A short counterexample property for safety and liveness verification of fault-tolerant distributed algorithms

Abstract

Distributed algorithms have many mission-critical applications ranging from embedded systems and replicated databases to cloud computing. Due to asynchronous communication, process faults, or network failures, these algorithms are difficult to design and verify. Many algorithms achieve fault tolerance by using threshold guards that, for instance, ensure that a process waits until it has received an acknowledgment from a majority of its peers. Consequently, domain-specific languages for fault-tolerant distributed systems offer language support for threshold guards.We introduce an automated method for model checking of safety and liveness of threshold-guarded distributed algorithms in systems where the number of processes and the fraction of faulty processes are parameters. Our method is based on a short counterexample property: if a distributed algorithm violates a temporal specification (in a fragment of LTL), then there is a counterexample whose length is bounded and independent of the parameters. We prove this property by (i) characterizing executions depending on the structure of the temporal formula, and (ii) using commutativity of transitions to accelerate and shorten executions. We extended the ByMC toolset (Byzantine Model Checker) with our technique, and verified liveness and safety of 10 prominent fault-tolerant distributed algorithms, most of which were out of reach for existing techniques.

TLA+ model checking made symbolic

“…More importantly, our framework opens the door for applying more advanced techniques such as abstraction [Ball et al 2001;Clarke et al 2003] and reduction [Cohen and Lamport 1998;Lipton 1975]. Reductions were shown to be efficient for special classes of fault-tolerant distributed algorithms by [Damian et al 2019;Konnov et al 2017b;von Gleissenthall et al 2019]. We are going to explore similar techniques, in order to check complex TLA + specifications of Raft by [Ongaro 2014], Disk Paxos [Gafni and Lamport 2003], and Egalitarian Paxos by [Moraru et al 2013].…”

“…Several techniques and tools for parameterized verification of fault-tolerant distributed algorithms were introduced by [Drăgoi et al 2014;Drăgoi et al 2016], [Farzan et al 2016], [von Gleissenthall et al 2016], [Konnov et al 2017b], and [Maric et al 2017]. The efficiency of these techniques comes from the restriction to special domains, whereas our approach applies to virtually any TLA + specification over finite structures.…”

Communication-Closed Asynchronous Protocols

“…There are several other frameworks for the verification of asynchronous distributed algorithms, e.g., Verdi [45], IronFleet [22], ByMC [25], Ivy [37], and Disel [40]. Very interesting distributed algorithms have been verified in these frameworks.…”

Extracting symbolic transitions from TLA+ specifications

“…To name a few, CBMC [15] and CPAChecker [3] implement bounded model checking [4] and CEGAR [9]. Domain-specific tools ByMC and Cubicle prove properties of parameterized distributed algorithms with SMT [10,14].…”