Interactive Safety Verification of Distributed Protocols by Inductive Proof Decomposition

TL;DR

This paper introduces an interactive, compositional approach for safety verification of distributed protocols using inductive proof graphs, aiding human-guided invariant development and enabling verification of complex protocols like Raft.

Contribution

The paper presents a novel inductive proof decomposition methodology that guides humans in developing invariants through proof graphs and localized variable slicing.

Findings

Successfully verified complex protocols including Raft.

Proof graphs offer structural insights into protocol correctness.

Localized variable slicing simplifies large inductive proofs.

Abstract

Many techniques for the automated verification of distributed protocols have been developed over the past several years, but their performance is still unpredictable and their failure modes can be opaque for industrial scale verification tasks. Thus, in practice, large-scale verification efforts typically require some amount of human guidance. In this paper, we present inductive proof decomposition, a new methodology for interactive safety verification that provides a compositional, interactive approach to inductive invariant development. Our approach guides the human-aided development of inductive invariants via a novel structure, an inductive proof graph, which is built incrementally by a human verifier, working backwards from a target safety property. A user is guided by induction counterexamples that are localized to specific nodes of this graph, and nodes of this proof graph are further decomposed based on logical actions that appear in a protocol's transition relation. Our decomposition also enables a localized variable slicing technique that hides irrelevant protocol state at each sub-component of an inductive proof, allowing a user to focus on fine-grained sub-problems rather than a large, monolithic inductive invariant. We present our technique and experience applying it to develop inductive safety proofs of several complex distributed protocols, including the Raft consensus protocol, which is beyond the capabilities of modern automated verification tools. We also demonstrate how the developed proof graphs provide additional insight into the structure of a protocol proof and its correctness.