Mechanical Verification of a Constructive Proof for FLP according - PowerPoint PPT Presentation

Mechanical Verification of a Constructive Proof for FLP according to Hagen V¨ olzer Bisping Brodmann Jungnickel Rickmann St¨ uber Wilhelm-Weidner Seidler Peters Nestmann 24 August 2016 Models and Theory of Distributed Systems Bisping et al. FLP Constructive Proof 24 August 2016 1 / 15

Introduction Consensus – Motivation Example • distributed database • each at different state • decide whether to apply transaction Bisping et al. FLP Constructive Proof 24 August 2016 2 / 15

Introduction Consensus – Motivation Example • distributed database • each at different state • decide whether to apply transaction • exchange messages • all have to arrive at same decision Bisping et al. FLP Constructive Proof 24 August 2016 2 / 15

Introduction Consensus – Motivation Example • distributed database • each at different state • decide whether to apply transaction • exchange messages • all have to arrive at same decision Problem processes may crash Bisping et al. FLP Constructive Proof 24 August 2016 2 / 15

Introduction The FLP Theorem Theorem (Fischer, Lynch, Paterson, 1985) impossible to ensure consensus, if processes may crash Bisping et al. FLP Constructive Proof 24 August 2016 3 / 15

Introduction The FLP Theorem Theorem (Fischer, Lynch, Paterson, 1985) impossible to ensure consensus, if processes may crash Theorem (V¨ olzer, 2004) more constructive proof of FLP Bisping et al. FLP Constructive Proof 24 August 2016 3 / 15

Introduction The FLP Theorem Theorem (Fischer, Lynch, Paterson, 1985) impossible to ensure consensus, if processes may crash Theorem (V¨ olzer, 2004) more constructive proof of FLP Our Work • based on the more constructive paper of V¨ olzer • formalizing this proof in Isabelle/HOL • . . . including “fairness”, which was just stated Bisping et al. FLP Constructive Proof 24 August 2016 3 / 15

Introduction Consensus Model • finite set of sequential processes • asynchronous communication channels between all pairs p 0 1 p 3 p 1 1 0 p 2 0 Bisping et al. FLP Constructive Proof 24 August 2016 4 / 15

Introduction Consensus Model • finite set of sequential processes • asynchronous communication channels between all pairs Definition: Binary Consensus p 0 Each process gets an input value from { 0 , 1 } and 1 may irrevocably decide on a final output value such that: p 3 p 1 • Agreement : No two processes decide 1 0 differently. • Validity : The output value is the input value p 2 of some process. 0 • Termination : Each process eventually decides or crashes. Bisping et al. FLP Constructive Proof 24 August 2016 4 / 15

Introduction Consensus Model • finite set of sequential processes • asynchronous communication channels between all pairs Definition: Binary Consensus p 0 Each process gets an input value from { 0 , 1 } and 1 may irrevocably decide on a final output value such that: p 3 p 1 • Agreement : No two processes decide 1 0 differently. • Validity : The output value is the input value p 2 of some process. 0 • Termination : Each process eventually decides or crashes. Bisping et al. FLP Constructive Proof 24 August 2016 4 / 15

Introduction Fairness • easy to obtain undesired behaviour • “block” process by not processing its messages Bisping et al. FLP Constructive Proof 24 August 2016 5 / 15

Introduction Fairness • easy to obtain undesired behaviour • “block” process by not processing its messages Definition: Fair Execution Each message is processed (as long as receiver not crashed). Bisping et al. FLP Constructive Proof 24 August 2016 5 / 15

Introduction Fairness • easy to obtain undesired behaviour • “block” process by not processing its messages Definition: Fair Execution Each message is processed (as long as receiver not crashed). • unfair execution practically irrelevant Bisping et al. FLP Constructive Proof 24 August 2016 5 / 15

Introduction The FLP Theorem Theorem (V¨ olzer, 2004) There is no consensus algorithm such that • a process may crash • validity • agreement • every fair execution terminates Bisping et al. FLP Constructive Proof 24 August 2016 6 / 15

Introduction The FLP Theorem Theorem (V¨ olzer, 2004) There is no consensus algorithm such that • a process may crash • validity • agreement • every fair execution terminates fundamental result in distributed computing Bisping et al. FLP Constructive Proof 24 August 2016 6 / 15

Introduction The FLP Theorem Theorem (V¨ olzer, 2004) Every consensus algorithm such that • a process may crash • validity • agreement has an infinite fair execution that does not decide. Bisping et al. FLP Constructive Proof 24 August 2016 7 / 15

Introduction The FLP Theorem Theorem (V¨ olzer, 2004) Every consensus algorithm such that • a process may crash • validity • agreement has an infinite fair execution that does not decide. � constructive Bisping et al. FLP Constructive Proof 24 August 2016 7 / 15

Introduction The FLP Theorem Theorem (V¨ olzer, 2004) Every consensus algorithm such that • a process may crash • validity • agreement has an infinite fair execution that does not decide. � constructive Idea of proof • find invariant that ensures non-decided • find proper way to extend finite execution, keeping the invariant • infinite fair run Bisping et al. FLP Constructive Proof 24 August 2016 7 / 15

Our proof in Isabelle/HOL Initial Lemma Non-uniform There are processes p , q such that • crash of p allows decision 0 • crash of q allows decision 1 Bisping et al. FLP Constructive Proof 24 August 2016 8 / 15

Our proof in Isabelle/HOL Initial Lemma Non-uniform There are processes p , q such that • crash of p allows decision 0 • crash of q allows decision 1 Initial Lemma There is a non-uniform initial configuration. Bisping et al. FLP Constructive Proof 24 August 2016 8 / 15

Our proof in Isabelle/HOL Initial Lemma Non-uniform There are processes p , q such that • crash of p allows decision 0 • crash of q allows decision 1 Initial Lemma There is a non-uniform initial configuration. Small error in V¨ olzer’s proof • used same symbol for different configurations • required adaption in proof Bisping et al. FLP Constructive Proof 24 August 2016 8 / 15

Our proof in Isabelle/HOL Extension Lemma Extension Lemma - V¨ olzer’s version For each non-uniform configuration c and each process p there is a configuration c ′ such that c ⇒ ∗ c ′ and crash of p in c ′ allows for both decisions. Bisping et al. FLP Constructive Proof 24 August 2016 9 / 15

Our proof in Isabelle/HOL Extension Lemma Extension Lemma - V¨ olzer’s version For each non-uniform configuration c and each process p there is a configuration c ′ such that c ⇒ ∗ c ′ and crash of p in c ′ allows for both decisions. Extension Lemma – our version • choose message ( p , m ) – receiver p , content m • apply Extension Lemma for this p • can safely consume message (keeping invariant) all put into single extension Bisping et al. FLP Constructive Proof 24 August 2016 9 / 15

Our proof in Isabelle/HOL Extension – Picture 0 • c 1 Bisping et al. FLP Constructive Proof 24 August 2016 10 / 15

Our proof in Isabelle/HOL Extension – Picture 0 p • • c 1 Bisping et al. FLP Constructive Proof 24 August 2016 10 / 15

Our proof in Isabelle/HOL Extension – Picture 0 p Extension • • c c ′ 1 Bisping et al. FLP Constructive Proof 24 August 2016 10 / 15

Our proof in Isabelle/HOL Extension – Picture 0 p Extension • • c c ′ 1 Bisping et al. FLP Constructive Proof 24 August 2016 10 / 15

Our proof in Isabelle/HOL Extension – Picture 0 p Extension • • c c ′ 1 Bisping et al. FLP Constructive Proof 24 August 2016 10 / 15

Our proof in Isabelle/HOL FLP-Theorem FLP-Theorem Each possible consensus algorithm has a fair infinite execution that does not decide. Bisping et al. FLP Constructive Proof 24 August 2016 11 / 15

Our proof in Isabelle/HOL FLP-Theorem FLP-Theorem Each possible consensus algorithm has a fair infinite execution that does not decide. Proof by V¨ olzer • start with non-uniform initial configuration • take message with minimal enabling time • extend execution using Extension Lemma, ending with non-uniform configuration • repeat this process Bisping et al. FLP Constructive Proof 24 August 2016 11 / 15

Our proof in Isabelle/HOL Proof Idea 0 • Initial 1 Bisping et al. FLP Constructive Proof 24 August 2016 12 / 15

Our proof in Isabelle/HOL Proof Idea 0 • • Initial ( p 1 , m 1 ) • 1 Bisping et al. FLP Constructive Proof 24 August 2016 12 / 15

Our proof in Isabelle/HOL Proof Idea 0 Extension • • Initial ( p 1 , m 1 ) • 1 Bisping et al. FLP Constructive Proof 24 August 2016 12 / 15

Our proof in Isabelle/HOL Proof Idea 0 Extension • • Initial ( p 1 , m 1 ) • 1 Bisping et al. FLP Constructive Proof 24 August 2016 12 / 15

Our proof in Isabelle/HOL Proof Idea 0 • ( p 2 , m 2 ) Extension • • • Initial ( p 1 , m 1 ) • 1 Bisping et al. FLP Constructive Proof 24 August 2016 12 / 15