Multi-parameterised compositional verification of safety properties

Siirtola, Antti; Kortelainen, Juha

doi:10.1016/j.ic.2015.08.002

Cited by 4 publications

(39 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The operators and the trace refinement relation have many useful properties [12], [28], [29], which are exploited in the proofs. The parallel composition is commutative, associative, and idempotent with respect to ≡ tr (i.e., L L ≡ tr L for all LTSs L) and a single-state LTS L id := ({ṡ}, ∅, ∅,ṡ) with the empty alphabet and no transition is the identity element of .…”

Section: Labelled Transition Systemsmentioning

confidence: 99%

“…and every set E of visible events [12]. Finally, tr is compositional with respect to the parallel composition and hiding operators; if…”

Section: Labelled Transition Systemsmentioning

confidence: 99%

“…Technically, our approach is based on parameterised labelled transition systems (PLTSs) [12], where a system implementation and specification are basically expressed as the parallel composition of labelled transition systems (LTSs). On the implementation side, one can use hiding, too, and correctness is understood as trace refinement, which allows for the analysis of safety properties.…”

Section: Introductionmentioning

confidence: 99%

“…However, systems with a quorum topology are not supported since in order to specify a quorum set, we should be able to say that for each element not in the set, there is a unique element in the set. This requires the use of existential quantification, which makes the verification problem undecidable [12]. Another possibility to model quorum sets is to use a counter over replicated components, but also this quickly leads to undecidability.…”

Section: Introductionmentioning

confidence: 99%

“…The whole process is implemented by extending Bounds tool, earlier introduced in [14]. In order to handle the QFVs, the results of [12] are not only adapted to take QFVs into account but several completely new results (Proposition 21, Lemma 23, Proposition 24, and Proposition 26) on the cut-offs of quorum sets are introduced.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Refinement Checking Parameterised Quorum Systems

Siirtola

2017

2017 17th International Conference on Application of Concurrency to System Design (ACSD)

Self Cite

View full text Add to dashboard Cite

Many fault-tolerant algorithms are based on decisions made by a quorum of nodes. Since the algorithms are utilised in safety critical applications such as distributed databases, it is necessary to make sure that they operate reliably under every possible scenario. We introduce a generic compositional formalism, based on parameterised labelled transition systems, which allows us to express safety properties of parameterised quorum systems. We prove that any parameterised verification task expressible in the formalism collapses into finitely many finite state refinement checking problems. The technique is implemented in a tool, which performs the verification completely automatically. As an example, we prove the leader election phase of the Raft consensus algorithm correct for an arbitrary number of terms and for a cluster of any size.

show abstract

Section: Labelled Transition Systemsmentioning

confidence: 99%

“…and every set E of visible events [12]. Finally, tr is compositional with respect to the parallel composition and hiding operators; if…”

Section: Labelled Transition Systemsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Refinement Checking Parameterised Quorum Systems

Siirtola

2017

2017 17th International Conference on Application of Concurrency to System Design (ACSD)

Self Cite

View full text Add to dashboard Cite

show abstract

Dynamic Cut-Off Algorithm for Parameterised Refinement Checking

Siirtola

Heljanko

2018

Formal Aspects of Component Software

Self Cite

View full text Add to dashboard Cite

The verification of contemporary software systems is challenging, because they are heavily parameterised containing components, the number and connections of which cannot be a priori fixed. We consider the multi-parameterised verification of safety properties by refinement checking in the context of labelled transition systems (LTSs). The LTSs are parameterised by using first-order constructs, sorts, variables, and predicates, while preserving compositionality. This allows us to parameterise not only the number of replicated components but also the system topology, the connections between the components. We aim to solve a verification task in the parameterised LTS formalism by determining cut-offs for the parameters. As the main contribution, we convert this problem into the unsatisfiability of a first-order formula and provide a SAT modulo theories (SMT)-based semi-algorithm for dynamically, i.e., iteratively, computing the cut-offs. The algorithm will always terminate for topologies expressible in the ∃ * ∀ * fragment of first-order logic. It also enables us to consider systems with topologies beyond this fragment, but for these systems, the algorithm is not guaranteed to terminate. We have implemented the approach on top of the Z3 SMT solver and successfully applied it to several system models. As a running example, we consider the leader election phase of the Raft consensus algorithm and prove a cut-off of three servers which we conjecture to be the optimal one.

show abstract

An automata-theoretic approach to the verification of distributed algorithms

Aiswarya¹,

Bollig²,

Gastin³

2018

Information and Computation

View full text Add to dashboard Cite

We introduce an automata-theoretic method for the verification of distributed algorithms running on ring networks. In a distributed algorithm, an arbitrary number of processes cooperate to achieve a common goal (e.g., elect a leader). Processes have unique identifiers (pids) from an infinite, totally ordered domain. An algorithm proceeds in synchronous rounds, each round allowing a process to perform a bounded sequence of actions such as send or receive a pid, store it in some register, and compare register contents wrt. the associated total order. An algorithm is supposed to be correct independently of the number of processes. To specify correctness properties, we introduce a logic that can reason about processes and pids. Referring to leader election, it may say that, at the end of an execution, each process stores the maximum pid in some dedicated register. Since the verification of distributed algorithms is undecidable, we propose an underapproximation technique, which bounds the number of rounds. This is an appealing approach, as the number of rounds needed by a distributed algorithm to conclude is often exponentially smaller than the number of processes. We provide an automata-theoretic solution, reducing model checking to emptiness for alternating two-way automata on words. Overall, we show that round-bounded verification of distributed algorithms over rings is PSPACE-complete. * Supported by LIA InForMel. arXiv:1504.06534v1 [cs.LO] 24 Apr 2015 view but expressive enough to formulate correctness properties. In this paper, we propose a language that can reason about processes, states, and pids. In particular, it will allow us to formalize when a leader-election algorithm is correct: At the end of an execution, every process stores, in register r, the maximum pid among all processes. Our language is inspired by Data-XPath, which can reason about trees over infinite alphabets [4,5,12].However, formal verification of distributed algorithms cumulates various difficulties that already arise, separately, in more standard verification: First, the number of processes is unknown, which amounts to parameterized verification [11]; second, processes manipulate data from an infinite domain [5,12]. In each case, even simple verification questions are undecidable, and so is the combination of both.In various other contexts, a successful approach to retrieving decidability has been a form of bounded model checking. The idea is to consider correctness up to some parameter, which restricts the set of runs of the algorithm in a non-trivial way. In multi-threaded recursive programs, for example, one may restrict the number of control switches between different threads [20]. Actually, this idea seems even more natural in the context of distributed algorithms, which usually proceed in rounds. In each round, a process may emit some messages (here: pids) to its neighbors, and then receive messages from its neighbors. Pids can be stored in registers, and a process can check the relation between stored pids before it moves to a new ...

show abstract

Multi-parameterised compositional verification of safety properties

Cited by 4 publications

References 31 publications

Refinement Checking Parameterised Quorum Systems

Refinement Checking Parameterised Quorum Systems

Dynamic Cut-Off Algorithm for Parameterised Refinement Checking

An automata-theoretic approach to the verification of distributed algorithms

Contact Info

Product

Resources

About