Formal verification for fault-tolerant architectures: Some lessons learned

  • Sam Owre
  • John Rushby
  • Natarajan Shankar
  • Friedrich von Henke
Part of the Lecture Notes in Computer Science book series (LNCS, volume 670)


In collaboration with NASA's Langley Research Center, we are developing mechanically verified formal specifications for the fault-tolerant architecture, algorithms, and implementations of a “reliable computing platform” (RCP) for digital flight-control applications.

Several of the formal specifications and verifications performed in support of RCP are individually of considerable complexity and difficulty. But in order to contribute to the larger goal, it has often been necessary to modify completed verifications to accommodate changed assumptions or requirements, and people other than the original developer have often needed to build on, modify, or cannibalize an intricate verification.

Accordingly, we have been developing and honing our verification tools to better support these large, difficult, iterative, and collaborative verifications. Our goal is to reduce formal verifications as difficult as these to routine exercises, and to maximize the value obtained from formalization and verification. In this paper, we describe some of the challenges we have faced, lessons learned, design decisions taken, and results obtained.


Theorem Prove Formal Verification Verification System Proof Obligation Clock Synchronization 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    W. R. Bevier and W. D. Young. The design and proof of correctness of a fault-tolerant circuit. In Meyer and Schlichting [13], pages 243–260.Google Scholar
  2. 2.
    R. S. Boyer and J S. Moore. Integrating decision procedures into heuristic theorem provers: A case study with linear arithmetic. In Machine Intelligence, volume 11. Oxford University Press, 1986.Google Scholar
  3. 3.
    J. H. Cheng and C. B. Jones. On the usability of logics which handle partial functions. In Carroll Morgan and J. C. P. Woodcock, editors, Proceedings of the Third Refinement Workshop, pages 51–69. Springer-Verlag Workshops in Computing, 1990.Google Scholar
  4. 4.
    Ben L. Di Vito and Ricky W. Butler. Formal techniques for synchronized fault-tolerant systems. In 3rd IFIP Working Conference on Dependable Computing for Critical Applications, pages 85–97, Mondello, Sicily, Italy, September 1992.Google Scholar
  5. 5.
    Ben L. Di Vito, Ricky W. Butler, and James L. Caldwell. High level design proof of a reliable computing platform. In Meyer and Schlichting [13], pages 279–306.Google Scholar
  6. 6.
    System Design and Analysis. Federal Aviation Administration, June 21, 1988. Advisory Circular 25.1309-1A.Google Scholar
  7. 7.
    L. Lamport and P. M. Melliar-Smith. Synchronizing clocks in the presence of faults. Journal of the ACM, 32(1):52–78, January 1985.CrossRefGoogle Scholar
  8. 8.
    Leslie Lamport, Robert Shostak, and Marshall Pease. The Byzantine generals problem. ACM Transactions on Programming Languages and Systems, 4(3):382–401, July 1982.CrossRefGoogle Scholar
  9. 9.
    Patrick Lincoln and John Rushby. Formal verification of algorithm for interactive consistency under a hybrid fault model. Technical report, Computer Science Laboratory, SRI International, Menlo Park, CA, February 1993.Google Scholar
  10. 10.
    Erwin Liu and John Rushby. Formal verification of a clock synchronization support circuit. Technical report, Computer Science Laboratory, SRI International, Menlo Park, CA, 1993. Forthcoming.Google Scholar
  11. 11.
    Dale A. Mackall. Development and flight test experiences with a flight-crucial digital control system. NASA Technical Paper 2857, NASA Ames Research Center, Dryden Flight Research Facility, Edwards, CA, 1988.Google Scholar
  12. 12.
    P. Michael Melliar-Smith and John Rushby. The Enhanced HDM system for specification and verification. In Proc. VerkShop III, pages 41–43, Watsonville, CA, February 1985. Published as ACM Software Engineering Notes, Vol. 10, No. 4, Aug. 85.Google Scholar
  13. 13.
    J. F. Meyer and R. D. Schlichting, editors. Dependable Computing for Critical Applications—2, volume 6 of Dependable Computing and Fault-Tolerant Systems, Tucson, AZ, February 1991. Springer-Verlag, Wien, Austria.Google Scholar
  14. 14.
    Paul S. Miner. A verified design of a fault-tolerant clock synchronization circuit: Preliminary investigations. NASA Technical Memorandum 107568, NASA Langley Research Center, Hampton, VA, March 1992.Google Scholar
  15. 15.
    S. Owre, J. M. Rushby, and N. Shankar. PVS: A prototype verification system. In Deepak Kapur, editor, 11th International Conference on Automated Deduction (CADE), volume 607 of Lecture Notes in Artificial Intelligence, pages 748–752, Saratoga, NY, 1992. Springer Verlag.Google Scholar
  16. 16.
    Daniel L. Palumbo and R. Lynn Graham. Experimental validation of clock synchronization algorithms. NASA Technical Paper 2857, NASA Langley Research Center, Hampton, VA, July 1992.Google Scholar
  17. 17.
    John Rushby. Formal specification and verification of a fault-masking and transientrecovery model for digital flight-control systems. In Vytopil [26],. pages 237–257.Google Scholar
  18. 18.
    John Rushby. Formal verification of an Oral Messages algorithm for interactive consistency. Technical Report SRI-CSL-92-1, Computer Science Laboratory, SRI International, Menlo Park, CA, July 1992. Also available as NASA Contractor Report 189704, October 1992.Google Scholar
  19. 19.
    John Rushby and Friedrich von Henke. Formal verification of algorithms for critical systems. In SIGSOFT '91: Software for Critical Systems, pages 1–15, New Orleans, LA, December 1991. Expanded version to appear in IEEE Transactions on Software Engineering, 1993.Google Scholar
  20. 20.
    John Rushby, Friedrich von Henke, and Sam Owre. An introduction to formal specification and verification using Ehdm. Technical Report SRI-CSL-91-2, Computer Science Laboratory, SRI International, Menlo Park, CA, February 1991.Google Scholar
  21. 21.
    Fred B. Schneider. Understanding protocols for Byzantine clock synchronization. Technical Report 87-859, Department of Computer Science, Cornell University, Ithaca, NY, August 1987.Google Scholar
  22. 22.
    Natarajan Shankar. Mechanical verification of a generalized protocol for Byzantine fault-tolerant clock synchronization. In Vytopil [26],. pages 217–236.Google Scholar
  23. 23.
    Robert E. Shostak. Deciding combinations of theories. Journal of the ACM, 31(1):1–12, January 1984.CrossRefGoogle Scholar
  24. 24.
    Mandayam Srivas and Mark Bickford. Verification of the FtCayuga fault-tolerant microprocessor system, volume 1: A case-study in theorem prover-based verification. Contractor Report 4381, NASA Langley Research Center, Hampton, VA, July 1991.Google Scholar
  25. 25.
    Philip Thambidurai and You-Keun Park. Interactive consistency with multiple failure modes. In 7th Symposium on Reliable Distributed Systems, pages 93–100, Columbus, OH, October 1988. IEEE Computer Society.Google Scholar
  26. 26.
    J. Vytopil, editor. Formal Techniques in Real-Time and Fault-Tolerant Systems, volume 571 of Lecture Notes in Computer Science, Nijmegen, The Netherlands, January 1992. Springer Verlag.Google Scholar
  27. 27.
    J. Lundelius Welch and N. Lynch. A new fault-tolerant algorithm for clock synchronization. Information and Computation, 77(1):1–36, April 1988.CrossRefGoogle Scholar
  28. 28.
    John H. Wensley et al. SIFT: Design and analysis of a fault-tolerant computer for aircraft control. Proceedings of the IEEE, 66(10):1240–1255, October 1978.Google Scholar
  29. 29.
    William D. Young. Verifying the Interactive Convergence clock-synchronization algorithm using the Boyer-Moore prover. NASA Contractor Report 189649, NASA Langley Research Center, Hampton, VA, April 1992.Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 1993

Authors and Affiliations

  • Sam Owre
    • 1
  • John Rushby
    • 1
  • Natarajan Shankar
    • 1
  • Friedrich von Henke
    • 1
  1. 1.Computer Science LaboratorySRI InternationalUSA

Personalised recommendations