---
title: 'Scoop-Check: SCOOP Verification Pipelines'
url: https://www.emergentmind.com/topics/scoop-check
type: topic
---

# Scoop-Check: SCOOP Verification Pipelines

to=arxiv_search.search  天天中彩票微信  北京赛车投注  {
  "query": "id:1504.02611 OR id:1504.07041 OR id:1505.05265 OR id:1409.7514 OR id:1101.1038",
  "max_results": 10,
  "sort_by": "submittedDate",
  "sort_order": "descending"
}
to=arxiv_search.search  天天中彩票未json ացին  {
  "query": "\"Towards Practical Graph-Based Verification for an Object-Oriented Concurrency Model\"",
  "max_results": 5,
  "sort_by": "relevance",
  "sort_order": "descending"
}
“Scoop-Check” is an *Editor’s term* for the family of formal verification and analysis pipelines developed for SCOOP, the Simple Concurrent Object-Oriented Programming model. In this usage, Scoop-Check denotes executable semantic frameworks that analyze SCOOP programs directly from source code or via automatic translation, with particular emphasis on deadlock detection, temporal-logic verification, alias analysis, and consistency checking. The term covers two closely related lines of work: a Rewriting Logic/Maude toolbox that integrates a Coffman deadlock detector and alias analyzer, and a graph-transformation workflow that translates SCOOP into GROOVE models based on CPM and CPM+OO [1409.7514] [1504.07041] [1504.02611] [1505.05265].

## 1. Formal basis in the SCOOP execution model

SCOOP associates every object with a processor, or handler, responsible for executing that object’s routines. Calls on non-separate targets are synchronous and execute on the caller’s processor, whereas calls on separate targets are issued to the supplier’s processor. Separate commands are asynchronous; separate queries are synchronous by necessity. Preconditions over separate targets act as wait conditions, so a caller may release locks and wait until the condition holds rather than failing immediately. These properties make deadlock and scheduling behavior depend on request queues, lock acquisition, and queue discipline rather than on explicit low-level mutex operations [1101.1038].

The full operational account is given as a state-based semantics with regions, heap, and store, and with configurations of the form
$$
\langle p_1 :: St_1 \mid \dots \mid p_n :: St_n, \sigma \rangle,
$$
where the $p_i$ are handlers, the $St_i$ are instruction stacks, and $\sigma$ is the global state. The semantics distinguishes request queue locks and call stack locks, models runtime operations such as `issue`, `lock`, `unlock`, `pass_locks`, `revoke_locks`, `eval`, `wait`, `result`, and `notify`, and treats precondition checking, postcondition checking, once routines, and deep import as first-class semantic mechanisms rather than external implementation details. This suggests that Scoop-Check is fundamentally tied to executable semantics rather than to ad hoc trace inspection [1101.1038].

A concise way to situate the main Scoop-Check variants is the following.

| Paper | Semantic substrate | Primary checking focus |
|---|---|---|
| "Coffman deadlocks in SCOOP" [1409.7514] | Maude / Rewriting Logic | Coffman-style deadlock detection |
| "On the Verification of SCOOP Programs" [1504.07041] | Maude / Rewriting Logic | Deadlock detection and alias analysis |
| "Towards Practical Graph-Based Verification for an Object-Oriented Concurrency Model" [1504.02611] | GROOVE / GTS | Deadlocks and behavioral properties from source |
| "Modelling and Verifying an Object-Oriented Concurrency Model in GROOVE" [1505.05265] | GROOVE / GTS | Source-level verification with CPM+OO |

## 2. Graph-transformation Scoop-Check in GROOVE

The graph-based line of Scoop-Check encodes SCOOP runtime configurations as typed graphs and operational steps as graph transformation rules. Its front end automatically translates SCOOP source, using ANTLR4 and an existing SCOOP grammar, into GROOVE input graphs in GXL. No additional annotations are required. The runtime semantics is organized around CPM, the Concurrent Processor Model, and CPM+OO, which extends CPM with full object orientation, multiple objects per processor, local and non-separate calls, call stacks and recursion, arbitrary attribute names, separate queries in expressions, reference expressions, and optional postcondition checking [1504.02611].

In CPM and CPM+OO, processors, request queues, locks, control-flow automata, and local memory are explicit graph entities. The semantics separates action rules from scheduling rules. Action rules encode atomic processor behavior such as `assign`, `command`, `query`, `lock`, `unlock`, and `create processor`; scheduling rules encode queue management, local pre/post-processing, and deterministic advancement of processors between atomic actions. The CPM prototype contains 19 action rules and 34 scheduling rules. GROOVE then explores the induced labeled transition system, supports LTL checking and bounded exploration, and treats properties as highest-priority error rules [1504.02611].

The deadlock criterion is structural. If $W \subseteq Proc \times Proc$ is the wait-for relation, then a deadlock occurs when
$$
D \equiv \exists p_1,\dots,p_k \;.\; k \ge 2 \;\land\; \bigwedge_{i=1}^{k} (p_i W p_{i+1}) \;\land\; p_{k+1} = p_1.
$$
Verification proceeds by checking
$$
\mathbf{AG}\,\neg D \quad \text{equivalently} \quad \neg \mathbf{F}\,\textit{error\_deadlock},
$$
or, for reachability, by searching for
$$
\mathbf{F}\,\textit{error\_deadlock}.
$$
This formulation is operational rather than purely denotational: GROOVE matches an `error_deadlock` rule against a cycle of processors poised before lock actions whose requested handlers are already locked by other processors in the cycle [1504.02611].

The later GROOVE development refines this picture with CPM+OO, explicit frames, lock passing, dynamic treatment of preconditions versus wait conditions, and a token optimization that collapses many local interleavings while preserving queue-relevant concurrency. The translation pipeline operates on unmodified SCOOP source and emits start graphs, type graphs, and rule systems suitable for property checking directly in GROOVE [1505.05265].

## 3. Rewriting-logic Scoop-Check in Maude

The Maude line of Scoop-Check embeds analysis directly into the SCOOP executable semantics formalized in Rewriting Logic. The resulting toolbox integrates two analyses under the same semantic roof: a Coffman deadlock detector and an alias analyzer. Programs are executed by Maude rewriting, optionally under analysis modes such as `aliasing-on` or `deadlock-on`, and Maude’s LTL model checker and search facilities are reused “for free” [1504.07041].

The deadlock detector is formulated in terms of waiting and holding sets. If $W(p)$ is the set of handlers that processor $p$ is waiting to lock and $H(p')$ is the set of handlers currently held by $p'$, then a deadlock is detected when
$$
(\exists D \subseteq \sigma.\textnormal{procs})\;.\;(\forall p \in D)\;(\exists p' \in D)\;(p \neq p')\;\land\;\big(W(p)\cap H(p')\neq \emptyset\big).
$$
The executable Maude rule rewrites a matching configuration to `deadlock`. Corresponding temporal formulas are written as reachability,
$$
\mathbf{F}\;\textnormal{deadlock},
$$
or deadlock freedom,
$$
\mathbf{G}\;\neg\textnormal{deadlock}.
$$
The earlier deadlock-only presentation already uses this Coffman-style condition, with processors waiting on `lock({q_i,\ldots})` at the tops of their stacks and lock ownership given by $\sigma.\mathrm{rq\_locks}(p)$ [1409.7514].

The alias component extends a previously introduced alias calculus to unbounded executions such as loops and recursive calls. Expressions are access paths, alias relations are symmetric and irreflexive, and the executable specification uses K-style cells to maintain the current alias relation and backtracking information. A key device is the lasso-based regular over-approximation:
$$
\textnormal{lasso}(r,r') \iff [x_1 y_1 z_1, x_2 y_2 z_2]\in r \;\text{iff}\; [x_1 y_1 y_1 z_1, x_2 y_2 y_2 z_2]\in r',
$$
with
$$
\textnormal{reg}(r,r') = \{[x_1 y_1^* z_1, x_2 y_2^* z_2] \mid [x_1 y_1 z_1, x_2 y_2 z_2] \in r \land [x_1 y_1 y_1 z_1, x_2 y_2 y_2 z_2] \in r'\}.
$$
In non-concurrent settings, this yields a sound over-approximation of may-alias information with no false negatives and a procedure that always stops [1504.07041].

This Maude-based Scoop-Check is therefore not limited to lock-cycle recognition. It also supports alias-driven abstraction of the semantics, in which condition evaluation can be replaced by branch-wise alias union, and non-essential runtime details can be removed to reduce the state space for deadlock analysis [1504.07041].

## 4. Checked properties, examples, and reported performance

Deadlock detection is the canonical Scoop-Check use case, and the literature repeatedly studies Dining Philosophers. In the correct variant, the routine `eat(left, right: separate FORK)` atomically locks both fork handlers before proceeding. In the faulty variant, philosophers acquire the left fork and right fork separately, producing a cycle in the wait-for relation. In the GROOVE-based semantics, `error_deadlock` then matches the deadlocked configuration and GROOVE returns a witness path with the deadlock cycle highlighted [1504.02611].

The graph-based evaluation reports five SCOOP programs across ten benchmark configurations, including Dining Philosophers, Producer–Consumer, Dining Savages, and Cigarette Smokers. State spaces reach hundreds of thousands of states and transitions. For Dining Philosophers with five philosophers, the deadlock-possible variant `DPB (5)` requires an LTL check of 175 s over about 75k states and full exploration of 204 s over about 123k states, with peak memory around 5.6 GB; the correct variant `DPE (5)` requires about 20k states in about 30 s with around 4.2 GB memory. Smaller instances complete within seconds [1504.02611].

The later CPM+OO evaluation gives a more detailed view of source-level verification. With token optimization, `DP(3,1,eat)` yields 2976 states and 3134 transitions in about 3.1 s, while `DP(7,1,eat)` reaches 132,518 states in about 203 s. For the faulty case, `DP(6,1,bad_eat)` reaches 662,009 states in about 964 s, and LTL deadlock checking for `DP(6,1,bad_eat)` explores 441,416 states in about 2151 s before finding a counterexample. The same framework also checks `error_Postcondition_Fail`, `error_Command_Void_Target`, and `error_Query_Void_Target`, and it confirms that some Dining Savages variants do not deadlock but may enter infinite wait-condition loops, a liveness issue outside the current deadlock rules [1505.05265].

The Maude line reports both guided rewriting and model checking. Strategy-driven rewriting finds a deadlock in the two-philosopher case after 479,677 rewrites and about 7.4 s real time, whereas LTL search on the alias-reduced semantics finds one deadlock at state 769,167 after 342,475,817 rewrites and 1,226,403 ms real time. The contrast is significant: strategy-guided execution can be practical, but exhaustive temporal reasoning remains expensive even after abstraction [1504.07041].

## 5. Semantic plurality, abstractions, and limitations

A recurring issue in Scoop-Check is that SCOOP has several partially conflicting semantic formalisations, both theoretical and by-implementation. The GROOVE-based work addresses this by proposing a modular, parameterizable runtime model that captures common features across known semantics and allows queue-related submodules to be swapped. One explicit example is the ability to change request handling from FIFO queues to a queue-of-queues discipline by modifying the queue module and affected rules. Another is verification by over-approximation, such as replacing FIFO queues with bags; verification on the approximation implies verification on the concrete model, but counterexamples may be spurious [1504.02611].

Coverage is deliberately incomplete. The Maude toolbox notes that state explosion is driven by the size of the full SCOOP formalization, including garbage collection, exceptions, region administration, and channel indexing. Proposed mitigations include semantic slicing, elimination of the parallelism lifting rule, removal of index-based channel naming, and alias-based abstract semantics. However, alias over-approximation is sound only in non-concurrent settings, and its use in concurrent contexts must be treated carefully because it may introduce false positives [1504.07041].

The source-level GROOVE workflow also targets a subset of SCOOP. Supported features include processors and request queues, separate references and handler locking, asynchronous commands, synchronous queries and the `result` variable, simultaneous atomic reservations, non-separate calls, call stacks and recursion, separate queries in expressions, reference expressions, and optional postcondition checks. Not yet covered are inheritance, agents, once routines, exceptions, separate callbacks, and some Eiffel-specific mechanisms. The CPM+OO translator further excludes inheritance, generics, expanded types beyond integer and boolean, class invariants, `old` in postconditions, and general exception support [1504.02611] [1505.05265].

A common misconception is that Scoop-Check establishes complete automation for arbitrary SCOOP/Eiffel programs. The reported systems operate directly on source code without annotations, but they do so for restricted fragments and under explicit abstraction choices. Another misconception is that deadlock checking exhausts the verification problem. The literature makes clear that void calls, postcondition violations, aliasing, and infinite wait-condition behaviors are distinct concerns with different rule encodings and different scalability profiles [1505.05265].

## 6. Significance and generalization

The central significance of Scoop-Check is methodological. The SCOOP literature moves from a comprehensive operational semantics detailed enough to guide compiler and runtime implementation, to concrete verification pipelines that analyze SCOOP programs directly from source without manual annotations [1101.1038] [1504.02611]. In the graph-based line, the key step is automatic translation to a typed graph that instantiates CPM or CPM+OO and is then explored by GROOVE. In the rewriting-logic line, the key step is embedding deadlock detection and alias analysis into the original executable semantics so that rewriting and temporal checking can be reused as analysis engines [1504.07041].

This yields a distinctive verification architecture. Runtime entities are made explicit; atomic action rules encode asynchronous behavior; scheduling is controlled through prioritized rules or strategies; and properties are reduced to error rules or temporal formulas. The approach is practical in the limited but important sense emphasized by the literature: it permits direct analysis of SCOOP source programs, supports simulation and counterexample generation, and exposes semantic design choices such as lock passing, queue discipline, and wait-condition handling [1504.02611] [1505.05265].

The broader implication is that Scoop-Check is transferable beyond SCOOP itself. The graph-based work explicitly argues that the same architecture—typed graphs for runtime entities, atomic action rules for core asynchronous behavior, prioritized scheduling, and error-rule verification—should be transferable to other concurrent languages and libraries, including Grand Central Dispatch and CAMEO. This suggests that Scoop-Check is not merely a checker for one language fragment, but a reusable pattern for building executable, source-level verifiers for object-oriented concurrency models [1504.02611].

In that sense, Scoop-Check names a convergence of semantics engineering and verification practice: SCOOP programs are made analyzable by turning their runtime model into a formal executable artifact, and correctness questions are answered by exploring or model-checking that artifact rather than by informal reasoning alone.

Source: https://www.emergentmind.com/topics/scoop-check