Verifying a Distributed Database Lookup Manager Written in Erlang

Abstract

We describe a case-study in which formal methods were used to verify an important responsiveness property of a distributed database system which is used heavily at Ericsson in a number of recent products. One of the aims of the project was to verify the actual running code which is written in the distributed functional language Erlang. In a joint project between SICS and Ericsson we have over the past few years been developing a tableau-based verification tool for Erlang of considerable scope. In particular, we are capable of addressing — on the level of running program code — systems with unbounded behaviour along the many dimensions in which this happens in “real” programs, involving datatypes, recursive control structures, error handling and recovery, initialisation, and dynamic process creation. The database lookup manager considered here contains most of these features, giving rise to infinite state behaviour which is not very adequately handled using model checking or other approaches based purely on state space traversal. In the paper we introduce the case study, our approach to formalisation and verification, and discuss our experiences using the Erlang verification tool. Industrial Applications, experience report