MODIST: transparent model checking of unmodified distributed systems

  • Authors:

  • Junfeng Yang;Tisheng Chen;Ming Wu;Zhilei Xu;Xuezheng Liu;Haoxiang Lin;Mao Yang;Fan Long;Lintao Zhang;Lidong Zhou

  • Affiliations:

  • Columbia University and Microsoft Research Silicon Valley;Microsoft Research Asia;Microsoft Research Asia;Microsoft Research Asia;Microsoft Research Asia;Microsoft Research Asia;Microsoft Research Asia;Tsinghua University;Microsoft Research Asia and Microsoft Research Silicon Valley;Microsoft Research Asia and Microsoft Research Silicon Valley

  • Venue:
  • NSDI'09 Proceedings of the 6th USENIX symposium on Networked systems design and implementation
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

MODIST is the first model checker designed for transparently checking unmodified distributed systems running on unmodified operating systems. It achieves this transparency via a novel architecture: a thin interposition layer exposes all actions in a distributed system and a centralized, OS-independent model checking engine explores these actions systematically. We made MODIST practical through three techniques: an execution engine to simulate consistent, deterministic executions and failures; a virtual clock mechanism to avoid false positives and false negatives; and a state exploration framework to incorporate heuristics for efficient error detection. We implemented MODIST on Windows and applied it to three well-tested distributed systems: Berkeley DB, a widely used open source database; MPS, a deployed Paxos implementation; and PACIFICA, a primary-backup replication protocol implementation. MODIST found 35 bugs in total. Most importantly, it found protocol-level bugs (i.e., flaws in the core distributed protocols) in every system checked: 10 in total, including 2 in Berkeley DB, 2 in MPS, and 6 in PACIFICA.