Systematic formal verification for fault-tolerant time-triggered algorithms

IEEE Transactions on Software Engineering

Volumn 25, Issue 5, 1999, Pages 651-660

  Rushby, John ^a,b  

^a IEEE

^b SRI INTERNATIONAL   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ALGORITHMS; COMPUTER SYSTEMS PROGRAMMING; FORMAL LANGUAGES; RESPONSE TIME (COMPUTER SYSTEMS);

FAULT TOLERANT TIME-TRIGGERED ALGORITHMS; SYSTEMATIC FORMAL VERIFICATION;

FAULT TOLERANT COMPUTER SYSTEMS;

EID: 0033336111     PISSN: 00985589     EISSN: None     Source Type: Journal    
DOI: 10.1109/32.815324     Document Type: Article

References (49)

1. T.D. Chandra, V. Hadzilacos, S. Toueg, and B. Charron-Bost, "On the Impossibility of Group Membership," Proc. 15th ACM Symp. Principles of Distributed Computing, pp. 322-330, Philadelphia, May 1996.
2. M.J. Fischer, N.A. Lynch, and M.S. Paterson, "Impossibility of Distributed Consensus with One Faulty Process," J. ACM, vol. 32, no. 2, pp. 374-382, Apr. 1985.
3. R. Guerraoui and A. Schiper, "Consensus: The Big Misunder-standing," Proc. Sixth IEEE Workshop Future Trends in Distributed Computing, pp. 183-188, Tunis, Tunisia, Oct. 1997.
4. H, Kopetz, Real-Time Systems: Design Princples for Distributed Embedded Applications. Dordrecht, The Netherlands: Kluwer, 1997.
5. K. Hoyme and K. Driscoll, "SAFEbus™," IEEE Aerospace and Electronic Systems Magazine, vol. 8, no. 3, pp. 34-39, Mar. 1993.
6. Aeronautical Radio, Inc, Annapolis, Md. ARINC Specification 659: Backplane Data Bus, Dec. 1993. Prepared by the Airlines Electronic Engineering Committee.
7. W. Sweet and D. Dooling, "Boeing's Seventh Wonder," IEEE Spectrum, vol. 32, no. 10, pp. 20-23, Oct. 1995.
8. M.J. Morgan, "Integrated Modular Avionics for Next-Generation Commercial Airplanes," IEEE Aerospace and Electronic Systems Magazine, vol. 6, no. 8, pp. 9-12, Aug. 1991.
9. A. Hachiga, "The Concepts and Technologies of Dependable and Real-Time Computer Systems for Shinkansen Train Control," Responsive Computer Systems, H. Kopetz and Y. Kakuda, eds., Dependable Computing and Fault-Tolerant Systems, vol. 7, pp. 225-252, Vienna, Austria: Springer-Verlag, 1993.
10. H. Kopetz and G. Grünsteidl, "TTP - A Protocol for Fault-Tolerant Real-Time Systems," Computer, vol. 27, no. 1, pp. 14-23, Jan. 1994.
11. F. Cristian, "Understanding Fault-Tolerant Distributed Systems," Comm. ACM, vol. 34, no. 2, pp. 56-78, Feb. 1991.
12. F. Cristian, B. Dancey, and J. Dehn, "Fault-Tolerance in Air Traffic Control Systems," ACM Trans. Computer Systems, vol. 14, no. 3, pp. 265-286, Aug. 1996.
13. M. Pease, R. Shostak, and L. Lamport, "Reaching Agreement in the Presence of Faults," J. ACM, vol. 27, no. 2, pp. 228-234, Apr. 1980.
14. F. Cristian, H. Aghili, R. Strong, and D. Dolev, "Atomic Broadcast: From Simple Message Diffusion to Byzantine Agreement," Proc. Fault Tolerant Computing Symp. 15, pp. 200-206, Ann Arbor, Mich., June 1985.
15. F. Cristian, "Reaching Agreement on Processor-Group Membership in Synchronous Distributed Systems," Distributed Systems, vol. 4, pp. 175-187, 1991.
16. P. Zhou and J. Hooman, "Formal Specification and Compositional Verification of an Atomic Broadcast Protocol," Real-Time Systems, vol. 9, no. 2, pp. 119-145, 1995.
17. Y. Gurevich and R. Mani, "Group Membership Protocol: Specification and Verification," Specification and Validation Methods, E. Börger, ed., pp. 295-328, Oxford, U.K.: Oxford Univ. Press, 1995.
18. L. Lamport and S. Merz, "Specifying and Verifying Fault-Tolerant Systems," Formal Techniques in Real-Time and Fault-Tolerant Systems. H. Langmaack, W.-P. de Roever, and J. Vytopil, eds., Lübeck, Germany, Lecture Notes in Computer Science 863, pp. 41-76, Springer-Verlag, Sept. 1994.
19. J. Rushby, "Formal Verification of an Oral Messages Algorithm for Interactive Consistency," Technical Report SRI-CSL-92-1, Computer Science Laboratory, SRI Int'l, Menlo Park, Calif., July 1992. also available as NASA Contractor Report 189704, Oct. 1992.
20. P. Lincoln and J. Rushby, "Formal Verification of an Agorithm for Interactive Consistency Under a Hybrid Fault Model," Proc. Computer-Aided Verification, CAV '93, pp. 292-304, C. Courcoubetis, ed., Elounda, Greece, Lecture Notes in Computer Science 697, Springer-Verlag, June/July 1993.
21. P. Lincoln and J. Rushby, "A Formally Verified Algorithm for Interactive Consistency Under a Hybrid Fault Model," Proc. Fault Tolerant Computing Symp. 23, pp. 402-411, Toulouse, France, June 1993.
22. P. Lincoln and J. Rushby, "Formal Verification of an Interactive Consistency Algorithm for the Draper FTP Architecture Under a Hybrid Fault Model," Proc. Ninth Ann. Conf. Computer Assurance, pp. 107-120, Gaithersburg, Md., June 1994.
23. W.R. Bevier and W.D. Young, "The Design and Proof of Correctness of a Fault-Tolerant Circuit," Dependable Computing for Critical Applications - 2, J.F. Meyer and R.D. Schlichting, eds., Dependable Computing and Fault-Tolerant Systems, vol. 6, pp. 243-260, Vienna, Austria: Springer-Verlag, Feb. 1991.
24. C.J. Walter, P. Lincoln, and N. Suri, "Formally Verified On-Line Diagnosis," IEEE Trans. Software Eng., vol. 23, no. 11, pp. 684-721, Nov. 1997.
25. J. Rushby, "A Fault-Masking and Transient-Recovery Model for Digital Flight-Control Systems," Formal Techniques in Real-Time and Fault-Tolerant Systems, J. Vytopil, ed., eh. 5, pp. 109-136, Boston, Dordecht, London: Kluwer, 1993.
26. B.L. Di Vito and R.W. Butler, "Formal Techniques for Synchronized Fault-Tolerant Systems," Dependable Computing for Critical Applications - 3, C.E. Landwehr, B. Randell, and L. Simoncini, eds., Dependable Computing and Fault-Tolerant Systems, vol. 8, pp. 163-188, Vienna, Austria: Springer-Verlag, Sept. 1992.
27. L. Lamport, R. Shostak, and M. Pease, "The Byzantine Generals Problem," ACM Trans. Programming Languages and Systems, vol. 4, no. 3, pp. 382-401, July 1982.
28. W.D. Young, "Comparing Verification Systems: Interactive Consistency in ACL2," IEEE Trans. Software Eng., vol. 23, no. 4, pp. 214-223 Apr. 1997
29. N.A. Lynch, Distributed Algorithms. San Francisco: Morgan Kaufmann, 1996.
30. H. Kopetz, "Should Responsive Systems be Event-Triggered or Time-Triggered?," IEICE Trans. Information and Systems, vol. D, no. 11, pp. 1,325-1,332, Nov. 1993.
31. S. Owre, J. Rushby, N. Shankar, and F. von Henke, "Formal Verification for Fault-Tolerant Architectures: Prolegomena to the Design of PVS," IEEE Trans. Software Eng., vol. 21, no. 2, pp. 107-125, Feb. 1995.
32. L. Lamport and P.M. Melliar-Smith, "Synchronizing Clocks in the Presence of Faults," J. ACM, vol. 32, no. 1, pp. 52-78, Jan. 1985.
33. W. Torres-Pomales, "An Optimized Implementation of a Fault-Tolerant Clock Synchronization Circuit," NASA Technical Memo. 109176, NASA Langley Research Center, Hampton, Va., Feb. 1995.
34. P.S. Miner and S.D. Johnson, "Verification of an Optimized Fault-Tolerant Clock Synchronization Circuit: A Case Study Exploring the Boundary between Formal Reasoning Systems," Designing Correct Circuits, M. Sheeran and S. Singh, eds., Bastad, Sweden, Sept. 1996.
35. F. Schmuck and F. Cristian, "Continuous Clock Amortization Need Not Affect the Precision of a Clock Synchronization Algorithm," Proc. Ninth ACM Symp. Principles of Distributed Computing, pp. 133-143, Québec City, Québec, Canada, Aug. 1990.
36. J. Rushby and F. von Henke, "Formal Verification of Algorithms for Critical Systems," IEEE Trans. Software Eng., vol. 19, no. 1, pp. 13-23, Jan. 1993.
37. N. Shankar, "Mechanical Verification of a Generalized Protocol for Byzantine Fault-Tolerant Clock Synchronization," pp. 217-236, Jan. 1992.
38. P.S. Miner, "Verification of Fault-Tolerant Clock Synchronization Systems," NASA Technical Paper 3349, NASA Langley Research Center, Hampton, Va., Nov. 1993.
39. J. Rushby, "A Formally Verified Algorithm for Clock Synchronization Under a Hybrid Fault Model," Proc. 13th ACM Symp. Principles of Distributed Computing, pp. 304-313, Los Angeles, Calif., Aug. 1994. Also available as NASA Contractor Report 198289
40. D. Schwier and F. von Henke, "Mechanical Verification of Clock Synchronization Algorithms," Formal Techniques in Real-Time and Fault-Tolerant Systems, Lyngby, Denmark, Lecture Notes in Computer Science 1486, pp. 262-271, Springer-Verlag, Sept. 1998.
41. H. Pfeifer, D. Schwier, and F.W. von Henke, "Formal Verification for Time-Triggered Clock Synchronization," Dependable Computing for Critical Applications - 7, J. Rushby, ed., San Jose, Calif., Jan. 1999. Dependable Computing and Fault Tolerant Systems, pp. 207-286, C.B. Weinstock and J. Rushby, eds., IEEE Computer Society.
42. H. Kopetz and W. Ochsenreiter, "Clock Synchronization in Distributed Real-Time Systems," IEEE Trans. Computers, vol. 36, no. 8, pp. 933-940, Aug. 1987
43. C. Temple, "Avoiding the Babbling-Idiot Failure in a Time-Triggered Communication System," Proc. Fault Tolerant Computing Symp. 28, pp. 218-227, Munich, Germany, June 1998.
44. C.S. Droste and J.E. Walker, The General Dynamics Case Study on the F16 Fly-by-Wire Flight Control System, AIAA Professional Study Series. American Inst. of Aeronautics and Astronautics, Undated.
45. R.S. Boyer and J.S. Moore, "MJRTY - A Fast Majority Vote Algorithm," Automated Reasoning: Essays in Honor of Woody Eledsoe, R.S. Boyer, ed., vol. 1, pp. 105-117, Dordrecht, The Netherlands: Kluwer Academic, 1991.
46. R.W. Butler and B.L. Di Vito, "Formal Design and Verification of a Reliable Computing Platform for Real-Time Control: Phase 2 Results," NASA Technical Memo. 104196, NASA Langley Research Center, Hampton, Va., Jan. 1992.
47. S. Katz, P. Lincoln, and J. Rushby, "Low-Overhead Time-Triggered Group Membership," Proc. 11th Int'l Workshop Distributed Algorithms (WDAG '97), pp. 155-169, M. Mavronicolas and P. Tsigas, eds., Saarbrüken, Germany, Lecture Notes in Computer Science 1320, Springer-Verlag, Sept. 1997.
48. IEEE Computer Society, Proc. Fault Tolerant Computing Symp. 25: Highlights from 25 Years, Pasadena, Calif., June 1995.
49. Formal Techniques in Real-Time and Fault-Tolerant Systems, J. Vytopil, ed., Nijmegen, The Netherlands, Lecture Notes in Computer Science 571, Springer-Verlag, Jan. 1992.