There is an urgent need for ''T-shaped'' software developers with breadth in Quantum Computing (QC) and depth in Computer Science and Software Engineering, who can build and work with the quantum-powered applications of the near future. This paper reports on our experiences implementing the Quantum-Aware (Q-Aware) track, an adaptable and lightweight curricular framework that can be integrated into existing curricula for the preparation of quantum-aware graduates. Our focus here is a study conducted on the integration of Q-Aware into Data Structures and Discrete Structures courses during Fall 2025. One goal of this study was to investigate the effectiveness of Q-Aware in helping students achieve the level of knowledge and skills for quantum awareness. In addition to a high level of enthusiasm of students for participation in Q-Aware, we observed a substantial increase in confidence of students when it comes to understanding concepts such as qubit, quantum state, superposition and quantum measurement. A second goal was to assess the effectiveness of QC training for the instructors teaching these courses. Student feedback was positive overall about the effectiveness of lectures, motivating students, effective use of time, and handling students' questions.

This work proposes a novel cognitive model, called Aggregate-Superpose-Project (ASP), to facilitate problem solving and the analysis of algorithms in Quantum Computing (QC). Our model contains three simple abstractions that help students use classic computing concepts towards specifying quantum states and transformations. Simplicity is a major advantage of ASP along with reinforcing the use of classical concepts in learning QC abstractions. Preliminary evaluations indicate that ASP can provide students with the means to describe quantum algorithms at appropriate levels of abstraction.

The complexity of statutory legislation can generate confusion and disagreement in interpretation even among experts and can leave ordinary citizens disempowered. Technological “solutions”, even with stakeholders’ best interests in mind, can exacerbate this sense of estrangement from the law. We are exploring an alternative application of technology in this area: a digital “sandbox” environment for legislators, lawyers, judges, and citizens to define and explore the consequences of legislation. Our approach employs a “lightweight” method to computational modeling, using automated analysis to uncover hidden assumptions and unintended consequences. As a case study, we are focusing on a number of U.S. statutes that define conditions under which prior convictions can be expunged from an individual’s public record. We use the Alloy modeling language and analyzer to explore consequences of expungement statutes. Starting with the State of Michigan’s Clean Slate Law and then extending to similar statutes in Utah and Arizona, we can model varying interpretations of the law in terms of modular changes to a base model, and then use the Alloy analyzer to explore the consequences of these interpretations. We have developed a user interface for the model that is tuned to the needs of individuals seeking expungement and their legal assistants, determining which convictions within the individual’s record can be expunged under varying interpretations, and explaining why some convictions may not be expunged. This application not only serves as a proof of concept for our larger sandbox vision but also has promise as a useful tool for individuals navigating the complexities of expungement.

Motif Searching is an important problem that can reveal crucial information from biological data. Since the general motif searching is NP-hard and the volume of biological data is growing exponentially in recent years, there is a pressing need for developing time and space-efficient algorithms to find motifs. In this paper, we explore scalable parallelization for Edit Distance-Based Motif Search (EMS). We introduce two parallel designs, recursEMS which integrates the existing EMS solver into a parallel recursion tree running in multiple processes, and parEMS that presents a novel thread-based method which avoids the storage of redundant motif candidates. To make the parallel designs practical, we implement SPEMS, a Scalability-sensitive Parallel solver for EMS. For any given biological dataset and search instance, SPEMS can provide an EMS parallelization towards the optimal performance, or a sub-optimal performance but being more space efficient. Evaluations on two real-world DNA dataset TRANSFAC and ChIP-seq show that SPEMS can obtain 10× geometric mean speedup over the state-of-the-art at the expense of no less than 74.7% memory overheads, or provide 2.2× geometric mean speedup with the possibility of consuming less memory, when running on a 48-core machine.

This article presents an approach for model extraction, formal specification, verification, and repair of the scheduler of Contiki, which is an event-driven lightweight operating system for the Internet of Things (IoT). We first derive a state machine–based abstraction of the scheduler’s modes of operation along with the control flow abstractions of the scheduler’s most important functions. We then use a set of transformation rules to formally specify the scheduler and all its internal functions in Promela. Additional contributions with respect to the conference version of this article include (1) modeling nested function calls in the Promela model of the scheduler using a novel technique amenable to model checking in SPIN; (2) modeling protothreads in Promela; (3) specifying and formally verifying 12 critical requirements of the scheduler; (4) detecting new design flaws in Contiki’s scheduler for the first time (to the best of our knowledge); (5) repairing the model and the source code of Contiki’s scheduler towards fixing the flaws detected through verification, as well as regression verification of the entire model of the scheduler; and (6) experimentally analyzing the time and space costs of verification before and after repair. The proposed formal model of Contiki’s scheduler along with novel modeling techniques enhance our knowledge regarding the most critical components of Contiki and provide reusable methods for formal specification and verification of other event-driven operating systems used in Cyber Physical Systems (CPSs) and the IoT.

This article presents a novel method, called Modular Grammatical Evolution (MGE), toward validating the hypothesis that restricting the solution space of NeuroEvolution to modular and simple neural networks enables the efficient generation of smaller and more structured neural networks while providing acceptable (and in some cases superior) accuracy on large data sets. MGE also enhances the state-of-the-art Grammatical Evolution (GE) methods in two directions. First, MGE's representation is modular in that each individual has a set of genes, and each gene is mapped to a neuron by grammatical rules. Second, the proposed representation mitigates two important drawbacks of GE, namely the low scalability and weak locality of representation, toward generating modular and multilayer networks with a high number of neurons. We define and evaluate five different forms of structures with and without modularity using MGE and find single-layer modules with no coupling more productive. Our experiments demonstrate that modularity helps in finding better neural networks faster. We have validated the proposed method using ten well-known classification benchmarks with different sizes, feature counts, and output class counts. Our experimental results indicate that MGE provides superior accuracy with respect to existing NeuroEvolution methods and returns classifiers that are significantly simpler than other machine learning generated classifiers. Finally, we empirically demonstrate that MGE outperforms other GE methods in terms of locality and scalability properties.

This paper investigates the verification and synthesis of parameterized protocols that satisfy leadsto properties on symmetric unidirectional rings (a.k.a. uni-rings) of deterministic, self-disabling and constant-space processes. First, we show that when$R$and$Q$are conjunctive global state predicates, verifying ‘$R$leadsto$Q$’ (denoted$R \leadsto Q$) for parameterized protocols on symmetric uni-rings is undecidable. Then, we show that surprisingly synthesizing symmetric uni-ring protocols that satisfy$R \leadsto Q$is actually decidable. We identify necessary and sufficient conditions for the decidability of synthesis based on which we design and implement a sound and complete algorithm that takes the predicates$R$and$Q$, and automatically generates a parameterized protocol that satisfies$R \leadsto Q$for unbounded (but finite) ring sizes. Moreover, we show that verifying leadsto properties remains undecidable even if$R$and$Q$are local state predicates! This result would lead to the impossibility of computing a cutoff for local leadsto on symmetric rings of deterministic, self-disabling and constant-space processes. We further show that verifying local and global deadlocks in our formal setting are decidable problems. We also present a cutoff theorem that enables the construction of symmetric rings where deadlocks are reachable.

This paper investigates the synthesis of parameterized systems that are self-stabilizing by construction. To this end, we present several significant results. First, we show a counterintuitive result that despite the undecidability of verifying self-stabilization for parameterized unidirectional rings, synthesizing self-stabilizing unidirectional rings is decidable! This is surprising because it is known that, in general, the synthesis of distributed systems is harder than their verification. Second, we present a topology-specific synthesis method (derived from our proof of decidability) that generates the state transition system of template processes of parameterized self-stabilizing systems with elementary unidirectional topologies (e.g., rings, chains, trees). We also provide a software tool that implements our synthesis algorithms and generates interesting self-stabilizing parameterized unidirectional rings in less than 50 microseconds on a regular laptop. We validate the proposed synthesis algorithms for decidable cases in the context of several interesting distributed protocols. Third, we show that synthesis of self-stabilizing bidirectional rings remains undecidable.

This paper investigates the verification and synthesis of parameterized protocols that satisfy global leadsto properties R ~→ Q on symmetric unidirectional rings (a.k.a. uni-rings) of deterministic and constant-space processes, where R and Q denote global state predicates. First, we show that verifying R ~→ Q for parameterized protocols on symmetric uni-rings is undecidable, even for deterministic and constant-space processes, and conjunctive state predicates. Then, we show that surprisingly synthesizing symmetric uni-ring protocols that satisfy R ~→ Q is actually decidable. We identify necessary and sufficient conditions for the decidability of synthesis based on which we devise a sound and complete algorithm that takes the predicates R and Q, and automatically generates a parameterized protocol that satisfies R ~→ Q for unbounded (but finite) ring sizes. We use our algorithm to synthesize some parameterized protocols, including an agreement protocol.

This article investigates the verification of livelock-freedom and self-stabilization on parameterized rings consisting of symmetric, constant space, deterministic, and self-disabling processes. The results of this article have a significant impact on several fields, including scalable distributed systems, resilient and self- * systems, and verification of parameterized systems. First, we identify necessary and sufficient local conditions for the existence of global livelocks in parameterized unidirectional rings with unbounded (but finite) number of processes under the interleaving semantics. Using a reduction from the periodic domino problem, we show that, in general, verifying livelock-freedom of parameterized unidirectional rings is undecidable (specifically, Π 1 0 -complete) even for constant space, deterministic, and self-disabling processes. This result implies that verifying self-stabilization for parameterized rings of self-disabling processes is also undecidable. We also show that verifying livelock-freedom and self-stabilization remain undecidable under (1) synchronous execution semantics, (2) the FIFO consistency model, and (3) any scheduling policy. We then present a new scope-based method for detecting and constructing livelocks in parameterized rings. The proposed semi-algorithm behind our scope-based verification is based on a novel paradigm for the detection of livelocks that totally circumvents state space exploration. Our experimental results on an implementation of the proposed semi-algorithm are very promising as we have found livelocks in parameterized rings in a few microseconds on a regular laptop. The results of this article have significant implications for scalable distributed systems with cyclic topologies.

In this paper, we evaluate the effectiveness of model slicing to provide assurance about correctness of SystemC TLM programs. The need for such assurance is important since SystemC has become a de-facto standard for building systems with hardware/software co-design. Existing approaches that enable one to transform the given SystemC TLM program into an UPPAAL model that can be verified suffer from models that result in state space explosion. This problem becomes even more complex when verifying fault-tolerance. Model slicing has the potential to provide a solution to this problem. Therefore, we focus on developing a model slicer that extends existing work on model slicing and combines it with tools to generate UPPAAL models from SystemC TLM programs and tools to add the impact of faults to those UPPAAL models. The experimental results show that with the proposed framework, the designer is capable of verifying even very complex SystemC TLM models, which would have been impossible without the proposed approach.

This paper presents a novel two-step method for automated design of self-stabilization. The first step enables the specification of legitimate states and an intuitive (but imprecise) specification of the desired functional behaviors in the set of legitimate states (hence the term “shadow”). After creating the shadow specifications, we systematically introduce the main variables and the topology of the desired self-stabilizing system. Subsequently, we devise a parallel and complete backtracking search towards finding a self-stabilizing solution that implements a precise version of the shadow behaviors, and guarantees recovery to legitimate states from any state. To the best of our knowledge, the shadow/puppet synthesis is the first sound and complete method that exploits parallelism and randomization along with the expansion of the state space towards generating self-stabilizing systems that cannot be synthesized with existing methods. We have validated the proposed method by creating both a sequential and a parallel implementation in the context of a software tool, called Protocon. Moreover, we have used Protocon to automatically design three new self-stabilizing protocols that we conjecture to require the minimal number of states per process to achieve stabilization (when processes are deterministic): 2-state maximal matching on bidirectional rings, 5-state token passing on unidirectional rings, and 3-state token passing on bidirectional chains.

This paper investigates the complexity of adding nonmasking fault tolerance, where a nonmasking fault-tolerant program guarantees recovery from states reached due to the occurrence of faults to states from where its specifications are satisfied. We first demonstrate that adding nonmasking fault tolerance to low atomicity programs-where processes have read/write restrictions with respect to the variables of other processes--is NP-complete (in the size of the state space) on an unfair or weakly fair scheduler. Then, we establish a surprising result that even under strong fairness, addition of nonmasking fault tolerance remains NP-hard! The NP-hardness of adding nonmasking fault tolerance is based on a polynomial-time reduction from the 3-SAT problem to the problem of designing self-stabilizing programs from their non-stabilizing versions, which is a special case of adding nonmasking fault tolerance. While it is known that designing self-stabilization under the assumption of strong fairness is polynomial, we demonstrate that adding self-stabilization to non-stabilizing programs is NP-hard under weak fairness.

We focus on the problem of adding multitolerance to an existing fault-intolerant program. A multitolerant program tolerates multiple classes of faults and provides a potentially different level of fault tolerance to each of them. We consider three levels of fault tolerance, namely failsafe (i.e., satisfy safety in the presence of faults), nonmasking (i.e., recover to legitimate states after the occurrence of faults), and masking (both). For the case where the program is subject to two classes of faults, we consider six categories of multitolerant programs—FF, FN, FM, MM, MN, and NN, where F, N, and M represent failsafe, nonmasking, and masking levels of tolerance provided to each class of fault. We show that the problem of adding FF, NN, and MN multitolerance can be solved in polynomial time (in the state space of the program). However, the problem is NP-complete for adding FN, MM, and FM multitolerance. We note that the hardness of adding MM and FM multitolerance is especially atypical given that MM and FM multitolerance can be added efficiently under more restricted scenarios where multiple faults occur simultaneously in the same computation. We also present heuristics for managing the complexity of MM multitolerance. Finally, we present real-world multitolerant programs and discuss the trade-off involved in design decisions while developing such programs.

This paper presents a method that can generate Self-Stabilizing (SS) parameterized protocols that are generalizable, i.e., correct for arbitrary number of finite-state processes. Specifically, we present necessary and sufficient conditions specified in the local state space of the representative process of parameterized rings for deadlock-freedom in their global state space. Moreover, we introduce sufficient conditions that guarantee live lock-freedom in arbitrary-sized unidirectional rings. We illustrate the proposed approach in the context of several classic examples including a maximal matching protocol and an agreement protocol. More importantly, the proposed method lays the foundation of an approach for automated design of global convergence in the local state space of the representative process.

Design and verification of Self-Stabilizing (SS) network protocols are difficult tasks in part because of the convergence property that requires an SS protocol to recover to a set of legitimate states from any state in its state space. Once an SS protocol reaches a legitimate state, it remains in the set of legitimate states as long as there are no faults, called the closure property. Distribution issues exacerbate the design complexity of SS protocols as processes should collaborate and take local actions that result in global convergence. Most existing design techniques are manual, and mainly focus on protocols whose global state can be corrected if the local states of all processes are corrected, called the locally correctable protocols. After manual design, an SS protocol has to be verified for closure and convergence. Previous work observes that verifying SS protocols is a harder problem than designing them as developers have to ensure the correctness of closure and convergence functionalities and their noninterference. An algorithmic method for the design of convergence generates protocols that are correct by construction, thereby eliminating the need for verification. In order to facilitate the design of SS protocols, this article presents a lightweight method for algorithmic addition of convergence to finite-state nonstabilizing protocols, including nonlocally correctable protocols. The proposed method enables the reuse of design efforts in the development of different self-stabilizing protocols. Moreover, for the first time (to the best of our knowledge), this article presents an algorithmic method for the addition of convergence to symmetric protocols that consist of structurally similar processes. The proposed approach is supported by a software tool that automatically adds convergence to nonstabilizing protocols. We have used the proposed method/tool to automatically generate several self-stabilizing protocols with up to 40 processes (and 3 40 states) in a few minutes on a regular PC. Surprisingly, our tool has synthesized both protocols that are the same as their manually designed versions as well as alternative solutions for well-known problems in the literature (e.g., Dijkstra’s token ring, maximal matching, graph coloring, agreement and leader election in a ring). Moreover, the proposed method has helped us detect a design flaw in a manually designed self-stabilizing protocol.

Design and verification of Self-Stabilizing (SS) network protocols are difficult tasks in part because of the requirement that a SS protocol must recover to a set of legitimate states from any state in its state space (when perturbed by transient faults). Moreover, distribution issues exacerbate the design complexity of SS protocols as processes should take local actions that result in global recovery/convergence of a network protocol. As such, most existing design techniques focus on protocols that are locally-correctable. To facilitate the design of finite-state SS protocols (that may not necessarily be locally-correctable), this paper presents a lightweight formal method supported by a software tool that automatically adds convergence to non-stabilizing protocols. We have used our method/tool to automatically generate several SS protocols with up to 40 processes (and 340states) in a few minutes on a regular PC. Surprisingly, our tool has automatically synthesized both protocols that are the same as their manually-designed versions as well as new solutions for well-known problems in the literature (e.g., Dijkstra's token ring). Moreover, the proposed method has helped us reveal flaws in a manually designed SS protocol.

The complexity of designing programs that simultaneously tolerate multiple classes of faults, called multitolerant programs, is in part due to the conflicting nature of the fault tolerance requirements that must be met by a multitolerant program when different types of faults occur. To facilitate the design of multitolerant programs, we present sound and (deterministically) complete algorithms for stepwise design of two families of multitolerant programs in a high atomicity program model, where a process can read and write all program variables in an atomic step. We illustrate that if one needs to design failsafe (respectively, nonmasking) fault tolerance for one class of faults and masking fault tolerance for another class of faults, then a multitolerant program can be designed in separate polynomial-time (in the state space of the fault-intolerant program) steps regardless of the order of addition. This result has a significant methodological implication in that designers need not be concerned about unknown fault tolerance requirements that may arise due to unanticipated types of faults. Further, we illustrate that if one needs to design failsafe fault tolerance for one class of faults and nonmasking fault tolerance for a different class of faults, then the resulting problem is NP-complete in program state space. This is a counterintuitive result in that designing failsafe and nonmasking fault tolerance for the same class of faults can be done in polynomial time. We also present sufficient conditions for polynomial-time design of failsafe-nonmasking multitolerance. Finally, we demonstrate the stepwise design of multitolerance for a stable disk storage system, a token ring network protocol and a repetitive agreement protocol that tolerates Byzantine and transient faults. Our automatic approach decreases the design time from days to a few hours for the token ring program that is our largest example with 200 million reachable states and 8 processes.

We concentrate on automatic revision of untimed and real-time programs with respect to UNITY properties. The main focus of this article is to identify instances where addition of UNITY properties can be achieved efficiently (in polynomial time) and where the problem of adding UNITY properties is difficult (NP-complete). Regarding efficient revision, we present a sound and complete algorithm that adds a singleleads-toproperty (respectively,bounded-time leads-toproperty) and a conjunction ofunless, stable, andinvariantproperties (respectively,bounded-time unlessandstable) to an existing untimed (respectively, real-time) UNITY program in polynomial-time in the state space (respectively, region graph) of the given program. Regarding hardness results, we show that (1) while oneleads-to(respectively,ensures) property can be added in polynomial-time, the problem of adding two such properties (or any combination ofleads-toandensures) is NP-complete, (2) if maximum non-determinism is desired then the problem of adding even a singleleads-toproperty is NP-complete, and (3) the problem of providing maximum non-determinism while adding a singlebounded-time leads-toproperty to a real-time program is NP-complete (in the size of the program's region graph) even if the original program satisfies the correspondingunbounded leads-toproperty.

We present a divide-and-conquer method, called DiConic, for automatic addition of failsafe fault-tolerance to distributed programs, where a failsafe program guarantees to meet its safety specification even when faults occur. Specifically, instead of adding fault-tolerance to a program as a whole, we separately revise program actions so that the entire program becomes failsafe fault-tolerant. Our DiConic algorithm has the potential to utilize the processing power of a large number of machines working in parallel, thereby enabling automatic addition of failsafe fault-tolerance to distributed programs with a large number of processes. We formulate our DiConic synthesis algorithm in terms of the satisfiability problem and demonstrate our approach for the Byzantine Generals problem and an industrial application.

Explicitly addressing fault-tolerance during the requirements analysis phase facilitates the early detection of inconsistencies between functional and fault-tolerance requirements, which could potentially reduce the overall development costs. Most existing approaches use redundancy of services as a means to mask faults, where it is difficult to provide a systematic approach for modeling and analyzing the effect of faults on functional requirements during use case analysis. Moreover, providing masking fault-tolerance could be costly or impractical. This paper overviews a systematic approach for use case-based modeling of faults and failsafe fault-tolerance, where a failsafe fault-tolerant system at least meets its safety requirements when faults occur

We focus on the problem of synthesizing failsafe fault-tolerance where fault-tolerance is added to an existing (fault-intolerant) program. A failsafe fault-tolerant program satisfies its specification (including safety and liveness) in the absence of faults. However, in the presence of faults, it satisfies its safety specification. We present a somewhat unexpected result that, in general, the problem of synthesizing failsafe fault-tolerant distributed programs from their fault-intolerant version is NP-complete in the state space of the program. We also identify a class of specifications, monotonic specifications, and a class of programs, monotonic programs, for which the synthesis of failsafe fault-tolerance can be done in polynomial time (in program state space). As an illustration, we show that the monotonicity restrictions are met for commonly encountered problems, such as Byzantine agreement, distributed consensus, and atomic commitment. Furthermore, we evaluate the role of these restrictions in the complexity of synthesizing failsafe fault-tolerance. Specifically, we prove that if only one of these conditions is satisfied, the synthesis of failsafe fault-tolerance is still NP-complete. Finally, we demonstrate the application of monotonicity property in enhancing the fault-tolerance of (distributed) nonmasking fault-tolerant programs to masking.

In this paper, we investigate the effect of the representation of safety specification on the complexity of adding masking fault tolerance to programs - where, in the presence of faults, the program 1) recovers to states from where it satisfies its (safety and liveness) specification and 2) preserves its safety specification during recovery. Specifically, we concentrate on two approaches for modeling the safety specifications: 1) the bad transition (BT) model, where safety is modeled as a set of bad transitions that should not be executed by the program, and 2) the bad pair (BP) model, where safety is modeled as a set of finite sequences consisting of at most two successive transitions. If the safety specification is specified in the BT model, then it is known that the complexity of automatic addition of masking fault tolerance to high atomicity programs - where processes can read/write all program variables in an atomic step) - is polynomial in the state space of the program. However, for the case where one uses the BP model to specify safety specification, we show that the problem of adding masking fault tolerance to high atomicity programs is NP-complete. Therefore, we argue that automated synthesis of fault-tolerant programs is likely to be more successful if one focuses on problems where safety can be represented in the BT model.

We concentrate on automated synthesis of multitolerant programs, i.e., programs that tolerate multiple classes of faults and provide a (possibly) different level of fault-tolerance to each class. We consider three levels of fault-tolerance: (1) failsafe, where in the presence of faults, the synthesized program guarantees safety, (2) nonmasking, where in the presence of faults, the synthesized program recovers to states from where its safety and liveness are satisfied, and (3) masking where in the presence of faults the synthesized program satisfies safety and recovers to states from where its safety and liveness are satisfied. We focus on the automated synthesis of finite-state multitolerant programs in high atomicity model where the program can read and write all its variables in an atomic step. We show that if one needs to add failsafe (respectively, nonmasking) fault-tolerance to one class of faults and masking fault-tolerance to another class of faults then such addition can be done in polynomial time in the state space of the fault-intolerant program. However, if one needs to add failsafe fault-tolerance to one class of faults and nonmasking fault-tolerance to another class of faults then the resulting problem is NP-complete. We find this result to be counterintuitive since adding failsafe and nonmasking fault-tolerance to the same class of faults (which is equivalent to adding masking fault-tolerance to that class of faults) can be done in polynomial time, whereas adding failsafe fault-tolerance to one class of faults and nonmasking fault-tolerance to a different class of faults is NP-complete.

In this paper we focus on automated techniques to enhance the fault-tolerance of a nonmasking fault-tolerant program to masking. A masking program continually satisfies its specification even if faults occur. By contrast, a nonmasking program merely guarantees that after faults stop occurring, the program recovers to states from where it continually satisfies its specification. Until the recovery is complete, however a nonmasking program can violate its (safety) specification. Thus, the problem of enhancing fault-tolerance from nonmasking to masking requires that safety be added and recovery be preserved. We focus on this enhancement problem for high atomicity programs-where each process can read all variables-and for distributed programs-where restrictions are imposed on what processes can read and write. We present a sound and complete algorithm for high atomicity programs and a sound algorithm for distributed programs. We also argue that our algorithms are simpler than previous algorithms, where masking fault-tolerance is added to a fault-intolerant program. Hence, these algorithms can partially reap the benefits of automation when the cost of adding masking fault-tolerance to a fault-intolerant program is high. To illustrate these algorithms, we show how the masking fault-tolerant programs for triple modular redundancy and Byzantine agreement can be obtained by enhancing the fault-tolerance of the corresponding nonmasking versions. We also discuss how the derivation of these programs is simplified when we begin with a nonmasking fault-tolerant program.

In this paper, we focus our attention on the problem of automating the addition of failsafe fault-tolerance where fault-tolerance is added to an existing (fault-intolerant) program. A failsafe fault-tolerant program satisfies its specification (including safety and liveness) in the absence of faults. And, in the presence of faults, it satisfies its safety specification. We present a somewhat unexpected result that, in general, the problem of adding failsafe fault-tolerance in distributed programs is NP-hard. Towards this end, we reduce the 3-SAT problem to the problem of adding failsafe fault-tolerance. We also identify a class of specifications, monotonic specifications and a class of programs, monotonic programs. Given a (positive) monotonic specification and a (negative) monotonic program, we show that failsafe fault-tolerance can be added in polynomial time. We note that the monotonicity restrictions are met for commonly encountered problems such as Byzantine agreement, distributed consensus, and atomic commitment. Finally, we argue that the restrictions on the specifications and programs are necessary to add failsafe fault-tolerance in polynomial time; we prove that if only one of these conditions is satisfied, the addition of failsafe fault-tolerance is still NP-hard.