Verification of randomized consensus algorithms under round-rigid adversaries

Abstract

Randomized fault-tolerant distributed algorithms pose a number of challenges for automated verification: (i) parameterization in the number of processes and faults, (ii) randomized choices and probabilistic properties, and (iii) an unbounded number of asynchronous rounds. This combination makes verification hard. Challenge (i) was recently addressed in the framework of threshold automata. We extend threshold automata to model randomized consensus algorithms that perform an unbounded number of asynchronous rounds. For non-probabilistic properties, we show that it is necessary and sufficient to verify these properties under round-rigid schedules, that is, schedules where processes enter round r only after all processes finished round $$r-1$$ r - 1 . For almost-sure termination, we analyze these algorithms under round-rigid adversaries, that is, fair adversaries that only generate round-rigid schedules. This allows us to do compositional and inductive reasoning that reduces verification of the asynchronous multi-round algorithms to model checking of a one-round threshold automaton. We apply this framework and automatically verify the following classic algorithms: Ben-Or’s and Bracha’s seminal consensus algorithms for crashes and Byzantine faults, 2-set agreement for crash faults, and RS-Bosco for the Byzantine case.

On methods and tools for rigorous system design

“…Papers [3,18] contribute to the design of correct-by construction high-level models by defining a highlevel modelling formalism [18] and by providing an approach for debugging CPS models [3]. Papers [9,14,22,24,28] contribute to the design and proof of domain-specific abstractions. They provide techniques for ensuring the correctness of randomised consensus protocols [9], program block parallelisation [14], usage control policies [22], and for ensuring optimality of partition schedules [24] and energy consumption [28].…”

“…Those traces that satisfy the properties are then used to mine additional specifications, and the method produces explanations from the analysis of failed traces with respect to the properties mined. -The paper "Verification of Randomized Consensus Algorithms under Round-Rigid Adversaries" by Bertrand, Konnov, Lazić, and Widder [9] is an extension of paper [8] by the same authors. This work is focused on obtaining a fully automated proof of correctness-encompassing validity, agreement and almost-sure termination-of randomised consensus algorithms involving arbitrarily many (faulty) processes and rounds under round-rigid adversaries, i.e.adversaries that are weakly fair and that select actions in a "roundbased" manner.…”

Model checking randomized distributed algorithms

“…In order to model round-based randomized fault-tolerant distributed algorithm such as the randomized consensus by Ben Or, the model of threshold automata was recently extended with probabilistic transitions and multiple rounds [Bertrand et al 2019]. More importantly, this work provides the first automated proofs of consensus algorithms that follow the ideas of Ben Or.…”

A Reduction Theorem for Randomized Distributed Algorithms Under Weak Adversaries

“…The asynchronous parallel composition of many processes leads to a huge number of executions. Recently, several verification methods [18,14,6,9,5] are based on the idea that for many distributed algorithms, instead of considering all these asynchronous executions, it is sufficient to consider only fewer (representative) synchronous executions. The central argument is similar to the reductions (also know as, mover analysis) by Lipton [15] and Elrad and Francez [10]: given an arbitrary execution, by repeatedly swapping neighboring transitions, one arrives at one of the representative (synchronous) executions.…”

“…However, typical randomized consensus algorithms from the literature [4,7,16,17] have a structure similar to Figure 1. Almost sure termination of these algorithms have been automatically verified in [5] under synchronous executions formalized via round-rigid adversaries. In this paper we show that for these distributed algorithms the computation trees that are defined by weak adversaries can be reduced to round-rigid computation trees by a swapping argument.…”