1. Superstabilizing Protocols for Dynamic Distributed Systems Authors: Shlomi Dolev, Ted Herman Presented by: Vikas Motwani CSE 291: Wireless Sensor Networks June 3 rd 2003

2. Outline  Self-Stabilization  Dynamic Systems  Superstabilization  Update Protocol  Superstabilizer  Warm Legitimacy  Conclusion/Relation to Sensor Networks

3. Self-Stabilization  Most General Technique enabling a system to tolerate arbitrary transient faults: self-stabilization  Protocol is Self-Stabilizing if, in response to a transient fault, it converges to a legitimate state in finite time.  Evaluated by Efficiency of Convergence: time of convergence to a legitimate state following a transient fault  Largely ignores behavior of protocols between transient fault and restoration to legitimate state, Main concern: recovery from transient fault and convergence to legitimate state

4. Dynamic Systems  A system where communication links and processors may fail and recover during normal operation  Protocols for dynamic systems designed to contend with such failures and recoveries without global reinitialization  However, these protocols consider only global states that are reachable from a predefined initial state under a constrained sequence of failures; and failures are handled with as few adjustments as possible.  Makes guarantees about the behavior of the system between fault and restoration to legitimate state

5. A Dynamic System representation  Graph representation: processors:nodes and links:edges  Processors may communicate only with neighbors  Processors communicate using registers, and application of model to message passing system intended  Associated with each processor: code, local variables, program counter, shared register, list of neighbors  Local processor variables: variables used for computations and field image variables (refers to fields of registers)

6. Superstabilization  Combine benefits of both self-stabilizing and dynamic protocols  Protocol is super-stabilizing if; It is self-stabilizing, and, When it starts in a legitimate state and a topology change occurs, a passage predicate must hold and continue to hold until the protocol reaches a legitimate state, hence accounting for protocol behavior during transition  Specified with respect to a class to topology changes; more stable than self-stabilization as system maintains stability with respect to passage predicate even when disturbed by topology change  Motivation: topology change is usually detected, if not, self stabilization is a fallback mechanism to deal with the change

7. Terminologies  Computation: 1-step sequence of global system states  Fair computation: computation that is finite or contains infinitely many steps of each non-crashed processor  Suppose P is a predicate with some system property, a legitimacy predicate L is specified with respect to P: to determine whether or not the property of interest holds  L also specifies permissible values of all register fields, program counters and local variables so P remains invariably true in a computation  Interrupt statement: statement concerned with adjusting to topology change  Trajectory: sequence of global states in which each segment is either a fair computation or a sequence of topology change events (removal or addition of a single component)

8. Superstabilization Paradigm  Specifies a class Λ of topology change events  Definition: A protocol P is superstabilizing with respect to Λ if and only if P is self-stabilizing, and for every trajectory ф beginning at a legitimate state and containing a single topology change event of type Λ, the passage predicate holds for every local state б Є ф  Adjustment Measure: maximum number of processors having different states in a state-space, ranging over the minimal collection of variables and fields upon which P depends, taken over all states derived from a legitimate state and a topology change event. small adjustment measure = few adjustments are necessary in response to a topology change

9. Evaluating Superstabilization Protocols  Cycle: a minimal sequence of steps in a computation so that an iteration of the protocol at processor p executes the program for p from the first to the last statement  Time complexity measured in rounds: 1 st round terminates at 1 st state at which p has completed at least one cycle, round i+1 terminates when p has completed at least one cycle after round i  Stabilization time: maximum number of rounds it takes the protocol to reach a legitimate state from an arbitrary state  Superstabilization time: maximum number of rounds it takes for the protocol starting from an arbitrary legitimate state, followed by an arbitrary Λ-change event to again reach a legitimate state

10. General Superstabilization  General method takes a self-stabilizing protocol P and outputs a protocol P s that is both self-stabilizing and super-stabilizing  Done by modifying P and superimposing a new component called the superstabilizer  Superstabilizer uses as a tool, a self- stabilizing update protocol

11. Update Protocol  Suppose that every processor has a field image x p ; the update problem is to broadcast x p to all processors  Topology update: when the field x p contains all local information about p’s links and network characteristics  In addition, let each processor have a field e p which contains three tuples where q is processor identifier, u is same type as x p, k is distance between p and the processor named in 1 st component

12. Update Protocol Implementation  For the update protocol, Distance-stable state: any state for which; Each processor p has exactly one tuple in its e p field for every processor q in the network, reachable by some path from p e p contains no other tuples Each computation that starts in such a state preserves the above two conditions

13. SuperStabilizer  A tool used in transforming a given self-stabilizing protocol P into a superstabilizing protocol P s.  Function F determines a new legitimate state from a previously legitimate state perturbed by a topology change E  Superstabilizer makes use of F by assembling the image of a global state from local snapshots, followed by disseminating F(global state) to all processors so a new legitimate state is reached  Superstabilizer “hides” E from any processor in a way that no user of protocol P can observe a state inconsistent with current topology by making global transition between legitimate states for different topologies effectively atomic

14. Characteristics  Superstabilizer has 2 components: Modified Update Protocol Interrupt statement  P is modified as follows: Each action of P is guarded by a Boolean freeze p so that when freeze p holds, no action of P is enabled at processor p and PC remains static  All freeze fields false in absence of topology changes  Step scheduling arranged so that a cycle of superstabilizer is inserted before each read step of P, so any news of topology changes is processed by superstabilizer before P at each processor  Superstabilizer also specifies an interrupt section for the protocol P s so that topology changes incident on processor p are handled by the superstabilizer at p

15. Superstabilizing Protocol  Combination of superstabilizer and modified protocol P results in superstabilizing protocol P s  Legitimate state for P s is any state in which Variables, fields and program counter with respect to P satisfy LP Update protocol component is in legitimate state(all e fields have accurate tuples) Each freeze variable is false Each computation that starts in such a state preserves the above conditions

16. Warm Legitimacy  Passage protocol defined in terms of freeze fields.  For any state б, warm[б] = set of processors with freeze fields = false  б is warm legitimate if there exists a state γ and topology T. γ where γ is LP, such that б[warm] = γ[warm] (б is warm-legitimate if it is in a legitimate state with respect to some topology) when we disregard any processor with freeze p = true  Passage protocol for the general method: the protocol state is warm- legitimate  Pseudo-variable snap p = collection of all local variables, shared fields and program counter of P for processor p  When topology change occurs, P is frozen at all processors, snap value is recorded, a snap value for the new topology is computed, and each frozen processor is assigned the new snap value and then unfrozen

17. Interrupt statement  In response to a topology change E incident on a processor p, the program counter of protocol P s is reset to the first statement of the superstabilizer, the neighborhood N p is adjusted to reflect E, and the write operation is atomically executed.  This operation halts P by setting freeze p to true

18. Conclusion/Relation to Sensor Networks  Sensor Networks = Dynamic environment with high probability of failures and need to stabilize to an equilibrium state  Ability of a self-stabilizing system to recover from transient failures is based on the assumption that the failures do not continue to occur – safe assumption?  Global state vs. local state?  What kind of predicates would we want to apply/enforce/check for?  Can we predict/decide a class of failures that we could account for?