A Framework for Certified Self-Stabilization

Abstract

Abstract. We propose a general framework to build certified proofs of distributed selfstabilizing algorithms with the proof assistant Coq. We first define in Coq the locally shared memory model with composite atomicity, the most commonly used model in the self-stabilizing area. We then validate our framework by certifying a non trivial part of an existing silent self-stabilizing algorithm which builds a k-clustering of the network. We also certify a quantitative property related to the output of this algorithm. Precisely, we show that the computed k-clustering contains at most n−1 k+1 + 1 clusterheads, where n is the number of nodes in the network. To obtain these results, we also developed a library which contains general tools related to potential functions and cardinality of sets.

sasa: A SimulAtor of Self-stabilizing Algorithms

“…Furthermore, SASA could be connected to the PADEC framework [1], which provides libraries to develop mechanically checked proofs of self-stabilizing algorithms using the Coq proof assistant [4]. Since Coq is able to perform automatic OCAML program extraction, we should be able to simulate the certified algorithms using the same source.…”

“…Self-stabilization is defined in the reference book of Dolev [9] as a conjunction of two properties: convergence, which requires every execution of the algorithm to eventually reach a legitimate configuration; and correctness, which requires every execution starting from a legitimate configuration to satisfy the specification. Since an arbitrary configuration may be the result of transient faults, 1 self-stabilization is considered as a general approach for tolerating such faults in a distributed system.…”

“…Actually, this is mainly due to the fact that, in contrast with This is a Pre-print version of an article accepted for publication at TAP 2020 (Bergen, Norway) This study was partially supported by the French ANR projects ANR-16-CE40-0023 (DESCARTES) and ANR-16 CE25-0009-03 (ESTATE). 1 A transient fault occurs at an unpredictable time, but does not result in a permanent hardware damage. Moreover, as opposed to intermittent faults, the frequency of transient faults is considered to be low.…”

Space-Time Universality of Field Calculus

“…Values associated with data constructors c of arity zero (e.g., literal values) are written by omitting the empty parentheses, i.e., we write c instead of c(). In case b is a binary built-in operator, we allow infix notation to enhance readability: e.g., we shall sometimes write 1 + 2 for + (1,2).…”

“…Stabilisation guarantees that a limit exists, but in general such a limit could highly depend on "transient environmental changes". A stronger property, more useful in practical applications is self-stabilisation [1,20,26,35], additionally guaranteeing full-independence to transient changes as defined in the following.…”