Para\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$^2$$\end{document}2: parameterized path reduction, acceleration, and SMT for reachability in threshold-guarded distributed algorithms

Automatic verification of threshold-based fault-tolerant distributed algorithms (FTDA) is challenging: FTDAs have multiple parameters that are restricted by arithmetic conditions, the number of processes and faults is parameterized, and the algorithm code is parameterized due to conditions counting the number of received messages. Recently, we introduced a technique that first applies data and counter abstraction and then runs bounded model checking (BMC). Given an FTDA, our technique computes an upper bound on the diameter of the system. This makes BMC complete for reachability properties: it always finds a counterexample, if there is an actual error. To verify state-of-the-art FTDAs, further improvement is needed. In contrast to encoding bounded executions of a counter system over an abstract finite domain in SAT, in this paper, we encode bounded executions over integer counters in SMT. In addition, we introduce a new form of reduction that exploits acceleration and the structure of the FTDAs. This aggressively prunes the execution space to be explored by the solver. In this way, we verified safety of seven FTDAs that were out of reach before.


Introduction
Replication is a classic approach to make computing systems more reliable. In order to avoid a single point of failure, one uses multiple processes in a distributed system. Then, if some of these processes fail (e.g., by crashing or deviating from their expected behavior) the distributed system as a whole should stay operational. For this purpose one uses faulttolerant distributed algorithms (FTDAs). These algorithms have been extensively studied in distributed computing theory [1,50], and found application in safety critical systems (automotive or aeronautic industry). With the recent advent of data centers and cloud computing we observe growing interest in fault-tolerant distributed algorithms, and their correctness, also for more mainstream computer science applications [19,20,31,47,52,54,60].
We consider automatic verification techniques specifically for threshold-based faulttolerant distributed algorithms. In these algorithms, processes collect messages from their peers, and check whether the number of received messages reaches a threshold, e.g., a threshold may ensure that acknowledgments from a majority of processes have been received. Waiting for majorities, or more generally waiting for quorums, is a key pattern of many faulttolerant algorithms, e.g., consensus, replicated state machine, and atomic commit. In [34] we introduced an efficient encoding of these algorithms, which we used in [33] for abstractionbased parameterized model checking of safety and liveness of several case study algorithms, which are parameterized in the number of processes n and the fraction of faults t, e.g., n > 3t. In [41] we were able to verify reachability properties of more involved algorithms by applying bounded model checking. We showed how to make bounded model checking complete in the parameterized case. In particular, we considered counter systems where we record for each local state, how many processes are in this state. We have one counter per local state , denoted by κ[ ]. A process step from local state to local state is modeled by decrementing κ[ ] and incrementing κ[ ]. When δ processes perform the same step one after the other, we allow the processes to do the accelerated step that instantaneously changes the two affected counters by δ. The number δ is called acceleration factor, which can vary in a single run.
As we focus on threshold-based FTDAs, we consider counter systems defined by threshold automata. Here, transitions are guarded by threshold guards that compare a shared integer variable to a linear combination of parameters, e.g., x ≥ n − t or x < t, where x is a shared variable and n and t are parameters.
Completeness of the method [41] with respect to reachability is shown by proving a bound on the diameter of the accelerated system. Inspired by Lamport's view of distributed computation as partial order on events [43], our method uses a reduction similar to Lipton's [48]. Instead of pruning executions that are "similar" to ones explored before as in partial order reduction [28,53,59], we use the partial order to show (offline) that every run has a similar run of bounded length. Interestingly, the bound is independent of the parameters. In [41], we introduced the following automated method, which combines this idea with data abstraction [33]: Property holds, or a counterexample Tool chain described in this paper (SMT-based bounded model checking)

Fig. 1
Tool chain with counter abstraction [27,33,41] on top, and with SMT-based bounded model checking on bottom 1. Apply a parametric data abstraction to the process code to get a finite state process description, and construct the threshold automaton (TA) [33,36]. 2. Compute the diameter bound, based on the control flow of the TA. 3. Construct a system with abstract counters, i.e., a counter abstraction [33,55]. 4. Perform SAT-based bounded model checking [6,16] up to the diameter bound, to check whether bad states are reached in the counter abstraction. 5. If a counterexample is found, check its feasibility and refine, if needed [13,33]. Figure 1 gives on top a diagram [40] that shows the technique based on counter abstraction. While this allowed us to automatically verify several FTDAs not verified before, there remained two bottlenecks for scalability to larger and more complex protocols: First, counter abstraction can lead to spurious counterexamples. As counters range over a finite abstract domain, the semantics of abstract increment and decrements on the counters introduce nondeterminism. For instance, the value of a counter can remain unchanged after applying an increment. Intuitively, processes or messages can be "added" or "lost", which results in that, e.g., in the abstract model the number of messages sent is smaller than the number of processes that have sent a message, which obviously is spurious behavior. Second, counter abstraction works well in practice only for processes with a few dozens of local states. It has been observed in [4] that counter abstraction does not scale to hundreds of local states. We had similar experience with counter abstraction in our experiments in [41]. We conjecture that this is partly due to the many different interleavings, which result in a large search space.
To address these bottlenecks, we make two crucial contributions in this paper: 1. To eliminate one of the two sources of spurious counterexamples, namely, the nondeterminism added by abstract counters, we do bounded model checking using SMT solvers with linear integer arithmetic on the accelerated system, instead of SAT-based bounded model checking on the counter abstraction. An example threshold automaton with threshold guards "ϕ 1 : x ≥ (n + t)/2 − f ", "ϕ 2 : y ≥ (t + 1) − f ", and "ϕ 3 : y ≥ (2t + 1) − f " 1 2 3 4 5 r 3 : ϕ 1 → x++ r 2 : ϕ 2 → x++ r 1 : true → x++ r 4 : ϕ 1 → y++ r 5 : ϕ 2 → y++ r 6 : ϕ 3 2. We reduce the search space dramatically: we introduce the notion of an execution schema that is defined as a sequence of local rules of the TA. By assigning to each rule of a schema an acceleration factor (possibly 0, which models that no process executes the rule), one obtains a run of the counter system. Hence, due to parameterization, each schema represents infinitely many runs. We show how to construct a set of schemas whose set of reachable states coincides with the set of reachable states of the accelerated counter system.
The resulting method is depicted at the bottom of Fig. 1. Our construction can be seen as an aggressive form of reduction, where each run has a similar run generated by a schema from the set. To show this, we capture the guards that are locked and unlocked in a context.
Our key insight is that a bounded number of transitions changes the context in each run. For example, of all transitions increasing a variable x, at most one makes x ≥ n − t true, and at most one makes x < t + 1 false (the parameters n and t are fixed in a run, and shared variables can only be increased). We fix those transitions that change the context, and apply the ideas of reduction to the subexecutions between these transitions.
Our experiments show that SMT solvers and schemas outperform SAT solvers and counter abstraction in parameterized verification of threshold-based FTDAs. We verified safety of FTDAs [10,18,29,51,56,57] that have not been automatically verified before. In addition we achieved dramatic speedup and reduced memory footprint for FTDAs [9,12,58] which previously were verified in [41].
In this article we focus on parameterized reachability properties. Recently, we extended this approach to safety and liveness, for which we used the reachability technique of this article as a black box [37].

Our approach at a glance
For modeling threshold-based FTDAs, we use threshold automata that were introduced in [38,41] and are discussed in more detail in [40]. We use Fig. 2 to describe our contributions in this section. The figure presents a threshold automaton TA over two shared variables x and y and parameters n, t, and f , which is inspired by the distributed asynchronous broadcast protocol from [9]. There, n − f correct processes concurrently follow the control flow of TA, and f processes are Byzantine faulty. As is typical for FTDAs, the parameters must satisfy a resilience condition, e.g., n > 3t ∧ t ≥ f ≥ 0, that is, less than a third of the processes are faulty. The circles depict the local states 1 , . . . , 5 , two of them are the initial states 1 and We associate with every local state i a non-negative counter κ[ i ] that represents the number of processes in i . Together with the values of x, y, n, t, and f , the values of the counters constitute a configuration of the system. In the initial configuration there are n − f processes in initial states, i.e., κ[ 1 ] + κ[ 2 ] = n − f , and the other counters and the shared variables x and y are zero.
The rules define the transitions of the counter system. For example, according to the rule r 2 , if in the current configuration the guard y ≥ t + 1 − f holds true and κ[ 1 ] ≥ 5, then five processes can instantaneously move out of the local state 1 to the local state 3 , and increment x as prescribed by the action of r 2 (since the evaluation of the guard y ≥ t + 1 − f cannot change from true to false). This results in increasing x and κ[ 3 ] by five, and decreasing the counter κ[ 1 ] by five. When, as in our example, rule r 2 is conceptually executed by 5 processes, we denote this transition by (r 2 , 5), where 5 is the acceleration factor. A sequence of transitions forms a schedule, e.g., (r 1 , 2), (r 3 , 1), (r 1 , 1).
In this paper, we address a parameterized reachability problem, e.g., can at least one correct process reach the local state 5 , when n − f correct processes start in the local state 1 ? Or, in terms of counter systems, is a configuration with κ[ 5 ] = 0 reachable from an initial configuration with κ[ 1 ] = n − f ∧ κ[ 2 ] = 0? As discussed in [41], acceleration does not affect reachability, and precise treatment of the resilience condition and threshold guards is crucial for solving this problem.

Schemas
When applied to a configuration, a schedule generates a path, that is, an alternating sequence of configurations and transitions. As initially x and y are zero, threshold guards ϕ 1 , ϕ 2 , and ϕ 3 evaluate to false. As rules may increase variables, these guards may eventually become true. In our example we do not consider guards like x < t + 1 that are initially true and become false, although we formally treat them in our technique. In fact, initially only r 1 is unlocked. Because r 1 increases x, it may unlock ϕ 1 . Thus r 4 becomes unlocked. Rule r 4 increases y and thus repeated application of r 4 (by different processes) first unlocks ϕ 2 and then ϕ 3 . We introduce a notion of a context that is the set of threshold guards that evaluate to true in a configuration. For our example we observe that each path goes through the following sequence of contexts {}, {ϕ 1 }, {ϕ 1 , ϕ 2 }, and {ϕ 1 , ϕ 2 , ϕ 3 }. In fact, the sequence of contexts in a path is always monotonic, as the shared variables can only be increased.
The conjunction of the guards in the context {ϕ 1 , ϕ 2 } implies the guards of the rules r 1 , r 2 , r 3 , r 4 , r 5 ; we call these rules unlocked in the context. This motivates our definition of a schema: a sequence of contexts and rules. We give an example of a schema below, where inside the curly brackets we give the contexts, and fixed sequences of rules in between. (We discuss the underlined rules below.) Given a schema, we can generate a schedule by attaching to each rule an acceleration factor, which can possibly be 0. For instance, if we attach non-zero factors to the underlined rules in S, and a zero factor to the other rules, we generate the following schedule τ (we omit the transitions with 0 factors here).
It can easily be checked that τ is generated by schema S, because the sequence of the underlined rules in S matches the sequence of rules appearing in τ .
In this paper, we show that the schedules generated by a few schemas -one per each monotonic sequence of contexts -span the set of all reachable configurations. To this end, we apply reduction and acceleration to relate arbitrary schedules to their representatives, which are generated by schemas.
To show that this schedule is captured by the schema (2.1), we apply partial order arguments -that is, a mover analysis [48] -regarding distributed computations: As the guards ϕ 2 and ϕ 3 evaluate to true in τ 4 , and r 5 precedes r 6 in the control flow of the TA, all transitions (r 5 , 1) can be moved to the left in τ 4 . Similarly, (r 1 , 1) can be moved to the left in τ 2 . The resulting schedule is applicable and leads to the same configuration as the original one. Further, we can accelerate the adjacent transitions with the same rule, e.g., the sequence (r 5 , 1), (r 5 , 1) can be transformed into (r 5 , 2). Thus, we transform subschedules τ i into τ i , and arrive at the schedule τ from Eq. (2.2), which we call the representative schedule of τ . As the representative schedule τ is generated from the schema in (2.1), we say that the schema captures schedule τ . (It also captures τ .) Importantly for reachability checking, if τ and τ are applied to the same configuration, they end in the same configuration. These arguments are formalized in Sects. 5, 6 and 7.

Encoding a schema in SMT
One of the key insights in this paper is that reachability checking via schemas can be encoded efficiently as SMT queries in linear integer arithmetic. In more detail, finite paths of counter systems can be expressed with inequalities over counters such as κ[ 2 ] and κ [ 3 ], shared variables such as x and y, parameters such as n, t, and f , and acceleration factors. Also, threshold guards and resilience conditions are expressions in linear integer arithmetic.
We give an example of reachability checking with SMT using the simple schema {} r 1 , r 1 {ϕ 1 } which is contained in the schema S in Eq. (2.1). To obtain a complete encoding for S, one can similarly encode the other simple schemas and combine them.
To this end, we have to express constraints on three configurations σ 0 , σ 1 , and σ 2 . For the initial configuration σ 0 , we introduce integer variables: κ 0 1 , . . . , κ 0 5 for local state counters, x 0 and y 0 for shared variables, and n, t, and f for parameters. As is written in Eq. (2.3), the configuration σ 0 should satisfy the initial constraints, and its context should be empty (that is, all guards evaluate to false): The configuration σ 1 is reached from σ 0 by applying a transition with the rule r 1 and an acceleration factor δ 1 , and the configuration σ 2 is reached from σ 1 by applying a transition with the rule r 1 and an acceleration factor δ 2 . Applying transition with the rule r 1 to σ 0 just means to increase both κ[ 3 ] and x by δ 1 and decrease κ[ 2 ] by δ 1 . Hence, we introduce four fresh variables per transition and add the arithmetic operations. According to the schema, configuration σ 2 has the context {ϕ 2 }. The following equations express these constraints 1 : Finally, we express the reachability question for all paths generated by the simple schema {} r 1 , r 1 {ϕ 1 }. Whether there is a configuration with κ[ 5 ] = 0 reachable from an initial configuration with κ[ 1 ] = n − f and κ[ 2 ] = 0 can then be encoded as: Note that we check only κ 0 5 against zero, as the local state 5 is never updated by the rule r 1 . It is easy to see that conjunction of Eqs. (2.3)-(2.6) does not have a solution, and thus all paths generated by the schema {} r 1 , r 1 {ϕ 1 } do not reach a configuration with κ[ 5 ] = 0. By writing down constraints for the other three simple schemas in Eq. (2.1), we can check reachability for the paths generated by the whole schema as well. As discussed in Sect. 2.1, our results also imply reachability on all paths whose representatives are generated by the schema. More details on the SMT encoding can be found in Sect. 9.

Parameterized counter systems
We recall the framework of [41] to the extent necessary, and extend it with the notion of a context in Sect. 3.2. A threshold automaton describes a process in a concurrent system, and is a tuple TA = (L, I, Γ, , R, RC) defined below.
The finite set L contains the local states, and I ⊆ L is the set of initial states. The finite set Γ contains the shared variables that range over the natural numbers N 0 . The finite set is a set of parameter variables that range over N 0 , and the resilience condition RC is a formula over parameter variables in linear integer arithmetic, e.g., n > 3t. The set of admissible A key ingredient of threshold automata are threshold guards (or, just guards): Definition 3.1 A threshold guard is an inequality of one of the following two forms: where x ∈ Γ is a shared variable, a 0 , . . . , a | | ∈ Z are integer coefficients, and p 1 , . . . , p | | ∈ are parameters. We denote the set of all guards of the form (R) by Φ rise , and the set of all guards of the form (F) by Φ fall .
A rule defines a conditional transition between local states that may update the shared variables. Formally, a rule is a tuple (from, to, ϕ rise , ϕ fall , u): the local states from and to are from L. (Intuitively, they capture from which local state to which a process moves.) A rule is only executed if the conditions ϕ rise and ϕ fall evaluate to true. Condition ϕ rise is a conjunction of guards from Φ rise , and ϕ fall is a conjunction of guards from Φ fall (cf. Definition 3.1). We denote the set of guards used in ϕ rise by guard(ϕ rise ), and guard(ϕ fall ) is the set of guards used in ϕ fall .
Rules may increase shared variables using an update vector u ∈ N |Γ | 0 that is added to the vector of shared variables. As u ∈ N |Γ | 0 , global variables can only be increased or left unchanged. As will be later formalized in Proposition 3.1, guards from Φ rise can only change from false to true (rise), and guards from Φ fall can change from true to false (fall). Finally, R is the finite set of rules. We use the dot notation to refer to components of rules, e.g., r.from or r.u. Example 3.1 In Fig. 2, the rule r 2 : ϕ 2 → x++ that describes a transition from 1 to 3 , can formally be written as ( 1 , 3 , ϕ 2 , , (1, 0)). Its intuitive meaning is as follows. If the guard ϕ 2 : y ≥ (t + 1) − f evaluates to true, a process can move from the local state 1 to the local state 3 , and the global variable x is incremented, while y remains unchanged. We formalize the semantics as counter systems in Sect. 3.1.

Definition 3.2
Given a threshold automaton (L, I, Γ, , R, RC), we define the precedence relation ≺ P : for a pair of rules r 1 , r 2 ∈ R, it holds that r 1 ≺ P r 2 if and only if r 1 .to = r 2 .from. We denote by ≺ + P the transitive closure of ≺ P . Further, we say that r 1 ∼ P r 2 , if r 1 ≺ + P r 2 ∧ r 2 ≺ + P r 1 , or r 1 = r 2 . Assumption 3. 3 We limit ourselves to threshold automata relevant for FTDAs, i.e., those where r.u = 0 for all rules r ∈ R that satisfy r ≺ + P r . Such automata were called canonical in [41].
Remark 3. 1 We use threshold automata to model fault-tolerant distributed algorithms that count messages from distinct senders. These algorithms are based on an "idealistic" reliable communication assumption (no message loss); these assumptions are typically expected to be ensured by "lower level bookkeeping code", e.g., communication protocols. As a result, the algorithms we consider here do not gain from sending the same message (that is, increasing a variable) inside a loop, so that we can focus on threshold automata that do not increase shared variables in loops.
Looplets The relation ∼ P defines equivalence classes of rules. An equivalence class corresponds to a loop or to a single rule that is not part of a loop. Hence, we use the term looplet for one such equivalence class. For a given set of rules R let R/∼ be the set of equivalence classes defined by ∼ P . We denote by [r ] the equivalence class of rule r . For two classes c 1 and c 2 from R/∼ we write c 1 ≺ C c 2 iff there are two rules r 1 and r 2 in R satisfying [r 1 ] = c 1 and [r 2 ] = c 2 and r 1 ≺ + P r 2 and r 1 P r 2 . As the relation ≺ C is a strict partial order, there are linear extensions of ≺ C . Below, we fix an arbitrary of these linear extensions to sort transitions in a schedule: We denote by ≺ lin C a linear extension of ≺ C .  From r 9 ≺ P r 10 , it follows that c 3 ≺ C c 4 , and from r 4 ≺ + P r 10 , it follows that c 2 ≺ C c 4 . We can pick two linear extensions of ≺ C , denoted by ≺ 1 and ≺ 2 . We have c 1 ≺ 1 · · · ≺ 1 c 5 , and c 1 ≺ 2 c 2 ≺ 2 c 3 ≺ 2 c 5 ≺ 2 c 4 . In this paper we always fix one linear extension.
Remark 3.2 It may seem natural to collapse such loops into singleton local states. In our case studies, e.g, [29], non-trivial loops are used to express non-deterministic choice due to failure detectors [12], as shown in Fig. 4. Importantly, some local states inside the loops appear in the specifications. Thus, one would have to use arguments from distributed computing to characterize when collapsing states is sound. In this paper, we present a technique that deals with the loops without need for additional modelling arguments.

Counter systems
We use a function N : P RC → N 0 to capture the number of processes for each combination of parameters. As we use SMT, we assume that N can be expressed in linear integer arithmetic. For instance, if only correct processes are explictly modeled we typically have N (n, t, f ) = n − f , and the respective SMT expression is n − f . Given N , a threshold automaton TA, and admissible parameter values p ∈ P RC , we define a counter system as a transition system Let us consider a system of five processes, one of them being Byzantine faulty. Thus, n = 5, t = f = 1, and we explicitely model N (5, 1, 1) = n − f = 4 correct processes. One of the initial configurations is σ = (κ, g, p), where σ.κ = (1, 3, 0, 0, 0), σ.g = (0, 0), and σ.p = (5, 1, 1). In other words, there is one process in 1 , three processes in 2 , and global variables are initially Transition relation R A transition is a pair t = (rule, factor) of a rule of the TA and a nonnegative integer called the acceleration factor, or just factor for short. (As already discussed in Sect. 2.1, we will use the zero factors when generating schedules from schemas.) For a transition t = (rule, factor) we refer by t.u to rule.u, and by t.ϕ fall to rule.ϕ fall , etc. We say Note that here we use a notation that a configuration satisfies a formula, which is considered true if and only if the formula becomes true when all free variables of the formulas are evaluated as in the configuration.
We say that transition t is applicable (or enabled) in configuration σ , if it is unlocked, and σ.κ[t.from] ≥ t.factor. (As all counters are non-negative, a transition with the zero factor is always applicable to all configurations provided that the guards are unlocked.) We say that σ is the result of applying the enabled transition t to σ , and write The transition relation R ⊆ Σ ×Σ of the counter system is defined as follows: (σ, σ ) ∈ R iff there is a rule r ∈ R and a factor k ∈ N 0 such that σ = t (σ ) for t = (r, k). Updates do not decrease the values of shared variables, and thus the following proposition was introduced in [41]: Proposition 3.1 [41] For all configurations σ , all rules r , and all transitions t applicable to σ , the following holds: Schedules and paths A schedule is a (finite) sequence of transitions. For a schedule τ and an index i : we denote the ith transition of τ , and by τ i we denote the prefix τ [1], If there is a t i .factor > 1, then a schedule is accelerated.

Contexts and slices
The evaluation of the guards in the sets Φ rise and Φ fall in a configuration solely defines whether certain transitions are unlocked (but not necessarily enabled). From Proposition 3.1, one can see that after a transition has been applied, more guards from Φ rise may get unlocked and more guards from Φ fall may get locked. In other words, more guards from Φ rise may evaluate to true and more guards from Φ fall may evaluate to false. To capture this intuition, we define: We obtain:

Proposition 3.2 Every maximal monotonically increasing sequence of contexts is of length
Thus, there are (|Φ rise | + |Φ fall |)! = 6 maximal monotonically increasing sequences of contexts. Two of them are (∅, ∅) To every configuration σ , we attach the context consisting of all guards in Φ rise that evaluate to true in σ , and all guards in Φ fall that evaluate to false in σ : Definition 3.5 Given a threshold automaton, we define its configuration context as a function ω : The following monotonicity result is a direct consequence of Proposition 3.1.

Proposition 3.4 A schedule τ is steady for a configuration σ if and only if ω(σ ) = ω(τ (σ )).
In the following definition, we associate a sequence of contexts with a path: Definition 3.7 Given a configuration σ and a schedule τ applicable to σ , we say that path(σ, τ ) is consistent with a sequence of contexts Ω 1 , . . . , Ω m , if there exist indices n 0 , . . . , n m , with 0 = n 0 ≤ n 1 ≤ . . . ≤ n m = |τ | + 1, such that for every k, 1 ≤ k ≤ m, and every i with n k−1 ≤ i < n k , it holds that ω(τ i (σ )) = Ω k . r 2 : ϕ 2 → x++ Every path is consistent with a uniquely defined maximal monotonically increasing sequence of contexts. (Some of the indices n 0 , . . . , n m in Definition 3.7 may be equal.) In Sect. 4, we use such sequences of contexts to construct a schema recognizing many paths that are consistent with the same sequence of contexts.
A context defines which rules of the TA are unlocked. A schedule that is steady for a configuration visits only one context, and thus we can statically remove TA's rules that are locked in the context: In other words, R| Ω contains those and only those rules r with guards that evaluate to true in all configurations σ with ω(σ ) = Ω. These are exactly the guards from Ω rise ∪ (Φ fall \Ω fall ).
When ω(σ ) = Ω, then all guards from Ω rise evaluate to true, and then r.ϕ rise must also be true. As Ω fall contains those guards from Φ fall that evaluate to false in σ , then all other guards from Φ fall must evaluate to true, and then r.ϕ fall must be true too. Figure 5 shows an example of a slice.

Model checking problem: parameterized reachability
Given a threshold automaton TA, a state property B is a Boolean combination of formulas that have the form i∈Y κ[i] = 0, for some Y ⊆ L. The parameterized reachability problem is to decide whether there are parameter values p ∈ P RC , an initial configuration σ 0 ∈ I , with σ 0 .p = p, and a schedule τ , such that τ is applicable to σ 0 , and property B holds in the final state: τ (σ 0 ) | B.

Main result: a complete set of schemas
To address parameterized reachability, we introduce schemas, i.e., alternating sequences of contexts and rule sequences. A schema serves as a pattern for a set of paths, and is used to efficiently encode parameterized reachability in SMT. As parameters give rise to infinitely many initial states, a schema captures an infinite set of paths. We show how to construct a finite set of schemas S with the following property: for each schedule τ and each configuration σ there is a representative schedule s(τ ) such that: (1) applying s(τ ) to σ results in τ (σ ), and (2) path(σ, s(τ )) is generated by a schema from S. Given two schemas S 1 = Ω 0 , ρ 1 , . . . , ρ k , Ω k and S 2 = Ω 0 , ρ 1 , . . . , ρ m , Ω m with Ω k = Ω 0 , we define their composition S 1 • S 2 to be the schema that is obtained by concatenation of the two sequences: Ω 0 , ρ 1 , . . . , ρ k , Ω 0 , ρ 1 , . . . , ρ m , Ω m . Definition 4.2 Given a configuration σ and a schedule τ applicable to σ , we say that path(σ, τ ) is generated by a simple schema {Ω} ρ {Ω }, if the following hold: The first and the last states match the contexts: ω(σ ) = Ω and ω(τ (σ )) = Ω .
In general, we say that path(σ, τ ) is generated by a schema S, if S = S 1 • · · · • S k for simple schemas S 1 , . . . , S k and τ = τ 1 · · · τ k such that each path(π i (σ ), τ i ) is generated by the simple schema S i , for π i = τ 1 · · · τ i−1 and 1 ≤ i ≤ k. Remark 4.1 Definition 4.2 allows schemas to generate paths that have transitions with zero acceleration factors. Applying a transition with a zero factor to a configuration σ results in the same configuration σ , which corresponds to a stuttering step. This does not affect reachability. In the following, we will apply Definition 4.2 to representative paths that may have transitions with zero factors.
Example 4.1 Let us go back to the example of a schema S and a schedule τ introduced in Eqs. (2.1) and (2.2) in Sect. 2.1. It is easy to see that schema S can be decomposed into four simple schemas S 1 • · · · • S 4 , e.g., To ensure that path(σ 0 , τ ) is generated by schema S, one has to check Definition 4.2 for schemas S 1 , . . . , S 4 and schedules (τ 1 · t 1 ), (τ 2 · t 2 ), (τ 3 · t 3 ), and τ 4 , respectively. For instance, path(σ 0 , τ 1 · t 1 ) is generated by S 1 . Indeed, take the sequence of indices 1 and 2 and the sequence of acceleration factors 1 and 1. The path path(σ 0 , τ 1 · t 1 ) ends in the configuration σ 1 that differs from σ 0 in that κ Similarly, path(σ 1 , τ 2 · t 2 ) is generated by schema S 2 . To see that, compare the contexts and use the index sequence 1, 2, 4, and acceleration factors 1.
The language of a schema S -denoted with L(S) -is the set of all paths generated by S. For a set of configurations C ⊆ Σ and a set of schemas S, we define the set Reach(C, S) to contain all configurations reachable from C via the paths generated by the schemas from S, i.e., Reach(C, We say that a set S of schemas is complete, if for every set of configurations C ⊆ Σ it is the case that the set of all states reachable from C via the paths generated by the schemas from S, is exactly the set of all possible states reachable from C. In [41], a quantity C has been introduced that depends on the number of conditions in a TA. It has been shown that for every configuration σ and every schedule τ applicable to σ , there is a schedule τ of length at most d = |R| · (C + 1) + C that is also applicable to σ and results in τ (σ ) [41,Thm. 8]. Hence, by enumerating all sequences of rules of length up to d, one can construct a complete set of schemas: Although the set S d is finite, enumerating all its elements is impractical. We show that there is a complete set of schemas whose cardinality solely depends on the number of guards that syntactically occur in the TA. These numbers |Φ rise | and |Φ fall | are in practice much smaller than the number of rules |R|: Theorem 4.2 For all threshold automata, there exists a complete schema set of cardinality at most (|Φ rise | + |Φ fall |)!. In this set, the length of each schema does not exceed (3 · |Φ rise ∪ Φ fall | + 2) · |R|.
In the following sections we prove the ingredients of the following argument for the theorem: construct the set Z of all maximal monotonically increasing sequences of contexts. From Proposition 3.2, we know that there are at most (|Φ rise | + |Φ fall |)! maximal monotonically increasing sequences of contexts. Therefore, |Z | ≤ (|Φ rise | + |Φ fall |)!. Then, for each sequence z ∈ Z , we do the following: (1) We show that for each configuration σ and each schedule τ applicable to σ and consistent with the sequence z, there is a schedule s(τ ) that has a specific structure, and is also applicable to σ . We call s(τ ) the representative of τ . We introduce and formally define this specific structure of representative schedules in Sects. 5, 6 and 7. We prove existence and properties of the representative schedule in Theorem 7.1 (Sect. 7). Before that we consider special cases: when all rules of a schedule belong to the same looplet (Theorem 5.1, Sect. 5), and when a schedule is steady (Theorem 6.1, Sect. 6).
(2) Next we construct a schema (for the sequence z) and show that it generates all paths of all schedules s(τ ) found in (1). The length of the schema is at most (3 · (|Φ rise | + |Φ fall |) + 2) · |R|. This is shown in Theorem 7.2 (Sect. 7).
Theorem 4.2 follows from the above theorems, which we prove in the following.

Remark 4.2
Let us stress the difference between [41] and this work. From [41], it follows that in order to check correctness of a TA it is sufficient to check only the schedules of bounded length d(TA). The bound d(TA) does not depend on the parameters, and can be computed for each TA. The proofs in [41] demonstrate that every schedule longer than d(TA) can be transformed into an "equivalent" representative schedule, whose length is bounded by d(TA). Consequently, one can treat every schedule of length up to d(TA) as its own representative schedule. Similar reasoning does not apply to the schemas constructed in this paper: (i) we construct a complete set of schemas, whose cardinality is substantially smaller than |S d |, and (ii) the schemas constructed in this paper can be twice as long as the schemas in S d .
As discussed in Remark 3.2, the looplets in our case studies are typically either singleton looplets or looplets of size two. In fact, most of our benchmarks have singleton looplets only, and thus their threshold automata can be reduced to directed acyclic graphs. The theoretical constructs of Sect. 5.2 are presented for the more general case of looplets of any size. For most of the benchmarks -the ones not using failure detectors -we need only the simple construction laid out in Sect. 5.1.

Case I: one context and one looplet
We show that for each schedule that uses only the rules from a fixed looplet and does not change its context, there exists a representative schedule of bounded length that reaches the same final state. The goal is to construct a single schema per looplet. The technical challenge is that this single schema must generate representative schedules for all possible schedules, where, intuitively, processes may move arbitrarily between all local states in the looplet. As a consequence, the rules that appear in the representative schedules can differ from the rules that appear in the arbitrary schedules visiting a looplet.
We fix a threshold automaton, a context Ω, a configuration σ with ω(σ ) = Ω, a looplet c, and a schedule τ applicable to σ and using only rules from c. We then construct the representative schedule crep Ω c [σ, τ ] and the schema cschema Ω c . The technical details of the construction of crep Ω c [σ, τ ] for the case when |c| = 1 is given in Sect. 5.1, and for the case when |c| > 1 in Sect. 5.2. We show in Sect. 5.3 that these constructions give us a schedule that has the desired properties: it reaches the same final state as the given schedule τ , and its length does not exceed 2 · |c|.
Note that in [41], the length of the representative schedule was bounded by |c|. However, all representative schedules of a looplet in this section can be generated by a single looplet schema.

Singleton looplet
Let us consider the case of the looplet c containing only one transition, that is, |c| = 1. There is a trivial representative schedule of a single transition: a threshold automaton, a configuration σ , and a schedule τ = (r, f 1 ), …, (r, f m ) applicable to σ , one of the two schedules is also applicable to σ and results in τ (σ ): schedule (r, f 1 + · · · + f m ), or schedule (r, 0).
Case r.to = r. f rom We prove by induction on the length k : 1 ≤ k ≤ m of a prefix of τ , that the following constraints hold for all k: Base case k = 1. As schedule τ is applicable to σ , its first transition is enabled in σ . Thus, by the definition of an enabled transition, the rule r is unlocked, i.e., for all f ∈ {0, . . . , f 1 }, it holds (σ.κ, σ.g + f 1 · r.u, σ.p) | r.ϕ fall ∧ r.ϕ rise . By the definition, once the transition 1 and (τ k (σ )).g = σ.g + f 1 · r.u. Thus, Constraints (5.1)-(5.3) are satisfied for k = 1.
Consequently, when c has a single rule r , for configuration σ and a schedule τ = (r, f 1 ), . . . , (r, f m )

Non-singleton looplet
Next we focus on non-singleton looplets. Thus, we assume that |c| > 1. Our construction is based on two directed trees, whose undirected versions are spanning trees, sharing the same root. In order to find a representative of a steady schedule τ which leads from σ to τ (σ ), we determine for each local state how many processes have to move in or out of the state, and then we move them along the edges of the trees. First, we give the definitions of such trees, and then we show how to use them to construct the representative schedules and the schema.

Spanning out-trees and in-trees
We construct the underlying graph of looplet c, that is, a directed graph G c , whose vertices consist of local states that appear as components from or to of the rules from c, and the edges are the rules of c. More precisely, we construct a directed graph G c = (V c , E c , L c ), whose edges from Lemma 5.2 Given a threshold automaton and a non-singleton looplet c ∈ R/∼, graph G c is non-empty and strongly connected.
Proof As, |c| > 1 and thus E c ≥ 2, graph G c is non-empty. To prove that G c is strongly connected, we consider a pair of rules r 1 , r 2 ∈ c. By the definition of a looplet, it holds that r 1 ≺ + P r 2 and r 2 ≺ + P r 1 . Thus, there is a path in G c from r 1 .to to r 2 .from, and there is a path in G c from r 2 .to to r 1 .from. As r 1 and r 2 correspond to some edges in G c , there is a cycle that contains the vertices r 1 .from, r 1 .to, r 2 .from, and r 2 .to. Thus, graph G c is strongly connected.
As G c is non-empty and strongly connected, we can fix an arbitrary node h ∈ V c -called a hub -and construct two directed trees, whose undirected versions are spanning trees of the undirected version of G c . These are two subgraphs of G c : a directed tree T out = (V c , E out ), whose edges E out ⊆ E c are pointing away from h (out-tree); a directed tree T in = (V c , E in ), whose edges E in ⊆ E c are pointing to h (in-tree). For every node v ∈ V c \{h}, it holds that |{u : (u, v) ∈ E out }| = 1 and |{w : (v, w) ∈ E in }| = 1. e o u t ( 4 ) Fig. 6 The underlying graph of the looplet c 2 of the threshold automaton from Example 3.3 and Fig. 3 (left), together with trees T in (middle) and T out (right) Further, we fix a topological order in on the edges of tree T in . More precisely, in is such a partial order on E in that for each pair of adjacent edges ( , ), ( , ) ∈ E in , it holds that ( , ) in ( , ). In the same way, we fix a topological order out on the edges of tree T out .
Example 5.1 Consider again the threshold automaton from Example 3.3 and Fig. 3. We construct trees T in and T out for looplet c 2 , shown in Fig. 6.
Note that V c = { 2 , 3 , 4 , 5 , 6 }, and E c = {( 2 , 3 ), ( 3 , 5 ), ( 5 , 6 ), ( 6 , 4 ), ( 4 , 4 ), ( 4 , 5 ), ( 4 , 2 )}. Fix 4 as a hub. We can fix a linear order in such that ( 6 , 4 ), and a linear order out such that Note that for the chosen hub l 4 and this specific example, T in and in are uniquely defined, while an out-tree can be different from T out from our Fig. 6 (the rules r 8 , r 2 , r 3 , r 4 constitute a different tree from the same hub). Because out-tree T out is not a chain, several linear orders different from out can be chosen, e.g., ( 4 , 2 ) out ( 4 , 5 ) out ( 2 , 3 ) out ( 5 , 6 ). Representatives of non-singleton looplets Using these trees, we show how to construct a representative crep Ω c [σ, τ ] of a schedule τ applicable to σ with σ = τ (σ ). For a configuration σ and a schedule τ applicable to σ , consider the trees T in and T out . We construct two sequences: the sequence e in (1), . . . , e in (|E in |) of all edges of T in following the order in , i.e., if e in (i) in e in ( j), then i ≤ j; the sequence e out (1), . . . , e out (|E out |) of all edges of T out following the order out . Further, we define the sequence of rules r in (1), . . . , r in (|E in |) with r in (i) = L c (e in (i)) for 1 ≤ i ≤ |E in |, and the sequence of rules r out (1), . . . , r out (|E out |) with r out (i) = L c (e out (i)) for 1 ≤ i ≤ |E out |. Using configurations σ and σ = τ (σ ), we define: If δ in (i) ≥ 0, then δ in (i) processes should leave the local state r in (i).from towards the hub, and they do it exclusively using the edge e in (i). If δ out ( j) ≥ 0, then δ out ( j) processes should reach the state r out ( j).to from the hub, and they do it exclusively using the edge e out ( j). The negative values of δ in (i) and δ out ( j) do not play any role in our construction, and thus, we use max(δ in (i), 0) and max(δ out ( j), 0).
The main idea of the representative construction is as follows. First, we fire the sequence of rules r in (1), . . . , r in (k) to collect sufficiently many processes in the hub. Then, we fire the sequence of rules r out (1), . . . , r out (k) to distribute the required number of processes from the hub. As a result, for each location in the graph, the processes are transferred from σ σ : :
In the following, we fix a threshold automaton TA, a context Ω, and a non-singleton looplet c of the slice TA| Ω . We also fix a configuration σ of TA and a schedule τ that is contained in c and is applicable to σ . Our goal is to prove Lemma 5.8, which states that crep Ω c [σ, τ ] is indeed applicable to σ and ends in τ (σ ). To this end, we first prove auxiliary Lemmas 5.3-5.7.

Lemma 5.3 For every i
Proof Recall that by the definition of a configuration, every counter σ.κ[ ] is non-negative.

Lemma 5.4 Schedule
All rules r in (1), . . . , r in (|E in |) are from R| Ω , and thus are unlocked. Hence, it is sufficient to show that the values of the locations from the set V c are large enough to enable each transition (r in (i), w in (i)) for 1 ≤ i ≤ |E in |. To this end, we prove by induction that (α i−1 (σ )).κ[r i .from] ≥ w in (i), for 1 ≤ i ≤ |E in | and r i = L c (e in (i)).
Inductive step k assume that for all i : To this end, we construct the set of edges P k that precede the edge e in (k) in the topological order in , that is, P k = {e | e ∈ E in , e in e in (k), e = e in (k)}. We show that the following equation holds: Indeed, if one picks an edge e in ( j) ∈ P k , the edge e in ( j) adds w in ( j) to the counter κ[r k .from]. As the sequence {e in (i)} i≤k is topologically sorted, it follows that j < k. Moreover, as the tree T in is oriented towards the root, e in (k) is the only edge leaving the local state r k .from. Thus, no edge e in (i) with i < k decrements the counter σ.κ[r k .from].
Therefore, we have shown that τ in = α |E in | is applicable to σ .
The following lemma is easy to prove by induction on the length of a schedule. The base case for a single transition follows from the definition of a counter system.

Lemma 5.5 Let σ and σ be two configurations and τ be a schedule applicable to σ such that τ (σ ) = σ . Then it holds that
Further, we show that the required number of processes is reaching (or leaving) the hub, when the transitions derived from the trees T in and T out are executed: Lemma 5. 6 The following equality holds: Proof Recall that T in is a tree directed towards h, and the undirected version of T in is a spanning tree of graph C. Hence, for each local state ∈ V c \{h}, there is exactly one edge e ∈ E in with L c (e).from = . Thus, the following equation holds: Similarly, T out is a tree directed outwards h, and the undirected version of T out is a spanning tree of graph C. Hence, for each local state ∈ V c \{h}, there is exactly one edge e ∈ E out with L c (e).to = . Thus, the following equation holds: By combining (5.6) and (5.7), we obtain the following: As the initial schedule τ is applicable to σ , and τ (σ ) = σ , by Lemma 5.5, Proof We prove the lemma by case distinction:  Now we are in a position to prove that schedule crep Ω c [σ, τ ] is applicable to configuration σ and results in configuration τ (σ ): We notice that all rules in crep Ω c [σ, τ ] are from R| Ω and thus are unlocked, and that τ in is applicable to σ by Lemma 5.4. Hence, we only have to check that the values of counters from V c are large enough, so that transitions (r out ( j), w out ( j)) can fire.
We prove that each schedule β j is applicable to σ , for j : 1 ≤ j ≤ |E out |. We do so by induction on the distance from the root h in the tree T out . Base Inductive step assume that for a node ∈ V c and an edge e out (k) = ( , ) ∈ E out outgoing from node , schedule β k is applicable to configuration σ . Show that for each edge e out (i) outgoing from node the following hold: (i) schedule β i is also applicable to σ ; and (ii) (i) As the sequence {e out ( j)} j≤|E out | is topologically sorted, for each edge e out (i) outgoing from node , it holds that k < i.

Representatives for one context and one looplet
We now summarize results from Sects. 5.1 and 5.2, giving the representative of a schedule τ in the case when τ uses only the rules from one looplet, and does not change its context. If the given looplet consists of a single rule, the construction is given in Sect. 5.1, and otherwise in Sect. 5.2. We show that these constructions indeed give us a schedule of bounded length, that reaches the same state as τ . In the following, given a threshold automaton TA and a looplet c, we will say that a is not longer than 2 · |c|.
Proof If |c| = 1, then we use a single accelerated transition or the empty schedule as representative, as described in Lemma 5.1.
If |c| > 1, we construct the representative as in Sect. 5.2, so that by Lemma 5.8 property (a) follows. For every edge e ∈ E c , the rule L c (e) belongs to c, and thus crep Ω c [σ, τ ] satisfies property (b). As |E in | ≤ |c| and |E out | ≤ |c|, we conclude that |crep Ω c [σ, τ ]| ≤ 2 · |c|, and thus property c) is also satisfied. From this and Lemma 5.8, we conclude that crep Ω c [σ, τ ] is the required representative schedule. If |c| = 1, then by Lemma 5.1 we have that τ = (r, f ) for a rule r ∈ c and a factor f ∈ N 0 . In this case we construct cschema Ω c to be cschema Ω c = {Ω} r {Ω}. It is easy to see that path(σ, τ ) is generated by cschema Ω c , as well as that the length of cschema Ω c is exactly 1, that is less than 2 · |c|.
If |c| > 1, then we use the trees T in and T out to construct the schema cschema Ω c as follows: Since for an arbitrary configuration σ and a schedule τ , we use the same sequence of edges in Eqs. (5.4) and (5.9) to construct crep Ω c [σ, τ ] and cschema Ω c , the schema cschema Ω c generates all paths of the representative schedules, and its length is at most 2 · |c|.

Case II: one context and multiple looplets
In this section, we show that for each steady schedule, there exists a representative steady schedule of bounded length that reaches the same final state.
To construct a representative schedule, we fix a context Ω of a TA, a configuration σ with ω(σ ) = Ω, and a steady schedule τ applicable to σ . The key notion in our construction is a projection of a schedule on a set of looplets: In fact, each schedule τ has a unique projection on a set C. In the following, we write τ | c 1 ,...,c m to denote the projection of τ on a set {c 1 , . . . , c m }.
Provided that c 1 , . . . , c m are all looplets of the slice R| Ω ordered with respect to ≺ lin C , we construct the following sequences of projections on each looplet (note that π 0 is the empty schedule): π i = τ | c 1 · · · · · τ | c i for 0 ≤ i ≤ m.

Proof
In the following, we show Points 1-3 one-by-one. We need extra notation. For a local state we denote by 1 the |L|-dimensional vector, where the th component is 1, and all the other components are 0. Given a schedule ρ = t 1 · · · t k , we introduce a vector Δ κ (ρ) ∈ Z |L| to keep counter difference and a vector Δ g (ρ) ∈ N |Γ | 0 to keep difference on shared variables as follows: Proof of (1) Assume by contradiction that schedule τ | c 1 is not applicable to configuration σ . Thus, there is a schedule τ and a transition t * that constitute a prefix of τ | c 1 , with the following property: τ is applicable to σ , whereas τ · t * is not applicable to σ . Let = t * .from and = t * .to.
There are three cases of why t * may be not applicable to τ (σ ): (i) There is not enough processes to move: (σ.κ + Δ κ (τ · t * ))[ ] < 0. As τ is applicable to σ , there is a transition t of τ with [t.rule] = c 1 and t.to = as well as t.factor > 0. From this, by definition of ≺ lin C , it follows that [t.rule] ≺ lin C c 1 . This contradicts the lemma's assumption on the order c 1 ≺ lin C · · · ≺ lin C c m . (ii) The condition t * .ϕ rise is not satisfied, that is, τ (σ ) | t * .ϕ rise . Then, there is a guard ϕ ∈ guard(t * .ϕ rise ) with τ (σ ) | ϕ.
(ii) We now show that σ | t.ϕ rise ∧ t.ϕ fall . Assume by contradiction that σ | t.ϕ rise ∧ t.ϕ fall . There are two cases to consider.
We have thus shown all three points of Lemma 6.1.
Finally, we show that for a given context, there is a schema that generates all paths of such representative schedules. Proof Fix a configuration σ with ω(σ ) = Ω and a steady schedule τ applicable to σ . As srep Ω [σ, τ ] is a sorted sequence of the looplet representatives, all paths of srep Ω [σ, τ ] are generated by sschema Ω , which is not longer than 2 · |(R| Ω )|.

Proving the main result
Using the results from Sects. 5 and 6, for each configuration and each schedule (without restrictions) we construct a representative schedule. Proof Given a threshold automaton, fix a configuration σ and a schedule τ applicable to σ . Let Ω 1 , . . . , Ω K +1 be the maximal monotonically increasing sequence of contexts such that path(σ, τ ) is consistent with the sequence by Definition 3.7. From Proposition 3.2, the length of the sequence is K + 1 = |Φ rise | + |Φ fall | + 1. Thus, there are at most K transitions t 1 , . . . , t K in τ that change their context, i.e., for i ∈ {1, . . . , K }, it holds ω(σ i ) ω(t i (σ i )) for t i 's respective state σ i in τ . Therefore, we can divide τ into K + 1 steady schedules separated by the transitions t 1 , . . . , t K : Now, the main idea is to replace the steady schedules with their representatives from Theorem 6.1. That is, using t 1 , . . . , t K and ν 1 , . . . , ν K +1 , we construct the schedules ρ 1 , . . . , ρ K (by convention, ρ 0 is the empty schedule): Finally, the representative schedule rep[τ, σ ] is constructed as follows: From Theorem 6.1, it follows that rep[τ, σ ] is applicable to σ and it results in τ (σ ). Moreover, the representative of a steady schedule is not longer than 2|R|, which together with K transitions gives us the bound 2|R|(K +1)+ K . As we have that K = |Φ rise |+|Φ fall |, this gives us the required bound.
Further, given a maximal monotonically increasing sequence z of contexts, we construct a schema that generates all paths of the schedules consistent with z: Theorem 7.2 For a threshold automaton and a monotonically increasing sequence z of contexts, there exists a schema schema(z) that generates all paths of the representative schedules that are consistent with z, and the length of schema(z) does not exceed 3 · |R| · (|Φ rise | + |Φ fall |) + 2 · |R|.
Proof Given a threshold automaton, let ρ all be the sequence r 1 , . . . , r |R| of all rules from R, and let z = Ω 0 , . . . , Ω m be a monotonically increasing sequence of contexts. By the construction in Theorem 7.1, each representative schedule rep[σ, τ ] consists of the representatives of steady schedules terminated with transitions that change the context. Then, for each context Ω i , for 0 ≤ i < m, we compose sschema Ω and {Ω i } ρ all {Ω i+1 }. This composition generates the representative of a steady schedule and the transition changing the context from Ω i to Ω i+1 . Consequently, we construct the schema(z) as follows: By inductively applying Theorem 6.2, we prove that schema(z) generates all paths of schedules rep[σ, τ ] that are consistent with the sequence z. We get the needed bound on the length of schema(z) by using an argument similar to Theorem 7.1 and by noting that for every context, instead of one rule that is changing it, we add |R| extra rules.

Complete set of schemas and optimizations
Our proofs show that the set of schemas is easily computed from the TA: the threshold guards are syntactic parts of the TA, and enable us to directly construct increasing sequences of contexts. To find a slice of the TA for a given context, we filter the rules with unlocked guards, i.e., check whether the context contains the guard. To produce the simple schema of a looplet, we compute a spanning tree over the slice. To construct simple schemas, we do a topological sort over the looplets. For example, it takes just 30 s to compute the schemas in our longest experiment that runs for 4 h. In our tool we have implemented the following optimizations that lead to simpler and fewer SMT queries.

Entailment optimization
We say that a guard ϕ 1 ∈ Φ rise entails a guard ϕ 2 ∈ Φ rise , if for all combinations of parameters p ∈ P RC and shared variables g ∈ N |Γ | 0 , it holds that (g, p) | ϕ 1 → ϕ 2 . For instance, in our example, ϕ 3 : y ≥ (2t + 1) − f entails ϕ 2 : y ≥ (t + 1) − f . If ϕ 1 entails ϕ 2 , then we can omit all monotonically increasing sequences that contain a context (Ω rise , Ω fall ) with ϕ 1 ∈ Ω rise and ϕ 2 / ∈ Ω rise . If the number of schemas before applying this optimization is m! and there are k entailments, then the number of schemas reduces from m! to (m − k)!. A similar optimization is introduced for the guards from Φ fall .
Control flow optimization Based on the proof of Lemma 6.1, we introduce the following optimization for TAs that are directed acyclic graphs (possibly with self loops). We say that a rule r ∈ R may unlock a guard ϕ ∈ Φ rise , if there is a p ∈ P RC and g ∈ N |Γ | 0 satisfying: (g, p) | r.ϕ rise ∧ r.ϕ fall (the rule is unlocked); (g, p) | ϕ (the guard is locked); (g + r.u, p) | ϕ (the guard is now unlocked).
Let ϕ ∈ Φ rise be a guard, r 1 , . . . , r m be the rules that use ϕ, and r 1 , . . . , r k be the rules that may unlock ϕ. If r i ≺ lin C r j , for 1 ≤ i ≤ k and 1 ≤ j ≤ m, then we exclude some sequences of contexts as follows (we call ϕ forward-unlockable). Let ψ 1 , . . . , ψ n ∈ Φ rise be the guards of r 1 , . . . , r k . Guard ϕ cannot be unlocked before ψ 1 , . . . , ψ n , and thus we can omit all sequences of contexts, where ϕ appears in the contexts before ψ 1 , . . . , ψ n . Moreover, as ψ 1 , . . . , ψ n are the only guards of the rules unlocking ϕ, we omit the sequences with different combinations of contexts involving ϕ and the guards from Φ rise \{ϕ, ψ 1 , . . . , ψ n }. Finally, as the rules r 1 , . . . , r m appear after the rules r 1 , . . . , r k in the order ≺ lin C , the rules r 1 , . . . , r m appear after the rules r 1 , . . . , r k in a rule sequence of every schema. Thus, we omit the combinations of the contexts involving ϕ and ψ 1 , . . . , ψ n .
Hence, we add all forward-unlockable guards to the initial context (we still check the guards of the rules in the SMT encoding in Sect. 9). If the number of schemas before applying this optimization is m! and there are k forward-unlocking guards, then the number of schemas reduces from m! to (m − k)!. A similar optimization is introduced for the guards from Φ fall .

Checking a schema with SMT
We decompose a schema into a sequence of simple schemas, and encode the simple schemas. Given a simple schema S = {Ω 1 } r 1 , . . . , r m {Ω 2 }, which contains m rules, we construct an SMT formula such that every model of the formula represents a path from L(S) -the language of paths generated by schema S -and for every path in L(S) there is a corresponding model of the formula. Thus, we need to model a path of m +1 configurations and m transitions (whose acceleration factors may be 0).
To represent a configuration σ i , for 0 ≤ i ≤ m, we introduce two vectors of SMT variables: Given the set of local states L and the set of shared variables Γ , a vector k i = (k i 1 , . . . , k i |L| ) to represent the process counters, a vector x i = (x i 1 , . . . , x i |Γ | ) to represent the shared variables. We call the pair (k i , x i ) the layer i, for 1 ≤ i ≤ m.
Based on this we encode schemas, for which the sequence of rules r 1 , . . . , r m is fixed. We exploit this in two ways: First, we encode for each layer i the constraints of rule r i . Second, as this constraint may update only two counters -the processes move from and move to according to the rule -we do not need |L| counter variables per layer, but only encode the two counters per layer that have actually changed. As is a common technique in bounded model checking, the counters that are not changed are "reused" from previous layers in our encoding. By doing so, we encode the schema rules with |L| + |Γ | + m · (2 + |Γ |) integer variables, 2m equations, and inequalities in linear integer arithmetic that represent threshold guards that evaluate to true (at most the number of threshold guards times m of these inequalities).
In the following, we use the notation [k : m] to denote the set {k, . . . , m}. In order to reuse the variables from the previous layers, we introduce a function υ : L × [0 : m] → [0 : m] that for a layer i ∈ [0 : m] and a local state ∈ L, gives the largest number j ≤ i of the layer, where the counter k j is updated: Having defined layers, we encode: the effect of rules on counters and shared variables (in formulas M and U below), the effect of rules on the configuration (T ), restrictions imposed by contexts (C), and, finally, the reachability question.
To represent m transitions, for each transition i ∈ [1 : m], we introduce a non-negative variable δ i for the acceleration factor, and define two formulas: formula M (i − 1, i) to express the update of the counter of local state ∈ L, and formula U x (i − 1, i) to represent the update of the shared variable x ∈ Γ : otherwise.
The formula T (i − 1, i) collects all constraints by the rule r i : For a formula ϕ, we denote by ϕ[x i ] the formula, where each variable x ∈ Γ is substituted with x i . Then, given a context Ω = (Ω rise , Ω fall ), a formula C Ω (i) adds the constraints of the context Ω on the layer i: Finally, the formula C Ω 1 (0) ∧ T (0, 1) ∧ · · · ∧ T (m − 1, m) ∧ C Ω 2 (m) captures all the constraints of the schema S = {Ω 1 } r 1 , . . . , r m {Ω 2 }, and thus, its models correspond to the paths of schedules that are generated by S.
Let I (0) be the formula over the variables of layer i that captures the initial states of the threshold automaton, and B(i) be a state property over the variables of layer i. Then, parameterized reachability for the schema S is encoded with the following formula in linear integer arithmetic:

Experiments
We have extended our tool ByMC (Byzantine Model Checker [2]) with the technique discussed in this paper. All of our benchmark algorithms were originally published in pseudocode, and we model them in a parametric extension of Promela, which was discussed in [27,34].

Benchmarks
We revisited several asynchronous FTDAs that were evaluated in [33,41]. In addition to these classic FTDAs, we considered asynchronous (Byzantine) consensus algorithms, namely, BOSCO [57], C1CS [10], and CF1S [18], that are designed to work despite partial failure of the distributed system. In contrast to the conference version of this paper [39], we used a new version of the benchmarks from [37] that have been slightly updated for liveness properties. Hence, for some benchmarks, the running times of our tool may vary from [39]. The benchmarks, their source code in parametric of Promela, and the code of the threshold automata are freely available [30].

Implementation
ByMC supports several tool chains (shown in Fig. 1, p. 3), the first using counter abstraction (that is, process counters over an abstract domain), and the second using counter systems with counters over integers: Data and counter abstractions In this chain, the message counters are first mapped to parametric intervals, e.g., counters range over the abstract domainD = {[0, 1), [1, t + 1), [t + 1, n − t), [n − t, ∞)}. By doing so, we obtain a finite (data) abstraction of each process, and thus we can represent the system as a counter system: We maintain one counter κ[ ] per local state of a process, as well as the counters for the sent messages. Then, in the counter abstraction step, every process counter κ[ ] is mapped to the set of parametric intervalsD. As the abstractions may produce spurious counterexamples, we run them in an abstractionrefinement loop that incrementally prunes spurious transitions and unfair executions. More details on the data and counter abstractions and refinement can be found in [33]. In our experiments, we use two kinds of model checkers as backend: 1. BDD The counter abstraction is checked with nuXmv [11] using Binary Decision Diagrams (BDDs). For safety properties, the tool executes the command check_invar.
In our experiments, we used the timeout of 3 days, as there was at least one benchmark that needed a bit more than a day to complete. 2. BMC The counter abstraction is checked with nuXmv using bounded model checking [6]. To ensure completeness (at the level of counter abstraction), we explore the computations of the length up to the diameter bounds that were obtained in [41].
To efficiently eliminate shallow spurious counterexamples, we first run the bounded model checker in the incremental mode up to length of 30. This is done by issuing the nuXmv command check_ltlspec_sbmc_inc, which uses the built-in SAT solver MiniSAT. Then, we run a single-shot SAT problem by issuing the nuXmv command gen_ltlspec_sbmc and checking the generated formula with the SAT solver lingeling [5]. In our experiments, we set the timeout to 1 day.
Reachability for threshold automata In this tool chain, to obtain a threshold automaton, our tool first applies data abstraction over the domainD to the Promela code, which abstracts the message counters that keep the number of messages received by every process, while the message counters for the sent messages are kept as integers. More details can be found in [40]. Having constructed a threshold automaton, we compare two verification approaches: 2. FAST Acceleration of counter automata In this chain, our tool constructs a threshold automaton and checks the reachability properties with the existing tool FAST [3]. For comparison with our tool, we run FAST with the MONA plugin that produced the best results in our experiments.
The challenge in the verification of FTDAs is the immense non-determinism caused by interleavings, asynchronous message passing, and faults. In our modeling, all these are reflected in non-deterministic choices in the Promela code. To obtain threshold automata, as required for our technique, our tool constructs a parametric interval data abstraction [33] that adds to non-determinism.
Comparing to [39], in this paper, we have introduced an optimization to schema checking that dramatically reduced the running times for some of the benchmarks. In this optimization, we group schemas in a prefix tree, whose nodes are contexts and edges are simple schemas. In each node of the prefix tree, our tool checks, whether there are configurations that are reachable from the initial configurations by following the schemas in the prefix. If there are no such reachable configurations, we can safely prune the whole suffix and thus prove many schemas to be unsatisfiable at once. Table 1 summarizes the features of threshold automata that are automatically constructed by ByMC from parametric Promela. The number of local states |L| varies from 7 (FRB and STRB) to hundreds (C1CS and CBC). Our threshold automata are obtained by applying interval abstraction to Promela code, which keeps track of the number of messages received by each process. Thus, the number |L| is proportional to the number of control states and | D| k , where D is the domain of parametric intervals (discussed above) and k is the number of message types. Sometimes, one can manually construct a more efficient threshold automaton that models the same fault-tolerant distributed algorithm and preserves the same safety properties. For instance, Fig. 2 shows a manual abstraction of ABA that has only 5 local states, in contrast to 61 local states in the automatic abstraction (cf. Table 1). We leave open the question of whether one can automatically construct a minimal threshold automaton with respect to given specifications. Table 2 summarizes our experiments conducted with the techniques introduced in Sect. 10.2: BDD, BMC, PARA 2 , and FAST. On large problems, our new technique works significantly better than BDD-and SAT-based model checking. BDD-based model checking works very well on top of counter abstraction. Importantly, our new technique does not use abstraction refinement. In comparison to our earlier experiments [39], we verified safety of a larger set of benchmarks with nuXmv. We believe that this is due to the improvements in nuXmv and, probably, slight modifications of the benchmarks from [37].

Evaluation
NBAC and NBACC are challenging as the model checker produces many spurious counterexamples, which are an artifact of counter abstraction losing or adding processes. When using SAT-based model checking, the individual calls to nuXmv are fast, but the abstractionrefinement loop times out, due to a large number of refinements (about 500). BDD-based model checking times out when looking for a counterexample. Our new technique, preserves the number of proceses, and thus, there are no spurious counterexamples of this kind. In comparison to the general-purpose acceleration tool FAST, our tool uses less memory and is faster on the benchmarks where FAST is successful.
As predicted by the distributed algorithms literature, our tool finds counterexamples, when we relax the resilience condition. In contrast to counter abstraction, our new technique gives Table 1 The benchmarks used in our experiments. Some benchmarks, e.g., ABA, require us to consider several cases on the parameters, which are mentioned in the column "Case". The meaning of the other columns is as follows: |L| is the number of local states in TA, |R| is the number of rules in TA, |Φ rise | and |Φ fall | is the number of (R)-and (F)-guards respectively. Finally, |S| is the number of enumerated schemas, and Bound is the theoretical upper bound on |S|, as given in Theorem 4.2 Table 2 Summary of our experiments on AMD Opteron® 6272, 32 cores, 192 GB. The symbols are: " " for timeout (72 h. for BDD and 24 h. otherwise); " " for memory overrun of 32 GB; " " for BDD nodes overrun; " " for timeout in the refinement loop (72 h. for BDD and 24 h. otherwise); " " for spurious counterexamples due to counter abstraction schemas. The much smaller numbers for the fault-tolerant distributed algorithms are due to a natural order on guards, e.g., as x ≥ t + 1 becomes true earlier than x ≥ n − t under the resilience condition n > 3t. The drastic reduction in the case of CBC is due to the control flow optimization discussed in Sect. 8 and the fact that basically all guards are forward-unlocking.
When doing experiments, we noticed that the only kinds of guards that cannot be treated by our optimizations and blow up the number of schemas are the guards that use independent shared variables. For instance, consider the guards x 0 ≥ n − t and x 1 ≥ n − t that are counting the number of 0's and 1's sent by the correct processes. Even though they are mutually exlusive under the resilience condition n > 3t, our tool has to explore all possible orderings of these guards. We are not aware of a reduction that would prevent our method from exploding in the number of schemas for this example.
Since the schemas can be checked independently, one can check them in parallel. Figure 9 shows a distribution of schemas along with the time needed to check an individual schema. There are only a few divergent schemas that required more than 7 s to get checked, while the large portion of schemas require 1-3 s. Hence, a parallel implementation of the tool should verify the algorithms significantly faster. We leave such a parallel extension for future work.

Discussions and related work
We introduced a method to efficiently check reachability properties of FTDAs in a parameterized way. If n > 7t as for BOSCO, even the simplest interesting case with t = 2 leads to a system size that is out of range of explicit state model checking. Hence, FTDAs force us to develop parameterized verification methods. The problem we consider is concerned with parameterized model checking, for which many interesting results exist [14,15,[21][22][23]35]; cf. [7] for a survey. However, the FTDAs considered by us run under the different assumptions.
From a methodological viewpoint, our approach combines techniques from several areas including compact programs [49], counter abstraction [4,55], completeness thresholds for bounded model checking [6,16,42], partial order reduction [8,28,53,59], and Lipton's movers [48]. Regarding counter automata, our result entails flattability [46] of every counter system of threshold automata: a complete set of schemas immediately gives us a flat counter automaton. Hence, the acceleration-based semi-algorithms [3,46] should in principle terminate on the systems of TAs, though it did not always happen in our experiments. Similar to our SMT queries based on schemas, the inductive data flow graphs iDFG introduced in [24] are a succinct representations of schedules (they call them traces) for systems where the number of processes (or threads) is fixed. The work presented in [25] then considers parameterized verification. Further, our execution schemas are inspired by a general notion of semi-linear path schemas SLPS [45,46]. We construct a small complete set of schemas and thus a provably small SLPS. Besides, we distinguish counter systems and counter abstraction: the former counts processes as integers, while the latter uses counters over a finite abstract domain, e.g., {0, 1, many} [55].
Many distributed algorithms can be represented with I/O Automata [50] or TLA+ [44]. In these frameworks, correctness is typically shown with a proof assistant, while model checking is used as a debugger on small instances. Parameterized model checking is not a concern there, except one notable result [32].
The results presented in this article can be used to check reachability properties of FTDAs. We can thus establish safety of FTDAs. However, for fault-tolerant distributed algorithms liveness is as important as safety: The seminal impossibility result by Fischer, Lynch, and Paterson [26] states that a fault-tolerant consensus algorithm cannot ensure both safety and liveness in asynchronous systems. In recent work [37] we also considered liveness verification, or more precisely, verification of temporal logic specification with the G and F temporal operators. In [37], we use the results of this article as a black box and show that combinations of schemas can be used to generate counterexamples to liveness properties, and that we can verify both safety and liveness by complete SMT-based bounded model checking.