🤖 database, proofs that something good eventually happens

(authored by agents unless marked 🧑)

226 sources, best-read first, then newest first. Generated from sources.jsonl; edit the reviews’ notes, not this page.

• APR safety/liveness framework (2026)
  • title: Abstract Framework for All-Path Reachability Analysis toward Safety and Liveness Verification (Full Version)
  • what: Reformulates all-path reachability (APR) proof rules for abstract reduction systems so they correspond one-to-one with LCTRS rules, adapts cyclic APR proofs, reduces safety properties to partial APR validity, and introduces total validity that quantifies over finite and infinite execution paths for liveness. Defines DVP+ and a complete disproof rule DVP-bottom, proves equivalence with the original DVP, and formalizes finite APR pre-proofs, bud/companion links and proof graphs. Safety APR predicates characterize non-reachability of error states, illustrated with Peterson mutual exclusion. For liveness, Theorem 6.3 proves that an APR proof graph is acyclic iff the APR predicate is totally valid; the Peterson starvation-freedom example obtains an acyclic proof. Appendices establish decidability under finite reachable closure and detail limitations of reduction and cyclic generalization.
  • number: DVP and DVP+ define the same partially valid predicates
  • number: partial validity considers finite maximal paths; total validity considers finite and infinite paths
  • number: Theorem 6.3: acyclic proof graph iff total validity for a partially valid APR proof
  • number: APR proof/disproof decidability when reachable closure finite and side conditions decidable
  • limits: ARS reductions may be nondeterministic; partial validity alone ignores infinite paths and is insufficient for liveness. Total-validity criterion assumes a partially valid APR proof and its finite proof graph; decidability additionally needs finite reachable closure and decidable emptiness/intersection/runnability. Current cyclic buds must match companions exactly, the full cut rule is omitted, and process fairness/generalized companions are future work. Safety reduction uses error sets and normal-form conditions.
  • how much was read: most of it read
  • record id: apr-safety-liveness-framework-2026
• Certifying rlive (2026)
  • title: Certifying rlive: A New Proof Strategy for Liveness Model Checking
  • what: nuXmv finds invariants for a hardware model. A Python translator emits a PVS theory and proof script. PVS, with the Yices solver, checks the proof about behavior over time. So each liveness result comes with a certificate that a separate tool checked.
  • number: 53 instances provable by nuXmv in 1200 s
  • number: 41 of 53 proved by PVS; 12 exceeded memory
  • number: PVS limits 8 GB / 3600 s vs nuXmv 4 GB / 1200 s
  • limits: It certifies liveness of the model only. It does not cover code or systems with infinitely many states (future work). PVS, Yices and the translator are trusted. Only checks that had already succeeded were selected.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: certifying rlive
  • record id: certifying-rlive-2026
• Fairneris (2026)
  • title: A Higher-Order Separation Logic for Verifying Liveness-Preserving Refinements of Distributed Systems
  • what: A logic mechanized in Rocq. It transfers progress of a model to progress of an AnerisLang implementation, assuming a fair scheduler and a fair network. The network may drop, duplicate and reorder messages. Fairness here applies to sets of messages.
  • number: two-node implementation; every sequence number eventually gets a reply assuming callback termination and fairness
  • number: no LOC, person-time or benchmark timing reported
  • limits: It verifies code under the language’s own operational semantics, not a production Rust or OCaml executable. Humans supply the model, invariants, contracts and refinement proofs. The URL of the mechanization artifact is not given.
  • how much was read: most of it read
  • source; notes: A Higher-Order Separation Logic for Verifying Liveness-Preserving Refi
  • record id: fairneris-2026
• Federated Formal Verification (2026)
  • title: Federated Formal Verification: Cross-Backend Citation, Cross-Axis Convergence, and AI-Orchestrated Proof Dispatch for Production Systems
  • what: This work sends the open TLA+ proof obligations of a production Raft system to Coq, Lean, Why3, Apalache, Z3 and CBMC. Claude Code specialists handle each backend. CI rechecks the proofs, and the system generates Java runtime assertions.
  • number: 17 active hours, 263 commits, 26-axiom census closed
  • number: about twenty specialist agents in four waves of 3/6/7/4; practical concurrency 6-7
  • number: proof tree over 11,000 lines, 18 apex obligations
  • number: Coq 8/8 passes, median 34.4 s; Apalache 0/3; TLC 0/5; PRISM 1/13
  • limits: A human wrote the claim that the backends are equivalent. There is no artifact URL. The paper gives no prompts, no cost, and no breakdown of human effort. The Java assertions check test states only, not refinement. The speedup compares different protocols. Apalache refuted a property that Coq cited, at bound six.
  • how much was read: most of it read
  • source; notes: Federated Formal Verification: Cross-Backend Citation, Cross-Axis Conv
  • record id: federated-formal-verification-2026
• Feedback & Synthesis in LLM-Assisted Termination Proofs (2026)
  • what: LLMs propose decreasing measures (quantities that shrink at each step, proving termination) for ACL2s functions. ACL2s checks them and returns errors and counterexamples. It splits failures into loops (termination cores) and combines the subproofs.
  • number: 42 base functions
  • number: 786 hours on an H200 GPU
  • number: thirty-minute limit per problem
  • number: gpt-oss with feedback solved 70% of course and 93% of competition problems vs built-in ACL2s 65% and 63%
  • limits: It covers termination of functional code, not progress of distributed systems. The 39% compares the integrated search with the best LLM alone. The corpus is small.
  • how much was read: most of it read
  • source; notes: Feedback & Synthesis in LLM-Assisted Termination Proofs
  • record id: feedback-synthesis-in-llm-2026
• Formal Verification of Multi-Controller Systems in Cloud Management (2026)
  • what: A NuXMV model of two Kubernetes-style controllers, two resources and two users. It checks convergence (eventually the requested state holds forever) and completion. Overlapping resources cause endless overwriting. Dependencies can block forever.
  • number: Table 2: four settings; no overlap/dependencies all pass, others fail
  • number: no runtime, effort or source size reported
  • limits: A small abstract model, built by hand from incidents. The unavailability result holds only if the model lets a resource be unavailable forever.
  • how much was read: most of it read
  • source; notes: Formal Verification of Multi-Controller Systems in Cloud Management
  • record id: formal-verification-of-multi-2026
• Lawyer (2026)
  • title: Lawyer: Modular Obligations-Based Liveness Reasoning in Higher-Order Impredicative Concurrent Separation Logic
  • what: Lawyer proves fair termination (every fairly scheduled run finishes) in Rocq/Iris. It uses a logical transition system of obligations. A well-founded hierarchy orders the dependencies to rule out cycles. The authors verify a ticket-lock module and its client separately, against a fair-lock interface that obliges the holder to release.
  • limits: Finite sets of levels limit lock-coupling structures that grow without bound. Progress for independent modules, and liveness of programs that never terminate, are future work. The notes found no effort count.
  • how much was read: most of it read
  • source; notes: Iris: Trillium, Lilo, Lawyer
  • record id: lawyer-2026
• LIFT loop-bound termination verification (2026)
  • title: LLM-Guided Loop Bound Generation for Program Termination Verification
  • what: Introduces LIFT, a guess-and-check termination framework in which LLMs generate conjunctive or lexicographic loop bounds and a formal validator proves them or refutes them. A candidate bound b(V) is converted to a safety query by adding a counter initialized with b and asserting cnt>0 at each loop head. Constant bounds use bounded unrolling; symbolic bounds use ICE-DT or LLM invariant learners plus Boogie/SMT. If invariant proving fails, bounded violation analysis searches for a reachable counterexample state and feeds it back, while timeout and syntax diagnostics steer later prompts. Progressive generation starts with simple conjunctive bounds and escalates to lexicographic tuples; constant-offset correction and k-induction are included.
  • number: 171 benchmarks
  • number: 152 solved with Gemini
  • number: 139 solved with DeepSeek
  • number: 19 unsolved
  • limits: A valid over-approximate loop bound implies termination, but bounded violation analysis can miss violations after depth m and then treats the witness as potentially spurious. The framework is presented for one loop and says it generalizes to multiple loops. It relies on LLM inference, ICE-DT invariant quality, Boogie/SMT arithmetic, fixed iteration/time budgets, and syntactic restrictions excluding division/nonlinear operators. Nineteen of 171 benchmarks remain unsolved: ten lacked precise bounds and nine exceeded validator capability.
  • how much was read: most of it read
  • record id: lift-loop-bound-termination-verification-2026
• Liveness certificates (2026)
  • title: Liveness Proofs for Hardware Model Checking
  • what: Certificates for checking hardware liveness (k-liveness, liveness-to-safety, rLive, stabilizer extraction). They are validated by eight SAT obligations on a witness circuit.
  • number: 73 selected benchmarks found UNSAT
  • number: certificate-checking overhead 4% (k-liveness), 7% (rLive), 59% (L2S)
  • number: limits 14 GB, one hour
  • number: older Sindoni pipeline: 16 optimized and 13 unoptimized rLive instances not certified; overhead 309%/469% over certified instances only
  • limits: It covers finite-state hardware models. The soundness proof is mathematical, not mechanized. The aigunfair converter and the SAT checker are trusted.
  • how much was read: most of it read
  • source; notes: Liveness Proofs for Hardware Model Checking
  • record id: liveness-certificates-2026
• Mysticeti proofs (2026)
  • title: Mechanized Safety and Liveness Proofs for the Mysticeti Consensus Protocol under the LiDO-DAG Framework
  • what: Proves a corrected Mysticeti protocol and audits Sui’s deployed implementation. A counterexample lets honest participants jump over rounds without limit, so no block ever commits. The authors restrict jumping, add a catchup time GCT, and prove strong progress after both GST (the time after which message delays are bounded) and GCT.
  • number: 6271 new Coq/Rocq proof lines; two persons in two months (§5.5, PDF p.13)
  • number: 6271 lines, developed by two persons in two months
  • limits: Not a machine-checked proof that the whole Rust codebase matches the model. The Sui finding was true when the paper was written. It is not a claim about the current deployment. Weak liveness guarantees only that honest leader vertices and certificates get created, not that blocks commit.
  • how much was read: most of it read
  • source; notes: Mechanized Safety and Liveness Proofs for the Mysticeti Consensus Prot; notes: LiDO, LiDO-DAG, and a 2026 liveness bug
  • record id: mysticeti-proofs-2026
• Paxos-SB in DistAlgo (2026)
  • title: Specifying Paxos for System Builders: Pseudocode Made Executable
  • what: It transcribes detailed Paxos-SB pseudocode into runnable DistAlgo. At runtime it checks agreement, validity and timeouts. It finds two liveness bugs in the published pseudocode: a non-leader, and both survivors not counting their own vote.
  • number: Table 1: 598 lines total; about 370 excluding comments/setup; core about 200
  • number: original C about 7000 lines; pseudocode about 330 lines in 13 figures
  • number: 3 servers, 2 clients, 100,000 requests each in under 170 s; latency under 1.7 ms; about 10x C runtime
  • limits: These are runtime checks, not proofs. Humans supplied initial values and helpers, and no LLM workflow is reported. The recovery procedure is not implemented separately.
  • how much was read: most of it read
  • source; notes: Specifying Paxos for System Builders: Pseudocode Made Executable
  • record id: paxos-sb-in-distalgo-2026
• Pischke-Yoshida top-down bottom-up (2026)
  • title: Top-down = Bottom-up: Sound and Complete Characterisations of Liveness by Multiparty Global Protocols
  • what: Develops a principal global-type synthesis algorithm from safe-and-live local typing contexts and proves that top-down global-type projection and bottom-up local verification characterize exactly the same live multiparty sessions (Ptop = Pbot) under precise synchronous subtyping, balanced global types, and coinductive full-merging projection. Beyond the headline equivalence, the paper gives operational semantics for processes, local contexts, and global types; a deterministic fair round-robin scheduler that linearizes independent interactions; termination and balancedness proofs for synthesis; a combined projection/subtyping relation establishing trace inclusion and principality; and a complexity bound O(n^2 b |Delta|^n) for graph synthesis. The Monte Carlo MapReduce example shows why subsumption removes an unused crash branch. The implementation includes four projection algorithms, process/local inference, safety/liveness checking, and global synthesis, and benchmarks literature protocols including MapReduce, independent workers, rings, wallets, e-voting, and binary counters.
  • number: Ptop = Pbot
  • number: PSPACE-complete synchronously
  • number: undecidable in the asynchronous semantics
  • number: O(n^2 b |Δ|^n) graph synthesis bound
  • limits: Assumes synchronous session semantics, finite guarded recursive local types, finite labels, safe-and-live input contexts, fair scheduling, precise synchronous subtyping, and balanced global types. Process-level liveness is undecidable, so bottom-up checks context properties that soundly imply it; synchronous context checking is PSPACE-complete and asynchronous liveness is undecidable. Synthesis can incur exponential syntactic expansion because recursive syntax cannot share branch subterms; benchmarks show stack overflow/timeouts on largest coinductive-full cases. Tool results cover representative examples rather than production deployments.
  • how much was read: most of it read
  • record id: pischke-yoshida-top-down-bottom-up-2026
• Pono 2.0 (2026)
  • title: Pono 2.0: A Versatile SMT-Based Model Checker for Safety and Liveness
  • what: Presents an open, solver-agnostic SMT model checker supporting Btor2/SMV/VMT-LIB, multiple safety engines (BMC, k-induction, interpolation, IC3, CEGAR) and new liveness-to-safety and k-liveness engines. Version 2.0 adds VMT-LIB, Btor2 justice, ISMC/DAR interpolation engines, broader CEGAR and witness generation, portfolios and configurable Smt-Switch backends.
  • limits: Transition systems may be finite or infinite over SMT theories; properties are LTL safety or liveness. Completeness varies by engine: bounded BMC and k-liveness checks can be inconclusive, finite-index CEGP is explicitly incomplete, and correctness witnesses are not exported (invariants can be internally checked). Results depend on solver support and fixed resource limits.
  • how much was read: most of it read
  • record id: pono-2-0-2026
• REAL Ramsey elimination (2026)
  • title: Fast Ramsey Quantifier Elimination in LIRA (with applications to liveness checking)
  • what: Presents REAL (Ramsey Elimination for Arithmetic Logic), a solver-agnostic implementation eliminating Ramsey quantifiers from existential LIA, LRA, and LIRA formulas, with SMT-LIB extension and Alchemist translation from FASTer/Armoise reachability relations. The resulting existential formulas can be solved by standard SMT solvers to check liveness/termination. The paper defines the infinite-clique semantics and gives a worked arithmetic elimination argument using arithmetic progression witnesses. REAL adds SMT-LIB parsing/export, formula sharing and normalization, and compact Boolean/theory encodings. The FASTer pipeline verifies McCarthy91 termination and checks liveness of sliding-window, Lamport bakery, and cache-coherence protocols (SYNAPSE, Berkeley, Dragon, futurbus, MOESI). On eight pipeline benchmarks, REAL elimination/solving times and formula sizes are reported; parameterized integer/real families scale near-linearly in elimination, with solving dominating, and comparison to the prototype shows orders-of-magnitude speedups.
  • number: eight liveness benchmarks
  • number: dimensions 10, 100, 1000
  • number: McCarthy91 REAL 7.834s elimination and 853.53ms solving
  • number: futurbus FAST 125.95s and REAL 28.570s
  • limits: Ramsey elimination applies to existential linear arithmetic; liveness claims depend on FASTer computing a sound reachability relation and on the encoded fairness/model assumptions. The Lamport bakery starvation check fails without fairness assumptions. Mixed LIRA has substantial overhead because integer and real variables are separated; large benchmark solving times reach hundreds of seconds. The paper does not provide completeness beyond the supported arithmetic fragment or direct comparison on identical prototype benchmarks.
  • how much was read: most of it read
  • record id: real-ramsey-elimination-2026
• Robot supervisor synthesis audit (2026)
  • title: Realizability Is Not Enough: Encoding, Liveness, and Auditing of Synthesized Robot Supervisors
  • what: Builds an open-source ROS2/FlexBE pipeline that generates capability-based GR(1) specifications, performs well-separation analysis, synthesizes with slugs, audits explicit Mealy strategies, merges equivalent states with a proof, and emits executable HFSM supervisors. Four domains compare one-hot versus enumerated capability encodings and Fair-Outcome versus System-Goal liveness. Formalizes activation/outcome protocols and pending memory, explains how Fair-Outcome assumptions can be falsified by system-controlled retry bookkeeping, and introduces a post-synthesis explicit-state auditor. The auditor is sound and complete for protocol violations, deadlocks, bounded-failure violations and goal-unreachable SCC traps under completed exploration. A reducer is proven to preserve core capability output traces while explicitly documenting that pending propositions and full GR(1) winning status need not be preserved. Experiments expose ordering sensitivity and the gap between realizability, structural progress and executable deployment.
  • number: Two-Rivers one-hot raw 37 states and reduced 23; enumerated raw 26 and reduced 23
  • number: P0 2FP/3FP: all 44 trials flagged GOAL_UNREACHABLE_TRAP
  • number: P1 one-hot System-Goal 25,841.977 s versus enumerated 235.193 s in reported fixed ordering
  • number: Crazyflie System-Goal: one-hot 19.730 s and 76.7 reduced states; enumerated 9.275 s and 106 reduced states
  • limits: Results are for the GR(1) fragment, slugs/CUDD backend, sequential one-active-capability protocol, finite explicit strategies, and specified goal labels. Well-separation diagnoses game-level assumption falsification but is not a deployment certificate; the auditor is not a general fairness/liveness verifier and leaves SCCs with optional exits unflagged. Reduction preserves capability-level traces, not all auxiliary propositions. Physical correctness and indefinitely failing capabilities remain outside guarantees.
  • how much was read: most of it read
  • record id: robot-supervisor-synthesis-audit-2026
• Rocq MPST liveness (2026)
  • title: Formally Verified Liveness with Multiparty Session Types in Rocq
  • what: Reports Rocq mechanization of safety, deadlock freedom and liveness for a synchronous multiparty session calculus. Uses coinductive local/global type trees, process-oriented subtyping, plain-merge projection and association of local environments to balanced, well-formed, projectable global types. Operational correspondence plus induction on finite grafting contexts proves associated environments live on fair paths; session typing transfers guarantees to processes. Authors report about14K added Rocq lines, with public/archived source and classical choice/excluded-middle assumptions explicitly used in path construction. Records exact balancedness, well-formedness and projectability standing assumptions; asymmetric label matching under subtyping; environment versus session liveness quantifiers; mixed fixed-point path encoding; graft-height proof and its constructive_indefinite_description use; fair-session-path construction with excluded_middle_informative; stuck-recursion definition repair; precise output safety and synchronous reactive-semantics limits. Earlier record omitted axioms and conflated environment path guarantees with the existential session definition.
  • number: About 14K lines of Rocq
  • limits: Simple synchronous, rendezvous communication calculus, not asynchronous network queues. Guarded recursion, finite nonempty labeled branch sets, conditionals, sends/receives and inactive processes; values/expressions include bool/int/nat and nondeterministic choice. No crashes, Byzantine behavior, loss, timeout or network implementation are modeled. Subsorting is reflexive with nat≤int. Communication payloads are typed but do not encode arbitrary dependent data properties. Processes/sessions are inductive syntax, recursive variables encoded with natural indices; local/global types are possibly infinite coinductive trees corresponding to guarded recursive syntax. Continuations are lists of optional branches: label index k exists only for Some, not None/out-of-bounds. Raw Rocq constructors allow lists without valid branches; environment well-formedness tctx_wf imposes nonempty well-formed local trees. Participant maps use natural-number keys, disjoint domains for composition, and MMaps extensional equality M.Equal. Standing assumptions after Remark3.8: global types satisfy wfgC, encompassing inherited well-formedness/balancedness, and projectableA. Balancedness: for every subtree there is a finite depth k by which each participant in that subtree appears on every path long enough or ending. This is a structural protocol requirement, not scheduler fairness. Theorem5.8/6.9 concise statements suppress these standing conditions; arbitrary global trees or any collection of locally typed processes do not receive the theorem. Projection is coinductive plain merge. A participant at a root send/receive gets corresponding local branch; an uninvolved participant must project all continuations to the same local type. Absent participants project end. Stronger full merge is future work; projectability is assumed rather than proved for every global syntax. Process-oriented subtype may receive more labels and wider input sorts, or send fewer labels and narrower output sorts; continuations subtype coinductively. Association Γ⊑G requires every participant of G in Γ with Γ(p) subtype of its projection; any extra environment participant is absent or end. Local environments have individual send/receive readiness and synchronized reductions requiring compatible sorts. Global reduction permits root branch selection and disjoint communication in all branch continuations; printed GR-Ctx also requires both root participants in every continuation. Association is more than matching syntax, and must be preserved under reduction. Theorem4.8 soundness: if G can communicate between p/q under labelℓ, Γ can communicate between the same participants with possibly different labelℓprime, and both resulting objects remain associated. It does not simulate every exact global choice. Theorem4.9 completeness: each Γ synchronized step has the same-label G step preserving association. Counterexample in Remark4.10 has a sender restricted toℓ0 while the global type allowsℓ0/ℓ1. Calling this bidirectional same-label bisimulation would be inaccurate. Environment safety coinductively requires every mutually ready sender/receiver to synchronize using the sender label and compatible payload sorts, preserved under all synchronized reductions. It does not require a counterpart ready for every unilateral request; safety is distinct from progress. Example5.2 int sender/nat receiver is unsafe because int is not a subtype of nat. Associated environments satisfy Theorem5.3. Paths may be finite or infinite. Fairness Definition5.4: whenever synchronized pair(p,q) is enabled at positionn, some later communication of that same ordered pair occurs, possibly with a different label. It is pair fairness, not fairness of every branch label. Live paths require every unilateral send or receive request eventually gets its corresponding pair communication. An environment is live if every fair path from every reachable reduct is live. The universal condition is over fair paths only; unfair starvation schedules are excluded. Paco encodes coinductive predicates as greatest fixed points of parameterized inductive relations. Paths are cosequences with conil/cocons; eventual is inductive least fixed point, alwaysCG coinductive greatest fixed point. This avoids explicit index bookkeeping and Rocq native cofix guardedness limitations. These are proof representations, not a runtime scheduler or finite model checker. Balancedness supplies a finite p-grafting context containing no p, with holes beginning at p-related communication or end. Theorem5.8 first proves liveness for direct projections (actual Rocq uses equivalent global enabledness predicate), using height of p-grafting versus q-grafting as a decreasing induction measure until the pair becomes enabled, then fairness forces communication. Proof transfers to subtyped Γ by associating paths pointwise and preserving transition labels. Detailed grafting/projection definitions and inherited results are referred to [16]/[20]. Theorem5.8 path lifting extracts witnesses of Theorem4.9 from Prop to construct a CoFixpoint cosequence, explicitly using constructive_indefinite_description. Theorem6.9 additionally constructs a fair session path using constructive_indefinite_description and excluded_middle_informative. Thus reported machine checking has these logical assumptions; do not describe the whole development as axiom-free or constructive merely because it uses coinduction. Full artifact assumption audit/build was not performed. Reactive semantics folds finite internal conditional evaluation/recursion unfolding into communication transitions using an unfolding relation; no explicit τ-only LTS transitions. Structural congruence rearranges parallel composition/unit. This lets subject reduction match each session communication with exactly one same-label environment step, rather than a weak simulation with silent stuttering. Does not establish equivalence to arbitrary calculi with internal divergence or a concrete distributed runtime. Table2 session rule requires each component process be typed by an environment already associated with a suitable global type. Lemma6.1 preserves typing through unfolding. Theorem6.2 sends every session step to a same-label type step; Theorem6.3 permits a type step to be matched by a same-participant session/type step with potentially different label. Theorem6.5 explicitly guarantees the sender label belongs to the waiting receiver branch set in every reachable unfolded typed session. Theorem6.6 says a typed session either can communicate or every unfolding can further reach all-inactive processes, not global termination. Session liveness Definition6.7 is an existential continuation property at every reachable unfolded send/receive: from that unfolded state there exists a finite reduction sequence reaching the corresponding continuation. It is not syntactically the environment definition quantifying every fair path. Authors identify it as Padovani lock-freedom/lock-freedom under full fairness; Theorem6.9 proves it by choosing a fair session path, lifting it to a fair live environment path, then extracting a finite communication prefix. No bounded latency or unconditional all-schedules termination theorem is claimed. Remark6.8 repairs a prior liveness formulation that started its required continuation at the pre-unfolded state. In stuck sender µX.q!ℓ(0).X with q inactive, the original state coincides with the apparent post-send recursion, allowing zero steps to fake progress. Their definition starts at the unfolded pending-send state, excluding that example. This is a semantic definition correction, not a discovered bug in their checked theorem. Printed Table1 R-comm has p receiving from q but labels the communication(p,q), whereas Definition4.2 and environment/global send rules use(p,q) for p sending to q. Read literally this reverses the sender/receiver order and conflicts with same-label subject reduction for a one-way session. Likely presentation convention/typo; this reading has not checked artifact definitions and does not establish a Rocq inconsistency. Endpoint order should be checked before transcribing the rule into another verifier. Examples4.4/4.7/5.6 use G=p→q:{ℓ0(int).G,ℓ1(int).q→r:ℓ2(int).end}. The infiniteℓ0 path is fair under pair fairness, since p/q always communicate, but r waits forever. G is projectable and associated yet unbalanced. This is an explicit negative example outside standing balancedness, demonstrating why association alone is insufficient for liveness. The finiteℓ0,ℓ1,ℓ2 path terminates and is fair/live. Reported contribution around14K lines is added code on top of prior subject-reduction development [16], not necessarily whole artifact size. Proofs of subject reduction/deadlock freedom were rewritten for environment-based typing; operational correspondence, environment safety/liveness new. No checking-time, memory, theorem counts, admitted-proof count, dependency audit, industrial protocol benchmark or verified endpoint extraction measured here. Paper links GitHub omerskeskin/mpstlive and an SWH archive; reader has not built or audited artifact. First mechanization claims are author-qualified to their knowledge and not independently surveyed here. No completeness theorem saying every live session typable is provided. Fair termination is explicitly stronger; stronger liveness under instruction fairness or justness may require different global types/projection. Full merge, other calculi and weak simulation support are future work, not delivered extensions. Crash-stop/asynchronous association results mentioned are other work. Explicit declaration says no AI-generated text or code is present. This is authors stated provenance, not an independent audit. No Verus, Rust or TLA+ implementation delivered. For the human goal the value is a checked metatheory template with explicit fairness, logical-choice, model and correspondence assumptions; connecting it to verified Rust/network execution requires additional refinement and runtime proofs. Entire supplied21-page conference PDF read; no separate arXiv2605.23633 or cited background paper read in this batch. Existing multi-source record replaced, preserving aliases and archived original rather than treating prior abstract/incomplete text as a fresh whole read. Confidence about mechanized results is based on paper and reported source availability, not a fresh Rocq build.
  • how much was read: most of it read
  • source
  • record id: rocq-mpst-liveness-2026
• SoK consensus (2026)
  • title: Systematization of Knowledge: Formal Verification of Consensus Protocols
  • what: A survey that sorts consensus verification into model checking, deductive proofs, code proofs and hybrids.
  • number: over 20 verified consensus protocols
  • number: only about 30% of surveyed works address liveness
  • number: Matrix covers 20+ protocols in abstract and over 30 in conclusion
  • number: Only ≈30% of surveyed works address liveness (§5)
  • limits: It gives no search date range and no count of how many papers were considered, so the reported fraction is not an unbiased census. Table 1 entries need checking against the cited papers.
  • how much was read: most of it read
  • source; notes: Systematization of Knowledge: Formal Verification of Consensus Protoco
  • record id: sok-consensus-2026
• Structural Liveness of Conservative Petri Nets (2026)
  • what: Proves EXPSPACE-completeness of structural liveness for conservative and structurally bounded Petri nets, with doubly-exponential bounds on minimal live markings. The paper models Petri nets as action vectors and develops a proof chain: reversible virtual reachability is represented by bounded linear systems; conservative, structurally bounded and live-bottom-SCC properties are related; dead markings are represented by disjunctions of bounded restricted markings; quasi-dead markings and extractor cases reduce non-liveness to linear-system constraints. Small-solution theorems then yield a 2-exp bound on a live marking, enabling an exponential-space nondeterministic algorithm. A strengthened EXPSPACE lower bound completes hardness for conservative nets and transfers it to structurally bounded nets. The proof extends integer-solution bounds with divisibility constraints.
  • number: The complexity result is theorem-based; no runtime data or benchmark suite.
  • number: Linear-system dimension in the construction is d·2^d; solution norms are bounded by (2+||A||)^{2^{poly(d)}}.
  • number: The upper-bound algorithm guesses a binary-encoded live marking and checks liveness in polynomial space in that encoding.
  • limits: Results concern standard finite-dimensional Petri nets with nonnegative markings and conservative/structurally bounded subclasses; general structural liveness complexity remains open. Bounds are doubly exponential and not practical algorithms. Several technical ingredients are cited from prior work (Rackoff/Leroux), and the proof uses virtual reachability, reversibility and large-component extractors. No implementation or experimental evaluation is reported.
  • how much was read: most of it read
  • record id: structural-liveness-of-conservative-2026
• SysMoBench (2026)
  • title: SysMoBench: Evaluating AI on Formally Modeling Complex Real-World Systems
  • what: A benchmark of eleven concurrent and distributed systems. An AI writes a TLA+ model of each. The model is scored on syntax, execution, behavioral match to the code, and expected properties.
  • number: source sizes from 175 lines (PGo dqueue) to 5,360 (ZooKeeper leader election)
  • number: Etcd Raft with basic Sonnet agent: 7.69% conformance, 69.23% invariant correctness, 100% syntax
  • number: liveness properties violated 41.9% vs safety 8.3% (§5, Figure 4c)
  • number: each agent run five times, best output evaluated, at most three repairs
  • limits: Covers only the finite executions and configurations supplied. A model can match buggy code and still fail the desired guarantee. The evaluator uses an LLM for some mappings.
  • how much was read: most of it read
  • source; notes: SysMoBench
  • record id: sysmobench-2026
• Timers (2026)
  • title: Verifying First-Order Temporal Properties of Infinite-State Systems via Timers and Rankings
  • what: Turns a claim about time into a termination problem by adding timers that predict when formulas become true. A human supplies the model, the claim, the implicit ranking, the invariant and finite-set approximations. Z3 checks the generated conditions.
  • number: 17 tasks in Table 2, e.g. Ticket: 2 s, 20 invariant conjuncts, 256 proof tokens
  • number: Paxos: 101 s, 238 tokens; ABP: 4 s, 539 tokens; HRB-Correct: 135 s, 99 tokens; Dijkstra k-State: 64.8 s, 213 tokens
  • number: Ivy proof sizes for six tasks: 407, 521, 860, 446, 593, 748 tokens (Ticket, Paxos, ABP, HRB-Correct, HRB-Relay, Ackermann)
  • number: runtime is Z3 validation on Apple M1 Pro, Z3 4.13.3
  • limits: The guarantees cover first-order transition-system models, not deployed code. Rankings and invariants are not discovered automatically. Sizes count proof tokens, not human effort.
  • how much was read: most of it read
  • source; notes: Verifying First-Order Temporal Properties of Infinite-State Systems vi
  • record id: timers-2026
• TLA-Verus (2026)
  • title: TLA-Verus: Generating and Solving Temporal Proof Obligations with LLM Agents
  • what: This work translates existing TLA+ models into Verus temporal proof tasks. The translator is either an algorithm or an LLM writer plus reviewer. It builds on Anvil’s temporal logic library, and agents prove the tasks. Checks freeze the task and reject new assumptions or admissions (unproved claims accepted as true).
  • number: 16,459 model/property pairs attempted
  • number: algorithmic: 5,160 usable translations, 3,094 proofs (304 liveness)
  • number: agentic: 12,352 usable translations, 492 proofs in a 500-task sample
  • number: evaluation: 40 paired tasks, ten per category, 32 models from 24 repositories
  • limits: Showing that the implementation refines the model is future work, so a model proof is not a proof about Rust behavior. An LLM reviews whether the translation is faithful, and this is not proved. The dataset and pipeline are unreleased. The runs were not repeated. A Raft-style model was safe only because it could not make progress.
  • how much was read: most of it read
  • source; notes: closest related work; notes: reported results and populations
  • record id: tla-verus-2026
• Transition Invariants Revisited: Termination Witnesses and Their Validation (2026)
  • what: Extends the standard machine-readable proof format that program verifiers hand to each other so it can carry termination proofs. The proof is a transition invariant: a relation between any earlier and later state of a run that must decrease in a well-founded way. Three checkers re-validate such proofs independently of the tool that made them.
  • number: Evaluated on all SV-Benchmarks programs expected to terminate, 900 s CPU and 15 GB per run
  • number: Witnesses validated by at least one validator: CPAchecker 366 of 422 (87%), CPAchecker-TransVer 192 of 200 (96%), UAutomizer-TransVer 375 of 389 (96%), Goblint-TransVer 176 of 286 (62%)
  • number: Validators solved about 40 programs that CPAchecker’s own verification mode could not, using other tools’ witnesses
  • number: Validation often faster than verification (Wilcoxon p = 2.1e-10 and 1.1e-13 for the two CPAchecker validators on ranking-function witnesses)
  • limits: Termination of sequential C programs only; the authors say “We do not consider other reasons for non-termination, such as deadlocks.” One reduction route needs finite state spaces and TransVer has limited support for arrays and structs. Witnesses with many invariants (Goblint) often could not be validated within limits. Not about fairness or liveness of concurrent or distributed systems.
  • how much was read: most of it read
  • source; notes: Transition invariants as termination witnesses (2026)
  • record id: transition-invariants-revisited-termination-2026
• Verified MCP Gateway (2026)
  • title: Formal Verification of Agentic MLOps Protocols: Model Checking and Liveness Guarantees in Distributed Model Context Protocol Workflows
  • what: A gateway sits between an LLM agent and its tools (Model Context Protocol, MCP, a standard for LLM tool calls). Before each tool call it checks, against a hand-written state machine, that the call keeps three temporal-logic rules true: no deadlock, every GPU that is handed out is eventually returned, and no two agents write the same network folder at once.
  • number: 500 multi-agent training workflow traces, chain depth up to 14 tool calls
  • number: reachable states at depth 14: 196,608 unconstrained vs 672 with guards (99.66% fewer)
  • number: deadlocks: 54.2% (vanilla MCP), 33.6% (ReAct retry), 18.4% (static DAG check), 0.0% (verified gateway)
  • number: task completion 99.4% vs 38.4% for vanilla MCP; wasted GPU hours 0.2% vs 41.8%
  • limits: The state machine, its 12 tools and the three properties are written by hand for one production system; the paper does not say how the 500 traces were produced. The ‘liveness’ property is enforced by checking one step ahead at run time, so it is a guard, not a proof about all executions; there is no theorem or proof-assistant artifact.
  • how much was read: most of it read
  • source; notes: Formal Verification of Agentic MLOps Protocols (2026)
  • record id: verified-mcp-gateway-2026
• Verifying Graceful Degradation in a Distributed Malware-Detection System with SPIN (2026)
  • what: The authors model, in Promela, the endpoint side of a Bitdefender-style malware-detection system that falls back from a primary server to a legacy server to a weaker local scan, and check six properties written in temporal logic (five safety, one liveness) plus deadlock freedom with the SPIN model checker.
  • number: All six properties hold on the core 1 endpoint x 1 scan model: 6,168 states stored, depth 101, under 1 second (Table 2)
  • number: Streaming model (1 endpoint, 2 scans): 314,527 states; concurrent model (2 endpoints, 1 scan): 22,177,616 states (Table 4)
  • number: 2 endpoints each with 2 scans ran out of memory, so no result
  • number: 4 reachability trap claims all violated, showing the checked behaviors occur (Table 3)
  • limits: Assumes the transport is reliable (no loss or duplication), deadlines are untimed nondeterministic choices, and two detection contracts: the full servers always give the right verdict (A1) and the reduced scan never flags a benign file (A2). Finite instances only; unbounded endpoints and scans need parameterized techniques left to future work. The model is hand-abstracted from the production system and not tied to its code.
  • how much was read: most of it read
  • source; notes: ## Graceful degradation in a malware-detection system with SPIN (2026)
  • record id: verifying-graceful-degradation-in-2026
• Verus-TLA repository (2026)
  • title: verus-tla export (BasisResearch/verus PR #51)
  • what: This crate embeds TLA temporal predicates in Verus and provides state-machine structures, fairness predicates and verified helper lemmas for safety and liveness proofs.
  • number: 8 states
  • limits: README-level documentation; no independent proof audit was run.
  • how much was read: most of it read
  • source; notes: R02. Verus temporal libraries, 2025–2026 repository leads
  • record id: verus-tla-repository-2026
• Welder (2026)
  • title: Welder: Compositional Liveness Verification of Cluster Control Planes
  • what: Welder proves, for each controller, that it makes progress and limits its requests. This statement is called the CORE spec. It then combines the proofs of controllers that fit together. The authors verified the ReplicaSet, Deployment, StatefulSet and RabbitMQ controllers.
  • number: 1.5 person-years
  • number: proof lines: CORE 37,487 (ESR 36,215); executable 3,180; model 3,915; trusted 1,081; about seven minutes to check
  • number: analysis of 188 reported controller bugs claims CORE excludes 178 (95%)
  • number: seven bugs found during verification; zero in 629 functional, 1,302 controller-crash, 677 Pod-crash tests
  • limits: Features left out of the success condition are not checked. The proofs assume that faults eventually stop. Controllers that depend on each other in a circle need separate reasoning. Four controllers lack full feature parity with the upstream versions. The evidence on AI is qualitative only.
  • how much was read: most of it read
  • source; notes: Welder: Compositional Liveness Verification of Cluster Control Planes; notes: P07. Welder: Compositional Liveness Verification of Cluster Control Pl
  • record id: welder-2026
• Wirehead Rocq proofs (2026)
  • title: Toward Formal Verification of a Lock-Free Distributed Double Buffer Cache
  • what: A master’s thesis that proves, in the Rocq proof assistant, six properties of the swap algorithm in Wirehead, a MongoDB-based cache that lets many data generators feed one training job. The author models each MongoDB call as a plain function and the algorithm as a state machine where one process takes one atomic step at a time.
  • number: 4 Rocq files, 3,470 lines (thesis text says 3,475 in one place), 144 proofs, 2 Admitted, 3 axioms (all on the user-supplied chunk function)
  • number: Safety.v 1,339 lines; Liveness.v 1,342 lines; DB.v 513; Algorithm.v 276
  • number: about 800 lines of Safety.v are auxiliary invariants needed only for liveness
  • number: 5 of 6 properties fully checked; progress depends on 2 Admitted lemmas
  • limits: Assumes one MongoDB instance, crash-stop failures only, atomic database calls, and weak fairness of the scheduler; the match between the Rocq model and the Python code is asserted, not proved. Crash transitions and the real timeout-based lock recovery are not modeled.
  • how much was read: most of it read
  • source; notes: Toward Formal Verification of a Lock-Free Distributed Double Buffer Ca
  • record id: wirehead-rocq-proofs-2026
• ChonkyBFT (2025)
  • title: ChonkyBFT: Consensus Protocol of ZKsync
  • what: Presents ChonkyBFT, a partially synchronous committee BFT protocol for ZKsync with one voting round, single-slot finality, quadratic communication, and n≥5f+1. Safety, validity, and partial-synchrony progress are proved by quorum and timeout lemmas. The Quint specification and Apalache symbolic checking found pseudocode type/definition errors and attack paths; an 18-lemma inductive invariant was checked for bounded parameters. A deployment evaluation measures failure-free throughput, latency, resource use, and replication lag.
  • limits: At most f Byzantine replicas with n≥5f+1; authenticated reliable point-to-point channels, secure signatures/hashes, and partial synchrony after GST. Liveness additionally assumes block synchrony, periodic retransmission, bounded clock drift, and eventual correct leaders. Formal Apalache checks restrict to six replicas, at most one fault, three views, bounded message/QC sets, so they are model-level evidence. Performance tests are failure-free and exclude block synchronization.
  • how much was read: most of it read
  • source
  • record id: chonkybft-2025
• First-Order Automata (2025)
  • what: The paper defines an automaton that recognizes finite traces of a first-order temporal sentence over a background theory. It gives results on expressiveness and closure, and decision procedures that work under conditions.
  • number: no experiments, benchmarks or repository reported
  • limits: It covers finite traces only. Extending it to infinite words is future work, so it does not give liveness over infinite executions. Checking non-emptiness is only a semi-decision procedure (it may never answer).
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: First-Order Automata
  • record id: first-order-automata-2025
• Implicit rankings (2025)
  • title: Implicit Rankings for Verifying Liveness Properties in First-Order Logic.
  • what: The method compares old and new states through formulas, instead of computing a number that must shrink (a ranking function). Constructors combine them pointwise, lexicographically, by multiset or permutation, and across a whole domain. Z3 checks the conditions that result. It verifies toy stabilization, a binary counter, token-ring non-starvation, Chang-Roberts leader election, SAT backtracking and abstract CDCL termination. It also verifies Dijkstra’s k-, 4- and 3-state stabilization and Ghosh’s 4-state stabilization.
  • number: all examples verified within 10 minutes (§6, p.388)
  • number: all examples verified within 10 minutes
  • number: Dijkstra 3-state DomPerm(k=4) creates 18 existential quantifiers
  • number: toy stabilization bound n^2
  • limits: The user supplies how the ranking is composed, the other proof-rule formulas, and sometimes hints for existential witnesses. Domains are finite but unbounded. It does not cover unrestricted infinite domains in full. The review notes found no person-month figures.
  • how much was read: most of it read
  • source; notes: LVR and implicit ranking functions; notes: Ivy, ranking, Coq, and Iris case index
  • record id: implicit-rankings-2025
• LAW (2025)
  • title: The LAW theorem: Local Reads and Linearizable Asynchronous Replication
  • what: The paper proves that no replicated register can have all three of these: a local read (a read with no messages), linearizability, and a guarantee that operations finish despite async delays and one crash. It designs almost-local reads (batched read validation) in Hermes, ZAB and Raft variants.
  • number: Raft-ALR 2.6x baseline throughput at 2% writes, 1.8x at 5%; up to 156 million requests/s
  • number: ZAB-ALR within 4% of ZAB at 1% writes; Hermes-ALR within 11% at 1% writes
  • number: 5 CloudLab servers, one million keys; reads batched up to 128
  • limits: A human wrote a mathematical proof about a mathematical register (deterministic servers, one active operation each, at most one crash). The correctness of the read algorithms is argued in prose. The Raft baseline relaxes linearizability, so the performance comparison is an upper bound. There is no LLM, no code proof and no person-hours.
  • how much was read: most of it read
  • source; notes: Added related work: The LAW theorem: Local Reads and Linearizable Asyn
  • record id: law-2025
• LiDO-DAG (2025)
  • title: LiDO-DAG: A Framework for Verifying Safety and Liveness of DAG-Based Consensus Protocols
  • what: It separates the DAGs that spread data from the ordering step. In Coq, it proves that partially synchronous Narwhal, Bullshark and Sailfish keep agreement, and that they eventually commit vertices built by synchronous processes. Verification revealed a latency improvement for Sailfish.
  • number: two persons over three months for the three protocols (§5, p.203:21)
  • number: Table 2 (spec/proof lines): model 747/1500; Narwhal 2307/9697; Bullshark 603/4343; original Sailfish 270/3479; modified Sailfish 339/3040; some reused
  • number: LiDO-DAG model: spec 747 lines, proof 1,500
  • number: Narwhal: spec 2,307, proof 9,697
  • limits: It covers protocol models only. It does not show that a Rust implementation refines them. It excludes asynchronous probabilistic variants. It needs an extra fairness assumption: each synchronous builder succeeds within a fixed number of time segments. Line counts mix reused and safety proofs with liveness proofs.
  • how much was read: most of it read
  • source; notes: LiDO-DAG: A Framework for Verifying Safety and Liveness of DAG-Based C; notes: LiDO, LiDO-DAG, and a 2026 liveness bug
  • record id: lido-dag-2025
• Lilo (2025)
  • title: Lilo: A Higher-Order, Relational Concurrent Separation Logic for Liveness
  • what: Lilo is a Coq logic for the liveness of shared-memory programs. It uses obligations (promises to finish) and progress credits. The authors give proofs for a spinlock, a ticket lock, Treiber and elimination stacks, and infinite message passing.
  • limits: Stratified propositions limit contracts that refer to themselves. Logically atomic triples for the elimination stack are future work. It is not a result about networks or crashes.
  • how much was read: most of it read
  • source; notes: Iris: Trillium, Lilo, Lawyer
  • record id: lilo-2025
• MongoDB conformance blog (2025)
  • title: Conformance Checking at MongoDB: Testing That Our Code Matches Our TLA+ Specs
  • what: This 2025 retrospective describes MongoDB engineers testing whether C++ implementations conform to TLA+ specifications. It contrasts model-generated tests with trace checking, reports practical obstacles such as mapping implementation state back to the model, and describes a Raft-derived replica-set model with safety and liveness properties.
  • number: The post revisits two MongoDB products and work first tried in 2020.
  • number: A month to figure out how to instrument MongoDB
  • number: 4913 tests reached 100% branch coverage
  • limits: Trace checking and generated tests are incomplete samples; the post says completeness is usually impossible.
  • how much was read: most of it read
  • source
  • record id: mongodb-conformance-blog-2025
• Neural model checking with invariants (2025)
  • title: Let a Neural Network Be Your Invariant
  • what: For hardware designs, one small neural network is trained to be both an inductive invariant (a set of states that contains all reachable states and is closed under steps; this proves safety) and a ranking function (a number that drops each time something bad could recur; this proves liveness). A solver then checks the network exactly, so a yes answer is a real proof. Training uses a constraint solver (MILP) rather than gradient descent.
  • number: 634-task benchmark: 11 SystemVerilog designs; 206 safety, 219 liveness, 209 safety+liveness tasks
  • number: solved: 190/206 safety (92%), 192/219 liveness (88%), 172/209 safety+liveness (82%)
  • number: nuXmv solved 82% of liveness and 74% of safety+liveness tasks; rIC3 50% and 61%; ABC 36% and 46%; prior neural method NMC’24 79% of liveness
  • number: pure liveness: faster than the best other tool on 66% of tasks, 10x faster on 46%
  • limits: Only finite-state hardware-style systems (no arrays or strings of parametric length, no procedure calls or dynamic data); the benchmark is the authors’ own, built from textbook-level designs, so results may not carry to other workloads; relies on sign-activation feed-forward networks.
  • how much was read: most of it read
  • source; notes: Let a Neural Network Be Your Invariant (2025)
  • record id: neural-model-checking-with-invariants-2025
• Nola (2025)
  • title: Nola: Later-Free Ghost State for Verifying Termination in Iris
  • what: A logic in Rocq and Iris, with later-free ghost state (proof-only state without step-indexing), for proving termination and functional correctness of core-Rust programs. The prototype is RustHalt. Examples include Ackermann variants and traversal of a mutable list.
  • number: one axiom: uniqueness of identity proofs
  • number: no LOC, runtime or person-time reported
  • limits: RustHalt is a prototype. Its re-mechanization of RustHornBelt is incomplete. It is not production Rust.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Nola
  • record id: nola-2025
• On Temporal Verification of Stateful P4 Programs (2025)
  • what: Defines P4LTL temporal properties over completed packet processings while retaining register state between packets. Models arbitrary input packets and changing table actions, optionally constrained by symbolic control-plane assumptions. Constructs a Büchi transaction product in which the specification automaton advances only at packet return, reducing violations to fair feasible traces. A proof sketch establishes the abstract correspondence; p4tv implements P4-to-Boogie translation, ghost instrumentation and an Ultimate Automizer extension. Evaluation checks19 temporal tasks on nine programs plus assertion checks/scaling, identifying two naturally occurring property failures and three injected defects. Records exact packet-boundary/old/free-variable semantics, register initialization and control-plane scope, product transitions/acceptance and proof-sketch qualifications, refinement algorithm and implementation trust, all Table2/3 cells, actual versus injected bug distinction, p4v approximation and assertion instrumentation, rapid scaling growth, and source specification/prose inconsistencies including vacuous liveness formula. Separates local P4xos checks from whole Paxos consensus verification.
  • limits: §3: Environment is a serial infinite loop of complete packet processings, persistent registers outside loop, nondeterministic packet fields each iteration and metadata initialized per P4-16. Table applications are nondeterministic action choices. This abstracts a single programmed switch; no proof of interleaved pipeline concurrency, simultaneous register read/modify/write races, multiple switches, queue dynamics or actual hardware refinement is supplied. Packet time is not wall-clock time. §§2/3/7/8: Register initialization is part of each verification configuration. P4NIS failing task9 leaves count unconstrained; successful invariant/assertion examples assume valid/zero initialization or add recovery logic. Persistent arbitrary initial values differ from independently re-randomizing registers every packet. Results under initialization assumptions do not show a real deployment meets those assumptions. §§3.2/4: CPI constrains table keys/actions/parameters, allows symbolic sets of entries and changes between packets. Empty CPI permits every modeled rule. Property checked is assumption implies desired property; it can hold if assumption is impossible. Authors do not report systematic assumption satisfiability/vacuity checks or prove a real controller always enforces CPI. Table2 needs CPI for tasks6,7,8,16 only. §4.1: Predicates are evaluated at packet boundaries: terms normally after processing; old(t) at ingress start after parsing; valid(h) records validity after parsing, hit/apply record occurrence during processing. old(key) and old(para) expressly arbitrary. fwd(t) is egress_spec==t syntactic sugar, so packet-output/architecture correspondence matters. Free variables describe nondeterministic values intended to cover all names; scope/stability must be preserved when translating specifications. §§4/6/7.2: Boundary-only temporal properties can miss transient within-packet violations. Assertion checks use a shadow variable initialized true per packet and capture the assertion at its program point, then check its boundary value. This is an explicit instrumentation workaround; the native P4LTL language still cannot directly observe arbitrary internal events. Correct instrumentation and all relevant visits are part of the trust boundary. §5.1: Product keeps program/specification location pairs, updates specification only on TR(s), uses assume true on other statements, and accepting locations require spec acceptance plus TE/TR boundary. Fair means Büchi acceptance (infinitely recurring accepting states), not automatic network-delivery, scheduler or adversary fairness. Liveness assumptions about infinitely many particular packets are written explicitly in the property. Infinite repeated packet processing is the base execution model. §5.1/Appendix A: Theorem5.1/A.1 is an abstract correspondence with an informal proof sketch, not a mechanized proof of P4 semantics, Boogie translation, instrumenter or executable checker. Projection deletes only true steps imposed by non-return transitions; a return transition labelled true must remain. Appendix switches the named if/only-if directions, and reverse construction retains TE(s)∨TR(s) while operational product advances spec on TR(s) only. A rigorous proof should distinguish statement/boundary indexing and establish infinitely many returns; no concrete tool-unsoundness counterexample claimed. §5.2/6: Algorithm1 reuses counterexample-guided refinement from cited fairness-modulo-theory work: select accepting trace, test feasibility, return genuine trace or remove a generalized set of infeasible traces, finish when none remain. No universal termination/runtime bound or translation correctness theorem provided. Trust includes P4/Boogie modeling, ghost instrumentation, LTL conversion, automata/refinement/feasibility engine and underlying reasoning tools. Code/proofs not run in this reading. §6: Prototype fully supports V1Model but limited TNA/PSA. Authors claim model transferable with more detailed P4 processing; future architecture support is not demonstrated full support. State explosion remains. About10000C++/JavaLOC and selected small benchmark programs do not establish production-scale coverage. §8 pp.228–229: Printed P4NIS liveness consequence is conjunction over ports i of GF(phi_sp -> fwd(i)), under GF(phi_sp). This is weaker than GF(phi_sp AND fwd(i)): infinitely many non-specific packets satisfy every implication regardless of forwarding. Alternating specific/non-specific packets with no fwd(i) satisfies the displayed formula while violating the natural-language goal. This is a semantic observation about the printed specification, not a run of artifact specifications. §4’s earlier liveness example has a different stronger shape. §8: NDN weak-until formula is activated only after a data packet was forwarded; it then forbids repeated data forwarding until a matching forwarded interest. It does not by itself forbid the first unsolicited data forward before that trigger, nor require eventual forwarding because W permits no future interest. Task6’s separate property covers interest-before-data. Universal free hash variable is not a proof of hash collision freedom or data-name authentication. §5.1 Figure5/§7.2 Table3: Figure5 prose says status becomes0 when hdr.cnt<0, while listing/automaton tests>0; record follows code when describing example. Table3 says acceptor stored round strictly less than current round, while adjoining prose uses≤ under zero initialization. Strict< would fail on equal zeros; cannot silently interchange these properties. Printed description/code discrepancies do not establish implementation bugs. §7: Dataset has nine manually selected programs and manually authored properties; artificial bugs inserted in CPI/task8 and code/tasks15,18. Natural failures tasks9,13 are author-reported findings without external maintainer confirmation/production exploit in paper. 14 verified tasks and five counterexamples are outcomes for specified models, not whole programs certified correct. §7.2: Temporal comparison with four prior tools is a support limitation discussion; measured assertion comparison runs bf4 and an approximate p4v implementation from bf4 work because original p4v unavailable. Vera limited user assertions and Aquila unavailable. Spurious counterexamples are relative to chosen persistent-register configuration, not evidence prior tools unsound for their broader nondeterministic model. p4tv is much slower but more precise for these stateful examples. §7.3: Program and specification scaling varied separately on P4NIS ports and acceptor index clauses. Curves grow rapidly; Figure8 about8600s near64ports and Figure9 about24000s near32clauses, approximate visual readings only. Easy false properties return inabout90s for CNT8/16, so falsification speed does not imply comparable proof scaling. No cross-product scalability, latency budget or large production network study. §7: Hardware i5-12400 2.50GHz/32GB; no repeat counts, confidence intervals, error bars or user specification effort measurements given. Main temporal tasks10–1260s; assertion acceptor-safe1701s, so21min maximum applies only Table2. P4xos acceptor/learner predicates are local state/order/vote checks, not an end-to-end Paxos agreement/liveness proof under crash/message-loss/reconfiguration. No Verus/Rust/TLA+ implementation theorem or LLM-agent evaluation. §7.1/Table2 task8: Printed task8 checks property6, data is forwarded only after a corresponding interest. Reported trace receives interest then drops data. A dropped data packet alone cannot violate this only-if safety condition. Preserve author-reported counterexample outcome, but it does not demonstrate violation of the printed property without more trace/specification detail. This inconsistency does not establish tool unsoundness.
  • how much was read: most of it read
  • source
  • record id: on-temporal-verification-of-2025
• Reusable TLA+ Communication Primitives for Modeling and Verifying Distributed Systems (2025)
  • what: A PlusCal Echo protocol built over reusable channel abstractions (perfect, fair-loss, stubborn). TLC checks eventual delivery, FIN termination and that no message is invented.
  • number: MaxCopies set to two; only Property 3 held under duplication
  • number: no state counts, timings, LOC or hours
  • limits: The checks are bounded model checks. The user handles nondeterministic drops and eventual delivery. The perfect link is FIFO, which is stronger than usual.
  • how much was read: most of it read
  • source; notes: Reusable TLA+ Communication Primitives for Modeling and Verifying Dist
  • record id: reusable-tla-communication-primitives-2025
• rlive (2025)
  • title: Infinite-State Liveness Checking with rlive.
  • what: rlive is a model checker for liveness of infinite-state transition systems. It searches for counterexamples, learns abstraction predicates and synthesizes ranking functions. The ranking functions rule out loops that cannot run forever.
  • number: 835 liveness verification problems
  • number: timeout 1200 s, 8 GB per instance
  • number: solves 22 more instances than alpha-L2S
  • number: average speedup 6.47x on instances solved by both
  • limits: It handles Boolean and linear arithmetic constraints. It is model checking. It does not prove that software implements the model. It does not terminate on systems whose only counterexamples are not lasso-shaped (a prefix followed by a repeating loop).
  • how much was read: most of it read
  • source; notes: Infinite-State Liveness Checking with rlive
  • record id: rlive-2025
• Sound and Complete Witnesses for Template-Based Verification of LTL Properties on Polynomial Programs. (2025)
  • what: Defines existential and universal Büchi ranking functions as witnesses that a finitely branching numerical transition system has one, or only, runs visiting an acceptance set infinitely often. Gives soundness/completeness theorems and an LTL-to-product reduction, with deterministic-Büchi restrictions for direct universal verification. Synthesizes location-wise polynomial witnesses through quantified constraints, a cited Positivstellensatz reduction and SMT solving. Evaluates proof and refutation of four LTL properties on 287 linear and31 nonlinear programs; detailed results show competitive linear coverage and advantages on selected nonlinear tasks. Nonnegative witness values define a recurrent region; every chosen (existential) or enabled (universal) successor preserves this region, decreasing by at least one outside acceptance and allowing a reset at acceptance. Product automaton locations make Büchi membership constant at each synthesized location. Existential synthesis chooses one initial valuation and one suitable enabled successor; universal synthesis covers every initial valuation and successor. Reports invariant support, solver portfolio, excluded benchmark classes, true/false/unknown distinctions, and averages over different solved subsets. The paper’s broad general-LTL claims exceed the directly displayed positive universal-certificate reduction when the formula has no deterministic Büchi automaton.
  • limits: Transition systems have finitely many locations, finitely many real-valued variables and finitely many deterministic-update transitions; finite nondeterministic branching is allowed, unbounded nondeterministic assignment is not. Every state has a successor; a terminal location has an identity self-loop so all runs are infinite. Initial sets may be infinite. Synthesis further requires polynomial updates, guards and atomic constraints. There is no probabilistic transition semantics. LTL verification means all runs satisfy phi; refutation means some run satisfies not phi. Atom valuations need not be independent: x>=0 implies x+1>=0. The product with an NBW accepting not phi gives existential Büchi refutation. A direct universal-Büchi product for proving phi requires a deterministic Büchi automaton for phi; arbitrary LTL languages need not have one. Formal product definition and Lemma1 proof are deferred to [13]. The p.607 remark observes universal truth iff no accepting counterexample exists, then suggests using existential witnesses for general verification. Reader limit: absence of an EBRF is a negative semantic statement, not a positive polynomial witness that a synthesis routine has exhibited. Failure to find a degree-D witness cannot certify nonexistence of all witnesses. The displayed corollary for positive universal certificates remains restricted to deterministic Büchi formulas; deterministic programs with one run also permit an existential positive route. Büchi ranking is scalar real-valued in Definition1. On an edge from a state with f>=0: if current state is accepting, successor f must stay >=0; otherwise successor f must lie between0 and f−1. The decrement is at least1, not arbitrary strict real descent. Values at accepting states may jump upward, allowing repeated finite excursions. Negative values exempt states outside the selected invariant region. Existential EBRF requires at least one nonnegative initial state and at least one Büchi-ranked successor for every state. On negative states the implication is vacuous and total-successor assumption suffices. Choosing ranked successors from the initial nonnegative region creates an accepting run. Universal UBRF requires nonnegativity at every initial state and ranking on every transition, establishing acceptance on every run. Definition2 prints codomain R^n, but reuses scalar comparisons and the synthesis assigns scalar polynomials; reader treats that as a likely type typo, not a defined vector order. Theorems1/2 claim sound and complete witness families for existential/universal Büchi analysis of the stated finite-branching systems. Proofs are deferred to arXiv:2403.05386. Reader explanation of soundness: a nonnegative sequence cannot sustain decrements of at least1 forever outside B, hence each infinite continuation returns to B; the existential/universal successor quantifiers determine which continuations. Universal completeness depends on finite branching to bound nonaccepting delays from a fixed reachable state; the extension proof was not audited. The worked EBRF in Section3.1 assigns x0+3 at (linit,q0), x0+2 at (l1,q0), x0+1 at (l2,q0), zero at accepting (l1,q1), and zero otherwise. Reader defect: Figure2 includes nonaccepting terminal (lt,q0) with an identity self-loop, whose zero rank cannot satisfy0<=f(next)<=f(current)−1. The zero otherwise branch also fails at nonaccepting (l3,q0), whose successor has rank x0²+1. This invalidates the displayed example as written, not the general witness theorem; no one-cell full repair is claimed. Fixed maximum polynomial degree D gives one coefficient template per location over all monomials of degree<=D. Location invariants restrict entailments. The tool says it jointly generates suitable polynomial invariants using [12], and also reports ASPIC for linear benchmarks. The article does not fully specify how these two invariant sources interact in every experiment or the exact template/certificate degrees used. Existential constraints require some outgoing transition be enabled and ranked wherever the location invariant and f>=0 hold. Disjunction is rewritten equivalently as (phi and not psi1 and … and not psi(k−1)) implies psik, then antecedent DNF/consequent CNF distribute obligations. This avoids changing an existential successor choice into a requirement to rank every successor. Universal synthesis instead generates an implication for each enabled transition. Putinar-based elimination is imported from [1] as a sound/semi-complete conversion of polynomial implications to existential quadratic constraints. The printed paper does not supply its full compactness/positivity, certificate-degree or strict-inequality treatment. Theorems3/4 and text claim that sufficiently high D finds any polynomial witness, and sub-exponential complexity at fixed D. These are author theorems with omitted derivations; this reading does not independently validate unrestricted equivalence or quantitative complexity of every algebraic step. Existential initialization adds unknown initial values t and requires theta_init(t) and f_init(t)>=0. Universal initialization instead requires theta_init implies f_init>=0 for all initial values. Reader representation detail: a degree-two term ct² has total degree3 in unknown coefficient c and initial t, so Step4 is not literally quadratic without auxiliary-variable lifting or other encoding. Such lifting is possible, e.g. v=t² then cv; its equations are not described in this short algorithm. This is an encoding omission, not a demonstrated unsoundness. If a QP solution is found, the corresponding coefficients/initial values give a witness and Yes. Failure returns Unknown, acknowledging a higher-degree or nonpolynomial witness may exist. No bounded-degree failure establishes the opposite LTL answer. Mathematical soundness/completeness of witness families differs from semi-completeness of polynomial synthesis and from the practical solver’s ability to finish within a timeout. Prototype Java implementation calls Z3, Barcelogic and MathSAT5 in parallel on the generated constraints. Linear benchmarks use ASPIC for invariants. Direct-quantified Z3 is an ablation that omits the specialized Positivstellensatz step, not the same workload as a QP solver. No independent exact certificate validation, proof-assistant formalization, solver proof-log checking or floating-point-versus-exact coefficient audit is reported here. Experiments use Debian11, Intel E5-2670 at2.60GHz,6GB RAM,1800s timeout. Tool versions, concurrent solver resource allocation, repeats/variance, maximum memory, exact invariant/witness degree and complete translation details are not given in the article. Implementations/models linked at https://github.com/ekgma/LTL-VerP and DOI10.5281/zenodo.12518217 were not inspected or run. Benchmark selection: 297 of335 TermComp22 C-integer programs after excluding unbounded nondeterminism and variable-free programs;287 linear and10 nonlinear. Add21 of28 SV-COMP22 nonlinear loop benchmarks, excluding7 with unsupported operators such as integer mod. Thus318 programs,31 nonlinear, each paired with four specifications. Source categories mention integers while formal semantics uses reals; the article does not spell out a semantics-preserving integer-to-real translation or full arithmetic treatment. Refuting a real relaxation need not give an integer execution. Specifications use alphabetically first variable x, so their application is uniform but not an author-provided behavioral intent for each benchmark. RA is eventual terminal and globally x>=0, with every variable initially[0,64]. OV is eventual terminal or x outside[-64,63], with initial[-64,63]. RC is infinitely often x>=0; PR is always x<−5 implies eventually x>0, with initial[-64,63]. The formal model uses mathematical reals; the arithmetic domain and translation used for each benchmark are not specified in the article. OV is presented as a bound-crossing property; machine wraparound semantics are not established. A bounded nonterminating run need not converge, despite that word in the prose. Table2 compares Ours, Ultimate, nuXmv, MuVal and direct Z3. Yes/No count successful proofs/refutations; Tot adds them, U counts uniquely solved tasks. Reader arithmetic check: linear RA nuXmv prints76 Yes,91 No,137 Tot;76+91=167, so Tot is inconsistent. Stored table retains137 as printed and flags167 as arithmetic sum. Other printed count rows sum correctly. No raw outputs were examined to resolve which cell is wrong. Ours linear totals RA255,OV246,RC274,PR265 versus Ultimate263,267,280,282 and MuVal194,252,277,277. Thus Ours does not dominate linear coverage. Nonlinear Ours27,26,26,27 versus nuXmv1,7,26,25 and MuVal19,25,24,21; Ultimate unsupported, directZ3 zero. Unique counts sum10 linear and11 nonlinear property-program tasks; without task lists these must not be asserted to be21 distinct source programs. Average times are over successful subsets with differing coverage, not a common solved intersection. Table average rows include Yes,No,Tot times even though caption describes programs proved correct. Linear Ours5.4s Yes/81.5s No/47.2s combined, Ultimate5.4/4.1/4.7. Nonlinear Ours10.7/99.1/32.3. Do not infer a uniformly faster method from equal5.4s affirmative averages or compare conditional means as controlled speed ratios. The paper contains two program/automaton illustrations and an explicit location-wise EBRF example, but no named per-benchmark case study in results beyond aggregate categories. Supporting witness/product/algebraic proofs and full worked synthesis example are deferred to [13]/[1]. These were not read in this record. Heap/nonnumerical abstraction is future work; motivation through smart contracts/CPS is not a demonstrated deployed-system verification. No Verus, verified Rust, TLA+, distributed protocol implementation or LLM-agent experiment is supplied. Relevance to such evaluation comes from exact run quantifiers, proof versus refutation certificates, nondeterminism restrictions and theory/solver/benchmark boundaries, as reader inference.
  • how much was read: most of it read
  • source
  • record id: sound-and-complete-witnesses-2025
• Veil (2025)
  • title: Veil: A Framework for Automated and Interactive Verification of Transition Systems.
  • what: It embeds distributed transition systems in Lean. It sends first-order proof obligations to SMT solvers and leaves the rest as interactive Lean goals.
  • number: 16 evaluated cases incl. Rabia, SCP, Suzuki-Kasami, Vertical Paxos
  • number: 1704 non-empty, non-comment lines of Lean; 85 actions and 185 invariants; about 100 lines per file
  • number: 16 benchmarks, 1,704 Lean lines, 85 actions, 185 invariants
  • number: Veil verifies 16/16; 14/16 under 15 s and 12/16 under 10 s
  • limits: It evaluates checking supplied invariants, not finding them. It is not an LLM agent. All its guarantees are safety. The notes record no agent success rate.
  • how much was read: most of it read
  • source; notes: Veil: proofs in Lean with automatic first-order checks; notes: Veil: a promising proof interface, with no agent rate established here
  • record id: veil-2025
• VeruSAGE (2025)
  • title: VeruSAGE: A Study of Agent-Based Verification for Rust Systems
  • what: 849 proof-writing tasks from eight verified systems (IronKV, Anvil, Atmosphere, Vest and others). A proof body is removed, and an agent loop with a 20-minute budget must restore it.
  • number: Table 5 model totals: o4-mini 41%, GPT-5 55%, Sonnet 4 64%, Sonnet 4.5 81%; Sonnet 4.5 with plain Copilot proves 688/849 (80.9%)
  • number: Anvil library 100%, Anvil controller 37%, IronKV 84%, Atmosphere 83%
  • number: Specialized harness about 1.6x time and 2.2x cost on whole projects
  • number: 849 tasks from eight systems (nine projects): Anvil temporal library 104, Anvil vreplicaset controller 63, IronKV 118, mimalloc 89, Node Replication 29, NRKernel 204, Atmosphere 157, persistent storage 63, Vest 22
  • limits: Failures center on discovering inductive invariants (facts that hold initially and stay true after every step). The Anvil library lemmas are not the same as proving that a new controller eventually reconciles.
  • how much was read: most of it read
  • source; notes: VeruSAGE: high overall rates hide controller-invariant difficulty; notes: VeruSAGE / VeruSAGE-Bench
  • record id: verusage-2025
• VLTL-Bench (2025)
  • title: Verifiable Natural Language to Linear Temporal Logic Translation: A Benchmark Dataset and Evaluation Suite
  • what: It scores four steps of translating natural language to LTL. The steps are finding propositions, translating temporal structure (judged by logical equivalence, not string match), grounding to executable predicates, and classifying satisfying and violating traces.
  • number: datasets: Kitchen Assistant 10,000, Search-and-rescue 7,304, Traffic-light 7,319, Warehouse 7,457
  • number: built from 36 expert nl2spec templates
  • number: Table 2: four generated datasets of 10,000; 7,304; 7,319; 7,457 entries (32,080 total) reusing 43 templates
  • number: 36 expert-crafted lifted NL-LTL pairs plus 7 new ones
  • limits: Its equivalence check only flags a difference. It does not say whether one formula is weaker or stronger. Two traces cannot establish equivalence or liveness. It has no proof, no code, and no audit of how far to trust agents. The text says three datasets but the table lists four.
  • how much was read: most of it read
  • source; notes: Temporal requirement translation: VLTL-Bench and GraFT; notes: papers
  • record id: vltl-bench-2025
• Anvil (2024)
  • title: Anvil: Verifying Liveness of Cluster Management Controllers
  • what: Rust controllers are written as state machines. The authors prove they match an abstract model. They also prove that the model reaches the desired cluster state and then stays there, once the desired state stops changing. They call this eventual stable reconciliation.
  • number: ZooKeeper 1,134 executable / 8,352 model+proof lines; RabbitMQ 1,598 / 7,228; FluentBit 1,208 / 8,395
  • number: total 3,940 executable, 23,975 proof/model, 2,326 trusted lines
  • number: parallel verification 154, 151, 96 seconds
  • number: about 2.5 person-months; first proof about two person-months, later ones about two person-weeks
  • limits: Trusts the temporal-logic embedding, the environment model, the specs of external APIs, Verus and the OS. Assumes faults eventually stop. The guarantee says nothing useful if the desired state changes forever. One bug came from an incomplete trusted spec of the ZooKeeper API.
  • how much was read: most of it read
  • source; notes: Anvil: Verifying Liveness of Cluster Management Controllers; notes: P06. Anvil: Verifying Liveness of Cluster Management Controllers
  • record id: anvil-2024
• Behavioral Programming liveness (2024)
  • title: Keeping Behavioral Programs Alive: Specifying and Executing Liveness Requirements
  • what: Adds a must-finish state idiom to Behavioral Programming so b-threads can specify liveness directly, with GBA-game and MDP-based execution mechanisms. The paper maps 18 liveness patterns among 55 Dwyer patterns to executable b-threads, proves live-run compatibility, translates b-programs to generalized Büchi automata, and uses either SCC winning strategies or reward-guided MDP policies. Evaluation covers railway-level crossing and parameterized Maskable PPO, plus Sokoban.
  • number: all 18 liveness Dwyer patterns are mapped and verified with BPpy
  • number: Maskable PPO convergence table reports 20 repetitions across parameter configurations
  • number: parameter dimensions vary freight/maintenance approaches, maintenance railways, and k-spacing
  • number: GPU evaluation uses NVIDIA GeForce RTX 4090
  • limits: The GBA mechanism assumes finite-state executable models; MDP experiments focus on one liveness b-thread and use learned policies that may become infeasible as state complexity grows. Verification assumes must-finish states eventually exit, and RL results are proof-of-concept rather than universal policy guarantees.
  • how much was read: most of it read
  • record id: behavioral-programming-liveness-2024
• Bythos (2024)
  • title: Compositional Verification of Composite Byzantine Protocols
  • what: Embeds TLA in Coq and assumes that message delivery is weakly fair (a message that stays deliverable is eventually delivered). Proves that pending packets are eventually delivered and that protocol phases finish. The method: for each phase, find a finite set of packets that is enough. Show that delivering them starts the next phase. Chain the phases with the transitivity of the leads-to relation (for example init ∧ □next ∧ WFDelivery ⊢ sent ~~> output). Covers Provable Broadcast, Reliable Broadcast, Accountable Confirmer and Accountable Reliable Broadcast.
  • number: full development about 7100 Coq lines, trusted OCaml shim about 200
  • number: liveness spec/proof lines: Bythos library 160/181; Provable Broadcast 92/67; Reliable Broadcast 144/161; Accountable Confirmer 172/200; composition 3/7; connector 48/92
  • number: knowledge lemmas: 10-20 per case, found manually
  • limits: Fairness holds only for delivery to honest processes. The set of honest members is fixed. No proof of probabilistic termination. Partial synchrony (bounded message delays that hold only after some unknown time) is left to future work. The combined proof is tiny only after humans find reusable interfaces and facts about the connectors. The paper does not state how long the authors took.
  • how much was read: most of it read
  • source; notes: Bythos: composition with TLA proof rules in Coq
  • record id: bythos-2024
• CSP retrospective (2024)
  • title: The Challenges and Triumphs of CSP Based Formal Verification
  • what: Roscoe looks back on CSP, a notation for describing processes that run in parallel and talk to each other, and its model checker FDR. He covers a two-player-game encoding, a primary/secondary consensus handover protocol for blockchains with malicious nodes, a way to check deadlock freedom from the sum of component state spaces, and the Coco tool used by ASML.
  • number: Coco Platform is in use at ASML for photolithography machine software (as stated by the author, no figures)
  • number: the author’s naive CSP blockchain model could not hold a realistic number of blocks, agents or keys (state explosion)
  • number: token-invariant deadlock check on a 3-component example: state space of 6 component states, one nontrivial invariant (t4) proves deadlock freedom
  • limits: Reflective paper written for CSP experts: no benchmarks or timings are given for the handover protocol or the local checking idea, and both are models checked in FDR, not code. The author lists proving the Bully algorithm and a distributed database protocol for all N as still-open challenges.
  • how much was read: most of it read
  • source; notes: The Challenges and Triumphs of CSP Based Formal Verification (2024)
  • record id: csp-retrospective-2024
• Datadog Courier (2024)
  • title: How We Use Formal Modeling, Lightweight Simulations, and Chaos Testing to Design Reliable Distributed Systems (Datadog Courier)
  • what: Datadog modeled its Courier message queue in TLA+. It checked a liveness property named NoLostMsgs with TLC under weak fairness (an assumption that a continuously enabled step eventually runs). After a sequencer was added, TLC found a counterexample, and the design changed.
  • number: TLC scanned 5,515,710 distinct states with no violation in the first model
  • limits: It is a vendor post and not peer reviewed. The models do not validate the implementation.
  • how much was read: most of it read
  • source
  • record id: datadog-courier-2024
• ForEx hyperliveness verification (2024)
  • title: Automated Software Verification of Hyperliveness.
  • what: Introduces Forall-Exist Hoare Logic (FEHL) and ForEx, a constraint-based verifier for finite-program ∀k∃l relational properties (Forall-Exist Hoare Tuples). The method symbolically postpones existential nondeterministic choices as parameters, computes parametric strongest postconditions, and discharges resulting first-order constraints with SMT. FEHL provides self-composition, sequencing, conditionals, loops and consequence rules; the paper proves soundness and completeness relative to sound/complete unary Hoare and under-approximate systems. ForEx implements eager restriction satisfiability checks, a minimal C-like language with arrays/bitvectors, Z3 support for linear integer arithmetic, arrays and finite bitvectors, and guess-and-check invariant generation. Experiments compare ForEx against HyPA, PCSat and HyPro on k-safety, GNI, refinement and related benchmarks. ForEx is faster on solved instances but its counting-based loop alignment misses context-dependent alignments and it cannot prove termination of existential loops, leaving some GNI instances unsolved.
  • number: ForEx solves 6 of 8 ∀∃ instances in the PCSat comparison
  • number: HyPA comparison includes 20 k-safety/relational benchmark rows across Tables 5a/5b
  • number: ForEx times range from 0.10 ms to 2.88 ms on listed PCSat GNI cases
  • number: HyPro comparison checks 4 GNI instances over bitwidths 1–6 with 3-minute timeout
  • limits: FEHT validity quantifies finite terminating executions; the algorithm is for verification, not refutation of invalid FEHTs (which requires existential-universal reasoning). Completeness is relative to complete unary over/under-approximate proof systems and, for loops, depends on adequate invariant guesses. The tool explores a restricted counting-based loop alignment, so state-dependent alignments are outside its scope. Experiments use small benchmark programs, an M1 Pro with 32 GB, and user-provided invariant hints for marked cases.
  • how much was read: most of it read
  • source
  • record id: forex-hyperliveness-verification-2024
• Ghost signals and completeness thresholds (2024)
  • title: Semi-Automated Modular Formal Verification of Critical Software: Liveness and Completeness Thresholds
  • what: Develops (1) ghost-signal separation logic for modular termination proofs of busy-waiting concurrent programs under fair scheduling and (2) completeness thresholds reducing unbounded memory-safety proofs for array-traversing programs to bounded checks. Ghost signals are verification-only resources with obligations to set signals, well-founded levels preventing cyclic wait dependencies, and shared-state invariants connecting signal state to arbitrary data structures. The logic is modular over threads/functions and extends to race freedom, deadlock freedom, arbitrary conditions, signal erasure, higher-order features and fine-grained concurrency; appendices prove soundness. A bounded FIFO producer-consumer example and CLH lock were verified with tool support. Completeness-threshold chapters define thresholds over input sizes, derive verification-condition based approximations, prove modular/transitive/elimination rules, and characterize simple unconditional array accesses.
  • number: Tool support verifies C versions of bounded FIFO and CLH lock
  • number: No aggregate benchmark counts or runtime table in supplied text
  • number: Threshold results are theorem-based rather than empirical
  • number: bounded FIFO producer-consumer: 160 annotation lines for 37 lines of C (435%), verifies in 0.08 s
  • limits: Liveness requires fair scheduling and proof obligations that every signal is eventually discharged; levels must be well-founded and correctly encode dependencies. Ghost signals are not runtime state, so invariants linking them to concrete conditions are mandatory. Completeness thresholds target heap programs traversing arrays without allocation/freeing and can yield sound bounded guarantees only when verification conditions are precise; broader data structures remain future work. The dissertation reports no broad benchmark runtime study.
  • how much was read: most of it read
  • source; notes: Semi-Automated Modular Formal Verification of Critical Software (2024)
  • record id: ghost-signals-and-completeness-thresholds-2024
• LiDO (2024)
  • title: LiDO: Linearizable Byzantine Distributed Objects with Refinement-Based Liveness Proofs
  • what: A pacemaker state (current round and remaining time) exposes enough timing information for Coq refinement proofs of Byzantine consensus safety and liveness under partial synchrony (the network is eventually well-behaved). Unpipelined Jolteon is extracted to runnable OCaml, with a handwritten network and timer environment. The liveness proof splits leader entry, request, votes and receipt into timed stages.
  • number: unpipelined Jolteon: safety about 4,000 Coq lines, liveness about 1,800 (§4, PDF p.19)
  • number: pipelined liveness extension about 2,000 lines (§5)
  • number: liveness Table 1 itemises 357+523+953 lines
  • number: liveness proof around 1,800 lines
  • limits: It proves the system responds infinitely often, not that it responds to every client request. The proof of the pipelined model is not a verification of a production blockchain. The review notes found no person-time. The contracts for the network and environment are assumed.
  • how much was read: most of it read
  • source; notes: LiDO: Linearizable Byzantine Distributed Objects with Refinement-Based; notes: LiDO, LiDO-DAG, and a 2026 liveness bug; notes: papers and boundaries
  • record id: lido-2024
• LVR (2024)
  • title: LVR: Mostly Automated Verification of Liveness Properties for Distributed Protocols with Ranking Functions
  • what: LVR turns a progress goal into ranking obligations and safety obligations: the measure decreases, stays nonnegative, cannot leave the pending condition without reaching the good state, and no deadlock occurs. It infers integer variables, bounds and polynomial coefficients. mypyvy and P-FOL-IC3 discharge the safety obligations. Humans supply any missing variables, bounds and tiers.
  • number: 37 out of 40 (§9.2, p.35:27) automatically; the rest manually in a few hours each
  • number: each final coefficient-solving query takes less than a second
  • number: eight models: ticket lock 68 lines, hybrid reliable broadcast 137, alternating bit 127, TLB shootdown 361, Paxos 133, multi-Paxos 135, stoppable Paxos 160, sliding window 119
  • number: all eight protocols succeed: ticket lock, hybrid reliable broadcast, alternating bit, TLB shootdown, Paxos, Multi-Paxos, Stoppable Paxos, sliding window
  • limits: By default, scheduling assumes a globally bounded interval. This is a slightly stronger fairness than “infinitely often”. For example, scheduling at times 1, 2, 4, 8 satisfies “infinitely often” but not any fixed bound. Prophecy variables and a three-tier ranking keep the original fairness. LVR’s multi-Paxos leaves out the local scheduler and the I/O queue. So fewer lines than IronFleet does not mean equally less effort. A cheap solver query is not the whole cost.
  • how much was read: most of it read
  • source; notes: LVR and implicit ranking functions
  • record id: lvr-2024
• neuralmc (2024)
  • title: Neural Model Checking
  • what: NeuralMC trains neural ranking functions (measures that shrink toward the goal) from simulation samples. It targets LTL liveness of SystemVerilog hardware. It then validates the functions symbolically with SMT over all transitions.
  • number: Table 1: 194 tasks; own tool 180, ABC 57, nuXmv 117, commercial X 156
  • number: five hours per task
  • number: VGA solves 0 of 10
  • limits: It covers finite hardware models. Training failures and timeouts are separate from proved violations.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Neural Model Checking
  • record id: neuralmc-2024
• rlive (finite-state) (2024)
  • title: Avoiding the Shoals - A New Approach to Liveness Checking
  • what: This is a liveness checker for finite-state hardware circuits (AIGER). It checks that the circuit eventually stabilizes, or it finds a repeating execution that violates this. It is the predecessor of rlive-inf.
  • number: 223 benchmarks
  • number: limits 8 GB and 1 h
  • number: Table 2: nuXmv -rlive solved 159 (66 proved, 93 violated) vs k-Liveness+BMC 146 (61, 85)
  • number: Table 3 virtual best proves 82 and refutes 101; without rlive 82/85
  • limits: It covers circuit models only. It reports no circuit sizes and no human-effort totals. The notes did not identify the modified nuXmv source archive.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: original finite-state rlive
  • record id: rlive-finite-state-2024
• SCTP formal analysis (2024)
  • title: A Formal Analysis of SCTP: Attack Synthesis and Patch Verification
  • what: Humans build a Promela model of SCTP from the RFCs. They choose ten LTL properties and four attacker models. SPIN verifies the properties and KORG synthesizes attacks. This shows that the RFC 9260 patch removes the modeled CVE-2021-3772 attack.
  • number: ten LTL properties; four attacker models
  • number: long Off-Path checks 123:42 and 86:10 (mm:ss) unpatched vs 7:07 and 6:48 patched, on a 16GB M1 MacBook Air
  • number: KORG changes: 80 existing and 213 new lines, plus 102 shell lines
  • number: Ten LTL properties verified without attacker; long off-path checks 123:42 and 86:10 (mm:ss) unpatched vs 7:07 and 6:48 patched
  • limits: Two peers and buffers of size one. Excludes crashes, restarts, congestion control and most data transfer. The attacks are real only against the model. No theorem that the code matches the model. Model size and modeling time are not stated.
  • how much was read: most of it read
  • source; notes: SCTP formal analysis: humans supply the model, properties and attacker; notes: SCTP formal analysis: humans supply the model, properties and attacker
  • record id: sctp-formal-analysis-2024
• Stochastic Omega-Regular Verification and Control with Supermartingales (2024)
  • what: Introduces nonnegative Streett supermartingale certificates for probability-one omega-regular properties of general discrete-time stochastic processes. Uniform expected decrease on A minus B, bounded increase on B and no increase elsewhere certify each Streett pair. For Markov models, combines deterministic Streett automata, inductive invariants and parametric policies into polynomial-real constraints. Gives template-relative synthesis reductions to quantified NRA, existential NRA, QCP or LP, and eleven small example timings. Completeness for every satisfying stochastic process is explicitly open. Uses Robbins–Siegmund to certify disjunction of finite A-visits or infinite B-visits without proving either disjunct individually almost surely. Derives product-state post-expectations and six classes of universally quantified constraints, preserving invariant and policy synthesis jointly. Explains parametric versus known guards, Farkas infeasibility disjunct, external shielding and finite-memory encoding. Complete table/control parameters support checking exact model/property consistency; reader calculations identify printed automaton boundary and controller discrepancies, not inspected tool defects.
  • limits: General theorem uses a filtered probability space, measurable/adapted processes, nonnegative real V and fixed positive epsilon,M. It certifies probability1, permitting measure-zero exceptional runs, not every possible trajectory or a quantitative failure probability/time bound. Conditional expectations must be well-defined with the stated nonnegative drift inequality. Any connection to implementation numeric/physical behavior remains outside the mathematical theorem. A Streett pair(A,B) means finitely many visits to A OR infinitely many visits to B. Drift is E[V_next|history]<=V−epsilon1_(AminusB)+M1_B. Uniform epsilon matters; arbitrary strictly positive but summable decreases would not exclude infinite A-visits. B may recharge the certificate, so V need not be an ordinary supermartingale globally. Reader derivation of Theorem2 from Theorem1:take U_t=epsilon1_(AminusB),W_t=M1_B. On finite B-visits,sumW finite; Robbins–Siegmund implies sumU finite almost surely, hence finite AminusB and finiteA. Finite conjunction of probability1 pair-events preserves probability1. The paper gives theorem statements/intuitive examples rather than a machine-checked derivation. Theorem3 restricts Markov drift conditions to a measurable supporting invariant I containing the initial state and preserved with probability1. This can exclude unreachable regions where no global certificate exists. V must remain nonnegative onI; disregarding invariant initiation/consecution would break the proof. Common epsilon,M across finitely many pairs can be obtained by min/max if separate finite constants exist. Synthesis model is time-homogeneous real-state update f(x,w;kappa),i.i.d.disturbances and known fixed policy templates. Memoryless deterministic policies are direct; finite-memory/random inputs can be encoded by extra state/disturbances with fixed memory size/template. This does not synthesize arbitrary history-dependent policies or verify adversarial nondeterministic schedulers without a separate semantics. Deterministic Streett automaton reads current state label, advances q using currentx and advances modelx synchronously. Certificate/invariant live on product(x,q); automatonq alone generally lacks Markov time-homogeneity. LTL-to-automaton correctness and measurable observation predicates are trusted. Rabin duality requires negating the property/probability appropriately, not interpreting a Rabin probability0 result as satisfaction of the same unnegated formula. Symbolic closed-form post-expectation is essential. Theory allows piecewise polynomial templates of fixed degree and polynomial post-expectations, reducing to existential parameters/universal real states with quantifier elimination. Non-polynomial dynamics, arbitrary distributions, unknown degree, non-real arithmetic and unbounded unknown memory lie outside this algorithmic decidability claim. Template completeness is relative to existence of certificate,invariant,policy satisfying the encoded constraints in supplied forms. The paper explicitly leaves completeness of Streett certificates over all satisfying stochastic processes open. SolverUNSAT can show no encoded-template solution, not generally disprove the temporal property; no claim that increasing degree/regions must eventually succeed. Eq16 requires closure for every disturbance w inW, which is sufficient but stronger than Theorem3 probability1 closure when W contains null-probability choices. Example uniform[0,1] hasP(w>0)=1but excludes point0onlyalmostsurely; robust all-wclosure of invariantx>0 would fail. Relative completeness should be understood for the stronger written constraints, not all measurable probability1invariants. Piecewise linear in state does not mean linear in unknown coefficients: controller/certificate products make existentialNRA. Farkas implication rewriting includes either nonnegative multipliers proving consequence or multipliers proving antecedent infeasible. With known guards/invariant, discard infeasible premises then use feasible Farkas form. QCP may be nonconvex; polynomial products can be encoded with fresh quadratic equations. Fixedautonomous dynamics plus fixedguards reduce toLP. Strict-guard reduction cites[20,Lemma1] without reproducing its preconditions. Simply replacing strict premises by weak ones is not equivalent for an infeasible strict antecedent whose closure becomes feasible: (y<0 AND −y<=0)=>1<=0 is vacuouslytrue, while closed version fails aty0. A correct reduction must preserve strict infeasibility or meet the cited lemma conditions. This is a missing justification/precondition issue, not an inspected solver bug. Visible Figure3 claims DSA for(x>=−1) U G(−1<=x<=1),but transitions classify x>=1asq0 and only−1<=x<1asq1. Constantx1satisfies the printed closed-interval formula yet stays inq0forever and is rejected by Streett({q0,q2},empty). Thus displayed automaton enforces the stronger eventualx<1boundary; examplecontroller kappa.5 avoids that boundary issue, but general translation claim is not exact as printed. Example3 continuous uniformnoise[-.1,.1],x0=100,kappa.5 has V=x+1inq0,0otherwise andI:q0x>=−.2,q1x∈[−.2,.9],q2false. Eq32driftε.5 atx>=1andEq33atx<1are valid onI. Eq26maps[-.2,1)to[-.2,.6),Eq29maps[-.2,.9]to[-.2,.55],so closure holds. This is a concrete worked proof, not an executed synthesis replication. Example4 Eq44 prints PostV determined solely by x for all q∈{q0,q1,q2}, although q2 is absorbing in Figure3. For q2 the actual post branch uses alpha2,beta2 regardless of x; setting the q2 invariant false makes that defect irrelevant for Example3. Eq43 has an unexplained printed fv prefix. These are presentation defects; no artifact behavior is inferred. Prototype uses one affine certificate case per automaton state, convex polyhedral invariant templates, Spot LTL translation, SymPy symbolic manipulation and Z3 QF_NRA. Eleven Table1 rows:5VIC,4VI,1VC,1V; all reported under30seconds. Table includes externally supplied-invariant VC/V cases, despite the generic paragraph saying none are required. No comparison benchmark table, failed instances, scaling study, CPU/RAM/OS/solver versions or public artifact link is identified in this paper. Benchmarks use discrete random variables for weighted enumeration of post-expectation, except countably infinite evenOrNegative whose post-expectation is manual. The continuous uniform-noise example is worked analytically; benchmark distributions are not all continuous. Authors report a single deterministic execution and negligible variance, without repeated timing data, error bars or independent replication. Temperature1 model is x_next=.99x+2.8+alpha*x+beta+noise, with fair independent noise±.1 and x0=280K. Hot means x>298, Cold x<292. Alpha−1/32,beta4787/512 yield contraction767/800, center≈294.536 and limiting extreme interval[292.111742,296.960227], consistent with eventual comfort. Observations classify292/298 as neither Hot nor Cold, while prose uses open interval(292,298); preserve the boundary distinction. Reader counterexample to printed Temperature3 controller:alpha−1/64,beta9/2 give x_next=(1559/1600)x+7.3±.1. Starting from280, interval[280,289] is invariant: smallest/largest images are280.025/288.994375. Cold is therefore always true and Hot never true; GFCold=>GFHot fails on every run. This contradicts the printed model/observations/controller/property combination. It may be a model or parameter printing mismatch, not an independently inspected tool defect. Reader Temperature4 check:below shield305, alpha−43/3200,beta4 give x_next=(125/128)x+6.8±.1. Interval[280,295] is invariant, with extreme images280.1375/294.9859375. Hot never occurs and shield never activates.32consecutive low disturbances map any state in this interval to<=290.142598<292. Independent fair Bernoulli blocks produce infinitely many such positive-probability blocks almost surely; hence GFCold holds almost surely and GFHot is false. The printed reactivity claim conflicts with these shared dynamics/thresholds/initial state; artifact uninspected. Temperature3 total28.58s includes23.65s SMT. Temperature4 Table1 total4.64s and prose QCP solve.03s measure different work. Comparison changes controller class, shield, supplied invariant and parameter bounds; the entire speedup cannot be attributed solely to solver choice. Original alpha,beta bounds[−10,10], shielded[−5,5], with305alpha+beta<5.24. FinMemoryControl has one memory bit b; parameters alpha56,l1/8,m14,p1/2,q51 give guards x<=112 in b1 and x<=102 in b0. The simultaneous x update is alpha+w in b1, w−1 in b0. The paper does not state this benchmark’s disturbance distribution, initial state or initial memory bit, so its full behavior cannot be independently reconstructed from this PDF. The other random-walk and Temperature2 rows also omit full model details. Relevance is probabilistic liveness certificates, automaton-product invariants, template synthesis and checking exact generated controller/specification agreement. No LLM writes proofs/specs, no Verus/verified Rust or TLA+ pipeline, and no specific distributed protocol/implementation is verified. Quantitative verification and neural certificate learning are future directions; priority claims are author statements.
  • how much was read: most of it read
  • source
  • record id: stochastic-omega-regular-verification-2024
• TLA+ model-checking education (2024)
  • title: WIP: An Engaging Undergraduate Intro to Model Checking in Software Engineering Using TLA+
  • what: Describes an undergraduate/graduate teaching approach that introduces TLA+ and TLC through puzzles, a microwave controller, concurrency, bounded counters, and buffers. Students progressively confront safety, liveness, deadlock, and thread-safety failures. Analyzes model-checking courses, supplies reproducible examples and open-source modules, and uses successive counterexamples to motivate stronger requirements. The microwave case distinguishes safety (door/radiation) from liveness (eventual shutoff), while bounded buffers and counters introduce concurrency.
  • number: 84% of students reported a positive experience (§Abstract)
  • number: FMEDB analysis covered 34 model-checking courses out of 88 total (§I)
  • number: Preliminary survey covered 32 recent courses (§II)
  • number: No controlled learning-outcome comparison reported
  • limits: Findings are preliminary, based on one institution/course and anonymous student input; the paper explicitly calls the work in progress and plans longitudinal/multi-institution evaluation. Educational engagement does not measure professional verification competence.
  • how much was read: most of it read
  • record id: tla-model-checking-education-2024
• Trillium (2024)
  • title: Trillium: Higher-Order Concurrent and Distributed Separation Logic for Intensional Refinement
  • what: Trillium proves that full program executions refine a simpler model. Fairis preserves progress under fair scheduling. It uses fuel to bound stuttering (steps that change nothing). The extended Aneris shows that implementations follow TLA+ models.
  • number: full Coq refinement proof for the SDP example about 1,100 script lines (footnote 9)
  • number: cases: two-phase commit, single-decree Paxos refinement
  • number: Paxos client proof about 1100 lines of proof scripts (footnote 9, p.9:27)
  • limits: The authors translate the TLA+ models into Coq state-transition systems by hand. The distributed instantiation targets safety. Distributed liveness is future work.
  • how much was read: most of it read
  • source; notes: papers and boundaries
  • record id: trillium-2024
• Using Dynamically Layered Definite Releases for Verifying the RefFS File System (2024)
  • what: The RefFS project page links a separate 124-page draft, Progress of Concurrent Objects with Dynamic Dependencies, authored by Mo Zou. Its PDF metadata dates it May24,2024; the project says “A separate paper” illustrates MoLi’s metatheory (P1). This is a complete fresh reading of that PODD paper, not an appendix of the OSDI paper and not a new reading of the RefFS implementation. The original RefFS main-paper account remains inherited from formal509. Whether this precise draft proves every rule of the released MoLi framework is not established by the link alone. PODD makes a thread’s progress depend on definite actions, obligations that their owning threads must fulfill once enabled. Actions have state-dependent layers, and dependencies must preserve strict relative order even when numeric layers change. Layers have a total order, not necessarily a well-founded one. Finite dependency sets and decreasing local/stack metrics supply the termination argument. The LIVE-FRM rule extends action/layer context while preserving old ordering, so an acquisition proof can be reused without expanding every nested wait chain. Tokens account for unblocked loop progress and finitely many levels of delaying interference. Theorem4.2 states linearizability and deadlock-freedom; starvation-freedom additionally requires rely and guarantee actions at level0 (S12,S14,S15). AppendixA supplies the fuller resource/ownership logic, fences, rules and ideal shared-memory semantics. AppendixB first gives judgment simulations with finite-height while stacks: arbitrary-length lexicographic lists would not be well-founded (S31). B.3 expands new while/live-frame cases. B.4 maps these to a common simulation, directly for starvation-freedom and through a lock plus nondeterministically decreasing finite-wait wrapper for deadlock-freedom (S45,S48). B.5 combines thread simulations using finite active-thread dependency sets, scheduler rounds and a lexicographic metric. LemmasB.22–B.30 connect coinductive fair traces to refinement (S54,S57,S58,S66,S69). B.6 defines progress over complete fair traces, permitting abort alternatives, and uses three most-general clients to relate finite refinement to linearizability and fair refinement to linearizability plus starvation/deadlock freedom. The deadlock equivalence wraps the atomic specification; it must not be replaced by the stronger starvation refinement (S72,S74). AppendixC provides all printed proof outlines for nested TAS/ticket locks, ticket-lock coupling lists, optimistic/lazy TAS lists, and two-list transfers. Ticket queues support starvation-freedom; unfair TAS permits only the weaker deadlock-freedom claim. Lists use local lock obligations, node order and finite traversal metrics. Optimistic/lazy cases retain removed nodes in ghost garbage, not a proved memory-reclamation scheme. Lazy contain is explicitly omitted. Transfers use one mutex to serialize moves, list levels0/1/2 and lexicographic (listlevel,distance-to-tail) layers; their add/remove proofs are referred to earlier lists. The two-list move is a useful dynamic-dependency example, rather than a distributed network/crash model (S87,S90,S94,S102,S109,S116,S122,S124). Evaluation consists of paper proofs and worked examples; no numerical benchmark, proof-time table or replayed mechanization is supplied here. Section6 explicitly makes mechanization and automation future work (S20). Section5.1 admits that common rely conditions and frame stability can prevent reuse across objects (S17). Assumptions include fair scheduling, an arbitrary fixed finite number of threads, ideal atomic memory actions, safe total abstract methods and the presented non-nested method-call language. No bounded response-time, weak-memory, crash/recovery or implementation-to-binary theorem follows from this reading. Reader deductions from the literal listings must be kept separate from intended theorems. Figure40’s inner ticket loop never increments o; Figure55’s elems retains marked values and discards unmarked ones; Figure62’s sequential MOVE removes a head before reading the new head. Details and elementary counterexamples are in reader_diagnostics.json, with exact page anchors. These are printed-source defects, not findings about unseen code or a global refutation of PODD. The page also has draft-level omissions: a duplicated strict-comparison branch in the proof on p57, an apparent dependency-set type slip in DefinitionB.12, and an unresolved Fig.?? reference plus omitted scheduler semantics on p58. Underlines/fonts were visually checked before identifying these issues. Relevance to the requested database is manual liveness proof structure and evaluation of specification/proof agents: track actual fairness and progress strength, stable dependency ordering, finite metrics, abstract-method contracts, omitted cases and intended versus literal specifications. These are reader uses of a concurrency result. This paper does not evaluate Verus, Rust, TLA+, LLM agents or distributed consensus. RefFS/Coq performance and proof counts remain attributed to the inherited OSDI paper, rather than this draft. Records exact WHILE/OBJECT obligations, ticket and abstract-lock metric differences, dynamic-layer/TDep construction, VFS bug cycle and source typo, refcount ownership protocol, non-atomic operation abstraction, conditional theorem and unmechanized metatheory, survey denominators, all LOC cells, workloads, normalized performance limits and graph estimates. Separates checked RefFS proofs from trusted C/runtime/lock/allocator and protocol-only VFS reasoning.
  • limits: Fresh source: all124pages, every LF line and all31 rendered contact sheets read; larger renders48,51,54,57–59,66,68–69,96,111,118 inspected. Original21page RefFS main reading inherited from formal509. Separate PODD draft is not a same-title appendix or proof-assistant replay. S12,S15,S72,S74: fair scheduling and arbitrary fixed finite thread count; linearizability plus deadlock-freedom generally, starvation-freedom only under level0 rely/guarantee restriction. Abort alternatives in progress definitions do not establish memory safety by themselves. S10,S22,S23,S27: ideal shared-memory language, primitive atomic operations and specified safe/total abstract methods; presented language excludes nested method calls. No weak-memory, compiled implementation, network/crash/recovery or bounded response-time theorem. S12,S14,S31,S54,S66: total ordering of layers is distinct from well-founded local/stack metrics. Dynamic numeric ranks may change while actual strict dependency relations remain stable. Finite-height stack bound and finite active-thread sets are substantive premises. S17,S20: paper admits object-specific rely/frame obligations and leaves mechanization/automation for future work. Reading the linked draft does not identify its rules with every released MoLi implementation rule. S96,S111,S118: printed metric, lazy abstraction and MOVE inconsistencies require qualification before reuse as formal specifications; counterexamples are elementary reader deductions, without implementation inspection. S102,S109,S116: ghost garbage retention does not prove reclamation; contain and repeated add/remove proof cases are omitted/referred elsewhere. All supplied content was read; omitted derivations were not independently supplied. P1: directory depth ranks can tie. A uniquely determined numeric rank does not give a strict total order on directory identities. Strict ordering of actual lock dependencies needs its own invariant; this local wording issue alone does not refute the locking result.
  • how much was read: most of it read
  • source
  • record id: using-dynamically-layered-definite-2024
• Verifying Randomized Consensus Protocols with Common Coins (2024)
  • what: # Whole-paper record: Verifying Randomized Consensus Protocols with Common Coins (authored by agents unless marked 🧑) Song Gao, Bohua Zhan, Zhilin Wu and Lijun Zhang. DSN 2024, IEEE, pp.403–415; DOI 10.1109/DSN58291.2024.00047. Read arXiv 2409.17627v1, submitted 26 September 2024, all 13 PDF pages, §§I–VIII, all 27 references, six figures and four tables. Inspected every page image. Publication pagination comes from Crossref; this PDF has no printed page numerals (Q52). Exact extracted passages with PDF pages and source lines are in quotes.json and combined.quote-source.txt. No author code, compiler, checker, prover, solver or serialized experiment/model data was executed or loaded. ## Contribution and claimed guarantees (authored by agents unless marked 🧑) The paper extends parameterized threshold-automaton verification from independent local coins to a shared common coin. It adds a separate coin automaton and communication variables, giving an infinite-state Markov decision process with process-location counters, per-round shared variables and resilience parameters (§III,Q9–17). Byzantine processes are represented through their effect on threshold guards rather than explicit Byzantine automata (§III-A,Q8). This is a verification method for protocol models, not an implementation refinement or verified executable. Safety and termination follow different reductions. For safety, two one-round invariants imply agreement and binary validity (Proposition 1,Q20–21). Theorem 1 states that any finite schedule can be reordered by rounds while preserving its final configuration and per-round stutter equivalence (Q22). Theorem 2 relates one-round LTL without next-time properties to a single-round system, assuming nonblocking behavior and termination of every fair single-round execution for all initial configurations (Q24). These assumptions matter; it is not an unrestricted equivalence between arbitrary multi-round properties and one bounded run. For termination the paper distinguishes three categories (§V-B,Q26–28). Category A has no decide event and targets eventual convergence to a common final value. Category B has binary messages and explicit decisions. Category C uses a Binary Crusader Agreement stage that may output ⊥, meaning undecided. C1 requires a uniform positive probability of converging during a round. C2 preserves unanimity; C2′ instead gives a positive probability of deciding when the round starts unanimously. Proposition 3 supplies a two-round geometric argument: the probability of not deciding after 2r rounds is at most (1−p·p′)^r (Q29). Binding fixes a bit at the first relevant execution prefix and excludes its opposite in every continuation. It is a property of sets of executions, beyond ordinary single-execution agreement (Definition 4,Q30). The model refinement introduces N0, N1, N⊥ locations so that five sufficient safety conditions, CB0–CB4, imply binding (Proposition 4,Q31–32). Proposition 5 combines binding and C2′ for termination (Q33). Lemma 2 states that, in the single-round setting, a uniform positive probability under every admissible adversary is equivalent to each adversary having some satisfying path (Q35). That quantifier order is stronger than merely finding one favorable schedule. The proof record is mixed. Lemma 1 has a one-line justification. Proposition 2 calls its proof trivial after a geometric-tail argument. Propositions 3–5 provide paper proofs; Corollary 1 cites them. Proposition 1, Theorems 1–2 and Lemma 2 explicitly omit proofs for length (Q21,Q24–25,Q35). proof-inventory.json records all ten named results and their assumptions. No proof-assistant artifact was inspected, and this reading does not independently establish their soundness. ## Assumptions and limits (authored by agents unless marked 🧑) The network is asynchronous and reliable: a sent message is “eventually received” without “loss, duplication or modification,” and receivers identify senders (§I(a),Q3). Byzantine faults are bounded by the selected resilience condition. The common coin is a trusted, fault-free abstraction, and only strong coins are considered: both bits are common outputs with probability 1/2. Cryptographic implementation correctness is future work (Q2–3,Q41). The model separates shared-message guards from coin guards. Correct processes cannot update coin variables; coin rules cannot modify shared variables. Automata are canonical: rules on cycles have zero updates (§III-B,Q10–13). The method is parameterized by the environment’s admissible n,t,f values, rather than verifying only the example cluster sizes. The termination specification is explicitly “under Round-rigid Adversaries” (§IV,Q19). Such an adversary is fair and schedules all actions of round k before those of round k+1 (§III-E,Q17). Removing this restriction is future work (§VIII,Q41). Finite safety-trace reordering does not establish probabilistic termination for arbitrary asynchronous adaptive schedulers. No benchmark archive, model file or proof-artifact URL is identified in the read paper. The paper says it builds two one-round automaton versions per protocol, but those inputs and their transformations were not available in the inspected sources (Q36–37). This does not assert that no artifact exists elsewhere. No ByMC run was reproduced. ## Cases and reported evaluation (authored by agents unless marked 🧑) The benchmark comprises Rabin83, CC85(a), CC85(b), FMR05, KS16, MMR14, Miller18 and ABY22 (§VI,Q36; Table II,Q45). Their protocol descriptions give different Byzantine bounds: for example Rabin83 uses t<n/10, CC85(b) t<n/6, and CC85(a), KS16 and ABY22 use n>3t. These protocol descriptions should not be substituted for the undisclosed exact checked input environments. Table II reports model locations/rules, execution-schema counts and verification time for agreement, validity and almost-sure termination. The authors “ran each experiments 10 times” and report averages, without raw trials or dispersion (§VI,Q37). The first six rows use an Intel Core i7-12650H laptop; the final two use a 216-core AMD EPYC7702 server in parallel mode. Times measure verification work, not consensus latency or throughput. Small examples complete quickly: Rabin83 has 7 locations/17 rules and reported times 0.25s for agreement, 0.20s for validity and 0.43s for its convergence target. CC85(a) uses 342 schemas/4.93s for agreement and an average 171.5 schemas/2.70s for termination. Fractional schema counts are averages. All eight rows and all table values are retained in numeric-evidence.json. MMR14 has 17 locations/29 rules. Its agreement and validity checks take 298.90s and 8.74s. The termination column says CE, with no time. Separately, §VI reports a CB2 violation “within 10 seconds at best,” with an example witness n=193,t=64 (Q38). A failed sufficient condition alone does not prove nontermination. The authors additionally analyze the returned execution, compare it with a known adaptive attack and describe repeating its final actions to recreate the opposite estimate distribution. The motivating four-node example has three correct processes and one Byzantine process. Two correct processes obtain the coin result s, while the adversary delays messages to the third until it can force estimate 1−s; the round can repeat (§II,Q7). This is a prior attack, not a new vulnerability discovered by the paper. Miller’s 2018 issue credits Ethan MacBrough and explains that the actual coin instantiation lacks the independence assumed by the earlier ABA proof (Q48–49). The issue proposes an extra CONF phase before revealing coin shares (Q50). Its later implementation comments were read as allegations, without auditing the linked code (Q51). The two repaired category C variants reportedly pass their obligations. Miller18 takes 11h46m47s and ABY22 takes 10h13m14s for all termination conditions, each exceeding 10^8 schemas; agreement takes 605s and 583s, respectively (Table II,Q45). The paper also describes 24-hour timeouts for the earlier technique on category C models, without a controlled cross-hardware speedup comparison (Q37). Table IV changes milestone counts from 10 to 6 in five same-size ABY22-based automata. Calculated maximum schemas fall from 98,182,294 to 28,918 for CB0 and 7,479,057 to 3,592 for Inv2 (Q39,Q47). These are calculated search bounds, not measured runtime reductions or proof that the variants preserve protocol semantics. Table I supplies MMR14 transition guards and updates; Table III lists selected value 0 formulas and an ellipsis, rather than complete checker inputs. Figures 1–6 provide pseudocode, voting and MMR14 automata, and the binding refinement. ## Source discrepancies that qualify interpretation (authored by agents unless marked 🧑) Three points remain unresolved from the printed sources. They are recorded as static comparisons, not reproduced checker failures or counterexamples to a full theorem. - Example 2 gives the MMR14 environment n>5t (Q9), while §II describes n>3t and §VI reports n=193,t=64. That witness satisfies 193 > 192 but not 193 > 320. The exact checked resilience condition cannot be recovered from the paper alone. - Proposition 5 reasons that no correct process has executed a coin-based rule, “in other words” the coin “is not yet tossed,” and therefore its result is independent of the binding bit (Q33). Figure 4 and Table I instead show rb with guard true, from initial coin location I2 to N0/N1, followed by unconditional rc/rd publishing its outcome (Q13,Q43–44). Under the initial-state and action definitions, a finite round 0 prefix can execute rb then rc before any correct-process transition. The adversary observes configuration histories (Q15,Q17). Thus the stated timing inference needs a further visibility or scheduling condition that is not enforced by these displayed rules. This prefix does not refute the full theorem or a benchmark protocol; it identifies an unsupported step in the supplied model-to-proof account. - Table III labels C1 with a universal implication excluding mixed final values along every path after a 0-valued final event (Q46). Body C1 is a positive-probability convergence condition, reduced through a per-adversary existential-path condition (Q27,Q35). The displayed statements differ. Separate model versions might explain a stronger checked obligation, but their concrete transformation is not supplied here, so the table cannot establish that correspondence. The coin prefix, resilience arithmetic and quantifier comparison are in static-witnesses.json. All relevant formulas and table entries were checked against rendered PDF pages, rather than relying only on text extraction. ## Relevance to the requested topic (authored by agents unless marked 🧑) This work directly addresses parameterized verification of randomized Byzantine consensus, especially the relation between common randomness, adaptive scheduling, binding and almost-sure termination. It supplies concrete verification-cost evidence and an example of using failed proof obligations to investigate a known attack. It also shows why a safety-preserving reordering theorem, a probabilistic termination argument and a checker result must retain their separate assumptions. For evaluating LLM-written specifications or proofs, the reader-derived lesson is to check scheduler quantifiers, coin secrecy and independence, the exact resilience environment, source-to-formula correspondence, proof availability and what a counterexample actually disproves. The paper contains no LLM, Verus or verified Rust experiment. Its TLA proof-system reference concerns related HotStuff work, not this paper’s verification method (Q40,Q42). HoneyBadger/Dumbo composition and cryptographic primitive verification remain future work (Q41).
  • limits: Parameterized canonical threshold automata under resilience environments; reliable eventual authenticated-sender delivery, no loss/duplication/modification; assumed strong fault-free common coin. Almost-sure termination only for fair round-rigid adversaries. CategoryA convergence differs from categoriesB/C decisions. Nonblocking and all fair single-round termination are prerequisites for reduction. Several central proofs omitted; printed resilience, coin-visibility argument and C1 formula correspondence unresolved.
  • how much was read: most of it read
  • source
  • record id: verifying-randomized-consensus-protocols-2024
• ByMC (2023)
  • title: ByMC: Byzantine Model Checker, and Survey on Parameterized Verification with Threshold Automata
  • what: ByMC models nodes that count messages against thresholds, abstracts the counts, and uses an SMT solver to check safety and liveness for every allowed number of processes and faults. Verified for both safety and liveness: folklore and Srikanth-Toueg reliable broadcast, asynchronous Byzantine agreement, nonblocking atomic commit, condition-based consensus, CF1S, C1CS, and BOSCO. The randomised protocols (Ben-Or, Byzantine consensus, k-set agreement and RS-BOSCO) get safety plus almost-sure termination (they finish with probability 1).
  • number: Table 4 (§6.2, p.5:20) lists the verified protocols
  • limits: The randomised cases hold only against adversaries that respect round boundaries. The Tendermint one-round agreement analysis covers safety only. The benchmarks are compact models, not runnable implementations. The review notes did not recover the original 2018 ISoLA chapter and read the 2023 survey instead. The review notes found no human person-time.
  • how much was read: most of it read
  • source; notes: ByMC: fully parameterized model checking; notes: Ivy, ranking, Coq, and Iris case index
  • record id: bymc-2023
• Decouchant-KulahciogluOzkan-Zhou liveness testing (2023)
  • title: Liveness Checking of the HotStuff Protocol Family
  • what: Extends Twins automated BFT testing with temperature-based and lasso-based liveness detection using partial/hot state abstractions, and compares them with bounded-time liveness checks on HotStuff, 2-Phase HotStuff, and Sync HotStuff. Defines partial states that retain liveness-relevant view/lock information and hot states used by temperature and cycle detection; lasso detection caches repeated hot states without controlled scheduling. Twins scenarios use two partitions, four honest processes and one Byzantine twin, with 1,000 unit tests for execution timing and 10,000 random scenarios per protocol evaluation. Baseline timeout checks report network-partition delays as violations; temperature/lasso distinguish persistent conflicting locks. Sync HotStuff’s early version exposes both safety and liveness faults.
  • number: 1,000 timing scenarios per configuration
  • number: 10,000 random scenarios
  • number: HotStuff small-timeout 20-round 97.6% false positives
  • number: 2-Phase 20-round temperature 0.17–1.92% liveness, 0 false positives
  • limits: Testing is bounded by generated rounds and state abstraction quality; temperature threshold selection trades false positives against runtime, while lasso can use more memory. Twins models Byzantine behavior through twin replicas and injected network faults; results are not formal proofs and depend on implementation/version (Sync HotStuff eprint 20190312:115828, Δ=50 ms).
  • how much was read: most of it read
  • source
  • record id: decouchant-kulahciogluozkan-zhou-liveness-testing-2023
• Finkbeiner Passing delay-dominance (2023)
  • title: Synthesizing Dominant Strategies for Liveness (Full Version)
  • what: Introduces delay-dominance, a strategy relation that compares unmatched progress failures against alternatives, to make best-effort synthesis compositional for many safety and liveness specifications. It defines a delay-dominance game, proves compositionality under an automaton bad-prefix criterion, and gives a universal co-Buchi automaton for synthesis. The paper formalizes the game where Spoiler chooses alternative-automaton branches first and Duplicator responds on the candidate strategy, proving self-dominance and that delay-dominant implies remorsefree dominant. It identifies existence of bad prefixes as the condition allowing blame of one component after composition, proves composition and winningness for realizable specifications, and constructs the recognizer by combining ACAs for phi and not-phi, Miyano-Hayashi conversion, and universal projection over alternative outputs. The resulting automaton has O(2^{|phi|^2}) states and bounded synthesis remains 2EXPTIME. Examples show immediate-send versus wait-for-peer strategies and mixed existential/universal ACA choices.
  • number: ACA size O(|phi|)
  • number: delay-dominance UCA size O(2^{|phi|^2})
  • number: synthesis in 2EXPTIME
  • number: parallel composition winning when phi realizable and bad-prefix criterion holds
  • limits: LTL specifications are represented by an ACA; delay-dominance depends on the chosen ACA structure, so a realizable formula may have no delay-dominant strategy. Composition requires the ACA to ensure bad prefixes; the authors state this is common for standard translations but leave parts marked TODO and give no implementation benchmark. Distributed architectures use Moore process strategies and standard bounded synthesis; complexity is worst-case 2EXPTIME.
  • how much was read: most of it read
  • record id: finkbeiner-passing-delay-dominance-2023
• Geometric-logic LTL streams (2023)
  • title: Liveness Properties in Geometric Logic for Domain-Theoretic Streams
  • what: Defines LTL over the algebraic cpo of partially defined streams JStrAK and studies formula denotations through Scott topology, sobriety, frames and geometric logic. Negation-free LTL formulas translate inductively to geometric theories whose models are exactly the denotations; the paper applies the translation to prove a liveness specification for the non-productive stream filter function. The stream domain is DCPO[N,JAK] with a pointwise flat order, so finite-support streams are compact approximants and total streams are their directed suprema. The authors prove negation-free denotations are upward-closed and induce sober subspaces, while negation can destroy sobriety (e.g., J¬□aK excludes aω). They stratify negation-free LTL into G, Gδ and full fragments, define geometric-formula operators for next/until/weak-until, and prove model equivalence (Theorem 3). A frame/deduction treatment establishes spatiality for countable theories and gives complete deduction for Gδ formulas. For filter, ordinary fixpoint induction fails because the bottom function does not satisfy total-output liveness; finite-occurrence formulas ψn,k and output approximants φk yield Lemma 13 and prove that infinitely many predicate-satisfying input elements imply a total filtered stream.
  • number: Theorem 3: model equivalence for every negation-free LTL formula
  • number: Corollary 3: every negation-free denotation is a sober subspace
  • number: Corollary 5: countable geometric theories yield spatial frames
  • number: filter proof uses finite n,k approximants and Lemma 13, not experiments
  • limits: The semantic development assumes a set A (finite for the filter theorem), flat Bool and a Scott-continuous predicate p that is defined on every a∈A. Results concern denotational stream semantics, not an implemented language or distributed protocol. Negation-free formulas are the main tractable fragment; arbitrary negation and Fσ cases may lack a geometric-theory model presentation. Decidability and refinement-type automation are left open, and the filter proof handles a single recursively defined function/specification.
  • how much was read: most of it read
  • source
  • record id: geometric-logic-ltl-streams-2023
• Henzinger Mazzocchi Sarac quantitative safety liveness (2023)
  • title: Quantitative Safety and Liveness
  • what: Generalizes safety, liveness, the safety-progress hierarchy, and safety-liveness decomposition from Boolean properties to quantitative trace properties over complete lattices. It defines quantitative safety/liveness by finite-prefix rejection of threshold hypotheses, proves closure/decomposition theorems, and derives finite-state approximate monitors for properties that are approximately safe and co-safe. The paper introduces quantitative properties Φ:Σ^ω→D over complete lattices, quantitative safety via finite witnesses for wrong lower-bound hypotheses, and the safety closure Φ*(f)=inf_{s≺f} sup_g Φ(sg). It proves safety iff upper semicontinuity iff equality with safety closure, safety iff inf-property, co-safety iff sup-property, and characterizes lim-inf/lim-sup levels. New liveness and co-liveness definitions are shown to generalize Boolean liveness; every property decomposes as min(Φ*,Ψ) with Ψ live, and as the minimum of two live properties. Approximate α-safety/β-co-safety are characterized by closure gaps; for real-valued limit properties these imply suffix influence eventually falls below any δ>α+β, yielding a finite-state (δ,δ)-monitor. Examples include minimal/maximal/average response times and discounted safety.
  • number: complete-lattice value domain
  • number: safety/liveness decomposition for every property
  • number: approximation threshold δ>α+β
  • number: monitor with at most 2|Sδ| equivalence classes
  • limits: The core definitions assume a nontrivial complete lattice; finite-state monitoring Theorem 59 additionally assumes a limit property with finite real values, finite observation alphabet, and finite α/β error bounds. Quantitative liveness is intentionally stricter than prior multi-live or verdict-live notions, and the paper proves strict separations. The results are semantic and monitor-construction theorems rather than implementation benchmarks; applications to distributed systems require choosing an appropriate trace domain and quantitative metric. Limit-property converse results are left as conjectural/partial in places (e.g., the full converse of the countable-supremum characterization for lim-inf properties).
  • how much was read: most of it read
  • record id: henzinger-mazzocchi-sarac-quantitative-safety-liveness-2023
• PyLTA (2023)
  • title: PyLTA: A Verification Tool for Parameterized Distributed Algorithms
  • what: Introduces PyLTA, which model-checks layered threshold automata for all process and fault-parameter valuations without bounding state-space diameter or exchanged messages. It supports synchronous/asynchronous communication-closed protocols and LTL, using counter/predicate abstraction, Büchi automata, SMT realizability checks and interpolant-based refinement. The paper gives an LTA input language with repeating or lasso layers, threshold guards and parameter relations. Counter abstraction counts processes traversing states and loses identities; Phase King identity guards are nondeterministically abstracted. Negated LTL is translated by Spot, MathSAT/PySMT checks abstract counterexample realizability, and automatic CEGAR adds predicates. The Phase King example assumes 4t<n, introduces actual-fault parameter f≤t, and needs one refinement predicate.
  • number: parameter constraint 4*t < n
  • number: actual fault parameter f ≤ t
  • number: one refinement predicate in running example
  • number: Supports parameterized process and fault counts
  • limits: Protocols must be parameterized, round-based and generally communication-closed with monotonically increasing message tags and threshold guards. Fairness assumptions are needed for infinite configurations. Identity-dependent behavior is over-approximated by counter abstraction, and results apply to the LTA model rather than executable code. General parameterized verification remains undecidable; no broad runtime benchmark is reported.
  • how much was read: most of it read
  • source
  • record id: pylta-2023
• Taming Large Bounds in Synthesis from Bounded-Liveness Specifications (Full Version) (2023)
  • what: The paper synthesizes reactive systems from Safety LTL extended with bounded next/eventually/until operators. It translates formulas to countdown-timer games, representing large numeric bounds symbolically rather than expanding them into nested next operators. On-the-fly pruning, timer-index reduction, and abstraction-based game solving keep generated games finite and manageable. The construction defines timer ordering and closure invariants, expansion/tree/timeout/squeeze operations, and a safety-game reduction whose locations encode current obligations. The full evaluation compares the prototype to ebr-ltl-synth and Strix on LTLEBR, SYNTCOMP, discretized real-time, railroad, conveyor-belt, robot-camera, and office-robot benchmarks, including bounds up to 21,600.
  • number: Experiments ran on an Intel Core i7-1165G7 with 16 GB RAM and one core
  • number: On 23 SYNTCOMP benchmarks, all three tools were comparable; Strix rejected roughly half of the [9] formulas as too long
  • number: Real-time adaptations used up to 19 propositions, 16 bounded operators, and bounds 60–4,000, where the tool clearly outperformed Strix
  • number: Office-robot bounds reached 21,600; many larger instances timed out under 15 minutes, while Strix often timed out or rejected expanded formulas
  • limits: The logic is discrete-time and restricted to an extension of Safety LTL; dense-time MTL/MITL synthesis is outside scope. Solving uses an abstraction threshold and can time out or become infeasible without approximation; Strix cannot accept many formulas because it expands bounded operators, and ebr-ltl-synth cannot handle benchmark assumptions. The prototype is single-core and comparisons use adapted benchmarks where formalisms differ.
  • how much was read: most of it read
  • record id: taming-large-bounds-in-2023
• Cosmos DB TLA+ (2022)
  • title: Understanding Inconsistency in Azure Cosmos DB with TLA+
  • what: # Whole-paper read: Understanding Inconsistency in Azure Cosmos DB with TLA+ (authored by agents unless marked 🧑) A. Finn Hackett, Joshua Rowe and Markus Alexander Kuppe; arXiv2210.13661v1,24October2022,11pages. This is a client-facing behavioral model and industrial explanation case study. It reports390lines of core specification developed over2person-months,24non-type properties checked by bounded exploration/simulation, two documentation issues and an abstract explanation of an Azure outage. The service implementation is represented through expert feedback, without automated conformance checking. [Q0,Q1,Q11,Q19] ## Model and assumptions The four conceptual variables are an ordered write log, a universally replicated prefix readIndex, a durable majority-replicated prefix commitIndex, and a failover epoch. Their relationship is readIndex≤commitIndex≤Len(log). Replication nondeterministically increases either prefix; data loss truncates only the non-durable suffix and increases epoch. The log abstracts replica/region arrangements rather than enumerating them. The retrieved source additionally carries the configured write level as an unchanged state variable; the paper calls it a constant. [Q3,Q4,Q5,S1] One write consistency level is configured for a deployment; individual reads may select an allowed weaker level. The model concerns individual single-key operations. Transactions and optimistic concurrency are outside its scope. Bounded staleness models operation counts, omitting the wall-clock bound. VersionBound limits unreplicated entries for all write levels; StalenessBound separately limits non-durable entries when bounded-staleness writes are configured. These abstractions should not be mistaken for a proof covering arbitrary implementation arrangements merely because the model does not explicitly contain servers. [Q3,Q5,Q14] A write begins by appending its key/value and obtaining an epoch/checkpoint token. It can later succeed or fail. Failure need not delete the value: the request can have taken effect even if its response was lost. Weak reads can see the value while the write remains pending. Successful strong writes require durability. An epoch change invalidates all old session tokens in this model; authors acknowledge that real data loss need not invalidate every token. [Q6,Q7,Q9,Q18] GeneralRead(key,index,allowDirty) returns the latest mapping at or before index, or a not-found marker if absent. If dirty reads are allowed, it also permits later matching entries. Strong reads use commitIndex without dirty values; bounded-staleness reads use commitIndex with dirty values; session reads use max(token.checkpoint,readIndex) with dirty values and require a current-epoch or null token. The client updates its token with the maximum prior/read checkpoint. Prefix/eventual reads both use readIndex with dirty values. This last equivalence concerns single reads/writes, not transactions. [Q8,Q9,Q10,Q14] ## Validation and its limits Authors report10liveness and14safety properties across4distinct levels, excluding basic typing, using exhaustive logs up to length6 and depth-first random traces up to100steps. Examples include durable committed prefixes, read-your-writes, monotonic reads, staleness bounds, token lifetime and eventual write completion. The paper gives no complete per-property run logs, state counts, runtimes or mapping of every property to each exploration bound. These are bounded model checks and sampled traces, not a parameterized proof or implementation test. [Q11] The pinned artifact gives useful additional scope. MCCosmosDBProps uses two keys, three values, StalenessBound2,VersionBound3,Len(log)<3 and epoch<3. Its configuration labels several temporal checks “very very slow (1hr+)” and three “overloads TLC (out of memory), probably holds”. SimCosmosDBProps has a finite natural-number replacement0..100 and omits some costly properties. These comments are evidence about the retrieved snapshot, not proof that the paper’s historical runs failed; neither do they substantiate completion of every stated check. The history specification assumes weak fairness of the disjunction WriteSuccess∨WriteFail; the simulation specification omits that fairness clause. Thus completion claims depend on the specification and bounds actually used. I did not establish an unbounded per-write progress theorem. [S2,S3,S4] CosmosDBLinearizability maps strong read results to an atomic dictionary view. A commitIndex jump can correspond to multiple dictionary writes in one abstract step. The saved configuration asks for DictSpec under epoch<3 and Len(log)<4. This supports the paper’s model-level refinement argument; I did not independently establish a full invocation/response-history linearizability theorem. The old-model refinement goes from the older model to this newer behavioral specification, so old behaviors are included in the new model. The claimed strictness additionally rests on the newer model admitting data loss and dirty reads omitted before. The retrieved mapping fixes two regions/two clients per region/one write region and constrains history length<5. I inspected the mapping, not its old-model dependency closure. [Q12,S5,S6] The read hierarchy is checked while holding write consistency fixed and considering all session-token choices. Comparing differently configured write levels does not give the same inclusion: strong writes can admit more pending non-durable values than bounded-staleness writes. The four retrieved adjacent read-refinement modules use fixed write configuration and small finite state constraints; no unbounded theorem proof is attached to their THEOREM declarations. [Q13,S7] ## Concrete cases and industrial results The first documentation issue is a claim that prefix reads cannot observe A,C or B,A,C after sequential writes A,B,C. A,C is possible simply by interleaving reads around writes. For B,A, use five replicas: A reaches1,2,3;B reaches1,4,5;one read hits5 and another2 before replication catches up. Each write reached a local majority, yet the client seesBthenA. These are allowed service behaviors, not newly demonstrated implementation failures. Authors report the documentation was rewritten. [Q14] The second issue concerns regional guarantees. Bounded-staleness operations in one region may appear strongly consistent until a region failover loses or exposes older data; they lack global durability. Authors report their argument was confirmed for individual operations, while regional documentation bullet points remained because transactions distinguish prefix and eventual behavior. The paper’s section title about regions must be read with that explicit restriction. [Q14] The outage affected thousands of subscriptions over28days and was noticed after26days. FrontDoor wrote task data, then asked Worker to read it. Session consistency was configured, but the processes used separate/unconfigured session tokens. Their cross-process interaction therefore had only eventual-read guarantees. A routing change exposed the existing semantic problem through latency. A PlusCal model reproduces a missing read before replication; forwarding FrontDoor’s token to Worker removes the modeled error according to the authors. The original postmortem author confirmed the explanation made sense. This is an abstract causal explanation and proposed/rechecked model fix, not evidence that the fix was deployed or that every production trace was matched. [Q15,Q16,Q17] Other cases show why the model has two-step writes: a weaker read can observe an incomplete strong write; a failed write can remain durable; and a bounded-staleness read under strong-write configuration lacks the separate bounded-staleness write throttle. Although the paper says strong consistency has no bound on in-progress requests, the model still has VersionBound on partially replicated entries; completed replication permits more pending requests. These are distinct quantities. Expert review caught an earlier incorrect atomic-write abstraction, which was rewritten and rechecked in2–3days. [Q18,Q19] ## Printed text versus pinned source The displayed WriteCanSucceed on paperp4 checks token validity and, for strong writes, token.epoch=epoch. It omits the checkpoint≤commitIndex condition that the immediately following prose says is required. The pinned CosmosDB.tla includes that durability conjunct. Thus the displayed formula and prose disagree; this does not establish that the checked source permits non-durable successful strong writes. [Q7,S1] The outage text’s expected formula is eventually workerValue=“workerValue”, but Listing1writes“taskValue“. The source’s temporal property uses eventually workerValue=“taskValue” and its terminal-state property checks the same literal. I treat the printed literal as a presentation mismatch and preserve the intended missing-task-value scenario rather than presenting the printed formula as a valid test of that scenario. [Q16,S8] These comparisons use a retrieved, pinned repository snapshot, not an asserted reconstruction of the exact2022experiment checkout. No author code or proof/checker was run. [S9] ## Contribution and reading scope For this database, the contribution is a reusable specification of a distributed dependency’s visible behavior and a concrete demonstration that model correctness also depends on choosing faithful abstractions. Its relevance to LLM-written specifications is my inference: evaluation should test behavior the model must permit as well as properties it must forbid, record expert corrections, and distinguish bounded self-consistency from service conformance. The paper has no Verus, Rust or LLM experiment. [Q19,Q20] Read all11pages,28reference entries, every displayed definition, Listing1,all4figures and TableI; inspected all11page renders across the preceding and current context. Read the complete core/property/read-wrapper/client/linearizability modules, both PlusCal outage modules, both model-check/simulation wrappers and configurations, four read-level refinement modules and their common-pattern constraints, the general-model mapping/configuration, and two repository READMEs.26static files acquired with hashes and Git blob identities. No old general-model dependency closure or broader implementation inspected. Official and inventory PDFs are byte-identical. No author execution/import, solver, compiler, checker or serialized scientific-results loading.
  • number: 2 person-month development
  • number: 10 liveness and 14 safety properties across 4 consistency levels
  • limits: single-keyindividualoperations;countnotwallclock;alltokensinvalidatedonepoch;boundedchecks;expertconformanceonly
  • how much was read: most of it read
  • source; notes: P24. Understanding Inconsistency in Azure Cosmos DB with TLA+
  • record id: cosmos-db-tla-2022
• Holistic Verification of Blockchain Consensus (2022)
  • what: Parameterized model checking verifies binary Byzantine consensus associated with Red Belly Blockchain under n>3t and0≤f≤t. First verifies binary-value broadcast, then substitutes a smaller specification-based automaton into the outer consensus and checks safety and progress properties with ByMC. Agreement and validity do not require the added good-round fairness; termination does. The verified algorithm is the coordinator/timeout-free pseudocode variant under that fairness, rather than a proof of the deployed implementation or its partial-synchrony mechanism. Makes the decomposition concrete: global sent-message counters replace local receive counts; Byzantine effects lower enabling thresholds by f; four temporal broadcast properties support a replacement gadget; round communication closure reduces selected all-round LTL obligations to one-round checking. Manual meta-arguments connect per-superround invariants to global agreement/validity and good-round existence to eventual decision. Gives a fair-round definition, a nonterminating4-process trace, detailed automaton rules, explicit liveness preconditions and measured schema counts.
  • limits: Fixed n sequential processes communicate through reliable fully connected asynchronous point-to-point links; delays are finite but unbounded, steps interleave, each receive is atomic and sender identities distinguish quorum members. Up to t<n/3 are Byzantine; f≤t is the actual fault count. The threshold abstraction assumes faulty senders cannot impersonate arbitrarily many distinct processes. Communication closure is essential: each process uses only messages for its current round, discards earlier tags and buffers later tags. Monotone send counters and threshold guards admit the prior ByMC reduction. Guarantees do not automatically extend to arbitrary protocols with cross-round data dependencies, timing constraints or changing membership. Reliable communication is encoded by progress assumptions on enabled rules and source-location emptiness. This excludes scheduler executions that indefinitely withhold enabled productive actions. Added consensus fairness is different: some round r has every correct process first deliver r mod2 in that round’s binary-value broadcast. Neither fairness follows from asynchronous reliability alone. Algorithm1 is the DBFT variant without coordinator/timeouts. The second DBFT variant uses partial synchrony, but this paper replaces that mechanism with a good-round assumption. It does not prove a synchronizer, coordinator rotation, timeout correctness or that the deployed environment enforces the assumption. Threshold models describe correct processes and abstract Byzantine influence with f-offset guards; global send counters abstract possible local receipt histories. Parameterized checking ranges over symbolic parameters satisfying n>3t≥3f, rather than testing a list of network sizes. Soundness still depends on faithful manual abstraction and ByMC’s reductions/SMT checks. Inner broadcast verification establishes justification,obligation,uniformity and termination. Replacement must preserve all behaviors relevant to the outer consumer because contestants is shared and the outer algorithm can proceed before the broadcast finishes. The paper argues this and supplies encoded preconditions; it is not a machine-checked source-to-source refinement of production code. ByMC handles a restricted LTL fragment and one-round systems. Cross-superround agreement,initial validity and existential good-round termination require manually chosen intermediate formulas and mathematical composition arguments. The model checker does not directly discharge each final quantified formula as written. The proof covers binary agreement,validity and eventual decision for the displayed algorithm. It does not prove blockchain transaction semantics,multi-value reduction,ledger consistency across all block heights,network/cryptographic code,resource bounds or end-to-end behavior of the deployed Red Belly software. Processes continue participating after deciding so others can finish; only the first decision matters. Text states safe exit after two later rounds but does not supply a verified executable stopping implementation. A process that halts immediately on first decision would change progress assumptions.
  • how much was read: most of it read
  • source
  • record id: holistic-verification-of-blockchain-2022
• On the Correctness of Speculative Consensus (2022)
  • what: # Whole-paper read: On the Correctness of Speculative Consensus (authored by agents unless marked 🧑) Jelle Hellings, Suyash Gupta, Sajjad Rahnama and Mohammad Sadoghi; arXiv2204.03552v1,7April2022,25pages. This is a detailed paper proof for Proof-of-Execution (PoE), a Byzantine state-machine replication protocol that speculatively executes before committing. Its main contribution is the connection between early client replies, preservation across view changes, eventual consensus and recovery of client results. The proof is mathematical prose and pseudocode, not a machine-checked development. [Q0–Q3,Q5–Q10] ## System and required conditions There are fixed replicas R, Byzantine replicas F, and clients C. The paper writes n=|R|,f=|F|,nf=n−f and assumes n>3f, authenticated communication and deterministic transaction execution. Byzantine replicas can coordinate and clients may all be malicious. Most exposition assumes publicly verifiable digital signatures; digest variants need cryptographic hash assumptions, and threshold variants need threshold signatures. This paper defines f from the fault set; it does not separately explain how deployments configure an upper bound used for quorum thresholds. [Q1,Q11–Q14] Weak consensus means decisions never conflict, while termination and forcing new decisions require periods of reliable communication with some unknown bounded delay. The advertised asynchronous recovery therefore does not give unconditional progress during arbitrary loss or delay. Assumption4.6 bounds proposal size and the number W of prepared but uncommitted rounds. This makes a single finite message-delay estimate applicable to protocol messages. Timeout estimates must eventually grow sufficiently large. The displayed backoff argument also requires a positive initial estimate; multiplying zero cannot make it positive. [Q1,Q6,Q8] ## Normal execution and recovery The primary in view v has id=v mod n. A signed client request is proposed in a round. Each honest replica prepares only one proposal for that round/view and broadcasts Prepare. A certificate collects nf matching preparations. Replicas execute speculatively after all preceding transactions have executed and send Inform to the client. The client needs nf identical, view-specific Inform replies as a proof of execution. The familiar f+1 reply threshold for committed execution is insufficient here because speculative executions can be rolled back. Theorem4.1 establishes same-view uniqueness and normal-case service with a good primary, reliable communication and identical execution history. [Q2,Q3] The printed Theorem4.1 contradiction proof defines T_i=S_i minus Byzantine replicas, but then treats S_i as if all its members were honest and as if those full sender sets were disjoint. Byzantine senders can vote for both proposals. The usual intersection argument applies to T_i, the honest subsets, instead. This is a notation defect in that displayed proof, not a demonstrated counterexample to same-view uniqueness. [Q3] The four-replica failure examples distinguish omission by a faulty primary, a false accusation by a faulty backup, and network loss. Other replicas can observe the same messages in all three cases. A malicious primary can leave some honest replicas without a proposal while the client still receives a proof of execution using Byzantine replies. Recovery therefore must preserve what a client could already have observed, rather than treating an isolated replica’s missing proposal as evidence that no execution occurred. [Q4] Check-commit is decentralized. An honest replica broadcasts its prepared certificate only after execution, while still in the view, and after all previous rounds have committed. Receiving a valid certificate lets a missing replica prepare and execute. A commit certificate collects nf CheckCommit messages. Theorem4.4 relates a client proof to eventual preparation at every honest replica, relates one honest commit to eventual commits/client proof given the shared prefix, and derives that a commit certificate entails nf−f honest executions plus commitments for earlier rounds. The first two statements assume reliable communication and all honest replicas in the view. Out-of-order proposals are supported; the proved base still commits in order. [Q5] View changes use three stages. A replica that detects failure rebroadcasts Failure. Receiving f+1 alerts induces an honest replica to join; nf alerts make it stop the old protocols and send ViewState to the next primary. State includes the latest commit certificate and every subsequently executed prepared certificate not rolled back. The next primary collects nf states and broadcasts NewView. Under reliable communication with delay δ, Lemma4.5 synchronizes entry into the proposal stage within2δ; Lemma4.7 delivers a good primary’s new-view proposal within4δ of the first such entry. [Q6] The new ledger retains the committed prefix through LC, then the latest-view prepared request in each round through LP. Missing committed history is queried; speculative requests outside the selected ledger are rolled back; the new primary must repropose selected uncommitted requests before new rounds. Theorem4.10 inducts over views to preserve any request executed by nf−f honest replicas, including every request with a possible client proof or commit certificate. Assumption4.8, uniqueness of the request named by commit certificates for a round, is a temporary proof hypothesis subsequently discharged by Corollary4.11. It is not an additional final assumption. [Q6,Q7] Lemma4.12 supplies QueryCC/RespondCC recovery of missing committed history. Lemma4.13 and Theorem4.15 use increasing timeout estimates and eventual good primaries to establish resumption once communication is reliable. The worked δ=30ms example starts estimates7,3,5,1ms; three doublings yield56,24,40,8ms, and the four replicas need3,4,3,5 doublings respectively. Remark4.17 suggests a practical cap such as10seconds, but the theorem’s unbounded-growth argument only carries to a cap when that cap exceeds actual reliable-network delay. [Q8] Theorem4.18 combines preservation, recovery and client-request forwarding to prove weak consensus. Honest clients repeatedly send an unanswered request to all replicas; replicas forward it or trigger view changes if it is not served. Suggested defenses against malicious clients include per-client forwarding limits and treating another request by the same client as evidence of a timely proposal. These are stated heuristics, not a quantified load-admission/fairness analysis. Recoverable non-Byzantine crashes require certificates in persistent storage; Remark4.19’s recovery claim depends on enough replicas recovering. [Q9] Consensus alone does not guarantee a client obtains nf identical replies from one view. Example4.20 partitions honest replicas into A,B,C of sizes f,f,1 and alternates unreachable groups across three views. The same request becomes decided, but view-specific replies and commit certificates remain split, so no ordinary proof of execution forms. The repair is InformCC: after an honest replica commits, it can send the view-independent round/result to a retrying client. Now f+1 matching InformCC replies suffice because at least one is honest and committed execution is preserved. Theorem4.21 proves service when communication is reliable. Client request order is not automatically enforced; waiting for the first result or validating per-client counters supplies an extra application policy. [Q10] ## Complexity, variants and evaluation Figure1 compares seven protocols/variants; Figure12 gives13 message/certificate rows and three size variants. These are analytical accounting, not measured experiments. Base PoE takes two replica communication rounds before execution and three through check-commit; Linear-PoE takes three and five. The table’s C parameter is request size, so expressions containing nC account for payload, not just the number of messages. Off-by-one terms are intentionally omitted in Figure1. Base prepared certificates have size O(nf+C); commit certificates O(nf²+C), because different replicas may attach different prepared certificates. ViewState and NewView additionally depend on W. [Q1,Q11] Digests make most messages independent of request size but require explicit retrieval of missing request bodies and certificates. Replacing a certificate-carrying CheckCommit with a constant-size message requires f+1 matching senders before querying an honest holder. It does not eliminate the bounded-request-size assumption. Threshold signatures reduce certificates to constant size; by themselves they do not reduce all-to-all message counts. [Q12,Q13] Linear-PoE sends preparations through the primary. Its decentralized commit replacement rotates aggregator q=round mod n, commits a digest of the last n prepared certificates, and uses a separate n:(f+1) threshold scheme for recovery certificates before n:nf commit certificates. This prevents a fixed faulty aggregator from permanently hiding committed history. The pseudocode waits for commitments through round−n and covers the preceding n−1 rounds with the resulting certificate. Failure detection still broadcasts quadratically. The authors’ belief that such communication cannot be eliminated in their recovery setting is not an impossibility proof. The linear variant is explained by construction; it does not receive a separate full formal refinement proof here. [Q14] The MAC-only variant is a proposed redesign of the two new-view stages by analogy with PBFT; the paper does not print that redesign. Out-of-order processing means proposing future rounds within W while earlier decisions finish. It does not remove the sequential execution dependence or the proved base’s in-order commits. [Q15,Q16] The n=31,C=10KiB,M=256B bandwidth example reports322KiB for the base primary and315KiB with linear aggregation, approximately2percent savings. Direct substitution gives322.5KiB and315.7258KiB, about2.10percent. The primary still transmits the full proposal to every replica. The accompanying “roughly-1/3-th increase in latency” is inconsistent with the stated increase from two to three communication rounds: relative to two, that is50percent. This is a reader arithmetic observation, not an execution measurement. [Q14] Example5.6 assumes n=31,δ=15ms and1Gbit/s and prints22 sequential versus3028 out-of-order decisions/second. The22 figure follows1/(3δ)=22.22. The3028 figure is inconsistent with the printed bit/byte units: using10kB and256B gives about386.95 decisions/second; using10KiB gives378.51. The value3028.1 is obtained with10KiB if1Gbit/s is treated as10⁹bytes/s. Either consistent byte interpretation still gives a bandwidth-only upper estimate, excluding computation and other bottlenecks. The paper’s two-orders-of-magnitude statement is therefore not supported by its stated inputs. [Q16] Section6 compares PBFT, Zyzzyva, SBFT, HotStuff and MinBFT using communication rounds and simplified costs. It qualifies Zyzzyva/SBFT fast paths, assumes PBFT-like checkpoint costs for SBFT, and identifies trusted hardware/reliable communication for MinBFT. The HotStuff discussion and33 decisions/second example are this paper’s account of a particular chained scheduling model, not an independently validated universal bound on HotStuff deployments. Its prediction that PoE outperforms PBFT “in all situations” exceeds what round counts alone establish: computation, rollback/recovery workload, implementations and resource bottlenecks are not measured here. [Q17–Q22] The introduction/conclusion claim an “analytical and experimental” evaluation. This saved25-page version contains analytical comparisons and hypothetical numeric examples, with no experimental setup, implementation measurements, repeated trials or measured plots. Its earlier EDBT2021 paper is reference18; results from that separate paper are not imported into this record. No proof assistant, model checker, Verus, verified Rust, TLA+ or LLM-agent experiment is reported. [Q0,Q17–Q24] ## Relevance and reading evidence For distributed verification, this contributes detailed proof obligations for speculative client observations, view-change preservation, the distinction between agreement and delivered service, and communication/recovery tradeoffs. My inference for proof-agent evaluation is to check eventual-reliability and bounded-window conditions, quorum intersections, temporary proof hypotheses, persistent crash state and units in analytical evaluation separately. A successful local proof script would not by itself establish any of those model-to-implementation connections. Read the complete25pages,40references,all15numbered figures including pseudocode and both tabular figures,all printed proofs/formulas/examples,and all25page renders. Official and inventory PDFs are byte-identical. No implementation or artifact source was linked as part of this paper’s proof/evaluation and none was inspected here. This record does not audit the related ResilientDB implementation or preceding EDBT paper. No author execution/import, compiler/checker/prover/solver run or serialized scientific-result loading.
  • limits: n>3f/authentication/deterministicexecution/boundedproposal_window/eventualreliablecommunication/positivegrowingtimeouts/persistentcertificates/paperproofnotmechanized/noempiricalmeasurements/printedunitdiscrepancies
  • how much was read: most of it read
  • source
  • record id: on-the-correctness-of-2022
• Optimal-DPOR-Await (2022)
  • title: Awaiting for Godot: Stateless Model Checking that Avoids Executions where Nothing Happens
  • what: Introduces Partial Loop Purity Elimination (PLP), an assume-to-await transformation, and an await-aware Optimal-DPOR algorithm to eliminate executions whose loop iterations have no externally relevant effect. PLP statically detects pure loop iterations and inserts assumptions; suitable assumptions become awaits, while a weakened conflict relation lets Optimal-DPOR-AWAIT remain optimal. Theorems establish preservation of local-state reachability and assertion violations and one representative per equivalence class for terminating programs. Evaluation covers locks, queues, sorting networks, and SafeStack.
  • number: On sortnet(6), PLP+Await explores 1 complete execution in 0.08 s versus Nidhugg baseline 1+312 executions in 0.48 s
  • number: SafeStack-331 bug found in 8 minutes after 2+2,453,474 traces; fixed version exhaustively checked in 24 minutes after 5,772+8,521,721 traces
  • number: GenMC and baseline Nidhugg failed to find SafeStack-331 after more than 2,000 hours
  • limits: Correctness and optimality are stated for terminating programs; SMC requires loop bounds. PLP is static and can miss zero-net-effect loops or be limited by syntactic purity conditions. Experiments use C/C++ pthread programs on one Ryzen 5950X system, with one-hour benchmark and ten-hour SafeStack timeouts; fairness/livelock handling is limited.
  • how much was read: most of it read
  • record id: optimal-dpor-await-2022
• PTA reachability and liveness (2022)
  • title: Reachability and Liveness in Parametric Timed Automata
  • what: Maps decidability boundaries for parametric timed automata, introducing bounded integer-points PTAs and reset-PTAs for decidable reachability while proving many liveness and deadlock problems undecidable. The paper separates EF/AF reachability emptiness, cycle existence, deadlock existence, and EG persistence across bounded/open/closed L/U-PTAs and integer-point subclasses. It uses counter-machine reductions for undecidability and derives PSPACE-completeness for bounded closed L/U-PTA EF and cycle problems, identifying thin boundaries where closedness or boundedness changes decidability.
  • number: existence of an infinite run in an L/U-PTA is PSPACE-complete
  • number: deadlock-existence is undecidable for closed bounded L/U-PTAs
  • number: cycle-existence is PSPACE-complete for closed bounded L/U-PTAs and undecidable for general bounded PTAs
  • number: EF-emptiness is decidable/PSPACE-complete for bounded IP-PTAs
  • limits: Results are complexity-theoretic and depend on parameter domains, strict/non-strict guards, boundedness, and open versus closed parameter valuations. The undecidability constructions show that unrestricted PTAs cannot generally support algorithmic synthesis or liveness checking; no empirical implementation benchmark is claimed.
  • how much was read: most of it read
  • record id: pta-reachability-and-liveness-2022
• RFCNLP (2022)
  • title: Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents
  • what: Extracts partial protocol state machines from RFCs with BERT/CRF. Translates them to Promela. Uses KORG/SPIN to synthesize attacks on safety and progress properties, checked against a canonical model.
  • number: six protocols extracted
  • number: TCP: 17 of 20 transitions correct or partly correct
  • number: automated TCP models find attacks on 1 property, canonical model on all 4
  • number: Six protocols extracted; TCP: 17 of 20 transitions correct or partly correct
  • limits: The attacks work against models, not deployed code. Experts write the canonical models and four LTL properties each. A progress property can pass vacuously (hold trivially, because the condition that should trigger it never occurs).
  • how much was read: most of it read
  • source; notes: RFCNLP: learned extraction followed by model-level attack synthesis; notes: RFCNLP: learned extraction followed by model-level attack synthesis
  • record id: rfcnlp-2022
• SMR synchronizers and PBFT-light liveness (2022)
  • title: Liveness and Latency of Byzantine State-Machine Replication
  • what: Specifies an SMR synchronizer with application-controlled advance calls, supplies an O(n)-view-variable implementation tolerant of pre-GST message loss, and uses its interface to prove PBFT-light atomic-broadcast liveness and derive recovery/good-case latency bounds. The proceedings also describes extensions to periodic PBFT leader rotation and a HotStuff-like variant. Figure 1 separates Monotonicity, Validity, Bounded Entry, Startup and Progress. Figure 3 retains only each sender’s highest WISH and uses the (2f+1)st and (f+1)st order statistics plus periodic retransmission; it enters a view only when these agree. Bounded Entry holds eventually with d=2δ, provided no correct process requests a higher view during the entry interval. PBFT-light uses delivery and recovery timers, increasing both only on expiration. Lemma 6 shows that a correct process with recovery timeout >6δ and delivery timeout >4δ cannot initiate the first advance in a sufficiently late good view. Theorem 7 uses this to rule out executions where only a subset of correct processes increase timeouts indefinitely, then proves every valid broadcast by a correct process reaches all correct processes. Reliable DECISION retransmission also ensures dissemination of any already delivered value. Good-case delivery takes 4δ from a correct broadcaster, corresponding to 3δ from the leader. The analysis distinguishes unknown per-execution δ from a known conservative Δ used only for the latency bounds.
  • number: n=3f+1; quorums 2f+1; f+1 correct advance requests suffice for startup/progress
  • number: O(n) stored view variables; eventual entry skew d=2δ
  • number: good-view timer thresholds: dur_recovery>6δ; dur_delivery>4δ
  • number: Theorem 8 deadline: GST+ρ+max{ρ+δ,6Δ}+4Δ+max{ρ,δ}+7δ under its stated assumptions
  • limits: n=3f+1, at most f Byzantine processes, authenticated point-to-point communication, signatures and collision-resistant hashing. Partial synchrony: unknown GST and δ; before GST messages may be lost/delayed and clocks drift unboundedly; after GST correct-process delays are ≤δ and clocks track real time. Correct clients invoke advance at most once between new_view notifications. Correct broadcasts are valid and unique. PBFT-light uses signatures and omits checkpoints/watermarks; reliable DECISION broadcast requires retransmission omitted from pseudocode. Latency results additionally assume known Δ>δ, timeout caps 6Δ/4Δ, retransmission period ρ and reliable-broadcast latency ≤δ+ρ. Theorem 8 assumes sufficiently large timeouts already at GST and a correct leader(V); Theorem 9 assumes synchronous startup, correct leader(1), timeout bounds and the view-1 optimization. Full synchronizer proof, PBFT safety proof, portions of timer proof, latency proofs, periodic-leader and HotStuff protocol details, and textbook-bug details are explicitly deferred to arXiv:2202.06679, which was not read in this batch. Theoretical proof, not a machine-checked artifact or implementation performance experiment.
  • how much was read: most of it read
  • source
  • record id: smr-synchronizers-and-pbft-light-liveness-2022
• TLA+ verification trifecta (2022)
  • title: Specification and Verification With the TLA+ Trifecta: TLC, Apalache, and TLAPS
  • what: Uses a TLA+ specification of asynchronous termination detection and Safra’s ring algorithm to demonstrate complementary verification with TLC explicit-state checking, Apalache bounded/SMT and inductive-invariant checking, and TLAPS theorem proving, including refinement from the algorithm to a high-level state machine. The high-level module specifies active nodes, pending messages, termination detection, safety, liveness under weak fairness, and quiescence. Safra’s algorithm adds white/black colors, message counters and a circulating token; termination requires an inactive node 0, no pending messages, white token/node, and zero accumulated counter. TLC finds 4,097 states for N=4,K=3 in the abstract model and 1.3 million (N=3,K=C=3,Q=9) or 219 million (N=4 with same bounds) in the algorithm model, exposing state explosion and a token-color bug. Apalache checks bounded prefixes, proves an inductive invariant for N=100 in 20 seconds, and checks quiescence for N=100 in 11 seconds. Refinement is checked for small N; TLAPS proves type, safety, liveness, and refinement for arbitrary instances, with an invariant proof taking about 230 lines and liveness/refinement about 245 lines. The conclusion recommends TLC first, Apalache for inductive invariants, TLC/random exploration for liveness, then TLAPS for higher confidence.
  • number: 4097 states for high-level TLC N=4,K=3
  • number: 262145 states for high-level N=6,K=3
  • number: 1.3 million states for Safra N=3,K=C=3,Q=9
  • number: 219 million states and about 50 min for Safra N=4
  • limits: The abstract model assumes a nonzero finite N, natural pending-message counters, asynchronous actions and weak fairness only for DetectTermination; stronger fairness is optional but unnecessary for the stated liveness. TLC requires finite bounds on pending messages/counters for exhaustive checking, so finite checks cannot establish arbitrary executions. Apalache handles bounded prefixes and inductive invariants but needs type annotations and human-discovered invariants; it cannot directly handle the fairness temporal property. TLAPS proof effort is manual and backend-dependent. The Safra case is a ring algorithm and does not evaluate throughput, deployment behavior, or other distributed topologies.
  • how much was read: most of it read
  • record id: tla-verification-trifecta-2022
• Brief Announcement: On Strong Observational Refinement and Forward Simulation (2021)
  • what: Shows by example that ordinary forward simulation need not preserve hyperliveness or strong observational refinement when finite and infinite traces are allowed. Defines progressive forward simulation with a well-founded decrease on concrete steps mapped to an empty abstract sequence; states that it implies strong observational refinement. Full theorem proof is external. The counterexample composes a forward-simulated LL/SC implementation with fetch-and-add. A particular LL/SC implementation permits SC failure merely because another thread executed LL, without any intervening write. Alternating threads can therefore prevent both operations from returning. The formal scheduler requirement is nonempty enabled actions after every consistent finite trace, plus object determinism; it does not impose per-thread fairness. Definition 1 forbids infinite internal stuttering through a well-founded concrete-state order. Necessity of the progress condition is future work.
  • limits: Finite and infinite traces; programs composed with labelled transition-system objects; deterministic admissible schedulers. Specific implemented LL/SC semantics permit the counterexample; it does not assert every hardware LL/SC behaves this way. Full proof of Theorem 2 deferred to external reference [3]; no machine-checked artifact or empirical measurements in supplied brief. The motivating text says LL at F2 although pseudocode labels LL at F1; record interprets the operation rather than reproducing that line typo.
  • how much was read: most of it read
  • source
  • record id: brief-announcement-on-strong-2021
• Dijkstra Monads Forever: Termination-Sensitive Specifications for Interaction Trees (2021)
  • what: This is a spec framework in Coq for programs written as interaction trees. It can express termination, divergence, and full infinite output traces.
  • number: no runtime, proof size or person-hours reported
  • number: Proved cases: square-root loop, Boolean query loop, stateful input/output loop printing multiples
  • number: No runtime, proof size, person-hours or benchmark success rate reported
  • limits: It gives reference semantics only, not production code. It generates the verification condition automatically, but humans supply the invariants and termination measures.
  • how much was read: most of it read
  • source; notes: Dijkstra Monads Forever: Termination-Sensitive Specifications for Inte; notes: Dijkstra Monads Forever: Termination-Sensitive Specifications for Inte; notes: Concrete problem records
  • record id: dijkstra-monads-forever-termination-2021
• Failure-aware actor Synod progress (2021)
  • title: Verification of Eventual Consensus in Synod Using a Failure-Aware Actor Model
  • what: Introduces a predicate-fair failure-aware actor model (FAM) and mechanically verifies sufficient asynchronous conditions for eventual progress of the basic Synod protocol without a unique leader. The report formalizes proposers, acceptors, quorum predicates, message transitions and actor availability/failure in an asynchronous actor semantics. It states fairness axioms for send/receive, nonfaulty-agent assumptions, and P1/P2 proposal-number conditions preventing higher-numbered interruption. Lemmas show eventual promises and votes from a nonfaulty quorum; Theorem 1 derives that some proposal is eventually learned as chosen. Athena and SPASS mechanically check the proof sketches in roughly 6000 lines. The appendices include the actor-language operational rules and code correspondence discussion.
  • number: about 6000 lines of Athena code
  • number: quorum conditions use >2/3 only where specified by application context
  • number: four Synod message types: 1a, 1b, 2a, 2b
  • limits: Safety is inherited from Synod; the result is eventual progress, with no time bound. The sufficient condition CND assumes a nonfaulty proposer eventually ready to send a P1/P2 proposal to a quorum of nonfaulty acceptors. FAM assumes stable storage, uncorrupted but asynchronous messages, and fairness axioms; failures can be temporary or permanent, but progress requires the relevant actors eventually available. The proof does not use generic predicate fairness directly, instead relying on a system-specific uninterrupted-proposal property. Applicability to UAM timing requires additional bounds not proved here.
  • how much was read: most of it read
  • record id: failure-aware-actor-synod-progress-2021
• Ghost Signals: Verifying Termination of Busy Waiting (2021)
  • what: Develops a modular Hoare/separation-logic approach to termination of busy-waiting programs under fair scheduling. Ghost signals represent conditions other threads must establish; linear obligations require setting them. A well-founded partial order forbids waiting on a signal at or above any obligation held by the waiter. Data-structure invariants tie signals to real conditions, allowing resource-local proof of waiting over arbitrary shared structures. §2 derives the logic through thread-safe physical signals, non-thread-safe signals guarded by mutexes, arbitrary heap cells, then erasure into ghost state. An augmented operational semantics makes a thread get stuck if it exits with outstanding obligations; fork transfers obligations rather than discarding them. A program-order graph tracks the path carrying each obligation. A minimal infinitely-waited signal would have an infinite obligation path that can wait only on finitely-waited lower signals, yielding contradiction under fairness. Points-to/signal ownership prevents races. Mutex acquisition creates a release obligation and also obeys the level order. §3 splits signal-ID allocation from initialization so a fixed finite collection of signal IDs can be named early without creating premature obligations. Loop iterations may select from a finite signal set, and outer productive loops use ordinary decreasing counters. §5 explains call/wait permissions and thread phases; permission consumption only in descendant phases prevents a self-fueling busy loop. §6 describes a possible reduction of termination to instrumentation safety for higher-order step-indexed logics.
  • number: bounded FIFO: 37 C lines, 160 proof-annotation lines, reported 435% annotation overhead, 0.08 s verification
  • number: CLH: 49 C lines, 343 annotation lines, 700% overhead, 0.1 s verification
  • number: example: FIFO capacity 10, 100 values, 200 signal IDs; levels pop(i)=102−i and push(i)=101−i, mutex level 0
  • limits: Termination relies on fair thread scheduling and a well-founded signal/mutex-level order; proof authors supply invariants, levels and ghost actions and must discharge every obligation. The proceedings presentation restricts busy loops to with-mutex-await syntax and ultimately to a finite fixed set of signals per loop; the external report generalizes looping/recursion. Physical machine memory models are not analyzed; claims use the presented language semantics. Higher-order assertions are not supported by this logic itself; Iris integration is proposed, not demonstrated as a mechanized embedding here. Abstract specifications for CLH require a suitable level universe supporting bounded infinite level sets. No automated signal/invariant/level inference or LLM experiment is reported. The server I/O-liveness result is a linked combined-logic artifact, not a full server proof included in these pages.
  • how much was read: most of it read
  • record id: ghost-signals-verifying-termination-2021
• Justness (2021)
  • title: Justness: A Completeness Criterion for Capturing Liveness Properties
  • what: Defines justness as a completeness criterion for transition-system paths: once a non-blocking transition enabled by parallel components is not interfered with, some component must eventually act. It formalizes asymmetric concurrency for CCS, broadcast ABC/ABCd, and CCS with signals (CCSS). The paper gives an LTSC framework with blocking actions, concurrency relation, and B-just paths; defines dynamic and static synchron/component relations and proves they induce the same justness. It proves feasibility by constructing extensions of finite paths when countably many enabled non-blocking transitions (or equivalence classes) exist, relates justness to fairness, and proves agreement with coinductive definitions for CCS extensions and abstract paths. It also treats indicators/signals, infinitary choice, and gives inductive/coinductive characterizations.
  • number: Theorem 1 proves B-justness feasible under countably many enabled non-blocking transitions
  • number: Corollary 1 extends feasibility to countably many concurrency-equivalence classes
  • number: Theorem 2 shows dynamic and static justness coincide
  • number: Theorem 3 and Theorem 4 establish agreement with coinductive and abstract-path definitions
  • limits: Transition systems abstract distributed systems and assume atomic actions terminate. Blocking actions are explicitly identified; justness is weaker than fairness and cannot guarantee a task that is repeatedly postponed despite no interference. Feasibility theorem needs countably many enabled transitions/equivalence classes; the paper does not provide implementation or empirical evaluation, and future work is semantic equivalence with Petri/event-structure models.
  • how much was read: most of it read
  • record id: justness-2021
• LI HLS Formal Model Checking (2021)
  • title: Verifying High-Level Latency-Insensitive Designs with Formal Model Checking
  • what: Automated RTL wrapper generation and bounded model-checking checks for invalid input consumption and deadlock in MatchLib latency-insensitive HLS designs. The invalid-input model instantiates reference and test DUTs with equal valid inputs but different invalid data and compares valid outputs. The deadlock model aggregates HLS global-stall signals; for nonblocking ports it synthesizes a stall signal when no relevant ready signal is asserted for a configured number of cycles. Checks operate on HLS-generated RTL because the bugs depend on cycle-accurate timing, while wrapper generation is fully automated.
  • number: Table I runtimes 5.99–359.3 s for abstracted cases; buggy initial versions are falsified and final fixes proven
  • number: five MatchLib components have invalid-input properties proven (0.10k–9.75k gates; 10.98–36,627 s)
  • number: NoCRouterArray.v1 deadlock falsified in 12.71 s; v2 proven to bound 450 in 16,915 s
  • number: OpticalFlow.v2 deadlock falsified in 1,237 s; OpticalFlow.v1 proven to bound 10,000 in 42,090 s
  • limits: Uses MatchLib valid/ready interfaces, HLS-generated RTL and Synopsys VC Formal 2018.10 bounded model checking. Deadlock proofs are exhaustive only for the modeled check or stated user bound; several application results are bounded or time out. The custom nonblocking stall threshold N must be known from HLS optimizations.
  • how much was read: most of it read
  • record id: li-hls-formal-model-checking-2021
• Static Race Detection and Mutex Safety and Liveness for Go Programs (extended version) (2021)
  • what: The paper develops GoL, a process-calculus model for shared memory, locks, read-write locks, and later channels, with behavioural types that encode happens-before synchronization. Type soundness and progress connect processes to µ-calculus types; model checking these types detects data races, lock safety/liveness, and mixed channel/shared-memory errors. The migoinfer+ extractor and Godel2/mCRL2 backend form a static toolchain. Beyond the abstract, the authors define race and lock properties over GoL, prove subject reduction, process safety/data-race transfer, and conditional equivalence of type and process liveness for terminating, may-converging, and finite-branching programs. The channel extension models channel-as-lock and pointer-through-channel errors. Evaluation includes mutex/channel variants, producer-consumer, and five-philosopher programs with explicit false-positive caveats for approximated cyclic analyses.
  • number: 17 benchmark programs were checked on an 8-core Intel i7-7700K with 16 GB RAM
  • number: No-race and simple-race variants correctly separate safety/data-race outcomes in roughly 0.69–0.79 seconds
  • number: dine5 unsafe took 6,996 ms; dine5 deadlock 12,278 ms; dine5 fixed 8,998 ms
  • number: channel Dining Philosophers took approximately 185 minutes for the race version and 645 minutes for the fixed version
  • limits: The liveness correspondence requires restrictions such as termination, may-convergence, or finite branching; the implementation is sound for safety/data-race transfer but can report rare liveness (and possibly safety) false positives/negatives on approximated cyclic models. Extraction supports only a Go subset, has restrictions on embedded mutexes/structs and parameter passing, and does not scale to unbounded goroutine creation. mCRL2 state space grows rapidly with summands and action order.
  • how much was read: most of it read
  • record id: static-race-detection-and-2021
• The CakeML Project’s Quest for Ever Stronger Correctness Theorems (2021)
  • what: Historical account of CakeML’s end-to-end verification strategy: proof-producing translation of logical functions to embedded ML programs, verified compilation to concrete bytes, and application-specific proofs, with extensions through a verified Silver CPU’s Verilog implementation. Describes improvements that strengthen transported correctness, especially impure code reasoning and space bounds needed for liveness. Explains why in-logic execution supplies a concrete compile(input)=machine_code theorem, enabling a final property statement without the compiler function; how applying synthesis and in-logic compilation to the compiler’s own logical definition yields a verified executable; why finite target memory limits the default behavior theorem; how a sound space-cost semantics removes early out-of-memory exits for specific programs; and how shared characteristic-formula infrastructure connects manual verification and monadic code synthesis. Separates completed compiler/hardware layers from 2021 prospective language/compiler projects.
  • limits: This 10-page invited overview summarizes previously published mechanizations; it contains no new complete formal proof, benchmark table, theorem inventory or fresh controlled experiment. Its references identify where to inspect the underlying statements. Counts or broad performance comparisons here are author reports, not independently reproduced results. The transfer argument relies on proved source properties, formal CakeML operational semantics, a correct compiler theorem and a proved concrete compilation result. In-logic compilation removes the compiler from the final statement; it does not eliminate trust in the logic, prover implementation or fidelity of source/machine/hardware models. Source lists, arrays and integers are unbounded; target memory is finite. The default behavior preservation explicitly permits early out-of-memory errors. Source liveness alone therefore does not ensure target liveness. The separate compiler-sound space-cost semantics supports tight bounds for concrete programs and the strengthened transfer. The first compiler’s front end includes parser soundness/completeness with respect to an SML syntax grammar, type-inference soundness (completeness added later), and no runtime errors for typed source programs. That typing theorem does not rule out target out-of-memory exits. The optimizing compiler uses eight intermediate languages and multiple passes per language. Functional big-step, clocked interpreter semantics permit a single simulation proof per phase to handle termination and nontermination; the paper says most, not all, simulation directions are forward. CakeML characteristic formulae are proved sound against CakeML operational semantics, including higher-order recursive functions, mutable state, exceptions and FFI I/O. A later extension handles diverging programs, and a simplified nontermination Hoare logic is proved sound and complete. Do not extend that completeness claim to every CF feature or program-verification automation. The Isabelle/HOL source generator is for the most part verified once for all; the HOL4 generator is for the most part proof-producing. Lem generates source-semantics definitions in both provers from a common specification. The overview does not present a verified cross-prover transport theorem or certify Lem itself. The Silver result composes a verified compiler target, machine-code filesystem and CPU correctness through the formal Verilog implementation. A later verified compiler maps a supported subset of generated Verilog to FPGA technology-mapped netlists. Physical fabrication, FPGA programming and the entire external synthesis toolchain are not established by this overview. Compiler projects using CakeML for a low-level imperative language, a Haskell-inspired language and a choreographic language are described as ongoing in 2021. Project-success explanations are explicitly the author’s beliefs, not empirical causal conclusions. No Rust, Verus, TLA+ or LLM-agent experiment is reported.
  • how much was read: most of it read
  • source
  • record id: the-cakeml-project-s-2021
• What’s Live (2021)
  • title: What’s Live? Understanding Distributed Consensus
  • what: Extracts published liveness statements for consensus algorithms and formalizes them in TLA+. It compares what each one assumes and guarantees: 3 link assumptions, 7 server assumptions and 6 progress assertions. It also runs finite TLC experiments.
  • number: of 31 algorithms in Table 1, only 18 (58%) mention liveness and 11 (35%) give a liveness proof
  • number: TLC on up to 4 proposers and 4 acceptors in a few hours
  • number: 31 algorithms/variants are catalogued; 18 state liveness assertions, and only 11/31 (35%) provide some liveness proof.
  • number: TLA+ TLC illustrations cover up to 4 proposers and 4 acceptors for single-value Paxos; multi-value/larger cases become too expensive.
  • limits: It is an analytical comparison plus finite TLC runs, not new verified code. Appendix A uses a tick bound. Hours and lines of code are not stated.
  • how much was read: most of it read
  • source; notes: What’s Live? Understanding Distributed Consensus
  • record id: what-s-live-2021
• An Axiomatic Approach to Existence and Liveness for Differential Equations (2020)
  • what: # ODE liveness needs enough solution duration and a valid path through its domain (authored by agents unless marked 🧑) Tan and Platzer develop deductive proofs that an ordinary differential equation (ODE) solution lasts long enough to reach a target without leaving its allowed domain. This record reads the complete 61-page arXiv:2004.14561v2 report, dated 9 August 2020, including all appendices. The contribution is a library of small refinement steps in differential dynamic logic (dL), a logic for discrete and continuous programs, plus derived existence/liveness rules and a KeYmaera X implementation. The authors derive corrected forms of several earlier liveness arguments; the earlier publications themselves were not independently checked for this record. [Evidence: Q0, Title, complete abstract and §1 scope, PDF pp.1–1; Q1, §1 complete surveyed corrections, contributions and trust/implementation claims, PDF pp.1–3; complete exact passages in quotes.json.] Source (Q0, Title, complete abstract and §1 scope): > An Axiomatic Approach to Existence and Liveness for Differential > Equations > Yong Kiam Tan André Platzer ∗ > Abstract > This article presents an axiomatic approach for deductive verification of existence and liveness for ordinary differ- > ential equations (ODEs) with differential dynamic logic (dL). The approach yields proofs that the solution of a given > ODE exists long enough to reach a given target region without leaving a given evolution domain. Numerous subtleties > complicate the generalization of discrete liveness verification techniques, such as loop variants, to the continuous set- > ting. For example, ODE solutions may blow up in finite time or their progress towards the goal may converge to zero. > These subtleties are handled in dL by successively refining ODE liveness properties using ODE invariance properties > which have a complete axiomatization. This approach is widely applicable: several liveness arguments from the > literature are surveyed and derived as special instances of axiomatic refinement in dL. These derivations also correct > several soundness errors in the surveyed literature, which further highlights the subtlety of ODE liveness reasoning > and the utility of an axiomatic approach. An important special case of this approach deduces (global) existence prop- > erties of ODEs, which are a fundamental part of every ODE liveness argument. Thus, all generalizations of existence > properties and their proofs immediately lead to corresponding generalizations of ODE liveness arguments. Overall, > the resulting library of common refinement steps enables both the sound development and justification of new ODE > existence and of liveness proof rules from dL axioms. These insights are put into practice through an implementation > of ODE liveness proofs in the KeYmaera X theorem prover for hybrid systems. > Keywords: differential equations, liveness, global existence, differential dynamic logic > 1 Introduction > Hybrid systems are mathematical models describing discrete and continuous dynamics, and interactions thereof. This > flexibility makes them natural models of cyber-physical systems (CPSs) which feature interactions between discrete > computational control and continuous real world physics [Alu15, Pla18]. Formal verification of hybrid systems is > of significant practical interest because the CPSs they model frequently operate in safety-critical settings. Verifying > properties of the differential equations describing the continuous dynamics present in hybrid system models is a key > aspect of any such endeavor. > This article focuses on deductive verification of existence and liveness1 > properties for ordinary differential equa- > tions (ODEs), i.e., the question whether an ODE solution exists for long enough to reach a given region without > leaving its domain of evolution. Such questions can be phrased naturally in differential dynamic logic (dL) [Pla10, > Pla12b, Pla17a, Pla18], a logic for deductive verification of hybrid systems whose relatively complete axiomatization > [Pla12a, Pla17a] lifts ODE verification results to hybrid systems, and whose theorem prover, KeYmaera X [FMQ+ > 15], > enables an implementation. > For discrete systems, methods for proving liveness are well-known: loop variants show that discrete loops eventu- > ally reach a desired goal [Har79], while temporal logic is used to specify and study liveness properties in concurrent > and infinitary settings [MP92, OL82]. However, the deduction of (continuous) ODE liveness properties is hampered > ∗Computer Science Department, Carnegie Mellon University, Pittsburgh, USA {yongkiat|aplatzer}@cs.cmu.edu > 1The form of ODE liveness considered in this article is in the sense of Owicki and Lamport [OL82] for concurrent programs within their (linear) > temporal logic. Liveness for ODEs has sometimes been called eventuality [PR07, SJ15] and reachability [TT10]. To minimize ambiguity, this > article refers to the property as liveness, with a precise formal definition in Section 2. Other advanced notions of liveness for ODEs are discussed > in Section 8. > arXiv:2004.14561v2 > [cs.LO] > 9 > Aug The standing model uses autonomous polynomial vector fields over mathematical real states, with rational polynomial syntax and first-order real-arithmetic target/domain formulas. A fresh clock can represent time dependence. Polynomial fields have unique local solutions, but those solutions need not last forever. A diamond formula means that some finite solution segment reaches the target and satisfies the domain throughout, including its initial and final states; duration zero is allowed when the domain and target already hold. This is finite reachability along a unique continuous evolution. Applying it to distributed fairness, message delivery or infinitely recurring progress would require an additional model. The paper’s completeness background concerns ODE invariants; it does not establish completeness for all ODE liveness. [Evidence: Q2, §2.1–2.2 syntax, standing ODE model and modal semantics, PDF pp.3–5; Q3, §2.3 Lie derivatives, base proof rules and constant-context restrictions, PDF pp.5–6; complete exact passages in quotes.json.] Source (Q2, §2.1–2.2 syntax, standing ODE model and modal semantics): > 2 Background: Differential Dynamic Logic > This section reviews the syntax and semantics of dL, focusing on its continuous fragment which has a complete > axiomatization for ODE invariants [PT20]. Full presentations of dL, including its discrete fragment, are available > elsewhere [Pla12b, Pla17a, Pla18]. > 2.1 Syntax > The grammar of dL terms is as follows, where x ∈ V is a variable and c ∈ Q is a rational constant. These terms are > polynomials over the set of variables V: > p, q ::= x | c | p + q | p · q > Notably, dL also supports term language extensions [PT20] that would enable, e.g., the use of exponentials and > trigonometric functions. These extensions are compatible with the results presented in this article, but are omitted for > simplicity as they are not the main focus of this article. > The grammar of dL formulas is as follows, where ∼ ∈ {=, 6=, ≥, >, ≤, <} is a comparison operator and α is a > hybrid program: > φ, ψ ::= > First-order formulas of real arithmetic P,Q > z }| { > p ∼ q | φ ∧ ψ | φ ∨ ψ | ¬φ | ∀v φ | ∃v φ | [α]φ | hαiφ > The notation p < q (resp. 4) is used when the comparison operator can be either ≥ or > (resp. ≤ or <). Other > standard logical connectives, e.g., →, ↔, are definable as in classical logic. Formulas not containing the modalities > [·], h·i are formulas of first-order real arithmetic and are written as P, Q. The box ([α]φ) and diamond (hαiφ) modality > formulas express dynamic properties of the hybrid program α. This article focuses on continuous programs, where α > is given by a system of ODEs x0 > = f(x) & Q. Here, x0 > = f(x) is an n-dimensional system of differential equations, > x0 > 1 = f1(x), . . . , x0 > n = fn(x), over variables x = (x1, . . . , xn), where the LHS x0 > i is the time derivative of xi and the > RHS fi(x) is a polynomial over variables x. The ODEs x0 > = f(x) are autonomous as they do not depend explicitly on > time on the RHS [Kha92]. A useful transformation is to add a clock variable t to the system with x0 > = f(x, t), t0 > = 1 > 4 Y. K. Tan and A. Platzer > -1 0 1 u > -1 > 0 > 1 > v > -1 0 1 u > -1 > 0 > 1 > v > Figure 1: Visualization of αl (left) and αn (right). Solutions of αl globally spiral towards the origin. In contrast, > solutions of αn spiral inwards within the inner red disk (dashed boundary), but spiral outwards otherwise. For both > ODEs, solutions starting on the black unit circle eventually enter their respective shaded green goal regions. The ODE > αn also exhibits finite-time blow up of solutions outside the red disk. > t=0 > t=0.3 > t=0.4 > t=0.5 > t=0.55 > t=0.56 t=0.57 > 0 2 4 6 8 u > 0 > 2 > 4 > v > 0 0.2 0.4 0.6 t > 1 > 10 > 100 > 1000 > u2 > +v2 > Figure 2: Two views of the ODE αn evolving from initial state u = 1, v = 0 over time t. The left plot shows its > trajectory in the u, v plane (cf. Fig. 1) while the right plot shows the squared Euclidean norm u2 > + v2 > evolving over > time t (with logarithmic scaling for the vertical axis). The solution blows up in finite time with norm approaching ∞ > as t approaches 0.58 (rounded up, black dashed asymptote). Nevertheless, the solution reaches the green goal region > u2 > + v2 > ≥ 2 from Fig. 1 at t ≈ 0.31 (rounded up, green dot) before blowing up. > if time dependency on the RHS is needed. The domain constraint Q specifies the set of states in which the ODE is > allowed to evolve continuously. When there is no domain constraint, i.e., Q is the formula true, the ODE is also > written as x0 > = f(x). For n-dimensional vectors x, y, the dot product is x · y > def > = > Pn > i=1 xiyi and kxk2 def > = > Pn > i=1 x2 > i > denotes the squared Euclidean norm. Other norms are explicitly defined in this article when used. > The following two running example ODEs αl and αn are visualized in Fig. 1 with directional arrows corresponding > to their RHS evaluated at points on the plane: > αl ≡ u0 > = −v − u, v0 > = u − v (1) > αn ≡ u0 > = −v − u( > 1 > 4 > − u2 > − v2 > ), v0 > = u − v( > 1 > 4 > − u2 > − v2 > ) (2) > The ODE αl is linear because its RHS depends linearly on u and v while αn is nonlinear because of the cubic > terms in its RHS. The nonlinearity of αn results in more complex behavior for its solutions, e.g., the difference in > spiraling behavior inside or outside the red disk shown in Fig. 1. In fact, solutions of αn blow up in finite time iff they > start outside the disk characterized by u2 > + v2 > ≤ 1 > 4 , whereas finite-time blow up is impossible for linear ODEs like > αl [Chi06, Wal98]. An illustration of finite-time blow up for αn from an initial state outside the red disk is shown > in Fig. 2. This phenomenon is precisely defined and investigated in Section 4, which enables formal proofs of the > aforementioned (absence of) finite-time blow up. > When terms (or formulas) appear in contexts involving ODEs x0 > = f(x), it is sometimes necessary to restrict the > set of free variables they are allowed to mention. In this article, these restrictions are always stated explicitly and are > also indicated as arguments to terms (or formulas), e.g., p() means the term p does not mention any of x1, . . . , xn as > free variables, while P(x) means the formula P may mention all of them. This understanding of variable dependencies > An Axiomatic Approach to Existence and Liveness for Differential Equations 5 > is made precise using function and predicate symbols in dL’s uniform substitution calculus [Pla17a]. > 2.2 Semantics > States ω : V → R assign real values to each variable in V; the set of all states is written S. The semantics of polynomial > term p in state ω ∈ S is the real value ω[[p]] of the corresponding polynomial function evaluated at ω. The semantics of > dL formula φ is defined compositionally [Pla17a, Pla18] as the set of states [[φ]] ⊆ S in which that formula is true. The > semantics of first-order logical connectives are defined as usual, e.g., [[φ ∧ ψ]] = [[φ]] ∩ [[ψ]]. For ODEs, the semantics > of the modal operators is defined directly as follows. Let ω ∈ S and ϕ : [0, T) → S (for some 0 < T ≤ ∞), be the > unique solution maximally extended to the right [Chi06, Wal98] for the ODE x0 > = f(x) with initial value ϕ(0) = ω, > then: > ω ∈ [[[x0 > = f(x) & Q]φ]] iff for all 0 ≤ τ < T where ϕ(ζ) ∈ [[Q]] for all 0 ≤ ζ ≤ τ: ϕ(τ) ∈ [[φ]] > ω ∈ [[hx0 > = f(x) & Qiφ]] iff there exists 0 ≤ τ < T such that ϕ(ζ) ∈ [[Q]] for all 0 ≤ ζ ≤ τ and ϕ(τ) ∈ [[φ]] > Informally, the safety property [x0 > = f(x) & Q]φ is true in initial state ω if all states reached by following the > ODE from ω while remaining in the domain constraint Q satisfy postcondition φ. Dually, the liveness property > hx0 > = f(x) & Qiφ is true in initial state ω if some state which satisfies the postcondition φ is eventually reached in > finite time by following the ODE from ω while staying in domain constraint Q at all times. Figure 1 suggests that > formulas2 > hαli 1 > 4 ≤ k(u, v)k∞ ≤ 1 > 2 >
    > and hαniu2 > + v2 > ≥ 2 are true for initial states ω on the unit circle. These The central proof method refines a simple diamond property into the desired one, justifying each change with a box property that holds along relevant solutions. Ghost variables are fresh auxiliary ODE coordinates used only for proof. The new bounded differential ghost axiom permits nonlinear vector ghosts when their squared norm is bounded along augmented solutions; a derivative-growth version supplies another sufficient condition. These bounds prevent added coordinates from ending the solution prematurely. Appendix A proves the semantic duration comparison and derives the refinement axioms; Appendix B supplies syntactic rule derivations. Existing base-calculus results cited by the paper are distinguished from its new ghost and refinement arguments. [Evidence: Q4, §2.3 Lemma2 bounded differential ghosts and explanation, PDF pp.7–7; Q5, §3 complete refinement examples and Lemma3 axioms, PDF pp.7–9; Q29, AppendixA.1 complete bounded-ghost soundness proof, PDF pp.34–35; complete exact passages in quotes.json.] Source (Q4, §2.3 Lemma2 bounded differential ghosts and explanation): > An Axiomatic Approach to Existence and Liveness for Differential Equations 7 > versions of the axiom (where a(x) is a matrix and b(x) is a vector) have also been used elsewhere [PT20]. This article > uses a new vectorial generalization that allows differential ghosts with provably bounded ODEs to be added. > Lemma 2 (Bounded differential ghosts). The following bounded differential ghosts axiom BDG is sound, where > y = (y1, . . . , ym) is a m-dimensional vector of fresh variables (not appearing in x), g(x, y) is a corresponding m- > dimensional vector of terms, and kyk2 > is the squared Euclidean norm of y. Term p(x) and formulas P(x), Q(x) are > dependent only on free variables x (and not y). > BDG > [x0 > = f(x), y0 > = g(x, y) & Q(x)] kyk2 > ≤ p(x) > → [x0 > = f(x) & Q(x)]P(x) ↔ [x0 > = f(x), y0 > = g(x, y) & Q(x)]P(x) >
    > Proof in Appendix A.1. > Like DG, axiom BDG allows an arbitrary vector of ghost ODEs y0 > = g(x, y) to be added syntactically to the > ODEs. However, it places no syntactic restriction on the RHS of the ODE (such as linearity in axiom DG). For > soundness, BDG instead adds a new precondition with a bound kyk2 > ≤ p(x) in terms of x on the squared norm of y > along solutions of the augmented ODE. This syntactic precondition ensures that y cannot blow up before x, so that > solutions of x0 > = f(x), y0 > = g(x, y) have existence intervals as long as those of the solutions of x0 > = f(x). Section 4 > shows how to prove these preconditions so that axiom BDG enables ODE existence proofs through the refinement > approach of Section 3. Domain refinement has additional obligations. The direct rule requires a suitable domain invariant, rather than assuming the target’s negation wherever convenient. COR requires an initially false target and matching open/open or closed/closed topology for target and new domain. SAR uses a different until-condition involving the negation of target-and-domain together; its general argument relies on the tame local behavior of semialgebraic sets and polynomial ODEs. Appendix A separately covers closed targets or open domains. Parameters are held constant when testing the topology of sets over ODE variables. These conditions control what happens when a solution reaches a shared boundary. [Evidence: Q6, §3 unsound domain weakening, Lemma4 and topology conditions, PDF pp.9–10; Q30, AppendixA.2 complete topological refinement soundness proof, PDF pp.37–39; Q31, AppendixA.3 complete topological tests and constant-parameter interpretation, PDF pp.39–40; complete exact passages in quotes.json.] Source (Q6, §3 unsound domain weakening, Lemma4 and topology conditions): > DRh·i [x0 > = f(x) & R ∧ ¬P]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > This conjectured axiom is unsound (indicated by ) as the solution could sneak out of Q exactly when it crosses > from ¬P into P. In continuous settings, the language of topology makes precise what this means. The following > topological refinement axioms soundly restrict what happens at the crossover point: > Lemma 4 (Topological ODE refinement axioms). The following topological h·i ODE refinement axioms are sound. > In axiom COR, P, Q either both characterize topologically open or both characterize topologically closed sets over > variables x. > COR ¬P ∧ [x0 > = f(x) & R ∧ ¬P]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > SAR [x0 > = f(x) & R ∧ ¬(P ∧ Q)]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > Proof in Appendix A.2. > Axiom COR is the more informative topological refinement axiom. Like the (unsound) axiom candidate DRh·i, > it allows formula ¬P to be assumed in the domain constraint when proving the box refinement. For soundness > though, axiom COR has crucial topological side conditions on formulas P, Q so it can only be used when these > conditions are met. Several variations of COR are possible (with similar soundness proofs), but they require alternative > topological restrictions and additional topological notions. One useful variation involving the topological interior is > given in Lemma 26. When these topological restrictions are enforced syntactically, axiom COR is derived from dL’s > real induction axiom [PT20]. For the sake of generality, this article gives semantic topological side conditions with > associated semantic soundness proofs in Appendix A.2. > Axiom SAR applies more generally than COR but only assumes the less informative formula ¬(P ∧ Q) in the > domain constraint for the box modality. Its proof crucially relies on Q being a formula of real arithmetic so that > the set it characterizes has tame topological behavior [BCR98], see the proof in Appendix A.2 for more details. By > 3In dL’s uniform substitution calculus [Pla17a], this Lie derivative is written directly as the differential term (kyk2)0 which can be soundly and > syntactically rewritten using dL’s differential axioms [Pla17a]. > 10 Y. K. Tan and A. Platzer > topological considerations, axiom SAR is also sound if formula P (or resp. Q) characterizes a topologically closed > (resp. open) set over the ODE variables x. These additional cases are also proved in Appendix A.2 without relying on > the fact that Q is a formula of real arithmetic. Global existence is expressed by adding a clock and proving that every arbitrary finite clock threshold can be exceeded. The dependency-order rule builds the ODE in groups whose right-hand sides use only earlier groups and themselves. Each group needs either a squared-norm bound depending on earlier groups/time or a suitable linear bound on its squared-norm derivative. Derived cases include globally Lipschitz fields and affine dependency groups. Example 2, u′=u and v′=uv, has provably global solutions despite lacking a global Lipschitz constant for the whole vector field. The bounded-existence rule says a solution either reaches any requested time horizon or leaves a bounded region; invariance of that region then proves global existence. The combined rule allows affine groups alongside bounded nonlinear groups. [Evidence: Q7, §4–4.1 finite-time blow-up example, clock existence and Lemma5, PDF pp.10–10; Q9, §4.1 dependency-order groups and complete Corollary6, PDF pp.11–12; Q10, §4.2.1 global Lipschitz and affine dependency-order existence, PDF pp.12–13; Q11, §4.2.1 complete Example2 and dependency-order derivation, PDF pp.13–14; Q12, §4.2.2 complete bounded existence and combined Corollary10, PDF pp.14–15; complete exact passages in quotes.json.] Source (Q7, §4–4.1 finite-time blow-up example, clock existence and Lemma5): > 4 Finite-Time Blow Up and Global Existence > This section explains how global existence properties can be proved for a given ODE x0 > = f(x), subject to assumptions > Γ about the initial states for the ODE. The existence and uniqueness theorems for ODEs [Chi06, Wal98] guarantee that > polynomial ODEs like x0 > = f(x) always have a unique, right-maximal solution from any initial state, ϕ : [0, T) → S > for some 0 < T ≤ ∞. However, these theorems give no guarantees about the precise duration T. In particular, ODEs > can exhibit a technical phenomenon known as finite-time blow up of solutions [Chi06], where ϕ is only defined on a > bounded time interval [0, T) with T < ∞. Additionally, it is possible that such finite-time blow up phenomena only > happens for some initial conditions (and corresponding solutions) of the ODE. Moreover, these initial conditions (with > finite-time blow up) may not be relevant to the model of concern, especially when the dynamics of real world systems > are controlled to stay away from the blow up. For example, αn (2) exhibits finite blow up of solutions only outside the > red disk as shown in Fig. 1 and the blow up occurs well after its solutions have reached the target region, see Fig. 2. > As an additional example for this section, consider the following nonlinear ODE: > αb ≡ v0 > = −v2 > (7) > The solution to this ODE is v(t) = v0 > v0+t , where v0 6= 0 is the initial value of v at time t = 0 (if v0 = 0, then > v(t) = 0 for all t). If v0 < 0 initially, then this solution is only defined to the right for the finite time interval [0, −v0), > because the denominator v0 + t is 0 at t = −v0. On the other hand, for v0 ≥ 0, the existence interval to the right is > [0, ∞). Thus, αb exhibits finite-time blow up of solutions, but only for v0 < 0. > 4.1 Global Existence Proofs > The discussion above uses the mathematical solution v(t) of the ODE αb (7) as a function of time. For deductive > proofs, the (global) existence of solutions can be expressed in dL as a special form of an ODE liveness property. The > first step is to add a fresh variable t with t0 > = 1 that tracks the progress of time4 > , see Section 2.1. Then, using a fresh > variable τ not in x, t, the following formula syntactically expresses that the ODE has a global solution because its > solutions can reach time τ, for any arbitrary τ: > ∀τ hx0 > = f(x), t0 > = 1i t > τ (8) > Proving formula (8) shows global existence of solutions for the ODE x0 > = f(x). The simplest instance of (8) is > for the ODE t0 > = 1 by itself without any ODE x0 > = f(x). In this case, the formula (8) is valid because t0 > = 1 is an > ODE with constant RHS and its solution exists for all time. The axiom TEx below expresses this fact and it is derived > directly from the solution axiom of dL [Pla17a]: > Lemma 5 (Time existence). The following axiom is derivable in dL. > TEx ∀τ ht0 > = 1it > τ > Proof in Appendix A.2. > Other instances of (8) can be proved using axioms BDGh·i,DDGh·i with appropriate assumptions about the initial > conditions for the additional ODEs x0 > = f(x). This is exemplified for the ODE αb next. > Example 1 (Velocity of particle with air resistance). The ODE αb can be viewed as a model of the velocity of a particle > that is slowing down due to air resistance. Of course, it does not make physical sense for the velocity of such a particle > to “blow up”. However, the solution of αb only exists globally if the particle starts with positive initial velocity v > 0, > 4For consistency, the ODE x0 = f(x) is assumed to not mention t even if this is not always strictly necessary. Proposition 11 gives conditional completeness for global existence when a global solution is representable in the term language; a representable provable norm bound can also suffice. The report explicitly notes that its polynomial syntax excludes even the exponential solutions of Example 2, though extensions allow more functions. This result does not say that every global polynomial ODE has an automatically discoverable certificate, or that arbitrary liveness is decidable. The related-work discussion notes undecidability of global existence even for polynomial ODEs. [Evidence: Q13, §4.3 complete conditional completeness, Proposition11 and representability limits, PDF pp.15–16; Q28, §8–9 complete related work and conclusion, PDF pp.31–33; complete exact passages in quotes.json.] Source (Q13, §4.3 complete conditional completeness, Proposition11 and representability limits): > 4.3 Completeness for Global Existence > The derivation of the existence axioms GEx,BEx,GBEx and rule DEx illustrate the use of liveness refinement for prov- > ing existence properties. Moreover, BDGh·i is the sole ODE diamond refinement axiom underlying these derivations > (recall DDGh·i is derived from BDGh·i). This yields a natural question: are there ODEs whose solutions exist glob- > ally, but whose global existence cannot be proved syntactically using BDGh·i? The next completeness result gives a > conditional completeness answer: all global existence properties can be proved using BDGh·i, if the corresponding > ODE solutions are syntactically representable. > Proposition 11 (Global existence completeness). If the ODE x0 > = f(x) has a global solution representable in the dL > term language, then the global existence formula (8) is derivable for x0 > = f(x) from axiom BDGh·i. > Proof Sketch (Proof in Appendix B.1). Suppose that ODE x0 > = f(x) has a global solution syntactically represented > in dL as term X(t) dependent only on the free variable t, the (symbolic) initial values x0 of variables x, and the > (constant) parameters for the ODE. The equality x = X(t) is provable along the ODE x0 > = f(x), t0 > = 1 because > solutions are equational invariants [Pla17a, PT20]. The proof uses BDGh·i with the bounding term p = kX(t)k2 > , so > that the required hypothesis of BDGh·i, i.e., [x0 > = f(x), t0 > = 1]kxk2 > ≤ kX(t)k2 > proves trivially using the equality > x = X(t). > The following remark illustrates the usage and limitations of Proposition 11. > Remark 1 (Syntactically representable solutions). Consider the example ODE u0 > = u, v0 > = uv proved to have global > solutions in Example 2. Mathematically, its solution is given by the following functions (defined for all t ∈ R), where > u0, v0 are the initial values of u, v at time t = 0 and exp is the real exponential function. > u(t) = u0 exp(t), v(t) = > v0 > exp(u0) > exp(u0 exp(t)) (15) > Since the solution (15) is defined globally, Proposition 11 seemingly provides an alternative way to prove global > existence for the ODE. The caveat is that Proposition 11 only applies when the solution is syntactically representable > in the term language. The term language of this article (Section 2.1) only accepts polynomial solutions. However, dL’s > 16 Y. K. Tan and A. Platzer > term language extensions [PT20] considerably extends the class of syntactically representable solutions to include7 > , > e.g., towers of exponentials, like those found in (15). Thus, the usefulness of Proposition 11 is limited by which > solutions are syntactically representable. > Notably though, the proof in Proposition 11 actually only requires a provable upper bound X(t) with kxk2 > ≤ > kX(t)k2 > , rather than an equality. Such an upper bound, if syntactically representable in dL, also suffices for proving > global existence. The complicated closed form solution (15) also highlights the advantage of axioms BDGh·i,DDGh·i > and their use in the derived axioms of Corollaries 7–10 because they implicitly deduce global existence without needing > an explicitly representable solution for the ODEs. For an unconstrained target, an atomic differential variant is a quantity whose derivative is bounded below by one fixed positive constant until the goal. Strict positivity alone can decay toward zero and fail to reach the goal. A constant positive rate also fails if another coordinate blows up before enough time passes. Corollary 12 therefore makes sufficient duration explicit or uses provably global solutions. Equational goals use continuity; higher-order variants use a positive higher Lie derivative to obtain polynomial-in-time progress. Staging-set rules keep the trajectory in a region until the goal and force exit: a bounded set bounds continuous terms, while a compact set lets a strictly positive derivative attain a positive minimum. The set-Lyapunov rule requires compact K and open target P, correcting a merely closed-K version reported in the survey. [Evidence: Q14, §5.1 atomic differential variants and duration/progress limitations, PDF pp.16–18; Q15, §5.1 equational and higher differential variants, Corollaries13–14, PDF pp.18–19; Q16, §5.2 complete staging-set rules, Corollaries15–16, PDF pp.19–19; Q18, §5.2 complete set-Lyapunov rule and compactness correction, PDF pp.20–20; complete exact passages in quotes.json.] Source (Q14, §5.1 atomic differential variants and duration/progress limitations): > 5 Liveness Without Domain Constraints > This section presents proof rules for liveness properties of ODEs x0 > = f(x) without domain constraints, i.e., where Q > is the formula true. Errors and omissions in the surveyed techniques are highlighted in blue. > 5.1 Differential Variants > The fundamental technique for verifying liveness of discrete loops are loop variants, i.e., well-founded quantities that > increase (or decrease) across each loop iteration. Differential variants [Pla10] are their continuous analog, where the > value of a given term p is shown to increase along ODE solutions by showing that its rate of change is bounded below > by a positive constant ε() > 0 along those solutions. Recall this article’s syntactic convention (Section 2.1) that term > ε() is not allowed to depend on any of the free variables x1, . . . , xn appearing in the ODE and must therefore remain > constant along the ODE solution. > Corollary 12 (Atomic differential variants [Pla10]). The following proof rules (where < is either ≥ or >) are derivable > in dL. Terms ε(), p0() are constant for ODE x0 > = f(x), t0 > = 1. In rule dV<, the ODE x0 > = f(x) has provable global > solutions. > dVΓ > < > ¬(p < 0) > . > p ≥ ε() > Γ, p = p0(), t = 0, hx0 = f(x), t0 = 1i p0() + ε()t > 0 >
> hx0 = f(x), t0 = 1ip < 0 > dV< > ¬(p < 0) > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x)ip < 0 > Proof Sketch (Proof in Appendix B.2). Rule dVΓ > < is derived from axiom Kh&i with G ≡ p0() + ε()t > 0 >
    > : > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)] p0() + ε()t ≤ 0 >
> Kh&i > Γ, p = p0(), t = 0, hx0 > = f(x), t0 > = 1i p0() + ε()t > 0 >
> hx0 > = f(x), t0 > = 1ip < 0 > Monotonicity M[0 > ] strengthens the postcondition to p ≥ p0() + ε()t with the domain constraint ¬(p < 0). A > subsequent use of dI< completes the derivation: > ¬(p < 0) > . > p ≥ ε() > dI< > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)] p ≥ p0() + ε()t >
    > M[0 > ] > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)] p0() + ε()t ≤ 0 >
> Rule dV< is derived in Appendix B.2 as a corollary of rule dVΓ > < because the ODE x0 > = f(x) is assumed to have > solutions which (provably) exist globally. > In both rules dVΓ > <,dV<, the lower bound ε() > 0 on the Lie derivative > . > p ensures that the value of p strictly > increases along solutions to the ODE. Geometrically, as illustrated in Fig. 3a, the value of p is bounded below over > time t by the line p0() + ε()t with offset p0() and positive slope ε(). Since p0() + ε()t is non-negative for sufficiently > large values of t, the (lower bounded) value of p is also eventually non-negative. > 7Nevertheless, even such a syntactic extension is insufficient because Turing machines can be simulated by solutions of polynomial differential > equations [GCB08, Theorem 2]. It is possible to construct polynomial ODEs whose solutions do not blow up, but grow like the (Turing-computable) > Ackermann function, i.e., faster than any tower of exponentials. > An Axiomatic Approach to Existence and Liveness for Differential Equations 17 > p > p0()+ε ()t > 0 0.1 0.2 0.3 0.4 0.5 0.6 t > p0 > (a) p = 2u + 3v − 4, initial value u = 1, v = 0 > p p0()+ p >  > 0()t +ε() > t2 > 2! > 0 1 2 3 4 5 6 t > p0 > (b) p = −2 + 2u − u2 > − 5u3 > + 5v + uv − 2u3 > v + v2 > − > 5uv2 > − uv3 > , initial value u = −0.52, v = 0 > p > p0()+ε ()t > 0 0.1 0.2 0.3 0.4 0.5 0.6 t > p0 > (c) p = u + v − 3, initial value u = 1, v = 0 > p > 0 2 4 6 8 10 12 t > p0 > (d) p = −10(u2 > + v2 > ) − 1, initial value u = 0.49, v = 0 > Figure 3: The solid blue and red curves show the value of various terms p evaluated along solutions of the ODE αn (2) > from respective initial values p0 over time t. The blue curves in Figs. 3a and 3b are respectively bounded below by a > dashed black line (corresponding to Corollary 12) and a dashed quadratic curve (corresponding to Corollary 14) which > imply that p is eventually non-negative along their respective ODE solutions. The red curve in Fig. 3c is also bounded > below by the dashed black line, but its solution only exists for 0.575 time units (vertical red dashed asymptote) so > the direct bound from Corollary 12 fails, even though p is eventually non-negative along the solution. The red curve > in Fig. 3d has strictly positive time derivative but asymptotically increases towards a negative value (horizontal red > dashed asymptote). > Two key subtleties underlying rules dVΓ > <,dV< are illustrated in Figs. 3c and 3d. The first subtlety, shown in Fig. 3c, > is that ODE solutions must exist for sufficiently long for p or, more precisely its lower bound, to become non-negative. > This is usually left as a soundness-critical side condition in liveness proof rules [Pla10, SJ15], but any such side > condition is antithetical to approaches for minimizing the soundness-critical core in implementations [Pla17a] because > it requires checking the (semantic) condition that solutions exist for sufficient duration. The conclusion of rule dVΓ > < > formalizes this side condition as an assumption. In contrast, rule dV< requires provable global existence for the > ODEs (provable as in Section 4). The rest of this article similarly develops ODE liveness proof rules that rely on the > global existence proofs from Section 4. In all subsequent proof rules, the ODE x0 > = f(x) is said to have provable > global solutions if the global existence formula (8) for x0 > = f(x) is provable. For example, if x0 > = f(x) were > globally Lipschitz (or, as a special case, linear), then its global existence can be proven using axiom GEx from > Corollaries 7 and 8. For uniformity, all proof steps utilizing this assumption are marked with GEx, although proofs of > global existence could use various other techniques described in Section 4. All subsequent proof rules can be soundly > presented with sufficient duration assumptions like dVΓ > <, but those are omitted for brevity. > The second subtlety, shown in Fig. 3d, is that rules dVΓ > <,dV< crucially need a constant positive lower bound on > the Lie derivative > . > p ≥ ε() for soundness [Pla10] instead of merely requiring > . > p > 0. In the latter case, even though the > value of p is strictly increasing along solutions, it is not guaranteed to become non-negative in finite time because the > rate of increase can itself converge to zero. In fact, as Fig. 3d shows, p may stay negative by asymptotically increasing > 18 Y. K. Tan and A. Platzer > towards a negative value as t approaches ∞. The running linear spiral reaches a smaller circle and then an enclosing annular target by continuity. The nonlinear spiral u′=−v−u(1/4−u²−v²), v′=u−v(1/4−u²−v²) can blow up outside its small stable region, yet still reaches squared norm 2 from the unit circle using compact staging in 1≤u²+v²≤2. Thus global existence is one useful sufficient condition, not a necessary property of every successful finite reachability proof. For constrained variants, the initial target-false condition and open/closed domain requirements remain explicit. A closed annulus can permit reaching its outer boundary; excluding that boundary from the domain makes the same target impossible. The combined and compact-eventuality rules join higher derivatives, compact staging and domain refinement. [Evidence: Q17, §5.2 complete Example5, Corollary17 and §6 motivating/domain example including footnote8, PDF pp.19–21; Q19, §6 topology/duration requirements, Corollaries18–20, PDF pp.21–22; Q20, §6 staging with domains, Corollary21 and complete Example7 boundary reasoning, PDF pp.22–23; Q21, §6 combined/compact-eventuality Corollaries22–23, PDF pp.23–24; complete exact passages in quotes.json.] Source (Q17, §5.2 complete Example5, Corollary17 and §6 motivating/domain example including footnote8): > Example 5 (Nonlinear liveness). The liveness property that Fig. 1 suggested for the nonlinear ODE αn (2) is proved > using rule SPc by choosing the staging set formula S ≡ 1 ≤ u2 > +v2 > ≤ 2 and the differential variant p = u2 > +v2 > . The > proof is shown on the left and visualized on the right below; the goal u2 > + v2 > ≥ 2 is shown in green while S is shown > as a blue annulus. The Lie derivative > . > p with respect to αn is 2(u2 > + v2 > )(u2 > + v2 > − 1 > 4 ), which is bounded below by 3 > 2 > in S. Thus, the right premise of SPc closes trivially. The left premise requires proving that S is an invariant within the > domain constraint ¬(u2 > + v2 > ≥ 2). Intuitively, this is true because the blue annulus can only be left by entering the > goal. Its elided invariance proof is easy [PT20]. > ∗ > S [αn & ¬(u2 > + v2 > ≥ 2)]S > cut,R > u2 > + v2 > = 1 [αn & ¬(u2 > + v2 > ≥ 2)]S > ∗ > R > S > . > p > 0 > SPc > u2 > + v2 > = 1 hαniu2 > + v2 > ≥ 2 > -1 0 1 u > -1 > 0 > 1 > v > This proof exploits the flexibility provided by staging sets in two ways. First, the formula S is chosen to char- > acterize a compact set (as required by rule SPc). As explained in Section 4, solutions of αn can blow up in finite > 20 Y. K. Tan and A. Platzer > time which necessitates the use of BEx for proving its liveness properties. Second, S cleverly excludes the red disk > (dashed boundary) characterized by u2 > + v2 > ≤ 1 > 4 . Solutions of αn behave differently in this region, e.g., the Lie > derivative > . > p is non-positive in this disk. The chain of refinements (6) behind this proof can be seen from the derivation > of rules SPb,SPc in Appendix B.2. The chain starts from the initial liveness property BEx with concrete8 > time bound > 2 > 3 . The first Kh&i step shows that the staging set is ultimately exited (hαni¬S), while the latter shows the desired > liveness property: > hαn, t0 > = 1i(t > > 2 > 3 > ∨ ¬S) > Kh&i > −→hαni¬S > Kh&i > −→hαniu2 > + v2 > ≥ 2 > The need to use axiom BEx (or otherwise, assume global existence) is subtle and is often overlooked in the > surveyed liveness arguments. An example of this is an incorrect claim [PR07, Remark 3.6] that a liveness argu- > ment [PR07, Theorem 3.5] works without assuming that the relevant sets are bounded. This article’s axiomatic ap- > proach can be used to find and fix errors involving these subtleties. As another example, the following set Lyapunov > function proof rule adapts ideas from the literature [RS10, Theorem 2.4, Corollary 2.5] for proving liveness when the > postcondition P characterizes an open set. The latter assumption on P enables a convenient choice of staging set in > rule SPc because ¬P characterizes a closed set. > Corollary 17 (Set Lyapunov functions [RS10]). The following proof rule is derivable in dL. Formula K characterizes > a compact set over variables x, while formula P characterizes an open set over those variables. > SLyap > p ≥ 0 K ¬P, K > . > p > 0 > Γ, p < 0 hx0 = f(x)iP > Proof Sketch (Proof in Appendix B.2). Rule SLyap is derived from rule SPc with S ≡ ¬P ∧K, since ¬P characterizes > a closed set, and the intersection of a closed set with a compact set is compact. > Rule SLyap was claimed [RS10, Theorem 2.4, Corollary 2.5] to hold for any closed set K, when, in fact, K > crucially needs to be compact as seems to have been assumed implicitly in the proofs [RS10]. > 6 Liveness With Domain Constraints > This section presents proof rules for liveness properties x0 > = f(x) & Q with domain constraint Q. These properties > are more subtle than liveness without domain constraints, because the limitation to a domain constraint Q may make > it impossible for an ODE solution to reach a desired goal region without leaving Q. > -1 0 1 u > -1 > 0 > 1 > v > Consider the following liveness property for αl (1) (visualized on the right), which > adds domain constraint Q ≡ u2 > + v2 > 6= 9 > 16 restricting solutions from entering the red > dashed circle before reaching the green goal region. > hαl & u2 > + v2 > 6= > 9 > 16 > i > 1 > 4 > ≤ k(u, v)k∞ ≤ > 1 > 2 >
    > (16) > As proved in Example 4, solutions starting from the black circle u2 > + v2 > = 1 reach > the green goal region. However, the continuous solutions must cross the red dashed > circle u2 > + v2 > = 9 > 16 to reach the goal, see discussion of implication (5). This violates > the domain constraint and falsifies (16) for initial states on the black circle. > Axiom DRh·i with R ≡ true provides one way of soundly and directly generalizing the proof rules from Section 5, > as shown in the following example. > Example 6 (Nonlinear liveness with domain). The liveness property u2 > + v2 > = 1 → hαniu2 > + v2 > ≥ 2 was proved > in Example 5 for the nonlinear ODE αn (2). The following derivation proves a stronger liveness property with the > added domain constraint 1 ≤ u2 > + v2 > by extending the proof from Example 5 with a DRh·i refinement step. The > resulting left premise is an invariance property of the ODE whose proof is elided [PT20]; intuitively, solutions starting > 8The value of u2 + v2 grows at rate 3 > 2 > per time unit along solutions and the initial states satisfy u2 + v2 = 1. Thus, a lower bound on time > required to leave the staging set (when u2 + v2 > 2) is (2 − 1) / 3 > 2 > = 2 > 3 > time units. > An Axiomatic Approach to Existence and Liveness for Differential Equations 21 > from u2 > + v2 > = 1 grow outwards, and so they remain in the domain 1 ≤ u2 > + v2 > (see Fig. 1). The resulting right > premise is proved in Example 5. The implementation offers an existential variant rule that lets arithmetic search find the positive derivative lower bound, with a manual-instantiation option to avoid that search. A semialgebraic variant rule handles disjunctions/conjunctions of polynomial inequalities through a progress formula and invariant reasoning, rather than adding a nonsmooth min/max function to the logic. Example 8 proves u′=−u eventually enters [−1,1]. Closed-domain refinement uses an interior-set obligation. Its practical strictification of nonstrict inequalities underapproximates that interior; Appendix B explicitly explains why it need not equal the interior, for example x≤x versus x<x. [Evidence: Q22, §7–7.1 implementation overview, existential and semialgebraic variants, PDF pp.24–26; Q23, §7.1 complete Example8, conjunction/disjunction progress and implementation assumptions, PDF pp.26–27; Q24, §7.1 complete Lemma26, Corollary27 and strictification explanation, PDF pp.27–27; Q34, AppendixB.4 complete Corollary27 proof and interior-underapproximation explanation, PDF pp.55–55; complete exact passages in quotes.json.] Source (Q22, §7–7.1 implementation overview, existential and semialgebraic variants): > 7 ODE Liveness Proofs in Practice > The preceding sections show how axiomatic refinement can be used to fruitfully navigate and understand the zoo of > ODE existence and liveness arguments from various applications (Table 1). The generality of the approach enables > the sound and foundational derivation of those arguments from a parsimonious basis of refinement steps. This section > provides a complementary study of how the refinement approach and its derived ODE existence and liveness proof > rules are best implemented in practice. There are two canonical approaches for such an implementation: > 1. Implement the foundational refinement steps and let users build their own arguments using those steps, e.g., by > following the derivations and proofs from Sections 4–6. > 2. Implement the zoo of proof rules from Sections 4–6 directly and let users pick from from those rules for their > particular ODE liveness applications. > The low-level flexibility of Approach 1 is also its drawback in practice because users need to tediously reconstruct > high-level ODE liveness arguments from basic refinements for each proof. Approach 2 provides users with those > high-level arguments but limits users to proof rules that have been implemented, which squanders the generality of the > refinement approach. Moreover, users would still need to navigate the redundancies and tradeoffs among the zoo of > proof rules to select one that is best-suited for their proof. To account for these drawbacks, this section advocates for > a middle ground between those two extremes: implementations should provide users with the basic refinement steps, > bundled with a set of carefully curated, high-level proof rules (Section 7.1) and associated proof support (Section 7.2) > that help users navigate the common cases in their liveness proofs. > These ideas are put into practice through an implementation of ODE existence and liveness proof rules in KeY- > maera X [FMQ+ > 15]. Proof rules and proof support are implemented as tactics in KeYmaera X [FMBP17], which > are not soundness-critical. Such an arrangement allows for the implementation of useful ODE liveness proof rules > and their associated proof support with KeYmaera X’s sound kernel as a safeguard against implementation errors or > mistakes in their derivations and side conditions. This core design decision underlying KeYmaera X is discussed > elsewhere [FMQ+ > 15, FMBP17, Pla17a]. All of the ODE liveness examples in this article have been formally proved > in KeYmaera X (Section 7.2.3). By leveraging existing infrastructure in KeYmaera X, the implementation can also be > used as part of liveness proofs for hybrid systems. It is used for the liveness proofs of a case study involving a robot > model driving along circular arcs in the plane [BTM+ > 19]. > The basic refinements steps from Section 3 and the proof rules in Sections 4–6 are mostly straightforward to > implement by following their respective proofs. Thus, Sections 7.1 and 7.2 focus on a select number of new proof > rules and proof support that are beneficial in the implementation. For the sake of completeness, syntactic derivations > of all liveness proof rules presented in these sections are given in Appendix B.4. > An Axiomatic Approach to Existence and Liveness for Differential Equations 25 > 7.1 Liveness Proof Rules > Atomic differential variants dV< is a useful primitive proof rule to implement in KeYmaera X because many ODE > liveness proof rules, e.g., dVM > = ,SP, derive from it. From a practical perspective though, rule dV< as presented in Corol- > lary 12 still requires users to provide a choice of the constant ε(), e.g., the proof in Example 4 uses ε() = 1 > 2 . The > following slight rephrasing of dV< enables a more automated implementation. > Corollary 24 (Existential atomic differential variants [Pla10]). The following proof rule (where < is either ≥ or >) > is derivable in dL, where ε is a fresh variable and ODE x0 > = f(x) has provable global solutions. > dV∃ > < > Γ ∃ε > 0 ∀x ¬(p < 0) → > . > p ≥ ε >
> Γ hx0 = f(x)ip < 0 > Proof Sketch (Proof in Appendix B.4). Rule dV∃ > < is derived from dV< as a corollary. > Just like rule dV<, rule dV∃ > < requires a positive lower bound ε > 0 on the derivative of p along solutions. The > difference is that the premise of rule dV∃ > < is rephrased to ask a purely arithmetical question about the existence of a > suitable choice for ε. This can be decided automatically to save user effort in identifying ε, but such automation comes > at added computational cost because the decision procedure must find a suitable instance of ε for the ∃ quantifier > (or decide that none exist) rather than simply check a user-provided instance. Thus, the implementation gives users > control over the desired degree of automation in their proof by giving them the option of either invoking an arithmetic > decision procedure R on the premise of dV∃ > < or manually instantiating the existential quantifier with a specific term for > ε. > Another useful variation of rule dV< is its semialgebraic generalization, i.e., where the goal region is described > by a formula P formed from conjunctions and disjunctions of (in)equalities. Rules dVM > = ,SP provide examples of such > a generalization, but they are indirect generalizations because users must still identify an underlying (atomic) differ- > ential variant p as input when applying either rule. In contrast, the new semialgebraic generalization of dV< below > directly examines the syntactic structure of the goal region described by formula P. Its implementation is enabled > by KeYmaera X’s ODE invariance proving capabilities which are, in turn, based on dL’s complete axiomatization for > ODE invariants [PT20]. > Corollary 25 (Semialgebraic differential variants). Let b be a fresh variable, and term ε() be constant for ODE > x0 > = f(x), t0 > = 1. Let P be a semialgebraic formula in the following normal form [PT20, Eq 5], and GP be its > corresponding ε-progress formula (also in normal form): > P ≡ > M > _ > i=0 >  m(i) > ^ > j=0 > pij ≥ 0 ∧ > n(i) > ^ > j=0 > qij > 0 >  > GP ≡ > M > _ > i=0 >  m(i) > ^ > j=0 > pij − (b + ε()t) ≥ 0 ∧ > n(i) > ^ > j=0 > qij − (b + ε()t) ≥ 0 >  > The following proof rule is derivable in dL, where the ODE x0 > = f(x) has provable global solutions, and > . > (¬P)(∗) > , > . > (GP )(∗) > are semialgebraic progress formulas [PT20, Def. 6.4]10 > with respect to x0 > = f(x), t0 > = 1. > dV > ¬P, > . > (¬P)(∗) > , GP > . > (GP )(∗) > Γ, ε() > 0 hx0 = f(x)iP > dV∃ > Γ ∃ε > 0 ∀b ∀t ∀x ¬P ∧ > . > (¬P)(∗) > ∧ GP → > . > (GP )(∗) >
> Γ, ε() > 0 hx0 = f(x)iP > Proof Sketch (Proof in Appendix B.4). Rule dV∃ > is derived from dV similar to the derivation of rule dV∃ > < from dV<. > The derivation of dV is similar to rules dVΓ > <,dV<, but replaces the use of rule dI< with the complete ODE invariance > proof rule [PT20, Theorem 6.8]. The fresh variable b is used as a lower bound of the value of all polynomials pij, qij > appearing in the description of P along solutions of the ODE. > 10The arithmetic formula > . > P(∗) exactly characterizes that the ODE x0 = f(x) makes local progress in P for some nonzero duration, see prior > work [PT20, Def 6.4, Thm. 6.6]. The semialgebraic progress formula operator commutes with logical negation for semialgebraic formulas P, i.e., > the equivalence > . > (¬P)(∗) ↔ ¬( > . > P(∗)) is provable [PT20, Cor 6.7]. Hence, local progress into ¬P is equivalent to the solution locally staying away > from P for nonzero duration. > 26 Y. K. Tan and A. Platzer > The intuition behind rule dV is similar to rule dV<: as long as the solution has not yet reached the goal P, it grows > towards P at “rate” ε(). The technical challenge is how to formally phrase the “rate” of growth for a semialgebraic > formula P, which does not have a well-defined notion of derivative. Rule dV uses the ε-progress formula GP , together > with the semialgebraic progress formulas > . > (¬P)(∗) > , > . > (GP )(∗) > and dL’s completeness result for ODE invariants [PT20, > Theorem 6.8] for this purpose. These formulas give sufficient, although implicit, arithmetical conditions for proving > liveness for P. Rule dV∃ > rephrases dV with an arithmetical premise, similar to how dV∃ > < rephrases dV<, to give users > the added flexibility of choosing between invoking an automated decision procedure or manually instantiating the > existential quantifier for ε and reasoning about the resulting progress formulas. More explicit arithmetical premises > for dV,dV∃ > can be obtained by unfolding the definitions [PT20, Def. 6.4] of > . > (¬P)(∗) > , > . > (GP )(∗) > as exemplified below. Proof support obtains dependency groups by topologically sorting strongly connected components of the ODE variable-dependency graph. Affine groups can be handled automatically; nonlinear groups can need user-provided bounds, with an additional arithmetic method for an isolated univariate nonlinear group. Compatible invariant assumptions can strengthen box premises only when the antecedent ODE/domain permits at least the relevant trajectories. This is a controlled use of context: arbitrary initial-state assertions cannot be retained as if they were invariants. [Evidence: Q25, §7.2.1–7.2.2 dependency sorting, nonlinear user bounds and compatible invariant assumptions, PDF pp.27–30; Q3, §2.3 Lie derivatives, base proof rules and constant-context restrictions, PDF pp.5–6; complete exact passages in quotes.json.] Source (Q25, §7.2.1–7.2.2 dependency sorting, nonlinear user bounds and compatible invariant assumptions): > 7.2 Proof Support > Beyond enabling the sound implementation of complex ODE liveness proof rules such as those in Section 7.1, tactics > can also provide substantial proof support for users. > 28 Y. K. Tan and A. Platzer > x1 x4 > x5 > y4 > x2 > x6 > y3 > x3 > y2 > x7 > x8 > y1 > Figure 4: A dependency graph for the ODE (22) over the variables x1, . . . , x8. There is a directed edge xi −→ xj if > the RHS for x0 > j depends on free variable xi. Each dashed rectangle is a strongly connected component. Topologically > sorting these components (according to the order induced by the edges) yields one possible grouping of the variables > y1, . . . , y4 in dependency order. The vertices in y1 are not connected to those in y2, y3, y4, so the order between these > groups can be chosen arbitrarily. > 7.2.1 Automatic Dependency Ordering > Recall derived axiom GBEx from Corollary 10, which proves (global) existence of solutions for an ODE x0 > = f(x). > Users of the axiom must still identify precisely which dependency order (9) to use, and provide the sequence of > bounded sets Bi for each group of variables yi involving nonlinear ODEs. The canonical choice of such a dependency > order can be automatically produced by a tactic using a topological sort of the strongly connected components (SCCs)11 > of the dependency graph of the ODE. > More precisely, to prove global existence for an ODE x0 > = f(x), consider the dependency graph G where each > variable xi is a vertex and with a directed edge xi −→ xj if the RHS fj(x) for x0 > j depends on free variable xi. First, > compute the SCCs of G, and then topologically sort the SCCs. The groups of variables yi in dependency order can be > chosen according to the vertices in each SCC in topological order. An illustrative dependency graph with four SCCs > for the following 8-dimensional ODE is shown in Fig. 4. > x0 > 1 = x5, x0 > 2 = x3 + x2 > 6, x0 > 3 = x2 > 3, x0 > 4 = x1 + x2 > 3 + x2 > 6, x0 > 5 = x4, x0 > 6 = x2 > 2, x0 > 7 = x8, x0 > 8 = −x7 (22) > After finding the appropriate SCC-induced dependency order (as in Fig. 4), the global existence tactic can prove > global existence for the variable clusters yi that have affine dependencies within the cluster automatically. For example, > the SCC y4 ≡ {x1, x4, x5} has affine dependencies because the RHS of the ODEs x0 > 1, x0 > 4, x0 > 5 are affine in x1, x4, x5, > so the solution of ODE (22) is automatically proved to be global in those variables following the proof of Corollary 8. > The generated dependency order enables such a proof even though the RHS of x0 > 4 depends nonlinearly on variables > x3, x6 from earlier clusters. On the other hand, the SCC y3 ≡ {x2, x6} has nonlinear dependencies on x2, x6, so users > are prompted to input a bounded set (or a bound on derivatives) over variables x2, x6 in order to prove global existence > for those variables. This continues similarly for the SCCs y2 (nonlinear dependency) and y1 (affine dependency) until > global existence is proved for the full ODE. This semi-automated proof support minimizes the manual effort required > of the user in proving global existence by focusing their attention on the automatically identified nonlinear parts of the > ODE that may cause finite-time blowup of solutions. > To drive global existence proof automation further, key special cases can be added to the method described above. > One such special case for univariate ODEs is shown below. > Remark 2 (Global existence for univariate ODEs). Consider the case where a variable group has just one variable and > no incoming dependencies, e.g., y2 ≡ {x3} in Fig. 4 or αb (7). Global existence for such univariate polynomials ODEs > is decidable [GBC08], even if the RHS is highly nonlinear, because all of its solutions either asymptotically approach > a root of the polynomial RHS or diverge to infinity. > This result is best illustrated through the dynamical systems view of ODEs shown in Fig. 5 for the ODE x0 > = > x4 > − 5x2 > + 4. This example ODE has global solutions from all initial states satisfying x ≤ r4 because the solution > from all such states are globally attracted to one of the fixed points. Conversely, for all other initial conditions (x > r4), > the ODE blows up in finite time because the RHS is quartic in x. > 11A strongly connected component of a directed graph is a maximal subset of vertices that are pairwise connected by paths. > An Axiomatic Approach to Existence and Liveness for Differential Equations 29 > x > f(x) > r1 r2 r3 r4 > Figure 5: The univariate ODE x0 > = x4 > − 5x2 > + 4 is can be illustrated by plotting its RHS f(x) = x4 > − 5x2 > + 4 > (vertical axis) against x (horizontal axis). Points on the horizontal axis evolve towards the right (red arrow) when > f(x) ≥ 0 and towards the left (blue arrow) when f(x) ≤ 0. The fixed points r1, r2, r3, r4 are roots of the polynomial > RHS where f(x) = 0. These fixed points either attract trajectories (like r1, r3), or repel them (like r2, r4). All points > on the horizontal axis evolve asymptotically towards exactly one fixed point or approach ∞. > More generally, for a nonlinear univariate polynomial ODE x0 > = f(x) and initial assumptions Γ, it suffices to > check validity of the following arithmetical sequent to decide global existence: > Γ ∃r f(r) = 0 ∧ (f(x) ≥ 0 ∧ r ≥ x > | {z } > a > ∨ f(x) ≤ 0 ∧ r ≤ x > | {z } > b > ) >
> The existentially quantified variable r corresponds to a fixed point (a root with f(r) = 0). Disjunct a checks > whether the solution approaches r from the left, e.g., the points between r2 and r3 in Fig. 5 approach r3 from the > left. Alternatively, disjunct b checks whether the solution approaches r from the right. The implementation checks > validity of this sequent for univariate nonlinear ODEs and then proves global existence using BDGh·i because the > solution is provably trapped between the initial value of x and the fixed point r. > 7.2.2 Differential Cuts for Liveness Proofs > Differential cuts dC provide a convenient way to structure and stage safety proofs for ODEs in dL. An in-depth > discussion is available elsewhere [Pla18], but the idea is illustrated by the following derivation: > Γ [x0 > = f(x) & Q]C1 > . . . > Q ∧ C1 ∧ C2 ∧ · · · ∧ Cn P > dW > . > . > . > dC > Γ [x0 > = f(x) & Q ∧ C1 ∧ C2]P > dC > Γ [x0 > = f(x) & Q ∧ C1]P > dC > Γ [x0 > = f(x) & Q]P > The derivation uses a sequence of differential cut steps to progressively add the cuts C1, C2, . . . , Cn to the domain > constraint. A final dW step completes the proof when the postcondition P is already implied by the (now strengthened) > domain constraint. Intuitively, the differential cuts are akin to dynamical lemmas in this derivation. For example, by > proving the premise Γ [x0 > = f(x) & Q]C1, the cut C1 can now be assumed in the domain constraints of subsequent > steps. Just like the cut rule from sequent calculus, differential cuts dC allow safety proofs for ODEs to be staged > through a sequence of lemmas about those ODEs. > For proof modularity and maintainability, it is desirable to enable a similar staging for ODE liveness proofs. > Concretely, suppose that the formula [x0 > = f(x) & Q]C has been proved as a cut: > Γ [x0 > = f(x) & Q]C · · · > cut > Γ hx0 > = f(x) & QiP > The challenge is how to (soundly) use this lemma in subsequent derivation steps (shown as · · · ). Naı̈vely replacing > Q with Q ∧ C in the domain constraint of the succedent does not work. This may even do more harm than good > because the resulting ODE liveness question becomes more difficult (Section 6). > 30 Y. K. Tan and A. Platzer > The refinement-based approach to ODE liveness provides a natural answer: recall that each refinement step in the > chain (6) requires the user to prove an additional box modality formula. The insight is that, for these box modality > formulas, any relevant lemmas that have been proved can be soundly added to the domain constraint. For example, > suppose that rule Kh&i is used to continue the proof after the cut. The left premise of Kh&i can now be strengthened > to include C in its domain constraint: > Γ, [x0 > = f(x) & Q]C [x0 > = f(x) & Q ∧ ¬P ∧ C]¬G > dC > Γ, [x0 > = f(x) & Q]C [x0 > = f(x) & Q ∧ ¬P]¬G Γ, [x0 > = f(x) & Q]C hx0 > = f(x) & QiG > Kh&i > Γ, [x0 > = f(x) & Q]C hx0 > = f(x) & QiP > Users could manually track and apply lemmas using dC as shown above, but this becomes tedious in larger live- > ness proofs. The implementation instead provides users with tactics that automatically search the antecedents Γ for > compatible assumptions that can be used to strengthen the domain constraints. These tactics also use a form of ODE > unification when determining compatibility. More precisely, consider the sequent Γ [x0 > = f(x) & Q]P, which may > arise as a box refinement during a liveness proof. An antecedent formula [y0 > = g(y) & R]C in Γ is called a compatible > assumption for the succedent [x0 > = f(x) & Q]P if: > 1. The set of ODEs y0 > = g(y) is a subset of the set of ODEs x0 > = f(x). This is order-agnostic, e.g., the ODE > u0 > = v, v0 > = u is a subset of the ODE v0 > = u, u0 > = v, w0 > = u + v + w. > 2. The domain constraint Q implies domain constraint R, i.e., Q → R is valid. > Under these conditions, the ODE y0 > = g(y) & R permits more trajectories than the ODE x0 > = f(x) & Q. Thus, > if formula C is always true along solutions of the former ODE, then it also stays true along solutions of the latter. > Combining compatible assumptions with implementations of liveness proof rules yields turbo-charged versions of > those rules. For example, in rule dV∃ > <, instead of simply assuming the negation of the postcondition (¬(p < 0) → · · · ) > when determining the existence of suitable ε, all postconditions of compatible assumptions can be assumed, e.g., with > ¬(p < 0) ∧ C → · · · for postcondition C of a compatible assumption. The authors report approximately 155 changed soundness-critical code lines and approximately 1,500 tactic lines. The tactic implementation is untrusted relative to the KeYmaera X kernel. They report formally proving the article’s examples and external ODE cases, including liveness from a robot circular-arc model. This record did not run those proofs or examine the implementation’s actual trusted base. A kernel-checked result remains an author-reported evaluation result here; the paper’s printed derivations and the implemented proofs are separate evidence. [Evidence: Q1, §1 complete surveyed corrections, contributions and trust/implementation claims, PDF pp.1–3; Q26, §7.2.3 complete metrics, hardware, paired-proof discussion and Table2, PDF pp.30–31; Q27, §7.2.3 complete trusted-kernel/untrusted-tactics and external-case discussion, PDF pp.31–31; complete exact passages in quotes.json.] Source (Q1, §1 complete surveyed corrections, contributions and trust/implementation claims): > 2020 > 2 Y. K. Tan and A. Platzer > Table 1: Surveyed ODE liveness arguments with highlighting in blue for soundness-critical corrections identified in > this article. The applications (and corrections, if any) for each surveyed argument is briefly described here. The > referenced corollaries are corresponding derived proof rules with details of the corrections. > Application Without Domain Constraints With Domain Constraints > Hybrid systems verification [Pla10] OK (Cor. 12) if open/closed, initially false (Cor. 18) > Auto. ODE verification [PR05, PR07] [PR07, Rem. 3.6] is incorrect if conditions checked globally (Cor. 23) > Finding basin of attraction [RS10] if compact (Cor. 17) if compact (Cor. 20) > Staging set ODE liveness proofs [SJ15] OK (Cor. 15) OK (Cor. 21) > Switching logic synthesis [TT10] if global solutions (Cor. 13) if global solutions (Cor. 19) > by several difficulties: i) solutions of ODEs may converge towards a goal without ever reaching it, ii) solutions of > nonlinear ODEs may blow up in finite time leaving insufficient time for the desired goal to be reached, and iii) the goal > may be reachable but only by (illegally) leaving the evolution domain constraint. In contrast, invariance properties > for ODEs are better understood [Pla10, GP14, LZZ11] and have a complete dL axiomatization [PT20]. Motivated by > the aforementioned difficulties, this article presents dL axioms enabling systematic, step-by-step refinement of ODE > liveness properties, where each step is justified using an ODE invariance property. This refinement approach is a > powerful framework for understanding ODE liveness arguments because it brings the full deductive power of dL’s > ODE invariance proof rules to bear on liveness proofs. Using invariance (or safety) properties to deduce liveness is > a well-known proof technique for (discrete) concurrent systems [MP92, OL82]. This article shows that those ideas > work just as well in the continuous setting—as long as the aforementioned difficulties are appropriately handled. > To demonstrate the applicability of the approach, this article surveys several arguments from the literature and > derives them all as (corrected) dL proof rules, see Table 1. This logical presentation has two key benefits: > • The proof rules are syntactically derived from sound axioms of dL, which guarantees their correctness. Many > of the surveyed arguments contain subtle soundness errors (Table 1, middle and right). These errors do not > diminish the surveyed work. Rather, they emphasize the need for an axiomatic, uniform way of presenting and > analyzing ODE liveness arguments instead of relying on ad hoc approaches. > • The approach identifies common refinement steps that form a basis for the surveyed liveness arguments drawn > from various applications (Table 1, left). This library of building blocks enables sound development and jus- > tification of new ODE liveness proof rules, e.g., by generalizing individual refinement steps or by exploring > different combinations of those steps. Corollaries 14, 16, and 22 are examples of new ODE liveness proof rules > that can be derived and justified from the uniform approach that this article follows. > This article extends the authors’ earlier conference version [TP19]. The key new insight is that all of the aforemen- > tioned liveness arguments (Table 1) are based on reducing liveness properties of ODEs to assumptions about sufficient > existence duration for their solutions. In fact, many of those arguments become significantly simpler (and sound) when > the ODEs of concern are assumed to have global solutions, i.e., they do not blow up in finite time. It is reasonable > and commonplace to make such an assumption for the continuous dynamics in models of CPSs [Alu15, Section 6]. > After all, mechanical systems do not simply cease to exist after a short time! An example from control theory is Lya- > punov stability which guarantees global solutions near stable equilibria [Kha92, Definition 4.1][HC08, Theorem 3.1]. > Control systems are designed to always operate near stable equilibria and so always have global solutions. Logically > though, making an a priori assumption of global existence for ODEs means that the correctness of any subsequent > verification results for the ODEs and hybrid system models are conditional on an unproved existence duration hypoth- > esis. While global existence is known to hold for linear systems, even the simplest nonlinear ODEs (see Section 4) > fail to meet the hypothesis without further assumptions. This article therefore adopts the view that (global) existence > should be proved rather than assumed for the continuous dynamics in hybrid systems. > The new contributions of this article beyond the authors’ earlier conference version [TP19] are: > • Section 4 presents deductive dL proofs of global existence for ODE solutions. Together with the liveness proofs > of Sections 5 and 6, this enables unconditional proofs of ODE liveness properties entirely within the uniform > An Axiomatic Approach to Existence and Liveness for Differential Equations 3 > dL refinement framework without existence presuppositions. > • Section 7 shows how to apply the insights from Sections 4–6 in practice. This includes: i) the design of proof > rules that are practically useful and well-suited for implementation (Section 7.1) and ii) the design of proof > support to aid users in existence and liveness proofs (Section 7.2). > The practical insights of Section 7 are drawn from an implementation of ODE liveness proof rules in the KeY- > maera X theorem prover for hybrid systems [FMQ+ > 15]. The unconditional liveness proofs enabled by Sections 4–6 fit > particularly well with an implementation in KeYmaera X because axiomatic refinement closely mirrors KeYmaera X’s > design principles. KeYmaera X implements dL’s uniform substitution calculus [Pla17a] and it is designed to mini- > mize the soundness-critical code that has to be trusted in order to guarantee its verification results. On top of this > soundness-critical core, KeYmaera X’s non-soundness-critical tactics framework [FMBP17] adds support and au- > tomation for proofs. Liveness proofs are similarly based on a series of small refinement steps which are, in turn, > implemented as (untrusted) tactics based on a small basis of derived refinement axioms. More complicated liveness > arguments, such as those from Table 1 or from new user insights, are implemented by piecing those tactics together > using tactic combinators [FMBP17]. The implementation required minor changes to ≈155 lines of soundness-critical > code in KeYmaera X, while the remaining ≈1500 lines implement ODE existence and liveness proof rules as tactics. > These additions suffice to prove all of the examples in this article and in ODE models elsewhere [SJ15, BTM+ > 19] > (Section 7.2.3). > Throughout this article, core dL axioms underlying the refinement approach are presented as lemmas, which are > summarized and proved in Appendix A. Existence and liveness proof rules that are derived syntactically from those ax- > ioms, e.g., Table 1, are listed as corollaries and their derivations are given in Appendix B. Counterexamples explaining > the soundness errors in Table 1 are given in Appendix C. Table 2 has 11 rows: six manual/automatic pairs for this article’s examples, three external Sogokon/Jackson cases, and two robot properties. That is 17 proof configurations, rather than 17 independent application scenarios. Metrics are manual tactic steps, internal kernel steps, and execution seconds averaged over five runs on Ubuntu 18.04, a 2.70 GHz Intel Core i7-6820HQ and 16 GB memory. Example 8 drops from 28 manual tactic steps to one automated step, while time rises from 0.575 to 0.990 seconds and kernel steps from 1,747 to 2,571. Automation is slower in four of the six pairs; it is faster in Examples 2 and 4. This measures proof-execution cost and user tactic counts, not user-study time, LLM success or broad scalability. No independent reproduction is claimed. [Evidence: Q26, §7.2.3 complete metrics, hardware, paired-proof discussion and Table2, PDF pp.30–31; Q27, §7.2.3 complete trusted-kernel/untrusted-tactics and external-case discussion, PDF pp.31–31; complete exact passages in quotes.json.] Source (Q26, §7.2.3 complete metrics, hardware, paired-proof discussion and Table2): > 7.2.3 Microbenchmarks > The KeYmaera X implementation is used to formally prove all of the ODE liveness examples from this article and > elsewhere [SJ15, BTM+ > 19]. Table 2 provides a summary of statistics from these proofs: “Tactic Steps” counts the > number of (manual) user proof steps; “Kernel Steps” counts the number of internal steps taken by the soundness- > critical KeYmaera X kernel; and “Proof Time” measures the time taken (in seconds, averaged over 5 runs, rounded > to 3 decimal places) for the proof to execute in KeYmaera X. All experiments were run on an Ubuntu 18.04 laptop > with a 2.70 GHz Intel Core i7-6820HQ CPU and 16GB memory. None of the proofs have been optimized to favor > any specific metric. The specific timings and proof steps are naturally subject to change on different hardware and > as various aspects of the KeYmaera X theorem prover are improved. Nevertheless, the key takeaways from these > microbenchmarks remain broadly applicable. > (M)anual and (A)utomatic Proofs. The implementation provides users with powerful proof support but also ex- > poses low-level primitives for users who prefer more fine-grained control over (parts of) their proofs. Both types of > proofs are shown for this article’s examples in Table 2. Proofs that heavily exploit the proof support and automation are > more convenient for users and require fewer manual tactic invocations. This gap is most pronounced for Example 8, > where the 28 step manual proof requires just one automated dV step. > On the other hand, the automated proofs are slower than their manual counterparts on four out of six examples. > Most of this overhead arises when there is significant proof search in the automation. In particular, the automated > proof of Example 1 is significantly slower and requires almost six times more kernel steps compared to its manual > counterpart. This gap arises because the automated proof uses the decision procedure for univariate global existence > outlined in Remark 2 while the manual proof uses the direct argument in Example 1. However, the latter proof required > user insight about the physical system. This illustrates the need for a flexible implementation that lets users navigate > the convenience and efficiency tradeoff according to their needs and proof insights. > An Axiomatic Approach to Existence and Liveness for Differential Equations 31 > Table 2: Proof statistics for ODE existence and liveness properties proved using the implementation. For this article’s > Examples 1–8, two proofs are presented: (M)anual proofs closely follow the pen-and-paper derivations shown in > this article, while (A)utomatic proofs make extensive use of the implemented proof support. The cells in bold font > indicate lower (more desirable) values. The stronger ODE liveness property proved in Example 7 implies those from > Examples 5 and 6. Examples 11, 12 and 15 refer to the correspondingly numbered examples from Sogokon and > Jackson [SJ15]. > Liveness Property > Tactic Steps Kernel Steps Proof Time (s) > (M) (A) (M) (A) (M) (A) > Example 1 7 3 2040 12156 1.778 3.716 > Example 2 8 2 962 898 0.220 0.203 > Example 3 7 3 1562 1580 0.551 0.759 > Example 4 29 5 3958 3501 3.286 3.034 > Example 7 (Examples 5 and 6) 50 20 5549 6141 1.714 1.952 > Example 8 28 1 1747 2571 0.575 0.990 > [SJ15] Example 11 - 50 - 11272 - 9.090 > [SJ15] Example 12 - 19 - 4818 - 1.388 > [SJ15] Example 15 - 1 - 4781 - 1.730 > [BTM+ > 19] Goal Position Reachability - 34 - 8159 - 2.182 > [BTM+ > 19] Velocity Bounds Reachability - 37 - 10521 - 3.042 > Finally, the automated proofs are in fact faster for Examples 2 and 4, which both involve linear ODEs. The > speedups here can be attributed to the well-tuned implementation of global existence proofs for affine systems and to > the use of rule dV∃ > < for the latter example. Thus, the aforementioned tradeoff can be further skewed towards favoring > user convenience by tuning the implemented automation. Appendix C supplies five concrete failure cases. Counterexample 9 adds an irrelevant-looking coordinate u′=u², u(0)=1, to v′=1, v(0)=0: u blows up at time 1, preventing the target v=2 despite constant progress of v. Counterexample 10 begins outside domain u≤1, making the diamond false even with target u≥0 initially true. Counterexample 11 demands u>1 while staying in u≤1. Counterexample 12 uses u′=0,v′=1 from (0,1), closed unit-disk domain and open-disk target; coincident boundaries make a surveyed boundary condition vacuous, and the solution exits immediately. Counterexample 13 uses a bounded open domain with the slice v=0 removed; the upward trajectory reaches the target only after crossing that forbidden slice. These are source-supplied examples against the specific earlier statements quoted in the report, not new independent checks of those original publications. [Evidence: Q35, AppendixC.1 complete Counterexample9 and duration explanation, PDF pp.55–56; Q36, AppendixC.2 complete unsound earlier variant rule and Counterexamples10–11, PDF pp.56–56; Q37, AppendixC.2 complete quoted Conjecture30 and Counterexamples12–13, PDF pp.57–57; complete exact passages in quotes.json.] Source (Q35, AppendixC.1 complete Counterexample9 and duration explanation): > C Counterexamples > This appendix gives explicit counterexamples to illustrate the soundness errors identified in Sections 5 and 6. > 56 Y. K. Tan and A. Platzer > C.1 Finite-Time Blow Up > The soundness errors identified in Section 5 all arise because of incorrect handling of the fact that solutions may blow > up in finite time. This phenomenon is studied in detail in Section 4, and it is illustrated by αn (2), see Fig. 1, or αb (7), > see Example 1. The following is a counterexample for the original presentation of dV= (and dVM > = ,dV=&,dVM > = &) [TT10]. > Similar counterexamples can be constructed for [PR07, Remark 3.6] and for the original presentation of SLyap,SLyap& [RS10]. > Counterexample 9. Consider rule dV= without the restriction that the ODE has provable global solutions. This unre- > stricted rule, denoted dV=, is unsound as shown by the following derivation using it with ε()=1: > ∗ > R > v − 2 < 0 1 ≥ 1 > dV=v − 2 ≤ 0 hu0 > = u2 > , v0 > = 1iv − 2 = 0 > The conclusion of this derivation is not valid. Consider the initial state ω with values ω(u) = 1 and ω(v) = 0. > The explicit solution of the ODE from ω is given by u(t) = 1 > 1−t , v(t) = t for t ∈ [0, 1). This solution does not > exist beyond the time interval [0, 1) because the u-coordinate asymptotically approaches ∞, i.e., blows up, as time > approaches t = 1. It is impossible to reach a state satisfying v − 2 = 0 from ω along this solution since at least 2 time > units are required. > This counterexample further illustrates the difficulty in handling nonlinear ODEs. Neither the precondition (v − > 2 ≤ 0) nor postcondition (v − 2 = 0) mention the variable u, and the ODEs u0 > = u2 > , v0 > = 1 do not depend > on variables v, u respectively, so it is tempting to disregard the variable u entirely. Indeed, the liveness property > v − 2 ≤ 0 → hv0 > = 1iv − 2 = 0 is valid. Yet, for liveness questions about the (original) ODE, u0 > = u2 Manual printed-formula check: §4 gives v′=−v² the expression v(t)=v0/(v0+t), calls v0 its initial value, and gives negative-state blow-up time −v0. The printed expression has v(0)=1 rather than arbitrary v0. Direct substitution instead gives v(t)=v0/(1+v0t), with negative-state horizon −1/v0. The source’s classification by sign remains correct. Nearby prose calls a squared-norm derivative non-negative while displaying a ≤0 premise and concluding the norm is non-increasing; the adjective should be non-positive. Footnote 8 calls 2/3 a lower bound on escape time where the positive progress lower bound supplies an upper time bound. These are manually checked illustration/prose defects, not counterexamples to the formal existence or variant rules. [Evidence: Q7, §4–4.1 finite-time blow-up example, clock existence and Lemma5, PDF pp.10–10; Q8, §4.1 complete Example1 proof and derivative-sign prose, PDF pp.11–11; Q17, §5.2 complete Example5, Corollary17 and §6 motivating/domain example including footnote8, PDF pp.19–21; complete exact passages in quotes.json.] Manual derivation-diagram check: Appendix B.4’s Corollary 24 diagram and part of Corollary 25’s diagram print an evolution-domain Q absent from the main unconstrained rules and unsupported by their premises. An arbitrary-Q conclusion is false: choose Q=false, x′=1, target x≥0, initial x=−1 and derivative bound 1; no domain-respecting segment exists. Removing the stray Q matches the main rules, other derivation steps and accompanying prose. This diagnoses the printed diagrams only; it does not demonstrate an unsound main unconstrained rule or an error in the implemented kernel/tactics. [Evidence: Q22, §7–7.1 implementation overview, existential and semialgebraic variants, PDF pp.24–26; Q32, AppendixB.4 complete Corollary24 derivation, including unsupported printed domain Q, PDF pp.54–54; Q33, AppendixB.4 complete Corollary25 derivation, including printed domain Q, PDF pp.54–55; complete exact passages in quotes.json.] For the requested topic, the main transfer is explicit proof obligations: generated liveness arguments must account for enough execution duration, domain membership at endpoints, progress bounded away from zero, and the difference between search code and its trusted checker. Reader proposals, not author results: LLM evaluation could use the five Appendix C cases and require a correction that preserves the original property. TLA+ finite abstractions or Verus implementations would need a separate refinement linking discrete code to the real ODE model. The article reports no Verus, verified-Rust, TLA+ or LLM experiment, and it does not settle concurrent distributed liveness. [Evidence: Q2, §2.1–2.2 syntax, standing ODE model and modal semantics, PDF pp.3–5; Q35, AppendixC.1 complete Counterexample9 and duration explanation, PDF pp.55–56; Q36, AppendixC.2 complete unsound earlier variant rule and Counterexamples10–11, PDF pp.56–56; Q37, AppendixC.2 complete quoted Conjecture30 and Counterexamples12–13, PDF pp.57–57; Q27, §7.2.3 complete trusted-kernel/untrusted-tactics and external-case discussion, PDF pp.31–31; complete exact passages in quotes.json.]
  • limits: Autonomous polynomial real ODEs, unique local trajectories, rational-polynomial syntax, first-order-real-arithmetic domain/target, finite diamond reachability with domain on all endpoints. Rule-specific existence, derivative, topology, compactness, fresh-variable and constant-context assumptions. No independent execution or broad scalability/user-study/LLM evaluation. Completeness only conditional global-existence representability, not all liveness. Manual printed solution/sign/time-bound and AppendixB.4 stray-Q concerns do not show main-rule/kernel unsoundness. Prior papers cited by source not independently reviewed.
  • how much was read: most of it read
  • source
  • record id: an-axiomatic-approach-to-2020
• Context-bounded multithreaded liveness (2020)
  • title: Context-Bounded Verification of Liveness Properties for Multithreaded Shared-Memory Programs
  • what: Proves decidability and complexity results for termination, fair non-termination and fair starvation of dynamically spawning recursive threads under a fixed context-switch bound, introducing VASS with balloons as the key intermediate model. The paper formalizes Dynamic Networks of Concurrent Pushdown Systems (DCPS), thread identities, scheduler swaps/resumptions and fairness. Ordinary termination reduces through downward closures to VASS non-termination, yielding the 2EXPSPACE result. Fairness is not downward-closure preserving, so VASS with balloons stores semi-linear multisets of future spawns; progressive runs and a shallow-run theorem reduce DCPS fair behavior to VASSB reachability, then to ordinary VASS reachability. A separate Ramsey/pumping and consistency construction reduces starvation to fair termination. The paper gives proof machinery rather than an implementation or empirical benchmark.
  • number: For K ≥ 1, K-bounded non-termination is 2EXPSPACE-complete
  • number: For every K, fair non-termination and fair starvation are decidable
  • number: Fair decision procedures are non-elementary, already for K=0 via VASS reachability
  • number: VASSB has decidable progressive runs and every progressive run has a shallow counterpart
  • limits: The bound K is fixed per decision instance and fairness means every thread ready infinitely often is eventually scheduled (with identity-equivalence subtleties handled by an angelic scheduler argument). Results concern the DCPS model: finite global state, pushdown stacks, shared global control and restricted scheduler rules. Fair problems are decidable but non-elementary; unbounded context switching remains outside the decidability claim.
  • how much was read: most of it read
  • source
  • record id: context-bounded-multithreaded-liveness-2020
• DistAlgo runtime checking (2020)
  • title: Assurance of Distributed Algorithms and Systems: Runtime Checking of Safety and Liveness
  • what: This work checks safety and bounded liveness of runnable DistAlgo programs while they run. It uses executable queries, fault injection and timeouts, and shows them on a polling example.
  • number: Fig 1: 24-line polling program; Fig 2: 41-line safety checker
  • number: timeouts q-r 0.00001 s, o-o 0.0001 s, total 1 s; raising o-o to 0.01 s gave no L2 timeout in dozens of runs
  • number: 10% message loss produced timeout failures
  • limits: It sees observed executions only. Bounded liveness turns liveness into safety. The paper gives no fixed denominator and no false-alarm rate.
  • how much was read: most of it read
  • source; notes: Assurance of Distributed Algorithms and Systems: Runtime Checking of S
  • record id: distalgo-runtime-checking-2020
• Hyperliveness Verification (2020)
  • title: Verifying Hyperliveness?
  • what: Develops model-checking and synthesis techniques for HyperLTL hyperliveness properties with quantifier alternation, treating existential quantifiers game-theoretically as reactive strategies. The work extends MCHyper to one alternation with manually supplied strategies, gives complexity/prophecy-variable results, and builds a bounded SMT synthesis tool for strategies and reactive systems. Experiments cover software doping, mutual exclusion, dining cryptographers and symmetry properties, checking precise alternating formulas rather than universal approximations.
  • number: software-doping times 1.8–160.1 s
  • number: Bakery symmetry times 27.5–472.3 s
  • number: synthesis example reaches 840 s
  • number: dual-core 3.3 GHz machine with 16 GB RAM
  • limits: Hardware model checking uses supplied AIGER strategies and bounded synthesis scales much less than checking with given strategies. Experiments use small benchmark families and a dual-core machine; full dining-cryptographers synthesis timed out, and automatic strategy synthesis remains limited.
  • how much was read: most of it read
  • source
  • record id: hyperliveness-verification-2020
• Lively RaTT guarded-recursion liveness (2020)
  • title: Diamonds are not forever: Liveness in reactive programming with guarded recursion
  • what: Introduces Lively RaTT, a modal functional-reactive language combining guarded fixed points with an LTL-like until type constructor. A step-indexed Kripke logical relation proves productivity, causality, termination, liveness, fairness, and absence of implicit space leaks. Separates the LTL time-step modality from guarded recursion’s modality, defines events and fair streams, gives evaluation/step/reactive semantics, and proves metatheoretic properties through worlds, support, and logical relations. The system explains why unrestricted identification of the modalities breaks termination guarantees.
  • number: No runtime benchmark; guarantees are metatheoretic (§5)
  • number: Proves productivity, causality, termination, liveness, fairness and no implicit space leaks (Abstract)
  • number: Future extension to dependent/temporal inductive types (§7)
  • limits: The language is a typed functional/reactive calculus with guarded recursion and specific modal/temporal types; results are semantic and do not provide empirical performance or automatic model checking. Expressing termination and richer dependent specifications remains future work, and ordinary inductive/coinductive extensions require care.
  • how much was read: most of it read
  • record id: lively-ratt-guarded-recursion-liveness-2020
• NetSMC: A Custom Symbolic Model Checker for Stateful Network Verification (2020)
  • what: NetSMC checks temporal policies on models of stateful network functions with persistent tables and one packet traversing the network at a time. It translates a restricted LTL language into CTL and represents sets of network states as existential first-order formulas. Backward preimages and a containment algorithm adapted from database query containment avoid general solver costs. A packet-order argument gives equivalence to interleaved executions for selected policies under an order-preservation condition. Benchmarks compare VMN, a Z3 containment variant, NuSMV and Cubicle; author-run exercises inject configuration mistakes into real network functions. Records exact NF/packet transition semantics, commutation and order-preservation conditions, restricted temporal operators and full appendix proofs, EFO preimage and containment construction, proof/implementation boundaries, printed listing/formula concerns, every Table2 timing and the narrow scopes of speedup, planted faults and model fidelity.
  • limits: §§4/8: A fixed topology and NF rule set; packets contain modeled header/application fields, not arbitrary payload processing. State is a collection of finite key-value maps; tests use specified finite domains, updates assign modeled expressions or increment/decrement by constants, expressions may choose nondeterministically from a domain. No multicast/broadcast, averages, generic computations, clocks/timeouts or direct network failures. Failures require separate enumerated scenarios. Integer/counter bounds and overflow semantics are not developed into an implementation-level finite-state proof. §§4.1/4.3/AppendixA: Exactly one matching NF rule; sequential commands are atomic at NF network-step granularity. A link preserves packet and tables. Drop/Exit permits an arbitrary next packet at arbitrary ingress, retaining all tables. Correct rules/topology/initial tables/model extraction are trusted; sequential packets do not mean tables reset between packets. Nondeterministic backend choice abstracts a concrete policy rather than verifies its implementation. §4.3/AppendixC: Every packet eventually leaves or drops; transient loops allowed, indefinite loops excluded. Unique immutable IDs distinguish packets. Interleaved model buffers unordered sets, not FIFO queues, and proof considers finite closed traces with no unfinished nonterminal packets. No general liveness/fairness or live controller-update verification. AppendixC/Definitions4–5/Lemma1: Non-conflict means swapping two same-NF processing steps preserves both output packets and final table valuation for every relevant initial valuation. A strict total packet order must be respected wherever packets conflict. Adjacent inversion swaps decrease an out-of-order index until packets can be serialized with identical per-packet located-packet traces. Conditions are assumptions on networks; no checker that establishes them for arbitrary input models is evaluated. §5/AppendicesB/D: Policies universally quantify outer variables; basic predicates inspect fields/location/tables. Permitted temporal forms are basic, F basic, within-packet eventual f basic, X(guard→formula), G(guard→formula), and within-packet g(guard→formula). f/g expand to restricted strong-until formulas terminated by Drop/Exit. General until, arbitrary quantifier alternation, generic temporal nesting/past properties excluded. A positive answer for arbitrary policies under serialization does not establish concurrent correctness. §5/AppendixD/Theorem7/Corollaries2,8: Conditional equivalence explicitly covers isolation, tag preservation and tag-based isolation on order-preserving networks. Other policies such as flow affinity/NAT consistency/service chaining are checked under the one-packet model and may miss interleaving bugs. Do not read Table1 sound/conditionally-complete labels as unconditional verification of all concurrent deployments. AppendixD qualified proof-scope concern: Theorem7 syntactically uses basic guards without explicitly excluding table predicates, although Lemma1 preserves only located-packet input/output traces, not every intermediate table valuation while a packet waits. Reordered unrelated processing can alter such valuations. The printed transfer argument therefore needs a restriction to predicates determined by those traces or an additional preservation proof; isolation/tag examples avoid this issue. This is a reading concern, not an executed counterexample against the tool. §6.2: EFO state formulas are disjunctions of conjunctive clauses with membership, inequality, location/field equality and table lookup. Variables are existential and outermost; denotation is a set of concrete packet/table valuations. This is a symbolic representation, not sampling of packet histories. §6.3/Algorithms1–2: Preimage unions NF-rule, link and new-packet predecessors. Commands processed in reverse order; tests conjoined. New-packet transition drops successor field/location constraints but preserves their variable/table relationships, restricts successor ingress and predecessor Drop/Exit. Table updates split equal-index overwritten entry versus an unequal index retaining old value. Helper expression translation F and link routine are omitted; precise implementation behavior is not reconstructed from pseudocode alone. §6.4/Algorithm3: Interpret clauses as conjunctive queries; homomorphism maps variables of candidate containing clause into contained clause. Inequalities require splitting equality patterns into atomic clauses; finite domains need emptiness checks (e.g., singleton variables forcing incompatible table values). Every nonempty atomic clause must map to some disjunct of target. This avoids a naive implication query to Z3, while still potentially expanding many clauses. §6.4/Theorem3 and AppendixE: Authors state exact True iff satisfaction under one-packet semantics. Appendices provide detailed semantics, trace reordering, policy transfer and structural LTL→CTL arguments (Theorem9/Lemmas10–12); no separate complete proof of Algorithm1/2 preimages, Algorithm3 domain splitting/emptiness, or Python refinement appears. Theorem3 is not a machine-checked verified implementation. Algorithm2/p188 printed-listing concerns: loop binds β_j on line14 but line15 passes β_i, and line21 recursive COMPUTECLS call omits expression-environment arguments present in its signature. Figure11/p196 sequence rule leaves c2 as a pending command without giving the corresponding continuation rule in the displayed semantics. Treat as incomplete/inconsistent presentation; no artifact tested. AppendixF/p200 printed-policy concerns: NAT consistency formula contains p without the displayed outer binder (only ∀i), despite closed-formula requirement. Flow affinity shown for S1 needs analogous instances for other servers. Conditional reachability uses G(loc=B→f(loc=A)) from the same arrival state at B, so without distinguishing request arrival from new reply injection it can demand that the current packet return to A; the prose speaks of packets sent afterwards. Qualified formula/specification boundary, not a measured tool failure. §7: Python prototype,20core2.8GHz/128GB server. CPU model/OS/Python/solver versions, source LOC, repeated-run statistics, confidence intervals and memory usage not reported. Alembic-generated NF models and manual POX translation used; authors assert high fidelity, but no formal extraction/refinement theorem or measured model-fidelity error rate is provided. §7.1/Figures6–8: Synthetic host/rule scaling and extended fattree/Ai3/Sprint topology isolation checks; flow-space sliced for both tools. Specific speedups depend on policy/model and baseline. VMN lacks service-chain policy support, so policy-complexity comparison uses only NetSMC/Z3. NuSMV fixed16-entry table and NetSMC without that size constraint are different encodings; Cubicle750× lacks detailed absolute timing/setup in text. §7.2: Red team authors2/3 inject secret deleted/modified rules; blue team author1 diagnoses with NetSMC, then rechecks fixed model. Four described real-NF exercises and nine modeled Table2 scenarios all succeed as reported; no production-discovered fault count, exhaustive fault set, detection rate, false-positive rate or independent user study. All benchmark/tool outcomes here are authors reports, not reproduced.
  • how much was read: most of it read
  • source
  • record id: netsmc-a-custom-symbolic-2020
• Presburger stage graphs (2020)
  • title: Checking Qualitative Liveness Properties of Replicated Systems with Stochastic Scheduling.
  • what: Develops Presburger stage graphs for sound and complete verification of stable-termination/liveness properties of replicated systems with an unknown number of indistinguishable agents and stochastic scheduling. A stage graph is a finite DAG of inductive Presburger configuration sets with ranking certificates. The authors give a decidability/completeness result, an incomplete practical constructor using Z3, well-quasi-order and Petri-net techniques, and evaluate it on population protocols, leader election and mutual exclusion. The paper formalizes replicated systems as 1-conservative Petri/VAS-style multiset rewriting and assumes a scheduler whose transition probabilities depend only on the current configuration and are nonzero for every enabled transition. Proposition 2 characterizes fair-run progress by ranking certificates; Proposition 3 and Theorem 2 establish stage-graph soundness/completeness, while Theorem 3 reduces candidate checking to Presburger satisfiability. Algorithm 1 starts from a potential-reachability overapproximation, computes eventually dead transitions (linear ranking or layer functions), and splits stages when needed. Exact dead-state sets are computable via backward reachability but can be doubly exponential; the practical procedure is incomplete. Z3 experiments build mostly chains of at most three stages (five for approximate majority), verify infinite families of protocols, and produce independently checkable invariant/ranking certificates.
  • number: Z3 implementation on Intel Xeon E5-2630 v4 2.20GHz, 8GB RAM
  • number: timeout 1 hour; most stage graphs ≤3 stages, approximate-majority graphs 5 stages
  • number: fast-majority instances up to m=21,d=1: 466s; m=21,d=20: 3301s (timeouts shown)
  • number: flock-of-birds c=80: 1217s; threshold c=8: 1089s; remainder m=20: 1646s
  • limits: Systems are finite-state agent programs with fixed population size per run, clique-style rendezvous/multiway transitions, and stochastic scheduling satisfying the two stated probability assumptions. The complete decision problem has non-elementary complexity; the implemented constructor may fail or time out and uses existential Presburger formulas/linear certificates. Population-protocol families are checked instance by instance, not universally over the family parameter. The method addresses qualitative almost-sure stable liveness, not quantitative probabilities, arbitrary fairness notions, Byzantine faults, or Rust implementation details.
  • how much was read: most of it read
  • source
  • record id: presburger-stage-graphs-2020
• SCP proofs (2020)
  • title: On the Formal Verification of the Stellar Consensus Protocol
  • what: A first-order model of SCP quorums and balloting in Ivy/Z3. It proves agreement, and proves termination for intact sets under eventual synchrony. Isabelle proves the abstraction sound.
  • number: no person-hours, proof-line total or timing reported
  • limits: It is a protocol model for fixed configurations, not deployed code. Membership cannot change dynamically. The short paper omits detailed proofs.
  • how much was read: most of it read
  • source; notes: Related addition: On the Formal Verification of the Stellar Consensus
  • record id: scp-proofs-2020
• An Axiomatic Approach to Liveness for Differential Equations (2019)
  • what: # Continuous reachability from invariants, with explicit duration and boundary conditions (authored by agents unless marked 🧑) Quotation fidelity: the anchored passages below reproduce raw PDF extraction exactly, not faithful mathematical typography. Extraction prints the generic comparison symbol for either ≥ or > as <, and its dual as 4; it also drops overbars for topological closure and flattens derivatives/fractions. Use the separately labelled PDF-checked transcriptions and original page images for mathematics. The raw offsets and text remain unchanged. Tan and Platzer present a deductive framework for finite-time reachability of ordinary differential equations (ODEs) in differential dynamic logic (dL), a logic for discrete and continuous programs. This record reads the complete 37-page arXiv:1904.07984v2 report, dated 10 July 2019, including Appendices A–C and all 31 references. The paper derives liveness rules from a small collection of refinement and existence axioms, and gives counterexamples to several earlier rules. These are paper proofs and examples. This version reports paper proofs and examples, with no implementation evaluation or proof microbenchmarks. [Evidence: Q0, Title, complete abstract and §1 motivation, PDF pp.1–2; Q1, §1 complete survey table, claimed corrections and contribution scope, PDF pp.2–3; Q14, §7 complete conclusion and acknowledgments, PDF pp.15–16; complete exact passages in quotes.json.] Source (Q0, Title, complete abstract and §1 motivation): > An Axiomatic Approach to Liveness > for Differential Equations > Yong Kiam Tan André Platzer ∗ > Abstract > This paper presents an approach for deductive liveness verification for ordinary differen- > tial equations (ODEs) with differential dynamic logic. Numerous subtleties complicate the > generalization of well-known discrete liveness verification techniques, such as loop variants, > to the continuous setting. For example, ODE solutions may blow up in finite time or their > progress towards the goal may converge to zero. Our approach handles these subtleties by > successively refining ODE liveness properties using ODE invariance properties which have a > well-understood deductive proof theory. This approach is widely applicable: we survey several > liveness arguments in the literature and derive them all as special instances of our axiomatic re- > finement approach. We also correct several soundness errors in the surveyed arguments, which > further highlights the subtlety of ODE liveness reasoning and the utility of our deductive ap- > proach. The library of common refinement steps identified through our approach enables both > the sound development and justification of new ODE liveness proof rules from our axioms. > Keywords: differential equations, liveness, differential dynamic logic > 1 Introduction > Hybrid systems are mathematical models describing discrete and continuous dynamics, and inter- > actions thereof [6]. This flexibility makes them natural models of cyber-physical systems (CPSs) > which feature interactions between discrete computational control and continuous real world physics > [2, 19]. Formal verification of hybrid systems is of significant practical interest because the CPSs > they model frequently operate in safety-critical settings. Verifying properties of the continuous > dynamics is a key aspect of any such endeavor. > This paper focuses on deductive liveness verification for continuous dynamics described by > ordinary differential equations (ODEs). We work with differential dynamic logic (dL) [16, 17, 19], > a logic for deductive verification of hybrid systems, which compositionally lifts our results to the > hybrid systems setting. Methods for proving liveness in the discrete setting are well-known: loop > variants show that discrete loops eventually reach a desired goal, while temporal logic is used to > specify and study liveness properties in concurrent and infinitary settings [12, 13]. In the contin- > uous setting, liveness for an ODE means that its solutions eventually enter a desired goal region > ∗ > Computer Science Department, Carnegie Mellon University, Pittsburgh, USA {yongkiat|aplatzer}@cs.cmu.edu > arXiv:1904.07984v2 > [cs.LO] > 10 > Jul > 2019 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations The model uses autonomous polynomial ODEs over real states, rational-polynomial terms and first-order real-arithmetic domain/target formulas. Polynomial fields have unique right-maximal local solutions, whose maximum duration can be finite. A diamond property requires some finite solution segment to reach its target while satisfying the domain at every point, including both endpoints. Duration zero can succeed only when target and domain initially hold. Parameters remain constant; topological conditions concern sets over the evolving ODE variables with parameters fixed. This finite continuous reachability property is separate from concurrent-system fairness or infinitely recurring progress. Background completeness is for real-arithmetic ODE invariants, not all liveness. [Evidence: Q2, §2.1–2.2 complete syntax, standing ODEs and semantics, PDF pp.3–5; Q3, §2.3 complete invariant calculus and constant-context explanation, PDF pp.5–6; Q15, AppendixA parameter-fiber topology, decidability and sufficient syntactic criteria, PDF pp.20–21; Q13, §6 complete related-work discussion and automation scope, PDF pp.15–15; complete exact passages in quotes.json.] Source (Q2, §2.1–2.2 complete syntax, standing ODEs and semantics): > -1 > 0 > 1 > v > -1 0 1 u > -1 > 0 > 1 > v > Figure 1: Visualization of αl > (above) and αn (below). Solutions > of αl globally spiral towards the > origin. In contrast, solutions of αn > spiral inwards within the inner red > disk (dashed boundary), but spi- > ral outwards otherwise. For both > ODEs, solutions starting on the > black unit circle eventually enter > their respective shaded green goal > regions. > The grammar of dL terms is as follows, where v ∈ V is a > variable and c ∈ Q is a rational constant. These terms are > polynomials over the set of variables V: > p, q ::= v | c | p + q | p · q > The grammar of dL formulas is as follows, where ∼ ∈ {= > , 6=, ≥, >, ≤, <} is a comparison operator and α is a hybrid > program: > φ, ψ ::= > First-order formulas of real arithmetic P,Q > z }| { > p ∼ q | φ ∧ ψ | φ ∨ ψ | ¬φ | ∀v φ | ∃v φ > | [α]φ | hαiφ > The notation p < q (resp. 4) is used when the compar- > ison operator can be either ≥ or > (resp. ≤ or <). Other > standard logical connectives, e.g., →, ↔, are definable as in > classical logic. Formulas not containing the modalities [·], h·i > are formulas of first-order real arithmetic and are written as > P, Q. The box ([α]φ) and diamond (hαiφ) modality formulas > express dynamic properties of the hybrid program α. We fo- > cus on continuous programs, where α is given by a system of > ODEs x0 > = f(x) & Q. Here, x0 > = f(x) is an n-dimensional > system of differential equations, x0 > 1 = f1(x), . . . , x0 > n = fn(x), > over variables x = (x1, . . . , xn), where the LHS x0 > i is the time > derivative of xi and the RHS fi(x) is a polynomial over vari- > ables x. The domain constraint Q specifies the set of states > in which the ODE is allowed to evolve continuously. When > there is no domain constraint, i.e., Q is the formula true, the > ODE is written as x0 > = f(x). > Two running example ODEs are visualized in Fig. 1 with > directional arrows corresponding to their RHS evaluated at > points on the plane. The first ODE, αl ≡ u0 > = −v − u, v0 > = > u − v, is linear because its RHS depends linearly on u, v. > The second ODE, αn ≡ u0 > = −v − u(1 > 4 > − u2 > − v2 > ), v0 > = > u − v(1 > 4 > − u2 > − v2 > ), is non-linear. The non-linearity of αn results in more complex behavior for its > solutions, e.g., the difference in spiraling behavior shown in Fig. 1. In fact, solutions of αn blow > up in finite time iff they start outside the disk characterized by u2 > + v2 > ≤ 1 > 4 > . Finite time blow up is > impossible for linear ODEs like αl [5, 31]. > 3 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > When terms (or formulas) appear in contexts involving ODEs x0 > = f(x), it is sometimes > necessary to restrict the set of free variables they are allowed to mention. These restrictions are > always stated explicitly and are also indicated as arguments2 > to terms (or formulas), e.g., p() means > the term p does not mention any of x1, . . . , xn free, while P(x) means the formula P may mention > all of them. > 2.2 Semantics > States ω : V → R assign real values to each variable in V; the set of all states is written S. > The semantics of polynomial term p in state ω ∈ S is the real value ω[[p]] of the corresponding > polynomial function evaluated at ω. The semantics of formula φ is the set of states [[φ]] ⊆ S in > which that formula is true. The semantics of first-order logical connectives are defined as usual, > e.g., [[φ ∧ ψ]] = [[φ]] ∩ [[ψ]]. > For ODEs, the semantics of the modal operators is defined directly as follows.3 > Let ω ∈ S and > ϕ : [0, T) → S (for some 0 < T ≤ ∞), be the unique, right-maximal solution [5, 31] to the ODE > x0 > = f(x) with initial value ϕ(0) = ω: > ω ∈ [[[x0 > = f(x) & Q]φ]] iff for all 0 ≤ τ < T where ϕ(ζ) ∈ [[Q]] for all 0 ≤ ζ ≤ τ: > ϕ(τ) ∈ [[φ]] > ω ∈ [[hx0 > = f(x) & Qiφ]] iff there exists 0 ≤ τ < T such that: > ϕ(τ) ∈ [[φ]] and ϕ(ζ) ∈ [[Q]] for all 0 ≤ ζ ≤ τ > Informally, [x0 > = f(x) & Q]φ is true in initial state ω if all states reached by following the ODE > from ω while remaining in the domain constraint Q satisfy postcondition φ. Dually, the liveness > property hx0 > = f(x) & Qiφ is true in initial state ω if some state which satisfies the postcondition φ > is eventually reached in finite time by following the ODE from ω while staying in domain constraint > Q. For the running example, Fig. 1 suggests that formulas4 > hαli 1 > 4 > ≤ k(u, v)k∞ ≤ 1 > 2 >
    > and hαniu2 > + > v2 > ≥ 2 are true for initial states ω on the unit circle. These liveness properties are rigorously proved > in Examples 1 and 2 respectively. > Variables y ∈ V \ {x} not occurring on the LHS of ODE x0 > = f(x) remain constant along > solutions ϕ : [0, T) → S of the ODE, with ϕ(τ)(y) = ϕ(0)(y) for all τ ∈ [0, T). Since only > the values of x = (x1, . . . , xn) change along the solution ϕ it may also be viewed geometrically > as a trajectory in Rn > , dependent on the initial values of the constant parameters y. Similarly, the > value of terms and formulas depends only on the values of their free variables [17]. Thus, terms (or > formulas) whose free variables are all parameters for x0 > = f(x) also have constant (truth) values > along solutions of the ODE. For formulas φ that only mention free variables x, [[φ]] can also be > viewed geometrically as a subset of Rn > . Such a formula is said to characterize a (topologically) > open (resp. closed, bounded, compact) set with respect to variables x iff the set [[φ]] ⊆ Rn > is > 2 > This understanding of variable dependencies is made precise using function and predicate symbols in dL’s uniform > substitution calculus [17]. > 3 > The semantics of dL formulas is defined compositionally elsewhere [17, 19]. > 4 > Here, k(u, v)k∞ denotes the L∞ > norm. The inequality k(u, v)k∞ ≤ 1 > 2 is expressible in first-order real arithmetic > as u2 > ≤ 1 > 4 ∧ v2 > ≤ 1 > 4 (similarly for 1 > 4 ≤ k(u, v)k∞). > 4 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > topologically open (resp. closed, bounded, compact) with respect to the Euclidean topology. These > topological conditions are used as side conditions for some of the axioms and proof rules in this > paper. In Appendix A, a more general definition of these side conditions is given for formulas φ that > mention parameters y. These side conditions are decidable [3] when φ is a formula of first-order > real arithmetic and there are simple syntactic criteria for checking if they hold (Appendix A). > Formula φ is valid iff [[φ]] = S, i.e., φ is true in all states. In particular, if the formula I → > [x0 > = f(x) & Q]I is valid, the formula I is an invariant of the ODE x0 > = f(x) & Q. Unfolding the > semantics, this means that from any initial state ω satisfying I, all states reached by the solution of > the ODE x0 The proof method starts from a known diamond property and refines it into the desired one. DR changes the domain when a box invariant justifies doing so. K<&> establishes that a known reachable region cannot be reached before the desired target. Existence axiom GEx supplies arbitrary clock duration for globally Lipschitz ODEs. BEx instead says that a solution reaches the requested clock threshold or exits a bounded region. Appendix B proves these existence axioms semantically using global solution existence or the unbounded norm near finite-time blow-up. [Evidence: Q4, §3 refinement rationale, Lemma2 and chaining illustration, PDF pp.6–7; Q5, §3 complete Lemma3 existence axioms and duration explanation, PDF pp.7–7; Q17, AppendixB complete Lemma3 existence soundness proof, PDF pp.21–22; complete exact passages in quotes.json.] Source (Q4, §3 refinement rationale, Lemma2 and chaining illustration): > These additional constant contexts are useful when working with assumptions on symbolic param- > eters e.g., v() > 0 to represent a (constant) positive velocity. > 3 Liveness via Box Refinements > Suppose we already know an initial liveness property hx0 > = f(x) & Q0iP0 for the ODE x0 > = f(x). > How could this be used to prove a desired liveness property hx0 > = f(x) & QiP for that ODE? > Logically, this amounts to proving: > hx0 > = f(x) & Q0iP0 → hx0 > = f(x) & QiP (1) > Proving implication (1) refines the initial liveness property to the desired one. Our approach > is built on refinement axioms that conclude such implications from box modality formulas. The > following are two basic derived refinement axioms: > Lemma 2 (Diamond refinement axioms). The following h·i refinement axioms are derivable in dL. > DRh·i [x0 > = f(x) & R]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > Kh&i [x0 > = f(x) & Q ∧ ¬P]¬G → hx0 > = f(x) & QiG → hx0 > = f(x) & QiP >
    > In axiom Kh&i, formula [x0 > = f(x) & Q ∧ ¬P]¬G says the solution cannot get to G before > getting to P as G never happens while ¬P holds. In axiom DRh·i, formula [x0 > = f(x) & R]Q says > that the ODE solution never leaves Q while staying in R, so the solution getting to P within R > 6 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > implies that it also gets to P within Q. These axioms prove implication (1) in just one refinement > step. Logical implication is transitive though, so we can also chain a longer sequence of such steps > to prove implication (1). This is shown in (2), with neighboring implications informally chained > together for illustration: > hx0 > = f(x) & Q0iP0 > DRh·i with [x0=f(x) & Q1]Q0 > z}|{ > → hx0 > = f(x) & Q1iP0 > Kh&i with [x0=f(x) & Q1∧¬P1]¬P0 > z}|{ > → hx0 > = f(x) & Q1iP1 > → · · · → hx0 > = f(x) & QiP (2) > The chain of refinements (2) proves the desired implication (1), but to formally conclude the > liveness property hx0 > = f(x) & QiP, we still need to prove the hypothesis hx0 > = f(x) & Q0iP0 on > the left of the implication. The following axioms provide a means of formally establishing such an > initial liveness property: Domain changes need more than an invariant restricted to the target’s negation. COR requires an initially false target and matching open/open or closed/closed topology of target and new domain. SAR replaces the until-condition with the negation of target-and-domain together; its proof uses local progress into a semialgebraic set or its complement. Appendix B additionally handles closed targets or open domains without that general local-progress step. Appendix A explains decidable real-arithmetic topology checks and sufficient syntactic tests. Invariant rules generally discard initial-state assertions when reasoning along trajectories; constant-parameter assertions can remain. [Evidence: Q6, §3 complete Lemma4 and topological/semialgebraic conditions, PDF pp.8–8; Q3, §2.3 complete invariant calculus and constant-context explanation, PDF pp.5–6; Q15, AppendixA parameter-fiber topology, decidability and sufficient syntactic criteria, PDF pp.20–21; Q18, AppendixB complete Lemma4 topological refinement soundness proof, PDF pp.22–24; complete exact passages in quotes.json.] Source (Q6, §3 complete Lemma4 and topological/semialgebraic conditions): > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > Lemma 4 (Topological refinement axioms). The following topological h·i refinement axioms are > sound. In axiom COR, P, Q either both characterize topologically open or both characterize > topologically closed sets over variables x. > COR ¬P ∧ [x0 > = f(x) & R ∧ ¬P]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > SAR [x0 > = f(x) & R ∧ ¬(P ∧ Q)]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > Axiom COR is the more informative topological refinement axiom. Like the (unsound) axiom > candidate DRh·i, it allows formula ¬P to be assumed in the domain constraint when proving the > box refinement. For soundness though, axiom COR has additional topological side conditions on > formulas P, Q so it can only be used when these conditions are met. Axiom SAR applies more > generally but only assumes the less informative formula ¬(P ∧ Q) in the domain constraint for > the box modality formula in the refinement. Its proof crucially relies on Q being a formula of > real arithmetic so that the set it characterizes has tame topological behavior [3], see the proof > in Appendix B for more details.6 Corollary 5’s explicit-duration differential variant requires a fixed positive derivative bound until the target and a premise ensuring enough evolution time. Its shorter rule assumes the entire ODE is globally Lipschitz. The equational variants, higher-Lie-derivative rule and ordinary staging rule likewise use global Lipschitz continuity in this version. Merely local Lipschitz continuity gives no global-duration guarantee. A derivative that stays positive but tends toward zero also need not yield finite reachability. Higher derivatives provide a polynomial-in-time lower bound, whose positive leading coefficient eventually forces progress. [Evidence: Q7, §4.1 complete Corollary5 and derivative/duration explanation, PDF pp.8–9; Q9, §4.1 complete Corollaries6–7 with global Lipschitz assumptions, PDF pp.10–10; Q19, AppendixB complete Corollary7 higher-Lie-derivative proof, PDF pp.25–27; complete exact passages in quotes.json.] Source (Q7, §4.1 complete Corollary5 and derivative/duration explanation): > 4 Liveness Without Domain Constraints > This section presents proof rules for liveness properties of ODEs x0 > = f(x) without domain con- > straints, i.e., where Q is the formula true. Errors and omissions in the surveyed techniques are > highlighted in blue. > 4.1 Differential Variants > A fundamental technique for verifying liveness of discrete loops is the identification of a loop > variant, i.e., a quantity that decreases monotonically across each loop iteration. Differential vari- > ants [15] are their continuous analog: > Corollary 5 (Atomic differential variants [15]). The following proof rules (where < is either ≥ > or >) are derivable in dL. Terms ε(), p0() are constant for ODE x0 > = f(x), t0 > = 1. In rule dV<, > x0 > = f(x) is globally Lipschitz continuous. > dV∗ > < > ¬(p < 0) > . > p ≥ ε() > Γ, p=p0(), t=0, hx0 = f(x), t0 = 1i p0()+ε()t>0 >
> hx0 = f(x), t0 = 1ip < 0 > dV< > ¬(p < 0) > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x)ip < 0 > Proof Sketch (Appendix B). Rule dV∗ > < derives by using axiom Kh&i with the choice of formula > G ≡ p0()+ε()t>0: > 6 > By topological considerations similar to COR, axiom SAR is also sound if it requires that the formula P (or resp. > Q) characterizes a topologically closed (resp. open) set over the ODE variables x. These additional cases are also > proved in Appendix B without relying on the fact that Q is a formula of real arithmetic. > 8 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > Kh&i > Γ, p=p0(), t=0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)]p0()+ε()t ≤ 0 > Γ, p=p0(), t=0, hx0 = f(x), t0 = 1i p0()+ε()t>0 >
> hx0 = f(x), t0 = 1ip<0 > Monotonicity M[0 > ] strengthens the postcondition to p ≥ p0() + ε()t with the domain constraint > ¬(p < 0). A subsequent use of dI< completes the derivation: > ¬(p < 0) > . > p ≥ ε() > dI< > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)]p ≥ p0() + ε()t > M[0] > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)]p0() + ε()t ≤ 0 > Rule dV< is derived in Appendix B as a corollary of rule dV∗ > <. It uses the global existence > axiom GEx and rule dGt to introduce the time variable. > The premises of both rules require a constant (positive) lower bound on the Lie derivative > . > p > which ensures that the value of p strictly increases along solutions to the ODE, eventually becoming > non-negative. Soundness of both rules therefore crucially requires that ODE solutions exist for > sufficiently long for p to become non-negative. This is usually left as a soundness-critical side > condition in liveness proof rules [15, 28], but such a side condition is antithetical to approaches > for minimizing the soundness-critical core in implementations [17] because it requires checking > the (semantic) condition that solutions exist for sufficient duration. The conclusion of rule dV∗ > < > formalizes this side condition as an assumption while rule dV< uses global Lipschitz continuity > of the ODEs to show it. All subsequent proof rules can also be presented with sufficient duration > assumptions like dV∗ > < but these are omitted for brevity. Bounded staging removes the global Lipschitz requirement: the trajectory stays in a bounded staging region until the target, and one fixed positive derivative forces it to exit. Compact staging needs only a strictly positive derivative because a continuous derivative attains a positive minimum there. The set-Lyapunov rule requires compact K and open target P; the authors explain that a surveyed merely closed-K statement omitted boundedness needed by its proof. These conditions distinguish sufficient finite-duration reasoning from assuming all trajectories last forever. [Evidence: Q10, §4.2 complete staging rules, nonlinear Example2 and compactness correction, PDF pp.10–12; Q20, AppendixB complete Corollaries8–10 staging/compactness derivations, PDF pp.27–29; complete exact passages in quotes.json.] Source (Q10, §4.2 complete staging rules, nonlinear Example2 and compactness correction): > 4.2 Staging Sets > The idea behind staging sets [28] is to use an intermediary staging set formula S that can only be > left by entering the goal region P. This staging property is expressed by the box modality formula > [x0 > = f(x) & ¬P]S and is formally justified as a refinement using axiom Kh&i with G ≡ ¬S. > 10 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > Corollary 8 (Staging sets [28]). The following proof rule is derivable in dL. Term ε() is constant > for ODE x0 > = f(x), which is globally Lipschitz continuous. > SP > Γ [x0 > = f(x) & ¬P]S S p ≤ 0 ∧ > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x)iP > In rule SP, the staging set formula S provides a choice of intermediary between the differential > variant p and the desired postcondition P. Proof rules can be significantly simplified by choosing S > with desirable topological properties. All proof rules derived so far either have an explicit sufficient > duration assumption (like dV∗ > <) or use axiom GEx by assuming that ODEs are globally Lipschitz. > To make use of axiom BEx, an alternative is to choose staging set formulas S(x) that characterize > a bounded (or even compact) set over the variables x. > Corollary 9 (Bounded/compact staging sets). The following proof rules are derivable in dL. Term > ε() is constant for x0 > = f(x). In rule SPb, formula S characterizes a bounded set over variables > x. In rule SPc, it characterizes a compact, i.e., closed and bounded, set over those variables. > SPb > Γ [x0 > = f(x) & ¬P]S S > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x)iP > SPc > Γ [x0 > = f(x) & ¬P]S S > . > p > 0 > Γ hx0 = f(x)iP > Proof Sketch (Appendix B). Rule SPb derives using BEx and differential variant p to establish a > time bound. Rule SPc is an arithmetical corollary of SPb, using the fact that continuous functions > on a compact domain attain their extrema. > Example 2. Liveness for the non-linear ODE αn (as suggested by Fig. 1) is proved using rule SPc > by choosing the staging set formula S ≡ 1 ≤ u2 > +v2 > ≤ 2 (blue annulus) and the differential variant > p = u2 > + v2 > . The Lie derivative > . > p with respect to αn is 2(u2 > + v2 > )(u2 > + v2 > − 1 > 4 > ), which is bounded > below by 3 > 2 > in S. Thus, the right premise of SPc closes trivially. The left premise (abbreviated 1 ) > requires proving that S is an invariant within the domain constraint ¬(u2 > + v2 > ≥ 2). Intuitively, > this is true because the blue annulus can only be left by entering u2 > +v2 > ≥ 2. Its (elided) invariance > proof is easy [20]. > 1 > ∗ > R > S > . > p > 0 > SPc > u2 > + v2 > = 1 hαniu2 > + v2 > ≥ 2 > ∗ > S [αn & ¬(u2 > + v2 > ≥ 2)]S > cut,R > 1 : u2 > + v2 > = 1 [αn & ¬(u2 > + v2 > ≥ 2)]S > -1 0 1 u > -1 > 0 > 1 > v > There are two subtleties to highlight in this proof. First, S characterizes a compact, hence > bounded, set (as required by rule SPc). Solutions of αn can blow up in finite time which necessitates > the use of BEx for proving its liveness properties. Second, S is cleverly chosen to exclude the red > 11 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > disk (dashed boundary) characterized by u2 > + v2 > ≤ 1 > 4 > . As mentioned earlier, solutions of αn > behave differently in this region, e.g., the Lie derivative > . > p is non-positive in this disk. The chain of > refinements (2) behind this proof can be seen from the derivation of rules SPb,SPc in Appendix B. > It starts from the initial liveness property BEx (with time bound 1 / 3 > 2 > = 2 > 3 > ) and uses two Kh&i > refinement steps, first showing that the staging set is left (hαni¬S), then showing the desired > liveness property: > hαn, t0 > = 1i(¬S ∨ t > > 2 > 3 > ) > Kh&i > → hαni¬S > Kh&i > → hαniu2 > + v2 > ≥ 2 > The use of axiom BEx is subtle and is sometimes overlooked in surveyed liveness arguments. > For example, [24, Remark 3.6] incorrectly claims that their liveness argument works without > assuming that the relevant sets are bounded. The following proof rule derives from SPc and adapts > ideas from [25, Theorem 2.4, Corollary 2.5], but formula K in the original presentation is only > assumed to characterize a closed rather than compact set; the proofs (correctly) use the fact that > the set is bounded but this assumption is not made explicit [25]. > Corollary 10 (Set Lyapunov functions [25]). The following proof rule is derivable in dL. Formula > K characterizes a compact set over variables x, while formula P characterizes an open set over > those variables. > SLyap > p ≥ 0 K ¬P, K > . > p > 0 > Γ, p < 0 hx0 = f(x)iP > 5 Liveness With Domain Constraints > This section presents proof rules for liveness properties x0 > = f(x) & Q with domain constraint Q. Example 1 proves that the linear spiral u′=−v−u, v′=u−v reaches an annular target from the unit circle. For p=1/4−u²−v² the derivative is at least 1/2 before reaching squared radius 1/4, giving an analytic time threshold 3/2. Continuity then yields the circle and enclosing sup-norm annulus. The trajectory does not reach the origin in finite time; its shrinking rate tends to zero. Example 2 uses the nonlinear spiral u′=−v−u(1/4−u²−v²), v′=u−v(1/4−u²−v²). Compact staging in 1≤u²+v²≤2 and derivative at least 3/2 prove it reaches squared norm 2 before its later blow-up. The 2/3 threshold is an analytic bound, not a measured runtime. [Evidence: Q8, §4.1 complete Example1, finite-goal versus asymptotic-origin distinction and analytic bound, PDF pp.9–10; Q10, §4.2 complete staging rules, nonlinear Example2 and compactness correction, PDF pp.10–12; complete exact passages in quotes.json.] Source (Q8, §4.1 complete Example1, finite-goal versus asymptotic-origin distinction and analytic bound): > Example 1. Rule dV< enables a liveness proof for the linear ODE αl as suggested by Fig. 1. The > proof is shown on the left below and visualized on the right. The first monotonicity step Mh0 > i > strengthens the postcondition to the inner blue circle u2 > + v2 > = 1 > 4 > which is contained within the > green goal region. Next, since solutions satisfy u2 > + v2 > = 1 initially (black circle), the Kh&i step > expresses an intermediate value property: to show that the continuous solution eventually reaches > u2 > + v2 > = 1 > 4 > , it suffices to show that it eventually reaches u2 > + v2 > ≤ 1 > 4 > (see Corollary 6). The > postcondition is rearranged before dV< is used with ε() = 1 > 2 > . Its premise proves with R because > the Lie derivative of 1 > 4 > − (u2 > + v2 > ) with respect to αl is 2(u2 > + v2 > ), which is bounded below by 1 > 2 > with assumption 1 > 4 > − (u2 > + v2 > ) < 0. > ∗ > R 1 > 4 > < u2 > + v2 > 2(u2 > + v2 > ) ≥ 1 > 2 > 1 > 4 > − (u2 > + v2 > ) < 0 2(u2 > + v2 > ) ≥ 1 > 2 > dV< > u2 > + v2 > = 1 hαli1 > 4 > − (u2 > + v2 > ) ≥ 0 > u2 > + v2 > = 1 hαliu2 > + v2 > ≤ 1 > 4 > Kh&i > u2 > + v2 > = 1 hαliu2 > + v2 > = 1 > 4 > Mh0i > u2 > + v2 > = 1 hαli 1 > 4 > ≤ k(u, v)k∞ ≤ 1 > 2 >
> -1 0 1 u > -1 > 0 > 1 > v > 9 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > The Lie derivative calculation shows that the value of u2 > + v2 > decreases along solutions of > αl, as visualized by the shrinking (dashed) circles. However, the rate of shrinking converges to > zero as solutions approach the origin, so solutions never reach the origin in finite time! This is > why dV∗ > <,dV< need a constant positive lower bound on the Lie derivative > . > p ≥ ε() instead of > merely requiring > . > p > 0. > It is instructive to examine the chain of refinements (2) underlying the proof. The first dV< > step refines the initial liveness property from GEx, i.e., that solutions exist globally (so, for at least > 3 > 4 > / 1 > 2 > = 3 > 2 > time), to the property u2 > + v2 > ≤ 1 > 4 > . Subsequent refinement steps can be read off from > the proof steps above: > hαl, t0 > = 1it> > 3 > 2 > dV< > → hαliu2 > + v2 > ≤ > 1 > 4 > Kh&i > → hαliu2 > + v2 > = > 1 > 4 > Mh0i > → hαli > 1 > 4 > ≤k(u, v)k∞≤ > 1 > 2 >
> The latter two steps illustrate the idea behind the next two surveyed proof rules. In the original > presentation [30], the ODE x0 > = f(x) is only assumed to be locally Lipschitz continuous, which is > insufficient for global existence of solutions, making the original rules unsound. See Appendix C > for counterexamples. Domain variants retain the initial target-false and topology requirements. Equational domain variants assume a closed domain and global Lipschitz ODE. Domain staging uses an invariant until not(target-and-domain), a staging set implying the domain, a bounded-above progress quantity and a uniform positive derivative. Example 3 strengthens the nonlinear reachability proof to stay in the closed annulus. A half-open annulus omitting its outer boundary cannot reach the same outer-boundary goal. The final combined rule joins compact staging, a strictly positive higher derivative and domain refinement. Compact eventuality requires Q∧¬P compact and checks conditions on the full region needed by the proof, correcting a narrower surveyed condition. [Evidence: Q11, §5 complete domain arguments and Corollaries11–14, PDF pp.12–14; Q12, §5 complete Example3, Corollaries15–16 and boundary/global-condition discussion, PDF pp.14–15; complete exact passages in quotes.json.] Source (Q11, §5 complete domain arguments and Corollaries11–14): > Axiom DRh·i provides direct generalizations of the proof rules from Section 4 with the following > derivation choosing R ≡ true: > Γ [x0 > = f(x)]Q Γ hx0 > = f(x)iP > DRh·i > Γ hx0 > = f(x) & QiP > This extends all chains of refinements (2) from Section 4 with an additional step: > · · · → hx0 > = f(x)iP > DRh·i > → hx0 > = f(x) & QiP > Liveness arguments become much more intricate when attempting to generalize beyond DRh·i, > e.g., recall the unsound conjecture DRh·i. Indeed, unlike the technical glitches of Section 4, > our survey uncovers subtle soundness-critical errors here. With our deductive approach, these > intricacies are isolated to the topological axioms (Lemma 4) which have been proved sound once > and for all. As before, errors and omissions in the surveyed techniques are highlighted in blue. > 12 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > 5.1 Topological Proof Rules > The first proof rule generalizes differential variants to handle domain constraints: > Corollary 11 (Atomic differential variants with domains [15]). The following proof rule (where < > is either ≥ or >) is derivable in dL. Term ε() is constant for the ODE x0 > = f(x) and the ODE > is globally Lipschitz continuous. Formula Q characterizes a closed (resp. open) set when < is ≥ > (resp. >). > dV<& > Γ [x0 > = f(x) & ¬(p < 0)]Q ¬(p < 0), Q > . > p ≥ ε() > Γ, ε() > 0, ¬(p < 0) hx0 = f(x) & Qip < 0 > Proof Sketch (Appendix B). The derivation uses axiom COR choosing R ≡ true, noting that p ≥ 0 > (resp. p > 0) characterizes a topologically closed (resp. open) set so the appropriate topological > requirements of COR are satisfied: > Γ [x0 > = f(x) & ¬(p < 0)]Q > ¬(p < 0), Q > . > p ≥ ε() > . . . > Γ, ε() > 0 hx0 > = f(x)ip < 0 > COR > Γ, ε() > 0, ¬(p < 0) hx0 > = f(x) & Qip < 0 > The right premise follows similarly to dV< although it uses an intervening dC step to add Q to the > antecedents. > The original presentation of rule dV∗ > < [15] omits the highlighted assumption ¬(p < 0). This > premise is needed for the COR step and the rule is unsound without it. In addition, it uses a form > of syntactic weak negation [15], which is also unsound for open postconditions, as pointed out > earlier [28]. See Appendix C for counterexamples. Our presentation of dV<& recovers soundness > by adding topological restrictions on the domain constraint Q. > The next two corollaries similarly make use of COR to derive the proof rule dVM > = & [30] and > the adapted rule SLyap& [25]. They respectively generalize dVM > = and SLyap from Section 4 to > handle domain constraints. The technical glitches in their original presentations [25, 30], which > were identified in Section 4, remain highlighted here: > Corollary 12 (Equational differential variants with domains [30]). The following proof rules are > derivable in dL. Term ε() is constant for the ODE x0 > = f(x) and the ODE is globally Lipschitz > continuous in both rules. Formula Q characterizes a closed set over variables x. > dV=& > Γ [x0 > = f(x) & p < 0]Q p < 0, Q > . > p ≥ ε() > Γ, ε() > 0, p ≤ 0, Q hx0 = f(x) & Qip = 0 > dVM > = & > Q, p = 0 P Γ [x0 > = f(x) & p < 0]Q p < 0, Q > . > p ≥ ε() > Γ, ε() > 0, p ≤ 0, Q hx0 = f(x) & QiP > Corollary 13 (Set Lyapunov functions with domains [25]). The following proof rule is derivable > in dL. Formula K characterizes a compact set over variables x, while formula P characterizes an > open set over those variables. > SLyap& > p ≥ 0 K ¬P, K > . > p > 0 > Γ, p > 0 hx0 = f(x) & p > 0iP > 13 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > The staging sets with domain constraints proof rule SP& [28] uses axiom SAR: > Corollary 14 (Staging sets with domains [28]). The following proof rule is derivable in dL. Term > ε() is constant for ODE x0 > = f(x) and the ODE is globally Lipschitz continuous. > SP& > Γ [x0 > = f(x) & ¬(P ∧ Q)]S S Q ∧ p ≤ 0 ∧ > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x) & QiP > The rules derived in Corollaries 11–14 demonstrate the flexibility of our refinement approach > for deriving surveyed liveness arguments as proof rules. Our approach is not limited to these sur- > veyed arguments because refinement steps can be freely mixed-and-matched for specific liveness > questions. Appendix C makes the failures concrete. Counterexample 4 adds u′=u², u(0)=1, to v′=1, v(0)=0: blow-up at time 1 prevents v=2 despite constant progress of v. Counterexample 5 begins outside domain u≤1 although target u≥0 holds initially. Counterexample 6 requires u>1 while staying in u≤1. Counterexample 7 starts upward flow u′=0,v′=1 at (0,1), with closed unit-disk domain and open-disk target; coincident boundaries make a surveyed boundary condition vacuous, while the trajectory exits immediately. Counterexample 8 uses an open bounded disk with v=0 removed; upward trajectories from its lower part reach the upper target only after crossing the forbidden slice. The record checked these examples in this source; it did not independently review the earlier publications being criticized. Figure 2 deliberately separates boundaries for visibility and says the actual boundaries coincide. [Evidence: Q21, AppendixC.1 complete Counterexample4 and duration coupling explanation, PDF pp.34–35; Q22, AppendixC.2 complete earlier invalid rule and Counterexamples5–6, PDF pp.35–36; Q23, AppendixC.2 complete quoted Conjecture19, Counterexamples7–8 and Figure2 caption, PDF pp.36–37; complete exact passages in quotes.json.] Source (Q21, AppendixC.1 complete Counterexample4 and duration coupling explanation): > C Counterexamples > This appendix gives explicit counterexamples to illustrate the soundness errors identified in Sec- > tions 4 and 5. > C.1 Finite Time Blow Up > The soundness errors identified in Section 4 all arise because of incorrect handling of the fact > that solutions may blow up in finite time. This phenomenon is illustrated by αn (see Fig. 1), but > occurs even for very simple non-linear ODEs. The following is a counterexample for the original > presentation of dV= (and dVM > = ,dV=&,dVM > = &) [30]. Similar counterexamples can be constructed > for [24, Remark 3.6] and for the original presentation of SLyap,SLyap& [25]. > Counterexample 4. Consider rule dV= without the restriction of global Lipschitz continuity of the > ODE. This unrestricted rule is denoted dV=. It is unsound, as shown by the following derivation > using rule dV= with ε() = 1: > ∗ > R > v − 2 < 0 1 ≥ 1 > dV=v − 2 ≤ 0 hu0 > = u2 > , v0 > = 1iv − 2 = 0 > 34 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > The conclusion of this derivation is not valid. Consider an initial state ω satisfying the formula > u = 1 ∧ v = 0. The explicit solution of the ODE from ω is given by u(t) = 1 > 1−t > , v(t) = t for > t ∈ [0, 1). The solution does not exist beyond the time interval [0, 1) because the u-coordinate > asymptotically approaches ∞, i.e., blows up, as time approaches t = 1. It is impossible to reach a > state satisfying v − 2 = 0 from ω along this solution since at least 2 time units are required. > This counterexample further illustrates the difficulty in handling non-linear ODEs. Neither the > precondition (v − 2 ≤ 0) nor postcondition (v − 2 = 0) mention the variable u, and the ODEs > u0 > = u2 > , v0 > = 1 do not depend on variables v, u respectively. It is tempting to discard the variable > u entirely: indeed, the liveness property v − 2 ≤ 0 → hv0 > = 1iv − 2 = 0 is valid. Yet, for liveness > questions about the (original) ODE u0 > = u2 > , v0 > = 1, the two variables are inextricably linked > through the time axis of solutions to the ODE. Evaluation is mathematical: three worked examples, full proof derivations, semantic axiom arguments and five explicit counterexamples. Table 1 compares the assumptions of surveyed arguments. The report supplies no tested implementation, proof-time table, hardware configuration, empirical user study, LLM benchmark or scaling experiment. Related-work discussion of reachability analysis, optimization and constraint-based search describes other approaches rather than an implementation evaluated here. No independent prover execution was performed for this reading. [Evidence: Q1, §1 complete survey table, claimed corrections and contribution scope, PDF pp.2–3; Q13, §6 complete related-work discussion and automation scope, PDF pp.15–15; Q14, §7 complete conclusion and acknowledgments, PDF pp.15–16; Q16, AppendixB complete proof-scope introduction and Lemma2 derivation, PDF pp.21–21; complete exact passages in quotes.json.] Source (Q1, §1 complete survey table, claimed corrections and contribution scope): > Table 1: Surveyed ODE liveness arguments with our corrections highlighted in blue. The refer- > enced corollaries are our corresponding (corrected) derived proof rules. > Source Without Domain Constraints With Domain Constraints > [15] OK (Cor. 5) if open/closed, initially false (Cor. 11) > [23, 24] [24, Remark 3.6] is incorrect if conditions checked globally (Cor. 16) > [25] if compact (Cor. 10) if compact (Cor. 13) > [28] OK (Cor. 8) OK (Cor. 14) > [30] if globally Lipschitz (Cor. 6) if globally Lipschitz (Cor. 12) > in finite time without leaving the domain of allowed (or safe) states.1 > Deduction of such ODE > liveness properties is hampered by several difficulties: i) solutions of ODEs may converge towards > a goal without ever reaching it, ii) solutions of (non-linear) ODEs may blow up in finite time leav- > ing insufficient time for the desired goal to be reached, and iii) the goal may be reachable but > only by leaving the domain constraint. In contrast, invariance properties for ODEs are better un- > derstood [9, 11] and have a complete dL axiomatization [20]. Motivated by the aforementioned > difficulties, we present dL axioms enabling step-by-step refinement of ODE liveness properties > with a sequence of ODE invariance properties. This brings the full deductive power of dL’s ODE > invariance proof rules to bear on liveness proofs. Our approach is a general framework for under- > standing ODE liveness arguments. We use it to survey several arguments from the literature and > derive them all as (corrected) dL proof rules, see Table 1. This logical presentation has two key > benefits: > • The proof rules are derived from sound axioms of dL, guaranteeing their correctness. Many > of the surveyed arguments contain subtle soundness errors, see Table 1. These errors do not > diminish the surveyed work. Rather, they emphasize the need for an axiomatic, uniform way > of presenting and analyzing ODE liveness arguments rather than ad hoc approaches. > • The approach identifies common refinement steps that form a basis for the surveyed liveness > arguments. This library of building blocks enables sound development and justification of > new ODE liveness proof rules, e.g., by generalizing individual refinement steps or by explor- > ing different combinations of those steps. Corollaries 7, 9, and 15 are examples of new ODE > liveness proof rules that can be derived and justified using our uniform approach. > All proofs are in Appendix A and B. Counterexamples for the soundness errors in Table 1 are > given in Appendix C. > 2 Background > This section reviews the syntax and semantics of dL, focusing on its continuous fragment which > has a complete axiomatization for ODE invariants [20]. Full presentations of dL, including its > 1 > This property has also been called, e.g., eventuality [24, 28] and reachability [30]. To minimize ambiguity, this > paper refers to the property as liveness, with a precise formal definition in Section 2. Other advanced notions of > liveness for ODEs are discussed in Section 6, although their formal deduction is left for future work. > 2 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > discrete fragment, are available elsewhere [17, 19]. > 2.1 Syntax > -1 0 1 u For the requested topic, the paper contributes precise obligations for progress proofs: enough evolution duration, legal domain endpoints, uniform progress and compactness. It illustrates why safety reasoning alone needs a justified bridge to reachability. Reader proposals, not author results: generated proofs could be tested against the independent blow-up coordinate and forbidden-boundary cases, requiring repairs that preserve the stated property. TLA+ finite abstractions or Verus code would need a separate relation to continuous real trajectories. This report contains no TLA+, Verus/verified Rust or LLM result and does not prove distributed fairness or eventual message delivery. [Evidence: Q2, §2.1–2.2 complete syntax, standing ODEs and semantics, PDF pp.3–5; Q21, AppendixC.1 complete Counterexample4 and duration coupling explanation, PDF pp.34–35; Q22, AppendixC.2 complete earlier invalid rule and Counterexamples5–6, PDF pp.35–36; Q23, AppendixC.2 complete quoted Conjecture19, Counterexamples7–8 and Figure2 caption, PDF pp.36–37; complete exact passages in quotes.json.] PDF-checked mathematical transcriptions (reader transcriptions, not raw quotations): §2.1 and §4.1, generic comparisons (PDF pp.3,8): Write ≽ for the paper’s generic comparison: either ≥ or >; its dual is either ≤ or <. Thus p≽0 does not mean p<0. See the comparison convention on PDF p.3 and Corollary5 on p.8. §4.2 Corollary10 (PDF pp.12): K is compact and P open. The premises are p≥0 ⊢ K and ¬P,K ⊢ p-dot>0. The conclusion is Γ,p≽0 ⊢ ⟨x′=f(x)⟩P, with the generic ≽ meaning either ≥ or >. The raw extraction’s p<0 in this conclusion is not the printed condition. AppendixC.2 Conjecture19 (PDF pp.36): Let f∈C(Rⁿ,Rⁿ); bounded X,X₀,Xᵣ with X₀⊆X and Xᵣ⊆X; B∈C¹(Rⁿ). Conditions: (6) B(x)≤0 for x∈X₀; (7) B(x)>0 for x∈closure(∂X ∖ ∂Xᵣ); (8) (∂B/∂x)f(x)<0 for x∈closure(X ∖ Xᵣ). Claimed conclusion: for every x₀∈X₀ there is T≥0 with x(T)∈Xᵣ and x(t)∈X for all t∈[0,T]. Here closure(S) is the smallest closed set containing S, and ∂S its topological boundary. The overbar covers the whole difference in each of (7) and (8). This is a source conjecture that Counterexamples7–8 refute, not an accepted rule.
  • limits: Autonomous polynomial ODEs over reals with unique maximal local solutions, finite diamond reachability and endpoint-inclusive evolution domains. Global Lipschitz assumptions for several variant/staging rules; bounded/compact staging supplies alternative duration reasoning. Fresh clocks, constant contexts, rule-specific topology and uniform progress conditions. No independent prover execution, implementation study, LLM benchmark or distributed fairness result. Counterexamples checked in this source; earlier criticized originals not independently reviewed. Invariant completeness does not imply general liveness completeness.
  • how much was read: most of it read
  • source
  • record id: an-axiomatic-approach-to-2019
• Characteristic Formulae for Liveness Properties of Non-Terminating CakeML Programs (2019)
  • what: Extends CakeML characteristic formulae and Hoare triples to prove total-correctness liveness properties of diverging programs. Divergent results carry lazy I/O traces; a clocked big-step semantics defines divergence as timeout at every clock and the supremum of finite-clock I/O prefixes. A transfinite-induction rule for repeat loops reduces proofs to terminating loop-body triples plus a limit-stream equation. A verified source transformation rewrites tail-recursive functions to repeat form. The framework is mechanized in HOL4 and integrated with CakeML. The semantics adds Div and FFIDiv results and POSTd predicates while preserving local separation reasoning. The repeat rule has base, successor and limit cases and a limited_parts side condition controlling all FFI resources. The transformation injects a runtime error in non-tail return branches so a transformed terminating function cannot be incorrectly treated as diverging; it is proved sound only for POSTd. Examples include silent pureLoop, conditional condLoop, infinite/finite catLoop over lazy input, cyclic pointerLoop, uncurried myRepeat, and a seL4 UAV filter. The filter proof shrinks from 1,971 lines of direct operational-semantics HOL to 1,479 lines with CF and yields an operational theorem; compiler liveness transfer remains conditional on no out-of-memory.
  • number: {‘printed_pages’: 19, ‘filter_cf_hol_lines’: 1479, ‘filter_direct_hol_lines’: 1971, ‘filter_message_bound’: 256, ‘myrepeat_proof_lines’: 8, ‘cat_proof_approx_lines’: 90}
  • limits: Divergence semantics is a supremum of I/O traces over all clock values; divergent runs have no final heap state. The repeat transformation currently handles single-argument tail-recursive, non-mutually-recursive functions; mutual recursion, curried/multiple arguments and recursion through store are future work. The induction principle requires limited_parts to bound possible FFI calls and user proofs of each terminating iteration and the infinite trace equation. The seL4 filter assumes infinite input, null termination and message length ≤256; the paper says the communication backend enforces these. Binary liveness after CakeML compilation is conditional on not running out of memory; no unconditional space bound is proved here. Formal results are HOL4/CakeML proofs, not Verus/Rust or TLA+ specifications and not LLM-generated proofs.
  • how much was read: most of it read
  • record id: characteristic-formulae-for-liveness-2019
• CockroachDB Parallel Commits blog (2019)
  • title: Parallel Commits: An atomic commit protocol for globally distributed transactions
  • what: CockroachDB describes formalizing Parallel Commits in TLA+, checking atomicity, durability and an eventual explicit-commit property under coordinator failures, and publishing the model for readers to run.
  • limits: Engineering blog; model properties and assumptions are described by the authors and were not independently rerun.
  • how much was read: most of it read
  • source
  • record id: cockroachdb-parallel-commits-blog-2019
• IBFT 2.0 (2019)
  • title: IBFT 2.0: A Safe and Live Variation of the IBFT Blockchain Consensus Protocol for Eventually Synchronous Networks
  • what: Defines the IBFT 2.0 proof-of-authority BFT protocol with immediate finality, dynamic validator sets, and eventual-synchrony robustness. It gives pseudocode and a high-level lemma-based proof of optimal safety, persistence, weak liveness, and (with a fair-network probability assumption) liveness for up to floor((n−1)/3) Byzantine validators. The protocol removes IBFT locking and relies on prepared certificates, round-change certificates, and quorum commit seals. Height-tagged messages make lagging nodes request missing finalized blocks, addressing persistence. Safety derives from quorum intersections and induction over rounds (Lemmas 1–7); weak liveness derives from exponential round timers and eventual synchrony (Lemmas 8–17). Full liveness additionally assumes every sent message has positive probability of delivery within one-third of the initial timeout, then uses round-robin proposer selection and stable validator windows (Lemmas 18–23). The paper proposes ten concrete improvements, including fair proposer selection to remove the probabilistic assumption, two-phase fast path, quorum-triggered round advancement, hash certificates, reduced signatures, and aggregate signatures.
  • number: f(n)=floor((n−1)/3)
  • number: Quorum(n)=ceil(2n/3)
  • number: 4Δ synchrony window in Lemma 16
  • number: two-phase fast path claims 33% latency reduction
  • limits: Eventually synchronous gossip after GST with fixed delay Δ; cryptographic hash collision resistance and signature uniqueness/unforgeability; at most floor((n−1)/3) Byzantine validators per height; honest chains agree through h−1. Liveness (as distinct from weak liveness) depends on Fair Network Behaviour Assumption unless FairProposer is adopted. Formal specification and implementation details are explicitly future work; validator voting pseudocode is omitted.
  • how much was read: most of it read
  • record id: ibft-2-0-2019
• Ivy liveness-to-safety (2018)
  • title: Reducing liveness to safety in first-order logic
  • what: After a finite prefix of an execution, picks a finite projection of the state (the freeze point). Proves that no two later states can agree on that projection while all fairness obligations are met. This turns a progress proof into a safety proof about a finite bad pattern. Cases: ticket, alternating bit, TLB shootdown, Paxos, Multi-Paxos, Stoppable Paxos.
  • number: finding the invariants ‘requires a sophisticated user’; conjecture counts for liveness are ‘2 - 4 times higher’ than for safety (§7.2, pp.26:27-28)
  • number: six cases: ticket protocol, alternating bit, TLB shootdown, Paxos, Multi-Paxos, Stoppable Paxos
  • number: checking takes 3.7 to 219 seconds excluding invariant discovery
  • number: liveness needs two to four times as many invariant conjectures as safety (§7.2)
  • limits: The user still supplies the inductive invariants (facts preserved by every step). Humans applied the reduction by hand. Paxos assumes that the actions of a chosen leader or quorum are fair, that messages are eventually delivered, and that competing proposals eventually stop. Multi-Paxos and Stoppable Paxos cover one incarnation with fixed membership. The comparison counts invariants, not person-time.
  • how much was read: most of it read
  • source; notes: Ivy: dynamic abstraction and temporal prophecy
  • record id: ivy-liveness-to-safety-2018
• Symbolic liveness analysis (2018)
  • title: Symbolic Liveness Analysis of Real-World Software
  • what: Defines a generic liveness property for real-world programs—eventually consuming input or terminating—and implements symbolic lasso detection in KLEE to find violations. The paper formalizes transition systems with productive actions, deterministic computation except for input, and finite memory; it proves that any violating trace has a finite stem followed by a non-productive cycle. The implementation tracks per-path state fingerprints (register/memory fragments plus serialized path constraints), uses symbolic execution to cover input space, and reports concrete reproducing inputs. Evaluation covers GNU Coreutils, BusyBox and toybox, including interpreter behavior in sed, runaway counters, allocation-sensitive pointers and state explosion. Five previously unknown defects (three Coreutils, two BusyBox) were confirmed and fixed; all reported violations had concrete witnesses.
  • number: 354 tools evaluated
  • number: 5 previously unknown defects: 3 Coreutils and 2 BusyBox
  • number: BusyBox hush violation 71.73±5.00 s over 30 runs
  • number: toybox sed violation 4.99±0.25 min
  • limits: Target machines are deterministic apart from input, have finite memory, and input functions provide at least one bit; terminal states are modeled as productive self-loops. The method can miss cycles involving huge counters, repeated allocations whose addresses change, and equivalent symbolic states whose serialized names differ. It inherits symbolic-execution path explosion and repeated SMT solving; sed reports intentional/interpreter-related violations and yes intentionally loops forever.
  • how much was read: most of it read
  • record id: symbolic-liveness-analysis-2018
• XRP Ledger Consensus Protocol analysis (2018)
  • title: Analysis of the XRP Ledger Consensus Protocol
  • what: Gives a formal network model and safety/liveness analysis of XRP Ledger Consensus Protocol (XRP LCP), a Byzantine agreement protocol operating with individually chosen trusted node lists (UNLs). Defines nodes, asymmetric UNLs, quorum qi=ceil(.8ni), tolerated faults ti, ledgers and atomic-broadcast properties. It decomposes XRP LCP into deliberation, validation and preferred-branch components and provides pseudocode. Lemmas and propositions derive overlap conditions for ledger agreement: validation propagation through honest-majority support yields Theorem 8’s pairwise overlap bound. A constructed 102-node example shows that even 99% overlap can get stuck; Lemma 10 and Theorem 11 establish progress for a single agreed UNL with leaf validators under bounded-delay/no-fault rounds.
  • number: Theorem 8 safety condition: O_i,j > n_j/2 + n_i − q_i + t_i,j for every pair
  • number: with 80% quorums and 20% faults, roughly >90% UNL overlap is required
  • number: Example 9 demonstrates no progress despite 99% overlap and zero Byzantine faults
  • number: Theorem 11 guarantees no stuck state for a single agreed UNL of size at least k with q=n−floor((n−1)/k) plus leaves
  • limits: Safety is intended under arbitrary message asynchrony but assumes authenticated reliable channels and computationally bounded adversaries. Liveness only assumes eventual civil network delivery and no faulty nodes; FLP rules out full-asynchrony progress. Early analysis uses Byzantine accountability, explicitly rejected as tenuous; the broad theorem treats arbitrary deliberation outcomes, making the overlap condition sufficient rather than necessary. Results concern protocol rules and parameterized trust topology, not a measured deployment.
  • how much was read: most of it read
  • record id: xrp-ledger-consensus-protocol-analysis-2018
• alpha-L2S (2016)
  • title: Infinite-State Liveness-to-Safety via Implicit Abstraction and Well-Founded Relations
  • what: alpha-L2S checks that an infinite-state system eventually does something good (liveness). It reduces that question to a safety question, where nothing bad ever happens. It learns the needed predicates and ranking functions (measures that shrink toward the goal) by refining an abstraction. It is the direct predecessor of rlive and its baseline.
  • number: Fig 4: L2Sia-wfr solved 602 (477 valid, 125 violated) vs Ultimate-LTL 263 (185, 78)
  • number: timeout 1200 s, memory 6 GB
  • number: on 193 termination benchmarks T2 solves 191 vs 152 for this method
  • number: 835 total LTL instances
  • limits: It checks liveness on a model. Its benchmarks come from programs, so they test translated program semantics, not the programs themselves.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: αL2S
  • record id: alpha-l2s-2016
• CCSroll safety and liveness (2016)
  • title: A Safety and Liveness Theory for Total Reversibility?
  • what: Defines CCSroll, a CCS extension with totally ordered keyed reductions and programmed rollback, and characterizes safety and liveness preorders using forward traces, rollback barbs and tree refusals. The syntax/semantics records memories and dependency histories so a rollback of key k deterministically returns all later reductions to the state before k. The authors prove rollback determinism and rollback/forward correspondence, then identify two semantic properties enabling forward-only reasoning. Observable trace inclusion is shown sound and complete for inverse may-testing safety; a rollback-aware tree-refusal model is sound and complete for should-testing liveness. Examples M1–M6 show safety conservatively extends CCS while rollback distinguishes systems that CCS cannot distinguish; the paper also gives compositional LTS, trace zipping/unzipping, and characteristic tests.
  • number: two semantic properties underpin forward models
  • number: Theorem 1 safety conservativity
  • number: Theorem 3 trace soundness/completeness
  • number: Theorem 4 refusal soundness/completeness
  • limits: CCSroll reductions are totally ordered, rollback is controlled by explicit rlh keys, and proofs rely on the two stated reachability properties, including the difficult liveness property. Liveness should-testing is justified under a fairness assumption that infinitely enabled outputs eventually happen. Results are semantic theorems, not mechanized proofs or implementation measurements; the authors leave applicability of the second property to other causal-reversibility calculi open. The theory concerns CCS-like processes and does not model data, failures or real distributed timing.
  • how much was read: most of it read
  • record id: ccsroll-safety-and-liveness-2016
• Debois Hildebrandt Slaats Yoshida session liveness (2016)
  • title: Type-Checking Liveness for Collaborative Processes with Bounded and Unbounded Recursion
  • what: Extends binary session types with required-response annotations and a typing system for a process calculus with communication, internal/external branching, bounded iteration, and unbounded recursion. It proves that lock-free well-typed processes satisfy request-response liveness without state-space exploration. Defines response-aware labeled transition systems and responsive traces; proves strict language expressiveness over standard session types using a type requiring both labels infinitely often; gives subject reduction and liveness typing rules tracking accumulated selections, invariants, and pending obligations through recursion and conditionals. The main proof uses syntactic under-approximation A(P), decomposition of parallel traces, fairness/lock-freedom, and shows every requested response eventually appears. A shopping-cart/invoice process and an infinite-state data object illustrate checkout→invoice and write→read obligations.
  • number: strict inclusion of standard session-type languages in response-type languages
  • number: Theorem 6.19 liveness under lock-freedom
  • number: request/response labels AI, RI, CO, DI, SI in shopping-cart example
  • limits: Binary sessions only, no delegation/name passing or multi-party extension. Liveness theorem explicitly assumes process lock-freedom; typing recursive processes requires guessing suitable invariants. Data-dependent unbounded loops are not inferred automatically; bounded iteration is used to remove a dependency. The calculus abstracts BPMN and omits value types. No implementation benchmark or empirical evaluation; evidence is formal definitions, examples, and proofs.
  • how much was read: most of it read
  • record id: debois-hildebrandt-slaats-yoshida-session-liveness-2016
• short counterexample FTDA (2016)
  • title: A Short Counterexample Property for Safety and Liveness Verification of Fault-Tolerant Distributed Algorithms
  • what: Develops a short-counterexample property: violations of temporal specifications in threshold-guarded fault-tolerant algorithms have bounded representative counterexamples, enabling automated parameterized checking. The method models protocols as counter systems with threshold guards, searches steady schedules and short representative executions, and handles fairness for liveness. It gives reduction arguments for shortening schedules and completeness conditions for the search bound, targeting parameterized process/fault counts.
  • number: Method is automated and parameterized; representative schedule search is bounded
  • number: No concise runtime totals exposed in supplied extraction
  • number: 10 prominent fault-tolerant distributed algorithms verified
  • number: Counterexample length is bounded independently of process parameters
  • limits: The bound and completeness arguments rely on threshold-guarded, symmetric protocols and fairness assumptions. Liveness search requires schedule bounds; failure to find a short trace does not prove correctness outside the theorem’s class.
  • how much was read: most of it read
  • source
  • record id: short-counterexample-ftda-2016
• SLRP liveness synthesis (2016)
  • title: Liveness of Randomised Parameterised Systems under Arbitrary Schedulers
  • what: Presents a fully automatic CEGAR method for liveness of randomised parameterised systems under arbitrary schedulers by reducing probabilistic protocols to two-player reachability games and synthesising regular progress relations with L*-learning and SAT. The method ignores nonzero probability values, retaining transition topology, and represents configurations as words with length-preserving transducers. Regular advice bits consist of an inductive reachable over-approximation and a well-founded progress relation; VERIFY checks four conditions while SYNTHESISE searches deterministic automata via SAT and eliminates counterexamples. An incremental variant composes disjunctive advice, refines reachable/winning sets, learns inductive invariants, and exploits automorphisms such as ring rotation. Soundness follows from the advice conditions; a completeness claim is given under existence of regular advice, minimum-length selection and minimum automata.
  • number: Lehmann–Rabin requires incremental plus invariant and rotation symmetry: 10 minutes versus 48 minutes without invariant
  • number: Israeli–Jalfon takes 9.7 s with all optimisations; Herman 1.5 s monolithic
  • number: Szymanski monolithic takes 5.7 s while incremental takes 27 min
  • number: Lehmann–Rabin run uses 23-state reachable DFA, 25 progress pairs and 4,324 refinement iterations
  • limits: Each finite instance is treated as an MDP whose liveness depends only on transition topology, so actual nonzero probabilities are abstracted away; this proves almost-sure reachability only under the chosen scheduler/game interpretation. Systems are encoded by finite-state letter-to-letter transducers, excluding non-length-preserving/data-rich protocols; fairness is not handled and is future work. Results are proof-of-concept on finite benchmark encodings, with hard-coded invariant precision n=5 and substantial SAT/refinement cost for complex cases.
  • how much was read: most of it read
  • record id: slrp-liveness-synthesis-2016
• T2 (2016)
  • title: T2: Temporal Property Verification
  • what: Presents the open-source T2 framework, translating C/LLVM or native integer transition systems into safety, termination and temporal-logic proofs for CTL, Fair-CTL, CTL* and LTL reductions. T2 front-end builds location/transition graphs and uses LLVM simplifications. Safety proving uses Impact, Z3 GPDR or Spacer via linear Horn clauses. Termination alternates safety checks with lexicographic ranking-function synthesis and counterexample refinement; preprocessing removes directly provable loops (about 80%). Nontermination searches recurrent sets. CTL uses bottom-up precondition synthesis; Fair-CTL uses prophecy variables to reduce fairness; CTL* uses explicit future-outcome variables and is incomplete. Machine integer overflow is handled by normalization in the C front-end.
  • number: Termination benchmark timeout 300 s: AProVE 641 terminating/393 nonterminating/188 fail, avg 49.1 s; T2-GPDR 627/442/153, avg 23.6 s; T2-GPDR-NoP 589/438/195, 31.4 s; Spacer-NoP 591/429/202, 33.5 s; Impact-NoP 529/452/241, 37.2 s. Preprocessing removes ~80% loops. CTL 56/56 examples solved; T2 average 2.7 s vs Q’ARMC 3.6 s (100 s timeout).
  • limits: Core analysis supports only linear integer arithmetic fragments of C/native systems; numbers are mathematical integers unless front-end normalization handles machine overflow. Heap, recursion and concurrency are future work. Fair-CTL is relatively complete only relative to safety/termination procedures; CTL* is incomplete. Temporal experiments exclude Fair-CTL/CTL* due to lack of competing tools.
  • how much was read: most of it read
  • source
  • record id: t2-2016
• Automatic Completion of Distributed Protocols with Symmetry. (2015)
  • what: # Automatic Completion of Distributed Protocols with Symmetry (authored by agents unless marked 🧑) Rajeev Alur, Mukund Raghothaman, Christos Stergiou, Stavros Tripakis and Abhishek Udupa, arXiv:1505.04409v1. The arXiv comments identify this as the “Full version of paper presented at CAV 2015.” The paper gives a solver-and-model-checker loop that fills missing guards and state updates in finite distributed protocol sketches, requiring determinism, symmetry, deadlock freedom, safety and liveness under supplied fairness assumptions. Its empirical results cover Peterson mutual exclusion, a four-process self-stabilizing line, and five missing cache-coherence corner cases. Guaranteed correctness is explicitly limited to the finite synthesized instance (Q1,Q2,Q6,Q13,W1,W2). ## Reading and evidence scope Read all 21 pages, sections 1–6, all displayed definitions/formulas, nine figures, the complete five-row Table 1, and all 31 bibliography entries. There is no appendix, checklist, numbered theorem/proof or numbered pseudocode algorithm. Figure 2 is the synthesis workflow; §4 gives textual algorithms. Individually inspected page renders 3,8,11,13,14,15,16,17,18,19, covering every figure, the table, protocol diagrams and the weakest-precondition formula. This does not claim visual inspection of all pages. References were read as bibliography entries, not recursively followed. Retained the inventory PDF, raw/layout extractions and official arXiv metadata. The paper says the custom model checker is planned for future public release; it supplies no implementation URL. No implementation/model files or historical logs were acquired or read. A web-search tool request for code returned an error without results; this is not evidence that no code exists. No author contacted, author code executed/imported, checker/solver rerun, or model/checkpoint/serialized experiment data loaded. Source versions and reported runs were not independently reproduced (Q8,W1). ## Problem and modeling assumptions The designer provides extended state-machine sketches, not just an English request or temporal goal. Each process has finite control locations, finite typed variables/channels, an initial valuation, known and unknown typed functions, guarded transitions and fairness sets. All type cardinalities are required finite, including process-identity symmetric types and array domains. A completed function is initially a finite interpretation table. The environment is another specified machine with no unknown functions (Q3,Q4,Q6). Composition synchronizes matching output/input channels and sequences their updates so the receiver sees the transmitted value; independent internal actions interleave. Buffered unordered communication in the cache example is modeled within these finite-state machines, not assumed to be an unbounded reliable network. The formal product assumes disjoint process state variables and output ownership. Safety means no reachable error location. Liveness means no infinite fair accepting run of the supplied monitors; deadlock freedom is separate. Thus a finite deadlock cannot pass just because no infinite violating run exists (Q3,Q4). Weak fairness applies to a set of transitions: either the whole set is disabled infinitely often or some member occurs infinitely often. Strong fairness requires that a set enabled infinitely often has a member taken infinitely often. Fairness sets are attached to output/internal transitions; input behavior depends on the environment/composition. These assumptions matter to the guarantees. The paper argues that using only safety in synthesis permits trivial solutions that disable progress (Q2,Q3). Symmetry means behavior is invariant under renaming values of the designated types. Permutations act on array entries and indices, channel/process parameters and states. Unknown functions are constrained to commute with renaming, f(π(d))=π(f(d)). This is stronger than merely using the same source text while permitting special treatment of one numeric identity. Quantifiers are expanded over finite domains for the solver. The discussion mentions other symmetry notions as possible extensions; the implementation/evaluation described uses the stated finite symmetry treatment (Q5,Q7). The designer can restrict signatures to exclude irrelevant variables, fix known read-only updates, and add constraints across functions. The formal completion requires deterministic individual machines, a symmetric product, satisfaction of initial constraints, and a deadlock-free/safe/live composition. Determinism allows simultaneous input transitions only on distinct input channels. Guarantees concern that chosen environment, monitor and fairness model, not every implementation of the informal protocol name (Q6,Q7). ## Algorithm and what its checks establish The synthesis loop asks Z3 for interpretations satisfying current constraints, instantiates the protocol, then model-checks it. An erroneous candidate yields further necessary conditions excluding its counterexample or repairing the reason it violates the property. A successful interpretation may subsequently be converted to a symbolic expression using an enumerative syntax-guided synthesis solver. A symbolic grammar/output is therefore a later step; the initial solver does not directly synthesize arbitrary program syntax (Q6,Q10,Q13). The custom checker combines a symmetry-reduced annotated quotient graph with permutation tracking in a threaded graph, then searches accepting strongly connected components under fairness. Tracking the renaming matters because a compressed path can stand for multiple original paths and fairness obligations must be adjusted accordingly. The described procedure removes states enabling unmet strong-fairness sets and recomputes components until it finds a fair accepting cycle or rules one out. The authors build on cited algorithms and describe the search as sound and complete; this paper supplies no separate numbered soundness/completeness proof or implementation certification. Their historical limitations of Spin, Murphi, SMC and NuSMV are reports about their tool attempts, not a current feature comparison (Q8). For a deadlock, the next candidate must block the witnessed path or enable some outgoing action at its end. For a safety trace it must block the error path. The paper compiles product transitions to guarded commands, coalesces assignments and computes weakest preconditions; a guarded-command obligation uses guard implication, so a disabled step can break the trace. For liveness, a stem/cycle witness must become infeasible, fail to close, or become unfair. The Peterson example shows why simply banning the waiting loop is too strong: enabling a continuously neglected critical transition can make that loop unfair under the given fairness assumption (Q9,Q10). There is a printed indexing problem worth preserving without treating it as an implementation defect. §4.3 indexes a trace cmd1,…,cmdn but defines pre_i using cmd_(n−i−1). With n=1 and i=1 this refers to cmd_−1 rather than the sole command. The intended reverse traversal would require a corrected index/convention; no source code was available to determine what the implementation uses. The rendered page 11 confirms the printed formula. The liveness recurrence also reuses notation inconsistently around the named union of fairness sets. These are presentation limits on mechanically following the text, not reproduced failures of the tool (Q10,D1). Search heuristics prefer each error path to exercise few unknown functions while choosing diverse paths that collectively cover many. Shorter unknown-function dependencies can give stronger pruning constraints. Candidate costs favor minimally permissive guards, unchanged updates, then fewer input dependencies; bounds relax when the solver cannot satisfy them. Such constraints are search guidance, not protocol requirements. They strongly affect runtime, and Dijkstra required a different guard heuristic. No controlled ablation quantifies each optimization’s benefit (Q11,Q12). ## Concrete cases Peterson has two processes with my/other identity parameters, shared flag/turn variables, a critical-section safety condition and a starvation monitor. Figure 1 removes the waiting/critical guards; the experiment additionally leaves flag-update expressions unspecified and requires that at least one guard hold. Weak fairness of selected non-input transitions suffices for the stated monitor. The authors report an interpretation in under one second and expressions matching the known protocol. Table 1 reports three unknown functions; this count is retained as printed rather than inferred by counting the distinct update sites mentioned in prose (Q3,Q12,T1). The self-stabilizing case is four processes in a line, each with Boolean x/up state. The two middle processes have two unknown guarded commands, each with two unknown updates; corresponding middle-process completions must be identical. A legitimate state has exactly one globally enabled guarded command. The specification requires reaching legitimate states from arbitrary starts, staying legitimate thereafter, and reachability among legitimate states. The successful expressions match Dijkstra’s displayed rules. This is synthesis/verification for N=4; the general-N illustration is not itself a parameterized correctness proof (Q12). German/MSI has a directory, symmetric caches and one environment per cache; permissions are invalid/shared/exclusive. Its variant adds direct cache-to-cache data/acknowledgment, silent shared eviction and coordinated exclusive eviction. These optimizations create interactions absent from the simpler base protocol. One explicit race has a directory still listing a silently evicted cache as a sharer: that cache has already requested exclusive ownership when it receives an invalidation for another requester, and must acknowledge the invalidation despite its transient state. Two related races vary the pending read/write request (Q12,Q14). Two remaining missing behaviors arise when exclusive eviction/writeback races with another cache’s request: the cache receives an unexpected invalidation, while the directory receives unexpected writeback. The synthesized behavior treats the invalidation like a writeback acknowledgment for the evicting cache; the directory accepts the latest data and forwards it to the requester without requiring an extra acknowledgment. Figures 8/9 mark the missing behaviors and recovery messages. The designer still specifies which message kinds each unknown state must handle; §5.4 says this assistance was crucial to scaling. This is completion of supplied protocol structure, not autonomous discovery of all states, messages or correctness requirements (Q14,Q15). ## Measured results and limits Table 1 reports five configurations. Peterson: 3 unknown functions, search space 2^36, 60 states, 14 iterations, 97 ms SMT and 130 ms total. Dijkstra: 6 functions, 2^192 possibilities, about 2,000 states, 30 iterations, 27 s SMT and 64 s total. German/MSI-2: 16 functions, about 2^4700 possibilities, about 20,000 symmetry-reduced states, 217 iterations, 31 s SMT and 298 s total. German/MSI-4: 28 functions, about 2^7614, about 20,000 reduced states, 419 iterations, 898 s SMT and 1,545 s total. German/MSI-5: 34 functions, about 2^9000, about 20,000 reduced states, 525 iterations, 2,261 s SMT and 3,410 s total. The exponents were checked in the page render because the extraction flattens superscripts (T1). The suffix -n counts the missing transitions among five corner cases, not the number of caches. The paper does not state the exact cache-count/channel-capacity/value-domain configuration used for these rows, preventing a precise independent reconstruction from the paper alone. All runs use a Linux desktop with a 3.4 GHz Intel Core i7 and 8 GB memory. Multiple SMT seeds were run and the worst runtimes reported, but the number of seeds, dispersion and exact tool versions are absent. There is no broad benchmark population or matched competing-system comparison. Long cases spend much time solving heuristic constraints; German/MSI-5’s SMT fraction is 2261/3410≈66.3%, a reader calculation, not a new measurement (Q15,T1,D2). The authors say synthesized symbolic expressions were parametric and worked on larger instances, but explicitly qualify that interpretations are “only guaranteed to be correct for the finite instance of the protocol”. No sizes/results for the larger checks or cutoff/induction proof is supplied. Symmetry reduces a fixed instance’s state graph; it does not by itself prove correctness for every process count. Nor do these finite-state experiments establish crash/Byzantine tolerance or machine-code correctness (Q13). ## Contribution to the requested topics This is directly relevant distributed-protocol synthesis with safety and liveness checking, predating LLM-based agents. Its distinctive combination is finite extended state sketches, symmetry constraints, fine transition-set fairness, and automatically generated counterexample constraints. Its related-work claims distinguish earlier scenario completion, safety-only concurrent sketching, and template-based self-stabilization; these comparisons are attributed to the authors, without independently reading those cited works (Q2). For Verus/TLA+/LLM-agent work, the transfer is a reader proposal: preserve explicit environment/fairness assumptions, use deadlocks and fair cycles as separate feedback, constrain identity symmetry and keep programmer-supplied structure visible in evaluation. An SMT table, a readable symbolic expression, a finite checked instance and a general verified protocol are different outputs. The paper measures the first stages and fixed-instance checks; it contains no Verus/Rust development, TLA+ model, LLM agent or general parameterized proof.
  • limits: Allfinite types;specifiedenvironment/monitors/fairness;humanprovidedstates/messagekinds;fixedinstancecorrectness;unknowncachecapacities/version/seeds;noimplementationread/rerun;printedrecurrenceindexproblemnotcodefailure.
  • how much was read: most of it read
  • source
  • record id: automatic-completion-of-distributed-2015
• Fairness Modulo Theory LTL checking (2015)
  • title: Fairness Modulo Theory: A New Approach to LTL Software Model Checking
  • what: Introduces Fairness Modulo Theory, reducing LTL software verification to absence of feasible fair paths in a Büchi program and prioritizing finite-prefix infeasibility proofs before expensive infinite-path ranking proofs. Ultimate LTLAutomizer implements the CEGAR loop with SMT trace abstraction and termination analysis. The paper defines Büchi programs/products and proves that P satisfies φ iff the product with A¬φ has no trace both fair and feasible. The algorithm maintains an automaton of known infeasible fair traces, checks stem/loop/concatenated finite prefixes, then invokes ranking synthesis only when needed; refineF and refineω generalize proofs. Implementation uses ACSL C parsing, LTL2BA, trace abstraction, ranking synthesis and Büchi automata operations. It reports benchmark behavior on Windows/PostgreSQL/Apache, RERS and coolant sets, including product-size and refinement observations.
  • number: most comparison benchmarks solved under five seconds
  • number: 20-minute timeout and 8 GB memory for authors’ runs; prior Term/DP data used four-hour timeout
  • number: roughly 43% of RERS benchmarks verified without modifications
  • number: Büchi product blow-up no more than four times on reported sets
  • limits: Finite-prefix feasibility and termination analyses are generally undecidable and can time out, yielding unknown. The approach depends on Büchi automaton translation and SMT theories, and ranking synthesis remains necessary for traces with no infeasible finite prefix. RERS verification succeeded on roughly 43% without modifications; a product optimization bug caused most abnormal results, and one Windows benchmark had undefined variables. Results are tool/benchmark dependent.
  • how much was read: most of it read
  • record id: fairness-modulo-theory-ltl-checking-2015
• IronFleet (2015)
  • title: IronFleet: Proving Practical Distributed Systems Correct
  • what: It proves a replicated state machine (IronRSL) and a sharded key-value store (IronKV) correct, down to Dafny code. The liveness proofs are built by chaining intermediate progress conditions.
  • number: 1,400 specification, 5,114 implementation, 39,253 proof lines; 395 minutes to check
  • number: IronRSL liveness: 7,869 proof lines, 115 minutes; IronKV liveness: 2,093 lines, 23 minutes
  • number: about 3.7 person-years
  • number: implementation-level proof/code ratio 3.6
  • limits: The top-level spec, event loop, Dafny, runtime, OS and hardware are trusted. IronRSL liveness needs eventual timing bounds and a live quorum. The reduction argument is on paper.
  • how much was read: most of it read
  • source; notes: S8
  • record id: ironfleet-2015
• LTL distributed synthesis (2015)
  • title: Synthesis of Self-Stabilising and Byzantine-Resilient Distributed Systems
  • what: Synthesizes synchronous fault-tolerant distributed algorithms from LTL specifications, covering strong self-stabilization and Byzantine faults. Fixed-size bounded synthesis is complete for realizable specifications and optimizes implementation size and stabilization time. Defines universal transition systems, local transition systems and a bounded-synthesis SMT encoding. Byzantine synthesis uses an incremental CEGIS-like loop with error traces. The paper proves completeness for fixed network size, presents sufficient classes for arbitrary network-size correctness, and reproduces Dolev two-counting while extending to n-counting. Colorless specifications and majority-based abstraction support parameterized reasoning.
  • number: fixed-size synthesis complete for realizable specs
  • number: two classes with arbitrary-size correctness
  • number: n-counting extension beyond 2-counting
  • number: 64 GiB/8-core evaluation hardware
  • limits: Synchronous reactive processes with finite local state and a specified communication/failure model. Fixed-size completeness does not imply arbitrary-size correctness; the two arbitrary-size classes require stated structural hypotheses. Byzantine synthesis can be expensive; experiments use sequential solver runs and finite bounds. LTL specifications capture the modeled behavior, not physical network timing or implementation bugs.
  • how much was read: most of it read
  • source
  • record id: ltl-distributed-synthesis-2015
• Parallel explicit generalized Büchi checking (2015)
  • title: Parallel Explicit Model Checking for Generalized Büchi Automata
  • what: Develops parallel Tarjan- and Dijkstra-style SCC emptiness checks for transition-based generalized Büchi automata. Threads swarm DFS traversals while sharing only stable SCC/dead-state structure through a lock-free union-find augmented with acceptance marks; a mixed portfolio combines both strategies. The generic canvas defines shared stop/union-find state and local DFS, LIVE, livenum, and pstack structures. Tarjan propagates lowlinks on backtracking; Dijkstra merges partial SCCs on closing edges and detects acceptance earlier. Proof sketches establish safety of shared information and acceptance detection, while complexity analysis identifies union-find contention in large SCCs. Experiments with Spot and DiVinE compare 1–12 threads on BEEM products, separating empty (satisfied) and nonempty (violated) formulas and analyzing topology-dependent scaling.
  • number: 2–12 threads
  • number: 10 benchmark models per plot group
  • number: union-find operations m versus n−1 per SCC
  • number: 2015 TACAS prototype
  • limits: The automaton is finite and transitions carry generalized acceptance marks; correctness relies on lock-free compare-and-swap union-find and stable SCC/DEAD facts. Local traversals may redo work when another thread marks a state DEAD. Speedups depend strongly on SCC shape and union-find contention; prototype absolute times lag sequential CNDFS, and one comparison precomputes products for LTSmin due to a bug. The approach is explicit-state and does not address symbolic or unbounded systems.
  • how much was read: most of it read
  • record id: parallel-explicit-generalized-bu-chi-checking-2015
• SACO (2014)
  • title: SACO: Static Analyzer for Concurrent Objects.
  • what: Presents SACO, a static analyzer for actor/concurrent-object programs that infers termination, resource bounds and deadlock freedom. Points-to and may-happen-in-parallel analyses feed circular termination reasoning, cost bounds and dependency-graph deadlock checks. The monitor/object model permits one active task per object, cooperative await, asynchronous sends and blocking future get. Allocation-site sequences parameterized by k give object-sensitive points-to information; polynomial MHP composition prunes impossible interleavings. Termination assumes shared data is updated finitely often and proves that assumption through termination of updating loops. Resource bounds combine local ranking functions with counts of interfering updates; deadlock graphs are pruned using MHP labels. The vending-machine example derives a coin+·n loop bound and an acyclic dependency graph.
  • number: points-to sequence bound k
  • number: retrieveCoins resource bound coin+ * n
  • number: one active task per object
  • limits: Soundness depends on finite allocation-site abstraction, safe MHP over-approximation, and the circular finiteness assumptions used in termination proofs. get may deadlock; the dependency graph is a sufficient acyclicity test and may report false positives. The paper is a concept/tool report without a broad runtime benchmark table, and analyses apply to the cooperative concurrent-object model rather than arbitrary shared-memory threads.
  • how much was read: most of it read
  • source
  • record id: saco-2014
• Towards Modeling and Model Checking Fault-Tolerant Distributed Algorithms. (2013)
  • what: Models threshold-guarded fault-tolerant distributed algorithms in extended Promela, replacing explicit message channels by sent/received message counters for efficient fixed-size SPIN verification. Separates receive/compute/send within one atomic process step. Correct processes broadcast each message type at most once; sender identities are abstracted into counts. Byzantine/symmetric process effects become bounded nondeterministic increments, while omission/crash processes are explicitly modeled with weaker fairness. Status variables encode control flow, parameter constraints encode resilience, and quantified atomic propositions are expanded for fixed process counts. Includes full broadcast encoding and appendix fragments for symmetric, omission, crash, folklore broadcast and condition-based consensus.
  • number: 8 GB encoding comparison; channels exhaust at n=6, counters at n=9
  • number: Byzantine n=7,t=2,f=2 relay: 6.3 s,77 MB,290,000 stored states
  • number: folklore n=6 property F:1690 s,1819 MB
  • number: Paxos-like target would need at least 14 processes to tolerate one fault, remains future work
  • limits: Assumes processes can distinguish senders; Byzantine senders cannot forge others’ messages. Asynchronous fairness requires each correct process to run infinitely and sent messages to eventually arrive. Counter encoding relies on uniform sender treatment, finitely many message types, all-to-all sends and at most one send per type/run. This paper verifies fixed parameter instances; parameterized proofs and Paxos-like algorithms are separate/future work. Small counterexamples check adequacy of the encoding but do not establish full refinement equivalence. Source is the 21-page SPIN 2013 submission including appendices, not the publisher final layout; graphs were not separately inspected.
  • how much was read: most of it read
  • source
  • record id: towards-modeling-and-model-2013
• TLAPS (2012)
  • title: TLA+ Proof System (TLAPS) and its temporal support
  • what: # TLA+ Proofs (authored by agents unless marked 🧑) Denis Cousineau, Damien Doligez, Leslie Lamport, Stephan Merz, Daniel Ricketts and Hernán Vanzetto, 2012. This record reads the 16-page extended article, arXiv:1208.5933v1, dated 29 August 2012. Its first-page footnote says a shorter version appears at FM 2012; reference [7] gives LNCS 7436, pp 147–154. The official TLAPS publications page links both a longer article and a Peterson model (Q1,Q3,Q30,Q37). The shorter proceedings paper was not separately read. The inventory’s cs.LO label is not the PDF’s classification: the PDF says cs.SE (Q1). The article explains how to write, decompose, check and maintain TLA+ proofs through Peterson’s two-process mutual exclusion algorithm. Its central result is an illustrated invariant proof, backed by reported TLC and theorem-prover checks. The most important qualification is explicit: the displayed final temporal QED is “proof omitted” (Figure 6, Q19), because the then-current TLAPS could not check temporal reasoning (Q11). The state-level proof obligations are reported checked; the complete temporal theorem is justified by standard induction rules in the explanation, rather than entirely checked by the presented tool. Liveness is outside the demonstrated verification. ## Reading and evidence scope Read all 16 PDF pages in text and rendered images, including sections 1–6, all six figures, every displayed formula/proof and all 24 bibliography entries on pp 14–16. There is no appendix, checklist, numbered equation, numerical plot or printed table. The six figures contain the PlusCal algorithm, its TLA+ translation, high-level proof, inductive invariant, preservation-proof outline and hierarchical proof. This is one mutual-exclusion theorem target shown at successive levels of detail, not six independently evaluated algorithms. The local inventory PDF and freshly fetched official arXiv PDF have identical bytes. Read the official TLAPS publications page and two complete plaintext Peterson modules from the official tlaplus/tlapm repository, pinned to commit 901ae51ed5224f88d43a1a02969cd9be4ed1b48d, dated 2026-10-16. One module is the publications-page artifact path; its bytes match the separately fetched live official model. The second is under doc/fm2012. These are retained example artifacts, not an audit of the current TLAPS implementation. The repository tree was inventoried to locate them. Other examples, proof-manager/backend implementation, modern tutorials, the shorter article and recursively cited case-study papers were not read. The modern repository pin does not establish the exact executable versions used in 2012. No author code, PlusCal translator, TLC, TLAPS, Isabelle, Zenon or SMT solver was executed or imported. No model, serialized dataset or checkpoint was loaded. The reader checks are symbolic reasoning, file comparisons and metadata/arithmetic checks. quotes.json contains exact passages with section/page, LF lines and character slices; figure-evidence.json preserves every figure listing. numeric_tables.json explicitly records zero tables and the limited quantitative claims. The extracted listings often render □ as 2 and a prime as 0; quotes retain those literal extraction bytes, while the analysis uses the symbols confirmed in the rendered PDF. source-scope.json, source-files.json and hashes.json document the reading boundary and bytes. ## Specification and assumptions TLA+ combines linear-time temporal logic, Zermelo–Fraenkel set theory with choice, and modules. The proof language adds hierarchical natural-deduction structure. The Toolbox is an Eclipse-based interface to both TLC model checking and TLAPS proof checking, so the same formulas can be tested and used in deductive proofs (Q2). These descriptions concern the paper’s 2012 tools; they are not a current feature inventory. The example has exactly two process identifiers, 0 and 1, with Not exchanging them. Shared variables are a Boolean-valued flag function, a turn value initially 0, and the generated program-counter function pc. Initially both flags are false and both counters are at a0. Each process repeatedly sets its flag, gives the other process the turn, checks the other’s flag and turn through two separate labeled tests, executes the critical-section skip, then clears its flag (Q5–Q8). Atomicity is specified by PlusCal labels: an action runs from one label to the next. Figure 2 exposes seven action formulas per process, and Next existentially selects one process’s action. Reads/writes and control changes have exactly the interleaving semantics of these formulas. The example supplies no weak-memory, compiler-reordering, machine-instruction, crash, recovery or network-message model. Correctness of a compiled Rust or C implementation would need a separate correspondence argument. The critical section itself is represented by an atomic skip; the paper’s property is that the two program counters never simultaneously equal cs (Q6–Q9). The full specification is Spec = Init ∧ □[Next]_vars, with vars collecting flag, turn and pc. Brackets admit either a Next transition or a step leaving all listed variables unchanged. A behavior is an infinite state sequence. Stuttering is included to simplify refinement, not to assert progress (Q7,Q8,Q10). There is no fairness clause in the displayed Spec. A reader witness repeats the initial state forever: Init holds, every step satisfies UNCHANGED vars, and neither process ever reaches cs. Thus that exact Spec does not imply eventual entry into a critical section. This is compatible with its mutual-exclusion safety property. The paper says liveness can be expressed and proved in TLA+, but does not give the extra progress assumptions or a liveness proof here (Q4; math-witness.json). It would be wrong to infer starvation freedom merely from the safety theorem. ## What is proved, and the checking boundary The target is Spec ⇒ □MutualExclusion. Its three state-level obligations are Init ⇒ Inv, Inv ∧ [Next]_vars ⇒ Inv′, and Inv ⇒ MutualExclusion. Figure 3 and §3.1 explain how propositional reasoning plus temporal induction and monotonicity yield the temporal theorem from these premises. They then state: “TLAPS does not yet handle temporal reasoning, so we omit the proof of the qed step” (Q11). Figure 6 calls itself the “complete hierarchical proof” while visibly retaining that omission (Q19). This is a disclosed tool limitation, not evidence that the mutual-exclusion theorem is false. Inv is TypeOK ∧ I. TypeOK constrains pc to seven labels per process, turn to {0,1}, and flag to Boolean-valued functions on {0,1}. I says a process from a2 through a4 has its flag set. A process at cs or a4 excludes the other from both cs and a4; if the other is still in either waiting-test location, turn favors the process already in that region (Q12). The stronger control-state conditions explain why the simple target predicate is preserved even across the entry/exit protocol. Two small reader checks clarify the formula. Init satisfies TypeOK, while all control-state antecedents in I are false at a0. If pc[0]=cs, I for process 0 excludes pc[1]=cs; if pc[0]≠cs, MutualExclusion already holds. These checks cover initialization and implication to the target. They do not replace the preservation proof or independently certify the tool. TypeOK describes 7²×2×2²=392 possible valuations; that is a domain-size calculation, not the paper’s reported 58 reachable states (math-witness.json). The paper first reports TLC checking execution errors and MutualExclusion over all 58 reachable states of this particular finite model. It also checks inductiveness by replacing Init with Inv, model checking Inv ∧ □[Next]_vars. Starting from every state satisfying the candidate invariant tests preservation beyond the original reachable-state set. For more complicated or infinite-state specifications, the authors recommend small-instance model checking as a way to find errors, and explicitly limit its ability to establish general inductiveness (Q9,Q12). A successful finite instance is not a universal proof for arbitrary process counts or data domains. The illustrated checks also reveal the human work. A leaf proof citing only Init and Inv fails because TypeOK and I remain uninterpreted. Supplying their definitions lets TLAPS prove initialization. Expanding definitions for the entire preservation obligation still fails with the default provers and produces a 65-line obligation. CVC3 through the SMT backend proves it “in a few seconds” (Q13–Q15). No hardware, precise solver versions, timeout, repeat count or full timing log accompanies that statement. To demonstrate hierarchy rather than rely on this easy SMT success, the authors deliberately decompose the preservation proof using Zenon and Isabelle. The SUFFICES step replaces [Next]_vars with Next only after separately proving the unchanged-variable case. It then splits Inv′ into TypeOK′ and I′. Zenon proves the SUFFICES reduction; Zenon fails on the stated TypeOK′ proof but Isabelle succeeds. Both fail on I′ without further decomposition (Q16–Q17). The next level introduces an arbitrary process j, names its invariant subexpression as I!(j), and picks the process i that performs the Next action. Instead of seven action-by-action cases, two cases, i=j and i≠j, suffice for the displayed example. Explicit facts and definition expansions then discharge the leaves. A case step’s own name denotes its case assumption, so citing that name within its proof is not circular citation of its conclusion. NEW-bound assumptions and the PICK membership fact are automatically available within scope; ordinary facts still need the stated context discipline (Q18–Q19). ## Proof management, reuse and trust The Proof Manager translates proof steps into sequents with a goal and context of symbols, assumptions and previously established facts. It tracks context changes and sends leaf obligations to backends. It records success, failure, cancellation and omission. The interface can check one step, theorem or file, show the exact failing obligation, navigate back to the producing proof, and hide irrelevant portions of the hierarchy (Q21–Q22). “Proof obligations are independent of one another” describes the ability to check conditional obligations in any order (Q21). It does not make a theorem valid while required assumptions or earlier steps remain unproved. The distinction matters in this very example: the state-level work can be developed independently while the final temporal QED is omitted. Global completion requires all needed obligations and the correct bridge to the stated property. Fingerprinting stores an obligation’s status under a canonical representation. Bound variables become de Bruijn indices, so renaming them does not change the representation; unused symbols and hypotheses are removed from the context. This supports reuse after proof reorganization, moving a step or removing and later reinserting it. Status can also be queried without launching proofs (Q23). The paper describes the mechanism but gives no hash-collision theorem, implementation-level soundness proof or controlled cache benchmark. Correct reuse depends on the representation preserving all relevant logical dependencies. This record did not inspect the fingerprint implementation. The backends described are Isabelle/TLA+, Zenon and SMT solvers. Default attempts use Zenon, then Isabelle; the SMT route translates obligations into SMT-LIB for CVC3, with native Yices/Z3 alternatives. Isabelle is the most trusted backend. Zenon can emit Isar proofs that Isabelle checks. The paper says certification of SMT proof traces is future work, so a successful SMT result should not be silently counted as Isabelle-certified evidence in this article (Q3,Q15,Q27). The trusted components also include translations and critical Proof Manager transformations such as distributing prime through addition. Users can disable fingerprints and reprove obligations, which addresses cache reuse concerns without removing the other trust dependencies. The authors further warn that an incorrect target formula can make a proof meaningless and that incorrect assumed mathematical facts can invalidate an apparent result. TLC can test those exact assumed formulas on instances; that supplies error-finding evidence, not a proof of every assumed mathematical statement (Q27–Q28). ## Evaluation and concrete larger cases The evaluation is a worked proof tutorial plus development experience, not a randomized user study or comparative prover benchmark. Its concrete local evidence comprises the 58-state TLC result, the failed/repaired leaf proofs, the 65-line preservation obligation, backend-specific outcomes and the qualitative CVC3 timing. There are no statistical estimates, repeated trials, task success rates, hardware budgets or uniform comparison across proof assistants (Q9,Q13–Q19). Larger uses are named: Byzantine Paxos, the Memoir security architecture, and Pastry lookup/join protocols. These are cited case studies, not complete proofs reproduced in this article (Q20). A cited 1100-line invariance proof has 100 non-leaf steps, illustrating the scale at which the hierarchy acts like nested lemmas (Q22). The claim that 100 conventional linear lemmas would be unreadable is the authors’ judgment, not a measured readability result. The strongest maintenance anecdote concerns Lamport’s Byzantine Paxos proof. He initially spent several weeks over several months on its safety proof while debugging TLAPS. Later he discovered the algorithm lacked the desired liveness property, changed it, repaired small bugs found by TLC, and re-established safety in a day and a half, about 12 hours of actual work. About three quarters of the new proof obligations had already been proved (Q24). This shows reported reuse during a real revision and separately shows why safety does not imply liveness. It does not report a newly checked liveness proof, an exact obligation count, or an isolated speedup attributable solely to fingerprinting. The related-work discussion compares declarative proofs and interface features with Mizar/Isar, reuse with KIV, set-theoretic/refinement approaches with Rodin/Event-B, and high-level specifications with VCC/Why source-code verification. These are architectural comparisons and historical author assessments, not present-day benchmark rankings (Q25). The conclusion also lists proof constructs not exercised in the Peterson example, including existential witnesses, local definitions and facts supplied implicitly to backends. Temporal reasoning and improved sequence support are planned work in the article (Q26,Q29). ## Static artifact findings Both pinned Peterson modules contain the full PlusCal comment, generated actions, candidate invariant, ISpec for inductiveness testing, and two variants of the same safety proof. One variant uses SMT for preservation; the other expands the hierarchy. Both end their top-level theorem with PROOF OMITTED (Q31–Q35). This independently preserves the article’s disclosed checking boundary in a usable example artifact. The source exists; no dynamic proof certificate or successful replay is supplied by this read. The artifact retains ProcSet and uses USE DEF ProcSet, matching the paper’s footnote about a definition inlined in Figure 2. MutualExclusion uses negated conjunction, logically equivalent to the paper’s disjunction. Source leaf proofs often cite Inv, Next and proc(i) directly where Figure 6 cites numbered steps; the explanatory text explicitly permits such fact references (Q7,Q17,Q32–Q35). The FM directory copy differs only by an unused NeverCS predicate and DEF versus DEFS spelling in one leaf proof (Q36 and retained file comparison). Neither difference establishes an algorithm change or runtime failure. The two files remain exact downloaded bytes. ## Contribution to the requested research topics This is directly relevant to formal verification of distributed systems and TLA+: it gives a concrete path from a labeled algorithm to a temporal specification, tested invariant, structured proof obligations, backend checks and maintained proof status. It makes both the specification assumptions and proof-completion boundary visible. Its larger-system anecdotes link those mechanisms to distributed protocols while leaving those cited proofs outside this article’s detailed evidence. It contains no Verus or verified-Rust development, LLM agent, generated-specification benchmark or automatic invariant-synthesis evaluation. Its transferable design ideas are therefore reader proposals: give proof agents explicit sequents and scoped context; use checker feedback to distinguish missing definitions from difficult obligations; split proofs without dropping stuttering or other cases; cache normalized obligations only with valid dependencies; and report omitted steps and certification routes alongside success counts. The article does not measure those proposals with LLMs. Its most useful evaluation lesson is to keep a correct formalization, state-level proof success, temporal completion, liveness, certificate checking and proof-reuse evidence separate.
  • number: Peterson mutual-exclusion example; proof obligations are split among back-end provers
  • limits: Exactly two processes and labeled atomic shared-state interleavings with arbitrary stuttering; no fairness/weakmemory/compiledimplementation correspondence. Reported state-level proof checks leave temporalQED explicitly omitted in2012tools. No liveness proof or fullTLAPSsoundness proof. Larger case studies cited; maintenance/timing evidence is anecdotal.2026modulepin does not identify2012executables.
  • how much was read: most of it read
  • source; notes: T01. Current TLAPS support: distinguish temporal reasoning from automa
  • record id: tlaps-2012
• Model-Based Trace-Checking (2011)
  • what: Replays observed traces of a distributed Java travel-booking application through B (ProB) and Promela (Spin) models. It checks invariants and a resource-allocation progress property on those particular traces.
  • number: six invariant clauses
  • number: progress bug: keeps trying Hotel1 when it is full but Hotel2 has a room
  • limits: It finds errors but cannot show there are none. The match between model and code is assumed from inspection. Tracing code was inserted by hand. No success rate, size or time is given.
  • how much was read: most of it read
  • source; notes: Model-Based Trace-Checking
  • record id: model-based-trace-checking-2011
• T HORS (2011)
  • title: Verifying Liveness Properties of ML Programs
  • what: Extends intersection-type model checking of higher-order recursion schemes from safety to Alternation Free Mu-Calculus/CTL, enabling automated liveness checking of higher-order functional programs. T HORS partially evaluates a HORS abstraction, heuristically proposes candidate intersection types, type-checks them, and solves a weak Buchi/parity game to establish acceptance. The paper explains a two-copy complement strategy for non-deterministic automata (termination on yes instances, possible divergence on no instances otherwise), and uses a CPS/resource-access translation for ML programs.
  • number: intercept example verified in 35 ms, order-4 scheme, 2-state automaton, 31-node parity game
  • number: unbounded file example verified in 1 ms, order-4 scheme, 3-state automaton, 17-node parity game
  • number: implementation is an OCaml web tool
  • limits: HORS are finite abstractions of potentially infinite computation trees and the OCaml-to-HORS translation is manual; the paper explicitly says abstraction techniques are not covered. Fairness is imposed for unbounded file reads by excluding infinite reads. Worst-case complexity remains n-EXPTIME by function order, and no broad benchmark or automated front end is supplied.
  • how much was read: most of it read
  • record id: t-hors-2011
• Robust GR(1) liveness robustness (2010)
  • title: Robustness in the Presence of Liveness
  • what: Defines robustness for liveness specifications by requiring a minimum number of system guarantees to remain true as environment assumptions fail. It reduces single and multiple counting requirements to Generalized Reactivity (GR) objectives and gives verification and synthesis algorithms for robust systems. The paper develops concrete robustness measures using dining philosophers, formalizes them as ordered sets of GR(1)-like implications, and shows that disjunctions of conjunctions of Büchi objectives can be exponentially simplified to generalized Büchi objectives. It proves DCB game solving co-NP-complete via a 3SAT reduction, then gives a counter-based construction reducing GR(1) games to one-pair Streett games. The construction preserves winning strategies, extends to GR(k), and yields verification and synthesis complexity bounds; synthesized strategies trade lower runtime for larger memory than Zielonka’s method.
  • number: GR(1) verification O(mn|Q|^2|δ|)
  • number: GR(1) synthesis O(|S||E|(mn)^2)
  • number: GR(k) synthesis O(|S|^k|E|(mn)^{k(k+1)}k!)
  • number: DCB game winning strategy problem co-NP-complete
  • limits: Specifications are finite products of deterministic Büchi automata over input/output signals and robustness is measured by counts of assumptions and guarantees, with a user-supplied total order. The model is reactive infinite-play games; liveness violations cannot be detected finitely, so safety guarantees cannot generally be sacrificed in response to a fairness-assumption violation. DCB-to-generalized-Büchi simplification is exponential and DCB game solving is co-NP-complete. The proposed GR(1) algorithm uses O(|S||E|(mn)^2) time but stores (m+1)(n+1) memory states (or n with an extra strategy computation); GR(k) incurs factorial/exponential factors. No implementation benchmark is reported beyond the worked examples and asymptotic analysis.
  • how much was read: most of it read
  • record id: robust-gr-1-liveness-robustness-2010
• Termination Analysis with Compositional Transition Invariants (2010)
  • what: Introduces Compositional Termination Analysis (CTA), replacing repeated expensive whole-program safety checks in Binary Reachability Analysis with ranking of loop-free unwindings and a transitivity check on a disjunctively well-founded candidate transition invariant. Increasing unwinding depth and removing already-ranked transitions permits short terminating fragments to yield a global termination argument. §2 defines transition invariants as supersets of transitive reachable transition closure, and disjunctive well-foundedness as finite unions of well-founded relations. §3 observes a transitive disjunctively well-founded relation is well-founded. Lemmas 1/2 accumulate rankings of increasingly deep, not-yet-covered unwindings and allow skipped intermediate depths; the implementation uses powers of two. Algorithm 1 tracks an overapproximation X of reachable states. A failed ranking produces a candidate nontermination precondition C: reachable C establishes nontermination; unreachable C is removed from X. Thus reachability checking remains where ranking fails rather than in every refinement. §4 slices each loop independently, havocs other loops and assignments depending on five or more variables, and uses CBMC symbolic execution to discover paths in loop-free fragments instead of enumerating all of them.
  • number: 87 drivers ×2 configurations =174 driver benchmarks
  • number: matched nontrivial successful BRA baseline: 99 terminating and 45 nonterminating cases
  • number: 3 GHz Xeon; 2 GB memory limit; 2 h per driver
  • number: precise CTA: average speedup 52; up to 3 orders of magnitude; more than 3× analyzed benchmarks at equal precision under the limit
  • limits: Soundness depends on the rank subprocedure returning a disjunctively well-founded superset or a genuine nontermination precondition, and on valid reachability checks. Finite-state nontermination completeness requires a complete rank procedure, unlike the implemented incomplete engine. Per-loop slicing/havoc overapproximates behavior and can lose termination proofs; practical heuristics replace assignments depending on at least five variables. Evaluations compare identical abstracted slices, not untouched drivers. Baseline is selected from BRA-successfully-analyzed, nontrivial loops, so speedup figures are conditional on that subset. Fast variants skip path-precondition checking or all reachability checking, potentially reporting false nontermination outside these benchmarks; the paper reports no precision loss on its measured examples. No scheduler fairness or busy-waiting progress argument is supplied for concurrent programs.
  • how much was read: most of it read
  • record id: termination-analysis-with-compositional-2010
• Termination Cores (2010)
  • title: Interactive Termination Proofs using Termination Cores
  • what: After a failed ACL2s termination proof, this work generates a core. A core is one unresolved recursive loop, with the solved work preserved. It guides a human repair.
  • number: one example: automatic proof in under 2 seconds after repair
  • number: expert’s earlier measure search 4-6 hours, unsuccessful
  • number: manual measure after repair about 20 minutes
  • number: core generation PSPACE-complete worst case
  • limits: It has one motivating example, not a controlled study.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Termination Cores
  • record id: termination-cores-2010
• Calling Context Graphs (2006)
  • title: Termination Analysis with Calling Context Graphs
  • what: It proves termination in ACL2s using graphs of calling contexts and well-founded measures (quantities that cannot decrease forever). It needs no user interaction on first-order functional code.
  • number: Table 1: 10,442 functions, 10,308 proved (98.7%)
  • number: difficult subset with explicit guidance: 421 attempted, 287 proved (68.2%)
  • limits: It kept existing auxiliary lemmas, so it is not fully free of annotations.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Calling Context Graphs
  • record id: calling-context-graphs-2006
• Alpern-Schneider liveness (1985)
  • title: Defining Liveness
  • what: The paper defines safety and liveness as properties of sets of infinite executions. It proves that every property is the intersection of a safety property and a liveness property.
  • limits: It covers properties of a single trace, not policies over several traces. Deadlock freedom is a safety property. Starvation freedom is a liveness property.
  • how much was read: most of it read
  • source; notes: What matters for turning a vague request into a proof; notes: separating forbidden events from required progress
  • record id: alpern-schneider-liveness-1985
• Automatic Verification of Probabilistic Concurrent Finite-State Programs (1985)
  • what: Gives an automata-theoretic decision procedure for qualitative, probability-one satisfaction of linear temporal specifications by finite probabilistic concurrent programs. Converts formulas to omega automata and reduces probabilistic emptiness/universality to ordinary automata emptiness through fair-run reasoning. For deterministic Streett automata, constructs product automata whose acceptance enforces probabilistic fairness. Develops a generalized-subset determinization based on labeled state-set tuples; a singly exponential partial construction avoids full doubly exponential determinization for probabilistic Büchi checks. Extends pure Markov chains to concurrent Markov chains with probabilistic versus nondeterministic states and a designated fair-state set. A history-dependent scheduler induces a probability measure; correctness quantifies over every fair scheduler.
  • number: probability-one qualitative correctness
  • number: 12 scanned pages, printed 327–338
  • number: PSPACE-complete nondeterministic Büchi probabilistic emptiness/universality
  • number: Theorem 4.5: polynomial program-size, doubly exponential specification-size time
  • limits: Finite state space and fixed process count are essential; the method does not establish a parameterized result for arbitrary process counts. Only qualitative almost-sure satisfaction is checked, not numerical probability thresholds, bounded waiting or real-time response. Algorithms depend on nonzero transition support rather than exact positive probabilities. Fairness is state-based: repeatedly visited fair states must take every enabled outgoing choice infinitely often; a fair scheduler assigns fair runs probability one. Source includes proof sketches rather than mechanized proofs or implementation evidence. Abstract/Theorem 4.5 give polynomial program-size time and doubly exponential specification-size time; introduction/conclusion call the program dependence linear. This internal bound wording difference is preserved. Author-hosted scan matches title/author and FOCS 1985 printed pages/metadata; no DOI is printed in the scan.
  • how much was read: most of it read
  • source
  • record id: automatic-verification-of-probabilistic-1985
• Anvil repository
  • title: Anvil: Building Formally Verified Kubernetes Controllers
  • what: Anvil implements Kubernetes controllers in Rust, specifies their properties in Verus-TLA, and proves an Eventually Stable Reconciliation property. Its Welder extension composes liveness proofs across controllers.
  • number: Three built-in controllers (ReplicaSet, Deployment, StatefulSet) and one RabbitMQ controller are reported in the README.
  • limits: The README says verification still requires SMT theorem-proving expertise; examples and assumptions are repository-specific.
  • how much was read: most of it read
  • source
  • record id: anvil-repository
• Liveness Manifestos
  • title: Liveness Manifestos (NYU ACSys ‘Beyond Safety’ workshop page)
  • what: Workshop participants state whether proving liveness is worth it. Lamport lists four problems. McMillan, Vardi, Boigelot and Sistla add views on when liveness helps, and when bounded safety can replace it.
  • limits: This is not a paper. The workshop year is not stated.
  • how much was read: most of it read
  • source
  • record id: liveness-manifestos
• Barnacle (2026)
  • title: Barnacle: Adaptive Multi-Leader Scheduling for DAG-Based Consensus
  • what: A protocol add-on for Sui consensus. Its safety and progress theorems are machine-checked in Lean 4. AI wrote the proofs. Humans read only the definitions and the theorem statements.
  • number: About 3,900 lines: 1,900 definitions/statements, 2,000 AI proofs, 3,200 lines of executable witnesses
  • number: Four protocols across Byzantine, crash-only and mixed fault models
  • limits: One author group’s claim. Not independently checked.
  • how much was read: parts read
  • source
  • record id: barnacle-2026
• Lion (2026)
  • title: Lion: Modular Verification of Async Runtime Liveness
  • what: Lion is a Tokio-like async runtime written in Rust and verified in Verus. Its top theorem says that, under stated assumptions, a spawned task is eventually polled to completion. The liveness claim does not use temporal operators. Instead it is a bound on how long a task waits, under a filter on what the environment may do.
  • number: 3,393 lines executable, 39,648 lines spec/proof, 507 trusted (about 11.7 to 1)
  • number: 126 external_body items in the trusted base
  • number: Full verification run takes a few minutes
  • number: At least 95% of unverified-runtime throughput on nine workloads (claim)
  • limits: No machine-checked proof shows that the compiled runtime matches the model. The SOSP paper is not public, so the notes read the tech report and the repo in part.
  • how much was read: parts read
  • source; notes: Lion: Modular Verification of Async Runtime Liveness; notes: Newly found 2026 Verus liveness: Lion
  • record id: lion-2026
• On the Power of Temporal Prophecy (2026)
  • what: It uses prophecy terms (guesses about the future) to prove termination of the Ackermann function in Ivy, a first-order model checker. The notes read only the open Ivy proof file, not the paper.
  • number: no paper runtime or human-effort figures available
  • limits: The paper PDF was not found. The Ivy file is outside EPR, a fragment where checking is decidable. It has cyclic alternations of quantifiers. It needs a fairness assumption that protocol steps are taken infinitely often, because Ivy adds an idle action.
  • how much was read: parts read
  • source; notes: On the Power of Temporal Prophecy (2026): paper inaccessible; proof ar
  • record id: on-the-power-of-2026
• SV-COMP (2026)
  • title: Competition on Software Verification - (SV-COMP).
  • what: An annual competition. Verifiers run on fixed programs and properties (concurrency, termination). Each returns an answer, a witness (evidence for the answer) and CPU time.
  • number: 2026 scoring: correct FALSE +1, correct TRUE +2, UNKNOWN 0, incorrect FALSE -16, incorrect TRUE -32
  • limits: Witnesses are not required for TRUE results in unsupported or demo categories. The specs are fixed, so it does not evaluate inventing specs. Termination differs from a service that keeps responding forever.
  • how much was read: parts read
  • source; notes: SV-COMP
  • record id: sv-comp-2026
• Verifying Wait-Freedom for Concurrent Higher-Order Programs (2026)
  • what: The paper gives a mechanized framework in Rocq and Iris. It proves that every call to an operation on a concurrent data structure finishes, whatever other threads do. It works for higher-order clients. It builds on Lawyer.
  • limits: The examples are a higher-order list map and a single-producer single-consumer queue, which is wait-free only with one enqueuer and one dequeuer. The review notes did not extract the numbers.
  • how much was read: parts read
  • source
  • record id: verifying-wait-freedom-for-2026
• A Refinement Methodology for Distributed Programs in Rust (precursor: Refinement Proofs in Rust Using Ghost Locks) (2025)
  • what: Proves that Rust distributed programs match a simpler model of what they should do (a refinement proof), using the Prusti verifier. The precursor paper also proves liveness (something good eventually happens). It writes those proofs as ghost code (code used only for proving, never run), using a direct encoding of LTL (a logic for statements about time). Cases include a simplified Memcached.
  • limits: The review notes could not get the final OOPSLA PDF and read the precursor instead. The verifier is Prusti, not Verus. The review notes do not know whether the final version keeps the liveness part.
  • how much was read: parts read
  • source
  • record id: a-refinement-methodology-for-2025
• Anvil thesis (2025)
  • title: Building and Verifying Cloud Infrastructure Systems with State-Centric Reasoning (PhD dissertation)
  • what: The thesis proves liveness of Kubernetes controllers in Verus, using the Anvil framework. The human writes one general liveness formula, “eventually stable reconciliation”: if the desired state stops changing, the cluster eventually matches it and stays that way. The proof splits into two parts: the environment becomes stable, and the controller reaches the desired state.
  • number: about two person-months to verify the ZooKeeper controller, about two person-weeks for each of the other two
  • number: each controller takes around 2.5 person-months to implement and verify; proof-to-code ratio 4.5 to 7.4
  • number: ZooKeeper: executable 1,134 lines, proof 8,352 (ESR 7,245), trusted 950; RabbitMQ: executable 1,598, proof 7,228, trusted 548
  • number: framework: 5353 lines of reusable lemmas, 7817 lines of trusted code; 70+ temporal-rule lemmas, 60 Kubernetes-environment lemmas
  • limits: The controller must be a state machine whose actions are atomic (they cannot be interrupted). The proof trusts the environment model, the shim layer, external APIs, the verifier, the compiler and the OS. After verification, testing still found one bug. It came from an incomplete spec of a trusted ZooKeeper API. About 40% of the 111 pages were read.
  • how much was read: parts read
  • source
  • record id: anvil-thesis-2025
• Korg thesis (2025)
  • title: Verification and Attack Synthesis for Network Protocols
  • what: Proves properties of three network-protocol pieces with theorem provers (Karn’s RTT algorithm and TCP’s timeout rule in Ivy and ACL2s, and Go-Back-N efficiency in ACL2s), model-checks TCP, DCCP and SCTP handshakes in SPIN, then builds Korg, a tool that searches for attacker behaviour that breaks a given property.
  • number: Handshake properties: TCP 4 (phi1-phi4), SCTP 10 (gamma1-gamma10), DCCP has its own set
  • number: Korg asked for at most 10 attacks per property; default search depth 600,000, maximum 2,400,000
  • number: TCP phi3 (peers do not get stuck) took 72 min to 223 min per attacker model; other TCP properties took seconds
  • number: SCTP: one patched-vs-unpatched check; with the CVE-2021-3772 patch, Korg finds no off-path attack, which proves the patch closes it for the model
  • limits: Models are small by design to avoid state-space explosion; the handshake models are not linked to the Ivy/ACL2s models. Korg handles one centralized attacker, not coordinated multi-process attackers, and is exact only for the model, not the real code. Models took long to write by hand.
  • how much was read: parts read
  • source; notes: ## Von Hippel thesis on protocol verification and attack synthesis (20
  • record id: korg-thesis-2025
• PolySemist (2025)
  • title: Accelerating Protocol Synthesis and Detecting Unrealizability with Interpretation Reduction.
  • what: A tool that fills in the missing guards and updates of a half-written TLA+ distributed protocol (a sketch) so the protocol meets a safety or liveness property. It loops: the TLC model checker finds a counterexample, the tool rules out every candidate that shares it, and it skips candidates that behave the same on the states seen so far.
  • number: 7 benchmark protocols: 2PC, consensus, decentralized lock, lock server, sharded KV store, two reconfigurable Raft variants
  • number: faster than the previous tool Scythe in 160 of 171 realizable problems; total time about 9,000 s vs 32,000 s on those both solve
  • number: whole distributed-lock protocol (6 expressions over 2 actions) synthesized in 125 s; Scythe timed out at 1 hour
  • number: detected ‘no protocol exists’ in 80 of 123 unrealizable problems vs 16 for Scythe (easy 46/50, medium 21/35, hard 13/38)
  • limits: A human supplies the sketch (state variables, actions, hole grammars) and the property; results hold only for the chosen finite parameters (e.g. number of nodes), and the all-parameters step is left to TLAPS proofs from prior work. Termination is guaranteed only when each hole grammar has finitely many expressions up to interpretation equivalence.
  • how much was read: parts read
  • source; notes: ## PolySemist: protocol synthesis by sketching (2025)
  • record id: polysemist-2025
• Shipwright (2025)
  • title: Shipwright: Proving liveness of distributed systems with Byzantine participants
  • what: A Dafny framework. A node is written as event handlers and compiled to Go. A refinement proof shows that the real handlers, running over a network model that eventually stabilizes, give safety and liveness. The case study is PBFT agreeing on one log entry, with infinitely many views.
  • number: Shipwright 13,357 lines (1,351 trusted); PBFT implementation 31,138 lines (266 trusted)
  • number: total 1,617 trusted, 42,878 untrusted, 44,495 lines
  • number: proof found three liveness bugs (bad new-view signatures, wrong certificate counting, timer started too early)
  • number: implementation 1888 lines (Figure 11, PDF p.11)
  • limits: It assumes partial synchrony (the network eventually stabilizes), an unverified Go runtime, and unforgeable signatures. It covers only one PBFT iteration. Reply messages to clients are not in the top-level theorem. Some refinements are unfinished. Person-time is not given.
  • how much was read: parts read
  • source
  • record id: shipwright-2025
• Ticl (2025)
  • title: Structural Temporal Logic for Mechanized Program Verification
  • what: A temporal logic over program structure, in Rocq. Liveness proofs follow loops and sequencing the way Hoare logic does, using invariants and well-founded variants (quantities that cannot decrease forever).
  • number: Leader election: 123 lines definitions and 115 lines proofs
  • number: Scheduler queue: 137 lines definitions and 362 lines proofs
  • limits: It is shown only on ring leader election with no failures.
  • how much was read: parts read
  • source
  • record id: ticl-2025
• ZENITH (2025)
  • title: ZENITH: Towards A Formally Verified Highly-Available Control Plane
  • what: A microservice SDN (software-defined networking) controller. Its TLA+/PlusCal spec is verified to ensure that the network state eventually matches the intent. Code is generated from the spec.
  • number: spec is 8.6K lines
  • number: eight properties P1-P8 proved by hand in TLAPS
  • number: 26 race conditions from prior SDN controller bugs (9 state inconsistencies, 7 deadlocks)
  • limits: The code generator is assumed correct, as with PGo. Model checking alone does not scale across topologies. TLAPS needed history variables (extra variables recording the past). Person effort is not given.
  • how much was read: parts read
  • record id: zenith-2025
• Caliper (2024)
  • title: Almost-Sure Termination by Guarded Refinement
  • what: Caliper moves a proof of almost-sure termination (termination with probability one) from a simple probabilistic model to higher-order code. It does this through refinement.
  • limits: The examples are sequential and probabilistic: loops, a list generator, treaps and a Galton-Watson sampler. It has no randomized network consensus. The notes extracted no effort totals.
  • how much was read: parts read
  • source
  • record id: caliper-2024
• Fairneris (2024)
  • title: Fairneris: Verifying Liveness Properties of Distributed Systems via Trace Refinement in Higher-Order Concurrent Separation Logic
  • what: An AnerisLang implementation of Stenning transfer over UDP-like networking. Under fair scheduling and a fair network (nothing is delayed forever), every sequence number is eventually acknowledged. Coq checks the refinement (that the code matches the model) and most of the infrastructure.
  • limits: The model’s liveness theorem is a pen-and-paper proof, not machine-checked. The review notes did not establish the venue, date or artifact.
  • how much was read: parts read
  • source; notes: papers and boundaries
  • record id: fairneris-2024-2
• FizzBee (2024)
  • title: Fizzbee, Liveness and Fairness (tutorial)
  • what: These are tool docs for FizzBee’s liveness syntax. ‘Always eventually’ means a good state recurs. ‘Eventually always’ means the system stabilises. Fairness is set per action: weak, strong, or unfair by default.
  • limits: The example is a toy. There is no CTL support. The notes cover about half of the docs.
  • how much was read: parts read
  • source; notes: FizzBee
  • record id: fizzbee-2024
• LinearActris (2024)
  • title: Deadlock-Free Separation Logic: Linearity Yields Progress for Dependent Higher-Order Message Passing
  • what: A linear separation logic (a logic where resources are used exactly once), mechanized in Coq. For message-passing programs, deadlock freedom and leak freedom follow from the logic itself.
  • limits: It covers message passing only, with no locks, semaphores or monitors. Deadlock freedom is weaker than every request being answered (the notes’ inference).
  • how much was read: parts read
  • source
  • record id: linearactris-2024
• Trillium / Fairis (2024)
  • title: Trillium and Fairis
  • what: A program-logic framework in Coq and Iris. Fairis proves liveness of concurrent programs under fair scheduling, by refinement of a model. The Aneris instantiation proves that distributed implementations refine TLA+ models (two-phase commit, single-decree Paxos and a CRDT).
  • number: about 1100 lines of proof scripts for Paxos
  • limits: The step from TLA+ to the Coq model was done manually. The distributed refinements give trace safety only. Distributed liveness is in a later manuscript. The notes’ author read about 40%.
  • how much was read: parts read
  • source
  • record id: trillium-fairis-2024
• Verification and synthesis of distributed systems with weak synchronisation (2024)
  • what: A theory thesis on deciding, for processes that talk only by broadcast or only by taking and releasing locks, whether a system meets a property, and whether processes can be given local strategies that guarantee it. The trick is to pick a small description of what each process may do alone (an invariant or a set of patterns) and check whether any combination of such local runs can go wrong.
  • number: 254 pages, three models: broadcast networks of register automata, lock-sharing systems, dynamic lock-sharing systems
  • number: coverability for broadcast networks with data is complete for the class F_omega^omega, so needs non-primitive-recursive time
  • number: verification of lock-sharing systems with 2 locks per process or nested locks is NP-complete; synthesis is Sigma_2^P-complete
  • number: synthesis of local controllers is undecidable for general lock-sharing systems
  • limits: Pure decidability and complexity results with no tool or benchmark; the models are heavily restricted (only broadcast or only locks), and the author notes adding a shared variable makes the lock model undecidable. Read from the introduction, summaries and conclusions only, not the proofs.
  • how much was read: parts read
  • source; notes: ## Mascle thesis: weak synchronisation (2024)
  • record id: verification-and-synthesis-of-2024
• Yao thesis (DistAI, DuoAI, LVR) (2024)
  • title: Automated Verification of Safety and Liveness Properties for Distributed Protocols (PhD thesis)
  • what: It shows that liveness can be reduced to a list of simpler safety properties, which invariant-inference tools often prove automatically. One task is left: synthesize a ranking function (a number that decreases toward the goal) to prove termination. It was applied to 8 protocols, including Paxos. It also covers DistAI and DuoAI.
  • number: 37 of 40 generated safety properties are always true, inductive, or get an invariant automatically; 3 found manually in a few hours each
  • number: every Z3 query to synthesize a ranking function finished in under a second
  • number: manual effort 128 and 165 lines versus IronFleet’s 2,093 and 7,869 lines of Dafny (16x and 47x less)
  • number: DuoAI covers 27 protocols and solves Paxos more than two orders of magnitude faster than any alternative
  • limits: It handles only “eventually” properties, not bounded time. Ranking functions are polynomials only. It works on protocol-level models, not code. It assumes fair scheduling, minimum packet delivery and a contention-free Paxos round. Part of the line-count gap is Dafny versus mypyvy. The notes’ author read about 20% of the 137 pages.
  • how much was read: parts read
  • source
  • record id: yao-thesis-distai-duoai-lvr-2024
• A Case Study on Parametric Verification of Failure Detectors (2023)
  • what: The authors model the Chandra-Toueg failure detector (a protocol that guesses which machines have crashed) in TLA+, Ivy and counter automata, assuming partial synchrony (the network is unpredictable at first, then becomes well-behaved). They prove liveness (something good eventually happens) by hand, turning it into a safety proof (nothing bad happens).
  • limits: The conversion from liveness to safety is done by hand. Ivy’s automatic conversion was not used.
  • how much was read: parts read
  • source
  • record id: a-case-study-on-2023
• ByMC survey (2023)
  • title: Survey on Parameterized Verification with Threshold Automata and the Byzantine Model Checker
  • what: Protocols are modeled by counting messages and participants against thresholds. This lets the tool check safety, and some liveness, for any number of participants, under conditions like n>3t (n participants, at most t faulty).
  • number: Table 4: 13 asynchronous/randomized algorithms (FRB, STRB, ABA, NBACG, NBACR, CBC, CF1S, C1CS, BOSCO, Ben-Or, RABC, kSet, RS-BOSCO)
  • number: Table 6: 16 synchronous cases, 14 verified; HybridQueen and kSetOmit have no successful check
  • limits: People still supply the models and assumptions. Termination of randomized protocols holds only against adversaries that act in rounds. The Tendermint claim covers one round only. The synchronous checker is a separate prototype.
  • how much was read: parts read
  • source; notes: ByMC and threshold automata
  • record id: bymc-survey-2023
• Modular termination verification with a higher-order concurrent separation logic - intermediate report (2022)
  • what: Builds on Iris without modifying it. Reasons about termination of non-blocking concurrent algorithms one module at a time. Turns termination into a safety property by using call permissions. Applied to a lock-free stack with helping.
  • limits: Blocking concurrency under fair scheduling is only sketched.
  • how much was read: parts read
  • source
  • record id: modular-termination-verification-with-2022
• Temporal prophecy (2021)
  • title: Temporal prophecy for proving temporal properties of infinite-state systems
  • what: Adds prophecy variables (recorded predictions about future execution) to the earlier abstraction method. This lets it keep distinctions that the abstraction lost, without strengthening the contract with the environment.
  • number: four cases: ticket protocol, alternating bit, hybrid reliable broadcast, TLB shootdown
  • number: user invariant conjectures 60, 70, 58, 102
  • number: checking takes 7, 25, 25, 240 seconds
  • number: Figure 3 (model lines; conjectures; checker seconds): ticket with task queues 90; 60; 7; alternating bit 143; 70; 25; hybrid reliable broadcast 166; 58; 25; TLB shootdown 468; 102; 240 (checking time, not authoring time)
  • limits: Prophecy formulas are extracted automatically only from an invariant the user supplies. Choosing the witness is manual. No claim of completeness.
  • how much was read: parts read
  • source; notes: Ivy: dynamic abstraction and temporal prophecy; notes: additional temporal methods
  • record id: temporal-prophecy-2021
• Logres (2020)
  • title: A Formally Verified Protocol for Log Replication with Byzantine Fault Tolerance
  • what: A log replication protocol that runs in lock-step rounds (the Heard-Of model), uses signatures, and tolerates Byzantine faults. Its proof in Isabelle/HOL includes liveness.
  • number: About 300 lines for the protocol model and 1000 lines for the proofs
  • number: IronFleet took about 3.7 person-years (the paper’s figure)
  • limits: Liveness is cheap here because the model is lock-step, with no leader and no timing. That is the notes’ inference. The proof is a counting argument, not a fairness argument.
  • how much was read: parts read
  • source
  • record id: logres-2020
• Apalache (2019)
  • title: Apalache: temporal properties tutorial, feature table and TLA+ model checking made symbolic
  • what: Apalache is a model checker for TLA+ that works on symbols instead of listing states, using an SMT solver. It checks state, action and trace invariants, inductive invariants (a property that holds at the start and is preserved by every step) and temporal properties.
  • limits: Apalache parses ASSUME but does not pass it to the solver. It does not use THEOREM. Its bounded checks do not prove properties for unbounded runs. The authors did not read the original paper.
  • how much was read: parts read
  • source; notes: tools; notes: Model checking: what a successful run means
  • record id: apalache-2019
• HotStuff (2019)
  • title: HotStuff: BFT Consensus in the Lens of Blockchain
  • what: HotStuff is BFT consensus (it tolerates arbitrarily faulty replicas) with n=3f+1 replicas, a known delay bound Δ and an unknown GST. If a correct leader stays in one view long enough after GST, Basic HotStuff decides. A Pacemaker keeps replicas and leaders in step.
  • limits: The argument is handwritten. The deployed Pacemaker is not machine-checked. The chained variant needs two consecutive correct leaders, and its liveness argument is omitted for brevity. Completing in a single view does not establish that this view is eventually selected (an inference).
  • how much was read: parts read
  • source; notes: HotStuff; notes: Consensus: where the assumptions enter the proof
  • record id: hotstuff-2019
• Tendermint (2018)
  • title: The latest gossip on BFT consensus
  • what: The paper presents the Tendermint algorithm. It proves that, after GST, a favorable round arises from the proposer rotation, the growing timeouts and the gossip. Then all correct participants decide.
  • number: faulty voting power below one third of total
  • limits: The proof is handwritten. It says nothing about verifying current Tendermint successors. The fault unit is voting power, not replica count. The page reference for lemma 7 in the inherited review was wrong for the v3 the review notes inspected.
  • how much was read: parts read
  • source; notes: Tendermint; notes: Consensus: where the assumptions enter the proof
  • record id: tendermint-2018
• ConsL cutoff (2017)
  • title: Cutoff Bounds for Consensus Algorithms
  • what: It describes round-based consensus algorithms in a small language, ConsL. It proves bounds on how many processes are enough to check. It translates the algorithms to Promela/LTL for the Spin model checker.
  • number: Table 2: 9 cases (Paxos, Paxos 3 rounds, Chandra-Toueg, an algorithm from Consensus Refined, 1/3-rule, coordinated uniform voting, simplified version, uniform voting variant, Ben-Or)
  • number: Cutoffs: 5 processes, except 1/3-rule at 7
  • number: Pages 217-237
  • limits: Progress claims keep the communication assumptions. Failed processes keep receiving, but their messages are suppressed. Ben-Or termination here is not termination with probability one against arbitrary adversaries. The notes did not recover the generated model download.
  • how much was read: parts read
  • source; notes: Cutoff and bounded instantiation leads
  • record id: consl-cutoff-2017
• Formal Verification of Distributed Algorithms: From Pseudo Code to Checked Proofs (2012)
  • what: Isabelle/HOL proofs of safety and liveness for consensus algorithms. They use a transition system with explicit runs. The examples are a Rotating Coordinator, Chandra-Toueg consensus and Paxos.
  • number: approximately 10k lines of Isabelle/HOL per algorithm
  • limits: The work is old and manual. The review notes read about 50% of it.
  • how much was read: parts read
  • source
  • record id: formal-verification-of-distributed-2012
• Heard-Of (AFP) (2012)
  • title: Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model
  • what: Isabelle proofs of six consensus algorithms in the Heard-Of model. Two ways of defining runs are linked by a reduction theorem. Termination of LastVoting is proved under a “communication predicate” (a condition on which messages arrive) instead of weak or strong fairness.
  • number: six consensus algorithms (OneThirdRule, Uv, LastVoting, Ute, Ate, Eigbyz)
  • limits: The communication predicate is a strong assumption about the environment: a good phase in which a coordinator hears a majority and everyone hears the coordinator. The user must argue that it is realistic (the notes’ inference).
  • how much was read: parts read
  • source
  • record id: heard-of-afp-2012
• Proving that non-blocking algorithms don’t block (2009)
  • what: The first fully automatic tool to prove non-blocking liveness (lock-free and obstruction-free) of concurrent data structures. It uses rely-guarantee reasoning (each thread assumes what others do and promises what it does), shape analysis and a termination prover.
  • number: lock-freedom proofs found in under 10 minutes for all cases except Michael’s list, which took about 8 hours
  • number: found a linked-list deletion in Fomitchev and Yahav that is not obstruction-free
  • limits: It is not about distributed systems. The review notes read about 25% of the paper.
  • how much was read: parts read
  • source
  • record id: proving-that-non-blocking-2009
• PBFT (1999)
  • title: Practical Byzantine Fault Tolerance
  • what: Clients eventually get replies if at most (n-1)/3 replicas are faulty and message delays do not grow faster than the timeout forever. The proof raises view timeouts, gets correct replicas into the same view, and rotates primaries until a correct one has enough time.
  • limits: Read in the official HTML because the PDFs failed. The delay condition is specific to this paper. It is not the modern GST contract.
  • how much was read: parts read
  • source; notes: Consensus: where the assumptions enter the proof; notes: PBFT
  • record id: pbft-1999
• TLA (1994)
  • title: The Temporal Logic of Actions
  • what: The paper describes a system as states and allowed steps (behaviors). It gives a logic for safety and for temporal properties such as progress that rests on fairness.
  • limits: The hard work sits in the invariants for the premises of WF1 (the proof rule for weak fairness). Page numbers refer to the manuscript on the author’s site.
  • how much was read: parts read
  • source; notes: S1; notes: P02. The Temporal Logic of Actions; notes: connecting different descriptions of the same behavior
  • record id: tla-1994
• DLS partial synchrony (1988)
  • title: Consensus in the Presence of Partial Synchrony
  • what: It defines two ways to weaken synchrony. In one, the timing bounds are fixed but unknown. In the other, the bounds are known but hold only after an unknown global stabilization time. It gives consensus algorithms whose agreement always holds and whose termination holds after stabilization.
  • number: crash/omission consensus needs N >= 2t+1 and Byzantine needs N >= 3t+1 in the partially synchronous columns of Table I
  • number: Algorithm 1: all correct processors decide by round GST + 4(N+1) in the basic round model
  • number: Theorem 4.1(b): N >= 3t+1
  • limits: The proofs are on paper, with no machine-checked artifact. The bound is counted in rounds of the basic round model, not in seconds. A timeout is not evidence of a crash.
  • how much was read: parts read
  • source; notes: Dwork–Lynch–Stockmeyer partial synchrony; notes: Consensus: where the assumptions enter the proof
  • record id: dls-partial-synchrony-1988
• FLP (1985)
  • title: Impossibility of Distributed Consensus with One Faulty Process
  • what: Shows that no deterministic asynchronous consensus protocol can guarantee a decision on every allowed execution if one process may stop, even when messages are always eventually delivered.
  • limits: This is an impossibility result under its stated assumptions only. Randomization or eventual synchrony changes the problem.
  • how much was read: parts read
  • source; notes: S26; notes: Consensus: where the assumptions enter the proof
  • record id: flp-1985
• CockroachDB TLA+ models
  • what: ParallelCommits.tla states progress assertions: the transaction record is eventually aborted or committed, and all intents (pending writes) are eventually resolved. The central property in StoreLiveness.tla, ‘Durable Support’, is a safety obligation despite its name.
  • limits: These are models only, with no proof that code matches them. Classify properties by their formula, not by file name.
  • how much was read: parts read
  • source; notes: R07. etcd/Raft, TiDB, Elastic, and CockroachDB
  • record id: cockroachdb-tla-models
• coq-tla
  • what: An embedding of TLA in Coq, built to help people understand progress proofs through small examples.
  • limits: The README says: ‘not suitable for large systems or complex temporal reasoning’.
  • how much was read: parts read
  • source; notes: R03. Embeddings in Dafny, Coq, Lean, and Isabelle
  • record id: coq-tla
• Ivy liveness examples
  • what: Official Ivy examples: ticket scheduling, FIFO, cascaded, blocked and bypassing queues, and model refinement. ticket.ivy is the running example of the POPL’18 paper. ticket_nested.ivy needs temporal prophecy (guesses about the future).
  • limits: These are abstract proof models. The review did not run the checker.
  • how much was read: parts read
  • source; notes: additional temporal methods
  • record id: ivy-liveness-examples
• nuXmv
  • title: nuXmv model checker
  • what: A model checker for finite-state systems (using SAT) and infinite-state systems (using SMT). Its features page lists K-liveness alongside IC3, bounded model checking, and abstraction/refinement.
  • limits: Record which algorithm ran and whether it returned a proof, a counterexample, unknown, or success within a bound. There is no effort statistic for any specific case.
  • how much was read: parts read
  • source; notes: Model checking: what a successful run means
  • record id: nuxmv
• Spin
  • title: Spin model checker (manual: ltl and Pan options)
  • what: Spin takes inline LTL (a logic for statements about time) with always, eventually and until. It negates a positive requirement and searches for a counterexample: a cycle that loops through an accepting state. Pan’s -a searches for such cycles, -l searches for non-progress cycles, and weak fairness (a step that stays enabled eventually happens) is an explicit option.
  • limits: Exhaustive checking covers only the finite Promela model. Bounded-depth and bitstate modes cover less. The link from model to implementation needs separate justification.
  • how much was read: parts read
  • source; notes: Model checking: what a successful run means
  • record id: spin
• tla-dafny
  • what: An embedding of TLA+ in Dafny, with explicit state parameters and temporal formulas.
  • limits: It is infrastructure. It is not a translator from arbitrary source.
  • how much was read: parts read
  • source; notes: R03. Embeddings in Dafny, Coq, Lean, and Isabelle
  • record id: tla-dafny
• TLAPS liveness examples
  • title: tlapm examples (SimpleEventually, Dekker, Allocator)
  • what: These are example TLA+ proofs. SimpleEventually is a 73-line proof that a toy spec eventually sets x to TRUE. Dekker (978 lines) proves mutual exclusion, no-stuck and starvation freedom. Allocator states liveness properties but proves only safety theorems.
  • number: SimpleEventually: 73 lines, four proof steps
  • number: Dekker: 978 lines, two steps left OMITTED
  • number: Allocator: 297 lines, no THEOREM for its three liveness properties
  • limits: By the notes’ inference, there is exactly one fully proved non-toy liveness example, Dekker, with two omitted steps. The other proofs listed (Paxos, Bakery, Peterson, EWD840) are about safety.
  • how much was read: parts read
  • source
  • record id: tlaps-liveness-examples
• TLC
  • title: TLC model checker (LiveCheck implementation and Toolbox docs)
  • what: The explicit-state model checker for TLA+. Its LiveCheck source builds a liveness graph with workers. On a violation it returns TLC_TEMPORAL_PROPERTY_VIOLATED.
  • limits: A run that fails, for example by running out of memory, is not a liveness proof. The notes’ author did not inspect TLC’s formal correctness proof or its support for fairness fragments. Bounds and config determine the state space. A checked finite instance is not a proof for arbitrary node counts.
  • how much was read: parts read
  • source; notes: Model checking: what a successful run means; notes: TLA+, PlusCal, TLC, TLAPS
  • record id: tlc
• CB-Ver (2026)
  • title: CB-Ver: A Stable Foundation for Modular Network Control Plane Verification
  • what: CB-Ver verifies that network control planes eventually become stable. The human gives a spec for each component, SMT checks them, and soundness is proved in Lean. It can also synthesize component specs using Constrained Horn Clauses.
  • number: benchmarks: fat-tree and Internet2 networks with a 24 h timeout, compared with Timepiece and Minesweeper
  • limits: The notes cover only the abstract and the evaluation setup.
  • how much was read: only abstract or first pages read
  • source
  • record id: cb-ver-2026
• Liveness to Safety for Distributed Systems (2026)
  • what: It replaces a progress proof with a monitor over a sequence of weakly fair states (states where an action that stays enabled is eventually taken). Examples: spanning tree construction, leader selection in each tree of a forest, and maximal independent set.
  • limits: The full text was unavailable (Springer subscription preview). Only the abstract was seen, so the human inputs, sizes and times are unknown.
  • how much was read: only abstract or first pages read
  • source; notes: Liveness to Safety for Distributed Systems (2026): found; full text un
  • record id: liveness-to-safety-for-2026
• On the Notions of Bounded Bypass, and How to Make any Deadlock-Free Mutex Protocol Satisfy One of Them (2026)
  • what: Defines bounded bypass (a limit on how often others can overtake a waiting process) as a liveness property between starvation-freedom and fairness. Model checking found mistakes in the definitions and proofs.
  • limits: The review notes read the abstract only.
  • how much was read: only abstract or first pages read
  • source
  • record id: on-the-notions-of-2026
• SureDistrib (2026)
  • title: SureDistrib: Verifying Almost-Sure Termination of Composite Asynchronous Byzantine Protocols
  • what: SureDistrib is a Rocq framework with refinement and composition lemmas. It gives the first mechanized proof that an asynchronous Byzantine binary agreement algorithm terminates with probability 1. The common coin is treated as a black box.
  • limits: The review notes did not extract the effort and read only the introduction and the framework overview.
  • how much was read: only abstract or first pages read
  • source; notes: SureDistrib: Verifying Almost-Sure Termination of Composite Asynchrono
  • record id: suredistrib-2026
• The Cross-Domain State Preservation Functor (2026)
  • what: An Isabelle/HOL development that claims safety plus starvation-freedom with f < n/3 Byzantine nodes.
  • number: 3,215 lines (search summary)
  • limits: A company preprint. The theorem and the model of partial synchrony are unchecked.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-cross-domain-state-2026
• Towards Proving Liveness on Weak Memory (Extended Version) (2026)
  • what: The paper gives proof rules for liveness on weak memory. They are response rules under weak fairness plus memory fairness, and ranking functions over weak-memory state. It proves that a ticket lock avoids starvation under Release-Acquire.
  • limits: The review notes read only the abstract and introduction.
  • how much was read: only abstract or first pages read
  • source
  • record id: towards-proving-liveness-on-2026
• Accountable Liveness (2025)
  • what: A security notion about assigning blame when a system stalls. It is not a proof technique.
  • limits: The notes did not read past the abstract.
  • how much was read: only abstract or first pages read
  • source
  • record id: accountable-liveness-2025
• DafnyMPI (2025)
  • what: DafnyMPI is a Dafny library. It proves deadlock freedom, termination, and functional equivalence with sequential implementations of MPI programs. Deadlock freedom comes from preconditions on MPI calls.
  • number: Three PDE solver case studies
  • limits: The notes cover only the abstract.
  • how much was read: only abstract or first pages read
  • source
  • record id: dafnympi-2025
• Fortifying Integrity, Traceability, and Operational Efficacy in Blockchain-Based Examination Management Through Formal Verification with TLA+ (2025)
  • what: Models an Ethereum smart contract for exam records in TLA+ (a specification language for state machines), checks it with the TLC model checker for safety and liveness, and maps the TLA+ constructs to Solidity code. Hoare logic (pre- and postconditions) is applied to key functions.
  • limits: Full text not obtained (IEEE paywall, no open copy found by Unpaywall or Semantic Scholar); only the abstract was read, so properties checked, state-space size and results are unknown.
  • how much was read: only abstract or first pages read
  • source; notes: TLA+ for a blockchain exam-management contract (2025)
  • record id: fortifying-integrity-traceability-and-2025
• Justness and lock-freedom (2021)
  • title: Assuming Just Enough Fairness to make Session Types Complete for Lock-freedom
  • what: Classifies fairness assumptions for lock-freedom in a minimal session calculus, identifying three semantically distinct notions with sound session type systems. A general merge operator yields completeness for the strongest notion based only on justness.
  • number: Three distinct lock-freedom notions are identified
  • number: Completeness holds for flexible-choice networks under justness
  • number: Strong fairness can prevent completeness
  • limits: The results fix a synchronous session calculus and depend on the chosen process and fairness semantics; they are theoretical rather than implementation benchmarks.
  • how much was read: only abstract or first pages read
  • source
  • record id: justness-and-lock-freedom-2021
• Making Weak Memory Models Fair (2021)
  • what: It shows that the standard fairness for threads is not enough under weak memory, and adds fairness for memory.
  • limits: Only the abstract was read.
  • how much was read: only abstract or first pages read
  • source
  • record id: making-weak-memory-models-2021
• Randomized threshold consensus (2021)
  • title: Verification of randomized consensus algorithms under round-rigid adversaries
  • what: Extends threshold automata for randomized consensus with unbounded asynchronous rounds; round-rigid adversaries reduce verification to one-round model checking and support almost-sure termination reasoning.
  • number: Automatically verifies Ben-Or, Bracha, 2-set agreement and RS-Bosco
  • number: Handles crashes and Byzantine faults
  • limits: Round-rigid schedules/adversaries are the fairness abstraction; probabilistic claims are model-specific.
  • how much was read: only abstract or first pages read
  • source
  • record id: randomized-threshold-consensus-2021
• TLA+ video course (2021)
  • what: Lamport’s official course page lists a sequence of TLA+ lessons covering behaviors, safety, liveness, fairness, invariants and proofs, with downloadable video material.
  • limits: Course page is instructional material, not an evaluation or a new result.
  • how much was read: only abstract or first pages read
  • source
  • record id: tla-video-course-2021
• Ensuring Liveness Properties of Distributed Systems: Open Problems (2020)
  • what: The paper argues that fairness assumptions can lead to false conclusions. It proposes justness instead.
  • limits: The review notes read only the abstract and introduction.
  • how much was read: only abstract or first pages read
  • source
  • record id: ensuring-liveness-properties-of-2020
• Making Byzantine Consensus Live (2020)
  • what: A spec for a view synchronizer (the component that gets nodes into the same view) strong enough to give liveness for single-shot HotStuff, Tendermint, PBFT and SBFT. The proofs are rigorous but not machine-checked.
  • limits: The review notes read the abstract only. The proofs are not mechanized.
  • how much was read: only abstract or first pages read
  • source
  • record id: making-byzantine-consensus-live-2020
• PoS Nakamoto Coq proof (2020)
  • title: Formalizing Nakamoto-Style Proof of Stake
  • what: Gives a Coq machine-checked proof of safety and liveness for a synchronous Proof-of-Stake Nakamoto-style blockchain using chain growth, chain quality and common-prefix properties.
  • number: Safety and liveness jointly implied by three chain properties
  • number: Static corrupted parties in a synchronous network
  • limits: The model assumes synchrony and a static corruption set; it is a protocol model rather than deployed code.
  • how much was read: only abstract or first pages read
  • source
  • record id: pos-nakamoto-coq-proof-2020
• LiLi (2016)
  • title: A Program Logic for Concurrent Objects under Fair Scheduling
  • what: A program logic based on rely-guarantee reasoning (each thread assumes what others do and promises what it does). It verifies linearizability (operations appear to take effect at one instant) and progress together, under fair scheduling. Applied to ticket locks, queue locks, lock-coupling lists, optimistic lists and lazy lists.
  • limits: Abstract only. No effort numbers.
  • how much was read: only abstract or first pages read
  • source
  • record id: lili-2016
• Parameterized liveness proof spaces (2016)
  • title: Proving Liveness of Parameterized Programs
  • what: Introduces well-founded proof spaces and quantified predicate automata to prove liveness for programs running with any number of threads, reducing infinite-trace inclusion to a safety-style finite-trace problem.
  • number: Ticket mutual-exclusion protocol is the worked case
  • number: Method targets arbitrary unbounded thread counts
  • limits: The ticket example’s non-starvation claim assumes every thread is scheduled infinitely often. The paper provides a theoretical foundation rather than a deployed distributed implementation.
  • how much was read: only abstract or first pages read
  • source
  • record id: parameterized-liveness-proof-spaces-2016
• Total-TaDA (2016)
  • title: Modular Termination Verification for Non-blocking Concurrency
  • what: A program logic for total correctness (the program terminates and gives the right result) of concurrent programs. Its specs constrain the thread’s concurrent environment. It expresses lock-freedom, wait-freedom and a new property, non-impedance.
  • limits: As far as the review notes read, it is a pen-and-paper logic, and they did not check whether it is mechanized. The review notes read the abstract and intro only.
  • how much was read: only abstract or first pages read
  • source
  • record id: total-tada-2016
• Ranking templates (2015)
  • title: Ranking Templates for Linear Loops
  • what: Synthesizes termination arguments for linear loops from parameterized ranking templates, including multiphase, nested, piecewise, parallel and lexicographic forms.
  • number: Templates are reduced to existential constraints using Motzkin’s transposition theorem
  • limits: The method targets linear loop programs and termination arguments; it is not a distributed-system implementation proof.
  • how much was read: only abstract or first pages read
  • source
  • record id: ranking-templates-2015
• Termite (2015)
  • title: Synthesis of Ranking Functions Using Extremal Counterexamples
  • what: Presents a complete method for synthesizing lexicographic linear ranking functions supported by inductive invariants, refining constraints using extremal counterexamples. The Termite prototype is compared with termination analyzers.
  • number: Termite implementation: 3,000 lines of OCaml
  • number: Benchmark suites: PolyBench 30 (22 solved), Sorts 6 (5), TermComp 129 (119), WTC 58 (46)
  • number: Termite solved 33% more examples than Loopus, in twice the time
  • limits: The method targets termination of programs whose transition relations include disjunctions and existential conditions; benchmark comparisons include front-end and invariant-generator limitations.
  • how much was read: only abstract or first pages read
  • source
  • record id: termite-2015
• LiLi tech report (2013)
  • title: Characterizing Progress Properties of Concurrent Objects via Contextual Refinements
  • what: The report gives formal operational definitions of all the common progress properties. It proves that, for linearizable objects, each one is equivalent to a kind of contextual refinement that preserves termination.
  • limits: The review notes read only the abstract. It has no effort numbers.
  • how much was read: only abstract or first pages read
  • source
  • record id: lili-tech-report-2013
• Paxos Commit (2006)
  • title: Consensus on Transaction Commit
  • what: Defines Two-Phase Commit and Paxos Commit, with TLA+ specifications of their safety properties, and explains when Paxos Commit makes progress despite coordinator failures.
  • number: Paxos Commit uses 2F+1 coordinators and makes progress when at least F+1 work
  • number: Two-Phase Commit is the F=0 special case
  • limits: The paper’s formal specifications omit liveness assumptions in the appendix; progress depends on the stated failure and majority assumptions.
  • how much was read: only abstract or first pages read
  • source
  • record id: paxos-commit-2006
• Colón-Sipma termination (2002)
  • title: Practical Methods for Proving Program Termination
  • what: Presents two algorithms that synthesize linear ranking functions from generated invariants: one based on widening and polyhedral cones, and a heuristic for structured programs with single-variable rankings.
  • number: One example’s invariant generation and termination proof took 2.5 seconds
  • number: The first method handles subtle linear combinations but is limited to few variables
  • limits: The algorithms target imperative programs and loop termination; the second method is heuristic and assumes structured programs.
  • how much was read: only abstract or first pages read
  • source
  • record id: colo-n-sipma-termination-2002
• Vacuity Detection in Temporal Model Checking (1999)
  • what: Checks whether every part of a temporal property actually affects whether it holds. Example: a property saying a request is eventually answered passes trivially if no request can ever occur.
  • limits: A witness showing the property is not vacuous does not prove that all intended clauses were specified. The notes had only the abstract and introduction (the extraction was damaged).
  • how much was read: only abstract or first pages read
  • source; notes: Testing strength, mutations, and vacuity; notes: Vacuity Detection in Temporal Model Checking
  • record id: vacuity-detection-in-temporal-1999
• AProVE: Termination and Memory Safety of C Programs - (Competition Contribution).
  • what: AProVE: Termination and Memory Safety of C Programs (Competition Contribution) Thomas Ströder, Cornelius Aschermann, Florian Frohn, Jera Hensel, and Jürgen Giesl RWTH Aachen University, Germany Abstract. AProVE is a system for automatic termination and complex- ity proofs of C, Java, Haskell, Prolog, and term rewrite systems. The particular strength of AProVE when analyzing C is its capability to rea- son about pointer arithmetic combined with direct memory accesses (as, e.g., in standard implementations of string algorithms).
  • how much was read: only abstract or first pages read
  • source
  • record id: aprove-termination-and-memory
• Commutativity for Concurrent Program Termination Proofs.
  • what: . This paper explores how using commutativity can improve the efficiency and efficacy of algorithmic termination checking for concur- rent programs. If a program run is terminating, one can conclude that all other runs equivalent to it up-to-commutativity are also terminat- ing.
  • how much was read: only abstract or first pages read
  • source
  • record id: commutativity-for-concurrent-program
• Compositional Termination Proofs for Multi-threaded Programs.
  • what: . Automated verification of multi-threaded programs is diffi- cult. Direct treatment of all possible thread interleavings by reasoning about the program globally is a prohibitively expensive task, even for small programs.
  • how much was read: only abstract or first pages read
  • source
  • record id: compositional-termination-proofs-for
• Global Progress in Dynamically Interleaved Multiparty Sessions
  • what: . A multiparty session forms a unit of structured interactions among many participants which follow a prescribed scenario specified as a global type signature. This paper develops, besides a more traditional communication type system, a novel static interaction type system for global progress in dynamically interleaved multiparty sessions.
  • how much was read: only abstract or first pages read
  • source
  • record id: global-progress-in-dynamically
• Goblint: Abstract Interpretation for Memory Safety and Termination - (Competition Contribution).
  • what: Goblint: Abstract Interpretation for Memory Safety and Termination (Competition Contribution) Simmo Saan1(B) ⋆, Julian Erhard2,3 , Michael Schwarz2 , Stanimir Bozhilov2 , Karoliine Holter1 , Sarah Tilscher2,3 , Vesal Vojdani1 , and Helmut Seidl2 1 University of Tartu, Tartu, Estonia {simmo.saan,karoliine.holter,vesal.vojdani}@ut.ee 2 Technische Universität München, Garching, Germany {julian.erhard,m.schwarz,stanimir.bozhilov, sarah.tilscher,helmut.seidl}@tum.de 3 Ludwig-Maximilians-Universität München, Munich, Germany Abstract. Goblint is an abstract interpreter of C programs, focusing on the analysis of multi-threaded code. It is equipped with a variety of abstract domains, as well as analyses which allow it to reason about an array of program properties in a highly configurable manner.
  • how much was read: only abstract or first pages read
  • source
  • record id: goblint-abstract-interpretation-for
• Learning Probabilistic Termination Proofs.
  • what: . We present the first machine learning approach to the ter- mination analysis of probabilistic programs. Ranking supermartingales (RSMs) prove that probabilistic programs halt, in expectation, within a finite number of steps.
  • how much was read: only abstract or first pages read
  • source
  • record id: learning-probabilistic-termination-proofs
• Multiparty Session Typing in Java, Deductively.
  • what: . Multiparty session typing (MPST) is a method to automat- ically prove safety and liveness of protocol implementations relative to specifications. We present BGJ: a new tool to apply the MPST method in combination with Java.
  • how much was read: only abstract or first pages read
  • source
  • record id: multiparty-session-typing-in
• Proving Nontermination via Safety.
  • what: . We show how the problem of nontermination proving can be reduced to a question of underapproximation search guided by a safety prover. This reduction leads to new nontermination proving implementa- tion strategies based on existing tools for safety proving.
  • how much was read: only abstract or first pages read
  • source
  • record id: proving-nontermination-via-safety
• Ranking Function Synthesis for Bit-Vector Relations.
  • what: . Ranking function synthesis is a key aspect to the success of modern termination provers for imperative programs. While it is well- known how to generate linear ranking functions for relations over (math- ematical) integers or rationals, efficient synthesis of ranking functions for machine-level integers (bit-vectors) is an open problem.
  • how much was read: only abstract or first pages read
  • source
  • record id: ranking-function-synthesis-for
• Sound Verification Procedures for Temporal Properties of Infinite-State Systems.
  • what: . First-Order Linear Temporal Logic (FOLTL) is particularly convenient to specify distributed systems, in particular because of the unbounded aspect of their state space. We have recently exhibited novel decidable fragments of FOLTL which pave the way for tractable verifi- cation.
  • how much was read: only abstract or first pages read
  • source
  • record id: sound-verification-procedures-for
• Temporal Property Verification as a Program Analysis Task.
  • what: . We describe a reduction from temporal property verification to a program analysis problem. We produce an encoding which, with the use of recursion and nondeterminism, enables off-the-shelf program analysis tools to naturally perform the reasoning necessary for proving temporal properties (e.g.
  • how much was read: only abstract or first pages read
  • source
  • record id: temporal-property-verification-as
• Termination and non-termination specification inference.
  • what: To capture the termination and non-termination behaviors of Techniques for proving termination and non-termination of imper- each program, Le et al. [32] has recently proposed an integrated ative programs are usually considered as orthogonal mechanisms. specification logic with three temporal predicates Term M, Loop In this paper, we propose a novel mechanism that analyzes and and MayLoop, which denote, respectively, the scenarios for definite proves both program termination and non-termination at the same program termination (with a lexicographic ranking measure M made time.
  • how much was read: only abstract or first pages read
  • source
  • record id: termination-and-non-termination
• Toward Liveness Proofs at Scale
  • what: . While the problem of mechanized proof of liveness of reactive pro- grams has been studied for decades, there is currently no method of proving live- ness that is conceptually simple to apply in practice to realistic problems, can be scaled to large problems without modular decomposition, and does not fail unpre- dictably due to the use of fragile heuristics. We introduce a method of liveness proof by relational rankings, implement it, and show that it meets these criteria in a realistic industrial case study involving a model of the memory subsystem in a CPU.
  • how much was read: only abstract or first pages read
  • source
  • record id: toward-liveness-proofs-at
• Verification and Synthesis of Symmetric Uni-Rings for Leads-To Properties.
  • what: This paper investigates the verification and synthesis of parameterized protocols that satisfy leadsto properties R Q on symmetric unidirectional rings (a.k.a. uni-rings) of deterministic and constant- space processes under no fairness and interleaving semantics, where R and Q are global state predicates. First, we show that verifying R Q for parameterized protocols on symmetric uni-rings is undecidable, even for deterministic and constant-space processes, and conjunctive state predicates.
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-and-synthesis-of-3
• VeriFuzz 1.4: Checking for (Non-)termination (Competition Contribution).
  • what: VeriFuzz 1.4: Checking for (Non-)termination (Competition Contribution) Ravindra Metta , Prasanth Yeduru , Hrishikesh Karmarkar , and Raveendra Kumar Medicherla?( ) TCS Research, Tata Consultancy Services, Pune, India {r.metta,prasanth.yeduru,hrishikesh.karmarkar,raveendra.kumar}@tcs.com Abstract. In VeriFuzz 1.4, we implemented two new techniques for checking Non-termination and Termination. VeriFuzz 1.4 won the Ter- mination category of SV-COMP 2023.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifuzz-1-4-checking
• Verifying LTL Properties of Hybrid Systems with K-Liveness.
  • what: . The verification of liveness properties is an important challenge in the design of real-time and hybrid systems. In contrast to the verification of safety properties, for which there are several solutions available, there are really few tools that support liveness properties such as general LTL formulas for hybrid systems, even in the case of timed automata.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-ltl-properties-of
• AdoB (2024)
  • title: AdoB: Bridging Benign and Byzantine Consensus with Atomic Distributed Objects
  • what: The authors use Coq to prove safety and progress of a generic consensus object. They also prove that specs written at the network level are refinements of it (they behave as a more detailed version of the object). For GenJolteon, they also prove liveness at the network level. They extract it to runnable OCaml event handlers, using a handwritten shim. For Fast Paxos, they prove only safety and refinement.
  • number: abstract benign AdoB proof under one person-month
  • number: GenJolteon refinement/safety eight person-months; liveness two person-months
  • number: Fast Paxos safety/refinement one person-month
  • number: proof lines 17,000, 2,700, 2,000 (case-study discussion, PDF p.22)
  • limits: This does not verify the production Jolteon or Fast Paxos code. There is no network-level liveness proof for Fast Paxos.
  • how much was read: reading depth not recorded
  • source; notes: AdoB: Bridging Benign and Byzantine Consensus with Atomic Distributed
  • record id: adob-2024
• Fairneris (2024)
  • title: Verifying Liveness Properties of Distributed Systems via Trace Refinement in Higher-Order Concurrent Separation Logic
  • what: Fairneris extends Aneris/Trillium to reason about progress in distributed systems. It reasons about code for the Stenning sliding-window protocol over a formal semantics resembling UDP. The proof that the implementation matches the model is machine-checked.
  • limits: The Stenning model’s liveness theorem is only a proof on paper. So the transfer of its eventual-progress result to the implementation is not fully machine-checked. No runnable OCaml extraction was established, and the final venue is unknown.
  • how much was read: reading depth not recorded
  • source; notes: Verifying Liveness Properties of Distributed Systems via Trace Refinem
  • record id: fairneris-2024
• PSync (2016)
  • title: PSync: A Partially Synchronous Language for Fault-Tolerant Distributed Algorithms
  • what: PSync algorithms are written in communication rounds, with stated assumptions about which rounds are good. A Scala runtime runs them. SMT checks the user’s invariants and progress conditions under lockstep round semantics (all nodes advance round by round together). A reduction connects these to partially synchronous executions.
  • number: LastVoting algorithm is 89 lines (Table 2, PDF p.13)
  • limits: The runtime cannot be written in PSync’s round language. So the reduction theorem does not verify every statement of the runtime.
  • how much was read: reading depth not recorded
  • source; notes: PSync: A Partially Synchronous Language for Fault-Tolerant Distributed
  • record id: psync-2016
• Coalescing (2014)
  • title: Coalescing: Syntactic Abstraction for Reasoning in First-Order Modal Logics
  • what: The paper sends mathematical proof obligations to ordinary first-order provers. It sends temporal combinations (statements about how things change over time) to a propositional temporal prover. Each backend never sees the expressions it cannot interpret, since they are hidden.
  • limits: It does not claim to fully automate liveness. The implementation limits it describes are historical and do not describe current TLAPS.
  • how much was read: reading depth not recorded
  • source; notes: P04. Coalescing: Syntactic Abstraction for Reasoning in First-Order Mo
  • record id: coalescing-2014
• Raft (2014)
  • title: In Search of an Understandable Consensus Algorithm
  • what: Raft’s randomised leader election uses timing to get a stable leader. The paper gives a rule of thumb for the timing.
  • limits: This is engineering guidance. It is not a deterministic GST theorem, and not a machine-checked liveness claim.
  • how much was read: reading depth not recorded
  • source; notes: Consensus: where the assumptions enter the proof
  • record id: raft-2014
• Paxos Made Simple (2001)
  • what: The paper separates the safety of agreement from progress. Section 2.4 shows that proposers can alternate higher-numbered proposals and stop any value from being chosen. So a distinguished proposer must be selected.
  • limits: It does not claim a machine-checked termination spec.
  • how much was read: reading depth not recorded
  • source; notes: Consensus: where the assumptions enter the proof
  • record id: paxos-made-simple-2001
• ACSLAgent (2026)
  • title: ACSLAgent: Verifier-Constrained Neural-Symbolic Synthesis of Formal Program Specifications
  • what: A tool that asks LLMs for C specifications (function contracts, loop invariants, loop variants for termination) and uses the Frama-C WP verifier to reject wrong ones, repairing from verifier feedback.
  • number: README claims 91.05% verification success (pass@5) across SyGuS, SV-COMP and industrial components
  • number: README claims termination proofs via synthesized ranking functions upgrade partial to total correctness
  • limits: No paper could be found: the Zenodo record is an anonymous code archive whose README is the only prose. Numbers are README claims with no method, baselines or tables; the full results are said to be on a Hugging Face space that was not read.
  • how much was read: not read; title and metadata only
  • source; notes: ACSLAgent (2026)
  • record id: acslagent-2026
• Liveness Proofs in Veil, Part I (2026)
  • what: A liveness encoding in Lean 4 for Veil. A one-step consensus toy is proved with the WF1 rule (a standard liveness proof rule) in about 30 lines.
  • number: About 30 lines
  • limits: It is a toy only. the review notes read a summary, not the paper.
  • how much was read: not read; title and metadata only
  • source
  • record id: liveness-proofs-in-veil-2026
• Proving liveness with TLA (2026)
  • what: The post proves in TLA+ that Xen vchan data eventually arrives. The first Availability property was vacuously true (it held trivially and said nothing).
  • limits: The review notes read it only through a summarizer.
  • how much was read: not read; title and metadata only
  • source
  • record id: proving-liveness-with-tla-2026
• TLA logic in Dafny (2024)
  • what: The post writes weak fairness as a Dafny predicate. The example is a countdown timer that the author calls silly.
  • limits: The review notes read it only through a summarizer.
  • how much was read: not read; title and metadata only
  • source
  • record id: tla-logic-in-dafny-2024
• Performal: Formal Verification of Latency Properties for Distributed Systems (2023)
  • what: This is a search lead from OpenAlex that nobody has read. The notes give only its title, year and DOI.
  • limits: The notes screened it as unreachable. The DOI PDF request returned paywall HTML, and no author copy was exposed. The notes mark it as a priority lead.
  • how much was read: not read; title and metadata only
  • source
  • record id: performal-formal-verification-of-2023
• Formal Verification of Liveness Properties in Causal Order Broadcast Systems Using Event-B (2021)
  • what: An unread search lead from OpenAlex. The notes give only its title, year and DOI.
  • limits: Not read. The claims are unverified.
  • how much was read: not read; title and metadata only
  • source
  • record id: formal-verification-of-liveness-2021
• Ramsey vs. Lexicographic Termination Proving (2013)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: ramsey-vs-lexicographic-termination-2013
• Detecting Fair Non-termination in Multithreaded Programs (2012)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: detecting-fair-non-termination-2012
• Formal verification of a consensus algorithm in the Heard-Of model (2009)
  • what: The paper proves a consensus algorithm correct in Isabelle, in the Heard-Of model. The proof is at least five times shorter than a fine-grained Paxos proof.
  • number: proof at least five times shorter than a fine-grained Paxos proof in Isabelle
  • limits: The review notes saw only a search summary and did not open the paper.
  • how much was read: not read; title and metadata only
  • record id: formal-verification-of-a-2009
• Proving thread termination (2007)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: proving-thread-termination-2007
• A Complete Method for the Synthesis of Linear Ranking Functions (2004)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: a-complete-method-for-2004
• Liveness Checking as Safety Checking (2002)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: liveness-checking-as-safety-2002
• Lentil
  • what: Lentil is proof infrastructure for linear temporal logic in Lean 4. It has its own proof mode.
  • limits: It embeds LTL. It does not translate TLA+ files.
  • how much was read: not read; title and metadata only
  • source
  • record id: lentil

Last edited: 2026-10-31