Deductive Verification of Parameterized Fault-Tolerant Systems: A Case Study

Verification Diagrams Revisited: Disjunctive Invariants for Easy Verification

“…The most immediate targets for further research are empirical and, perhaps, theoretical investigations into the general utility of these approaches. The targets of my approach have all been synchronous group membership algorithms, while the verification diagrams of Manna et al seem not to have been applied to any hard examples (the verification in STeP of an interesting Leader Election algorithm [6] did not use diagrammatic methods). If practical experience with a variety of different problem types shows the approach to have sufficient utility, then it will be worth investigating provision of direct mechanical support.…”

“…For each transition condition, we symbolically simulate a step of the algorithm from the starting configuration, under that condition. The result of symbolic simulation becomes a new configuration (and implicitly discharges proof obligation (6) for that case)-unless we recognize it as a variant of an existing configuration, in which case we must explicitly discharge proof obligation (6) by proving that the result of symbolic simulation implies the existing configuration concerned (sometimes it may be necessary to generalize an existing configuration, in which case we will need to revisit previouslyproved proof obligations involving this configuration to ensure that they are preserved by the generalization). We also check that each new or generalized configuration implies the safety property (i.e., proof obligation ( 8)).…”

“…(The full algorithm differs from the simplified version given here in that all faulty processors eventually diagnose their faults and exclude themselves from their own membership; its proof is about four times as long as that presented here). 6…”

Verification of Parameterized Systems by Dynamic Induction

“…A natural inductive hypothesis is thus that processes with higher priority than the current process will achieve their goal. In some cases, for example in the proof of progress properties for a leader election algorithm presented in [BLM97], standard mathematical induction with a fixed order on the process indices suffices. However, in many cases a more flexible order is required.…”