X Meets Z: Verifying Correctness In The Presence Of POSIX Threads Bart Massey Robert Bauer Computer Science Department Rational Software Corporation Portland State University 1920 Amberglen Pkwy, Suite 200 Portland, Oregon USA 97207–0751 Beaverton, Oregon USA 97006
[email protected] [email protected] Abstract and guide the development of resulting code. While this approach is not a panacea, it typically does dramatically The engineering of freely-available UNIX software nor- reduce the likelihood of defects and increase confidence mally utilizes an informal analysis and design process in the developed system. A more surprising finding of coupled with extensive user testing. While this approach most of these case studies, confirmed by the authors’ ex- is often appropriate, there are situations for which it pro- perience in teaching formal methods to industrial prac- duces less-than-stellar results. titioners, is that Z-like lightweight formal methods are quite accessible to reasonably experienced software en- A case study is given of such a situation that arose dur- gineers. In fact, in many studies, the savings in time and ing the design and implementation of a thread-safe li- effort due to reduced defect rates has exceeded the extra brary for interaction with the X Window System. XCB cost of judiciously-applied formal analysis. is a C binding library for the X protocol designed to work transparently with either single-threaded or multi- Thus, using the Z notation to construct a lightweight threaded clients. Managing XCB client thread access to problem model can enable the construction of an algo- the X server while honoring the constraints of both XCB rithm for controlling client thread access to the server and the X server is thus a delicate matter.