1. Effect of Fairness in Model Checking of Self-stabilizing programs Jingshu Chen, Fuad Abujarad and Sandeep Kulkarni

3. Problem Statement Related work Our approach Results Summary

4. To verify self-stabilizing programs by symbolic model checking stabilization: – ability of a system to converge in finite number of steps from arbitrary states to desired state. – complex algorithm Symbolic model checking: doesn’t require the designer to have considerable experience in logic reasoning.

5. Two actions: x0= xn -> x0=(x0+1) mod K xi!=xi-1 ->xi=x(i-1) Note that: the domain of x is [0,..,K-1] This program is known to be self- stabilizing if K>N. In subsequent discussion, we let K=N+1. p0p0 p1p1 p2p2 p3p3 pnpn pn-1 pipi x0 xn xi xi-1 pi-1

6. Legal state: For Process 0 either x[0]=x[n] or x[0]=(x[n]+1) mod K For i=1.. N, either x[i-1]=x[i] or x[i-1]=x[i]+1 p0p0 p1p1 p2p2 p3p3 pnpn pn-1 pipi x0 xn xi xi-1 pi-1

7. T’s work has demonstrate feasibility of applying symbolic model checking for verifying self-stabilizing programs. The result shows that verification is feasible only for programs with a small number of process.

8. Observation: - the current approach is done under weak fairness computation; - current model checker focus on weak fairness in representation of fairness. Our approach is to verify self-stabilization under unfair computation.

9. Verification under weak fairness Two actions: x0= xn -> x0=(x0+1) mod K xi!=xi-1->xi=x(i-1)

10. Verification under unfair computation

11. Verification Results for the K-state Program(execution time(s)) K=3K=4K=5K=6K=7K=8K=9K=10K=50 Unfair 00000.020.030.050.083466.3 Weakly-fair (1) 00.030.635.3334.3139.11276.1N/A Weakly-fair(2) 0.10.44.643.5285.21836N/A Approximate state space 10^110^210^310^410^510^710^810^1010^84 In spite of the improved hardware, the ability to verify self-stabilizing programs under weak fairness remains essentially the same. Scalability of verifying self-stabilization can be significantly improved for the case where the program is correct self-stabilizing without fairness.

12. For the case where weak fairness is essential for self-stabilization, – Decomposition – Utilizing the weak version of stabilization-weak stabilization

13. Verification results for Huang’s Mutual Exclusion Program n=3n=5n=7n=11n=23n=29n=31 Unfair(le)000.050.4847.12271.05704.48 Unfair(t)000.020.1514.5770.18103.8 Unfair(total)000.070.6361.69341.23808.28 Weak(le)04.15N/A Weak(t)00.63----- Weak(total)04.79N/A unfair Not Self-stabilization under this model Weak0.17N/A Approximate state space 10^410^1010^1710^3410^9310^12710^138

14. Verification Results for the K-state Program(execution time(s)) K=3K=4K=5K=6K=7K=8K=9K=10K=50 Weak stabilization 00000.020.030.050.083485.27 Weakly-fair (1) 00.030.635.3334.3139.11276.1N/A Weakly-fair(2) 0.10.44.643.5285.21836N/A Approximate state space 10^110^210^310^410^510^710^810^1010^84 Verification of weak stabilization is substantially more scalable. This result also validates the suggestion in Gouda’s work that weak stabilization is easier to verify than self-stabilization.

15. If self-stabilization is possible without fairness then cost of verifying self-stabilization is substantially lower. This is the first paper that has shown feasibility of verifying the typical self-stabilizing programs, e.g., K-state program, with large number of processes. We also identify two approaches for those cases where weak fairness is essential for self- stabilization.