\documentclass[11pt,twoside]{article}
\usepackage{macros-course-lectures}

%\renewcommand{\bar}[1]{\overline{#1}}

\begin{document}


\lecture{notes16}{Self Stabilization (Part II)}{October 31, 2002}
\section*{Papers}
\begin{itemize}
\item Baruch Awerbuch, Boaz Patt-Shamir, and George Varghese.
Self-stabilization by local checking and correction. Based on FOCS 91
paper and Ph.D. thesis.
\item Baruch Awerbuch, Boaz Patt-Shamir, George Varghese, and Shlomi Dolev.
Self-stabilization by local checking and network reset. Proceedings of
the 8th International Workshop on Distributed Algorithms, WDAG'94, 1994.
\end{itemize}




\section{Common Background}

\subsection{Definition of Self Stabilization:} Despite a history of
arbitrary corruption of data, once such faults stop, the system should
stabilize to correct behavior without manual intervention.
\begin{itemize}
\item Copes with set of failures including link and node failures.
\item No initialization required for self-stabilizing programs.
\end{itemize} 

\subsection{Criticism:}
\begin{itemize}
\item Handles corruption of network state but not program code
$\rightarrow$ Program code can have redundancy to take care of itself!  
\item Initial mistakes allowed $\rightarrow$ Leads to only temporary loss of
service, so it is fine.
\item Contrasted to Byzantine fault model $\rightarrow$ Orthogonal
issues.
\end{itemize}

\subsection{Previous Work:}
	Covered by Prof Patt-Shamir: Dijkstra, Token passing, Spanning tree
and Network reset.
	Here we discuss efficient and general methodology for designing
self-stabilizing protocols (Local Checking and Correction). Katz and
Perry looked into centralized checking and correction. 
	Now, the papers described have local decentralized checking. The
first paper describes local checking and local correction. This is not
suitable for all kinds of algorithms, hence the next paper describes Local
Checking and Global Reset. This is a more powerful algorithm.

\subsection{Local Checking and Correction: Preview}
Consider a system where sender send at most $Max$ messages at most at a time
without acknowledgment and each time it gets a CR from the receiver it
gets an extra credit C, for which it
can send one more message M. The invariant in an acknowledgment based
messaging scheme is that the the number of credits with sender (C), the
number of messages in the channel(M), the number of messages queued up
at the receiver(Q) and the number of acknowledgments(CR) add up to
$Max$:
\[ C + M + Q + CR = Max \]
Periodically sender stops sending messages and takes a snapshot of the
receiver for the number of messages queued at the receiver. If 
\[ Q + C = Max \] 
Then the system is in a correct state.

\subsection{Extending to general network}
	The first paper (ASVD) proposes a framework for algorithms which
work locally for checking and correction. With the help of such schemes,
mutual exclusion, network resets and end-to-end communication across an
unreliable network can be achieved.

\subsection{Modeling Tools}
	Automaton components:
\begin{enumerate}
\item Set of Actions (A): input, output, internal
\item Finite set of states
\item A transition relation $R(A)\in \textrm{states}\times\textrm{actions}\times\textrm{states}$
	\[\forall s,a \exists (s,a,s^{~}) \in R(A) \]
\item An equivalence relation part(A) partitioning the set of locally
controlled actions into equivalence classes $c$ such that 
	\[\forall c \in part(A), \exists t_c, t_c\geq 0 \]
\end{enumerate}

\subsection{Terminology}
	Let a	 {\em timed element} (x,t) for an automata be a tuple with time
$t$ and $x$  from an arbitrary domain like state or action. Then an
execution $\alpha$ of automaton A is an alternating sequence of timed
states and actions of A of form:
\begin{enumerate}
\item $s_0 \in start \textrm{ and } (s_i, a_{i+1}, s_{i+1}) \in R \textrm{
forall } i\geq 0 $ 
\item The sequence can either be finite or infinite, but if finite it
must end with a timed state.
\item The sequence $t_0, t_1, t_2$ is a monotonically increasing sequence
of non-negative real numbers which grows without bound in case it is an
infinite series.
\item If any action in any class c is enabled in any state $s_i$ of
$\alpha$ then within time $s_i.time + t_c$ either some action in $c$
occurs or some state $s_j$ occurs in which every action in $c$ is
disabled.
\end{enumerate}
	Let $\alpha$ be an execution. Let $\gamma$ be the subsequence of
$\alpha$ consisting of timed external actions, and let $t_0$ be the
start time of $\alpha$. The {\em behavior} $\beta$ corresponding to
$\alpha$ is the sequence $\beta=t_0, \gamma$. 
	
\subsection{Stabilization: Definition and Properties}
\textbf{Definition based on Execution:}	Automaton A stabilizes to the executions in set C in time t if 
\[ \forall \alpha \in A, \textrm{     } \exists \textrm{some suffix of }\alpha
(\textrm{which starts within time $t$ of} \alpha) \in C \]
Execution stabilization is transitive. \\
\textbf{Definition based on External Behavior:} Consider two behaviors
$\beta=t_0,\gamma$ and $\beta'={t'}_0,\gamma'$. We say that $\beta'$ is
a {\em t-suffix} of behavior $\beta$ if:
\begin{enumerate}
\item $\beta'.start - \beta.start \leq t$
\item $\gamma'$ is a suffix of $\gamma$ containing all actions in
$\beta$ that occur at times strictly greater than $\beta'.start$.
\end{enumerate}
	Then, an IOA A stabilizes to the behavior sequence set P in time
t if for every behavior $\beta$ of A there is a t-suffix of behavior
$\beta$ that is in P.

\subsection{Network Model}
	It is a standard asynchronous message passing model, with one
packet on a link at a time and for every pair of neighbors, one node is
apriori declared the ``leader'' of the pair. The automaton is as shown
in Fig 4 of APV paper. 

\par With this background which is common to both papers, we now discuss
their respective algorithms.

\section{Local Checking and Correction}
	\subsection{Link Subsystem and Local Predicates} A property is
said to be local to a subgraph G' for a graph G, if the truth of the
property can be ascertained by examining only the components specified
by G'. This paper concentrates on {\em link subsystems} that consist of
a pair of neighboring nodes $u$ and $v$ and the channels between them.
For any state $s$, $s|u$ denotes $s$ projected on node $N_u$ and
$s|(u,v)$ denotes $s$ projected on link $(u,v)$.
For a network automaton $N$ with a link between nodes $u$ and $v$, if
the state is $s$, then the state of the $(u,v)$ subsystem is the
4-tuple: $(s|u, s|(u,v), s|(v,u), s|v)$. 
\par $L$ is a link predicate set for $N=Net(G,N)$ if for each
$(u,v)\in G$ there is some $L_{u,v}$ such that:
\begin{enumerate}
\item If $(a,b,c,d) \in L_{u,v}$ then $(d,c,b,a) \in L_{v,u}$.
\item $L = \{ L_{u,v}, (u,v) \in G\}$
\item There is at least one state s of $N$ such that s satisfies
$L_{u,v} \forall L_{u,v}\in L$  (This is also called Conjunction)
\end{enumerate}
\subsection{Local Checkability}
	A network automaton $N$ is locally checkable for predicate L
using link predicate $L$ if:
\begin{enumerate}
\item $L$ is a link predicate set for $N$ and L $\in Conj(L)$.
\item Each $L_{u,v} \in L$ is closed. 
\end{enumerate}
	The second condition is added because in an asynchronous
distributed system, it is apparently impossible to check whether an
arbitrary local predicate holds all the time. 

\subsection{Local Correctability} 
	Let us define a local reset function $f$, with three arguments:
a node $u$, state of node automaton $N_u$, and neighbor $v$ of node $u$.
Let $s$ be a state of $N$. It is represented in short by $f(s|u,v)$. If there is a partial ordering $<$ among nodes,
then for any state $s$ of $N$ and any edge $(u,v)$ of graph:
\begin{itemize}
\item \textbf{Correction:} $(f(s|u,v), nil, nil, f(s|v,u)) \in L_{u,v}$
\item \textbf{Stability:} For any neighbor $w$ of $v$,  if $(s|u,
s|(u,v), s|(v,u), s|v) \in L_{u,v}$ and $\{v,w\} < \{u,v\}$ is false
then \\
$(s|u, s|(u,v), s|(v,u), f(s|v,w)) \in L_{u,v}$.
\end{itemize}
	With such a reset function, a network is locally correctable to
$L$ if:
\begin{itemize}
\item $N$ is locally checkable for L in $L$.
\item $f$ is a local reset function for $N$.
\end{itemize}

\textbf{Theorem 6.1} Consider any network automaton $N$ that is locally
correctable using a link predicate $L$, local reset function $f$, and
partial order $<$. Then there   exists some $N^+$ that is an
unrestricted IOA for constants $c$ and $\tilde{c}$ such that $N^+$
stabilizes to the behaviors of $N(c)|L$ in time $\tilde{c}.height(<)$.
\subsection{Transformation Code} 
	The leader of each $(u,v)$ subsystem will periodically do a {\em
local snapshot} to check if $(u,v)$ subsystem satisfies its predicates;
if the leader detects a violation, it tries to make the local predicate
true by doing a {\em local reset} of the $(u,v)$ subsystem. To make the
snapshot and reset protocols stabilizing, counter flushing technique is
used. (Counter flushing paper has already been covered in Lecture 15 by
Prof Patt-Shamir). Please look at Figure 7 in APV paper. 
\par In this technique all request and response packets are numbered.
Also, the leader keeps a variable $count_u[v]$ that $u$ uses to number
all requests sent to $v$ within a phase. At the end of each phase, the
value is incremented. Similarly, the responder $v$
keeps a variable $count_v[u]$ in which $v$ stores the number of the last
request it has received from $u$. Node $v$ weeds out duplicates by only
accepting requests with number not equal to $count_u[v]$. Counter
flushing guarantees that within 5 phases requests and responses are
correctly matched. 
\par The augmented automata has been shown in Figure 8 of APV Paper. 

\subsection{Intuitive Proof of Local Correction Theorem}
\subsubsection{Intuition behind Local Snapshot}  Please look at Figure
11 of APV paper. To understand why a snapshot works correctly if the
response from $v$ is sent following the receipt of the request at $u$,
first let $a'$ and $b$ be the state of nodes $u$ and $v$ respectively just
before the response is sent and $a$,$b'$ be the states just after the
response is delivered. Then, it is possible to construct an execution which
starts in state $(a', nil, nil, b)$ has an intermediate state
$(a,nil,nil,b)$ and has a final state $(a,nil,nil,b')$.
\par This is because first we apply all changes on node $u$ and change
it from $a'$ to $a$ and then apply all changes to $v$. Thus the state
$(a,nil,nil,b)$ recorded by the snapshot is a possible successor of the
state of the subsystem when the response is sent. Similarly it is also a
possible predecessor of the state when responses are delivered. Since,
$L_{u,v}$ is close, we are guaranteed that the detection mechanism will
not produce false alarms and will always detect a violation.
\subsubsection{Intuition behind Local Resets} Using similar arguments to
that of snapshot case, there is an execution sequence possible which
means that even though the resets have been applied on $u$ and $v$ when
they sent and received response, $L_{u,v}$ still holds at the end of
reset phase.
\subsubsection{Intuition behind Local Correction Theorem} We can now see
why the augmented automaton will ensure that all local predicates hold
in time proportional to the height of the partial order. This is because
the request-response matching starts from the minimal element in the partial order
and once $L_{u,v}$ holds for  the subsystem, it remains true. In each 5
phases, new subsystems are added until the local predicate holds in the
whole network.

\section{Local Checking and Global Reset}
	In this paper a reset protocol is used to provide, upon request,
a consistent signal common to all nodes in the network. The external
interface of the protocol at some node $u$ is as shown in Fig. 2 of APVD
paper. The external interface between a reset service and its users
mimics the link interface with packets replaced by messages (SEND,
RECEIVE, FREE to accept another message). The reset service at node, however, offers two extra actions: an input action
REQUEST to request a reset and an output action SIGNAL to inform that
the reset has been completed at that node.
\subsection{Behavior Specifications for Reset Protocols}
	Response time of the protocol is denoted by R, and
{\em well-formedness} condition is also enforced on the behavior.
Formally, a behavior is {\em well-formed} if between any to SENDs there
is a FREE to request a new send. Some more requirements on the reset protocol
are:
\subsubsection{Timeliness} A behavior is timely if for the whole network
the following holds:
\begin{enumerate}
\item At any point during the behavior, either $FREE_{u,v}$ occurs
within constant time, or else SIGNAL occurs at one of the nodes in O(R)
time.
\item Every send is followed by a receive in O(R) time, or else SIGNAL
occurs at one of the two corresponding nodes.
\end{enumerate}
\subsubsection{Causality} A behavior is causal if the following holds:
\begin{enumerate}
\item For every signal event, there is a request event that occurs
within the preceding O(R) time. 
\item For every request event, there is a signal event that occurs
within the following O(R) time. 
\item For any signal event, there are signal events that occur at all
nodes in the network within the preceding and following O(R) time units.
\end{enumerate}

\subsubsection{Mating Relation}
	Now, we define {\em signal intervals} at any node $u$. These are the
subsequences of the total behavior demarcated by $SIGNAL_u$ events. If
the number of $SIGNAL_u$ events is finite, then $u$'s {\em final
interval} is the infinite interval that begins with the last $SIGNAL_u$
event.
	Given a behavior, let  $I_u$ denote the set of signal intervals
at $u\in V$, and let $\hat{I}$ denote the set of all signal intervals. A
{\em mating relation} ``$\leftrightarrow$'' is a reflexive, symmetric
relation over $\hat{I}\times\hat{I}$ that satisfies the following
conditions for any node in the link $(u,v)$ in the network:
\begin{enumerate}
\item If a receive occurs in $I_v$ and the corresponding send event
occurs in $I_u$, then $I_u\leftrightarrow I_v$.
\item For all values of $I_u$, there exists at most one $I_v$, such that $I_u\leftrightarrow I_v$. 
\item  If $I_u\leftrightarrow I_v$, the sequence of messages $v$
receives from $u$ is a prefix of the messages $u$ sends to $v$.
\item For all  $I_u\leftrightarrow I_v$, $I_v$ is final iff $I_u$ is
final. If both are final then all the messages sent have been received.
\item  If $I_u\leftrightarrow I_v$ and  $I'_u\leftrightarrow I'_v$ then
$I_v$ precedes $I'_v$ iff $I_u$ precedes $I'_u$. 
\end{enumerate}
 
\subsubsection{Consistency}
	A behavior is {\em weakly consistent} if every RECEIVE action
has a corresponding send event, and there exists a mating relation over
the set of signal intervals of the behavior. A behavior is {\em strongly
consistent} if the behavior is weakly consistent and in addition the
mating relation is transitive.
\subsubsection{Internal Reset}
	A protocol $R$ is a weak(strong) internal reset if any well-formed
behavior of $R$ is a suffix of some timely, causal and weakly (resp.
strongly) consistent behavior.
	\par
	The basic protocol of Katz and Perry  requires a stable set of
paths to a fixed leader and it stabilizes in $O(n^2)$ time while the APV
protocol stabilizes in $O(n)$ time. 

\subsection{Self-stabilization by Local Checking and Global Reset}
\textbf{Theorem 10} Let $N$ be any network automaton that is locally
checkable for some predicate $\Pi$. Then there exists some constant $c$,
and some uninitialized network automaton $N^+$ which stabilizes to the
behaviors of $N(c)|\Pi$ in $O(R)$ time, where $R$ is the response time
of any stabilizing internal reset protocol. \par
\textbf{The transformation} is same as that described in previous paper,
the Counter flushing mechanism. \par
\textbf{Analysis} The local checking is provenly stabilizing in 5 steps.
We assume that we are given a correct internal reset protocol. We need
to prove that in $O(R)$ time, the local checking process will stop
making reset requests. We know eventually Counter Flushing stabilizes.
 The mating property can be used to deduce that the corresponding
snapshots occur within the same signal interval. 
Thus each local predicate is satisfied and stabilized eventually and
global correct state is achieved.

\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
