Reliable Messages and Connection Establishment

Transcription

1 26. Rliabl Mssags Rliabl Mssags and Connction Establishmnt Th attachd pap on liabl mssags is Chapt 10 fom th book Distibutd Systms: Achitctu and Implmntation, ditd by Sap Mullnd, Addison-Wsly, 199. It contains a caful and complt tatmnt of potocols fo nsuing that a mssag is dlivd at most onc, and that if th a no sious failus it is dlivd xactly onc and its dlivy is poply acknowldgd. Butl W. Lampson 1 Intoduction Givn an unliabl ntwok, w would lik to liably dliv mssags fom a snd to a civ. This is th function of th tanspot lay of th ISO svn-lay cak. It uss th ntwok lay, which povids unliabl mssag dlivy, as a channl fo communication btwn th snd and th civ. Idally w would lik to nsu that mssags a dlivd in th od thy a snt, vy mssag snt is dlivd xactly onc, and an acknowldgmnt is tund fo ach dlivd mssag. Unfotunatly, it s xpnsiv to achiv th scond and thid goals in spit of cashs and an unliabl ntwok. In paticula, it s not possibl to achiv thm without making som chang to stabl stat (stat that suvivs a cash) vy tim a mssag is civd. Why? Whn w civ a mssag aft a cash, w hav to b abl to tll whth it has alady bn dlivd. But if dliving th mssag dosn t chang any stat that suvivs th cash, thn w can t tll. So if w want a chap dliv opation that dosn t qui witing stabl stat, w hav to choos btwn dliving som mssags mo than onc and losing som mssags ntily whn th civ cashs. If th ffct of a mssag is idmpotnt, of cous, thn duplications a hamlss and w will choos th fist altnativ. But this is a, and th latt choic is usually th lss of two vils. It is calld at-most-onc mssag dlivy. Usually th snd also wants an acknowldgmnt that th mssag has bn dlivd, o in cas th civ cashs, an indication that it might hav bn lost. At-most-onc mssags with acknowldgmnts a calld liabl mssags. Th a vaious ways to implmnt liabl mssags. An implmntation is calld a potocol, and w will look at sval of thm. All a basd on th ida of tagging a mssag with an idntifi and tansmitting it patdly to ovcom th unliability of th channl. Th civ kps a stock of good idntifis that it has nv accptd bfo; whn it ss a mssag taggd with a good idntifi, it accpts it, dlivs it, and movs that idntifi fom th good st. Othwis, th civ just discads th mssag, phaps aft acknowldging it. This pap oiginally appad as chapt 10 in Distibutd Systms, d. S. Mullnd, Addison-Wsly, 199, pp It is th sult of joint wok with Nancy Lynch and Jøgn Søgaad-Andsn. Handout 26. Rliabl Mssags 1 Handout 26. Rliabl Mssags 2

2 In od fo th snd to b su that its mssag will b dlivd ath than discadd, it must tag th mssag with a good idntifi. What maks th implmntations ticky is that w xpct to los som stat whn th is a cash. In paticula, th civ will b kping tack of at last som of its good idntifis in volatil vaiabls, so ths idntifis will bcom bad at th cash. But th snd dosn t know about th cash, so it will go on using th bad idntifis and thus snd mssags that th civ will jct. Diffnt potocols us diffnt mthods to kp th snd and th civ mo o lss in sync about what idntifis to us. In pactic liabl mssags a most oftn implmntd in th fom of connctions. Th ida is that a connction is stablishd, any amount of infomation is snt on th connction, and thn th connction is closd. You can think of this as th snding of a singl lag mssag, o as snding th fist mssag using on of th potocols w discuss, and thn snding lat mssags with incasing squnc numbs. Usually connctions a full-duplx, so that ith nd can snd indpndntly, and it is oftn chap to stablish both dictions at th sam tim. W igno all ths complications in od to concntat on th ssntial logic of th potocols. What w man by a cash is not simply a failu and stat of a nod. In pactic, potocols fo liabl mssags hav limits, calld timouts, on th lngth of tim fo which thy will wait to dliv a mssag o gt an ack. W modl th xpiation of a timout as a cash: th potocol abandons its nomal opation and pots failu, vn though in gnal it s possibl that th mssag in fact has bn o will b dlivd. W bgin by witing a caful spcification S fo liabl mssags. Thn w psnt a lowlvl spc D in which th non-dtminism associatd with losing mssags whn th is a cash is movd to a plac that is mo convnint fo implmntations. W xplain why D implmnts S but don t giv a poof, sinc that quis tchniqus byond th scop of this chapt. With this goundwok, w psnt a gnic potocol G and a poof that it implmnts D. Thn w dscib two potocols that a usd in pactic, th handshak potocol H and th clock-basd potocol C, and show how both implmnt G. Finally, w xplain how to modify ou potocols to wok with finit sts of mssag idntifis, and summaiz ou sults. Th goals of this chapt a to: Giv a simpl, cla, and pcis spcification of liabl mssag dlivy in th psnc of cashs. Explain th standad handshak potocol fo liabl mssags that is usd in TCP, ISO TP4, and many oth widspad communication systms, as wll as a nw clock-basd potocol. Show that both potocols can b bst undstood as spcial cass of a simpl, mo gnal potocol fo using idntifis to tag mssags and acknowldgmnts fo liabl dlivy. Us th mthod of abstaction functions and invaiants to hlp in undstanding ths th subtl concunt and fault-tolant algoithms, and in th pocss psnt all th had pats of coctnss poofs fo all of thm. Tak advantag of th gnic potocol to simplify th analysis and th agumnts. Handout 26. Rliabl Mssags 1.1 Mthods W us th dfinition of implmnts and th abstaction function poof mthod xplaind in Chapt. H is a bif summay of this matial. Suppos that X and Y a stat machins with namd tansitions calld actions; think of X as a spcification and Y as an implmntation. W patition th actions of X and Y into xtnal and intnal actions. A bhavio of a machin M is a squnc of actions that M can tak stating in an initial stat, and an xtnal bhavio of M is th subsqunc of a bhavio that contains only th xtnal actions. W say Y implmnts X iff vy xtnal bhavio of Y is an xtnal bhavio of X. 1 This xpsss th ida that what it mans fo Y to implmnt X is that fom th outsid you don t s Y doing anything that X couldn t do. Th st of all xtnal bhavios is a ath complicatd objct and difficult to ason about. Fotunatly, th is a gnal mthod fo poving that Y implmnts X without asoning xplicitly about bhavios in ach cas. It woks as follows. Fist, dfin an abstaction function f fom th stat of Y to th stat of X. Thn show that Y simulats X: 1. f maps an initial stat of Y to an initial stat of X. 2. Fo ach Y-action and ach achabl stat y th is a squnc of X-actions (phaps mpty) that is th sam xtnally, such that th following diagam commuts. f f(y) y X-actions Y-action f(y' ) f y' A squnc of X-actions is th sam xtnally as a Y-action if thy a th sam aft all intnal actions a discadd. So if th Y-action is intnal, all th X-actions must b intnal (phaps non at all). If th Y-action is xtnal, all th X-actions must b intnal xcpt on, which must b th sam as th Y-action. A staightfowad induction shows that Y implmnts X: Fo any Y-bhavio w can constuct an X-bhavio that is th sam xtnally, by using (2) to map ach Y-action into a squnc of X-actions that is th sam xtnally. Thn th squnc of X-actions will b th sam xtnally as th oiginal squnc of Y-actions. In od to pov that Y simulats X w usually nd to know what th achabl stats of Y a, bcaus it won t b tu that vy action of Y fom an abitay stat of Y simulats a squnc of X-actions; in fact, th abstaction function might not vn b dfind on an abitay stat of Y. Th most convnint way to chaactiz th achabl stats of Y is by an invaiant, a 1 Actually this dfinition only dals with th implmntation of safty poptis. Roughly spaking, a safty popty is an asstion that nothing bad happns; it is a gnalization of th notion of patial coctnss fo squntial pogams. A systm that dos nothing implmnts any safty popty. Spcifications may also includ livnss poptis, which oughly asst that somthing good vntually happns; ths gnaliz th notion of tmination fo squntial pogams. A full tatmnt of livnss is byond th scop of this chapt, but w do xplain infomally why th potocols mak pogss. Handout 26. Rliabl Mssags 4

3 pdicat that is tu of vy achabl stat. Oftn it s hlpful to wit th invaiant as a conjunction, and to call ach conjunct an invaiant. It s common to nd a stong invaiant than th simulation quis; th xta stngth is a stong induction hypothsis that maks it possibl to stablish what th simulation dos qui. So th stuctu of a poof gos lik this: Establish invaiants to chaactiz th achabl stats, by showing that ach action maintains th invaiants. Dfin an abstaction function. Establish th simulation, by showing that ach Y-action simulats a squnc of X-actions that is th sam xtnally. This mthod woks only with actions and dos not qui any asoning about bhavios. Futhmo, it dals with ach action indpndntly. Only th invaiants connct th actions. So if w chang (o add) an action of Y, w only nd to vify that th nw action maintains th invaiants and simulats a squnc of X-actions that is th sam xtnally. W xploit this makabl fact in Sction 9 to xtnd ou potocols so that thy us finit, ath than infinit, sts of idntifis. In what follows w giv abstaction functions and invaiants fo ach potocol. Th actual poofs that th invaiants hold and that ach Y-action simulats a suitabl squnc of X-actions a outin, so w giv poofs only fo a fw sampl actions. 1.2 Typs and notation W us a typ M fo th mssags bing dlivd. W assum nothing about M. All th potocols xcpt S and D us a typ I of idntifis fo mssags. In gnal w assum only that Is can b compad fo quality; C assums a total oding. If x is a multist whos lmnts hav a fist I componnt, w wit ids(x) fo th multist of Is that appa fist in th lmnts of x. 2 Th spcification S Th spcification S fo liabl mssags is a slight xtnsion of th spc fo a FIFO quu. Figu 1 shows th xtnal actions and som xampls of its tansitions. Th basic stat of S is th FIFO quu q of mssags, with put( and gt( actions. In addition, th status vaiabl cods whth th most cntly snt mssag has bn dlivd. Th snd can us gtack( to gt this infomation; aft that it may b fogottn by stting status to lost, so that th snd dosn t hav to mmb it fov. Both snd and civ can cash and cov. In th absnc of cashs, vy mssag put is dlivd by gt in th sam od and is positivly acknowldgd. If th is a cash, any mssag still in th quu may b lost at any tim btwn th cash and th covy, and its ack may b lost as wll. Th gtack( action pots on th mssag most cntly put, as follows. If th has bn no cash sinc it was put th a two possibilitis: th mssag is still in q and gtack cannot occu; th mssag was dlivd by gt( and gtack(ok) occus. If th hav bn cashs, th a two additional possibilitis: th mssag was lost and gtack(lost) occus; th mssag was dlivd o is still in q but gtack(lost) occus anyway. Th ack maks th most sns whn th snd altnats put( and gtack( actions. Not that what is bing acknowldgd is dlivy of th mssag to th clint, not its cipt by som pat of th implmntation, so this is an nd-to-nd ack. In oth wods, th gt should b thought of as including clint pocssing of th mssag, and th ack might includ som sult tund by th clint such as th sult of a mot pocdu call. This could b xpssd pcisly by adding an ack action fo th clint. W won t do that bcaus it would clutt up th psntation without impoving ou undstanding of how liabl mssags wok. W wit... fo a squnc with th indicatd lmnts and + fo concatnation of squncs. W viw a squnc as a multist in th obvious way. W wit x = (y, *) to man that x is a pai whos fist componnt is y and whos scond componnt can b anything, and similaly fo x = (*, y). W dfin an action by giving its nam, a guad that must b tu fo th action to occu, and an ffct dscibd by a st of assignmnts to stat vaiabls. W ncod paamts by dfining a whol family of actions with latd nams; fo instanc, gt( is a diffnt action fo ach possibl m. Actions a atomic; ach action complts bfo th nxt on is statd. To xpss concuncy w intoduc mo actions. Som of ths actions may b intnal, that is, thy may not involv any intaction with th clint of th potocol. Intnal actions usually mak th stat machin non-dtministic, sinc thy can happn whnv thi guads a satisfid, not just whn th is an intaction with th nvionmnt. W mak xtnal actions with *s, two fo an input action and on fo an output action. Actions without *s a intnal. It s convnint to psnt th snd actions on th lft and th civ actions on th ight. Som actions a not so asy to catgoiz, and w usually put thm on th lft. S n d q = status = OK Put( GtAck( q = D C B status =? Gt(B) Gt(C) Gt(D) Gt( Cash Los(B) Los(B) Rcov q = status = lost Figu 1. Som stats and tansitions fo S C R c i v Handout 26. Rliabl Mssags Handout 26. Rliabl Mssags 6

4 Snd Rciv Nam Guad Effct Nam Guad Effct **put( c s = fals appnd m to q, status :=? *gt( c = fals, m is fist on q mov had of q, if q = mpty and status =? thn status := OK *gtack( c s = fals, optionally status = a status := lost **cash s c s := tu **cash c := tu *cov s c s c s := fals *cov c c := fals los c s o c dlt som lmnt fom q; if it s th last thn status := lost, o status := lost q : squnc[m] := status : Status := lost c s : Boolan := fals (c is shot fo coving ) c : Boolan := fals Tabl 1. Stat and actions of S To dfin S w intoduc th typs A (fo acknowldgmnt) with valus in {OK, lost} and Status with valus in {OK, lost,?}. Tabl 1 givs th stat and actions of S. Not that it says nothing about channls; thy a pat of th implmntation and hav nothing to do with th spc. Why do w hav both cash and cov actions, as opposd to just a cash action? A spc that only allows mssags to b lost at th tim of a cash is not implmntd by a potocol lik C in which th snd accpts a mssag with put and snds it without vifying that th civ is unning nomally. In this cas th mssag is lost vn though it wasn t in th systm at th tim of th cash. This is why w hav a spaat cov action that allows th civ to dcla th point aft a cash whn mssags a again guaantd not to b lost. Th sms to b no nd fo a cov s action, but w hav on fo symmty. A spc which only allows mssags to b lost at th tim of a cov is not implmntd by any potocol that can hav two mssags in th ntwok at th sam tim, bcaus aft a cash s and bfo th following cov s it s possibl fo th scond mssag in th ntwok to b dlivd, which mans that th fist on must b lost to psv th FIFO popty. Th simplst spc that covs both ths cass can los a mssag at any tim btwn a cash and its following cov, and w hav adoptd this altnativ. Th dlayd-dcision spcification D Nxt w intoduc an implmntation of S, calld th dlayd-dcision spcification D, that is mo non-dtministic about whn mssags a lost. Th ason fo D is to simplify th poofs of th potocols: with mo fdom in D, it s asi to pov that a potocol simulats D than to pov that it simulats S. A typical potocol tansmits mssags fom th snd to th civ ov som kind of channl that can los mssags; to compnsat fo ths losss, th snd tansmits. If th snd cashs with a mssag in th channl it stops tansmitting, but whth th civ gts th mssag dpnds on whth th channl loss it. This may not b dcidd until aft th snd has covd. So th potocol dosn t dcid whth th mssag is lost until aft th snd has covd. D has this fdom, but S dos not. S n d q = status = lost Put( GtAck( C q = D C B status =? Gt(B) Gt(C) Gt(D) Dop(B) Dop(D) Figu 2. Som stats and tansitions of D Gt( Cash Mak(B) Mak(D) Rcov q = D# C B# status =? # Snd Rciv Nam Guad Effct Nam Guad Effct **put( cs = fals appnd (m, +) to q, *gt( c = fals, mov had of q, status := (?, +) (m, *) fist on q if q = mpty and status = (?, x) thn status:=(ok,x) *gtack( cs = fals, status = (a, *) status := (a, +) o status := (lost, +) **cashs cs := tu **cash c := tu *covs cs cs := fals *cov c c := fals mak cs o c fo som lmnt of q o fo status, mak := # R c i v unmak fo som lmnt of q o fo status, mak := + dop dlt an lmnt of q with mak = #; if it was th last lmnt, status := (lost, +) o if status = (*, #), status := (lost, +) q : squnc[(m, Mak)] := status : (Status, Mak) := (lost, +) c s : Boolan := fals c : Boolan := fals Tabl 2. Stat and actions of D Handout 26. Rliabl Mssags 7 Handout 26. Rliabl Mssags 8

5 D is th sam as S xcpt that th dcisions about which mssags to los at covy, and whth to los th ack, a mad by asynchonous dop actions that can occu aft covy. Each mssag in q, as wll as th status vaiabl, is augmntd by an xta componnt of typ Mak which is nomally + but may bcom # btwn cash and covy bcaus of a mak action. At any tim an unmak action can chang a mak fom # back to +, a mssag makd # can b lost by dop, o a status makd # can b st to lost by dop. Figu 2 givs an xampl of th tansitions of D; th + maks a omittd. To dfin D w intoduc th typ Mak that has valus in th st {+, #}. Tabl 2 givs th stat and actions of D..1 Poof that D implmnts S W do not giv this poof, sinc to do it using abstaction functions w would hav to intoduc pophcy vaiabls, also known as multi-valud mappings o backwad simulations (Abadi and Lampot [1991], Lynch and Vaandag [199]). If you wok out som xampls, howv, you will pobably s why th two spcs S and D hav th sam xtnal bhavio. 4 Channls All ou potocols us th sam channl abstaction to tansf infomation btwn th snd and th civ. W us th nam packt fo th mssags snt ov a channl, to distinguish thm fom liabl mssags. A channl can fly dop and od packts, and it can duplicat a packt any finit numb of tims whn it s snt; 2 th only thing it isn t allowd to do is dliv a packt that wasn t snt. Th ason fo using such a wak spcification is to nsu that th liabl mssag potocol will wok ov any bit-moving mchanism that happns to b availabl. With a stong channl spc, fo instanc on that dosn t od packts, it s possibl to hav somwhat simpl o mo fficint implmntations. Th a two channls s and s, on fom snd to civ and on fom civ to snd, ach a multist of packts initially mpty. Th natu of a packt vais fom on potocol to anoth. Tabl givs th channl actions. Potocols intact with th channls though th xtnal actions snd(...) and cv(...) which hav th sam nams in th channl and in th potocol. On of ths actions occus if both its pconditions a tu, and th ffct is both th ffcts. This always maks sns bcaus th stats a disjoint. Nam Guad Effct Nam Guad Effct **snds(p) add som numb of **snds(p) add som numb copis of p to s of copis of p to s *cvs(p) p s mov on p fom s cvs(p) p s mov on p fom s loss(p) p s mov on p fom s loss(p) p s mov on p fom s Th gnic potocol G Th gnic potocol G gnalizs two pactical potocols dscibd lat, H and C; in oth wods, both of thm implmnt G. This potocol can t b implmntd dictly bcaus it has som magic actions that us stat fom both snd and civ. But both al potocols implmnt ths actions, ach in its own way. Th basic ida is divd fom th simplst possibl distibutd implmntation of S, which w call th stabl potocol B (fo stabl). In B all th stat is stabl (that is, nothing is lost whn th is a cash), and ach nd kps a st g s o g of good idntifis, that is, idntifis that hav not yt bn usd. Initially g s g, and th potocol maintains this as an invaiant. To snd a mssag th snd chooss a good idntifi i fom g s, attachs i to th mssag, movs i fom g s to a last s vaiabl, and patdly snds th mssag. Whn th civ gts a mssag with a good idntifi it accpts th mssag, movs th idntifi fom g to a last vaiabl, and tuns an ack packt fo th idntifi aft th mssag has bn dlivd by gt. Whn th civ gts a mssag with an idntifi that isn t good, it tuns a positiv ack if th idntifi quals last and th mssag has bn dlivd. Th snd waits to civ an ack fo last s bfo doing gtack(ok). Th a nv any ngativ acks, sinc nothing is v lost. This potocol satisfis th quimnts of S; indd, it dos btt sinc it nv loss anything. 1. It povids at-most-onc dlivy bcaus th snd nv uss th sam idntifi fo mo than on mssag, and th civ accpts an idntifi and its mssag only onc. 2. It povids FIFO oding bcaus at most on mssag is in tansit at a tim.. It dlivs all th mssags bcaus th snd s good st is a subst of th civ s. 4. It acks vy mssag bcaus th snd kps tansmitting until it gts th ack. Th B potocol is widly usd in pactic, und nams that smbl quuing systm. It isn t usd to stablish connctions bcaus th cost of a stabl stoag wit fo ach mssag is too gat. In G w hav th sam stuctu of good sts and last vaiabls. Howv, thy a not stabl in G bcaus w hav to updat thm fo vy mssag, and w don t want to do a stabl wit fo vy mssag. Instad, th a opations to gow and shink th good sts; ths opations maintain th invaiant g s g as long as th is no civ cash. Whn th is a cash, mssags and acks can b lost, but S and D allow this. Figu shows th stat and som possibl tansitions of G in simplifid fom. Th nams in outlin font a stat vaiabls of D, and th cosponding valus a th valus of th abstaction function in that stat. Figu 4 shows th stat of G, th most impotant actions, and th S-shapd flow of infomation. Th nw vaiabls in th figu a th complmnt of th usd vaiabls in th cod. Th havy lins show th flow of a nw idntifi fom th civ to th snd, back to th civ along with th mssag, and thn back again to th snd along with th acknowldgmnt. Tabl. Actions of th channls 2 You might think it would b mo natual and clos to th actual implmntation of a channl to allow a packt alady in th channl to b duplicatd. Unfotunatly, if a packt can b duplicatd any numb of tims it s possibl that a potocol lik H (s sction 8) will not mak any pogss. Handout 26. Rliabl Mssags 9 Handout 26. Rliabl Mssags 10

6 S n d gs = lasts = msg = q = status = OK 4 s = 4 C last = 2 C s = mak = + gt(c) q = C status =? cashs C C nil 2 nil C OK + nil + C # q = C# status = lost g = cash; cov (bfo stikout) R c i v shink() (aft stikout) q = C# status =? # lost 1. At-most-onc dlivy is th sam as in B. 2. Th snd may snd a mssag aft a cash without chcking that a pvious outstanding mssag has actually bn civd. Thus mo than on mssag can b in tansit at a tim, so th must b a total oding on th idntifis in tansit to maintain FIFO oding of th mssags. In G this oding is dfind by th od in which th snd chooss idntifis.. Complt dlivy is th sam as in B as long as th is no civ cash. Whn th civ cashs g s g may cas to hold, with th ffct that mssags that th snd handls duing th civ cash may b assignd idntifis that a not in g and hnc may b lost. Th potocol nsus that this can t happn to mssags whos put happns aft th civ has covd. Whn th snd cashs, it stops tansmitting th cunt mssag, which may b lost as a sult. 4. As in B, th snd kps tansmitting until it gts an ack, but sinc mssags can b lost, th must b ngativ as wll as positiv acks. Whn th civ ss a mssag with an idntifi that is not in g and not qual to last it optionally tuns a ngativ ack. Th is no point in doing this fo a mssag with i < last bcaus th snd only cas about th ack fo last s, and th potocol maintains th invaiant last last s. If i > last, howv, th civ must somtims snd a ngativ ack in spons so that th snd can find out that th mssag may hav bn lost. S n d choos(i) put( gtack( Figu. Som stats and tansitions of G Snd actions stat mssags / acks idntifis channls gs last s msg cs gows(i) snd(i, cv(i, [copy] s A B s OK 4 lost gow(i) cv(i, snd(i, Rciv stat actions nw g last c gt( Figu 4. Stat, main actions, and infomation flow of G G also satisfis th quimnts of S, but not quit in th sam way as B. R c i v G is oganizd into a st of implmntabl actions that also appa, with vy mino vaiations, in both H and C, plus th magic gow, shink, and clanup actions that a simulatd quit diffntly in H and in C. Whn th a no cashs, th snd and civ ach go though a cycl of mods, th snd phaps on mod ahad. In on cycl on mssag is snt and acknowldgd. Fo th snd, th mods a idl, [ndi], snd; fo th civ, thy a idl and ack. An agnt that is not idl is busy. Th backtd mod is intnal : it s possibl to advanc to th nxt mod without civing anoth mssag. Th mods a not xplicit stat vaiabls, but instad a divd fom th valus of th msg and last vaiabls, as follows: mod s = idl iff msg = nil mod = idl iff last = nil mod s = ndi iff msg nil and last s = nil mod s = snd iff msg nil and last s nil mod = ack iff last nil To dfin G w intoduc th typs: I, an infinit st of idntifis. P (packt), a pai (I, M o A). Th snd snds (I, M) packts to th civ, which snds (I, A) packts back. Th I is th to idntify th packt fo th dstination. W dfin a patial od on I by th ul that i < i' iff i pcds i' in th squnc usd s. Th G w giv is a somwhat simplifid vsion, bcaus th actions a not as atomic as thy should b. In paticula, som actions hav two xtnal intactions, somtims on with a channl and on with th clint, somtims two with channls. Howv, th simplifid vsion diffs fom on with th pop atomicity only in unimpotant dtails. Th appndix givs a vsion of G with all th fussy dtails in plac. W don t giv ths dtails fo th C and H Handout 26. Rliabl Mssags 11 Handout 26. Rliabl Mssags 12

7 potocols that follow, but contnt ouslvs with th simplifid vsions in od to mphasiz th impotant fatus of th potocols. Figu is a mo dtaild vsion of Figu 4, which shows all th actions and th flow of infomation btwn th snd and th civ. Stat vaiabls a givn in bold, and th black guads on th tansitions giv th p-conditions. Th mak vaiabl can b # whn th civ has covd sinc a mssag was put; it flcts th fact that th mssag may b doppd. S n d Snd actions stat choos(i) shinks(i) choos(i) put( Y gtack( nw s gs last s msg = cs gows(i) msg nil, lasts = nil snd(i, cv(i, c [copy] s A I B s OK 4 lost gow(i) cv(i, cv(i, *) snd(i, Rciv stat actions nw g last c mak put( Figu. Dtails of actions and infomation flow in G = = X X = i (gs {lasts}) o mak Y = gs g o c shink(i) OK lost # + gt( Tabl 4 givs th stat and actions of G. Th magic pats, that is, thos that touch non-local stat, a boxd. Th conjunct c s has bn omittd fom th guads of all th snd actions xcpt cov s, and likwis fo c and th civ actions. In addition to mting th spc S, this potocol has som oth impotant poptis: It maks pogss: gadlss of pio cashs, povidd both nds stay up and th channls don t always los mssags, thn if th s a mssag to snd it is vntually snt, and othwis both patis vntually bcom idl, th snd bcaus it gts an ack, th civ bcaus vntually clanup maks mod = idl. Pogss dpnds on doing nough gow actions, and in paticula on complting th squnc gow (i), gow s (i), choos(i). R c i v Nam Guad Effct Nam Guad Effct **put( msg = nil, g s g o c msg := m, mak := + choos(i) msg nil, last s = nil, i g s g s :={j j i}, last s := i, usd s +:= i *gt( xists i such that cv s (i,, i g g :={j j i}, last := i, snd s (i, OK) snd last s nil snd s (last s, msg) *gtack( cv s (last s, last s := nil, msg := nil sndack xists i such that cv s (i, *), i g **cash s c s := tu **cash c := tu *cov s c s last s := nil, msg := nil, c s := fals *cov c, usd g s usd s optionally snd s (i, if i = last thn OK ls lost) last := nil, mak := #, c := fals shink s (i) g s := {i} shink (i) i g s, i last s o mak = # g := {i} gow s (i) i usd s, i g o c g s +:= {i} gow (i) i usd g +:= {i}, usd +:= {i} gowusd i usd s g s, usd s +:= {i} clanup last last s last := nil s (i) i usd o c unmak g s g, last s g {last,nil} mak := + usd s : squnc[i] := (stabl) usd : st[i] := { } (stabl) g s : st[i] := { } g : st[i] := { } last s : I o nil := nil last : I o nil := nil msg : M o nil := nil mak : Mak := # c s : Boolan := fals c : Boolan := fals Tabl 4. Stat and actions of G It s not ncssay to do a stabl stoag opation fo ach mssag. Instad, th cost of a stabl stoag opation can b amotizd ov as many mssags as you lik. G has only two stabl vaiabls: usd s and usd. Diffnt implmntations of G handl usd s diffntly. To duc th numb of stabl updats to usd, fin G to divid usd into th union of a stabl usd -s and a volatil usd -v. Mov a st of Is fom usd -s to usd -v with a singl stabl updat. Th usd -v bcoms mpty in cov ; simulat this with gow (i) followd immdiatly by shink (i) fo vy i in usd -v. Th only stat quid fo an idl agnt is th stabl vaiabl usd. All th oth (volatil) stat is th sam at th nd of a mssag tansmission as at th bginning. Th snd fogts its stat in gtack, th civ in clanup, and both in cov. Th shink actions mak it possibl fo both patis to fogt th good sts. This is impotant bcaus agnts may nd to communicat with many oth agnts btwn cashs, and it isn t pactical to Handout 26. Rliabl Mssags 1 Handout 26. Rliabl Mssags 14

8 qui that an agnt maintain som stat fo vyon with whom it has v communicatd. An idl snd dosn t snd any packts. An idl civ dosn t snd any packts unlss it civs on, bcaus it snds an acknowldgmnt only in spons to a packt. This is impotant bcaus th channl soucs shouldn t b wastd. W hav constuctd G with as much non-dtminism as possibl in od to mak it asy to pov that diffnt pactical potocols implmnt G. W could hav simplifid it, fo instanc by liminating unmak, but thn it would b mo difficult to constuct an abstaction function fom som oth potocol to G, sinc th abstaction function would hav to account fo th fact that aft a cov th mak vaiabl is # until th nxt put. With unmak, an implmntation of G is f to st mak back to + whnv th guad is tu..1 Abstaction function to D Th abstaction function is an ssntial tool fo poving that th potocol implmnts th spc. But it is also an impotant aid to undstanding what is going on. By studying what happns to th valu of th abstaction function duing ach action of G, w can lan what th actions a doing and why thy wok. Dfinitions cu-q = {(msg, mak)} if msg nil and (last s = nil o last s g ) { } othwis inflight s = {(i, ids(s) i g and i last s }, sotd by i to mak a squnc old-q = th squnc of (M, Mak) s gottn by tuning ach (i, in inflight s into (m, #) inflight s = {last s } if (last s, OK) s and last s last { } othwis. Not that th inflights xclud lmnts that might still b tansmittd as wll as lmnts that a not of intst to th dstination. This is so th abstaction function can pai thm with th # mak. Abstaction function q old-q + cu-q status (?, mak) if cu-q { } ( (OK, +) if mod s = snd and last s = last (b) (OK, #) if mod s = snd and last s inflight s (c) (lost, +) if mod s = snd (d) and last s (g {last } inflight s ) (lost, +) if mod s = idl () c s/ c s/ Th cass of status a xhaustiv. Not that w do not want (msg, +) in q if mod s = snd and lasts s g, bcaus in this cas msg has bn dlivd o lost. W s that G simulats th q of D using old-q + cu-q, and that old-q is th lftov mssags in th channl that a still good but havn t bn dlivd, whil cu-q is th mssag th snd is cuntly woking on, as long as its idntifi is not yt assignd o still good. Similaly, status has a diffnt valu fo ach stp in th dlivy pocss: still snding th mssag (, nomal ack (b), ack aft a civ cash (c), lost ack (d), o dlivd ack ()..2 Invaiants Lik th abstaction function, th invaiants a both ssntial to th poof and an impotant aid to undstanding. Thy xpss a gat dal of infomation about how th potocol is supposd to wok. It s spcially instuctiv to s how th pats of th stat that hav to do with cashs (c s/ and mak) affct thm. Th fist fw invaiants stablish som simpl facts about th usd sts and thi lation to oth vaiabls. (G2) flcts that fact that idntifis mov fom g s to usd s on by on, (G) th fact that unlss th civ is coving, idntifis must nt usd bfo thy can appa anywh ls (G4) th fact that thy must nt usd s bfo thy can appa in last vaiabls o channls. If msg = nil thn last s = nil (G1) g s usd s = { } (G2 All lmnts of usd s a distinct. (G2b) usd g (G If c thn usd g s usd s (Gb) usd s {last s, last } {nil} ids(s) ids(s) (G4) Th nxt invaiants dal with th flow of idntifis duing dlivy. (G) says that ach idntifi tags at most on mssag. (G6) says that if all is wll, g s and last s a such that a mssag will b dlivd and acknowldgd poply. (G7) says that an idntifi fo a mssag bing acknowldgd can t b good. {m (i = last s and m = msg) o (i, s} has 0 o 1 lmnts (G) If mak = + and c s and c thn g s g and last s g {last, nil} (G6) g ({last } ids(s)) = { } (G7) Finally, som facts about th idntifi last s fo th mssag th snd is tying to dliv. It coms lat in th idntifi oding than any oth idntifi in s (G8. If it s bn dlivd and is gtting a positiv ack, thn nith it no any oth idntifi in s is in g, but thy a all in usd (G8b). If it s gtting a ngativ ack thn it won t gt a lat positiv on (G8c). If last s nil thn ids(s) last s (G8 and if last s = last o (last s,ok) s thn ({last s } ids(s)) g = { } (G8b) and ({last s } ids(s)) usd and if (last s, lost) ids(s) thn last s last (G8c). Poof that G implmnts D This quis showing that vy action of G simulats som squnc of actions of D which is th sam xtnally. Sinc G has quit a fw actions, th poof is somwhat tdious. A fw xampls giv th flavo. cov s : Mak msg and dop it unlss it movs to old-q; mak and dop status. Handout 26. Rliabl Mssags 1 Handout 26. Rliabl Mssags 16

9 gt(: Fo th chang to q, fist dop vything in old-q lss than i. Thn m is fist on q sinc ith i is th smallst I in old-q, o i = last s and old-q is mpty by (G8. So D s gt( dos th st of what G s dos. Evything in old-q + cu-q that was i is gon, so th cosponding M s a gon fom q as quid. W do status by th abstaction function s cass on its old valu. D says it should chang to (OK, x) iff q bcoms mpty and it was (?, x). In cass (c-) status isn t (?, x) and it dosn t chang. In cas (b) th guad i g of gt is fals by (G8b). In cas ( ith i = last s o not. If not, thn cu-q mains unchangd by (G8, so status dos also and q mains non-mpty. If so, thn cuq and q both bcom mpty and status changs to cas (b). Simulat this by umaking status if ncssay; thn D s gt( dos th st. gtack(: Th q is unchangd bcaus last s = i ids(s), so last s g by (G7) and hnc cuq is mpty, so changing msg to nil kps it mpty. Bcaus old-q dosn t chang, q dosn t ith. W nd up with status = (lost, +) accoding to cas (), as quid by D. Finally, w must show that a ags with th old valu of status. W do this by th cass of status as w did fo gt: ( Impossibl, bcaus it quis last s g, but w know last s ids(s), which xcluds last s g by (G7). (b) In this cas last s = last, so (G8c) nsus a lost, so a = OK. (c) If a = OK w a fin. If a = lost dop status fist. (d) Sinc last s inflight s, only (last s, lost) s is possibl, so a = lost. () Impossibl bcaus last s nil. shink : If c thn msg may b lost fom q; simulat this by making and dopping it, and likwis fo status. If mak = # thn msg may b lost fom q, but it is makd, so simulat this by dopping it, and likwis fo status. Othwis th pcondition nsus that last s g dosn t chang, so cu-q and status don t. Inflight s, and hnc old-q, can los an lmnt; simulat this by dopping th cosponding lmnt of q, which is possibl sinc it is makd #. 6 How C and H implmnt G Thn fo ach potocol w giv a figu that shows th flow of packts, followd by a fomal dsciption of th stat and th actions. Th potion of th figus that shows mssags bing snt and acks tund is xactly th sam as th bottom half of Figu 4 fo G; all th potocols handl mssags and acks idntically. Thy diff in how th snd obtains good idntifis, shown in th top of th figus, and in how th civ clans up its stat. In th figus fo C and H w show th abstaction function to G in outlin font. Not that G allows ith good st to gow o shink by any numb of Is though patd gow o shink actions as long as th invaiants g s g and last s g {last } a maintaind in th absnc of cashs. Fo C th incas actions simulat occuncs of sval gow and shink actions, on fo ach i in th st dfind in th tabl. Likwis cv s (j s, i) in H may simulat sval shink s actions. Abstaction functions to G G C H usd s {i 0 i < tim s } {snt} {nil} usd s (histoy) usd {i 0 i < low} usd g s {tim s } {snt} {i (j s, i) s} g {i low < i and i < high} {i } {nil} mak # if last s g and dadlin = nil + othwis msg, last s/, and c s/ a th sam in G, C, and H # if mod s = ndi and g s g + othwis s s th (I, M) mssags in s s s th (I, A) mssags in s W now pocd to giv two pactical potocols, th clock-basd potocol C and th handshak potocol H. Each implmnts G, but thy handl th good sts quit diffntly. In C th good sts a maintaind using tim; to mak this possibl th snd and civ clocks must b oughly synchonizd, and th must b an upp bound on th tim quid to tansmit a packt. Th snd s cunt tim tim s is th only mmb of g s ; if th snd has alady usd tim s thn g s is mpty. Th civ accpts any mssag with an idntifi in th ang (tim 2ε δ, tim + 2ε), wh ε is th maximum clock skw fom al tim and δ th maximum packt tansmission tim, as long as it hasn t alady accptd a mssag with a lat idntifi. In H th snd asks th civ fo a good idntifi; th civ s obligation is to kp th idntifi good until it cashs o civs th mssag, o lans fom th snd that th idntifi will nv b qual to last s. W bgin by giving th abstaction functions fom C and H to G, and a sktch of how ach implmnts th magic actions of G, to hlp th ad in compaing th potocols. Caful study of ths should mak it cla xactly how ach potocol implmnts G s magic actions in a poply distibutd fashion. Handout 26. Rliabl Mssags 17 Handout 26. Rliabl Mssags 18

10 Sktch of implmntations G C H gow s (i) tick(i) snd s (j s, i) shink s (i) tick(i'), i {tim s } {snt} los s (j s, i) if th last copy is lost o cv s (j s, i'), fo ach i g s {i'} gow (i) incas-high(i'), fo ach mod = idl and cv s (ndi, *) i {i high < i < i'} shink (i) incas-low(i'), fo ach cv s (i, don) i {i low < i i'} clanup clanup cv s (last, don) 7 Th clock-basd potocol C This potocol is du to Liskov, Shia, and Woclawski [1991]. Figu 6 shows th stat and th flow of infomation. Compa it with Figu 4 fo G, and not that th is no flow of nw idntifis fom civ to snd. In C th passag of tim supplis th snd with nw idntifis, and is also allows th civ to clan up its stat. Th ida bhind C is to us loosly synchonizd clocks to povid th idntifis fo mssags. Th snd uss its cunt tim fo th nxt idntifi. Th civ kps tack of low, th biggst clock valu fo which it has accptd a mssag: bigg valus than this a good. Th civ also kps a stabl bound high on th biggst valu it will accpt, chosn to b lag than th civ s clock plus th maximum clock skw. Aft a cash th civ sts low := high; this nsus that no mssags a accptd twic. Th snd s clock advancs, which nsus that it will gt nw idntifis and also nsus that it will vntually gt past low and stat snding mssags that will b accptd aft a civ cash. It s also possibl fo th civ to advanc low spontanously (by incas-low) if it hasn t civd a mssag fo a long tim, as long as low stays small than th cunt tim 2ε δ, wh ε is th maximum clock skw fom al tim and δ is th maximum packt tansmission tim. This is good bcaus it givs th civ a chanc to un sval copis of th potocol (on fo ach of sval snds), and mak th valus of low th sam fo all th idl snds. Thn th civ only nds to kp tack of a singl low fo all th idl snds, plus on fo ach activ snd. Togth with C s clanup action this nsus that th civ nds no stoag fo idl snds. If th assumptions about clock skw and maximum packt tansmission tim a violatd, C still povids at-most-onc dlivy, but it may los mssags (bcaus low is advancd too soon o th snd s clock is lat than high) o acknowldgmnts (bcaus clanup happns too soon). Handout 26. Rliabl Mssags 19 S n d Snd actions stat choos(i) put( gs gtack( tim s last s msg cs 2ε δ 2ε skw tansmission tim skw snd(i, cv(i, s OK 4 lost tim Handout 26. Rliabl Mssags 20 s A B cv(i, snd(i, high low last c Figu 6. Th flow of infomation in C Rciv stat actions Šβ nw i fom snd gt( Mods, typs, packts, and th pattn of mssags a th sam as in G, xcpt that th I st has a total oding. Th dadlin vaiabl xpsss th assumption about maximum packt dlivy tim: al tim dosn t advanc (by pogss) past th dadlin fo dliving a packt. In a al implmntation, of cous, th will b som oth poptis of th channl fom which th constaint imposd by dadlin can b dducd. Ths a usually pobabilistic; w dal with this by dclaing a cash whnv th channl fails to mt its dadlin. Tabl givs th stat and actions of C. Th conjunct c s has bn omittd fom th guads of all th snd actions xcpt cov s, and likwis fo c and th civ actions. Not that lik G, this vsion of C snds an ack only in spons to a mssag. This is unlik H, which has continuous tansmission of th ack and pays th pic of a don mssag to stop it. Anoth possibility is to mak timing assumptions about s and tim out th ack; som assumptions a ndd anyway to mak clanup possibl. This would b lss pactical but mo lik H. Not that tim s and tim diff fom al tim (now) by at most ε, and hnc tim s and tim can diff fom ach oth by as much as 2ε. Not also that th dadlin is nfocd by th pogss action, which dosn't allow al tim to advanc past th dadlin unlss somon is coving. Both cash s and cash cancl th dadlin. About th paamts of C Th potocol is paamtizd by th constants: δ = maximum tim to dliv a packt β = amount byond tim + 2ε to incas high ε = maximum of now tim /s g R c i v

11 Ths paamts must satisfy two constaints: δ > ε so that mod s = snd implis last s < dadlin. β > 0 so incas-high can b nabld. Asid fom this constaint th choic of β is just a tadoff btwn th fquncy of stabl stoag wits (at last on vy β, so a bigg β mans fw wits) and th dlay imposd on cov to nsu that mssags put aft cov don t gt doppd (as much as 4ε + β, bcaus high can b as big as tim + 2ε + β at th tim of th cash bcaus of (), and tim 2ε has to gt past this via tick bfo cov can happn, so a bigg β mans a long dlay). 7.1 Invaiants Mostly ths a facts about th oding of vaious tim vaiabls; a lot of x nil conjuncts hav bn omittd. Nothing bing snt is lat than tim s (C1). Nothing bing acknowldgd is lat than low, which is no lat than high, which in tun is big nough (C2). Nothing bing snt o acknowldgd is lat than last s (C). Th snd s tim is lat than low, hnc good unlss qual to snt (C4). last s tim s (C1) last low high (C2 ids(s) low (C2b) If c thn tim + 2ε high (C2c) ids(s) last s (C last last s (Cb) {i (i, OK) s} last s (Cc) low tim s (C4) low < tim s if last s tim s If a mssag is bing snt but hasn t bn dlivd, and th hasn t bn a cash, thn dadlin givs th dadlin fo dliving th packt containing th mssag (basd on th maximum tim fo a packt that is bing tansmittd to gt though s), and it isn t too lat fo it to b accptd (C). If dadlin nil thn now < last s + ε + δ (C low < last s (Cb) An idntifi gtting a positiv ack is no lat than low, hnc no long good (C6). If it s gtting a ngativ ack, it must b lat than th last on accptd (C7). If (last s, OK) s thn last s low (C6) If (last s, lost) s thn last < last s (C7) Nam Guad Effct Nam Guad Effct **put( msg = nil msg := m choos(i) msg nil, last s = nil, i=tim s, i snt snt := i, last s := i, dadlin := now+δ *gt( xists i such that cv s (i,, i (low..high) low := i, last := i, dadlin := nil, snd s (i, OK) snd last s nil snd s (last s, msg) *gtack( cv s (last s, last s := nil, msg := nil **cash s c s := tu, dadlin:= nil *cov s c s last s := nil, msg := nil, c s := fals sndack **cash xists i such that cv s (i, *), i (low..high) *cov c, high < tim 2ε low := max(low, i), snd s (i, if i = last thn OK ls lost ) if i = last s thn dadlin := nil c := tu, dadlin:= nil last := nil, low := high, high := tim + 2ε + β, c := fals low := i incaslow(i) 2ε δ low < i tim incashigh(i) + 2ε + β high < i tim high := i last := nil clanup snt tim s snt := nil clanup last < tim 2ε 2δ tick(i) tim s < i, now i < ε pogss(i) now < i, i tim s/ < ε, i < dadlin o dadlin=nil tim s := i tick(i) tim < i, now i < ε, i + 2ε < high o c now := i tim := i tim s : I := 0 (stabl) tim : I := 0 (stabl) snt : I o nil := nil low : I := 0 high : I := β (stabl) last s : I o nil := nil last : I o nil := nil msg : M o nil := nil c s : Boolan := fals c : Boolan:= fals dadlin : I o nil := nil now : I := 0 Tabl. Stat and actions of C. Actions blow th thick lin handl th passag of tim. 8 Th handshak potocol H This is th standad potocol fo stting up ntwok connctions, usd in TCP, ISO TP-4, and many oth tanspot potocols. It is usually calld th-way handshak, bcaus only th Handout 26. Rliabl Mssags 21 Handout 26. Rliabl Mssags 22

12 packts a ndd to gt th data dlivd, but fiv packts a quid to gt it acknowldgd and all th stat cland up (Blsns [1976]). As in th gnic potocol, whn th a no cashs th snd and civ ach go though a cycl of mods, th snd phaps on ahad. Fo th snd, th mods a idl, ndi, snd; fo th civ, thy a idl, accpt, and ack. In on cycl on mssag is snt and acknowldgd by snding th packts fom snd to civ and two fom civ to snd, fo a total of fiv packts. Tabl 6 summaizs th mods and th packts that a snt. Th mods a divd fom th valus of th stat vaiabls j and last: mod s = idl iff j s = last s = nil mod = idl iff j = last = nil mod s = ndi iff j s nil mod = accpt iff j nil mod s = snd iff last s nil mod = ack iff last nil Snd Rciv mod snd advanc on packt advanc on snd mod idl s idl blow ndi (ndi, j s ) patdly snd (last s, patdly idl ndi o snd (i, don) whn (i, aivs put, to ndi (j s, i) aivs, to snd (last s, a ) aivs, to idl (i, don) whn (j j s, i) o (i, OK) aivs, to foc civ to idl (ndi, j) (j, i) (i, (i, (i, don) (ndi, j) aivs, to accpt (i, aivs, to ack (i, don) aivs, to idl (last, don) aivs, to idl Tabl 6. Exchang of mssags in H (i, lost) whn (i, aivs (j, i ) patdly (last, OK) patdly 4 Handout 26. Rliabl Mssags 2 idl accpt (i, lost) is a ngativ acknowldgmnt; it mans that on of two things has happnd: Th civ has fogottn about i bcaus it has land that th snd has gottn a positiv ack fo i, but thn th civ has gottn a duplicat (i,, to which it sponds with th ngativ ack, which th snd will igno. Th civ has cashd sinc it assignd i, and i s mssag may hav bn dlivd to gt o may hav bn lost. 4 (i, OK) is a positiv acknowldgmnt; it mans i s mssag was dlivd to gt. ack S n d Snd actions stat j-nw put( choos(i) put( gtack( gs js last s msg snd(ndi, j) cv( j, i) snd(i, cv(i, snd(i, don) 12 s ndi 12 cv(ndi, j) snd( j, i) cv(i, snd(i, cv(i, don) [as last] Handout 26. Rliabl Mssags 24 s s B A s OK 4 lost s 12 4 don [copy] Figu 7. Th flow of infomation in H j Rciv stat actions nw i last assigni(j, i) g gt( clanup Figu 7 shows th stat, th flow of idntifis fom th civ to th snd at th top, and th flow of don infomation back to th civ at th bottom so that it can clan up. Ths a sandwichd btwn th standad xchang of mssag and ack, which is th sam as in G (s Figu 4). Intuitivly, th ason th a fiv packts is that: On ound-tip (two packts) is ndd fo th snd to gt fom th civ an I (namly i ) that both know has not bn usd. On ound-tip (two packts) is thn ndd to snd and ack th mssag. A final don packt fom th snd infoms th civ that th snd has gottn th ack. Th civ nds this infomation in od to stop tansmitting th ack and discad its stat. If th civ discads its I got th mssag stat bfo it knows that th snd got th ack, thn if th channl loss th ack th snd won t b abl to find out that th mssag was actually civd, vn though th was no cash. This is contay to th spc S. Th don packt itslf nds no ack, bcaus th snd will also snd it whn idl and hnc can bcom idl as soon as it ss th ack. W intoduc a nw typ: J, an infinit st of idntifis that can b compad fo quality. Th snd and civ snd packts to ach oth. An I o J in th fist componnt is th to idntify th packt fo th dstination. Som packts also hav an I o J as th scond R c i v

13 componnt, but it dos not idntify anything; ath it is bing communicatd to th dstination fo lat us. Th (i, and (i, don) packts a both oftn calld clos packts in th litatu. Th H potocol has th sam pogss and fficincy poptis as G, and in addition, although th potocol as givn dos assum an infinit supply of Is, it dos not assum anything about clocks. It s ncssay fo a busy agnt to snd somthing patdly, bcaus th oth nd might b idl and thfo not snding anything that would gt th busy agnt back to idl. An agnt also has a st of xpctd packts, and it wants to civ on of ths in od to advanc nomally to th nxt mod. To nsu that th potocol is slf-stabilizing aft a cash, both nds spond to an unxpctd packt containing th idntifi i by snding an acknowldgmnt: (i, lost) o (i, don). Whnv th civ gts don fo its cunt I, it bcoms idl. Onc th civ is idl, th snd advancs nomally until it too bcoms idl. Tabl 7 givs th stat and actions of H. Th conjunct c s has bn omittd fom th guads of all th snd actions xcpt cov s, and likwis fo c and th civ actions. 8.1 Invaiants Rcall that ids(c) is {i (i, *) c}. W also dfin jds(c) = {j (j, *) c o (*, j) c}. Most of H s invaiants a boing facts about th pogss of I s and J s fom usd sts though i/j s/ to last s/. W nd th histoy vaiabls usd s and sn to xpss som of thm. (H6) says that th s at most on J (fom a ndi packt) that gts assignd a givn I. (H8) says that as long as th snd is still in mod ndi, nothing involving i has mad it into th channls. j-usd {j s, j } {nil} jds(s) jds(s) (H1) usd {i, last } {nil} usd s {i (*, i) s} ids(s) ids(s) (H2) usd s {last s, last } {nil} ids(s) ids(s) (H) If (i, don) s thn i last s (H4) If i nil thn (j, i ) sn (H) If (j, i) sn and (j, i) sn thn j = j (H6) If (j, i) s thn (j, i) sn (H7) If j s = j nil thn (i, *) s and (i, don) s (H8) 8.2 Pogss W consid fist what happns without failus, and thn how th potocol covs fom failus. If nith patn fails, thn both advanc in sync though th cycl of mods. Th only thing that dails pogss is fo som paty to chang mod without advancing though th full cycl of mods that tansmits a mssag. This can only happn whn th civ is in accpt mod and gts (i, don), as you can s fom Tabl 6. This can only happn if th snd got a packt containing i. But if th civ is in accpt, th snd must b in ndi o snd, and th only thing that s bn snt with i is (j s, i ). Th snd gos to o stays in snd and dosn t mak don whn it gts (j s, i ) in ith of ths mods, so th cycling though th mods is nv disuptd as long as th s no cash. Nam Guad Effct Nam Guad Effct **put( msg = nil, msg := m, qusti choos(i) xists j such that j j-usd j s nil, last s = nil last s = nil, cv s (j s, i) j s := j, j-usd +:= {j} snd s (ndi, j s ) j s := nil, last s := i, usd s +:= i assigni(j,i) cv s (ndi, j), i = last = nil, i usd j := j, i := i, usd +:= i, sn +:= {(j, i)} sndi j nil snd s (j, i ) snd last s nil snd s (last s, msg) *gt( xists i such j := i := nil, that cv s (i,, last := i, i = i snd s (i, OK) sndack last nil snd s (last, OK) *gtack( cv s (last s, bounc (j, i) if a = OK thn snd s (last s, don) msg := last s := nil bounc xists i such that cv s (i, *), i i, i last cv s (j, i), snd s (i, don) clanup(i) cv s (i, don), j j s, i last s i = i o i = last o cv s (i, OK) snd s (i, lost ) j := i := nil, last := nil **cash s c s := tu **cash c := tu *cov s c s msg := nil, j s := last s := nil, c s := fals *cov c j := i := nil, last := nil, c := fals gowj-usd(j) j-usd +:= {j} gowusd(i) usd +:= {i} usd s : squnc[i] := (histoy) usd : st[i] := { } (stabl) j-usd : st[j] := { } (stabl) sn : st[(j, I)] := { } (histoy) j s : J o nil := nil j : J o nil := nil msg : M o nil := nil i : I o nil := nil last s : I o nil := nil last : I o nil := nil c s : Boolan := fals c : Boolan := fals Tabl 7. Stat and actions of H. Havy black lins outlin additions to G If ith patn fails and thn covs, th oth bcoms idl ath than gtting stuck; in oth wods, th potocol is slf-stabilizing. Why? Whn th civ isn t idl it always snds somthing, and if that isn t what th snd wants, th snd sponds don, which focs th civ to bcom idl. Whn th snd isn t idl it s ith in ndi, in which cas it will vntually gt what it wants, o it s in snd and will gt a ngativ ack and bcom idl. In mo dtail: Th civ bails out whn th snd cashs bcaus th snd fogts i s and j s whn it cashs, if th civ isn t idl, it kps snding (j, i ) o (last, OK), th snd sponds with (i /last, don) whn it ss ith of ths, and th civ nds up in idl whnv it civs this. Handout 26. Rliabl Mssags 2 Handout 26. Rliabl Mssags 26