolean_condition)
assert 鐃熟わ申鐃縦でわ申孫垈鐃叔緒申任鐃緒申鐃緒申發件申鐃緒が鐃緒申鐃緒申鐃緒申鐃曙た鐃淑わ申弌鐃緒申鐃緒申鐃淑醐申呂覆砲鐃緒申鐃術わ申擇椶鐃緒申泙鐃緒申鵝�わ申鐃緒申鐃緒申鐃緒申鐃盾し鐃緒申錣�鐃緒申鐃緒申鐃緒申鐃緒申覆鐃緒申辰鐃緒申蕁�鐃緒申鐃緒申文鐃熟ワ申鐃初ー鐃緒申鐃緒申陲垢鐃叔わ申鐃順う鐃緒申
鐃緒申鐃塾ワ申妊鐃藷グ醐申鐃緒申聾鐃緒申鐃緒申未鐃緒申嘆鐃緒申鐃緒申鐃緒申鐃緒申弔鐃緒申鐃緒申鐃緒申鐃縦э申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃塾よう鐃緒申鐃緒申徴鐃熟￥申鐃緒申鐃曙か鐃緒申鐃緒申鐃緒申砲鐃緒申鐃緒申鐃緒申戰鐃塾使わ申鐃緒申鐃巡、Promela 鐃祝わ申鐃緒申鐃緒申 timeout 文鐃塾逸申味鐃巡、assert 鐃塾よう鐃緒申文鐃塾使わ申鐃緒申鐃祝醐申鐃緒申鐃殉わ申鐃緒申
鐃緒申鐃准醐申鐃緒申箸鐃緒申鐃� Promela 鐃緒申鐃緒申僂鐃緒申鐃緒申鐃熟￥申鐃緒申妊覯緒申鐃緒申鐃緒申鐃緒申鐃緒申颪い砲弔鐃緒申鐃緒申鐃緒申鐃緒申端鐃緒申表鐃緒申鐃緒申鐃叔わ申鐃緒申茲�鐃祝わ申鐃淑わ申鐃緒申个覆鐃殉わ申鐃緒申鐃獣わ申 Promela 鐃祝わ申辰謄妊奪疋鐃緒申奪鐃緒申鐃渋醐申澆鐃緒申鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申蓮鐃緒申鐃緒申撻廛鐃緒申鐃緒申鐃緒申蓮鐃緒申罅種申鐃緒申鐃祝常申鐃叔わ申鐃淑わ申鐃叔ッドワ申鐃獣ワ申鐃緒申鐃縮常申鐃�鐃緒申了鐃緒申鐃緒申鐃緒申分鐃緒申鐃緒申鐃緒申茲�鐃祝わ申鐃淑わ申鐃緒申个覆鐃殉わ申鐃緒申
Promela 鐃叔は￥申鐃緒申鐃藷スワ申鐃藷ス駕申鐃緒申鐃曙た鐃緒申鐃駿てのプワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃緒申廛鐃緒申鐃緒申鐃緒申鐃緒申鐃塾の最醐申泙鐃緒申鐃獣ｏ申鐃緒申鐃緒申鐃緒申帖鐃緒申鐃緒申戮討離鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申優襪�鐃緒申鐃叔わ申鐃緒申鐃緒申屬鐃緒申名鐃塾緒申了鐃緒申鐃瞬と醐申鐃淑わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃駿てのプワ申鐃緒申鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申里虜埜鐃殉わ申鐃緒申達鐃緒申鐃緒申茲�鐃祝ワ申妊覯緒申鐃緒申鐃緒申箸聾造鐃殉わ申鐃緒申鐃純え鐃出￥申鐃緒申鐃緒申鐃縦わ申鐃塾プワ申鐃緒申鐃緒申鐃緒申 IDLE 鐃緒申鐃瞬に居申続鐃緒申鐃暑か鐃盾し鐃緒申泙鐃緒申鵑掘鐃緒申泙鐃緒申鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃熟随申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申亮鐃緒申鐃緒申鐃暑ー鐃竣わ申鐃緒申頭鐃緒申鐃峻わ申続鐃緒申鐃暑か鐃盾し鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申鐃叔￥申鐃緒申鐃准プワ申鐃緒申鐃緒申爐�鐃緒申鐃塾よう鐃淑緒申了鐃緒申鐃瞬とデッドワ申鐃獣ワ申鐃緒申鐃緒申鐃塾に醐申分鐃緒申鐃暑た鐃緒申法鐃�Promela 鐃叔は緒申了鐃緒申鐃瞬ワ申戰鐃緒申箸鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申箸鐃緒申弌鐃緒申鐃緒申劼離廛鐃緒申鐃緒申鐃緒申鐃� dijkstra() 鐃祝ワ申戰鐃緒申劼箸鐃緒申媛辰鐃緒申泙鐃�*3鐃緒申
proctype dijkstra()
{ byte count = 1;
end: do
:: (count == 1) ->
sema!p; count = 0
:: (count == 0) ->
sema?v; count = 1
od
}
end 鐃緒申戰鐃緒申鐃宿加わ申鐃暑こ鐃夙にわ申蝓�鐃竣ワ申鐃緒申鐃緒申鐃緒申 dijkstra() 鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申虜埜鐃塾鰹申未泙鐃緒申鐃獣ｏ申鐃緒申覆鐃緒申討癲�鐃暑ー鐃竣わ申鐃緒申頭鐃祝わ申鐃緒申丱鐃緒申蕁種申箸呂覆鐃殉わ申鐃藷。わ申鐃緒申鐃緒申鵝△鐃緒申里茲�鐃淑常申鐃瞬はデッドワ申鐃獣ワ申鐃緒申鐃瞬の逸申鐃緒申鐃緒申鐃盾し鐃緒申泙鐃緒申鵑�￥申鐃盾し鐃叔ッドワ申鐃獣ワ申鐃緒申鐃殉わ申鐃緒申鐃緒申箸鐃緒申鐃緒申蕁�鐃緒申鐃緒申呂鐃緒申離廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任呂覆鐃緒申任鐃緒申腓�鐃淑もし他鐃塾プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃淑緒申了鐃緒申鐃瞬にわ申鐃淑わ申鐃緒申鐃熟醐申鐃准プワ申鐃緒申鐃緒申爐�鐃緒申陲靴討鐃緒申鐃緒申任鐃緒申腓�鐃祝￥申
鐃述とつの醐申鐃准ワ申妊鐃祝つわ申鐃述とつ以常申僚鐃塾誌申鐃緒申屬鐃緒申鐃緒申襪�鐃盾し鐃緒申泙鐃緒申鵝�もし鐃緒申鐃塾よう鐃淑とわ申鐃熟￥申鐃竣ワ申鐃緒申鐃緒申鐃緒申離鐃駿ワ申鐃縮常申鐃緒申呂鐃緒申戮謄鐃祝￥申鐃緒申鐃祝わ申鐃淑わ申鐃緒申个覆鐃殉わ申鐃藷。まわ申鐃緒申鐃緒申了鐃緒申鐃瞬ワ申戰鐃緒申名鐃緒申鐃熟￥申鐃緒申鐃淑らず end 鐃緒申 3 文鐃緒申鐃緒申鐃緒申呂鐃緒申必鐃竣わ申鐃緒申鐃緒申泙鐃緒申鐃�endde, end0, end_appel 鐃塾よう鐃祝ワ申戰鐃緒申佞鐃緒申鐃緒申譴随申鐃緒申屬聾鐃緒申撻廛鐃緒申鐃緒申鐃緒申砲鐃緒申戮鐃緒申鐃緒申鐃緒申塀鐃塾誌申鐃緒申屬箸鐃緒申動鐃緒申鐃緒申泙鐃緒申鐃�
鐃緒申了鐃緒申鐃瞬ワ申戰鐃緒申同鐃緒申鐃処う鐃祝￥申鐃醇ー鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃曙ス鐃緒申鐃緒申鐃緒申戰鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃塾常申隋�鐃竣ワ申鐃緒申鐃曙ス鐃緒申鐃瞬ワ申戰鐃熟プワ申鐃夙ワ申鐃暑が鐃緒申展鐃緒申鐃淑わ申鐃緒申个覆鐃淑わ申鐃緒申鐃瞬にマ￥申鐃緒申鐃緒申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申鐃竣ワ申鐃夙ワ申鐃緒申亮孫鐃緒申鐃祝わ申鐃緒申鐃竣ワ申鐃緒申鐃曙ス鐃緒申鐃瞬ワ申戰鐃緒申劼箸弔鐃緒申眠瓩件申覆鐃緒申鐃緒申戮討鐃縮居申促鐃緒申鐃緒申鐃緒申鐃熟￥申鐃緒申鐃緒申的鐃祝駕申鐃暑ー鐃竣￥申starvation loop鐃祝になわ申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃夙わ申鐃緒申 dijkstra 鐃緒申鐃緒申任蓮鐃緒申鐃緒申泪侫鐃緒申謄鐃緒申箸鐃緒申鐃緒申鐃緒申鐃� "progress" 鐃夙わ申鐃緒申鐃緒申戰鐃緒申弔鐃緒申鐃緒申鐃緒申撻廛鐃緒申鐃緒申鐃緒申蓮鐃緒申廛鐃緒申肇鐃緒申鐃塾実刻申鐃緒申鐃宿�鐃緒申鐃緒申鐃殉フワ申鐃銃ワ申鐃夙わ申鐃緒申鐃緒申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申襪鰹申箸鐃緒申認鐃緒申鐃銃わ申鐃緒申泙鐃緒申鐃�
proctype dijkstra()
{ byte count = 1;
end: do
:: (count == 1) ->
progress: sema!p; count = 0
:: (count == 0) ->
sema?v; count = 1
od
}
鐃盾し鐃述とつ以常申両鐃緒申屬縫廛鐃緒申鐃緒申譽刻申鐃駿ワ申鐃縦わ申鐃緒申鐃緒申蓮鐃�progress0, progress_foo 鐃塾よう鐃緒申 progress 鐃緒申鐃緒申呂泙鐃緒申法鐃緒申鐃緒申鐃縮常申鐃緒申離鐃駿ワ申鐃縦わ申鐃緒申必鐃竣わ申鐃緒申鐃緒申泙鐃緒申鐃�
-a 鐃春ラグ鐃緒申鐃緒申蠅件申鐃� Spin 鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃准プワ申鐃緒申鐃緒申鐃熟ワ申鵐織鐃緒申爛�鐃竣ワ申鐃緒申鐃� -l 鐃薯サポ￥申鐃夙わ申鐃殉わ申鐃緒申鐃緒申鐃准プワ申鐃緒申鐃緒申鐃熟￥申鐃叔フワ申鐃緒申箸任呂泙鐃緒申妊奪疋鐃緒申奪鐃緒申鐃獣居申鐃緒申鐃峻わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃塾フラグ鐃緒申鐃緒申蠅件申鐃緒申鐃緒申撻廛鐃緒申鐃緒申鐃緒申鐃� non-progress 鐃暑ー鐃竣わ申探鐃緒申鐃緒申圓鐃緒申泙鐃緒申鐃緒申鐃緒申鐃獣居申鐃緒申魯妊奪疋鐃緒申奪鐃緒申鐃獣居申鐃緒申鐃緒申鐃緒申鐃緒申 2 鐃旬の誌申鐃瞬とワ申鐃緒申鐃緒申鐃緒申未鐃緒申廚鐃緒申泙鐃緒申鐃宿醐申鐃塾種申法鐃緒申鐃出わ申鐃緒申鐃緒申鐃緒申鐃淑駕申鐃宿は￥申鐃緒申連鐃緒申鐃緒申分鐃緒申鐃熟わ申鐃緒申廚箸鐃緒申討鐃緒申泙鐃緒申法鐃�
鐃緒申鐃殉までは￥申鐃宿のよう鐃緒申鐃術随申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾わ申鐃緒申鐃殉わ申鐃緒申C 鐃緒申鐃緒申鐃緒申鐃緒申離泪鐃緒申鐃緒申鐃夙ってどのよう鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申里鐃緒申鐃緒申鮓�てわ申鐃殉わ申鐃緒申鐃緒申Promela 鐃熟ワ申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申廚鐃緒申鐃緒申鐃塾わ申鐃緒申飽焚鐃緒申里茲�鐃緒申鐃緒申鐃緒申鐃叔э申鐃銃わ申鐃殉わ申鐃緒申
mtype = { ack, nak, err, next, accept }
鐃緒申鐃緒申鐃緒申法鐃熟￥申鐃緒申鐃曙ぞ鐃緒申鐃�鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃�鐃祝実際にどわ申鐃緒申鐃獣わ申鐃粛わ申鐃緒申僂鐃緒申襪�鐃夙わ申鐃緒申鐃緒申鐃夙わ申鐃緒申櫃鐃緒申討鐃緒申鐃緒申鐃緒申任鐃所好鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃緒申鐃緒申鐃緒申名鐃緒申鐃熟わ申鐃塾まま醐申鐃准プワ申鐃緒申鐃緒申鐃緒申鐃緒申濃鐃緒申僂鐃緒申鐃緒申鐃緒申鐃叔わ申鐃暑た鐃潤、鐃緒申鐃初ー鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申
鐃緒申鐃緒申優鐃緒申鐃緒申鐃緒申砲鐃緒申鐃緒申鐃� mtype 鐃緒申鐃緒申鐃緒ー鐃宿わ申鐃緒申僂鐃緒申鐃緒申鐃祝わ申蝓�鐃出縁申鐃緒申鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃春ワ申鐃緒申鐃緒申匹鐃緒申鐃粛とわ申鐃銃ではなわ申鐃緒申鐃緒申鐃緒申箸鐃緒申動鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申磴�鐃出￥申鐃淑駕申鐃塾よう鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�
chan q = [4] of { mtype, mtype, bit, short };
鐃緒申鐃緒申鐃殉では￥申Promela 鐃緒申鐃緒申鐃緒申鐃緒申鐃暑す鐃駿ての器申鐃緒申文鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申錙�鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申assert鐃緒申timeout鐃緒申goto鐃緒申break鐃緒申skip鐃祝を見てわ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃銃￥申文鐃叔わ申鐃緒申泙鐃緒申鐃� chan, len, run 鐃夙わ申鐃獣わ申鐃緒申鐃淑醐申鐃緒申鐃緒申鐃淑醐申濃鐃緒申僂鐃緒申鐃緒申鐃緒申鐃叔わ申鐃緒申単鐃緒申藥誌申劼砲弔鐃緒申討盡�鐃銃わ申鐃殉わ申鐃緒申鐃緒申
skip 文鐃熟￥申鐃渋際にはまっわ申鐃緒申鐃緒申鐃術わ申擇椶鐃緒申覆鐃緒申鐃緒申鐃淑醐申鐃緒申弋鐃緒申鐃緒申鐃緒申鐃緒申鐃塾にフワ申鐃暑タ鐃緒申鐃緒申鐃緒申未鐃緒申鐃淑醐申箸鐃緒申鴇匆陲靴泙鐃緒申鐃緒申鐃�skip 鐃熟件申鐃緒申的鐃祝は醐申鐃緒申琉鐃緒申鐃緒申任呂覆鐃緒申里任鐃緒申鐃緒申鐃獣縁申鐃� 鐃緒申鐃� (1) 鐃夙書いわ申単鐃緒申幣鐃緒申文鐃緒申同鐃緒申鐃緒申鐃縮わ申鐃緒申同鐃緒申鐃緒申任鐃緒申蝓�鐃緒申文鐃叔わ申鐃緒申同鐃緒申鐃処う鐃淑居申文鐃祝￥申(0) 鐃緒申鐃緒申鐃緒申鐃緒申 block 鐃緒申 hang鐃緒申assert(0) 鐃緒申鐃緒申鐃緒申鐃緒申 halt 鐃緒申鐃粛わ申鐃緒申鐃殉わ申鐃淑実際にはわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃緒申法鐃�else 鐃熟もう鐃述とつの居申文鐃叔わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申反鐃緒申鐃緒申鐃緒申悩埜鐃塾ワ申鐃竣ワ申鐃緒申鵐掘鐃緒申鐃緒申鵐垢鐃淑醐申箸鐃緒申道鐃緒申僂鐃緒申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申
if :: a > b -> ... :: else -> ... fi
else 鐃緒申同鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申他鐃塾わ申鐃駿てのワ申鐃竣ワ申鐃緒申鵑�実刻申鐃峻駕申能鐃淑とわ申鐃祝わ申鐃緒申鐃渋行駕申能鐃祝なわ申泙鐃緒申鐃�
Promela 鐃叔ワ申妊覯緒申鐃緒申鐃獣縁申鐃淑（件申戮里鐃緒申鐃祝プワ申鐃夙ワ申鐃緒申鐃緒申鐃薯示わ申鐃殉わ申鐃緒申
mtype = { ack, nak, err, next, accept };
proctype transfer(chan in,out,chin,chout)
{ byte o, i;
in?next(o);
do
:: chin?nak(i) ->
out!accept(i);
chout!ack(o)
:: chin?ack(i) ->
out!accept(i);
in?next(o);
chout!ack(o)
:: chin?err(i) ->
chout!nak(o)
od
}
init
{ chan AtoB = [1] of { mtype, byte };
chan BtoA = [1] of { mtype, byte };
chan Ain = [2] of { mtype, byte };
chan Bin = [2] of { mtype, byte };
chan Aout = [2] of { mtype, byte };
chan Bout = [2] of { mtype, byte };
atomic {
run transfer(Ain,Aout, AtoB,BtoA);
run transfer(Bin,Bout, BtoA,AtoB)
};
AtoB!err(0)
}
鐃緒申鐃緒申優鐃� Ain 鐃緒申 Bin 鐃熟￥申鐃緒申鐃緒申鐃叔わ申鐃緒申鐃緒申鐃緒申討鐃緒申覆鐃緒申丱奪鐃緒申鐃緒申鐃緒申疋廛鐃緒申鐃緒申鐃緒申覆鐃緒申鐃重常申鐃緒申鐃緒申鐃緒申謄鐃塾ユー鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃祝にわ申辰董鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申 next 鐃緒申任鐃春わ申鐃粛￥申ASCII鐃緒申文鐃緒申鐃緒申鐃緒申鐃宿）のト￥申鐃緒申鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申同鐃粛に￥申鐃醇ー鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃熟￥申鐃緒申鐃緒申優鐃� Aout, Bout 鐃緒申鐃緒申如鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申鐃粛ワ申肇廛鐃緒申鐃緒申鐃緒申蓮鐃緒申鐃緒申肇潺奪鐃緒申暴鐃緒申鐃緒申鐃緒申鐃曙、鐃緒申鐃淳￥申鐃緒申 err 鐃緒申奪鐃緒申鐃緒申鐃緒申砲鐃所ス鐃緒申鐃緒申鐃夙わ申鐃殉わ申鐃緒申
Promela 鐃叔居申鐃述わ申鐃緒申鐃緒申鐃緒申鐃銃ワ申離鐃叔ルが与鐃緒申鐃緒申譴随申箸鐃緒申鐃�Spin 鐃熟ワ申鐃緒申鐃銃ワ申離鐃緒申鐃緒申爛件申潺鐃曙ー鐃緒申鐃緒申鐃薯しわ申鐃所、鐃緒申鐃緒申鐃銃ワ申両鐃緒申峩鐃緒申屬鐃緒申鐃緒申瓩�探鐃緒申鐃緒申鐃緒申 C 鐃緒申鐃緒申慮鐃緒申撻廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申蠅刻申襪鰹申箸鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申慮鐃緒申撻廛鐃緒申鐃緒申鐃緒申蓮鐃緒申鐃緒申箸鐃緒申弌鐃緒申廛鐃緒申肇鐃緒申鐃緒申孫鐃緒申罅�鐃醇ー鐃緒申鐃緒申鐃緒申鐃述わ申鐃緒申鐃緒申鐃緒申鐃銃ワ申鐃緒申鐃緒申兢鐃緒申鐃緒申反鐃緒申鐃銃わ申鐃淑わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃獣ワ申鐃緒申鐃殉わ申鐃緒申
鐃緒申鐃盾オ鐃竣ワ申鐃緒申鐃緒申鐃緒申蠅件申覆鐃緒申鐃� Spin 鐃緒申動鐃緒申鐃緒申鐃緒申鐃熟￥申鐃緒申鐃緒申鐃準シ鐃淳ワ申譟種申鐃緒申鐃緒申鐃峻わ申鐃殉わ申鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃� -n N 鐃緒申鐃緒申蠅件申鐃緒申鐃緒申蓮鐃緒申鐃緒申鐃緒申爛件申潺鐃曙ー鐃緒申鐃緒申鐃塾わ申鐃緒申亮鐃緒申鐃緒申鐃緒申 N 鐃緒申鐃緒申鐃所し鐃殉わ申鐃緒申
鐃緒申鐃竣ワ申鐃緒申鐃� pglrs 鐃熟￥申鐃醇ー鐃緒申鐃緒申鐃緒申鐃淳ワ申譟種申鐃緒申鐃緒申砲弔鐃緒申峠鐃緒申呂鐃緒申鐃緒申鐃緒申鐃緒申鐃塾ワ申戰鐃緒申鐃緒申鐃所す鐃緒申里忙鐃緒申僂鐃緒申泙鐃緒申鐃緒申鐃緒申呂里鐃緒申戮討旅圓蓮鐃緒申名鐃緒申妊鐃塾ワ申鐃緒申鐃緒申鐃塾刻申鐃瞬刻申悗了鐃緒申箸鐃殉みまわ申鐃緒申
-p 鐃熟￥申鐃緒申鐃駿てのワ申鐃銃ップわ申鐃出わ申鐃緒申 Promela 鐃竣ワ申鐃緒申鐃緒申鐃塾常申鐃緒申鐃術駕申鐃緒申表鐃緒申鐃緒申鐃殉わ申鐃緒申
-g 鐃熟￥申鐃緒申鐃駿てのワ申鐃銃ップわ申鐃出わ申鐃銃わ申鐃塾とわ申鐃塾ワ申鐃緒申鐃緒申鐃出ワ申鐃術随申鐃緒申鐃粛わ申表鐃緒申鐃緒申鐃殉わ申鐃緒申
-l 鐃熟￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃術随申鐃緒申鐃縦プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃術駕申鐃緒申鐃緒申鐃緒申鐃夙のワ申鐃緒申鐃緒申鐃緒申鐃術随申鐃緒申鐃粛わ申表鐃緒申鐃緒申鐃殉わ申鐃緒申-p 鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃夙み刻申錣誌申道箸鐃緒申箸鐃緒申鐃緒申任鐃緒申腓�鐃緒申
-r 鐃熟わ申鐃駿てのワ申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申戰鐃夙わ申表鐃緒申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申麓鐃緒申鐃緒申鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申鐃縮常申鐃緒申鐃緒申峭罅�鐃緒申鐃緒申鐃緒申鐃塾刻申鐃瞬号、鐃緒申奪鐃緒申鐃緒申鐃緒申離僖鐃潤ー鐃緒申鐃瞬刻申淵僖鐃潤ー鐃緒申鐃緒申鐃夙わ申 1 鐃峻になわ申泙鐃緒申法鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃竣とワ申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃粛ワ申鐃縮常申鐃緒申鐃緒申峭鐃緒申表鐃緒申鐃緒申鐃殉わ申鐃緒申
-s 鐃熟わ申鐃駿てのワ申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申戰鐃夙わ申表鐃緒申鐃緒申鐃殉わ申鐃緒申
Spin 鐃叔はわ申鐃緒申鐃� 3 鐃縦のワ申鐃竣ワ申鐃緒申鐃緒申-a鐃緒申-m鐃緒申-t鐃祝わ申鐃緒申僂鐃緒申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申
-a 鐃熟プワ申鐃夙ワ申鐃緒申鐃緒申嘆鐃緒申鐃緒申鐃緒申鐃緒申撻廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申僚鐃緒申呂鐃� pan.[cbhmt] 鐃緒申名鐃春わ申鐃緒申鐃暑い鐃緒申鐃縦わ申鐃緒申 C 鐃緒申鐃緒申離侫鐃緒申鐃緒申鐃祝書き出わ申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申譴随申侫鐃緒申鐃緒申鐃薯コワ申僖鐃緒申襪刻申鐃緒申鐃祝わ申鐃渋行駕申能鐃淑醐申鐃准器が鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申峩鐃緒申屬鬚�まなわ申探鐃緒申鐃緒申鐃緒申鐃緒申蓮鐃獣縁申房鐃緒申里茲�鐃祝ワ申鐃緒申僖鐃緒申襪刻申鐃緒申鐃緒申鐃叔わ申鐃緒申鐃叔わ申鐃順う鐃緒申
$ gcc -o pan pan.c
鐃順き鐃淑ワ申鐃緒申鐃銃ワ申両鐃緒申蓮鐃緒申鐃緒申鐃峻ュー鐃緒申鐃塾ワ申鐃緒申鐃夙わ申鐃峻わ申鐃緒申鐃緒申鐃盾し鐃緒申泙鐃緒申鵝�わ申鐃塾よう鐃緒申鐃順き鐃淑ワ申鐃緒申鐃銃ワ申慮鐃緒申擇鬚垢鐃緒申鐃熟￥申鐃緒申鐃緒申鐃緒申率的鐃祝使わ申鐃俊ット常申鐃瞬駈申鐃緒申法鐃緒申箸鐃緒申鐃緒申砲鐃所検鐃准わ申鐃緒申能鐃祝なるか鐃盾し鐃緒申泙鐃緒申鵝�ビット常申鐃瞬駈申鐃緒申法鐃緒申鐃緒申僂鐃緒申鐃夙わ申鐃熟以駕申鐃塾よう鐃祝ワ申鐃緒申僖鐃緒申襪件申泙鐃緒申鐃�
$ gcc -DBITSTATE -o pan pan.c
鐃緒申鐃塾よう鐃緒申探鐃緒申鐃塾ワ申鐃出レー鐃緒申鐃熟￥申鐃熟ッワ申鐃緒申鐃緒申鐃緒申鐃淑詳細は醐申辧砲砲鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申譴随申孫垈鐃叔緒申文鐃緒申撻廛鐃緒申鐃緒申鐃準自鐃夙にもオ鐃竣ワ申鐃緒申鐃緒申鐃緒申蠅刻申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃准プワ申鐃緒申鐃緒申鐃祝誌申鐃緒申任鐃緒申襯�鐃竣ワ申鐃緒申鐃熟￥申鐃遵記鐃塾よう鐃祝ワ申鐃緒申僖鐃緒申襪件申鐃緒申鐃緒申鐃� "./pan -?" 鐃祝わ申鐃緒申認鐃叔わ申鐃殉わ申鐃淑醐申鐃准プワ申鐃緒申鐃緒申鐃祝誌申鐃緒申任鐃緒申襯�鐃竣ワ申鐃緒申鐃祝つわ申鐃銃は￥申鐃緒申劼鐃�鐃瞬醐申鐃准プワ申鐃緒申鐃緒申鐃緒申鐃緒申僂鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃祝￥申
-m 鐃熟￥申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申離妊侫鐃緒申鐃夙の随申鐃緒申鐃書いわ申鐃術刻申鐃緒申鐃緒申里忙鐃緒申僂鐃緒申泙鐃緒申鐃緒申名鐃熟￥申鐃緒申鐃緒申鐃緒申鐃熟ワ申鐃緒申鐃緒申鐃獣トとなわ申鐃緒申鐃粛ルが鐃緒申鐃獣ぱわ申鐃叔なわ申鐃夙わ申鐃緒申鐃緒申鐃渋行駕申能鐃祝なわ申泙鐃緒申鐃緒申鐃緒申鐃熟逸申鐃循のわ申鐃緒申鐃緒申同鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申呂鐃緒申弔任鐃祝常申泙鐃緒申鐃塾ではわ申鐃緒申泙鐃緒申鐃�-m 鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申蠅刻申鐃緒申鐃祝わ申鐃緒申鐃緒申鐃緒申鐃緒申肋鐃祝実行駕申能鐃祝なわ申泙鐃緒申鐃緒申鐃緒申辰僂鐃緒申砲覆辰討鐃緒申鐃緒申鐃緒申優鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申麓鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申離鐃緒申廛鐃緒申鐃緒申鐃� -a 鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃夙み刻申錣誌申童鐃緒申撻廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申蓮鐃緒申鐃緒申鐃緒申鐃緒申鐃暑検鐃准プワ申鐃緒申鐃緒申鐃塾随申鐃緒申鐃書いわ申同鐃粛に異なわ申泙鐃緒申鐃緒申鐃緒申擇鐃緒申鐃楯には￥申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾醐申鐃緒申鐃緒申鐃緒申必鐃竣わ申鐃緒申鐃緒申任鐃緒申腓�鐃緒申
-t 鐃熟￥申鐃緒申鐃緒申表鐃緒申鐃術のワ申鐃竣ワ申鐃緒申鐃叔わ申鐃緒申鐃緒申鐃准プワ申鐃緒申鐃緒申爐� assert 鐃緒申鐃出わ申鐃緒申鐃夙随申鐃叔ッドワ申鐃獣ワ申鐃緒申望鐃殉なわ申鐃緒申奪鐃緒申鐃緒申鐃緒申亮鐃緒申鐃緒申鮓�つわ申鐃緒申鐃緒申隋�鐃緒申鐃准プワ申鐃緒申鐃緒申鐃緒申 pan.trail 鐃夙わ申鐃緒申名鐃塾フワ申鐃緒申鐃緒申縫鐃緒申蕁種申竜鐃緒申廚鐃書き出わ申鐃殉わ申鐃緒申Spin 鐃緒申 -t 鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申蠅刻申鐃緒申鐃祝わ申蠅緒申両楮戮鮓�わ申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃渋常申離鐃緒申廛鐃緒申鐃緒申鐃�pglrs鐃祝わ申鐃夙み刻申錣誌申鐃緒申鐃祝わ申螢�鐃初ー鐃緒申鐃緒申鐃緒申鐃藷スわ申鐃出わ申鐃暑い鐃緒申鐃緒申鐃緒申鐃淑誌申鐃緒申鐃緒申鐃獣縁申房鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔わ申鐃緒申任鐃緒申腓�鐃緒申
鐃緒申鐃緒申鐃叔紹介しなわ申鐃獣わ申 Spin 鐃緒申他鐃塾ワ申鐃竣ワ申鐃緒申鐃祝つわ申鐃銃は常申略鐃緒申鐃殉わ申鐃緒申鐃旬わ申鐃緒申鐃熟￥申[5] 鐃薯見てわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃述ワ申箸箸鐃緒申董鐃緒申鐃緒申離泪縫絅�鐃緒申虜埜鐃祝わ申鐃緒申 "鐃緒申鐃緒申某鐃緒申鐃緒申鐃緒申蟆種申鐃緒申鐃�" 鐃盾見鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申
鐃淑駕申鐃祝種申鐃緒申鐃竣ワ申鐃夙ワ申鐃緒申鐃緒申鐃緒申佑鐃緒申討澆泙鐃緒申腓�鐃緒申鐃緒申鐃緒申鐃叔は￥申鐃淑駕申鐃塾ワ申妊鐃緒申 lynch 鐃夙わ申鐃緒申鐃春ワ申鐃緒申鐃緒申鐃緒申鐃渋醐申鐃緒申鐃緒申箸鐃緒申泙鐃緒申鐃�
1 #define MIN 9
2 #define MAX 12
3 #define FILL 99
4
5 mtype = { ack, nak, err }
6
7 proctype transfer(chan chin, chout)
8 { byte o, i, last_i=MIN;
9
10 o = MIN+1;
11 do
12 :: chin?nak(i) ->
13 assert(i == last_i+1);
14 chout!ack(o)
15 :: chin?ack(i) ->
16 if
17 :: (o < MAX) -> o = o+1
18 :: (o >= MAX) -> o = FILL
19 fi;
20 chout!ack(o)
21 :: chin?err(i) ->
22 chout!nak(o)
23 od
24 }
25
26 proctype channel(chan in, out)
27 { byte md, mt;
28 do
29 :: in?mt,md ->
30 if
31 :: out!mt,md
32 :: out!err,0
33 fi
34 od
35 }
36
37 init
38 { chan AtoB = [1] of { mtype, byte };
39 chan BtoC = [1] of { mtype, byte };
40 chan CtoA = [1] of { mtype, byte };
41 atomic {
42 run transfer(AtoB, BtoC);
43 run channel(BtoC, CtoA);
44 run transfer(CtoA, AtoB)
45 };
46 AtoB!err,0; /* start */
47 0 /* hang */
48 }
鐃緒申鐃塾プワ申鐃夙ワ申鐃緒申魯鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申 ack鐃緒申nak鐃緒申err 鐃緒申鐃緒申僂鐃緒申泙鐃緒申鐃�err 鐃熟￥申2 鐃縦わ申転鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃瞬のワ申鐃緒申優鐃緒申命鐃緒申砲鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申里罎�鐃淳わ申鐃叔ル化鐃緒申鐃緒申里忙鐃緒申僂鐃緒申討鐃緒申泙鐃緒申鐃緒申鐃緒申鐃粛ワ申凌鐃緒申鐃緒申颪い魯鐃緒申鐃粛ワ申廛鐃緒申鐃緒申鐃緒申砲鐃緒申鐃叔ル化鐃緒申鐃銃わ申鐃殉わ申鐃緒申鐃殉わ申転鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申 2 鐃縦のワ申鐃緒申鐃緒申鐃緒申鐃術随申鐃瞬わ申鐃緒申鐃術常申鐃淑上記鐃塾わ申里呂錣駈申抜岼鐃獣てわ申鐃殉わ申鐃祝わ申 assert 鐃緒申箸辰鐃宿緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃�
鐃緒申鐃盾オ鐃竣ワ申鐃緒申鐃緒申鐃緒申蠅件申覆鐃緒申鐃� Spin 鐃緒申鐃緒申鐃初せ鐃緒申函鐃緒申鐃緒申鐃緒申爛件申潺鐃曙ー鐃緒申鐃緒申鐃緒申圓鐃緒申鐃緒申孫圓鐃緒申鐃緒申鐃緒申鐃獣縁申暴鐃緒申呂鐃緒申襪�鐃緒申鐃渋刻申鐃緒申鐃緒申未辰鐃� printf 文鐃緒申鐃緒申呂鐃緒申泙鐃緒申鐃緒申鐃緒申両鐃緒申蓮鐃緒申焚鐃緒申里茲�鐃淑緒申鐃熟になわ申泙鐃緒申鐃�
$ spin lynch # no options, not recommended spin: "lynch" line 13: assertion violated #processes: 4 proc 3 (transfer) line 11 (state 15) proc 2 (channel) line 28 (state 6) proc 1 (transfer) line 13 (state 3) proc 0 (:init:) line 48 (state 6) 4 processes created $
鐃遵記鐃塾ワ申妊鐃祝わ申 printf 鐃熟なわ申鐃塾わ申 printf 鐃緒申鐃出わ申鐃緒申鐃緒申呂呂鐃緒申鐃殉わ申鐃藷が￥申鐃竣ワ申鐃緒申鐃緒申鐃緒申 assert 鐃祝逸申反鐃緒申鐃緒申鐃緒申鐃潤、鐃緒申鐃塾わ申鐃夙わ申鐃緒申鐃熟わ申鐃緒申討鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃塾りた鐃緒申鐃緒申鐃熟￥申鐃緒申蠅随申鐃緒申鐃緒申鐃淑わ申鐃夙わ申鐃出￥申鐃緒申鐃駿ての種申鐃緒申鐃緒申鐃駿ワ申函暴鐃緒申呂鐃緒申鐃処う鐃緒申鐃緒申鐃初せ鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃塾件申未魏爾凌鐃� 1 鐃祝種申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃熟につわ申鐃銃はほとわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃殉でわ申覆鐃緒申任鐃緒申腓�鐃緒申
鐃遵記鐃塾ワ申鐃淳ワ申譟種申鐃緒申鐃緒申任浪鐃緒申拗圓辰討鐃銃縁申鐃� assert 鐃緒申反鐃薯検出わ申鐃殉わ申鐃緒申鐃緒申鐃淳ワ申譟種申鐃緒申鐃緒申魯鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃重�鐃緒申鐃緒申鬚靴討鐃緒申鐃塾で￥申鐃縦ねにわ申鐃塾ワ申鐃緒申鐃緒申鐃塾逸申反鐃薯見つわ申鐃緒申必鐃竣はわ申鐃緒申泙鐃緒申鵝�再醐申鐃緒申能鐃淑実行ワ申鐃緒申鐃緒申鐃藷スわ申鐃緒申鐃緒申鐃緒申鐃緒申蓮鐃�-n N 鐃緒申鐃竣ワ申鐃緒申鐃緒申箸鐃緒申泙鐃緒申鐃緒申磴�鐃出￥申
$ spin -r -n100 lynch
鐃夙わ申鐃緒申函鐃緒申鐃緒申鐃緒申爛醐申鐃緒申優譟種申鐃緒申亮鐃緒申鐃緒申鐃緒申 100 鐃緒申鐃緒申僂鐃緒申鐃緒申鐃緒申同鐃緒申鐃緒申鐃熟わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申歉擇鐃緒申泙鐃緒申鐃�
鐃縮のワ申鐃竣ワ申鐃緒申鐃緒申鐃緒申蠅刻申鐃緒申鐃祝わ申蝓�鐃緒申鐃淳ワ申譟種申鐃緒申鐃緒申亮孫圓砲鐃緒申鐃緒申呂鐃渋随申鐃緒申个鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申呂鐃緒申鐃緒申謄鐃緒申鐃緒申箸呂鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃縮になわ申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃出わ申鐃緒申鐃獣縁申焚鐃緒申 grep 鐃緒申箸辰峠鐃緒申呂鐃春ワ申鐃暑タ鐃緒申鵐阿鐃緒申鐃緒申鐃叔わ申鐃緒申鐃緒申鐃夙わ申鐃出￥申鐃遵記鐃緒申鐃緒申砲鐃緒申鐃緒申謄鐃緒申鐃粛ワ申廛鐃緒申鐃緒申鐃緒申凌鐃緒申鐃緒申颪い鐃緒申鐃緒申鐃縮ｏ申覆鐃緒申辰鐃緒申箸鐃緒申討蕁�鐃淑駕申鐃塾よう鐃祝わ申鐃殉わ申鐃緒申
$ spin -n100 -r lynch | grep "proc 2"
鐃緒申鐃緒申鐃緒申鐃緒申函鐃緒申鐃� 1 鐃塾よう鐃淑件申未砲覆鐃殉わ申鐃緒申
$ spin -r lynch proc 1 (transfer) line 21, Recv err,0 <- queue 1 (chin) proc 2 (channel) line 29, Recv nak,10 <- queue 2 (in) proc 3 (transfer) line 12, Recv nak,10 <- queue 3 (chin) proc 1 (transfer) line 15, Recv ack,10 <- queue 1 (chin) ... proc 1 (transfer) line 15, Recv ack,12 <- queue 1 (chin) proc 2 (channel) line 29, Recv ack,99 <- queue 2 (in) proc 3 (transfer) line 15, Recv ack,99 <- queue 3 (chin) proc 1 (transfer) line 15, Recv ack,99 <- queue 1 (chin) proc 2 (channel) line 29, Recv ack,99 <- queue 2 (in) proc 3 (transfer) line 21, Recv err,0 <- queue 3 (chin) proc 1 (transfer) line 12, Recv nak,99 <- queue 1 (chin) spin: "lynch" line 13: assertion violated #processes: 4 proc 3 (transfer) line 11 (state 15) proc 2 (channel) line 28 (state 6) proc 1 (transfer) line 13 (state 3) proc 0 (:init:) line 48 (state 6) 4 processes created $ spin -n100 -r lynch | grep "proc 2" proc 2 (channel) line 29, Recv nak,10 <- queue 2 (in) proc 2 (channel) line 29, Recv ack,11 <- queue 2 (in) proc 2 (channel) line 29, Recv ack,12 <- queue 2 (in) proc 2 (channel) line 28 (state 6) 鐃緒申 1. 鐃緒申鐃淳ワ申譟種申鐃緒申鐃緒申僚鐃緒申鐃�
鐃淑駕申鐃塾よう鐃淑件申未鐃緒申鐃緒申鐃祝は￥申-c 鐃緒申鐃竣ワ申鐃緒申鐃淑バ￥申鐃緒申鐃緒申鐃�3.0鐃叔の随申鐃緒申能鐃祝わ申箸鐃緒申泙鐃緒申鐃�
$ spin -c lynch proc 0 = :init: proc 1 = transfer proc 2 = channel proc 3 = transfer q\p 0 1 2 3 1 AtoB!err,0 1 . chin?err,0 2 . chout!nak,10 2 . . in?nak,10 3 . . out!err,0 3 . . . chin?err,0 1 . . . chout!nak,10 1 . chin?nak,10 2 . chout!ack,10 2 . . in?ack,10 3 . . out!ack,10 3 . . . chin?ack,10 1 . . . chout!ack,11 1 . chin?ack,11 2 . chout!ack,11 2 . . in?ack,11 3 . . out!ack,11 3 . . . chin?ack,11 1 . . . chout!ack,12 1 . chin?ack,12 2 . chout!ack,12 2 . . in?ack,12 3 . . out!ack,12 3 . . . chin?ack,12 1 . . . chout!ack,99 1 . chin?ack,99 2 . chout!ack,99 2 . . in?ack,99 3 . . out!err,0 3 . . . chin?err,0 1 . . . chout!nak,99 1 . chin?nak,99 spin: line 13 "lynch", Error: assertion violated ------------- final state: ------------- #processes: 4 79: proc 3 (transfer) line 11 "lynch" (state 15) 79: proc 2 (channel) line 28 "lynch" (state 6) 79: proc 1 (transfer) line 13 "lynch" (state 3) 79: proc 0 (:init:) line 47 "lynch" (state 6) 4 processes created
鐃叔緒申鐃緒申鵑�ワ申鐃緒申優鐃緒申 id 鐃瞬号、鐃叔緒申旅圓鐃緒申廛鐃緒申鐃緒申鐃� id 鐃瞬刻申如鐃緒申胴圓呂匹離廛鐃緒申鐃緒申鐃緒申鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申転鐃緒申鐃緒申圓辰鐃緒申鐃緒申鐃緒申鐃熟わ申鐃銃わ申鐃殉わ申鐃緒申
鐃緒申鐃淳ワ申譟種申鐃緒申鐃緒申録鐃緒申鐃緒申鐃緒申澤廚鐃緒申鐃緒申鐃縮につわ申鐃銃わ申鐃獣とデバッワ申鐃緒申鐃緒申砲鐃緒申鐃緒申立鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃塾ワ申鐃緒申鐃銃ムが鐃緒申鐃緒申鐃祝ワ申鐃初ー鐃緒申泙鐃叔わ申鐃淑わ申鐃緒申鐃宿わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃熟でわ申鐃殉わ申鐃緒申Spin 鐃叔わ申 -a 鐃緒申 -t 鐃緒申鐃竣ワ申鐃緒申鐃緒申箸鐃緒申鐃緒申砲鐃所、鐃緒申鐃夙わ申鐃緒申鐃緒申鐃順き鐃淑ワ申妊鐃叔わ申鐃獣わ申鐃夙わ申鐃銃も検鐃准わ申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�
鐃竣ワ申鐃夙ワ申鐃緒申鐃叔ワ申鐃緒申个鐃緒申鐃緒申鐃瞬駈申鐃緒申探鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃熟以駕申鐃緒申 1 鐃緒申鐃旬のよう鐃祝わ申鐃銃削申鐃緒申鐃� 5 鐃縦フワ申鐃緒申鐃暑か鐃緒申覆鐃殉わ申鐃緒申
$ spin -a lynch $ wc pan.[bchmt] 99 285 1893 pan.b 3158 10208 70337 pan.c 356 1238 7786 pan.h 216 903 6045 pan.m 575 2099 14017 pan.t 4404 14733 100078 total
pan.c 鐃熟プワ申鐃夙ワ申鐃緒申慮鐃緒申擇鐃峻わ申 C 鐃緒申鐃緒申離鐃緒申鐃緒申匹里曚箸鐃宿わ申泙澆泙鐃緒申鐃�pan.t 鐃熟プワ申鐃夙ワ申鐃緒申鐃緒申鐃緒申鐃春ワ申鐃緒申鐃薯エンコ￥申鐃宿わ申鐃緒申鐃緒申鐃旬マトリク鐃緒申鐃緒申泙澆泙鐃緒申鐃�pan.b 鐃緒申 pan.m 鐃熟緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃旬と居申鐃緒申鐃緒申鐃緒申鐃緒申鐃旬わ申 C 鐃塾ワ申鐃緒申鐃宿￥申pan.h 鐃熟ヘッワ申鐃春ワ申鐃緒申鐃緒申任鐃緒申鐃緒申鐃緒申鐃緒申呂鐃緒申鐃緒申弔鐃緒申鐃緒申鐃祝￥申妊鐃緒申鐃術ワ申鐃暑す鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申覆鐃緒申箸鐃緒申弌鐃緒申鐃緒申鐃緒申峩鐃緒申鐃獣居申鐃緒申鐃緒申鐃夙わ申鐃緒申鐃俊ット常申鐃瞬駈申鐃瞬わ申鐃緒申僂鐃緒申鐃夙わ申鐃祝￥申
鐃緒申鐃緒申鐃銃ワ申両鐃緒申峩鐃緒申屬鐃緒申鐃緒申鐃緒申茲�100,000鐃循どまでなわ申弌鐃緒申鐃獣とわ申鐃宿わ申鐃緒申法鐃熟￥申鐃叔フワ申鐃緒申箸里泙泪廛鐃緒申鐃緒申鐃緒申鬟灰鐃術ワ申鐃暑す鐃暑こ鐃夙でわ申鐃緒申
$ gcc -o pan pan.c
鐃緒申鐃緒申僖鐃緒申鐃祝わ申辰討任鐃緒申鐃緒申孫團廛鐃緒申鐃緒申鐃緒申 pan 鐃緒申孫圓鐃緒申鐃緒申鐃祝わ申蠍￥申擇鐃緒申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃塾常申鐃塾醐申鐃准わ申鐃緒申探鐃緒申鐃緒申圓鐃緒申泙鐃緒申鐃緒申弔泙蝓�鐃緒申能鐃淑わ申鐃駿てのワ申鐃駿ワ申肇鐃緒申鐃緒申鐃緒申鵐垢鐃銃ワ申鐃夙わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃�assert 鐃緒申反鐃緒申鐃緒申鐃緒申个鐃緒申鐃薯見つわ申鐃出わ申鐃殉わ申鐃緒申
$ ./pan assertion violated (i == last_i + 1)) pan: aborted pan: wrote pan.trail search interrupted vector 64 byte, depth reached 56 61 states, stored 5 states, linked 1 states, matched hash conflicts: 0 (resolved) (size 2^18 states, stack frames: 0/5)
(鐃緒申蠖件申鐃緒申鐃緒申弌鐃緒申鐃緒申鐃緒申僚鐃緒申老鐃緒申鐃緒申蓮鐃銃縁申鐃緒申鐃緒申鐃緒申泙鐃叔わ申鐃殉わ申鐃緒申鐃緒申鐃緒申辰鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃緒申)
鐃緒申鐃熟の最緒申鐃� 1 鐃緒申鐃旬は￥申assert 鐃緒申反鐃緒申鐃緒申鐃獣わ申鐃緒申鐃緒申鐃緒申陲掘鐃緒申鐃緒申兢鐃緒が鐃緒申鐃緒申鐃緒申鐃緒申覆鐃緒申辰鐃緒申能鐃緒申反鐃緒申魘気鐃緒申討鐃緒申鐃殉わ申鐃緒申鐃緒申鐃塾逸申反鐃緒申 61 鐃緒申鐃瞬わ申鐃緒申鐃緒申鐃緒申鐃曙た鐃緒申鐃夙�鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃緒申魯奪鐃緒申鐃� "conflicts" 鐃熟￥申鐃緒申鐃瞬駈申鐃瞬をアワ申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃緒申屬砲鐃緒申鐃緒申鐃緒申魯奪鐃緒申鐃塾常申鐃粛駕申鐃緒申鮗┐鐃緒申討鐃緒申泙鐃緒申鐃緒申鐃獣居申鐃緒申癲種申匹任蓮鐃緒申鐃緒申戮討両鐃緒申屬魯螢刻申函鐃�linked list鐃祝に鰹申納鐃緒申鐃銃￥申鐃緒申鐃駿ての常申鐃粛わ申鐃処し鐃銃わ申鐃殉わ申鐃緒申鐃緒申鐃塾常申鐃祝わ申鐃緒申鐃緒申任鐃舜随申鐃緒申鐃緒申鐃緒申鐃緒申分鐃熟￥申3 鐃緒申鐃旬でわ申鐃順う鐃緒申鐃緒申鐃緒申蓮鐃緒申鐃緒申潺鐃曙ー鐃緒申鐃祝わ申辰萄童鐃緒申鐃叔緒申淵鐃緒申蕁種申鐃緒申鐃緒申鐃緒申鵐垢鐃� trail 鐃春ワ申鐃緒申鐃緒申忘鐃緒申譴随申鐃緒申箸鮗┐鐃緒申討鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申念焚鐃緒申里茲�鐃祝わ申鐃緒申函鐃�
$ spin -t -r lynch | grep "proc 2"
鐃緒申鐃初ー鐃塾醐申鐃緒申鐃緒申鐃淑にでわ申鐃獣わ申鐃緒申鐃緒申鐃所す鐃緒申鐃緒申任鐃緒申鐃叔わ申鐃順う鐃緒申assert 鐃緒申適鐃准でわ申鐃緒申弌鐃緒申鐃緒申撻廛鐃緒申鐃緒申鐃緒申呂鐃緒申琉鐃夙随申鮓�つわ申鐃銃わ申鐃緒申泙鐃緒申鐃緒申發件申鐃緒申里茲�鐃淑逸申反鐃緒申鐃緒申陲気鐃淑わ申鐃獣わ申鐃緒申鐃熟￥申鐃瞬違い鐃淑わ申 assert 鐃緒申反鐃緒申鐃夙わ申鐃処う鐃淑実行ワ申鐃緒申鐃緒申鐃藷スわ申鐃淑わ申鐃獣わ申鐃夙わ申鐃緒申鐃緒申鐃夙でわ申鐃順う鐃緒申
鐃緒申鐃准プワ申鐃緒申鐃緒申鐃熟わ申鐃緒申鐃縦わ申鐃塾ワ申鐃竣ワ申鐃緒申鵑�誌申鐃緒申任鐃緒申鐃処う鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申匹里茲�鐃淑ワ申鐃竣ワ申鐃緒申鵑�わ申鐃暑か鐃熟￥申鐃淑駕申鐃塾よう鐃祝わ申鐃緒申肇鐃緒申鐃緒申奪鐃緒申任鐃緒申泙鐃緒申鐃�
$ ./pan -- -cN stop at Nth error (default=1) -l find non-progress cycles # when compiled with -DNP -a find acceptance cycles # when not compiled with -DNP -mN max depth N (default=10k) -wN hash table of 2^N entries (default=18) ...etc.
鐃叔緒申鐃� -c 鐃緒申鐃竣ワ申鐃緒申鐃塾逸申鐃緒申鐃緒申 0 鐃緒申鐃緒申鐃所す鐃緒申函鐃緒申鐃緒申撻廛鐃緒申鐃緒申鐃緒申魯鐃緒申蕁種申鮓�つわ申鐃銃わ申鐃緒申峩鐃緒申鐃獣居申鐃緒申鐃渋鰹申鐃緒申泙鐃緒申鐃緒申鐃緒申蕁種申鐃緒申鐃緒申弔鐃緒申鐃淑わ申鐃獣わ申鐃緒申鐃緒申 -c0 鐃緒申鐃竣ワ申鐃緒申鵑�誌申鐃所さ鐃曙た鐃緒申鐃熟￥申鐃緒申鐃塾醐申鐃准わ申鐃緒申了鐃緒申鐃緒申函鐃緒申孫圓任鐃緒申覆鐃緒申辰鐃緒申鐃緒申鐃獣ｏ申任鐃緒申覆鐃緒申辰鐃緒申縫鐃緒申鐃緒申匹亡悗鐃緒申鐃緒申彁櫃鮗┐鐃緒申泙鐃緒申鐃緒申鐃緒申両鐃緒申僚鐃緒申呂楼焚鐃緒申里茲�鐃祝なわ申泙鐃緒申鐃�
$ ./pan -c0 assertion violated (i == (last_i + 1)) vector 64 byte, depth reached 60, errors: 5 165 states, stored 5 states, linked 26 states, matched hash conflicts: 1 (resolved) (size 2^18 states, stack frames: 0/6) unreached code :init: (proc 0): reached all 9 states unreached code channel (proc 1): line 35 (state 9), reached: 8 of 9 states unreached code transfer (proc 2): line 24 (state 18), reached: 17 of 18 states
鐃遵記鐃熟￥申5 鐃縦わ申 assert 鐃緒申反鐃緒申鐃緒申鐃獣わ申鐃緒申鐃夙わ申 165 鐃塾ワ申法鐃緒申鐃緒申淵鐃緒申鐃緒申謄鐃塾常申鐃瞬わ申鐃緒申鐃曙た鐃緒申鐃薯示わ申鐃銃わ申鐃殉わ申鐃緒申鐃緒申鐃瞬に関わ申鐃銃は￥申鐃銃常申鐃瞬わ申鐃駿ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申 64 byte 鐃叔￥申鐃循環わ申鐃淑わ申鐃緒申長鐃塾ワ申鐃緒申鐃緒申鐃藷スわ申 60 鐃叔わ申鐃暑こ鐃夙を示わ申鐃銃わ申鐃殉わ申鐃緒申鐃緒申鐃緒申優鐃竣ワ申鐃緒申鐃緒申鐃緒申転鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃塾どわ申鐃緒申砲鐃緒申鐃獣ｏ申鐃緒申討鐃緒申覆鐃緒申鐃緒申屬鐃緒申劼箸弔鐃緒申襪鰹申箸蘯�鐃緒申鐃銃わ申鐃殉わ申鐃緒申鐃緒申達鐃緒申鐃銃わ申鐃淑わ申鐃緒申鐃瞬は￥申鐃緒申鐃曙ぞ鐃緒申離廛鐃緒申鐃緒申鐃緒申鐃� do 鐃暑ー鐃竣わ申直鐃緒申任鐃緒申鐃緒申匹鐃緒申鐃塾ルー鐃竣も終了鐃緒申鐃淑わ申鐃緒申鐃夙わ申嫂泙鐃緒申萄鐃緒申鐃銃わ申鐃暑こ鐃夙わ申鐃緒申鐃春わ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申
-l 鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申蠅刻申鐃夙￥申鐃緒申鐃准プワ申鐃緒申鐃緒申鐃熟デッドワ申鐃獣ワ申鐃緒申 assert 鐃緒申反鐃緒申鐃� non-progress 鐃暑ー鐃竣わ申探鐃緒申鐃殉わ申鐃緒申鐃緒申鐃塾ワ申鐃竣ワ申鐃緒申鐃祝つわ申鐃銃わ申 "鐃緒申鐃緒申鐃駿な使わ申鐃緒申" 鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申
鐃緒申鐃准プワ申鐃緒申鐃緒申鐃熟わ申鐃緒申鐃� 2 鐃縦のワ申鐃竣ワ申鐃緒申鐃薯サポ￥申鐃夙わ申鐃銃わ申鐃殉わ申鐃緒申鐃叔フワ申鐃緒申箸任鐃獣居申鐃緒申凌鐃緒申鐃緒申鐃� 10,000 鐃緒申鐃銃ップわ申鐃緒申鐃渋わ申鐃緒申討鐃緒申泙鐃緒申鐃緒申發恵居申鐃緒申鐃緒申鐃緒申鐃獣居申鐃緒申鐃緒申鐃緒申砲泙鐃獣ｏ申鐃緒申鐃緒申鐃緒申蓮鐃獣居申鐃緒申鐃緒申任鐃緒申擇鐃暑た鐃潤検鐃准わ申鐃緒申分的鐃祝なわ申泙鐃緒申鐃緒申亮造鐃緒申鐃獣居申鐃緒申鐃峻わ申鐃緒申鐃緒申鐃緒申鐃熟￥申"depth reached" 鐃緒申鐃緒申鐃緒申探鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃緒申鐃緒申鐃叔э申鐃緒申鐃緒申發件申鐃緒申鐃緒申任覆鐃緒申辰鐃緒申鐃緒申鐃� -m 鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申蠅件申童鐃緒申擇魴�わ申鐃瞬わ申必鐃竣わ申鐃緒申鐃緒申泙鐃緒申鐃�
-m 鐃緒申鐃竣ワ申鐃緒申鐃熟￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃重�鐃緒申探鐃緒申鐃緒申鐃叔わ申鐃准わ申里砲鐃緒申鐃術でわ申鐃殉わ申鐃緒申鐃緒申鐃夙わ申鐃出￥申assert 鐃緒申鐃夙随申鐃緒申鐃渋行ワ申鐃緒申鐃緒申鐃藷スのわ申鐃緒申鐃緒申短鐃塾わ申里鐃獣居申鐃緒申鐃緒申鐃緒申箸鐃緒申忙箸鐃緒申泙鐃緒申鐃緒申鐃緒申里茲�鐃緒申探鐃緒申鐃緒申鐃叔わ申鐃准わ申鐃緒申蓮鐃緒申鐃緒申鐃獣居申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔の駕申能鐃淑わ申鐃駿ての逸申反鐃薯検出わ申鐃緒申鐃緒申鐃緒申歉擇鐃緒申泙鐃緒申鐃�
鐃叔醐申離鐃緒申廛鐃緒申鐃緒申鐃� -w N 鐃叔わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申峩鐃緒申屬慮鐃緒申擇離鐃緒申鐃緒申鐃緒申廚任呂覆鐃緒申鐃緒申孫垰鐃緒申屬鳳洞鐃緒申鐃准ぼわ申鐃殉わ申鐃緒申"hash table width" 鐃緒申鐃縮常検鐃准プワ申鐃緒申鐃緒申爐�鐃緒申鐃緒申鐃緒申鐃暑シ鐃緒申鐃銃ワ申離鐃祝￥申鐃緒申鐃淑常申鐃瞬随申鐃緒申予鐃緒申鐃粛わ申鐃出随申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔わ申鐃緒申弌鐃緒申腓�鐃緒申鐃緒申鐃所し鐃淑わ申鐃緒申个覆鐃殉わ申鐃緒申覆發件申鐃緒申鐃薯小わ申鐃緒申鐃緒申鐃所す鐃緒申函鐃緒申魯奪鐃緒申鐃塾常申鐃粛わ申鐃緒申鐃獣わ申鐃緒申探鐃緒申鐃祝誌申鐃瞬わ申鐃緒申鐃緒申茲�鐃祝なわ申任鐃緒申腓�鐃祝￥申鐃緒申鐃塾デフワ申鐃緒申鐃緒申鐃� 18 鐃叔わ申 262,144 鐃緒申鐃瞬を扱わ申鐃緒申鐃夙わ申鐃叔わ申鐃緒申鐃緒申鐃緒申鐃瞬駈申鐃緒申探鐃緒申鐃緒申鐃准ではわ申鐃塾デフワ申鐃緒申鐃緒申佑里泙泙能鐃淑�鐃夙なわ申茲�鐃祝わ申鐃駿わ申鐃叔わ申鐃緒申
鐃緒申鐃緒申鐃瞬駈申鐃緒申探鐃緒申鐃叔醐申鐃准わ申鐃緒申箸鐃緒申鐃宿�鐃竣となわ申鐃緒申鐃緒申未牢鐃獣縁申坊彁鐃緒申鐃緒申鐃緒申鐃緒申鐃叔わ申鐃殉わ申[4]鐃緒申鐃盾し鐃緒申鐃遵記鐃塾プワ申鐃夙ワ申鐃緒申鐃緒申鐃塾よう鐃祝￥申1 鐃緒申鐃瞬をエンコ￥申鐃宿わ申鐃緒申里鐃� 64 byte 必鐃竣で￥申探鐃緒申鐃祝誌申鐃術でわ申鐃暑シ鐃緒申鐃銃ワ申離鐃緒申鐃緒申未鐃� 2MB 鐃緒申鐃夙わ申鐃緒申函鐃�32,768 鐃緒申鐃瞬鰹申納鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申發件申鐃緒申鐃緒申謄鐃塾常申鐃瞬駈申鐃瞬わ申鐃緒申鐃緒申鐃獣ｏ申鐃叔緒申幣鐃緒申嵜鐃緒申鐃緒申鐃緒申鐃淑常申砲覆辰鐃緒申鐃順、鐃緒申鐃准は種申鐃峻となわ申泙鐃緒申鐃緒申鐃緒申泙里箸鐃緒申鐃緒申鐃�Spin 鐃熟わ申鐃塾トワ申奪廚鐃緒申鬚韻鐃緒申鐃緒申鐃叔わ申鐃緒申唯鐃緒申鐃�鐃緒申鐃准ワ申鐃緒申鐃銃ワ申任鐃緒申鐃渋常申亮鐃銃逸申鐃緒申撻鐃緒申鐃緒申謄鐃熟（わ申鐃曙が鐃緒申鐃竣とわ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃祝関件申鐃淑わ申鐃祝￥申鐃緒申鐃緒申鐃夙わ申鐃縮わ申鐃緒申鐃夙ユー鐃緒申鐃緒申鐃緒申立鐃緒申鐃緒申鐃緒申鐃緒申鐃瞬わ申鐃緒申鐃淑わ申鐃緒申鐃准わ申鐃緒申討鐃緒申泙鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申慮鐃緒申鐃緒申鐃祝￥申任蓮鐃緒申鐃緒申鐃緒申鐃緒申鐃渋わ申達鐃緒申鐃緒申鐃緒申隋�鐃緒申鐃塾ワ申鐃出レー鐃緒申鐃熟急件申鵬鐃緒申鐃緒申辰討鐃緒申泙鐃緒申泙鐃緒申鐃緒申鐃緒申箸鐃緒申弌鐃緒申鐃叔種申任鐃緒申鐃緒申鐃瞬随申鐃緒申2鐃旬の常申鐃瞬随申鐃緒申鐃縦常申鐃瞬駈申鐃瞬を検証わ申鐃緒申箸鐃緒申鐃緒申鐃緒申鐃獣居申鐃緒申鐃粛�鐃緒申鐃淑ワ申鐃出レー鐃緒申鐃熟わ申鐃獣わ申鐃緒申 50% 鐃叔わ申鐃緒申Spin 鐃叔はわ申鐃塾よう鐃淑ワ申鐃緒申鐃緒申鐃叔わ申咼奪半鐃緒申峩鐃緒申鐃祝�[4]鐃緒申箸鐃緒申鐃緒申砲鐃所十分鐃緒申鐃宿わ申鐃緒申未鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申咼奪半鐃緒申峩鐃緒申屬鐃夙わ申鐃祝は以駕申鐃塾よう鐃祝醐申鐃准プワ申鐃緒申鐃緒申鐃薯コワ申僖鐃緒申襪件申泙鐃緒申鐃�
$ gcc -DBITSTATE -o pan pan.c
鐃緒申鐃塾よう鐃祝ワ申鐃緒申僖鐃緒申襪居申譴随申鐃緒申撻廛鐃緒申鐃緒申鐃緒申任鐃緒申鐃緒申鐃緒申鐃銃縁申鐃緒申茲�鐃緒申 assert 鐃緒申反鐃薯見つわ申鐃出わ申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申
$ ./pan assertion violated (i == ((last_i + 1)) pan: aborted pan: wrote pan.trail search interrupted vector 64 byte, depth reached 56 61 states, stored 5 states, linked 1 states, matched hash factor: 67650.064516 (size 2^22 states, stack frames: 0/5) $
鐃渋際￥申鐃緒申鐃緒申鐃駿わ申鐃順き鐃緒申鐃緒申鐃緒申鐃緒申鮠�わ申鐃緒申鐃緒申鐃暑た鐃緒申砲鐃緒申鐃緒申鐃祝￥申鐃夙っわ申鐃緒申鐃熟￥申鐃緒申鐃緒申鐃瞬駈申鐃緒申探鐃緒申鐃緒申鐃緒申戮討鐃循とわ申桧磴わ申呂鐃緒申鐃殉わ申鐃緒申淵咼奪半鐃緒申峩鐃緒申鐃祝￥申鐃緒申鐃緒申鐃渋随申鐃渋�鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申未鐃緒申鐃緒申覆鵬鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申襪鰹申箸鐃塾わ申鐃緒申鐃銃はでわ申鐃緒申鐃祝￥申鐃緒申鐃緒申鐃緒申鐃順き鐃緒申鐃緒申鐃緒申魄靴辰鐃緒申箸鐃緒申砲蓮鐃緒申鐃緒申磴わ申鐃宿緒申鐃殉わ申鐃緒申鐃緒申鐃熟の最醐申鐃� 2 鐃峻に￥申鐃緒申鐃出レー鐃緒申鐃塾醐申鐃術わ申蠅�鐃出わ申里鐃緒申腓�鐃淑ワ申妊鐃薯検証わ申鐃緒申箸鐃緒申砲鐃緒申鐃緒申立鐃縦でわ申鐃順う鐃緒申鐃俊ット常申鐃瞬駈申鐃瞬わ申適鐃緒申鐃叔わ申鐃緒申鐃緒申屬虜鐃緒申鐃緒申鐃熟￥申鐃叔醐申旅圓暴颪い討鐃緒申鐃殉わ申鐃淑わ申鐃緒申鐃叔は￥申2 22 byte 鐃殉わ申鐃緒申 3200 鐃緒申鐃俊ット（常申鐃瞬））￥申鐃緒申鐃塾常申旅圓鐃�鐃熟ッワ申鐃緒申鐃緒申鐃緒申鐃薯示わ申鐃銃わ申鐃殉わ申鐃緒申鐃緒申鐃緒申麓尊櫃両鐃緒申嵜鐃緒申燃鐃獣わ申鐃緒申鐃瞬の削申鐃緒申鐃緒申砲鐃緒申鐃緒申茲緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃緒申腓�鐃淑ハッワ申鐃緒申鐃緒申鐃叔￥申100 鐃淑常申砲録鐃緒申鐃緒申鐃緒申旅發わ申鐃緒申鮗┐鐃緒申鐃緒申鐃緒申離鐃緒申丱譟種申鐃緒申鐃� 99% 鐃緒申 100% 鐃叔わ申鐃緒申鐃熟ッワ申鐃緒申鐃緒申鐃叔わ申 1 鐃祝駈申鼎鐃緒申函鐃緒申鐃緒申丱譟種申鐃緒申鐃� 0% 鐃祝駈申鼎鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申慮鐃緒申撻鐃緒申鐃緒申謄爐�探鐃緒申鐃叔わ申鐃淑わ申鐃獣わ申鐃緒申鐃盾し鐃緒申鐃熟￥申鐃純い鐃緒申鐃出レー鐃緒申鐃夙なってわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃祝わ申鐃緒申鐃緒申鐃緒申分的鐃淑ワ申鐃出レー鐃緒申鐃緒申存鐃緒申鐃緒申討鐃緒申鐃夙わ申鐃緒申鐃緒申鐃祝緒申分鐃緒申鐃緒申鐃春わ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申 Spin 鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申亮鐃銃逸申鐃緒申撻鐃緒申鐃緒申謄鐃緒申蠖�鐃緒申鐃緒申鐃緒申鐃純い鐃夙わ申鐃緒申鐃緒申鐃夙わ申鐃緒申鐃緒申泙鐃緒申鐃�鐃緒申
鐃俊ット常申鐃瞬醐申鐃准わ申鐃緒申標鐃粛は￥申鐃俊ット常申鐃瞬駈申鐃瞬のワ申鐃緒申虜鐃緒申鐃緒申鐃緒申鐃縮をアワ申鐃緒申鐃緒申鐃夙わ申鐃暑こ鐃夙にわ申鐃熟ッワ申鐃緒申鐃緒申鐃叔わ申 100 鐃淑常申砲鐃緒申襪鰹申箸任鐃緒申鐃緒申鐃緒申鐃緒申侶鐃縮わ申鐃緒申鐃緒申砲蓮鐃�-w N 鐃緒申鐃竣ワ申鐃緒申鐃祝わ申辰鴇鐃緒申峩鐃緒申屬離鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申里砲鐃緒申覆鐃緒申離鐃緒申鐃峻ュー鐃緒申鐃叔鰹申鐃緒申鐃叔わ申鐃緒申尊櫃離鐃緒申鐃緒申未鐃重�鐃緒申鐃緒申鐃緒申里砲鐃緒申襪鰹申箸任鐃緒申鐃緒申妊侫鐃緒申鐃夙でわ申 N 鐃緒申 22 鐃叔￥申鐃緒申鐃緒申鐃緒申弍鐃緒申鐃緒申鐃緒申鐃瞬駈申鐃瞬わ申 4MB 鐃叔わ申鐃緒申鐃緒申鐃夙わ申鐃出￥申鐃緒申鐃淑わ申鐃塾ワ申鐃緒申團紂種申鐃緒申鐃� 128 MB 鐃塾ワ申鐃緒申鐃緒申鐃獣てわ申鐃緒申鐃順、-w27 鐃夙誌申鐃所す鐃緒申鐃緒申砲鐃緒申多鐃緒申鐃塾常申鐃瞬につわ申鐃緒申調鐃駿わ申鐃緒申鐃緒申任鐃緒申鐃叔わ申鐃順う鐃緒申
鐃緒申鐃塾マニュア鐃緒申虜能鐃緒申鐃緒申分鐃叔は￥申鐃緒申同鐃緒申鐃叔￥申鐃緒申鐃縮随申鐃祝限らず Promela 鐃夙わ申鐃緒申名鐃塾醐申鐃緒申砲鐃緒申鐃渋行ワ申鐃緒申鐃銃ワ申離鐃叔ワ申鐃宿緒申鐃祝￥申砲弔鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申慮鐃緒申鐃熟わ申鐃緒申鐃縦わ申鐃塾わ申鐃緒申辰箸鐃緒申鐃獣わ申鐃緒申徴鐃緒申鐃緒申辰討鐃緒申泙鐃緒申鐃緒申廛鐃緒申鐃緒申鐃緒申屬鐃緒申命鐃緒申蓮鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申有鐃術随申鐃緒申陲靴胴圓鐃緒申泙鐃緒申鐃銃縁申鐃緒申鐃緒申鐃銃縁申鐃緒申命鐃緒申呂匹鐃緒申鐃緒申鐃緒申眠鐃緒申鐃緒申鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃縮随申鐃塾居申鐃緒申鐃緒申 2 鐃縦のワ申鐃緒申鐃緒申鐃夙わ申鐃銃ワ申妊覯緒申鐃緒申鐃殉わ申鐃緒申Promela 鐃塾わ申鐃駿てわ申文鐃緒申鐃緒申鐃緒申的鐃祝ワ申妊鐃緒申屮鐃緒申奪鐃緒申鐃緒申鐃緒申鐃緒申能鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃熟わ申鐃緒申文鐃緒申鐃渋行駕申能鐃緒申鐃緒申鐃渋刻申鐃峻駕申能鐃緒申鐃祝わ申蝓�鐃循とわ申匹離鐃緒申鐃緒申鐃緒申魯廛鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申辰討鐃緒申鐃縦駈申鐃塾常申鐃瞬にわ申鐃殉わ申鐃緒申鐃竣ワ申鐃緒申鐃緒申同鐃塾わ申鐃緒申澪鐃緒申僂肇廛鐃緒申鐃緒申鐃緒申鐃縦器申呂鐃緒申慮鐃緒申鐃塾削申鐃緒申砲鐃緒申鐃緒申里任鐃緒申鐃�Promela 鐃緒申鐃淳計￥申Spin 鐃祝わ申觚￥申擇箸鐃緒申留鐃緒申鐃緒申楼呂砲弔鐃緒申討両楮戮蓮鐃�[5] 鐃祝わ申鐃緒申泙鐃緒申鐃�
Promela 鐃熟￥申鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申任呂覆鐃緒申鐃緒申鐃緒申鐃緒申僂離鐃叔ワ申鵐宛鐃緒申鐃緒申嫂泙鐃緒申萄鐃緒申鐃銃わ申鐃殉わ申鐃緒申鐃純え鐃出￥申鐃緒申旅鐃緒申鐃緒申鐃緒申櫂如鐃緒申鐃緒申鐃緒申牢泙鐃叔わ申鐃殉わ申鐃藷し￥申鐃術随申鐃塾器申鐃旬件申鐃緒申錣削申鐃緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃藷。醐申鐃准ワ申妊鐃熟プワ申鐃夙ワ申鐃緒申亮鐃緒申鐃緒申鐃緒申鐃楯駕申鐃緒申鐃緒申鐃緒申里任鐃緒申鐃緒申鐃楯駕申鐃祝わ申蝓�鐃竣ワ申鐃緒申鐃緒申鐃緒申鐃緒申澪鐃緒申僂鐃緒申楴鐃重�鐃緒申鐃叔わ申分離鐃緒申鐃緒申調鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃塾でわ申鐃緒申鐃緒申櫺鐃緒申砲鐃緒申鐃緒申鐃緒申肇廛鐃緒申鐃緒申鐃淳ングに関わ申鐃緒申楮戮鐃緒申泙鐃緒申鐃緒申鐃塾でわ申鐃緒申
Promela 鐃塾種申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申旅鐃淑醐申呂鐃緒申鐃緒申鐃緒申辰僂鐃� C 鐃緒申鐃緒申 [6] 鐃緒申鐃緒申辰箸鐃緒申討鐃緒申泙鐃緒申鐃�Promela 鐃緒申 E.W. 鐃緒申鐃緒申鐃緒申鐃緒申鐃夙ワ申 [1] 鐃緒申 C.A.R. 鐃循￥申鐃緒申 [3] 鐃緒申 "鐃緒申鐃緒申鐃宿ワ申鐃殉ワ申標鐃緒申鐃�" 鐃塾影駈申鐃緒申鐃順い鐃祝種申鐃緒申鐃銃わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃夙は緒申鐃緒申憤磴わ申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃夙ワ申慮鐃緒申鐃熟プワ申鐃緒申鐃緒申鐃緒申鐃緒申澪鐃緒申僂鐃緒申鐃緒申離廛鐃淳テワ申鐃瞬とわ申鐃銃誌申鐃獣てわ申鐃殉わ申鐃藷。ホ￥申鐃緒申鐃塾醐申鐃緒申蓮鐃銃縁申鐃緒申命鐃緒申里澆鐃駿￥申鐃緒申鐃夙わ申鐃銃わ申鐃殉わ申鐃緒申鐃殉わ申鐃循￥申鐃緒申鐃塾醐申鐃緒申任蓮鐃緒申鐃緒申鐃緒申匹鐃緒申鐃叔誌申鐃術でわ申鐃緒申文鐃塾種申鐃緒申鐃緒申鐃緒申造鐃緒申鐃緒申鐃殉わ申鐃緒申Promela 鐃緒申鐃緒申鐃緒申判朶鐃淑醐申琉鐃縮ｏ申蓮鐃渋常申離鐃緒申鐃緒申疋鐃緒申泪鐃宿醐申鐃緒申醗曚覆鐃殉わ申鐃緒申鐃緒申鐃駿てのワ申鐃緒申鐃宿わ申鐃緒申鐃塾とわ申鐃熟￥申鐃緒申鐃緒申文鐃緒申鐃緒申鐃叔わ申鐃緒申鐃塾ではなわ申鐃瞬ワ申鐃獣ワ申鐃緒申鐃緒申泙鐃緒申鐃宿�鐃竣でわ申鐃緒申鐃銃縁申鐃緒申鐃緒申箸鐃緒申泙鐃緒申法鐃�
鐃醇ー鐃緒申鐃熟最常申鐃渋わ申鐃緒申鐃熟をすわ申鐃緒申鐃緒申如鐃�Promela 鐃塾醐申鐃准ワ申妊襪�鐃緒申鐃緒申鐃緒申鐃緒申鐃曙た鐃緒申鐃准プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申Spin 鐃緒申鐃夙￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申觚￥申撻廛鐃緒申鐃緒申鐃緒申匹鐃緒申鐃緒申 ANSI C 鐃叔居申鐃述わ申鐃緒申討鐃緒申襪随申瓠�Unix 鐃緒申鐃緒申鐃銃ワ申屬念椰鐃緒申鐃緒申鐃叔緒申任鐃緒申鐃緒申鐃緒申鐃緒申蓮鐃緒申曠鐃緒申肇鐃緒申鐃峻ュー鐃緒申鐃緒申物鐃緒申的鐃淑限鰹申鐃緒申鐃緒申鐃緒申个鐃緒申茲�鐃祝鰹申鐃緒申名鐃緒申任鐃緒申鐃緒申廛鐃緒申肇鐃緒申鐃塾醐申鐃准にわ申鐃緒申鐃銃わ申鐃緒申鐃緒申鐃渋わ申鐃緒申任任鐃緒申鐃緒申鐃緒申鐃緒申鐃塾醐申鐃准わ申存鐃緒申鐃緒申鐃緒申里任鐃緒申鐃�
Spin 鐃緒申箸辰鐃緒申鐃緒申擇砲鐃緒申鐃緒申討泙鐃緒申鐃緒申砲鐃緒申覆鐃緒申鐃出なわ申覆鐃緒申纏鐃緒申蓮鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃渋なワ申妊鐃緒申 Promela 鐃祝わ申蟲�鐃述わ申鐃暑こ鐃夙でわ申鐃緒申鐃緒申鐃塾醐申鐃緒申呂錣駈申半鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃緒申鐃緒申妊鐃藷グわ申鐃緒申的鐃緒申調鐃緒申鐃緒申鐃駿わ申鐃緒申調鐃緒申鐃緒申亡悗鐃緒申襯件申鐃緒申謄鐃緒申側鐃縮わ申鐃緒申个鐃緒申鐃緒申鐃叔わ申鐃緒申他鐃塾詳削申鐃緒申分鐃熟￥申鐃塾象わ申鐃殉わ申鐃緒申鐃緒申鐃緒申的鐃祝は￥申鐃緒申妊鐃熟縮常申鐃叔のワ申鐃緒申鐃銃ワ申任鐃緒申蝓�鐃緒申鐃准わ申鐃緒申鐃緒申鐃緒申鐃祝関わ申鐃緒申鐃緒申分鐃緒申鐃緒申鐃春ルシ鐃緒申鐃銃ワ申鐃緒申鐃緒申鐃緒申任鐃緒申鐃宿�鐃竣わ申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申辰鐃緒申鐃緒申妊鐃緒申鐃循わ申鐃緒申函鐃緒申鐃緒申鐃熟￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃薯検証わ申鐃暑た鐃緒申忙箸鐃緒申襦�鐃緒申鐃緒申譴� "鐃緒申鐃准ワ申鐃緒申鐃緒申鐃緒申" 鐃夙呼ぶ逸申連鐃塾刻申鐃緒申物鐃塾器申鐃竣となわ申泙鐃緒申鐃緒申鐃緒申撻鐃緒申鐃緒申鐃緒申箸鐃緒申曚鐃緒申襪随申鐃祝￥申鐃緒申妊鐃緒申 assert 鐃緒申迭櫃鐃緒申鐃緒申鐃緒申鐃叔わ申鐃殉わ申鐃緒申assert 鐃祝わ申蝓�鐃緒申妊鐃緒申鐃緒申鐃緒申竸鐃緒申鐃緒申佑筌わ申戰鐃夙のワ申鐃緒申鐃緒申鐃藷スに関わ申鐃緒申鐃緒申鐃術常申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申襪鰹申箸鐃緒申任鐃緒申泙鐃緒申鐃�
鐃淑駕申鐃叔種申鐃遵げ鐃緒申能鐃緒申鐃緒申蓮鐃緒申鐃緒申鐃緒申屬鐃緒申里傍鐃緒申鐃緒申鐃緒申譟�1966 年鐃緒申 H. Hyman 鐃緒申 Communications of the ACM 鐃緒申発表鐃緒申鐃緒申鐃緒申他鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃出わ申鐃緒申鐃叔わ申鐃緒申
1 Boolean array b(0;1) integer k, i, 2 comment process i, with i either 0 or 1, and k = 1-i; 3 C0: b(i) := false; 4 C1: if k != i then begin; 5 C2: if not b(1-i) then go to C2; 6 else k := i; go to C1 end; 7 else critical section; 8 b(i) := true; 9 remainder of program; 10 go to C0; 11 end
鐃緒申鐃塾駕申蓮鐃�Dekker 鐃塾緒申鐃緒申硫鐃夙わ申鐃緒申鐃塾わ申鐃緒申鐃塾で￥申2 鐃縦のプワ申鐃緒申鐃緒申鐃緒申鐃瞬刻申 0 鐃緒申 1鐃祝わ申鐃出象とわ申鐃緒申鐃緒申里任鐃緒申鐃緒申鐃緒申沺鐃�Hyman 鐃塾解がワ申鐃緒申謄鐃緒申鐃緒申襯誌申鐃緒申鐃緒申鐃緒申鐃緒申个鐃緒申襯�鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申他鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申歉擇鐃緒申討鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申箸鐃緒申泙鐃緒申腓�鐃緒申鐃緒申鐃緒申鐃塾最緒申了纏鐃緒申蓮鐃�Promela 鐃叔わ申鐃塾駕申離鐃叔ワ申鐃緒申鐃緒申鐃叔わ申鐃緒申鐃緒申鐃緒申鐃叔￥申鐃緒申鐃塾駕申濃箸鐃緒申討鐃緒申鐃緒申竸鐃緒申鐃緒申个鐃緒申鐃縮常申鐃緒申鐃緒申鐃緒か鐃緒申笋刻申鐃緒申鐃塾にわ申鐃殉わ申鐃緒申
1 bool want[2]; /* Bool array b */
2 bool turn; /* integer k */
3
4 proctype P(bool i)
5 {
6 want[i] = 1;
7 do
8 :: (turn != i) ->
9 (!want[1-i]);
10 turn = i
11 :: (turn == i) ->
12 break
13 od;
14 skip; /* critical section */
15 want[i] = 0
16 }
17
18 init { run P(0); run P(1) }
鐃緒申鐃塾ワ申妊鐃塾醐申鐃准プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申僖鐃緒申襪刻申襪鰹申箸如鐃緒申妊奪疋鐃緒申奪鐃緒申里茲�鐃淑種申鐃竣わ申鐃緒申鐃所が鐃緒申鐃緒申弌鐃緒申鐃緒申鐃薯見つわ申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�
$ spin -a hyman0 $ gcc -o pan pan.c $ ./pan full statespace search for: assertion violations and invalid endstates vector 20 byte, depth reached 19, errors: 0 79 states, stored 0 states, linked 38 states, matched total: 117 hash conflicts: 4 (resolved) (size 2^18 states, stack frames: 3/0) unreached code _init (proc 0): reached all 3 states unreached code P (proc 1): reached all 12 states
鐃緒申鐃塾ワ申妊鐃熟最緒申離謄鐃緒申箸縫僖鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃曙が鐃緒申鐃緒申鐃祝駈申味鐃緒申鐃緒申鐃緒申里蓮鐃緒申鐃緒申離鐃緒申襯器申螢削申爐�鐃緒申他鐃緒申鐃緒申鐃緒申歉擇鐃緒申討鐃緒申襪�鐃宿わ申鐃緒申鐃緒申鐃祝つわ申鐃銃でわ申鐃緒申鐃緒申鐃緒申砲呂鐃緒申鐃緒申弔鐃緒申鐃緒申鐃祝￥申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃叔わ申鐃獣縁申鐃緒申鐃祝￥申鐃獣縁申鐃緒申鐃緒申鐃緒申鐃緒申鐃宿緒申鐃緒申鐃緒申鐃� assert 鐃緒申鐃叔ワ申鵬辰鐃緒申襪鰹申箸任鐃緒申鐃�
1 bool want[2];
2 bool turn;
3 byte cnt;
4
5 proctype P(bool i)
6 {
7 want[i] = 1;
8 do
9 :: (turn != i) ->
10 (!want[1-i]);
11 turn = i
12 :: (turn == i) ->
13 break
14 od;
15 skip; /* critical section */
16 cnt = cnt+1;
17 assert(cnt == 1);
18 cnt = cnt-1;
19 want[i] = 0
20 }
21
22 init { run P(0); run P(1) }
鐃緒申鐃緒申鐃叔は￥申鐃緒申鐃緒申鐃緒申鐃出ワ申鐃術随申 cnt 鐃緒申鐃宿加わ申鐃緒申鐃緒申鐃緒申謄鐃緒申鐃緒申襯誌申鐃緒申鐃緒申鐃緒申某鐃緒申鐃緒申鐃緒申鐃緒申箸鐃緒申鐃� +1鐃緒申鐃緒申鐃緒申謄鐃緒申鐃緒申襯誌申鐃緒申鐃緒申鐃藷かわ申任鐃夙わ申鐃緒申 -1 鐃緒申鐃緒申茲�鐃祝わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃術随申鐃緒申鐃粛わ申鐃夙りう鐃緒申鐃緒申鐃緒申佑鐃� 1 鐃叔わ申鐃所、鐃述とつのプワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申謄鐃緒申鐃緒申襯誌申鐃緒申鐃緒申鐃緒申鐃緒申砲鐃緒申鐃夙わ申鐃塾わ申 1 鐃祝なわ申泙鐃緒申鐃�
$ spin -a hyman1 $ gcc -o pan pan.c $ ./pan assertion violated (cnt==1) pan: aborted (at depth 15) pan: wrote pan.trail full statespace search for: assertion violations and invalid endstates search was not completed vector 20 byte, depth reached 25, errors: 1 123 states, stored 0 states, linked 55 states, matched total: 178 hash conflicts: 42 (resolved) (size 2^18 states, stack frames: 3/0)
鐃緒申鐃准プワ申鐃緒申鐃緒申鐃緒申 assert 鐃緒申反鐃緒申鐃緒申鐃獣わ申鐃緒申鐃緒申陲靴討鐃緒申泙鐃緒申鐃緒申鐃緒申離鐃緒申蕁種申鐃緒申鐃緒申鐃緒申鵐垢鐃緒申鐃緒申鐃獣ワ申鐃緒申鐃暑た鐃緒申鐃� Spin 鐃緒申 -t 鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申蠅件申討鐃緒申竜鐃緒申廚鮓�てみまわ申鐃順う鐃緒申
$ spin -t -p hyman1 proc 0 (_init) line 24 (state 2) proc 0 (_init) line 24 (state 3) proc 2 (P) line 8 (state 7) proc 2 (P) line 9 (state 2) proc 2 (P) line 10 (state 3) proc 2 (P) line 11 (state 4) proc 1 (P) line 8 (state 7) proc 1 (P) line 12 (state 5) proc 1 (P) line 15 (state 10) proc 2 (P) line 8 (state 7) proc 2 (P) line 12 (state 5) proc 2 (P) line 15 (state 10) proc 2 (P) line 16 (state 11) proc 2 (P) line 17 (state 12) proc 2 (P) line 18 (state 13) proc 1 (P) line 16 (state 11) proc 1 (P) line 17 (state 12) spin: "hyman1" line 17: assertion violated step 17, #processes: 3 want[0] = 1 _p[0] = 12 turn[0] = 1 cnt[0] = 2 proc 2 (P) line 18 (state 13) proc 1 (P) line 17 (state 12) proc 0 (_init) line 24 (state 3) 3 processes created
鐃緒申鐃銃￥申鐃盾う鐃述とつのワ申鐃初ー鐃緒申発鐃緒申鐃緒申法鐃薯見てみまわ申鐃順う鐃緒申鐃盾う鐃緒申鐃駿ワ申妊鐃祝ワ申鐃緒申謄鐃緒申鐃緒申襯誌申鐃緒申鐃緒申鐃緒申鐃緒申離廛鐃緒申鐃緒申鐃緒申凌鐃緒申亡悗鐃緒申鐃緒申鐃緒申鐃獣わ申鐃殉わ申鐃緒申
1 bool want[2];
2 bool turn;
3 byte cnt;
4
5 proctype P(bool i)
6 {
7 want[i] = 1;
8 do
9 :: (turn != i) ->
10 (!want[1-i]);
11 turn = i
12 :: (turn == i) ->
13 break
14 od;
15 cnt = cnt+1;
16 skip; /* critical section */
17 cnt = cnt-1;
18 want[i] = 0
19 }
20
21 proctype monitor()
22 {
23 assert(cnt == 0 || cnt == 1)
24 }
25
26 init {
27 run P(0); run P(1); run monitor()
28 }
鐃緒申鐃駿は￥申鐃緒申鐃緒申鐃緒申 cnt 鐃緒申鐃粛に関わ申鐃緒申鐃緒申鐃術常申鐃熟￥申鐃緒申立鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃緒申 monitor() 鐃緒申名鐃緒申鐃緒申鐃獣に逸申味鐃熟なわ申鐃塾でわ申鐃緒申鐃祝にわ申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申媛辰鐃緒申譴随申廛鐃緒申鐃緒申鐃緒申蓮鐃�2 鐃縦のプワ申鐃緒申鐃緒申鐃夙とわ申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃緒申 1 鐃緒申鐃銃ップわ申孫圓鐃緒申鐃塾誌申鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃熟ワ申鐃緒申鐃銃ワ申亮孫鐃緒申鐃緒申鐃宿のワ申鐃緒申鐃淳ングでわ申鐃渋行わ申鐃緒申鐃叔緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申Promela 鐃祝わ申鐃緒申妊覯緒申鐃緒申譴随申鐃緒申鐃緒申謄燹�鐃緒申鐃緒申咫鐃�Spin 鐃祝わ申蠍￥申擇鐃緒申鐃暑シ鐃緒申鐃銃ワ申蓮鐃緒申鐃緒申鐃緒申鐃緒申鐃銃縁申鐃緒申任鐃緒申鐃緒申鐃獣て￥申Spin 鐃祝わ申觚￥申擇鐃� 3 鐃縦のプワ申鐃緒申鐃緒申鐃塾駕申能鐃緒申鐃緒申鐃駿てわ申鐃緒申鐃緒申鐃淳ングを検証わ申鐃出象とわ申鐃暑た鐃潤、鐃緒申鐃緒申 assert 鐃緒申他鐃緒申 2 鐃縦のプワ申鐃緒申鐃緒申鐃緒申鐃緒申存鐃緒申鐃瞬のわ申鐃緒申鐃暑タ鐃緒申鐃淳ングわ申評鐃緒申鐃緒申鐃緒申鐃塾でわ申鐃緒申鐃盾し鐃緒申鐃准プワ申鐃緒申鐃緒申爐�鐃緒申反鐃緒申鐃緒申陲靴覆鐃緒申辰鐃緒申鐃緒申蓮鐃緒申鐃緒申鐃緒申鐃� assert 鐃緒申反鐃緒申鐃夙わ申鐃処う鐃淑実行ワ申鐃緒申鐃緒申鐃藷スわ申鐃緒申3 鐃縦のプワ申鐃緒申鐃緒申鐃塾実行ワ申鐃峻￥申鐃宿にわ申蕕削申砲泙辰鐃緒申鐃緒申覆鐃緒申鐃緒申箸鳩鐃緒申鐃緒申鼎鐃緒申鐃緒申鐃緒申鐃叔わ申鐃緒申里任鐃緒申鐃�monitor 鐃竣ワ申鐃緒申鐃緒申鐃祝わ申襯件申鐃緒申謄鐃緒申鐃緒申鐃術常申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃祝￥申鐃緒申鐃緒申鐃緒申鐃緒申譴随申鐃祝￥申任鐃緒申鐃緒申鐃緒申撻廛鐃緒申鐃緒申鐃緒申楼焚鐃緒申里茲�鐃淑件申未鐃緒申鐃署すわ申任鐃緒申腓�鐃緒申
$ spin -a hyman2 $ gcc -o pan pan.c $ ./pan assertion violated ((cnt==0)||(cnt==1)) pan: aborted (at depth 15) pan: wrote pan.trail full statespace search for: assertion violations and invalid endstates search was not completed vector 24 byte, depth reached 26, errors: 1 368 states, stored 0 states, linked 379 states, matched total: 747 hash conflicts: 180 (resolved) (size 2^18 states, stack frames: 4/0)
2 鐃縦のプワ申鐃緒申鐃緒申鐃緒申 3 鐃緒申鐃旬わ申 monitor 鐃竣ワ申鐃緒申鐃緒申鐃夙わ申余分鐃淑ワ申鐃藷タ￥申鐃所ー鐃俊ングのわ申鐃潤、探鐃緒申鐃緒申鐃駿わ申鐃緒申鐃緒申鐃銃ワ申鐃緒申嵜鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申蕁種申鐃緒申鐃緒申鐃緒申鐃緒申鐃署さわ申討鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申鐃銃ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申弔任皀逸申鐃緒申鐃緒申丱鐃緒申鐃緒申鐃術常申鐃夙わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申与鐃緒申鐃緒申鐃緒申箸鐃緒申鐃緒申鐃緒申任呂鐃緒申鐃殉わ申鐃藷。わ申鐃緒申鐃緒申呂鐃緒申鐃薯示わ申鐃緒申鐃緒申里任鐃緒申鐃緒申鐃緒申鐃緒申単鐃緒申淵咼奪噺魎好廛鐃緒申肇鐃緒申鐃緒申alternating bit protocol鐃祝で￥申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃渋誌申鐃緒申鐃緒申罎�鐃淳わ申鐃叔ワ申鵐阿鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申negative acknowledgements鐃祝にわ申鐃緒申張鐃緒申鐃緒申鐃緒申里任鐃緒申鐃�
1 #define MAX 5
2
3 mtype = { mesg, ack, nak, err };
4
5 proctype sender(chan in, out)
6 { byte o, s, r;
7
8 o=MAX-1;
9 do
10 :: o = (o+1)%MAX; /* next msg */
11 again: if
12 :: out!mesg(o,s) /* send */
13 :: out!err(0,0) /* distort */
14 :: skip /* or lose */
15 fi;
16 if
17 :: timeout -> goto again
18 :: in?err(0,0) -> goto again
19 :: in?nak(r,0) -> goto again
20 :: in?ack(r,0) ->
21 if
22 :: (r == s) -> goto progress
23 :: (r != s) -> goto again
24 fi
25 fi;
26 progress: s = 1-s /* toggle seqno */
27 od
28 }
29
30 proctype receiver(chan in, out)
31 { byte i; /* actual input */
32 byte s; /* actual seqno */
33 byte es; /* expected seqno */
34 byte ei; /* expected input */
35
36 do
37 :: in?mesg(i, s) ->
38 if
39 :: (s == es) ->
40 assert(i == ei);
41 progress: es = 1 - es;
42 ei = (ei + 1)%MAX;
43 if
44 /* send, */ :: out!ack(s,0)
45 /* distort */ :: out!err(0,0)
46 /* or lose */ :: skip
47 fi
48 :: (s != es) ->
49 if
50 /* send, */ :: out!nak(s,0)
51 /* distort */ :: out!err(0,0)
52 /* or lose */ :: skip
53 fi
54 fi
55 :: in?err ->
56 out!nak(s,0)
57 od
58 }
59
60 init {
61 chan s_r = [1] of { mtype,byte,byte };
62 chan r_s = [1] of { mtype,byte,byte };
63 atomic {
64 run sender(r_s, s_r);
65 run receiver(s_r, r_s)
66 }
67 }
鐃緒申鐃塾プワ申鐃夙ワ申鐃暑が鐃緒申鐃緒申鐃緒申鐃叔￥申鐃緒申鐃緒申転鐃緒申鐃緒申鐃緒申箸鐃緒申鐃縮随申鐃緒申謄鐃緒申箸鐃緒申襪随申鐃祝￥申鐃緒申鐃塾ワ申妊鐃祝はわ申鐃叔にわ申鐃緒申鐃縦わ申鐃緒申 assert 鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申泙鐃緒申鐃�sender 鐃熟ワ申奪鐃緒申鐃緒申鐃緒申箸鐃緒申鐃� MAX 鐃緒申法鐃夙わ申鐃緒申鐃粛常申鐃緒申鐃淑わ申無鐃緒申鐃緒申鐃重常申鐃緒申鐃緒申鐃処う鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃殉わ申鐃緒申MAX 鐃緒申鐃粛は緒申鐃竣ではなわ申鐃緒申鐃竣ワ申鐃夙ワ申鐃緒申鐃緒申鐃叔ワ申鐃緒申鐃緒申鐃緒申鐃瞬刻申鐃緒申鐃緒申丙鐃緒申離鐃緒申鐃緒申鐃緒申任鐃� 2鐃祝わ申鐃緒申腓�鐃緒申鐃緒申于鐃緒申任發�鐃殉わ申鐃殉わ申鐃藷。わ申鐃夙わ申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃渋誌申鐃緒申硫鐃叔緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申箸鐃緒申鐃緒申鐃緒申鐃緒申譴随申如鐃緒申鐃緒申鐃緒申辰鐃緒申鐃緒申蝓�鐃渋わ申鐃舜わ申鐃緒申譴随申蠅刻申襪鰹申箸覆鐃� receiver 鐃緒申鐃熟わ申鐃緒申鐃暑こ鐃夙わ申鐃緒申鐃准わ申鐃緒申鐃緒申鐃塾でわ申鐃緒申40 鐃緒申鐃旬わ申 assert 鐃祝わ申鐃緒申鐃緒申里砲鐃緒申鐃薯検証わ申鐃殉わ申鐃緒申鐃盾し鐃遵記鐃祝書いわ申鐃竣求が鐃緒申鐃緒申鐃緒申鐃淑わ申鐃緒申能鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申蓮鐃緒申鐃緒申鐃� assert 鐃塾逸申反鐃緒申鐃緒申鐃出わ申鐃緒申泙鐃緒申鐃�
鐃叔緒申慮鐃緒申擇任蓮鐃緒申鐃緒申鐃緒申鐃緒申辰鐃緒申鐃緒申鐃塾駕申能鐃緒申鐃緒申鐃淑わ申鐃緒申鐃緒申鐃緒申鐃緒申多鐃緒申鐃緒申鐃緒申討鐃緒申鐃殉わ申鐃緒申
$ spin -a ABP0 $ gcc -o pan pan.c $ ./pan full statespace search for: assertion violations and invalid endstates vector 40 byte, depth reached 131, errors: 0 346 states, stored 1 states, linked 125 states, matched total: 472 hash conflicts: 17 (resolved) (size 2^18 states, stack frames: 0/25) unreached code _init (proc 0): reached all 4 states unreached code receiver (proc 1): line 58 (state 24) reached: 23 of 24 states unreached code sender (proc 2): line 28 (state 27) reached: 26 of 27 states
鐃緒申鐃緒申鐃緒申鐃緒申鐃春わ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃塾件申未鐃緒申鐃緒申鐃緒申鐃緒申譴随申鐃獣ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃瞬わ申鐃熟わ申鐃緒申譴随申鐃緒申箸鐃緒申味鐃緒申鐃銃わ申鐃緒申里砲鐃緒申鐃緒申泙鐃緒申鵝�わ申鐃緒申鐃熟デ￥申鐃緒申鐃緒申鐃緒申鐃淑らず転鐃緒申鐃緒申鐃緒申鐃夙わ申鐃緒申鐃緒申鐃夙はワ申鐃緒申鐃獣ワ申鐃緒申鐃銃わ申鐃殉わ申鐃緒申sender 鐃緒申 receiver 鐃緒申鐃緒申鐃緒申有鐃緒申鐃淑ワ申奪鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申蕕削申鐃緒申蕁種申鐃獣ワ申鐃緒申鐃緒申鐃緒申魎垢鐃緒申討鐃緒申襪逸申鐃殉わ申辰討鐃緒申鐃緒申能鐃緒申鐃盾あ鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申襪随申鐃祝￥申sender 鐃緒申 receiver 鐃緒申鐃淳ワ申鐃緒申鐃緒申鐃緒申覆鐃緒申鐃緒申覆鐃緒申討鐃緒申襪鰹申箸鮗┐鐃緒申謄廛鐃緒申鐃緒申鐃緒申両鐃緒申屬鐃� "鐃竣ワ申鐃緒申鐃曙ス鐃緒申鐃緒申" 鐃塾ワ申戰鐃緒申呂鐃殉わ申鐃淑実際にわ申鐃緒申鐃緒申鐃塾プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔緒申分鐃淑のでわ申鐃緒申鐃祝￥申
鐃緒申鐃緒申妊廛鐃緒申鐃緒申譽刻申鐃緒申屬鐃殉っわ申鐃緒申鐃縮過し鐃淑わ申鐃殉ま実行ワ申鐃緒申鐃緒申鐃暑が鐃緒申鐃緒申鐃瞬わ申鐃緒申鐃緒申鐃緒申鐃淑わ申鐃緒申鐃薯検証でわ申鐃緒申茲�鐃祝なわ申泙鐃緒申鐃緒申鐃緒申鐃塾実行フワ申鐃緒申鐃緒申呂鐃緒申里泙淹箸鐃緒申覆鐃緒申里如鐃緒申離鐃竣ワ申鐃緒申鐃曙ス鐃緒申鐃緒申鐃緒申鐃緒申鮓�つわ申鐃暑た鐃緒申妨鐃緒申撻廛鐃緒申鐃緒申鐃緒申鬟灰鐃術ワ申鐃暑し鐃淑わ申鐃緒申鐃殉わ申鐃緒申
$ gcc -DNP -o pan pan.c $ ./pan -l pan: non-progress cycle (at depth 6) pan: wrote pan.trail full statespace search for: assertion violations and non-progress loops search was not completed vector 44 byte, depth reached 8, loops: 1 12 states, stored 1 states, linked 0 states, matched total: 13 hash conflicts: 0 (resolved) (size 2^18 states, stack frames: 0/1)
鐃緒申未砲鐃緒申函鐃緒申鐃緒申覆鐃緒申箸鐃述とつのノワ申廛鐃緒申鐃緒申譽刻申鐃緒申鐃緒申鐃緒申襪�鐃緒申鐃緒申泙鐃緒申鐃緒申能鐃祝醐申鐃縦わ申鐃緒申鐃緒申里聾鐃緒申撻廛鐃緒申鐃緒申鐃緒申砲鐃緒申 trail 鐃春ワ申鐃緒申鐃緒申砲鐃緒申竜鐃緒申廚鐃緒申鐃渋醐申鐃緒申鐃銃わ申鐃銃￥申鐃緒申鐃緒申鐃薯そわ申鮓�わ申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申侶鐃縮わ申鐃� 2 鐃緒申鐃緒申半鐃祝種申鐃緒申鐃殉わ申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申里罎�鐃淳わ申損鐃緒申鐃緒申鐃緒申鐃駿も繰鐃緒申鐃瞬わ申続鐃緒申鐃緒申鐃銃わ申鐃所、鐃緒申鐃渋ワ申鐃初ー鐃叔わ申鐃緒申鐃緒申鐃緒申鐃初ー鐃緒申鐃緒申鐃緒申鐃藷スとわ申鐃銃はわ申鐃殉わ申鐃緒申鐃薯くわ申鐃緒申泙鐃緒申鵝�ノワ申廛鐃緒申鐃緒申譽刻申鐃緒申鐃緒申鐃緒申襪�鐃緒申鐃緒申鐃緒申存鐃淳わ申鐃緒申里鐃緒申鐃緒申襪随申鐃祝￥申-c 鐃春ラグ鐃緒申箸辰討澆泙鐃緒申鐃�-c 鐃緒申鐃竣ワ申鐃緒申鐃塾逸申鐃緒申鐃緒申 0 鐃緒申鐃緒申鐃所し鐃緒申鐃緒申鐃熟￥申鐃緒申鐃初ー鐃塾刻申弯鐃緒申鐃緒申鐃緒申呂鐃緒申鐃殉わ申鐃緒申
$ pan -l -c0 full statespace search for: assertion violations and non-progress loops vector 44 byte, depth reached 137, loops: 92 671 states, stored 2 states, linked 521 states, matched total: 1194 hash conflicts: 39 (resolved) (size 2^18 states, stack frames: 0/26)
鐃緒申鐃初ー鐃熟￥申92 鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃�-c 鐃緒申鐃竣ワ申鐃緒申鐃緒申 -c1, -c2, -c3, ... 鐃塾よう鐃祝緒申忙箸辰討鐃緒申離鐃緒申鐃緒申鐃緒申鵐垢鐃述とつわ申鐃縦醐申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申能鐃祝醐申鐃縦わ申鐃獣わ申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃渋誌申鐃緒申魴�わ申鐃瞬わ申鐃緒申鐃薯原逸申鐃夙わ申鐃暑エ鐃初ー鐃緒申鐃緒申鐃緒申鐃藷スわ申鐃緒申鐃緒申鐃緒申董鐃緒申鐃緒申鐃緒申鐃緒申戮鐃緒申鐃緒申鮓困蕕刻申鐃緒申箸鐃緒申任鐃緒申泙鐃緒申鐃緒申鐃緒申里鐃緒申鐃緒申 "progress" 鐃緒申 8 文鐃緒申鐃緒申鐃緒申呂泙鐃緒申鐃銃�鐃緒申鐃縦わ申鐃緒申鐃緒申戰鐃緒申鐃獣ワ申鐃緒申鐃緒申鐃緒申損鐃緒申鐃緒申鐃銃わ申鐃緒申胴圈鐃�13, 43, 48 鐃緒申鐃旬）わ申張鐃所、鐃縦るエ鐃初ー鐃緒申鐃緒申鐃緒申鐃緒申鮓�まわ申鐃淑ワ申戰鐃緒申 :: 鐃塾醐申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃�*4鐃緒申
$ spin -a ABP1 $ gcc -DNP -o pan pan.c $ ./pan -l pan: non-progress cycle (at depth 133) pan: wrote pan.trail full statespace search for: assertion violations and non-progress loops search was not completed vector 44 byte, depth reached 136, loops: 1 148 states, stored 2 states, linked 2 states, matched total: 152 hash conflicts: 0 (resolved) (size 2^18 states, stack frames: 0/26)
鐃緒申鐃駿は￥申鐃緒申鐃緒申鐃緒申鐃曙た鐃緒申鐃竣にわ申蠅鰹申離廛鐃緒申肇鐃緒申鐃祝わ申鐃緒申鐃暑真鐃祝随申鐃緒申淵丱鐃緒申鐃緒申鐃緒申蕕�鐃祝わ申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申鐃緒申 2 鐃塾醐申半鐃祝わ申鐃塾居申鐃竣を示わ申鐃殉わ申鐃緒申
$ spin -t -r -s ABP0
<<<<>>>>
proc 1 (sender) line 13, Send err,0,0 -> queue 2 (out)
proc 2 (receiver) line 55, Recv err,0,0 <- queue 2 (in)
proc 2 (receiver) line 56, Send nak,0,0 -> queue 1 (out)
proc 1 (sender) line 19, Recv nak,0,0 <- queue 1 (in)
spin: trail ends after 12 steps
step 12, #processes: 3
_p[0] = 6
proc 2 (receiver) line 36 (state 21)
proc 1 (sender) line 11 (state 6)
proc 0 (_init) line 67 (state 4)
3 processes created
$
$ spin -t -r -s ABP1
...
proc 2 (receiver) line 39, Recv mesg,0,0 <- queue 2 (in)
proc 2 (receiver) line 47, Send err,0,0 -> queue 1 (out)
proc 1 (sender) line 20, Recv err,1,0 <- queue 1 (in)
proc 1 (sender) line 12, Send mesg,0,0 -> queue 2 (out)
proc 2 (receiver) line 39, Recv mesg,0,0 <- queue 2 (in)
proc 2 (receiver) line 52, Send nak,0,0 -> queue 1 (out)
proc 1 (sender) line 21, Recv nak,0,0 <- queue 1 (in)
proc 1 (sender) line 12, Send mesg,0,0 -> queue 2 (out)
proc 2 (receiver) line 39, Recv mesg,0,0 <- queue 2 (in)
proc 2 (receiver) line 52, Send nak,0,0 -> queue 1 (out)
<<<<>>>>
proc 1 (sender) line 21, Recv nak,0,0 <- queue 1 (in)
proc 1 (sender) line 12, Send mesg,0,0 -> queue 2 (out)
proc 2 (receiver) line 39, Recv mesg,0,0 <- queue 2 (in)
proc 2 (receiver) line 52, Send nak,0,0 -> queue 1 (out)
spin: trail ends after 226 steps
...
鐃緒申 2. 鐃緒申鐃初ー鐃塾居申鐃緒申 - 鐃緒申張鐃緒申鐃緒申 Alternating Bit Protocol
鐃述とつの￥申鐃緒申鐃緒申鐃薯示わ申鐃緒申acknowledgment 鐃緒申鐃醇が鐃緒申鐃緒申鐃重常申鐃緒申鐃緒申鐃緒申函鐃�sender 鐃緒申 receiver 鐃緒申無鐃渋ワ申鐃緒申鐃緒申鐃緒申亡戮辰討鐃緒申泙鐃緒申泙鐃緒申鐃�sender 鐃緒申 acknowledgment 鐃緒申鐃緒申鐃緒申鐃獣てわ申鐃淑わ申鐃塾で器申任忘埜鐃緒申鐃緒申鐃獣わ申鐃緒申奪鐃緒申鐃緒申鐃緒申魴�わ申鐃瞬わ申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃緒申鐃殉わ申鐃緒申receiver 鐃緒申泙鐃緒申鐃叔わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃�negative acknowledgment鐃祝わ申鐃緒申鐃緒申鐃緒申櫃鐃渋鰹申鐃緒申泙鐃緒申鐃�
鐃緒申鐃塾マニュア鐃緒申鐃� Spin 鐃塾種申鐃竣な居申能鐃塾鰹申鐃竣と醐申鐃准で使わ申鐃緒申鐃緒申鐃緒申鐃重�鐃淑わ申鐃緒申鐃緒申砲弔鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申鐃祝わ申鐃緒申鐃殉わ申鐃緒申Spin 鐃祝は￥申鐃緒申鐃緒申鐃叔種申鐃遵げ鐃緒申鐃緒申琉奮鐃緒申砲癲�鐃緒申鐃准わ申鐃緒申鐃緒申鐃塾�鐃緒申鐃緒申鐃緒申鐃緒申鐃塾わ申鐃緒申鐃塾�鐃縦でわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申竜鐃叔緒申鐃緒申鐃緒申鐃殉わ申鐃緒申
Spin 鐃叔はまわ申 "鐃緒申鐃緒申鐃緒申" 鐃緒申 "鐃竣居申" 鐃緒申 never-claim 鐃叔ワ申妊覯緒申鐃緒申襪鰹申箸妊鐃緒申鐃緒申謄爐�鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申匹鐃緒申鐃緒申鐃緒申擇鐃緒申襪鰹申箸鐃叔わ申鐃殉わ申鐃緒申鐃醇ー鐃緒申鐃緒申鐃緒申鐃緒申鐃銃ムが達鐃緒申鐃緒申鐃駿わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃� claim 鐃緒申表鐃緒申鐃緒申鐃緒申函鐃�Spin 鐃緒申鐃緒申鐃潤く鐃緒申鐃緒申 claim 鐃緒申鐃緒申鐃緒申立鐃縦誌申鐃緒申鐃緒申鐃緒申鐃緒申襪�鐃緒申反鐃緒申鮗┐鐃緒申任鐃緒申腓�鐃緒申never-claim 鐃緒申B鐃緒申鐃�chi鐃緒申鐃緒申鐃夙マトワ申*5鐃緒申鐃緒申鐃緒申鐃叔￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申弔鐃緒申辰鐃緒申鐃緒申鐃緒申鐃叔ル化鐃緒申能鐃叔わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃出￥申鐃緒申鐃緒申鐃緒申 Spin 鐃叔は￥申鐃竣居申鐃緒申鐃緒申鐃緒申鐃緒申里鐃� LTL 鐃塾刻申文鐃緒申箸鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申鐃�Spin 鐃熟ユー鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃� LTL 鐃薯そわ申鐃緒申鐃緒申鐃緒申鐃� never-claim 鐃緒申鐃術器申鐃緒申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申
Spin 鐃叔はまわ申鐃緒申鐃醇ー鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申屮鐃緒申奪箸鐃獣居申鐃緒申鐃緒申鐃緒申造鐃緒申鐃処う鐃祝ワ申鐃緒申鐃銃ワ申両鐃緒申峩鐃緒申屬鐃縮常申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃緒申覆鐃緒申鐃緒申任鐃� never-claim 鐃緒申鐃緒申僂鐃緒申泙鐃緒申鐃緒申鐃緒申鐃緒申戮肋鐃緒申峩鐃緒申屬鐃緒申擇鐃緒申襪随申鐃祝誌申鐃術わ申鐃殉わ申鐃祝￥申鐃緒申鐃緒申鐃緒申法鐃祝わ申蝓�鐃緒申鐃夙わ申鐃緒申鐃緒申鐃瞬駈申鐃緒申探鐃緒申鐃緒申鐃渋刻申鐃峻駕申能鐃叔も、鐃緒申鐃緒申鐃銃ワ申凌鐃緒申鐃緒申颪い鐃粛随申鐃緒申鐃緒申鐃緒申蕁種申離僖鐃緒申鐃緒申鵑�含まわ申襪�鐃宿わ申鐃緒申鐃薯すばやく鐃緒申鐃准わ申鐃暑こ鐃夙わ申鐃叔わ申鐃殉わ申鐃緒申
鐃緒申鐃緒申鐃� Promela 鐃緒申 Spin 鐃緒申鐃縮の誌申鐃緒申鐃緒申法鐃祝つわ申鐃銃の詳細につわ申鐃銃は￥申[5] 鐃薯参考にわ申鐃銃わ申鐃緒申鐃緒申鐃緒申鐃緒申Spin 鐃出￥申鐃緒申鐃緒申鐃� 2.0 鐃緒申 3.0 鐃叔の鰹申張鐃祝つわ申鐃銃わ申 WhatsNew.html 鐃薯見てわ申鐃緒申鐃緒申鐃緒申鐃緒申
[1] Dijkstra, E.W., ``Guarded commands, non-determinacy and formal derivation of programs.'' CACM 18, 8 (1975), 453-457.
[2] Dijkstra, E.W., ``Solution to a problem in concurrent programming control.'' CACM 8, 9 (1965), 569.
[3] Hoare, C.A.R., ``Communicating Sequential Processes.'' CACM 21, 8 (1978), 666-677.
[4] Holzmann, G.J., ``Algorithms for automated protocol verification.'' AT&T Technical Journal 69, 1 (Jan/Feb 1990). Special Issue on Protocol Testing, Specification, Verification.
[5] Holzmann, G.J., The Spin Model Checker: Primer and Reference Manual (2003), Addison-Wesley.
[6] Kernighan, B.W. and Ritchie, D.M., The C Programming Language. 2nd ed. (1988), Prentice Hall.
byte state = 2;
active proctype A()
{ (state == 1) -> state = 3
}
active proctype B()
{ state = state - 1
}
$ spin -a ABP0
error: ("ABP0":13) label progress_0 placed incorrectly
=====>instead of
do (or if)
:: ...
:: Label: statement
od (of fi)
=====>always use
Label: do (or if)
:: ...
:: statement
od (or fi)
Gerard J. Holzmann 鐃緒申
:: skip -> progress_1: out!err(0,0)鐃夙わ申鐃緒申鐃処う鐃祝わ申鐃緒申个鐃緒申鐃緒申閥鐃緒申鐃緒申討鐃初い鐃殉わ申鐃緒申鐃緒申鐃緒申奪鐃緒申鐃緒申鐃緒申鐃渋誌申鐃緒申鐃緒申討鐃緒申鐃峻￥申14, 52鐃緒申鐃旬）わ申鐃緒申咼鐃緒申蕁種申鐃緒申鐃緒申鐃緒申鐃緒申討鐃緒申鐃峻￥申13, 51鐃緒申鐃旬）にプワ申鐃緒申鐃曙ス鐃緒申戰鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申函鐃緒申鐃淑醐申鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃暑真鐃祝随申鐃緒申淵丱鐃緒申離鐃緒申蕁種申鐃緒申鐃緒申鐃緒申鵐垢鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申焚鐃緒申縫廛鐃緒申鐃緒申譽刻申鐃駿ワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔ワ申鮗┐鐃緒申泙鐃緒申鐃�
1 #define MAX 5
2
3 mtype = { mesg, ack, nak, err };
4
5 proctype sender(chan in, out)
6 { byte o, s, r;
7
8 o=MAX-1;
9 do
10 :: o = (o+1)%MAX; /* next msg */
11 again: if
12 :: out!mesg(o,s) /* send */
13 :: skip -> progress_0: out!err(0,0) /* distort */
14 :: skip -> progress_1: skip /* or lose */
15 fi;
16 if
17 :: timeout -> goto again
18 :: in?err(0,0) -> goto again
19 :: in?nak(r,0) -> goto again
20 :: in?ack(r,0) ->
21 if
22 :: (r == s) -> goto progress
23 :: (r != s) -> goto again
24 fi
25 fi;
26 progress: s = 1-s /* toggle seqno */
27 od
28 }
29
30 proctype receiver(chan in, out)
31 { byte i; /* actual input */
32 byte s; /* actual seqno */
33 byte es; /* expected seqno */
34 byte ei; /* expected input */
35
36 do
37 :: in?mesg(i, s) ->
38 if
39 :: (s == es) ->
40 assert(i == ei);
41 progress: es = 1 - es;
42 ei = (ei + 1)%MAX;
43 if
44 :: out!ack(s,0) /* send, */
45 :: out!err(0,0) /* distort */
46 :: skip /* or lose */
47 fi
48 :: (s != es) ->
49 if
50 :: out!nak(s,0) /* send, */
51 :: skip -> progress_0: out!err(0,0) /* distort */
52 :: skip -> progress_1: skip /* or lose */
53 fi
54 fi
55 :: in?err(0,0) ->
56 out!nak(s,0)
57 od
58 }
59
60 init {
61 chan s_r = [1] of { mtype,byte,byte };
62 chan r_s = [1] of { mtype,byte,byte };
63 atomic {
64 run sender(r_s, s_r);
65 run receiver(s_r, r_s)
66 }
67 }
|
Spin Online References Promela Manual Index Promela Grammar Spin HomePage |
(Page Updated: 30 August 2014) |