Towards Modeling and Model Checking Fault-Tolerant Distributed Algorithms

Abstract

Abstract. Fault-tolerant distributed algorithms are central for building reliable, spatially distributed systems. In order to ensure that these algorithms actually make systems more reliable, we must ensure that these algorithms are actually correct. Unfortunately, model checking state-ofthe-art fault-tolerant distributed algorithms (such as Paxos) is currently out of reach except for very small systems. In order to be eventually able to automatically verify such fault-tolerant distributed algorithms also in larger systems, several problems have to be addressed. In this paper, we consider modeling and verification of fault-tolerant algorithms that basically only contain threshold guards to control the flow of the algorithm. As threshold guards are widely used in fault-tolerant distributed algorithms (and also in Paxos) efficient methods to handle them bring us closer to the above mentioned goal. As case study we use the reliable broadcasting algorithm by Srikanth and Toueg that tolerates even Byzantine faults. We show how one can model this basic fault-tolerant distributed algorithm in Promela such that safety and liveness properties can be efficiently verified in Spin. We provide experimental data also for other distributed algorithms.

Para $$^2$$ 2 : parameterized path reduction, acceleration, and SMT for reachability in threshold-guarded distributed algorithms

“…All of our benchmark algorithms were originally published in pseudocode, and we model them in a parametric extension of Promela, which was discussed in [27,34].…”

“…Waiting for majorities, or more generally waiting for quorums, is a key pattern of many faulttolerant algorithms, e.g., consensus, replicated state machine, and atomic commit. In [34] we introduced an efficient encoding of these algorithms, which we used in [33] for abstractionbased parameterized model checking of safety and liveness of several case study algorithms, which are parameterized in the number of processes n and the fraction of faults t, e.g., n > 3t. In [41] we were able to verify reachability properties of more involved algorithms by applying bounded model checking.…”

Counter Simulations via Higher Order Quantifier Elimination: a preliminary report

“…On the other hand, for a long time, it has been observed that counter systems [14,15,17] can be sufficient to specify many problems (like cache coherence or broadcast protocols) in the distributed algorithms area. Recently, counter abstractions have been effectively used also in the verification of fault-tolerant distributed protocols [3,[25][26][27]. It should be noticed that, unlike what happens in the old framework of [14,15,17], these new applications are often (although not always) based on abstractions that can only simulate the original algorithms and such simulation may sometimes be the result of an a priori reasoning on the characteristics of the algorithm, embedded into the model.…”

Brief announcement

“…The latter makes it imperative to handle multiple parameters such as n, t, and the number f of faulty processes in a run of the algorithm, as well as resilience conditions such as n > 3t ∧ f ≤ t. In the context of fault-tolerant distributed algorithms, model checking was hence limited to verifying small system instances. For instance, the authors of [18,17,11,9] fixed the number n of processes a priori to some small value, say, n = 4 to 10, and used model checking for ruling out errors in these particular system instances. Although it is tempting to verify a "large enough" model and assume that this implies the algorithm's correctness in the general case, this is not necessarily true.…”

“…However, for our abstraction method, a new variant of control flow automata (CFA) [5] is more natural, and the ways to express nondeterminism in our CFA variant are particularly suitable to model the influence of faults and uncertain message delays. In [8], we describe in detail how fault-tolerant message passing algorithms are specified using CFAs. As the CFA formalism is rather low-level compared to the way distributed algorithms are typically stated in the literature, interfaces to higher-level languages are subject to future work.…”