Model checking a self-stabilizing synchronization protocol for arbitrary digraphs

Abstract

This report presents the mechanical verification of a self-stabilizing distributed clock synchronization protocol for arbitrary digraphs in the absence of faults. This protocol does not rely on assumptions about the initial state of the system, other than the presence of at least one node, and no central clock or a centrally generated signal, pulse, or message is used. The system under study is an arbitrary, nonpartitioned digraph ranging from fully connected to 1-connected networks of nodes while allowing for differences in the network elements. Nodes are anonymous, i.e., they do not have unique identities. There is no theoretical limit on the maximum number of participating nodes. The only constraint on the behavior of the node is that the interactions with other nodes are restricted to defined links and interfaces. This protocol deterministically converges within a time bound that is a linear function of the self-stabilization period. A bounded model of the protocol is verified using the Symbolic Model Verifier (SMV) for a subset of digraphs. Modeling challenges of the protocol and the system are addressed. The model checking effort is focused on verifying correctness of the bounded model of the protocol as well as confirmation of claims of determinism and linear convergence with respect to the self-stabilization period.

A self-stabilizing hybrid fault-tolerant synchronization protocol

“…The details of the model checking effort are similar to [22], where the models of the system components and their data structures are fully described and similar abstractions are employed with respect to the size of the model and real-time delays. We do not restate the details of model checking effort here.…”

“…Instead, we focus on the model checking results. Similar to [22], the Symbolic Model Verifier (SMV) was used in the modeling of this protocol on a PC with 4GB of memory running Linux [23]. SMV's language description and modeling capability provide relatively easy translation from the pseudo-code.…”

“…The discretization is used for practical purposes in implementing and model checking the protocol. Since continuous time modeling is impracticable, we used the same abstractions as in [22] for discrete time.…”