A NOTE ON K-STATE SELF-STABILIZATION IN A RING WITH K= N

Transcription

1 Nordic Journal of Comuting A NOTE ON K-STATE SELF-STABILIZATION IN A RING WITH K= N WAN FOKKINK Vrije Universiteit Amsterdam Deartment of Theoretical Comuter Science De Boelelaan 08a, 08 HV Amsterdam, The Netherlands CWI Deartment of Software Engineering, PO Box 94079, 090 GB Amsterdam, The Netherlands wanf@cs.vu.nl JAAP-HENK HOEPMAN Radboud University Nijmegen Institute for Comuting and Information Sciences PO BOX 900, 6500 GL Nijmegen, The Netherlands jhh@cs.ru.nl JUN PANG INRIA Futurs and LIX, École Polytechnique Rue de Saclay, 928 Palaiseau Cedex, France angjun@lix.olytechnique.fr Abstract. We show that, contrary to common belief, Dijkstra s K-state mutual exclusion algorithm on a ring also stabilizes when the number K of states er rocess is one less than the number N+ of rocesses in the ring. We formalize the algorithm and verify the roof in PVS, based on Qadeer and Shankar s work. We show that K=Nis shar by giving a counter-examle for K=N. ACM CCS Categories and Subject Descritors: C.2.2, C.2.4, D.2.4, F.3.. Key words: Distributed comuting, fault tolerance, self-stabilization, mutual exclusion, formal verification, PVS.. Introduction Dijkstra introduced the notion of self-stabilization in his seminal aer [Dijkstra 974]. A distributed system is said to be self-stabilizing if it satisfies the following two roerties: The contribution of Jun Pang to this research was suorted by the Dutch Technology Foundation STW under the roject CES5008 Imroving the quality of embedded systems using formal design and systematic testing. This aer was finalized when Jun Pang was emloyed at CWI Amsterdam. Received February, 2004; acceted March, 2005.

2 2 W.J. FOKKINK, J.-H. HOEPMAN, J. PANG () convergence: starting from an arbitrary state, the system is guaranteed to reach a stable state; (2) closure: once the system reaches a stable state, it cannot become unstable anymore. A system with the roerty of self-stabilization can have the advantages of fault tolerance, robustness for dynamic toologies, and straightforward initialization. Consider a system with a number of rocesses sharing a common resource (usually called critical section). Given an arbitrary initial state of the system, there might be more than one rocess enabled to access the common resource. The roblem of mutual exclusion is to guarantee that the common resource will not be accessed by more than one rocess simultaneously. Self-stabilizing algorithms for mutual exclusion make sure that each infinite run of the system reaches a stable state where exactly one rocess is enabled; and from then on, mutual exclusion of the common resource is guaranteed. In [Dijkstra 974], Dijkstra resented three self-stabilizing algorithms for mutual exclusion on a ring network: an algorithm with K-state rocesses, an algorithm with four-state rocesses, and an algorithm with three-state rocesses. Regarding their correctness, he wrote: For brevity s sake most of the heuristics that led me to find them, together with the roofs that they satisfy the requirements, have been omitted, [...]. After more than ten years, Dijkstra [986] ublished a roof of self-stabilization of his algorithm with three-state rocesses, and acknowledged that the verification was actually not trivial. In this aer, we focus on Dijkstra s algorithm with K-state rocesses. We consider a system of N+ rocesses, numbered from 0 through N, arranged in a unidirectional ring. Each rocess i has a counter v(i) that can hold a value from 0 to K. Each rocess can observe its own counter value and the counter value of its anti-clockwise neighbor. 0 is a distinguished rocess that is enabled when v(0)=v(n), and when enabled, it can increment its counter by modulo K. Each rocess i for i=,..., N is enabled when v(i) v(i ), and when enabled, it can udate its counter value so that v(i)=v(i ). Thus the behavior of the system can be resented as follows: Dijkstra s K-state algorithm for mutual exclusion. Let rocesses 0,..., N form a unidirectional ring, where the counter for each rocess i holds a value v(i) {0,..., K }. if v(0)=v(n), then v(0) := (v(0)+) mod K; if v(i) v(i ) for i=,..., N, then v(i) := v(i ). The system is said to be in a stable state if it contains exactly one enabled rocess, which can be interreted as holding a token. This token can be assed along the ring network; a rocess can access the common resource only when it holds the token. This algorithm has been roved correct by different roof methods for selfstabilization, e.g. [Varghese 992], [Tel 994] and [Theel 2000]. It attracted much attention from the formal verification community. There are two distinct traditions

3 A NOTE ON K-STATE SELF-STABILIZATION IN A RING WITH K = N 3 in automatic verification: theorem roving and model checking. Merz [998] formalized the algorithm and roved it correct in Isabelle/HOL [Nikow et al. 2002]. Qadeer and Shankar [998] alied PVS [Owre et al. 992] to rove its correctness. Later on, Kulkarni et al. [999] also roved its correctness using PVS in a different fashion. Model checking techniques were alied to this algorithm in [Shukla et al. 997] and [Tsuchiya et al. 200]. Shukla et al. [997] verified whether the algorithm converges to stable states from a given initial state in SPIN [Holzmann 990] for systems with rocesses u to fifty. Tsuchiya et al. [200] described the algorithm in SMV [McMillan 993] and verified the roerty of self-stabilization for systems with any ossible initial state and 3 N 8. Due to the state exlosion roblem, this aroach has some restrictions: it cannot be directly used for any ossible initial state, and/or it can only rove the algorithm correct with a limited number of rocesses and states. However, all these roofs only showed correctness of the algorithm under a stronger condition, namely the algorithm is correct if K > N. This also haened in Schneider s survey aer on self-stabilization [Schneider 993]. The only excetion we could find is [Kulkarni et al. 999]. Although they roved the algorithm correct for K> N, almost at the end of the aer, they stated: it is ossible to rove stabilization when K N we will need to redo only the roofs that deend on this assumtion, namely Lemmas 6.4, 6.6, 6.8. However, the validity of this claim is not clear, esecially their formulation of Lemma 6.4 is false when K= N. Judging from the literature, it seems to be a common belief that Dijkstra s K- state mutual exclusion algorithm on a ring only stabilizes when K > N. But in fact, Dijkstra gave a note after resenting the solution with K-state machines in [Dijkstra 974] as follows: Note. [...] the relation K N is sufficient. A brief informal roof sketch was given by himself in [Dijkstra 982]. In addition, he said: (and for smaller values of K counter examles kill the assumtion of selfstabilization.) We note that, if K = N, there should be at least three rocesses in the ring; namely, if K=N=, then clearly 0 is always enabled and is never enabled. If K> N, then the algorithm also works for a ring with two rocesses. In this aer, we formally rove that if N>, then K Nis sufficient for the stabilization of Dijkstra s K-state mutual exclusion algorithm. For the condition K>N, the roofs in [Varghese 992], [Tel 994], [Qadeer and Shankar 998], [Merz 998] and [Kulkarni et al. 999] used the classic igeonhole rincile. The roof for K = N becomes considerably more comlicated, since the igeonhole rincile cannot be simly alied for any state of the algorithm. This will be exlained in detail in Section 3. Our roof, which is different from the roof sketch in [Dijkstra 982], has been checked in PVS. The rest of the aer is structured as follows. In Section 2, we show that Dijkstra s K-state mutual exclusion algorithm on a ring also stabilizes when the number of states er rocess is one less than the number of rocesses on the ring, namely

4 4 W.J. FOKKINK, J.-H. HOEPMAN, J. PANG K N. We formalized the algorithm and checked our roof in PVS. Our verification in PVS is based on [Qadeer and Shankar 998], we reused their formalization of the algorithm and most of their lemmas. We resent the crucial lemmas of our PVS verification in Section 3. In Section 4, we show that K N is shar by a counter-examle, which was missing in [Dijkstra 982]. We conclude this aer in Section Proof of Self-Stabilization We give the roof that Dijkstra s K-state mutual exclusion algorithm on a ring stabilizes when K N >. First we rove the closure roerty for self-stabilization (see Proosition ). LEMMA. In each state of the algorithm, there is at least one enabled rocess. PROOF. We distinguish two cases: for all i {,..., N}, v(i)=v(0). In articular, v(0)=v(n), which imlies 0 is enabled; otherwise, there exists a j {,..., N} such that v( j) v(0), and for all i {,..., j }, v(i)=v(0). Since v( j) v( j ), j is enabled. Lemma imlies that no run of the algorithm ever deadlocks, as in each state the enabled rocess(es) can fire, meaning that the counter value is udated. PROPOSITION. Once in a stable state, the system will remain in stable states. PROOF. We assume i is the only enabled rocess in some stable state. It is easy to see that when i fires, it makes itself disabled, and it makes at most i s clockwise neighbor enabled. By Lemma, in each state of the algorithm, there exists at least one enabled rocess. Therefore, after the firing of i, the clockwise neighbor of i is the only enabled rocess, so the system remains in a stable state. We roceed to rove the convergence roerty for self-stabilization (see Theorem ). LEMMA 2. In each infinite run of the algorithm, 0 fires infinitely often. PROOF. Given a state, consider the sum over all elements{n i i {,..., N} i is enabled}. Clearly, when a nonzero rocess fires, this sum strictly decreases. Furthermore, for each state, this sum is at least 0. Hence, in each infinite run, 0 must fire infinitely often. DEFINITION. The legitimate states are those states that satisfy v(i)= x for all i< j and v(i)=(x ) mod K for all j i N, for some choice of x<kand j N. Note that a legitimate state is stable, as only j is enabled.

5 A NOTE ON K-STATE SELF-STABILIZATION IN A RING WITH K = N 5 THEOREM. Let N>. Even if K= N, Dijkstra s K-state mutual exclusion algorithm for N + rocesses stabilizes. PROOF. By Lemma, no run of the algorithm ever deadlocks. By Lemma 2, in each infinite run of the algorithm 0 fires infinitely often. Let N>. We rove that each infinite run of the algorithm visits a legitimate state. Consider the case where 0 fires for the first time. Then just before that, v(0)=v(n)=y for some y, and the new value of v(0) becomes (y+) mod K. Now consider the case when 0 fires again. Then just before that, v(0)=v(n)= (y+) mod K. In order for N to change its counter value from y to (y+) mod K, it must have coied (y+) mod K from its anti-clockwise neighbor N. This moment must have occurred after 0 changed its counter value to v(0) = (y+ ) mod K. But then, just after N coies (y+) mod K from N, we actually have v(n )=v(n)=(y+) mod K. In other words, since N> imlies that N 0, two different nonzero rocesses hold the same counter value (y+) mod K. Then the N nonzero rocesses hold at most N different counter values from {0,..., K }. When K N (so in articular when K=N), then at this oint in time there is an x<kthat does not occur as the counter value of any nonzero rocess in the ring. Since 0 fires infinitely often, eventually v(0) becomes x. The other rocesses merely coy counter values from their anti-clockwise neighbors, so at this oint no other rocess holds x. The next time 0 fires, v(n)=v(0)= x. The only way that N gets the counter value x is if all intermediate rocesses have coied x from 0. We conclude that all rocesses have the counter value x, which is a legitimate state. Dijkstra [982] gave a secific scenario to show that the system will definitely reach a legitimate state, after 0 has been enabled for N times. In most cases, a legitimate state can be detected earlier than in that scenario, as shown in the above roof. 3. Mechanical Verification in PVS Qadeer and Shankar [998] resented a detailed descrition of a mechanical verification in PVS of stabilization of Dijkstra s K-state mutual exclusion algorithm. Although they only checked the correctness of the algorithm under the condition K > N, their PVS formalism and roof could for a large art be reused, which saved us much effort and gave us many insightful thoughts on the verification in PVS. (The URL ft://ft.cs.york.ac.uk/ub/vs/examles/ self-stability/ contains their PVS formalization and roofs.) First, we resent Qadeer and Shankar s claims to sketch their roof skeleton. Then we show the lemma that we had to adat for our roof. The algorithm satisfies the following roerties, for each state of the system, and each infinite run from this state: I. there is always at least one enabled rocess; II. the number of enabled rocesses never increases;

6 6 W.J. FOKKINK, J.-H. HOEPMAN, J. PANG III. the enabledness of each rocess is eventually toggled; IV. 0 eventually takes on any counter value below K (follows by Proerty III); These roerties require no restriction on the relation between N and K. Proerty I corresonds to Lemma. Proerty II follows the fact that when a rocess fires, it makes itself disabled, and it makes at most its clockwise neighbor enabled. Proerty III is a more general version of Lemma 2. Qadeer and Shankar s PVS roof of these first four roerties could be (more or less) reused by us directly. V. eventually the system will reach a state, where there is some value x below K such that v(i) x for all i {,..., N} (follows by Proerty IV, and the roof of Theorem ); VI. eventually the system will reach a state with v(0)=x, and v(i) x for all i {,..., N}; then 0 is disabled until v(i) = v(0) for all i {,..., N} (follows by Proerty V); VII. the system is self-stabilizing (follows by roerties VI, I, and II). The roof of Proerty V uses the igeonhole rincile, which states that if each of n+ igeons is assigned to one of n igeonholes, then some hole must contain at least two igeons. This rincile was also formulated and roved in [Qadeer and Shankar 998]. Let S (v) denote the set{x<k i {,..., N}(v(i)= x)}. The following lemma corresonds to Proerty V. It states that the nonzero rocesses do not contain all the ossible counter values. LEMMA 3. (Lemma 4.3 in [Qadeer and Shankar 998]) If K> N, then x<k(x S (v)). Under the condition K > N, this can be informally roved as follows [Qadeer and Shankar 998]: there are N nonzero rocesses, and hence at most N distinct counter values at these rocesses; if there are K (K> N) ossible counter values, then there must be some x < K that is not the counter value at any nonzero rocess. If we relax the condition to K N, the above roof fails, because the igeonhole rincile does not aly when the number of igeons equals the number of igeonholes. Starting from this oint, we assume that K N>. We define T(v) to denote the set{x<k i {,..., N }(v(i)= x)}. In the following lemma the igeonhole rincile does aly. LEMMA 4. x<k(x T(v)). PROOF. T(v) contains at most N distinct counter values at rocesses from to N. If there are K (K N) ossible counter values, then there must be some x< K with x T(v). To check the roof of Lemma 4 in PVS, we could simly follow the PVS roof stes of Lemma 3 in [Qadeer and Shankar 998]. Now we introduce an extra lemma. LEMMA 5. v(n) T(v)= S (v)=t(v).

7 A NOTE ON K-STATE SELF-STABILIZATION IN A RING WITH K = N 7 PROOF. This is straightforward by the definitions of S (v) and T(v). In PVS, Lemma 5 could be roved by using existing PVS libraries for the finite cardinalities. Now we resent the main lemma for our PVS roof, corresonding to Lemma 3 in [Qadeer and Shankar 998] (Proerty VI). LEMMA 6. Each infinite run of the algorithm eventually reaches a state where the nonzero rocesses do not contain all the ossible counter values. PROOF. We know from Proerty III that N will eventually fire. By the algorithm, we then have v(n)=v(n ), so that v(n) T(v). By Lemma 5, S (v)=t(v). By Lemma 4, we can find an x< K with x T(v), so x S (v). After roving Lemma 6, and reusing (more or less) the lemmas and the PVS roof stes for roerties VI and VII in [Qadeer and Shankar 998], we could mechanically rove self-stabilization of Dijkstra s K-state algorithm in PVS. 4. K= N is Shar N 0 N 0 0 N N N 2 N Inital state Ste: Ste: N 0 0 N N 0 0 N 2 N 2 N 2 N 3 2 N 3 2 N 3 2 Ste: N+ Ste: N Ste: N Fig. 4.: A counter-examle: a ring with K = N In this section, we give a counter-examle showing that a smaller value of K would kill self-stabilization. For examle, in Fig. 4. (which assumes that N 3), we have a system with K=N, meaning that each rocess can have a counter value{0,..., N 2}. Consider the initial state shown at the to left-hand side of Fig. 4., in which 0,..., hold counter values from 0 to N 2, N holds counter value 0, and N holds counter value. By the algorithm,,..., N are

8 8 W.J. FOKKINK, J.-H. HOEPMAN, J. PANG enabled, so the number of enabled rocesses is N. (In Fig. 4., black rocesses are enabled.) We have a run as follows: Ste : N fires and makes 0 enabled; Ste 2: N fires and makes N enabled;... Ste N : 2 fires and makes enabled; Ste N: fires and makes 2 enabled; Ste N+ : 0 fires and makes enabled. From the initial state, after the above N+ stes (all rocesses have fired only once), the system ends in a state where the counter values of the rocesses are symmetric (modulo N ) to the initial state, so it still has N enabled rocesses. This scenario can be executed infinitely often without breaking the symmetry. So the system will never reach a legitimate state. Note that the given scenario only deals with the case K=N, it can be straightforwardly generalized for other cases with K< N. Thus K= N is shar! 5. Conclusion Judging from the literature on self-stabilization, it seems to be a common belief that Dijkstra s K-state algorithm on a ring stabilizes when K > N. In this aer we show that, contrary to this common belief, the algorithm also stabilizes when the number of states er rocess is one less than the number of rocesses on the ring (namely K=N). Our roof was formalized and checked in PVS, based on [Qadeer and Shankar 998]. We have given a counter-examle showing that K = N is indeed shar. One imortant fact (Lemma 6) used in our roof is that the nonzero rocesses do not contain all the ossible counter values. By this observation, together with the fact that each rocess is infinitely often enabled, we can rove that each infinite run of the algorithm will reach a legitimate state. For the case K>N, this fact can be roved using the igeonhole rincile, as is done in [Varghese 992], [Tel 994], [Qadeer and Shankar 998], [Merz 998] and [Kulkarni et al. 999]. For the case K=N in this aer, we choose the moment that N is enabled and fires, which makes v(n)=v(n ). After that we can aly the igeonhole rincile. Another imortant fact (Lemma ) is that whenever the system reaches a stable state, it will remain in stable states. Thus we have roved the roerties for self-stabilization. Regarding the verification in PVS, we downloaded the PVS code and roof by Qadeer and Shankar. Following their roof stes in PVS, we simly added a new definition of T(v), roved two new lemmas (Lemma 4 and Lemma 5), and adated one lemma as Lemma 6. The whole verification did not take too much effort. First, we sent a few days to understand the formalism and roof in [Qadeer and Shankar 998]. Since the PVS system, including PVS libraries, has been udated after 998, the downloaded PVS roof could not be simly rerun. We made some adations to make their PVS roof work again. After that, when we had the idea to

9 A NOTE ON K-STATE SELF-STABILIZATION IN A RING WITH K = N 9 rove (as shown in Section 2) the algorithm correct under the condition K = N, the roof was comletely checked in PVS within one day. The dum file containing our PVS formalization and roofs can be found at the URL htt:// olytechnique.fr/ angjun/stabilization/. References DIJKSTRA, E. W Self-stabilizing Systems in Site of Distributed Control. Communications of the ACM 7,, DIJKSTRA, E. W Self-stabilization in Site of Distributed Control. In Selected Writings on Comuting: A Personal Persective. Sringer-Verlag, DIJKSTRA, E. W A Belated Proof of Self-stabilization. Distributed Comuting,, 5 6. HOLZMANN, G. J Design and Validation of Comuter Protocols. Prentice Hall. KULKARNI, S. S., RUSHBY, J. M., AND SHANKAR, N A Case-study in Comonent-based Mechanical Verification of Fault-tolerant Programs. In Proceedings of 4th Worksho on Self- Stabilization. IEEE Comuter Society, MCMILLAN, K. L Symbolic Model Checking. Kluwer Academic. MERZ, S On the Verification of A Self-stabilizing Algorithm. Technical reort, University of Munich. NIPKOW, T., PAULSON, L. C., AND WENZEL, M Isabelle/HOL - A Proof Assistant for Higher- Order Logic. Sringer-Verlag. OWRE, S., RUSHBY, J. M., AND SHANKAR, N PVS: A Prototye Verification System. In Proceedings of th Conference on Automated Deduction, Volume 607 of Lecture Notes in Comuter Science. Sringer-Verlag, QADEER, S. AND SHANKAR, N Verifying A Self-stabilizing Mutual Exclusion Algorithm. In Proceedings of IFIP Working Conference on Programming Concet and Methods. Chaman & Hall, SCHNEIDER, M Self-stabilization. ACM Comuting Surveys 25,, SHUKLA, S. K., ROSENKRANTZ, D. J., AND RAVI, S. S Simulation and Validation Tool for Selfstabilizing Protocols. In Proceedings of 2nd SPIN Worksho, Volume 32 of DIMACS Series in Discrete Mathematics and Theoretical Comuter Science. TEL, G Introduction to Distributed Algorithms. Cambridge University Press. THEEL, O. E Exloitation of Ljaunov Theory for Verifying Self-stabilizing Algorithms. In Proceedings of 4th Conference on Distributed Comuting, Volume 94 of Lecture Notes in Comuter Science. Sringer-Verlag, TSUCHIYA, T., NAGANO, S., PAIDI, R. B., AND KIKUNO, T Symbolic Model Checking for Selfstabilizing Algorithms. IEEE Transaction on Parallel and Distributed Systems 2,, VARGHESE, G Self-Stabilization by Local Checking and Corrections. Phd thesis, MIT.