Proving the Correctness of Distributed Algorithms using TLA

Khushboo KanjaniP1: while true doif x 1 = x n thenx 1 := (x 1 + 1)mod(n + 1)endendP i (i ≠ 1) :while true doifx i ≠ x i−1 thenx i := x i−1endendAlgorithm 1: Dijkstra self-stabilizing algorithm for MEExample: Here we give a TLA specification of the famous Dijkstra’s selfstabilizingalgorithm for mutual exclusion in a ring described in Algorithm1. The notations used here are explained in Figure 1. Equation 1 describesthe initial condition of the variables. Equation 2 states that ∀i ∈ [0, N]i ≠ 1if the value of x i is not equal to that of its left neighbor, it is assigned thatvalue when process P i is activated. For P 1 , equation 3 states that the valueof x 1 is incremented if its value is equal to x n . In equation 4, w definesthe state function of all the variables in the program. These TLA formulasC 1 , C 2 , ....C n describe the behavior of the processes P 1 , P 2 , ....P n respectively.All possible executions of the program satisfy the temporal formula definedin equation 6.Init φ ≡ ∀i ∈ n, 0 ≤ x i ≤ n (1)∀i ∈ [0, N]i ≠ 1, C i ≡ (x i ≠ x i−1 ) ∧ (x ′ i = x i−1 ) ∧ Unchanged < AllBut(x i ) >(2)C 1 ≡ (x 1 = x n ) ∧ (x ′ 1 = (x 1 + 1)mod(n + 1)) ∧ Unchanged < AllBut(x 1 ) >(3)w =< x 1 , x 2 , ........., x n > (4)C ≡ C 1 ∨ C 2 ∨ ........ ∨ C n (5)φ ≡ Init φ ∧ □[C] w (6)CPSC 689-608 Spring 2007 Report Draft