Efficient model checking of fault-tolerant distributed protocols

Abstract

To aid the formal verification of fault-tolerant distributed protocols, we propose an approach that significantly reduces the costs of their model checking. These protocols often specify atomic, process-local events that consume a set of messages, change the state of a process, and send zero or more messages. We call such events quorum transitions and leverage them to optimize state exploration in two ways. First, we generate fewer states compared to models where quorum transitions are expressed by single-message transitions. Second, we refine transitions into a set of equivalent, finer-grained transitions that allow partial-order algorithms to achieve better reduction. We implement the MP-Basset model checker, which supports refined quorum transitions. We model check protocols representing core primitives of deployed reliable distributed systems, namely: Paxos consensus, regular storage, and Byzantine-tolerant multicast. We achieve up to 92% memory and 85% time reduction compared to model checking with standard unrefined single-message transitions.

State Machine Replication for the Masses with BFT-SMART

“…This means that several recent efforts in verification of safety properties in distributed systems through model checking (e.g., [18]) do not solve liveness bugs, which is the most difficult problem in our experience.…”

“…Although distributed systems tracing, debugging and verification is a lively research area (e.g., [18], [19]), there are still no tools mature enough to be used. Our approach for testing BFT-SMART is based on JUnit, a popular unit testing tool.…”

Towards Modeling and Model Checking Fault-Tolerant Distributed Algorithms

“…Formalization and verification of a class of fault-tolerant distributed algorithms have been addressed in [5]. Their formalization uses the fact that for many distributed algorithms, the order in which messages arrive is not relevant, but only how many messages are received.…”

Para $$^2$$ 2 : parameterized path reduction, acceleration, and SMT for reachability in threshold-guarded distributed algorithms

“…From a methodological viewpoint, our approach combines techniques from several areas including compact programs [49], counter abstraction [4,55], completeness thresholds for bounded model checking [6,16,42], partial order reduction [8,28,53,59], and Lipton's movers [48]. Regarding counter automata, our result entails flattability [46] of every counter system of threshold automata: a complete set of schemas immediately gives us a flat counter automaton.…”