Modeling and Analysis of Fischer s Algorithm

Transcription

1 Processes and Data, Department of Computer Science, Swansea University Vino - July 2011

2 Today s Talk 1. Mutual Exclusion Algorithms (recap) 2. Fischer s Algorithm 3. Modeling Fischer s Algorithm 4. Analysis of Fischer s Algorithm

3 Mutual Exclusion Algorithms

4 Mutual Exclusion As previously observed, the idea of mutual exclusion is that two processes which have critical sections cannot enter those sections at the same time. Critical Section Critical Section

5 Mutual Exclusion Algorithms The abstract behaviour of mutual exclusion algorithms described as:

6 Mutual Exclusion Algorithms The abstract behaviour of mutual exclusion algorithms described as: while true do begin remainder region trying region critical section exit region end

7 Mutual Exclusion Algorithms The abstract behaviour of mutual exclusion algorithms described as: while true do begin remainder region trying region critical section exit region end Algorithms like this satisfy two properties: Mutual Exclusion Deadlock Freedom

8 Asynchronous Mutual Exclusion Known asynchronous mutual exclusion algorithms for n processes require O(n) read and write registers and O(n) operations in order to access the critical section. (Lynch and Shavit 1992)

9 Asynchronous Mutual Exclusion Known asynchronous mutual exclusion algorithms for n processes require O(n) read and write registers and O(n) operations in order to access the critical section. (Lynch and Shavit 1992) Question: Is it possible to achieve mutual exclusion in asynchronous systems consisting of n processes by using a smaller number of shared registers and/or fewer than O(n) operations to access the critical section?

10 Asynchronous Mutual Exclusion (cont.) Short answer:

11 Asynchronous Mutual Exclusion (cont.) Short answer: No.

12 Asynchronous Mutual Exclusion (cont.) Short answer: No. Long answer: Theorem There is no asynchronous algorithm providing mutual exclusion with deadlock freedom for n 2 processes that uses fewer than n shared read and write registers. (Burns and Lynch)

13 Fischer s Algorithm

14 Beating the theorem Can the lower bound in the Theorem for deadlock-free mutual exclusion be overcome by considering computational models other than the one underlying the above-mentioned result of Burns and Lynch?

15 Michael Fischer The first researcher to accomplish this was Michael Fischer, who overcame the lower bound by assuming timing constraints. His algorithm uses one shared mulitwriter register id with initial value 0. Each process P i, i {1,..., n} executes the following algorithm, where delay is a positive integer constant.

16 Fischer s Algorithm while true do begin noncritical section; L: if id 0 then goto L; 1: id := i; 2: pause(delay); 3: if id i then goto L; critical section; id := 0; end pause(delay) makes the process wait for the amount of time specified by the constant delay.

17 Choosing the value of delay Fischer s algorithm is real-time. Therefore it is important to optimise the value of delay. So what should it s value be?

18 Choosing the value of delay Fischer s algorithm is real-time. Therefore it is important to optimise the value of delay. So what should it s value be? We could assume a positive integer upper bound c for the time between successive steps of the execution of a process while it attempts to access its critical section.

19 Choosing the value of delay Fischer s algorithm is real-time. Therefore it is important to optimise the value of delay. So what should it s value be? We could assume a positive integer upper bound c for the time between successive steps of the execution of a process while it attempts to access its critical section. In Fischer s algorithm, we choose a value larger than c, the longest time that a process may take to perform a step while trying to enter its critical section. But why?

20 Choosing the value of delay (cont.) By the time that process i has reached line 3 in the pseudocode algorithm (3: if id i then goto L;), each process j that has passed the test in line L (L: if id 0 then goto L;) and might write j in the variable id has already done so, since delay c and c is the longest time that such a step may take. Therefore, whenever process i finds that id = i in line 3 then it can safely enter its critical section because all the other processes are either before line L or after line 1 with their index overwritten by process i, so they will fail the test at line 3.

21 A Brief Reflection Fischer s algorithm is deadlock free and mutually exclusive for as long as its timing assumptions are met. The timing behaviour of the algorithm is nearly optimal (Lynch and Shavit 1992, Theorem 4.6.)

22 A Brief Reflection Fischer s algorithm is deadlock free and mutually exclusive for as long as its timing assumptions are met. The timing behaviour of the algorithm is nearly optimal (Lynch and Shavit 1992, Theorem 4.6.) However...

23 A Brief Reflection Fischer s algorithm is deadlock free and mutually exclusive for as long as its timing assumptions are met. The timing behaviour of the algorithm is nearly optimal (Lynch and Shavit 1992, Theorem 4.6.) However... If the timing constraints are not met, then the algorithm can no longer guarantee mutual exclusion!

24 Modeling Fischer s Algorithm

25 Modeling Fischer s Algorithm Fischer s algorithm for n processes can be modeled as a network of timed automata. Each of the n timed automata in the network is akin to one process running the algorithm.

26 Fischer s Automaton /tiny /tiny L id = 0,x := 0 /tiny 1, x c id := 0 not(id = 0),x > c id := i,x := 0 /tiny CS id = i,x > c /tiny 2

27 Fischer s Network We model the algorithm for n processes as the network of timed automata A 1 A 2... A n States of this network consist of an n-tuple of locations (l 1,..., l n ), where l n is a location in the automaton A i, i {1,..., n} and a valuation for the set of clocks {x 1,..., x n }; x i standing for the local clock of automaton A i.

28 Fischer s Network We model the algorithm for n processes as the network of timed automata A 1 A 2... A n States of this network consist of an n-tuple of locations (l 1,..., l n ), where l n is a location in the automaton A i, i {1,..., n} and a valuation for the set of clocks {x 1,..., x n }; x i standing for the local clock of automaton A i. But...

29 Handling the shared variable Due to the value of the shared variable id actively determining which edges are enabled, the states of the network also need to record the current value of this variable.

30 Handling the shared variable Due to the value of the shared variable id actively determining which edges are enabled, the states of the network also need to record the current value of this variable. We write a state of the network A 1 A 2... A n as so: (l 1,..., l n, x 1 = c 1,..., x n = c n, id = i), where c 1,..., c n are non-negative reals and i {1,..., n}.

31 Handling the shared variable Due to the value of the shared variable id actively determining which edges are enabled, the states of the network also need to record the current value of this variable. We write a state of the network A 1 A 2... A n as so: (l 1,..., l n, x 1 = c 1,..., x n = c n, id = i), where c 1,..., c n are non-negative reals and i {1,..., n}. The initial state of the network is (L,..., L, x 1 = 0,..., x n = 0, id = 0),

32 Analysis of Fischer s Algorithm

33 Analysis of Fischer s Algorithm Now we have a model of the algorithm as a network of timed automata, we must analyse the behaviour of the model in order to verify that it affords the mutual exclusion property. We state the following invariant property: No matter how the network evolves, at no point of its computation will two different component automata each be in its location CS at the same time.

34 Using Hennessy-Milner logic with time We can express invariance properties in Hennessy-Milner logic with time. We wish to express the following requirement: Two different component automata cannot each be in its location CS at the same time.

35 Using Hennessy-Milner logic with time (cont.) We have the option of modifying the model by adding self-loop edges to location CS, labeling them with some observable synchronisation action in i! which is used to signal that A i is in its critical section.

36 Using Hennessy-Milner logic with time (cont.) We have the option of modifying the model by adding self-loop edges to location CS, labeling them with some observable synchronisation action in i! which is used to signal that A i is in its critical section. This allows us to express mutual exclusion using the property Inv ([in i!]ff [in j!]ff ) 1 i<j n

37 UPPAAL Verification We could potentially look to verify the correctness of the algorithm using the verification tool UPPAAL, however the language supported by it does not allow us to write formulae such as we had on the previous slide.

38 UPPAAL Verification We could potentially look to verify the correctness of the algorithm using the verification tool UPPAAL, however the language supported by it does not allow us to write formulae such as we had on the previous slide. We can rewrite this formula as MutexNow 1 i<j n ( A i.cs A j.cs) Which will allow us to express mutual exclusion using the property Inv(MutexNow)

39 Summary - Part One To summarise, we briefly recapped on mutual exclusion. We then introduced Fischer s algorithm and modeled it using timed automata. We then went some way to verifying its correctness by giving the ideas needed to formally verify the algorithm using UPPAAL.

40 Summary - Part Two Introduction to CCS Behavioural equivalences Fixed points and bisimulation equivalence Hennessy-Milner logic Hennessy-Milner logic with recursive definitions Mutual exclusion CCS with time delays Timed automata Timed behavioural equivalences Hennessy-Milner logic with time Modeling and analysis of Fischer s Algorithm

41 Thank you!