By J. Burns and J. Pachl Based on a presentation by Irina Shapira and Julia Mosin Uniform Self-Stabilization 1 P0P0 P1P1 P2P2 P3P3 P4P4 P5P5

1

by J. Burns and J. Pachl

Based on a presentation by Irina Shapira and Julia Mosin

Uniform Self-Stabilization

P0

P1

P2

P3

P4

P5

2

Self-Stabilizing System: S = (G, R, , )

• G = (V,E), |V|=n

• = 0 x 1 x . . . x n-1 - set of configurations where i is a finite set of states of processor Pi

• R - orientation of G specifies a total ordering on the neighbors for each v in V

• = 0 , 1 , . . . , n-1 - sequence of transition relations i is the transition relation of Pi : from i x v1 x . . . x vk to i ( R(i) = (v1, . . ., vk) )

3

For configuration = (s0, s1, … , sn-1) where

• sj is a state of Pj (for all j).


• x - possible next state of Pi by i ,

i.e. if R(i) = (v1, . . ., vk ) then x i (si, sv1, …, svk).

Define i () as the set of configurations ’ (of all processors)

such that ’ = (s0,s1, …, si-1, x, si+1, …, sn-1)

(for all possible values of x)

In words: i () is the set of configurations of the whole

system if Pi takes a step in .

4

• Pi is enabled (privileged) at if i () is not empty

i• -> ’ is a step of Pi if ’ i ()

• -> ’ is a step of Pi for some i

• 0, 1, ... is a computation of the system where

j-1 -> j for all j

Only one processor takes a step at a time - central daemon


5

P0

A system S = (G, R, , ) where

An n-processor uniform ring

• G is a cycle

• processors are denoted by 0,1, …, n-1 clockwise

• R(i) = ( (i-1) mod n, (i+1) mod n )

• 0 = 1 = . . . = n-1

• 0 = 1 = . . . = n-1

P1

P2

P3P4

P5

Definition:A system S = (G, R, , ) is self-stabilizing iff there is a set , called the legitimate configurations of S, satisfying:

For every there is a ’ such that -> ’ (1) No Deadlock

For every , every ’ such that -> ’ is in (2) Closure

Every infinite computation of S contains a configuration in (3) No Livelock

For every , exactly one processor is enabled (4) Mutual Exclusion

For every processor Pi, every infinite computation consisting of

configurations in contains an infinite number of steps by Pi

(5) Fairness

6

2,4 and 5 deal only with legitimate states.

The problem is 1 and 3.

7

s0s2

Theorem:There is no uniform n-processor self-stabilizing ring if n is composite.

Proof:

P0

P1

P2

P3

P4

P5

• [i] = {Pj | j = i mod p}

• Sym() all the Pj in [i] are in the same state in • if Sym(0) holds, we can construct an infinite computation

0 -> 1 -> 2 -> … for which Sym(i) holds for every i

0:

s0

s0

s0s0

s0

1:

s1

s1s1

s2

s2

2:

8

Main Result

• uniform (no distinguished processor)

• O( n2 ) states

• deterministic algorithm

• central scheduler

Algorithm for a ring of a prime size:

• unidirectional

9

• deterministic

• unidirectional (the value of di(si, si-1, si+1) depends only on si and si-1)

Notation:

means that

1i is s x 1 1( , , )i i i ix s s s

The algorithm

10

A First Attempt

• 0 = 1 = . . . = n-1 = { 0, 1, …, n-2 }

• arithmetic modulo n-1

The rule: if si si-1+1 then si-1 si si-1+1

11

121

P0

P2P3

P4 P1

0

0

2

3

0 0 1 2 3

1P1

P2

0 1 1 2 3

P0 P1 P2 P3 P4

0 1 2 2 3

P2P3

0 1 2 3 3

3P3

P4

0 1 2 3 0P40

P0

...

0 0 1 2 3

0 0 1 2 3

P0

P1

2

3 0

The cycle of the intendedlegitimate configurations


12

1321

0210

2020310

101

P2P3

P4

0 1 2 0 1

P0 P1 P2 P3 P4

...

0 1 2 0 1

A configuration sequence which does not converge to the legitimate configurations

P1

P0

P3

0 1 2 3 1

P3

P0

P4

2 1 2 3 1 P0

P1P4

2 1 2 3 0 P4

P0

P12 3 2 3 0

P0

P1

P2

1 3 2 3 0

P0

P1

P2

1 3 0 3 0

P1

P2P3

1 2 0 3 0

P1

P2P3 1 2 0 1 0 P2P3

P4

0 1 2 0 1

P0

P2P3

P4

livelock


13

14

The Algorithm:• n 3

Rule A: if Li Li-1+1 and (Li0 or Ti-1=0 or Ti-1Li-Li-1 or Ti-1<Ti) then Li-1.Ti-1 Li.Ti (Li-1+1).(Li-Li-1)

Rule B: if Li = Li-1+1 and Li 0 and Ti-1 Ti then Li-1.Ti-1 Li.Ti Li.Ti-1

• states are label.tag (Li.Ti)

• labels { 0, 1, …, n-2 }• tags { 0 } U { 2, 3, …, n-2 }

15

The Proof of Self-Stabilization:

Let L be the set of all cyclic permutations of configurations of the form

0.0 1.0 … a-1.0 a.0 a.0 a+1.0 … n-2.0for a=0, 1, …, n-2

Theorem:If n is prime, then the ring is self-stabilizing(and L is a set of legitimate configurations)

S = (G, R, , )


Rule B: if Li = Li-1+1 and Li0 and Ti-1 Ti then Li-1.Ti-1 Li.Ti Li.Ti-1

From now till the end: proof of the theorem.

16

Definitions:Let gG be a configuration

• if Li+1 Li+1 (mod n-1), then Pi and Pi+1 form a gap of g• the gap size (of Pi and g) g(i, ) g = Li+1- Li (mod n-1)• a segment of g is a maximal cyclically contiguous

sequence s=(Pi, Pi+1, …, Pj-1, Pj ) which contains no gaps

• the gap size of s g(s, )g is the gap size of its right end, g(j,g)

• Pi is the left end of s, Pj is the right end of s

• a segment is zero based if its left end is 0 (Li = 0)

17

Example:

P0 P1 P2 P3 P4 P5 P6

1.3 2.3 3.1 5.2 0.2 1.1 0.4 label.tag

• n=7

• labels {0, 1, …, 5}, arithmetic mod 6

• segment s1 = (p3, p4, p5)

• segment s2 = (p6, p0, p1, p2)

• (p6, p0, p1, p2) is zero based

g(s1, )g = 5 g(s2, )g = 2

18

The Protocol - Revised:


Rule B: if Li = Li-1+1 and Li 0 and Ti-1 Ti then Li-1.Ti-1 Li.Ti Li.Ti-1

Within segment‘stopped’ by label 0 and

by equal tags

Between segments

• There are less distinct labels than processes, so a segment always exists

19

3.03.31.30.21.0

1.0

2.0

3.32.3

1.0 2.0 3.3 2.3 3.0 P0 P1 P2 P3 P4

P1

P0

P3P2

0.2 2.0 3.3 2.3 3.0

P4



0.2

P0

P1

0.2 1.2 3.3 2.3 3.0

1.2P1P4

0.2 1.2 3.3 2.3 3.3

P4

P3

0.2 1.2 3.3 0.3 3.3

0.3P3

P4 0.2 1.2 3.3 0.3 1.3 P4

P2

0.2 1.2 2.2 0.3 1.3

2.2P2P3

0.2 1.2 2.2 3.2 1.3

3.2P3

P4

0.2 1.2 2.2 3.2 0.2

P4

P0

1.0 1.2 2.2 3.2 0.2

1.0

P1

1.0 2.0 2.2 3.2 0.2

P1 2.0

P2

1.0 2.0 3.0 3.2 0.2

P2

3.0P3

1.0 2.0 3.0 0.0 0.2

0.0P3

P4

1.0 2.0 3.0 0.0 1.0

P4

P0P0

20

(2) Closure

Recall:

For every there is a ‘ such that -> ’ (1) No Deadlock

For every , every ’ such that -> ’ is in





(5) Fairness

Only

A system S = (G, R, , ) is self-stabilizing iff there is a set , called the legitimate configurations of S, satisfying:

21

For every , exactly one processor is enabled

(4) Mutual Exclusion



l is a cyclic permutation of the form

l = 0.0 1.0 … a-1.0 a.0 a.0 a+1.0 … n-2.0

Ti-1 = Ti for all i, hence rule B cannot be applied

Rule A can be applied to exactly one processor

22




is a cyclic permutations of the form l = 0.0 1.0 … a-1.0 a.0 a.0 a+1.0 … n-2.0

Ti-1 = Ti for all i , hence rule B cannot be applied

Rule A can be applied to exactly one processor

-> l l’ by rule A l’ = 0.0 1.0 … a-1.0 a.0 a+1.0 a+1.0 … n-2.0

l’ L

as b

efor

e

23



(5) Fairness



if Pi is enabled in l , then Pi+1 will be enabled in l’

and so on …

• is a cyclic permutations of the form l = 0.0 1.0 … a-1.0 a.0 a.0 a+1.0 … n-2.0

• -> l l’ by rule A l’ = 0.0 1.0 … a-1.0 a.0 a+1.0 a+1.0 … n-2.0as

bef

ore

arithmetic (of processors) is mod n

24

So, we have to prove:







(5) Fairness


• Rule A doesn’t apply, so all the segments are zero-based

• Case 1: one zero-based segment of length n

if Ti-1 = 0 rule A applies

else Ti-1 0, so Ti-1 Li - Li-1 and again rule A applies

… Li-1.Ti-1

0.Ti . …

… 0.Ti-1 0.Ti ...



25

• Assume towards contradiction no rule applies


26

• Case 2: there is more than one segment

0.t1 1.t1 … m1.t1

0.t2 1.t2 … m2.t2

0.tk 1.tk … mk.tk

...

all the gaps and all the segments have the same size

Since n is prime, all the segment lengths must be 1

0.0 ...0.0 0.0 0.0

and rule A applies for each gap!



Rule B doesn’t apply: all tags within each segment are equal

Rule A doesn’t apply for the base of segment j+1, so tj = 0-mj (for all j)

Rule A doesn’t apply: tj tj+1 for each gap

• Rule A doesn’t apply, so all the segments are zero-based

Hence: No Deadlock holds

27

So, it remains to show: :







(5) Fairness


28

Lemma:

Proof:

The number of segments in a computation is non-increasing.

• Rule B does not change the number of segments

• Rule A cannot increase the number of segments

Pi … Pi-1 Pi

… Pi-1 Pi Pi+1 … Pi+1 …

Pi+1 … … Pi-1 Pi+1 …

… Pi-1 Pi



29

Lemma:

Proof:

In every infinite computation, every processor takes a step by Rule A infinitely many times

• suppose each Pi takes a finite number of steps by Rule A

• if some Pi takes an infinite number of steps by rule A, so do all:• Li-1 must change between two Rule A steps of Pi

• so Pi-1 takes infinitely many Rule A steps, and so does Pi-2…

• all labels are fixed and so are all segments

• A left end of a segment cannot take a step by rule B

• Pi which is not a left end can take at most one step more than Pi-1



• only Rule A step by Pi can change Li

• the computation is finite – a contradiction

30

Definition:A computation in which the number of segments is constant is called quiet.



Next, we want to prove that the number of segments is strictly decreasing.

We prove each quiet computation with more than one segment is finite.

The number of segments cannot increase.After a finite number of steps we reach a configuration, from which the computation is quiet.

31

Definition :Let C = g0 g1 … be a quiet computation

• a dynamic gap is a function z from indices of computation into indices of processors, satisfying the following:

(1) processor z(0) is the right end of the segment in g0

(2) if gj-1-> gj is a step of Pi by rule A and z(j-1) = i-1 then z(j) = i, else z(j)=z(j-1)

... Pi-1

z(j-1)

gj-1: Pi Pi+1 ...

... Pi-1 Pi

z(j)

gj: Pi+1 ...



32

Definition (cont):• a dynamic segment is a function sz

from indices of computation into segments, such that sz(j) is a segment in gj whose right end is z(j).

... Pi

sz(j)

z(j)

gj:



33



Claim: in a quiet computation gap sizes remain constant. (they only circulate around the ring.)

1.- 2.- 3.- 8.- 9.- 10.- 11.-

1.- 2.- 3.- 4.- 9.- 10.- 11.-

formally …

informally:

34

Lemma:

Proof:

Let C = g0 g1 … be a quiet computation and z a dynamic gap of C.Then g(z(j-1), gj-1) = g(z(j), gj) for all j.

• Pi = z(j-1)+1 takes a step

... Pi-1

z(j-1)

gj-1: Pi Pi+1 ...

... Pi-1 Pi

z(j)

gj: Pi+1 ...

length > 1

• Pi z(j-1)+1 takes a step - does not affect the gap



• if Pi takes a step and z(j)=i, the segment disappears – a contradiction

Pi

z(j-1)

g =Li-Li-1

L’i+1= Li +1

L’i=Li-1+1

gap size

The gap persists

length = 1

35

So: in a quiet computation gap sizes remain constant. (they only circulate around the ring.)



informally …

Claim: For each dynamic segment in a quiet computation there is a configuration in which the right end has label 0,and there is a configuration in which

the left end has label 0.

For a dynamic gap z, g(z) denotes this common value. Formally g(z)= g(z(j), j) .

36

1.- 2.- 3.- 8.- 9.- 10.- 11.-

1.- 2.- 3.- 4.- 5.- 10.- 11.-

…

1.- 2.- 3.- 4.- 9.- 10.- 11.-

…

1.- 2.- 3.- 4.- 5.- … 0.- 5.-

Each processor takes infinite number of steps by Rule A



37

and from here on:

…

1.- 2.- 3.- 4.- 5.- … 0.- 5.-

2.- 3.- 4.- 5.- … 0.- … …

… 3.- 4.- 5.- … 0.- … …

…

0.- … …



38



Formally …

Claim: For each dynamic segment in a quiet computation there is a configuration in which the right end has label 0,and there is a configuration in which

the left end has label 0.

39

Proof: Consider z at a time j’.

Lemma: Let C = g0 g1 … be an infinite quiet computation and z a dynamic gap of C. Then there is j, such that the state of processor z(j) in gj is 0.g(z).

... a.*gj': ...

z(j’)



… the right end has label 0:

Rule A will be applied to Pi-1 and to Pi.

But it is applied to Pi before it can applied to Pi-1, otherwise the number of segments decreases, which is impossible since the computation is quiet.

Pi-1 Pi

40

... a.* (a+1).g(z)gj”: ...

z(j”)

… 0.g(z)gj: ...

z(j)



When Rule A is applied to Pi we get from

So eventually we get to a configuration

Pi Pi+1

... a.*gj': ...

z(j’)

Pi Pi+1

to

41

… the left end has label 0:

Proof: we eventually get to a configuration

Lemma: Let C = g0 g1 … be an infinite quietcomputation and z a dynamic gap of C. Then there is k0, such that the state of processor z(k) +1 in gk

is 0.u for some u .

...

sz

gj: … 0.g(z’)

Pi z’(j)=Pi+1

sz’



If Pi+1 is the first element of z’(j), then we are done.

Else, consider the first time Pi takes a step by rule A.

42

... – . – gk: 0.g(z’) ...

Pi+1

sz sz’



We eventually get to a configuration

So, from the configuration

...

sz

gj: … 0.g(z’)

Pi z’(j)=Pi+1

sz’

z(k)=Pi

We consider the first time Pi takes a step by rule A.

But therefore Pi+1 cannot take any step by Rule A, so its label must remain 0.

43

Definition:A segment is well formed if all of its tags are equal to its gap size.



Claim: From some point all segments are well formed.

Recall: we want to show that the number of segments is eventually reduced to one.

44

... 0.g(z)

Proof: Consider a specific segment. We get to

Lemma: Let C = g0 g1 … be an infinite quiet computation.

Then there is j0 , such that for all j j0, all segments in gj are well formed.

sz

gj: z(j)=Pi



We know that Rule A will be applied to Pi+1.

Rule A cannot be applied to Pi earlier, since then the number of segments will decrease.

Rule B cannot be applied to Pi earlier, since Li=0.

45

... 0.g(z)sz

gj:

... 0.g(z) 1.g(z)

z(j)=Pi

z(j’1)=Pi+1



So, when Rule A will be applied to Pi+1 we get to

We know that Rule A will be applied to Pi+2.

Rule A cannot be applied to Pi earlier, since its Li=0.

Rule B cannot be applied to Pi and Pi+1 earlier .

We get to: … 0.g(z) 1.g(z) 2.g(z)

z(j”)=Pi+2

j” :

j’ :

46

0.g(z) 1.g(z) … *.g(z)

gj: z(j)



So, eventually we get to

Where all tags in a segment are equal.

Rule B cannot be applied within this segment.

So this segment will remain well-formed from now on.

Apply this argument, from this configuration, to the 2nd, 3rd, …, segment.

So, eventually all segments are well-formed.

47



Lemma: There is a point in every infinite computation after which every configuration has exactly one segment.

Proof: from some point the computation is quiet,and all segments are well-formed.

So, rule B cannot be applied.

48



Claim: for all gaps, g(z)=0.

...

sz

z(j)=Pi

sz’

Pi+1

0.g(z’)

Pi+1 can make a step only after Pi, but such a step would destroy sz contradiction

Proof: if there is only one segment, the gap must be 0.Otherwise, consider a maximal gap, g(z)>0.

Let z’ z. At some point z’ is 0 based

49



So, all gaps have g(z)=0.

There is either 1 segment of length n,

or n segments of length 1.

If we have n segments of length 1, then any Rule A decreases the number of segments – a contradiction.

So, there is a single segment of length n, as desired.

50

… a-1.0 a.0 a.0 a+1.0 ...

with one well-formed segment, g(z) = 0, and all tags = 0.This is a legitimate configuration. This completes the proof.

Eventually the system reaches a configuration :

:



Recall: the set of legitimate configurations, L

is the set of all cyclic permutations of the form

0.0 1.0 … a-1.0 a.0 a.0 a+1.0 … n-2.0

for a=0, 1, …, n-2

51

Conclusion

• uniform (no distinguished processor)

• O( n2 ) states

• deterministic algorithm

• central scheduler

We saw an algorithm for a ring of a prime size:

• unidirectional

52

Questions

• Can we find a simpler algorithm?

• Can we find an algorithm with o( n2 ) states?

• Estimate the convergence time of the algorithm.

• Algorithms for other graphs? For Cayley graphs?

• Give a lower bound for the number of states and the convergence time.

Documents

By J. Burns and J. Pachl Based on a presentation by Irina Shapira and Julia Mosin Uniform Self-Stabilization 1 P0P0 P1P1 P2P2 P3P3 P4P4 P5P5