Model Checking Chandy-Lamport Distributed Snapshot Algorithm Revisited

Chandy and Lamport have proposed a distributed snapshot algorithm (called CLDSA). One desired property of CLDSA is as follows. Let s1 be the state in which CLDSA initiates, s2 be the state in which CLDSA terminates, and s* be the snapshot taken, and then s* is reachable from s1 and s2 is reachable from s*. The property is called the distributed snapshot reachability (DSR) property. We give a more faithful formal definition of the property that involves two state machines M_UDS and CL(M_UDS), where M_UDS is a state machine of an underlying distributed system (UDS) and CL(M_UDS) is a state machine of the UDS superimposed by CLDSA, while the definition of the DSR property used in an existing study only involves CL(M_UDS). We also prove a theorem on equivalence of the two definitions that guarantees the validity of the model checking approach used in the existing study.