Friedrich W. von Henke

Learn More
Clock synchronization algorithms play a crucial role in a variety of fault-tolerant distributed architectures. Although those algorithms are similar in their basic structure, the particular designs diier considerably , for instance in the way clock adjustments are computed. This paper develops a formal generic theory of clock synchronization algorithms(More)
| PVS is the most recent in a series of verii-cation systems developed at SRI. Its design was strongly innuenced, and later reened, by our experiences in developing formal speciications and mechanically checked verii-cations for the fault-tolerant architecture, algorithms, and implementations of a model \reliable computing platform" (RCP) for life-critical(More)
We describe our experience with formal, machine-checked verification of algorithms for critical ap-, placations, concentrating on a Byzantine fault-tolerant algorithm for synchronizing the clocks in the replicated computers of a digit al flight control system. First, we explain the problems encountered in unsynchronized systems and the necessity, and(More)
In order to compare primitive recursive functions and transductions defined by automata in a natural way independent of encodings, we generalize the Grzegorczyk hierarchy, the recursion number hierarchy and the loop hierarchy from arithmetical to wordfunctions. We observe several differences between the arithmetical and the non-arithmetical theory. By means(More)
This paper describes our experience using coordinated atomic (CA) actions as a system structuring tool to design and validate a sophisticated control system for a complex industrial application that has high reliability and safety requirements. Our study is based on the "Fault-Tolerant Production Cell", which represents a manufacturing process involving(More)
We describe a formal speciication and mechanically checked veriica-tion of the Interactive Convergence Clock Synchronization Algorithm of Lamport and Melliar-Smith 16]. In the course of this work, we discovered several technical aws in the analysis given by Lamport and Melliar-Smith, even though their presentation is unusually precise and detailed. As far(More)
Schneider Sch87] generalizes a number of protocols for Byzantine fault-tolerant clock synchronization and presents a uniform proof for their correct-ness. We present a mechanical veriication of Schneider's protocol leading to several signiicant clariications and revisions. The veriication was carried out with the Ehdm system RvHO91] developed at the SRI(More)