Mechanical Verification of Automatic Synthesis of Fault-Tolerant Programs

Abstract

Abstract. Fault-tolerance is a crucial property in many systems. Thus, mechanical verification of algorithms associated with synthesis of faulttolerant programs is desirable to ensure their correctness. In this paper, we present the mechanized verification of algorithms that automate the addition of fault-tolerance to a given fault-intolerant program using the PVS theorem prover. By this verification, not only we prove the correctness of the synthesis algorithms, but also we guarantee that any program synthesized by these algorithms is correct by construction. Towards this end, we formally define a uniform framework for formal specification and verification of fault-tolerance that consists of abstract definitions for programs, specifications, faults, and levels of fault-tolerance, so that they are independent of platform and architecture. The essence of synthesis algorithms involves fixpoint calculations. Hence, we also develop a reusable library for fixpoint calculations on finite sets in PVS.

Logic-Based Program Synthesis and Transformation

“…Kulkarni and Bonakdarpour's work [8,28] is the closest to the proposed approach in this paper. As such, we would like to highlight some differences between their contributions and ours.…”

“…Since we would like the specification of a protocol to be as general as possible, we impose little constraints on the notions of state, transitions, etc. Thus, the [28]. Likewise, an action is defined as a set of transitions, Action:Type =set[Transition].…”

“…A computation prefix of a protocol prt is a finite sequence of states where each state is reached from its predecessor by a transition of prt. Kulkarni et al [28] specify a prefix as an infinite sequence in which only a finite number of states are used. By contrast, we specify a computation prefix as a finite sequence type.…”

“…We believe that it is more natural and more accurate to model the concept of prefix by finite sequences. Our experience also shows that modeling computation prefixes as finite sequences simplifies formal specification and verification of reachability and convergence while saving us several definitions that were required in [28] to capture the length of the prefix. We first define a type for finite sequences of states; i.e., Pos F S. Then, we use the predicate Condi prefix?…”

“…Tsuchiya et al [36] use symbolic model checking to verify several protocols such as mutual exclusion and leader election. Kulkarni et al [8,28] mechanically prove (in PVS) the correctness of algorithms for automated addition of fault tolerance; nonetheless, such algorithms are not tuned for the design of convergence. Most existing automated techniques [6,14,16,27] for the design of fault tolerance enable the synthesis of non-parametric fault-tolerant systems.…”