Formal Specification and Verification Using +CAL: An Experience Report

We present a case study on the use of the +CAL specification language as applied to the process interaction semantics of the MPI standard. We also present preliminary, but highly encouraging, results from a generalization of the notion of cluster-based partial-order reduction in the context of +CAL model checking. Called generalized static reduction (GSR), this approach takes advantage of the commuting nature of many MPI send/receive operation types. Preliminary results confirm that +CAL is a user-friendly and less error-prone notation than TLA+ (into which +CAL compiles), and syntactically supports the kind of transition annotations that GSR requires. Our preliminary evaluation of GSR on a simple example shows that with it, TLC (the TLA+ model checker) can handle a 128-process model in 8 hours, when all conceivable alternatives on this example will not finish their state enumeration.