Formal verification of a distributed dynamic reconfiguration protocol

Schultz, William; Ian, Dardik,; Tripakis, Stavros

doi:10.1145/3497775.3503688

Cited by 5 publications

(6 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…endive was also able to automatically discover an inductive invariant for a key safety property of MLDR, a Raft-based distributed dynamic reconfiguration protocol [42]. This protocol, reported in Table I as mldr, is a significantly more complex, industrial scale protocol [41]. IC3PO was not able to discover an invariant for our Ivy model of the MLDR protocol after a 1 hour timeout when given the same instance size used in the TLA+ model given to endive.…”

Section: E Discussionmentioning

confidence: 99%

“…To evaluate endive, we measured its performance on 29 protocols selected from an existing benchmark set published in [23]. We also evaluate endive on an additional, industrial scale protocol, MongoLoglessDynamicRaft (MLDR), which is a recent protocol for distributed dynamic reconfiguration in a Raft based replication system [42], [41].…”

Section: B Benchmarksmentioning

confidence: 99%

“…Thus, the standard technique for proving that such a system satisfies a given invariant is to discover an inductive invariant, which is an invariant that is typically stronger than the desired system invariant, and is preserved by all protocol transitions. Discovering inductive invariants, however, is one of the most challenging aspects of verification and remains a non-trivial task with a large amount of human effort required [47], [11], [46], [41]. Thus, automating the inference of these invariants is a desirable goal.…”

Section: Introductionmentioning

confidence: 99%

“…Our technique is partially inspired by prior observations [11], [41], [24], [8] that, for many practical protocols, an inductive invariant I is typically of the form…”

Section: Introductionmentioning

confidence: 99%

“…Our tool solves nearly all of these benchmarks, and compares favorably with other state of the art tools, despite the fact that all of these tools accept Ivy or decidable Ivy fragments as inputs. We also evaluate our tool and other state of the art tools on a more complex, industrial scale protocol, MongoLoglessDynamicRaft (MLDR) [41]. MLDR performs dynamic reconfiguration in a Raft based replication system.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Plain and Simple Inductive Invariant Inference for Distributed Protocols in TLA+

Schultz¹,

Ian²,

Tripakis³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

We present a new technique for automatically inferring inductive invariants of parameterized distributed protocols specified in TLA+. Ours is the first such invariant inference technique to work directly on TLA+, an expressive, high level specification language. To achieve this, we present a new algorithm for invariant inference that is based around a core procedure for generating plain, potentially non-inductive lemma invariants that are used as candidate conjuncts of an overall inductive invariant. We couple this with a greedy lemma invariant selection procedure that selects lemmas that eliminate the largest number of counterexamples to induction at each round of our inference procedure. We have implemented our algorithm in a tool, endive, and evaluate it on a diverse set of distributed protocol benchmarks, demonstrating competitive performance and ability to uniquely solve an industrial scale reconfiguration protocol.

show abstract

Section: E Discussionmentioning

confidence: 99%

Section: B Benchmarksmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…Our technique is partially inspired by prior observations [11], [41], [24], [8] that, for many practical protocols, an inductive invariant I is typically of the form…”

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations