Parameterized Model Checking of Synchronous Distributed Algorithms by Abstraction

Abstract

Parameterized verification of fault-tolerant distributed algorithms has recently gained more and more attention. Most of the existing work considers asynchronous distributed systems (interleaving semantics). However, there exists a considerable distributed computing literature on synchronous fault-tolerant distributed algorithms: conceptually, all processes proceed in lock-step rounds, that is, synchronized steps of all (correct) processes bring the system into the next state. We introduce an abstraction technique for synchronous fault-tolerant distributed algorithms that reduces parameterized verification of synchronous fault-tolerant distributed algorithms to finite-state model checking of an abstract system. Using the TLC model checker, we automatically verified several algorithms from the literature, some of which were not automatically verified before. Our benchmarks include fault-tolerant algorithms that solve atomic commitment, 2-set agreement, and consensus. I(n, t, f) parameterized system J abstract system pseudocode manual encoding model checking with TLC assign values to n, t, f model checking fixed size system [10, 25, 48, 51] automatic model checking with TLC model checking abstract system [22, 24, 27, 28, 29] automatic pattern-based predicate abstraction patterns provided by user data and counter abstraction automated predicate abstraction [23] CMP [13, 32, 40] counter abstraction [24, 46]

Communication-Closed Asynchronous Protocols

“…Then we prove the leader election outer loop correct. Its specification states that there is at most one leader in a ballot (like in (1)) and that a majority of processes have the same prefix, consisting of all the committed commands. The leader picks the longest log of its followers.…”

Communication-Closed Layers as Paradigm for Distributed Systems: A Manifesto

“…Such systems can be effectively verified with different methods. In the literature, we already find results using the following methods: a domain-specific consensus logic with decision procedures [11], [12], and methods to infer invariants [47], cut-off results [35], for model checking abstraction-based model checking [1], bounded model checking [45], [44], interactive theorem provers and finite state model checking [7], [8].…”

A Gals Approach for Pogramming Distributed Interactive Multimedia Applications

“…The deployment of synchronous applications in such architectures rises some issues that has driven several researches. Asynchronous interactions [1,43], synchronous semantic preservation [44,45], automatic distributed code generation [46,47,48], verification of synchronous distributed applications [49,50] are some examples of these problems. Here we focus on the asynchronous interactions issue.…”

“…The fourth changes the current slide in response to the event SHOW_SLIDE (lines [40][41][42][43]. And finally, the last trail reacts to each occurrence of the event SEEK, performing a seek operation, and then withdraws the control from the student (i.e., it sets the variable control to 0) broadcasting this to all students (lines [45][46][47][48][49][50]. Now let's focus on the students program, whose source code is depicted in Listing 6.5.…”

“…Back to the mapping script, it iterates over the student table in lines 13and 18-20, calling the function link (lines [36][37][38][39][40][41][42][43][44][45][46][47][48][49] to define the other mappings of this application. These maps are: -teacher's "NEW_SLIDE" event to students' "SHOW_SLIDE" event, also using the slideTransf function; -teacher's "REPLY_CONTROL" event to students' "CONTROL_CHANGED"; -teacher's "PERFORM_SEEK" event to students' "SEEK"; -students' "TRY_GET_CONTROL" event to teacher's "REQUEST_CONTROL"; -students' "REWIND" event to teacher's "SEEK_REQUEST", using a filter function that tests if the student who has emitted the "REWIND" indeed is the one who has the control over the video.…”