U s i n g S i m u l a t e d E x e c u t i o n - PowerPoint PPT Presentation

U s i n g S i m u l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h m s T o h N e Wi n , M i c h a e l E r n s t , S t e p h e n G a r l a n d , D i l s u n K i r l i K a y n a r , N a n c y L y n c h "How to help a theorem prover with execution data" U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 1

G o a l : m a k e t h e o r e m p r o v e r s e a s i e r t o u s e ● Wh y d o w e w a n t t o u s e a p r o v e r ? – T o v e r i f y g e n e r a l , i n fj n i t e s t a t e s y s t e m s ● Wh a t ' s h a r d a b o u t u s i n g a p r o v e r ? – T h e y g e t s t u c k a n d n e e d h u m a n i n p u t U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 2

Wh a t k i n d o f h u m a n i n p u t ? Program to be verified Theorem prover Verified proof U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 3

Wh a t k i n d o f h u m a n i n p u t ? Program to be verified Tactics Proof structure Case analysis Which facts to use Theorem prover Verified proof U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 4

Wh a t k i n d o f h u m a n i n p u t ? Program to be verified Lemmas Tactics Proof structure Human insight and intuition on invariants of reachable states Case analysis Which facts to use Theorem prover Verified proof U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 5

T r a d i t i o n a l a p p r o a c h e s Program to be verified Lemmas Tactics Human insight and intuition on invariants of reachable states ??? Improved tactics to Theorem prover prover Verified proof U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 6

U s i n g e x e c u t i o n d a t a t o h e l p p r o v e r s ● P r o g r a m s a r e o f t e n t e s t e d b e f o r e v e r i fj c a t i o n – T e s t i n g s h o w s e r r o r s q u i c k l y – V e r i fj c a t i o n i s e x p e n s i v e i n h u m a n t i m e ● E x e c u t i o n d a t a i s n o r m a l l y t h r o w n a w a y – Wh a t i n f o r m a t i o n c a n b e k e p t f o r p r o o f s ? U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 7

G e n e r a t i n g t a c t i c s Program annotated for testing by execution Lemmas Tactics Translator from test cases to prover language Proof structure and case analysis Theorem prover Verified proof U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 8

G e n e r a t i n g l e m m a s Program annotated for testing by execution Lemmas Tactics Daikon runtime analysis Translator from test cases tool to prover language generalizes over executions Conjectured invariants Proof structure and case analysis Theorem prover Verified proof U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 9

O u t l i n e ● M o t i v a t i o n : e x e c u t i o n - a s s i s t e d t h e o r e m p r o v e r s ● F o r m a l m o d e l : I O a u t o m a t o n ● C a s e s t u d y : L a m p o r t ' s P a x o s p r o t o c o l ● L e m m a s : c o n j e c t u r e d i n v a r i a n t s ● T a c t i c s : p r o o f o u t l i n e ● C o n c l u s i o n U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 1 0

F o r m a l m o d e l : I O a u t o m a t o n ● M o d e l f o r d i s t r i b u t e d s y s t e m s [Lynch/Tuttle 89] – L a b e l e d ( i n fj n i t e , n o n d e t e r m i n i s t i c ) s t a t e m a c h i n e – F i r s t o r d e r l o g i c t o d e fj n e t r a n s i t i o n s U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 1 1

F o r m a l m o d e l : I O a u t o m a t o n ● M o d e l f o r d i s t r i b u t e d s y s t e m s [Lynch/Tuttle 89] – L a b e l e d ( i n fj n i t e , n o n d e t e r m i n i s t i c ) s t a t e m a c h i n e – F i r s t o r d e r l o g i c t o d e fj n e t r a n s i t i o n s Specifica ● M u l t i p l e l e v e l s o f a b s t r a c t i o n tion – A b s t r a c t s p e c i fj c a t i o n a u t o m a t o n Abstract – L a y e r e d i m p l e m e n t a t i o n a u t o m a t a Implementa tion Concrete Implementa tion U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 1 2

V e r i fj c a t i o n m e t h o d s ● S i m u l a t i o n r e l a t i o n s f o r r e fj n e m e n t Specifica tion Simulation relation Abstract Implementa tion Simulation relation Concrete Implementa tion U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 1 3

V e r i fj c a t i o n m e t h o d s ● S i m u l a t i o n r e l a t i o n s f o r r e fj n e m e n t ● I n v a r i a n t a s s e r t i o n s f o r i m p l e m e n t a t i o n s Specifica tion Simulation relation Abstract Invariants Implementa tion Simulation relation Concrete Invariants Implementa tion U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 1 4

I O A l a n g u a g e a n d t o o l s ● I O A i n t e r p r e t e r – A l l o w s s i m u l a t e d e x e c u t i o n o f o n e a u t o m a t o n , o r o f a p a i r f o r r e fj n e m e n t – U s e r - s p e c i fj e d s c h e d u l i n g t o r e s o l v e n o n d e t e r m i n i s m ● I O A t r a n s l a t o r s t o p r o v i n g l a n g u a g e s – T h e L a r c h P r o v e r – I s a b e l l e / H O L U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 1 5

O u t l i n e ● M o t i v a t i o n : e x e c u t i o n - a s s i s t e d t h e o r e m p r o v e r s ● I O a u t o m a t o n m o d e l ● C a s e s t u d y : L a m p o r t ' s P a x o s p r o t o c o l ● L e m m a s : c o n j e c t u r e d i n v a r i a n t s ● T a c t i c s : p r o o f o u t l i n e ● C o n c l u s i o n U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 1 6

P a x o s i n I O A ● S Consens p e c i fj c a t i o n f o r c o n s e n s u s us ● Globalized implementation using Global1 ballots and quorums Concrete Paxos U s i n g S i mu l a t e d E x e c u t i o n i n V e r i f y i n g D i s t r i b u t e d A l g o r i t h ms V MC A I 2 0 0 3 1 7