Formalizing inductive proofs of network algorithms

Abstract

Theorem proving and model checking are combined to fully formalize a correctness proof of a broadcasting protocol. The protocol is executed in a network of processors which constitutes a binary tree of arbitrary size. We use the theorem prover Coq and the model checker Spin to verify the broadcasting protocol.

Our goals in this work are twofold. The first one is to provide a strategy for carrying out formal, mechanical correctness proofs of distributed network algorithms. Even though logical specifications of programs implementing such algorithms are often defined precisely enough to allow a human verifier to prove the program's correctness, the definition of the network is often only informal or implicit. Our example illustrates how an underlying network can be formally defined by means of induction, and how to reason about network algorithms by structural induction. Our second goal is to integrate theorem proving and model checking to increase the class of algorithms for which mechanical verification is practical. Theorem provers are expressive and powerful, but require sophisticated insight and guidance by the user. Model checkers are fully automatic and effective for verifying finite state automata, but limited to finite spaces of a certain size. We provide a proof strategy which draws on the strengths of both techniques.