Formal modeling and analysis of atomic commitment protocols

The formal specification and mechanical verification of an atomic commitment protocol (ACP) for distributed real-time and fault-tolerant databases is presented. As an example, the non-blocking ACP of Babaoglu and Toueg (1993) is analyzed. An error in their termination protocol for recovered participants has been detected. We propose a new termination protocol which has been proved correct formally. To stay close to the original formulation of the protocol, timed state machines are used to specify the processes, whereas the communication mechanism between processes is defined using assertions. Formal verification has been performed incrementally: adding recovery from crashes only after having proved the basic protocol. The verification system PVS was used to deal with the complexity of this fault-tolerant protocol.