Communication-Closed Asynchronous Protocols

Abstract

Fault-tolerant distributed systems are implemented over asynchronous networks, so that they use algorithms for asynchronous models with faults. Due to asynchronous communication and the occurrence of faults (e.g., process crashes or the network dropping messages) the implementations are hard to understand and analyze. In contrast, synchronous computation models simplify design and reasoning. In this paper, we bridge the gap between these two worlds. For a class of asynchronous protocols, we introduce a procedure that, given an asynchronous protocol, soundly computes its round-based synchronous counterpart. This class is defined by properties of the sequential code. We computed the synchronous counterpart of known consensus and leader election protocols, such as, Paxos, and Chandra and Toueg's consensus. Using Verifast we checked the sequential properties required by the rewriting. We verified the round-based synchronous counter-part of Multi-Paxos, and other algorithms, using existing deductive verification methods for synchronous protocols.

Tutorial: Parameterized Verification with Byzantine Model Checker

“…Practical approaches to computer-aided verification of distributed algorithms and systems is a lively research area as well: Approaches range from mechanized verification [48,90,80] over deductive verification [35,9,73,38,32] to automated techniques [17,60,5,44]. In our work, we follow the idea of identifying fragments of automata and logic that are sufficiently expressive for capturing interesting algorithms and specifications, as well as amenable for completely automated verification.…”

“…Observe that the algorithm only operates on messages from the current round (the guards only count messages tagged with r ). Asynchronous algorithms with this feature are called communication closed [40,32]. In the case of Ben-Or's algorithm, each round consists of two stages where the processes first exchange messages tagged with R, wait until the number of received messages reaches a certain threshold (the expression over parameters in line 5) and then exchange messages tagged with P .…”

TLA+ model checking made symbolic

“…More importantly, our framework opens the door for applying more advanced techniques such as abstraction [Ball et al 2001;Clarke et al 2003] and reduction [Cohen and Lamport 1998;Lipton 1975]. Reductions were shown to be efficient for special classes of fault-tolerant distributed algorithms by [Damian et al 2019;Konnov et al 2017b;von Gleissenthall et al 2019]. We are going to explore similar techniques, in order to check complex TLA + specifications of Raft by [Ongaro 2014], Disk Paxos [Gafni and Lamport 2003], and Egalitarian Paxos by [Moraru et al 2013].…”

Parameterized Verification of Systems with Global Synchronization and Guards

“…They show that many textbook protocols can be modeled under the following restrictions: (i) every state is assumed to have an unguarded internal transition to the initial state Init, and (ii) the only conjunctive guard is {Init}. Clearly, every action in a process that satisfies these conditions will also satisfy condition (C1w), and therefore well-behaved systems subsume and significantly generalize the types of protocols considered by Emerson and Kahlon. Moreover, there has recently been much research on the verification of roundbased distributed systems [14,34,37], where processes can move independently to some extent, with the restriction that transitions between rounds can only be done synchronously for all processes. When abstracting from certain features (e.g.…”

“…Distributed applications are notoriously difficult to implement and reason about, primarily due to the combinatorial explosion of behaviors resulting from the interleaving of computation and communication. Naturally, they have received a lot of attention from the formal methods community to facilitate reasoning about correctness properties that are too complex to reason about informally or manually [3,7,14,15,34,36,42,46,50,52,55].…”