A verified implementation of priority monitors in java

  • Authors:
  • Ángel Herranz;Julio Mariño

  • Affiliations:
  • Babel Research Group, Universidad Politécnica de Madrid, Spain;Babel Research Group, Universidad Politécnica de Madrid, Spain

  • Venue:
  • FoVeOOS'11 Proceedings of the 2011 international conference on Formal Verification of Object-Oriented Software
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

Java monitors as implemented in the java.util.concurrent.locks package provide no-priority nonblocking monitors. That is, threads signalled after blocking on a condition queue do not proceed immediately, but they have to wait until both the signalling thread and possibly some of the others which have requested the lock release it. This can be a source of errors (if threads that get in the middle leave the monitor in a state incompatible with the signalled thread re-entry) or inefficiency (if repeated evaluation of preconditions is used to ensure safe re-entry). A concise implementation of priority nonblocking monitors in Java is presented. Curiously, our monitors are implemented on top of the standard no-priority implementation. In order to verify the correctness of our solution, a formal transition model (that includes a formalisation of Java locks and conditions) has been defined and checked using Uppaal. This model has been adapted to PlusCal in order to obtain a formal proof in TLA independent of the number of threads.