Verification of Threshold-Based Distributed Algorithms by Decomposition to Decidable Logics

Abstract

Verification of fault-tolerant distributed protocols is an immensely difficult task. Often, in these protocols, thresholds on set cardinalities are used both in the process code and in its correctness proof, e.g., a process can perform an action only if it has received an acknowledgment from at least half of its peers. Verification of threshold-based protocols is extremely challenging as it involves two kinds of reasoning: first-order reasoning about the unbounded state of the protocol, together with reasoning about sets and cardinalities. In this work, we develop a new methodology for decomposing the verification task of such protocols into two decidable logics: EPR and BAPA. Our key insight is that such protocols use thresholds in a restricted way as a means to obtain certain properties of "intersection" between sets. We define a language for expressing such properties, and present two translations: to EPR and BAPA. The EPR translation allows verifying the protocol while assuming these properties, and the BAPA translation allows verifying the correctness of the properties. We further develop an algorithm for automatically generating the properties needed for verifying a given protocol, facilitating fully automated deductive verification. Using this technique we have verified several challenging protocols, including Byzantine one-step consensus, hybrid reliable broadcast and fast Byzantine Paxos.

Verification of randomized consensus algorithms under round-rigid adversaries

“…To do so, first we introduce two round invariants (4) and (5). The rest of the section is then devoted to proving that these round invariants imply the consensus properties agreement and validity.…”

TLA+ model checking made symbolic

“…Indeed, many reduction rules can be optimized for fragments of TLA + . For instance, we could write more efficient rules for functions with linearly ordered domains such as integers, or rules for comparing set cardinalities to integers [Berkovits et al 2019;Kuncak et al 2005]. More importantly, our framework opens the door for applying more advanced techniques such as abstraction [Ball et al 2001;Clarke et al 2003] and reduction [Cohen and Lamport 1998;Lipton 1975].…”

“…Moreover, it is common to use powersets, sets of functions, and set cardinalities in TLA + specifications. Multiple techniques were developed for sets and cardinalities in SMT [Berkovits et al 2019;Cristiá and Rossi 2016;Drăgoi et al 2014;Kuncak et al 2005;Tinelli et al 2018;von Gleissenthall et al 2016;Yessenov et al 2010]. Although these techniques can be used to reason about some TLA + expressions, they pose various constraints on the set theory that would not easily accommodate typical TLA + specifications.…”

Parameterized Verification of Systems with Global Synchronization and Guards

“…Distributed applications are notoriously difficult to implement and reason about, primarily due to the combinatorial explosion of behaviors resulting from the interleaving of computation and communication. Naturally, they have received a lot of attention from the formal methods community to facilitate reasoning about correctness properties that are too complex to reason about informally or manually [3,7,14,15,34,36,42,46,50,52,55].…”