Parametric Verification of a Group Membership Algorithm

Abstract

Abstract. We address the problem of verifying clique avoidance in the TTP protocol. TTP allows several stations embedded in a car to communicate. It has many mechanisms to ensure robustness to faults. In particular, it has an algorithm that allows a station to recognize itself as faulty and leave the communication. This algorithm must satisfy the crucial 'non-clique' property: it is impossible to have two or more disjoint groups of stations communicating exclusively with stations in their own group. In this paper, we propose an automatic verification method for an arbitrary number of stations N and a given number of faults k. We give a faithful abstraction that allows to model the algorithm by means of unbounded (parametric) counter automata. We have checked the nonclique property on this model in the case of one fault, using the ALV tool as well as the LASH tool.

FAST: acceleration from theory to practice

“…Each round is divided into as many slots as stations. The protocol behaves as follows (a more complete description can be found in [54,22] …”

“…We use the modeling proposed by Merceron and Bouajjani in [22]. This modeling is based on counter systems.…”

Parametric Verification of a Group Membership Algorithm

“…Section 5 generalizes the approach for a given number of faults k. Section 6 concludes the paper. A preliminary version of this paper has appeared in (Bouajjani and Merceron 2002).…”

An Overview of Formal Verification for the Time-Triggered Architecture

“…Their analysis includes the effects of the rest of the membership algorithm. Bouajjani and Merceron [7] prove that the clique avoidance algorithm, considered in isolation, tolerates multiple asymmetric faults; they also describe an abstraction for the nnode, k-faults parameterized case that yields a counter automaton. Reachability is decidable for this class of systems, and experiments are reported with two automated verifiers for the k = 1 case.…”

“…Concretely, (1) is accomplished for TTA by Pfeifer's verification [40] (and potentially, in more automated form, by extensions to the approaches of [3,7]), (2) should require little more than an adjustment to those proofs, and the hard case is (3). Bouajjani and Merceron's analysis [7] can be seen as establishing C |= QS for the restricted case where the arbitrary initial state is one produced by the occurrence of multiple, possibly asymmetric faults in message transmission or reception. The general case must consider the possibility that the initial state is produced by some outside disturbance that sets the counters and flags of the algorithm to arbitrary values (I have formally verified this case for a simplified algorithm), and must also consider the presence of M and F .…”