Resilience-Building Technologies: State of Knowledge -- ReSIST NoE Deliverable D12

ion could be that two modules with the same priority number can be permuted without changing the behavior of the system. Accordingly, the orbit relation partitions two global states into the same orbit if they can be transformed into each other simply by permuting the local states of the modules with the same priority number. As representatives, those states can be picked where e.g. the first module of the particular priority set is given the bus access. 2.1.5 A Novel Abstraction Approach Amongst verification and validation (V&V) approaches, formal verification is seeing increased usage and acceptance. One popular technique is model checking that allows for automated verification (without user guidance) by performing exhaustive simulation on the model of the system. However, model checking faces the problem of state space explosion. Abstraction is a general method to reduce the level of detail in order to reduce the complexity of analysis. Researchers at TU Darmstadt are working on a new technique that is tailored to the characteristic of a large class of distributed protocols [Serafini et al. 2006]. The basic observation is that many protocols exhibit a significant level of symmetry, which arises when all processes execute the same program and communication is synchronous and broadcast-based. Furthermore, most of the time the formulae to be verified are “plane”, i.e., they have the form “all correct processes enjoy a certain property”.ion is a general method to reduce the level of detail in order to reduce the complexity of analysis. Researchers at TU Darmstadt are working on a new technique that is tailored to the characteristic of a large class of distributed protocols [Serafini et al. 2006]. The basic observation is that many protocols exhibit a significant level of symmetry, which arises when all processes execute the same program and communication is synchronous and broadcast-based. Furthermore, most of the time the formulae to be verified are “plane”, i.e., they have the form “all correct processes enjoy a certain property”. The straightforward modeling of a distributed protocol entails modeling the behavior of a single process and then composing the processes together. As a consequence, the state of the system is represented as a tuple of states, one for each process. Our approach is instead to consider all the possible states that any correct process can assume at each round. At each round, we calculate the set of all the possible states of any correct process due to symmetric message exchange with the other correct processes and to the presence of faults. This allows representation of the state of the system as a set instead of as a tuple of states, leading to a considerable reduction of the size of the state space. The verification of global properties is then carried out by checking if the desired properties hold for all the states that any correct process can have. The key challenge is to prove that the abstraction process loses information but preserves certain properties. The abstraction is proved to be sound with respect to plane properties, i.e., if we can prove a plane property in the abstracted model then this also holds for the non-abstracted one. As we represent the set of states of any correct process, it is intuitively clear that our approach allows verification of properties that apply to each process individually, e.g., “each process shall have a variable within a given range”. In this case it is sufficient to visit all the possible states of a correct process and to verify that they satisfy the property of interest. It is more complicated to prove consistency properties, e.g., “all processes shall decide the same value”. For this purpose we partition the set of possible states of a process into consistency sets. At each round, it is guaranteed that if any two correct processes can have different states, these states belong to the same consistency set. The non-determinism in the evolution of the global system states determines the possibility of having several alternative consistency sets. Consistency properties are then required to hold only within each consistency set but not across them, e.g., “within each consistency set, all states shall have the same decision value”. For the sake of simplicity, the approach focuses on the verification problem for core fault tolerant protocols of frame-based, synchronous systems (e.g. consensus, atomic broadcast, diagnosis, membership). The approach, however, can be extended to model-checking of round-based asynchronous protocols. RESIST D12 verif p 16 Part Verif 2 – Model Checking Let us consider a scenario where such a protocol is symmetric (i.e., where each process performs the same operations) and there are no faults. If all processes start from the same initial state, they will perform the same state transitions at each round. Therefore, the state of the system could be modeled by representing only the common state of any process. Its evolution throughout rounds can thus be seen as a single thread. Each of these states is supposed to satisfy the desired properties of the protocol (safety and liveness). We can expand this model by considering the presence of different, asymmetric initial process states. The state of a correct process will now evolve as a tree, where at each round the state of each process at round i is derived according to the state of the other processes at round i − 1. Each combination of states at round i − 1 results in different branches of the tree at round i. At each round, a correct process will find itself in one state among a set of multiple possible states; these are the children of a common parent node. These sets are called consistency sets. Similarly to alternative subtrees, consistency sets are mutually exclusive. As in the previous case, all the possible states at each round, i.e., all the states within each consistency set, are supposed to enjoy the specified properties. When model checking fault tolerant protocols, however, the number of possible communication patterns and state transitions explodes due to the “extended” behavior of faulty nodes, particularly if the fault model allows them to communicate asymmetrically (e.g. under the Byzantine or the receive-omission fault assumption). This greatly increases the number of possible states and considerably reduces the symmetry of the system state. In our modeling approach, these further asymmetries are also handled using consistency sets. In fact, if the protocol is fault tolerant then the desired properties shall hold in spite of faults as well as of asymmetries in the possible initial states. To understand the concept of consistency set we can consider a very simple example of a synchronous system consisting of three processors, where one of the two can be faulty and symmetrically send incorrect messages. Assume that the domain of the messages is {0, 1, 2}. Say that all correct processes start from state S1 and produce the message 0 as initial message in the first round of the protocol. There are three possible states of a correct process after the first communication round: S2, if both processes are correct and send the message 0; S3 or S4, if one of the processes is faulty and symmetrically sends the message 1 or 2 respectively. In this case we would have two consistency sets: {S2, S3} and {S2, S4}. Consistency sets are mutually exclusive and reflect the non-determinism given by the possible presence of faulty messages. By construction, they allow us to deduce that we will never have a situation where one correct process has the state S3 and another correct process has the state S4 (although a correct process can assume both the states S3 and S4). Typically, abstraction techniques are defined considering general state models, for example Kripke structures. Such techniques are generally proved to be sound and complete and can be applied to model check any kind of specification, independent of the specific problem under examination. On the other hand, many papers reporting experiences on model checking distributed protocols introduce abstractions which are tied to the particular protocol and whose soundness and completeness are not shown but rather assumed as “sensible” (see for example [Steiner et al. 2004, Ramasamy et al. 2002]). Such an approach undermines the value of the results obtained by model checking. A contribution of our work is to introduce an abstraction scheme that, while specific for a class of distributed protocols, is rigorous enough to prove its properties mathematically. To achieve this, we first illustrate a modeling framework to express a distributed protocol (modified from [Dolev et al. 1986]). This somehow represents a higher level language if compared to normal specification languages used by model checkers. Then we show how to construct abstracted and nonabstracted models starting from the given specifications. Finally we prove that our abstracted models preserve soundness with respect to their corresponding non-abstracted models. RESIST D12 verif p 17 Part Verif 2 – Model Checking Using a specific protocol specification language, both the models are rigorously defined, allowing soundness and completeness to be proved. In contrast, much previous work on using abstractions to model check distributed protocols focused on defining the abstracted model. We claim that this approach should generally be applied when using domain specific abstraction, i.e. abstractions that are specific to a certain class of problems. Currently, we are running experiments to measure the gain of the abstraction (in terms of state space size and proof execution time). One of our running case studies is a consensus protocol to solve interactive (binary) consensus [Lamport et al. 1982]. 2.2 Process algebras and action-based model checking applied to fault-tolerant systems 2.2.1 Overview In [Bernardeschi et al. 2000], process algebras and action-based model chec