Reference. On Symmetry and Quantification: A New Approach to Verify Distributed Protocols
Proving that an unbounded distributed protocol satisfies a given safety property amounts to finding a quantified inductive invariant that implies the property for all possible instance sizes of the protocol. Existing methods for solving this problem can be described as search procedures for an invariant whose quantification prefix fits a particular template. We propose an alternative constructive approach that does not prescribe, a priori, a specific quantifier prefix. Instead, the required prefix is automatically inferred without any search by carefully analyzing the structural symmetries of the protocol. The key insight underlying this approach is that symmetry and quantification are closely related concepts that express protocol invariance under different re-arrangements of its components. We propose symmetric incremental induction, an extension of the finite-domain IC3/PDR algorithm, that automatically derives the required quantified inductive invariant by exploiting the connection between symmetry and quantification. While various attempts have been made to exploit symmetry in verification applications, to our knowledge, this is the first demonstration of a direct link between symmetry and quantification in the context of clause learning during incremental induction. We also describe a procedure to automatically find a minimal finite size, the cutoff, that yields a quantified invariant proving safety for any size. Our approach is implemented in IC3PO, a new verifier for distributed protocols that significantly outperforms the state-of-the-art, scales orders of magnitude faster, and robustly derives compact inductive invariants fully automatically.
Cite
Cited by (4)
SAT-based quantified symmetric minimization of the reachable states of distributed protocols: An update LuoSatBasedQuantifiedSymmetric
In prior work [13], we introduced a procedure for deriving minimum formulas in first-order logic (FOL) for the reachable states of a restricted class of multi-sorted distributed protocol specifications: protocols with sorts representing unbounded sets of symmetric (indistinguishable) elements. This paper provides a deeper analysis of this idea that yields additional insights about the oft-cited observation that the behavior of such protocols can be inferred from analyzing relatively small finite instances whereby a protocol’s behavior becomes invariant, i.e. saturates [24], beyond certain cutoff sizes of its sorts. The paper discusses several issues in previous work [13] and provides more succinct FOL formulas of the reachable states for a collection of common protocols.
Formally verified asymptotic consensus in robust networks tekriwal-2024-formally
Distributed architectures are used to improve performance and reliability of various systems. Examples include drone swarms and load-balancing servers. An important capability of a distributed architecture is the ability to reach consensus among all its nodes. Several consensus algorithms have been proposed, and many of these algorithms come with intricate proofs of correctness, that are not mechanically checked. In the controls community, algorithms often achieve consensus asymptotically , e.g., for problems such as the design of human control systems, or the analysis of natural systems like bird flocking. This is in contrast to exact consensus algorithm such as Paxos, which have received much more recent attention in the formal methods community. This paper presents the first formal proof of an asymptotic consensus algorithm, and addresses various challenges in its formalization. Using the Coq proof assistant, we verify the correctness of a widely used consensus algorithm in the distributed controls community, the Weighted-Mean Subsequence Reduced (W-MSR) algorithm . We formalize the necessary and sufficient conditions required to achieve resilient asymptotic consensus under the assumed attacker model. During the formalization, we clarify several imprecisions in the paper proof, including an imprecision on quantifiers in the main theorem.
Regularity and Quantification: A New Approach to Verify Distributed Protocols goelRegularityQuantificationNew
Proving that an unbounded distributed protocol satisfies a given safety property amounts to finding a quantified inductive invariant that implies the property for all possible instance sizes of the protocol. Existing methods for solving this problem can be described as search procedures for an invariant whose quantification prefix fits a particular template. We propose an alternative constructive approach that does not prescribe, a priori, a specific quantifier prefix. Instead, the required prefix is automatically inferred without any enumerative search by carefully analyzing the spatial and temporal regularity of the protocol. The key insight underlying this approach is that structural regularity and quantification are closely related concepts that express protocol invariance under different re-arrangements of its components and its unbounded evolution over time. We extended the finite-domain IC3/PDR algorithm to use these regularities and boost clause learning to automatically derive the required quantified inductive invariant by exploiting the connection between structural regularities and quantification. We also describe a procedure to automatically find a minimal finite size, the cutoff, that yields a quantified invariant proving safety for any size. Our approach is implemented in IC3PO, a new verifier for distributed protocols that significantly outperforms the state-of-the-art, scales orders of magnitude faster, and robustly derives compact inductive invariants fully automatically.
Sift: Using Refinement-guided Automation to Verify Complex Distributed Systems maSiftUsingRefinementguided
Distributed systems are hard to design and implement correctly. Recent work has tried to use formal verification techniques to provide rigorous correctness guarantees. These works present a hard choice, though. One must either opt for the power of refinement-based approaches like IronFleet and Verdi, at the cost of large amounts of manual effort; or choose the more automated approach of I4, IC3PO, SWISS and DistAI which give up the ability to prove refinement and the power and scalability that come with it.
Cites 68 works (6 here)
With notes (6)
AVR: Abstractly Verifying Reachability goelAVRAbstractlyVerifying2020
We present AVR, a push-button model checker for verifying state transition systems directly at the source-code level. AVR uses information embedded in the word-level syntax of the design representation to automatically perform scalable model checking by combining a novel syntax-guided abstraction-refinement technique with a word-level implementation of the IC3 algorithm. AVR provides independently-verifiable certificates that offer provable assurance and are easy to relate to the word-level system. Moreover, proof certificates can be further used in innovative ways to extract key design information and are useful in a growing number of applications.
I4: Incremental inference of inductive invariants for verification of distributed protocols maI4IncrementalInference2019
Designing and implementing distributed systems correctly is a very challenging task. Recently, formal verification has been successfully used to prove the correctness of distributed systems. At the heart of formal verification lies a computerchecked proof with an inductive invariant. Finding this inductive invariant, however, is the most difficult part of the proof. Alas, current proof techniques require inductive invariants to be found manually—and painstakingly—by the developer. In this paper, we present a new approach, Incremental Inference of Inductive Invariants (I4), to automatically generate inductive invariants for distributed protocols. The essence of our idea is simple: the inductive invariant of a finite instance of the protocol can be used to infer a general inductive invariant for the infinite distributed protocol. In I4, we create a finite instance of the protocol; use a model checking tool to automatically derive the inductive invariant for this finite instance; and generalize this invariant to an inductive invariant for the infinite protocol. Our experiments show that I4 can prove the correctness of several distributed protocols like Chord, 2PC and Transaction Chains with little to no human effort.
Towards Automatic Inference of Inductive Invariants ma-2019-towards
Ivy: Safety verification by interactive generalization padonIvySafetyVerification
Despite several decades of research, the problem of formal verification of infinite-state systems has resisted effective automation. We describe a system — Ivy — for interactively verifying safety of infinite-state systems. Ivy’s key principle is that whenever verification fails, Ivy graphically displays a concrete counterexample to induction. The user then interactively guides generalization from this counterexample. This process continues until an inductive invariant is found. Ivy searches for universally quantified invariants, and uses a restricted modeling language. This ensures that all verification conditions can be checked algorithmically. All user interactions are performed using graphical models, easing the user’s task. We describe our initial experience with verifying several distributed protocols.
IronFleet: proving practical distributed systems correct hawblitzel-2015-ironfleet
SAT-Based Model Checking without Unrolling bradleySATBasedModelChecking2011
A new form of SAT-based symbolic model checking is described. Instead of unrolling the transition relation, it incrementally generates clauses that are inductive relative to (and augment) stepwise approximate reachability information. In this way, the algorithm gradually refines the property, eventually producing either an inductive strengthening of the property or a counterexample trace. Our experimental studies show that induction is a powerful tool for generalizing the unreachability of given error states: it can refine away many states at once, and it is effective at focusing the proof search on aspects of the transition system relevant to the property. Furthermore, the incremental structure of the algorithm lends itself to a parallel implementation.
External (62)
- Proceedings of SAT Competition 2020: Solver and Benchmark Descriptions (2020)
- First-order quantified separators (2020)
- Learning the boundary of inductive invariants (2020)
- Complexity and information in invariant inference (2019)
- Pretend synchrony: synchronous verification of asynchronous distributed programs (2019)
- Model Checking of Verilog RTL Using IC3 with Syntax-Guided Abstraction (2019)
- Empirical Evaluation of IC3-Based Model Checking Techniques on Verilog RTL Designs (2019)
- The part-time parliament (2019)
- Inferring Inductive Invariants from Phase Structures (2019)
- Verification of threshold-based distributed algorithms by decomposition to decidable logics (2019)
- Quantifiers on Demand (2018)
- Thread modularity at many levels: a pearl in compositional verification (2017)
- Property-Directed Inference of Universal Invariants or Proving Their Absence (2017)
- Parameterized verification through view abstraction (2016)
- Proving Parameterized Systems Safe by Generalizing Clausal Proofs of Small Instances (2016)
- The Satisfiability Modulo Theories Library (SMT-LIB) (2016)
- Decidability of Parameterized Verification (2015)
- How Amazon web services uses formal methods (2015)
- Verdi: a framework for implementing and formally verifying distributed systems (2015)
- ParaVerifier: An Automatic Framework for Proving Parameterized Cache Coherence Protocols (2015)
- PySMT: a solver-agnostic library for fast prototyping of SMT-based algorithms (2015)
- Yices 2.2 (2014)
- Cubicle: A Parallel SMT-Based Model Checker for Parameterized Systems (2012)
- CVC4 (2011)
- Verification Modulo Theories (vmt-lib.org) (2011)
- Efficient Implementation of Property Directed Reachability (2011)
- Verifying safety properties with the TLA+ proof system (2010)
- Backward Reachability of Array-based Systems by SMT solving: Termination and Invariant Synthesis (2010)
- Deciding Effectively Propositional Logic Using DPLL and Substitution Sets (2009)
- Pre-RTL formal verification: an Intel experience (2008)
- Z3: An Efficient SMT Solver (2008)
- Symmetry and Completeness in the Analysis of Parameterized Systems (2007)
- IIV: An Invisible Invariant Verifier (2005)
- An Extensible SAT-solver (2004)
- Model checking and abstraction to the aid of parameterized systems (a survey) (2004)
- Combining Symmetry Reduction and Under-Approximation for Symbolic Model Checking (2002)
- Specifying systems: the TLA+ language and tools for hardware and software engineers (2002)
- Parameterized verification with automatically computed inductive assertions (2001)
- Chaff: engineering an efficient SAT solver (2001)
- Automatic Deductive Verification with Invisible Invariants (2001)
- Paxos made simple (2001)
- A First Course in Abstract Algebra (6th ed.) (2000)
- SMC: a symmetry-based model checker for verification of safety and liveness properties (2000)
- Exploiting Symmetry When Model-Checking Software (1999)
- GRASP: a search algorithm for propositional satisfiability (1999)
- Symmetry and model checking (1996)
- Better verification through symmetry (1996)
- A new approach for the verification of cache coherence protocols (1995)
- Symbolic Model Checking (1993)
- Symbolic model checking: 1020 States and beyond (1992)
- Reasoning about systems with many processes (1992)
- PVS: A prototype verification system (1992)
- Symbolic model checking: 10^20 states and beyond (LICS 1990 version) (1990)
- A structural induction theorem for processes (1989)
- Limits for automatic verification of finite-state concurrent systems (1986)
- Proving the Correctness of Multiprocess Programs (1977)
- Verifying properties of parallel programs (1976)
- Client server protocol in Ivy (web page)
- A collection of distributed protocol verification problems (ivybench, GitHub)
- The Ivy language and verifier (web page)
- pySMT fork (GitHub, aman-goel/pysmt)
- Toy consensus protocol (Ivy example)