Verification of an Industrial Asynchronous Leader Election Algorithm Using Abstractions and Parametric Model Checking

Abstract

The election of a leader in a network is a challenging task, especially when the processes are asynchronous, i. e., execute an algorithm with time-varying periods. Thales developed an industrial election algorithm with an arbitrary number of processes, that can possibly fail. In this work, we prove the correctness of a variant of this industrial algorithm. We use a method combining abstraction, the SafeProver solver, and a parametric timed model-checker. This allows us to prove the correctness of the algorithm for a large number p of processes (p = 5000).Our main contribution is to perform a formal verification of the algorithm correctness for a large number of nodes. By correctness, we mean the actual election of the leader after a fixed number of rounds.We consider here a special form of the general leader election problem [Lyn96]: we assume that, in the network, all the processes (or nodes) have a specific ID number, and they execute the same code (symmetry) in order to agree which ID number is the highest one. In the synchronous context where all processes communicate simultaneously, the problem is often solved using the "Bully algorithm" [GM82]. In the asynchronous context where each process communicates with a specific period possibly subject to delay variation (jitter), the problem is much more difficult. Periods can be all slightly different from each other, which makes the problem particularly complex. For example, a classical distributed leader election protocol, where the nodes exchange data using broadcasting, was designed by Leslie Lamport [Lam98] in the asynchronous context. The correctness of this algorithm was proved mechanically many times using, e. g., TLA + tool [Lam02], or, more recently, using the timed model checking tool Uppaal [BDL04]. However, these automated proofs work only for a small number p of processes, typically for p ≤ 10. In this paper, we present a technique to prove the correctness of such a distributed leader election using automated tools for a large number of nodes (e. g., p = 5000). The principle of the method relies on the abstraction method consisting in viewing the network from the point of view of a specific (but arbitrary) node, say node i , and considering the rest of the nodes of the network as an abstract environment interacting with node i . In this abstract model, two basic properties of the algorithm can be proven. However, in order to prove the full correctness of the leader election algorithm, we will need an auxiliary model, where some timing information is added to (a raw form of) the abstract model. Using this auxiliary timed model, we are able to prove an additional property of the leader election algorithm. Thanks to the three aforementioned properties added as assumptions, we can then prove the full correctness of the leader election algorithm, using the bounded model checker SafeProver [ÉJ17] on the abstract model.The leader election algorithm we use is not Lamport's algorithm, but a simple asynchronous form of the Bully algorithm. We consider a specifi...

IMITATOR 3: Synthesis of Timing Parameters Beyond Decidability

“…-the parametric verification of an asynchronous memory circuit by ST-Microelectronics (from a model described in [37]), -verification of parametric scheduling problems by Astrium Space Transportation [40] and ArianeGroup SAS [13], -analysis of music scores [38], -verifying the multi-processor image processing system of an unmanned aerial aircraft with uncertain periods, as a benchmark made public by Thales [46], -parametric pattern matching and monitoring of logs from the automative industry [20], -synthesis of timing/cost parameters in attack-fault trees [23,31], -testing product lines using parametric constraints [44], -verification of an industrial asynchronous leader election algorithm by Thales using IMITATOR combined with abstractions [18], -performing parametric opacity analyses for timed automata [30], and -synthesis of parameter valuations guaranteeing liveness properties for the Bounded Retransmission Protocol [11].…”

Handling State Space Explosion in Component-Based Software Verification: A Review

“…The variables are idle or do not have any influence on the system properties [5]. Abstraction method has been successfully used to verify in many domains [92] [93]. Orbit problem seeks to find if the two states a andā are in the equal orbit [94].…”

Timed Automata Robustness Analysis via Model Checking

“…Model-checking methods allow for verifying whether a given TA meets a given system specification. Contemporary model-checking tools, such as UPPAAL [BDL `06] or Imitator [AFKS12], have proved to be practically applicable on various industrial case studies [BDL `06, AFMS19,HPW01]. Unfortunately, during the system design phase, the system information is often incomplete.…”