Verification and Synthesis of Symmetric Uni-Rings for Leads-To Properties Ali Ebnenasir aebnenas@mtu.edu Department of Computer Science College of Computing Michigan Technological University Houghton MI 49931 http://asd.cs.mtu.edu/
Parameterized Distributed Systems (PDS) Family 2: just one process Dijkstraβs Token Ring for mutual exclusion: π 2 : Template process 2 P N-1 P 0 Action 0 : x 0 = x N-1 Γ x 0 := x N-1 + 1 x N-1 x 0 Read/Write - Process P i has x i β β€ N = {0, 1, β¦, N-1} P 1 - N denotes the total number of processes - Addition and subtraction are done in modulo N x 1 π 1 : Template process 1 Q = β i β β€ N : ( (x i -1 = x i ) β¨ (x i -1 = x i +1)) Action i : x i β x i-1 Γ x i := x i-1 Legend : . . . Process/Node Family 1: N-1 symmetric processes Read from
Significance From System on Chip, to multithreaded programs and large scale network protocols.
Example: Agreement on Parity β Parity on a fully symmetric unidirectional ring (uni-ring); i.e., k =1 β Ring size: N>2, arbitrary but finite; i.e., π 1 = {P 0 , β¦, P N-1 } β Process P i : has a variable x i capturing set of writeable variables x i β β€ 4 = {0, 1, 2, 3} β β Topology: uni-ring (read/write restrictions) read x i -1 and x i ; write x i β β Conjunctive state predicate Q = β i β β€ N : ((|x i -1 - x i | mod 2) = 0) β Template Process: P 0 x 0 P 1 A i : (|x i -1 - x i | mod 2) β 0 Γ x i := x i-1 β 4 2 x 1 x N-1 P 2 x 2
Proposed Method Most existing methods for verification and synthesis: Correctness of a finite abstract model β Correctness of PDS We propose a method based on characterization of global failures in local state spaces of template processes in a topology-specific fashion. Absence of local characterizations β Correctness of PDS
Topology and Property-Specific Synthesis of R β Q Variable x i and its domain Parameterized Actions Synthesize Algorithm for Uni-Ring R = β i β β€ N : r(x i -1 - x i ) Satisfies R β Q for an arbitrary (but finite) Q = β i β β€ N : q(x i -1 - x i ) # of processes Specifications: Linear Temporal Logic β Leads-To: β ( R β β Q ) β£ ( R β Q ) β E.g., ( true β Q ) β Note : From any global state in R, the entire ring eventually reaches a global state in Q ; i.e., global liveness.
Failures of Leads-To in PDS β’ Reaching global deadlocks and/or global livelocksfrom R β’ Verification of deadlock-freedom is decidable. [ICDCS 2012] [ICDCS 2012] A. Farahat and A. Ebnenasir, β Local reasoning for global convergence of parameterized rings ,β in IEEE International Conference on Distributed Computing Systems (ICDCS), 2012, pp. 496β505.
Livelock-Freedom in Uni-Rings β Theorem 1: Verifying livelock-freedom in symmetric uni-rings is undecidable, even for deterministic , constant-space and self-disabling processes. [SSSβ13, ACM TOCLβ19] β Self-disabling process: once it executes an action, it disables itself until enabled again by its predecessor. β’ Corollary: Verifying R β Q in symmetric uni-rings is undecidable. (Proof in the paper) [SSSβ13] Alex Klinkhamer and Ali Ebnenasir, Verfiying Livelock Freedom of Parameterized Rings and Chains , 15th International Symposium on Stabilization, Safety, and Security of Distributed Systems (SSS 2013). [ACM TOCLβ19] A. Klinkhamer and A. Ebnenasir, β On the verification of livelock-freedom and self-stabilization on parameterized rings ,β ACM Transactions on Computational Logic, vol. 20, no. 3, pp. 1β36, 2019.
Local Characterization of Global Livelocks in Uni-Rings: Can we detect and construct global livelocks just by analyzing the local state transition system of the template process?
Action Graphs β Protocols can be represented as labeled directed multi-graphs in the local state space of the template process Vertices : values in the domain of x i β {0, 1, 2, 3} β Arcs : each arc (a, b, c) represents a local update of x i to c if x i-1 =a and x i = b β E.g., ( 0 , 1 , 2 ) means if x i-1 =0 and x i = 1 then update x i to 2 β (|x i -1 - x i | mod 2) β 0 Γ x i := x i-1 β 4 2 1 |3 0|2 0 2 1 3 1|3 0|2
Action Graphs β Protocols can be represented as labeled directed multi-graphs in the local state space of the template process Vertices : values in the domain of x i β {0, 1, 2, 3} β Arcs : each arc (a, b, c) represents a local update of x i to c if x i-1 =a and x i = b β E.g., ( 0 , 1 , 2 ) means if x i-1 =0 and x i = 1 then update x i to 2 β (|x i -1 - x i | mod 2) β 0 Γ x i := x i-1 β 4 2 ( 0 , 1 , 2 ) 1 |3 0|2 0 2 1 3 1|3 0|2
Action Graphs β Protocols can be represented as labeled directed multi-graphs in the local state space of the template process Vertices : values in the domain of x i β {0, 1, 2, 3} β Arcs : each arc (a, b, c) represents a local update of x i to c if x i-1 =a and x i = b β E.g., ( 0 , 1 , 2 ) means if x i-1 =0 and x i = 1 then update x i to 2 β (|x i -1 - x i | mod 2) β 0 Γ x i := x i-1 β 4 2 ( 0 , 1 , 2 ) x i-1 1 |3 0|2 0 2 1 3 1|3 0|2
Action Graphs β Protocols can be represented as labeled directed multi-graphs in the local state space of the template process Vertices : values in the domain of x i β {0, 1, 2, 3} β Arcs : each arc (a, b, c) represents a local update of x i to c if x i-1 =a and x i = b β E.g., ( 0 , 1 , 2 ) means if x i-1 =0 and x i = 1 then update x i to 2 β (|x i -1 - x i | mod 2) β 0 Γ x i := x i-1 β 4 2 ( 0 , 1 , 2 ) x i x i-1 1 |3 0|2 0 2 1 3 1|3 0|2
Action Graphs β Protocols can be represented as labeled directed multi-graphs in the local state space of the template process Vertices : values in the domain of x i β {0, 1, 2, 3} β Arcs : each arc (a, b, c) represents a local update of x i to c if x i-1 =a and x i = b β E.g., ( 0 , 1 , 2 ) means if x i-1 =0 and x i = 1 then update x i to 2 β (|x i -1 - x i | mod 2) β 0 Γ x i := x i-1 β 4 2 ( 0 , 1 , 2 ) x i x i-1 set x i to 1 |3 0|2 0 2 1 3 1|3 0|2
Enabling Actions β An action of a process P i may potentially enable another action of P i (0, 3 , 2 ), (1, 2 , 3 ), (2, 1 , 0 ) (3, 0 , 1 ) 1| 3 0| 2 0 2 1 3 1 |3 0 |2
Closed Walks in Action Graphs β Propagation of enablement as closed walk: sequence of consecutive actions A 0 : (|x i -1 - x i | mod 2) β 0 Γ x i := x i-1 β 4 2 (0, 3 , 2 ), (1, 2 , 3 ), (2, 1 , 0 ) (3, 0 , 1 ) 1| 3 0| 2 0 2 1 3 1 |3 0 |2 Closed Walks 2 Closed Walks 1
Enabling Closed Walks β A closed walk enabling another closed walk. 0| 2 0 2 1 3 Closed walk 1: (1, 2 , 3 ), Closed walk 2:
Enabling Closed Walks β A closed walk enabling another closed walk. 1| 3 0| 2 0 2 1 3 Closed walk 1: (1, 2 , 3 ), Closed walk 2: (0, 3 , 2 ),
Enabling Closed Walks β A closed walk enabling another closed walk. 1| 3 0| 2 0 2 1 3 0 |2 Closed walk 1: (1, 2 , 3 ), (3, 0 , 1 ) Closed walk 2: (0, 3 , 2 ),
Enabling Closed Walks β A closed walk enabling another closed walk. 1| 3 0| 2 0 2 1 3 1 |3 0 |2 Closed walk 1: (1, 2 , 3 ), (3, 0 , 1 ) Closed walk 2: (0, 3 , 2 ), (2, 1 , 0 )
Enabling Closed Walks β A closed walk enabling another closed walk. 1| 3 0| 2 0 2 1 3 1 |3 0 |2 Closed walk 1 enables closed walk 2. Closed walk 1: (1, 2 , 3 ), (3, 0 , 1 ) Closed walk 2: (0, 3 , 2 ), (2, 1 , 0 )
Enabling Closed Walks β A closed walk enabling another closed walk. 1| 3 0| 2 0 2 1 3 1 |3 0 |2 A closed walk of length n enables another closed walk of length n iff j -th action of the first walk enables the j -th action of the second walk, for 1β€ j β€ n Closed walk 1: (1, 2 , 3 ), (3, 0 , 1 ) Closed walk 2: (0, 3 , 2 ), (2, 1 , 0 )
Circularly Enabling Closed Walks β’ Closed walk 2 also enables closed walk 1. 1| 3 0 2 1 3 Closed walk 1: Closed walk 2: (0, 3 , 2 ),
Circularly Enabling Closed Walks β’ Closed walk 2 also enables closed walk 1. 1| 3 0| 2 0 2 1 3 Closed walk 1: (1, 2 , 3 ), Closed walk 2: (0, 3 , 2 ),
Circularly Enabling Closed Walks β’ Closed walk 2 also enables closed walk 1. 1| 3 0| 2 0 2 1 3 1 |3 Closed walk 1: (1, 2 , 3 ), Closed walk 2: (0, 3 , 2 ), (2, 1 , 0 )
Circularly Enabling Closed Walks β’ Closed walk 2 also enables closed walk 1. 1| 3 0| 2 0 2 1 3 1 |3 0 |2 Closed walk 1: (1, 2 , 3 ), (3, 0 , 1 ) Closed walk 2: (0, 3 , 2 ), (2, 1 , 0 )
Circularly Enabling Closed Walks 1| 3 0| 2 0 2 1 3 1 |3 0 |2 2 circularly enabling closed walks, each of length 2. Closed walk 1: (1, 2 , 3 ), (3, 0 , 1 ) Closed walk 2: (0, 3 , 2 ), (2, 1 , 0 )
Local Characterization of Global Livelocks Theorem 2 : There are m closed walks, each of length n , in the action graph that enable each other circularly (m > 1 and n β₯1) if and only if A uni-ring of symmetric, constant-space, deterministic and self-disabling processes has a livelock for a ring size ( m Γ n ) [SSSβ13] Alex Klinkhamer and Ali Ebnenasir, Verfiying Livelock Freedom of Parameterized Rings and Chains , 15th International Symposium on Stabilization, Safety, and Security of Distributed Systems (SSS 2013). [ACM TOCLβ19] A. Klinkhamer and A. Ebnenasir, β On the verification of livelock-freedom and self-stabilization on parameterized rings ,β ACM Transactions on Computational Logic, vol. 20, no. 3, pp. 1β36, 2019.
Synthesize a PDS using just locality and action graphs?
Recommend
More recommend
