Section: Scientific Foundations

Programming abstraction and verification

For the local level of abstraction, recursive rule languages (variants of Datalog) have been used to describe communication protocols [44] [45] , thus reviving the recursive languages developed in the 80's for deductive databases [26] [27] [51] , well-suited to define routes in networks. Query languages allow the expression of protocols, one or two orders of magnitude simpler than classical imperative programming languages. We continue this trend to demonstrate the potential of declarative rule languages for the local abstraction level, clarifying their semantics in asynchronous distributed computation, investigating further their expressive power and the complexity of their distributed evaluation. The definition of a rule language which admits efficient distributed execution while offering enough expressive power is still an active topic of research [40] .

Having correct and robust protocols is fundamental for critical distributed systems. Ensuring the desirable properties of protocols is a very difficult problem. Neither simulations nor testbed implementations can ensure the quality required for network protocols. As an alternative to these methods, some researchers have successfully investigated the use of formal verification as a mean to guarantee the quality of protocols [30] [36] [46] [48] .

Formal verification is a technique that assures whether a system enjoys a given property, based on a formal model of the system under evaluation. There are roughly two approaches to formal verification. The first approach is model checking [35] , which consists of an exhaustive exploration of all states and transitions in the formal model of the system. A lot of model checking tools have been developed, such as SPIN [41] , UPPAAL [24] , PRISM [23] , etc. The second approach is logical inference. It relies on a formal mathematical model for reasoning about the system, usually using theorem proving software such as the HOL [22] , or the Coq [21] . This is usually only partially automated and is driven by the user's understanding of the system to validate.

We have pursued the second approach, by using the Coq proof assistant for protocols expressed in rule languages. This requires the modeling in Coq of the distributed systems, the machine evaluating the rule programs, as well as the theory of interest for the class of protocols considered.Ê