Model Checking of Consensus Algorit

Abstract

We show for the first time that standard model checking allows one to completely verify asynchronous algorithms for solving consensus, a fundamental problem in fault-tolerant distributed computing. Model checking is a powerful verification methodology based on state exploration. However it has rarely been applied to consensus algorithms, because these algorithms induce huge, often infinite state spaces. Here we focus on consensus algorithms based on the Heard-Of model, a new computation model for distributed computing. By making use of the high abstraction level provided by this computation model and by devising a finite representation of unbounded timestamps, we develop a methodology for verifying consensus algorithms in every possible state by model checking.

Engineering Dynamic Adaptation for Achieving Cost-Efficient Resilience in Software-Intensive Embedded Systems

“…To verify consensus algorithms, all the three properties need to be checked. However, validity is usually trivially satisfied for most consensus algorithms [10]. Instead of checking whether the other two properties (agreement and termination) hold, we focus on the property that eventually some process decides.…”

“…Instead, we focus on the cases where only one process is allowed to crash. Considering related works of verifying consensus algorithms that only small cases are possible (typically only 3 or 4 nodes) to be verified [10], we believe that model checking these 1-crashed cases is still an interesting study.…”

“…The papers on combining model checking and other proof techniques for verifying consensus algorithms and on model checking consensus algorithms with fixed numbers of processes and rounds have already been discussed by Tsuchiya and Schiper [10], [15]. Tsuchiya and Schiper present a first (fully) automatic verification of consensus algorithms using NuSMV without imposing any restrictions on the number of rounds [10]. They reduce agreement and termination verification to the problem of model checking the algorithm with a global round, and use bounded model checking to effectively verify consensus problems [15].…”

“…The other difference is the way on how to deal with unbounded round numbers. They focus on either maintaining relative order of pairs of round numbers [10] or a global round of the checked algorithm [15], [16], while we aim to find bounds on distance of round numbers. Our approach is not limited to consensus problems, it can be also applied to other algorithms such as leader election.…”