Formal verification for fault-tolerant architectures: Some lessons learned
In collaboration with NASA's Langley Research Center, we are developing mechanically verified formal specifications for the fault-tolerant architecture, algorithms, and implementations of a “reliable computing platform” (RCP) for digital flight-control applications.
Several of the formal specifications and verifications performed in support of RCP are individually of considerable complexity and difficulty. But in order to contribute to the larger goal, it has often been necessary to modify completed verifications to accommodate changed assumptions or requirements, and people other than the original developer have often needed to build on, modify, or cannibalize an intricate verification.
Accordingly, we have been developing and honing our verification tools to better support these large, difficult, iterative, and collaborative verifications. Our goal is to reduce formal verifications as difficult as these to routine exercises, and to maximize the value obtained from formalization and verification. In this paper, we describe some of the challenges we have faced, lessons learned, design decisions taken, and results obtained.
KeywordsTheorem Prove Formal Verification Verification System Proof Obligation Clock Synchronization
Unable to display preview. Download preview PDF.
- 1.W. R. Bevier and W. D. Young. The design and proof of correctness of a fault-tolerant circuit. In Meyer and Schlichting , pages 243–260.Google Scholar
- 2.R. S. Boyer and J S. Moore. Integrating decision procedures into heuristic theorem provers: A case study with linear arithmetic. In Machine Intelligence, volume 11. Oxford University Press, 1986.Google Scholar
- 3.J. H. Cheng and C. B. Jones. On the usability of logics which handle partial functions. In Carroll Morgan and J. C. P. Woodcock, editors, Proceedings of the Third Refinement Workshop, pages 51–69. Springer-Verlag Workshops in Computing, 1990.Google Scholar
- 4.Ben L. Di Vito and Ricky W. Butler. Formal techniques for synchronized fault-tolerant systems. In 3rd IFIP Working Conference on Dependable Computing for Critical Applications, pages 85–97, Mondello, Sicily, Italy, September 1992.Google Scholar
- 5.Ben L. Di Vito, Ricky W. Butler, and James L. Caldwell. High level design proof of a reliable computing platform. In Meyer and Schlichting , pages 279–306.Google Scholar
- 6.System Design and Analysis. Federal Aviation Administration, June 21, 1988. Advisory Circular 25.1309-1A.Google Scholar
- 9.Patrick Lincoln and John Rushby. Formal verification of algorithm for interactive consistency under a hybrid fault model. Technical report, Computer Science Laboratory, SRI International, Menlo Park, CA, February 1993.Google Scholar
- 10.Erwin Liu and John Rushby. Formal verification of a clock synchronization support circuit. Technical report, Computer Science Laboratory, SRI International, Menlo Park, CA, 1993. Forthcoming.Google Scholar
- 11.Dale A. Mackall. Development and flight test experiences with a flight-crucial digital control system. NASA Technical Paper 2857, NASA Ames Research Center, Dryden Flight Research Facility, Edwards, CA, 1988.Google Scholar
- 12.P. Michael Melliar-Smith and John Rushby. The Enhanced HDM system for specification and verification. In Proc. VerkShop III, pages 41–43, Watsonville, CA, February 1985. Published as ACM Software Engineering Notes, Vol. 10, No. 4, Aug. 85.Google Scholar
- 13.J. F. Meyer and R. D. Schlichting, editors. Dependable Computing for Critical Applications—2, volume 6 of Dependable Computing and Fault-Tolerant Systems, Tucson, AZ, February 1991. Springer-Verlag, Wien, Austria.Google Scholar
- 14.Paul S. Miner. A verified design of a fault-tolerant clock synchronization circuit: Preliminary investigations. NASA Technical Memorandum 107568, NASA Langley Research Center, Hampton, VA, March 1992.Google Scholar
- 15.S. Owre, J. M. Rushby, and N. Shankar. PVS: A prototype verification system. In Deepak Kapur, editor, 11th International Conference on Automated Deduction (CADE), volume 607 of Lecture Notes in Artificial Intelligence, pages 748–752, Saratoga, NY, 1992. Springer Verlag.Google Scholar
- 16.Daniel L. Palumbo and R. Lynn Graham. Experimental validation of clock synchronization algorithms. NASA Technical Paper 2857, NASA Langley Research Center, Hampton, VA, July 1992.Google Scholar
- 17.John Rushby. Formal specification and verification of a fault-masking and transientrecovery model for digital flight-control systems. In Vytopil ,. pages 237–257.Google Scholar
- 18.John Rushby. Formal verification of an Oral Messages algorithm for interactive consistency. Technical Report SRI-CSL-92-1, Computer Science Laboratory, SRI International, Menlo Park, CA, July 1992. Also available as NASA Contractor Report 189704, October 1992.Google Scholar
- 19.John Rushby and Friedrich von Henke. Formal verification of algorithms for critical systems. In SIGSOFT '91: Software for Critical Systems, pages 1–15, New Orleans, LA, December 1991. Expanded version to appear in IEEE Transactions on Software Engineering, 1993.Google Scholar
- 20.John Rushby, Friedrich von Henke, and Sam Owre. An introduction to formal specification and verification using Ehdm. Technical Report SRI-CSL-91-2, Computer Science Laboratory, SRI International, Menlo Park, CA, February 1991.Google Scholar
- 21.Fred B. Schneider. Understanding protocols for Byzantine clock synchronization. Technical Report 87-859, Department of Computer Science, Cornell University, Ithaca, NY, August 1987.Google Scholar
- 22.Natarajan Shankar. Mechanical verification of a generalized protocol for Byzantine fault-tolerant clock synchronization. In Vytopil ,. pages 217–236.Google Scholar
- 24.Mandayam Srivas and Mark Bickford. Verification of the FtCayuga fault-tolerant microprocessor system, volume 1: A case-study in theorem prover-based verification. Contractor Report 4381, NASA Langley Research Center, Hampton, VA, July 1991.Google Scholar
- 25.Philip Thambidurai and You-Keun Park. Interactive consistency with multiple failure modes. In 7th Symposium on Reliable Distributed Systems, pages 93–100, Columbus, OH, October 1988. IEEE Computer Society.Google Scholar
- 26.J. Vytopil, editor. Formal Techniques in Real-Time and Fault-Tolerant Systems, volume 571 of Lecture Notes in Computer Science, Nijmegen, The Netherlands, January 1992. Springer Verlag.Google Scholar
- 28.John H. Wensley et al. SIFT: Design and analysis of a fault-tolerant computer for aircraft control. Proceedings of the IEEE, 66(10):1240–1255, October 1978.Google Scholar
- 29.William D. Young. Verifying the Interactive Convergence clock-synchronization algorithm using the Boyer-Moore prover. NASA Contractor Report 189649, NASA Langley Research Center, Hampton, VA, April 1992.Google Scholar