Formal verification for fault-tolerant architectures: Some lessons learned

Author(s):  
Sam Owre ◽  
John Rushby ◽  
Natarajan Shankar ◽  
Friedrich von Henke
2021 ◽  
Vol 93 ◽  
pp. 01006
Author(s):  
Vladimir Kukharenko ◽  
Kirill Ziborov ◽  
Rafael Sadykov ◽  
Ruslan Rezin

The extent of formal verification methods applied in industrial projects has always been limited. The proliferation of distributed ledger systems (DLS), also known as blockchain, is rapidly changing the situation. Since the main area of DLSs’ application is the automation of financial transactions, the properties of predictability and reliability are critical for implementing such systems. The actual behavior of the DLS is largely determined by the chosen consensus protocol, which properties require strict specification and formal verification. Formal specification and verification of the consensus protocol is necessary but not sufficient. It is also required to ensure that the software implementation of the DLS nodes complies with this protocol. Finally, the verified software implementation of the protocol must run on a fairly reliable operating system. The financial focus of DLS application has also led to the emergence of the so-called smart contracts, which are an important part of the applied implementations of specific business processes based on DLSs. Therefore, the verifiability of smart contracts is also a critical requirement for industrial DLSs. In this paper, we describe an ongoing industrial project between a large Russian airline and three universities – Innopolis University (IU), Moscow Institute of Physics and Technology (MIPT) and Lomonosov Moscow State University (MSU). The main expected project result is a DLS for more flexible refueling of aircrafts, verified at least at the four technological levels described above. After brief project overview, we focus on our experience with the formal specification and verification of HotStuff, a leader-based fault-tolerant protocol that ensures reaching distributed consensus in the presence of Byzantine processes. The formal specification of the protocol is performed in the TLA+ language and then verified with a specialized TLC tool to verify models based on TLA+ specifications.


2012 ◽  
Vol 2012 ◽  
pp. 1-15
Author(s):  
Alexandre Carvalho Leite ◽  
Bernd Schäfer ◽  
Marcelo Lopes de OLiveira e Souza

Fault-tolerant control design of wheeled planetary rovers is described. This paper covers all steps of the design process, from modeling/simulation to experimentation. A simplified contact model is used with a multibody simulation model and tuned to fit the experimental data. The nominal mode controller is designed to be stable and has its parameters optimized to improve tracking performance and cope with physical boundaries and actuator saturations. This controller was implemented in the real rover and validated experimentally. An impact analysis defines the repertory of faults to be handled. Failures in steering joints are chosen as fault modes; they combined six fault modes and a total of 63 possible configurations of these faults. The fault-tolerant controller is designed as a two-step procedure to provide alternative steering and reuse the nominal controller in a way that resembles a crab-like driving mode. Three fault modes are injected (one, two, and three failed steering joints) in the real rover to evaluate the response of the nonreconfigured and reconfigured control systems in face of these faults. The experimental results justify our proposed fault-tolerant controller very satisfactorily. Additional concluding comments and an outlook summarize the lessons learned during the whole design process and foresee the next steps of the research.


2005 ◽  
Vol 2005 (1) ◽  
pp. 741-745
Author(s):  
Carl Jochums ◽  
William Robberson

ABSTRACT The moment an oil spill occurs, response speed is of the essence. Yet how often have you participated in the Incident Command System (ICS) at a spill and been frustrated with the speed or the coordination of the response? How often has a response been declared a success but getting there was so frustrating and exhausting that you've sworn you won't work that way anymore? ICS is here to stay; yet how you can consistently make it work optimally for you and the response remains a challenge. This paper is based upon the premise that ICS enables the right information to be communicated to the right people, in the right format, at the right time. However, during most response debriefs, at the top of the “needs improvement” list you will find numerous references to the failure of information flow and communications. In this paper we share some of the hard lessons-learned in spill response along the California Coast, and ways in which some of the agencies involved today are proactively “preparing to communicate” within the Incident Command System. We use case histories of past and recent spills and the California Spill of National Significance 2004 exercise to illustrate the communications and coordination problems inherent in most response Incident Command structures. A variety of issues are considered; from the evolutionary paths of most responses; to the numerous personalities and egos involved; to the wide array of expectations amongst participants and stakeholders; and the often unique and varied authorities and agendas that multiple agencies bring to a response. We also suggest innovative ways in which the process of communications within the ICS is being augmented, enhanced, and set-up for success. We introduce concepts such as “data mining,” “embedded information specialists,” “fault-tolerant” communications mechanisms, “message mapping,” and “NEBA front-end loading”. A number of communications tools and concepts are described, that if implemented, will greatly improve multi-agency coordination and communications during a response, leading to a less stressful and more successful response outcome.


1992 ◽  
Vol 114 (4) ◽  
pp. 755-762 ◽  
Author(s):  
K. D. Tillman ◽  
T. J. Ikeler

The Pratt & Whitney and Northrop companies together, under the Air Force Wright Research and Development Center (WRDC) sponsored Integrated Reliable Fault-Tolerant Control for Large Engines (INTERFACE II) Program [1, 2], designed and demonstrated an advanced real-time Integrated Flight and Propulsion Control (IFPC) system. This IFPC system was based upon the development of physically distinctive, functionally integrated, flight and propulsion controls that managed the Northrop twin engine, statically unstable, P700 airplane. Digital flight control and digital engine control hardware were combined with cockpit control hardware and computer simulations of the airplane and engines to provide a real-time, closed-loop, piloted IFPC system. As part of a follow-on effort, lessons learned during the INTERFACE II program are being applied to the design of a flight critical propulsion control system. This paper will present both the results of the INTERFACE II IFPC program and approaches toward definition and development of an integrated propulsion control system for flight critical applications.


Sign in / Sign up

Export Citation Format

Share Document