Fault-Tolerant Metric Vector Routing

Transcription

1 Fault-Toleant Metic Vecto Routing Joge A. Cobb Deatment of Comute Science Univesity of Texas at Dallas Richadson, TX Abstact We esent a distibuted outing otocol fo obtaining the best ath between any ai of nodes in a comute netwok. The metic to detemine the best ath between the two nodes is an n-dimensional vecto. Each element of the vecto is a simle metic, such as ho-count, link cost, link bandwidth, etc.. Given that no ath may ovide the best value fo each of the simle metics in the vecto, the metics ae given distinct ioities. Ties between two aths with equal high ioity metics ae boken in favo of the ath with the best lowe ioity metics. The otocol has the nice oety that the outing tables emain loo-less at all times. In addition, the otocol is vey obust. In aticula, it is self-stabilizing. That is, the otocol toleates any tansient fault. 1. Intoduction The outing oblem consists of finding a ath fom any node in the comute netwok to any othe node in the netwok. Nodes in the netwok have a outing table which, fo each destination node in the netwok, contains the identity of the neighbo coesonding to the next-ho to the destination. If an algoithm exists to obtain a ath to a single destination, the algoithm may be elicated to obtain a ath to any destination. Thus, when esenting a distibuted outing otocol, is common to only conside a single destination. We take this aoach in this ae. Let the destination be called oot. If we conside all netwok edges (, q), whee q is the next ho neighbo of to each the oot, we obtain a sanning tee of the netwok. Thus, the outing oblem may be educed to finding a sanning tee ooted at the destination. This tee is known as the outing tee. The ath fom each node to the oot along the outing tee must satisfy some metic citeia. Fo examle, the ath along the outing tee fom to the oot could be the shotest ath between and the oot. Most outing algoithms deal with eithe one o two metics. Fo examle, a single metic could be the total ho count of the ath. A double metic could be finding the ath whose bottleneck bandwidth is the geatest, and among those with the geatest bottleneck bandwidth, choose the ath with the smallest ho count [e.g. 8, 12]. In this ae, we esent a outing algoithm whee the metic is an n-dimensional vecto V. Each element of a the vecto is a simle metic, such as ho count, bottleneck bandwidth, etc.. The metics ae aanged in ode of ioity; that is, metic V[1] is moe imotant than metic V[2]. In the evious examle, the bottleneck bandwidth would be V[1] and the ho count would be V[2]. The need fo a metic vecto aises fom the comlex olicy and quality of sevice outing otocols of the futue. Fo examle, one may envision a metic with thee comonents. The fist is secuity; the ath should be as secue as ossible to avoid theft of infomation. Second, fom the most secue aths, choose the ath with geatest bandwidth. Thid, fom these aths, choose the one with the smallest ho count. We also addess the issue of loo-less outing. Looless outing otocols fo a single metic has been studied in the ast [3] [9] [11]. In this ae, we esent a loo-less outing otocol fo metic vecto outing. Finally, the otocol we esent is also self-stabilizing. A system is self-stabilizing [6] [10] iff, when stated fom an abitay initial state, it eventually conveges to a desied oeating state. Thus, egadless of the initial value of any vaiable in the system, the system conveges to its desied oeating state. This allows the system to ecove fom memoy ead eos, undetected couted messages, etc.. Hence, a self-stabilizing system is extemely obust. Due to the desiability of self-stabilization, the outing algoithm we develo in this ae is also self-stabilizing. Duing its nomal execution, its outing tables will emain loo-less, and a sanning outing tee is always maintained. Howeve, if a fault occus, causing a node fom being disconnected fom the tee o intoducing a loo, then the otocol will convege and econstuct the outing sanning tee, and emain loo-less theeafte. To ou knowledge, the only othe study of a selfstabilizing loo-less outing otocol is [7] [8]. In this otocol, the metic is the ai of bottleneck bandwidth and ho-count. The otocol equies a global temination detection algoithm, and only the oot may oagate metic udates though the netwok. The otocol we esent may use a metic vecto of any dimension, equies no global temination detection algoithm, and any node may oagate metic udates at any time. To simlify the esentation, we assume each comute can ead the vaiables of its neighboing comutes. We will elax this assumtion to a message assing model in the full ae. Due to sace estictions, the coectness oof is also defeed to the full ae. Thoughout, we use quantifications of the fom:

2 ( x : R(x) : B(x)) Above, is any commutative and associative oeato, such as +, -, max, min, (conjunction), o (disjunction). R(x) is a Boolean function defining the ange of values fo the dummy vaiable x, and B(x) is a function defining the value given as an oeand to. Fo examle, (min x : 1 x 3 : x 2 ) denotes the minimum of 1 2, 2 2, and Metic Vecto Routing The metic of a ath fom a node of the outing tee to the oot of the tee is an intege value exessing the desiability of the ath. Fo examle, if the metic of a ath is its numbe of hos, a ath with smalle numbe of hos has a bette metic (is moe desiable) than a ath with a geate numbe of hos. If the metic of the ath is its bottleneck bandwidth (i.e., the minimum of the bandwidths of the links along the ath), then a ath with geate bottleneck bandwidth is moe desiable than a ath with smalle bottleneck bandwidth. We assume thee exists a elation,, on the values of a metic. Also, let.m denote the metic of the ath fom node to the oot node. If.m q.m, then the metic of 's ath to the oot is moe desiable than the metic of q's ath to the oot. Relation must satisfy the following equiements. (x y y z) (x z) fo all x, y, and z. (x x) fo all x. (x y y x) fo all x and y. (x y y x) fo all x and y, x y. x fo evey x, x. We define elation as follows: x y iff (x y x = y). Relation is total. Fo examle, if the metic is ho count, then is the "less than" elation on integes, and is zeo. On the othe hand, if the metic is bottleneck bandwidth, then is the "geate than" elation on integes, and is the lagest bandwidth of any link in the netwok. Let be the aent of q on the outing tee. Let.m and q.m be the metics of these two nodes. We say that metic m is inceasing if it must be the case that.m q.m. Metic m is non-deceasing if it must be the case that.m q.m. Fo examle, ho count is an inceasing metic, since.m + 1 = q.m. Howeve, bottleneck bandwidth is a non-deceasing metic, since.m = q.m is ossible. A metic vecto V of dimension n is a vecto with n metic values, V[1], V[2],..., V[n]. Each one of the n metics of V may be eithe an inceasing o non-deceasing metic. The sub-vecto V[1],..., V[i] is denoted by V i. The metics of the vecto ae aanged in ode of ioity. Thus, V[i] has highe ioity than V[i+1], 1 i < n. With a slight abuse of notation, we ext to metic vectos V and W of the same dimension. We assume that the tye of V[i] is comatible with the tye of W[i], fo all i, 1 i n. We say that V W iff thee exists an i, 1 i n, such that V[i] W[i], and V (i-1) = W (i-1). Thus, fo the fist i-1 metics, V and W ae identical, but fo metic i, V is a bette choice than W. Theefoe, oveall, V is a bette choice than W. It can be shown that if satisfies the five equiements mentioned ealie fo a single metic, then also satisfies the extension of these equiements to metic vectos. Also, the following obsevation on the elation is staightfowad to ove. Obsevation 1 a) If V j W j, then V k W k, fo 1 j < k n. b) If V j W j, then V k W k, fo 1 k < j n. Let q be the aent of ocess in the outing tee. Associated with the link between and q is a metic vecto (, q).v. The metic vecto of,.v, is defined as follows. i : 1 i n :.V[i] = ( q.v[i] +i (, q).v[i] ) (1) Above, +i is the binay oeato that combines the ith metic of the link and the ith metic of the aent to obtain the ith metic of the child. E.g., if the ith metic is ho count, then (, q).v[i] = 1, and +i is intege addition. If the ith metic is bottleneck bandwidth, then (, q).v[i] is the bandwidth of link (, q), and +i is the minimum oeato. Below, we use the function vud (vecto udate) to obtain the metic vecto of a child given the metic vecto of the aent and the metic vecto of the link, as done in (1) above. Hence, the following assignment is efomed when the metic vecto of needs to be udated..v := vud(q.v, (, q).v) Let P = 0, 1,..., (k-1) be a diected ath of k nodes fom 0 to (k-1), whee (k-1) = oot. Let ( i, (i+1) ).V be the metic vecto of link ( i, (i+1) ). The metic vecto P.V of ath P is defined ecusively as follows. oot.v = P.V = 0.V i.v = vud( (i+1).v, ( i, (i+1) ).V), fo 0 i < k-1 Above, is the n-dimensional vecto of values. The outing oblem may be consideed as finding a minimum metic tee. A ath fom to the oot is a minimum metic ath iff thee is no ath fom to the oot whose metic is bette than that of this ath. A minimum metic tee is a diected sanning tee ooted at the oot node, such that, fo any node in the tee, the ath fom to the oot along the tee is a minimum metic ath. 3. Potocol Notation We next esent the notation that we will use to descibe ou outing otocols. The netwok model consists of a set of ocesses, which ead but do not wite the vaiables of thei neighboing ocesses. Each ocess is defined by a set of local, a set of local inuts, a set of local vaiables, and a set of actions. We denote with.v the local vaiable v of ocess. We omit the efix if the ocess is clea fom the context. The actions of a ocess ae seaated by the symbol [], using the following syntax:

3 action [] action []... [] action Each action is of the fom guad command. A guad is a Boolean exession. A command is a sequence of executable statements. Simila notations fo defining netwok otocols ae discussed in [4] and [5]. An action in a ocess is enabled if its guad evaluates to tue in the cuent state of the netwok. An execution ste of a otocol consists of choosing any enabled action fom any ocess, and executing the action' s command. Executions ae maximal and fai. If multile actions in a ocess diffe by a single value, we abbeviate them into a single action with aametes. Fo examle, let j be a aamete whose tye is the ange The action x[j] < 0 y[j] := false is a shothand notation fo the following two actions. x[0] < 0 y[0] := false [] x[1] < 0 y[1] := false 4. The Basic Potocol We next esent a basic otocol to obtain a minimum metic tee. The otocol intoduces temoay loos, but it eventually conveges, and a minimum metic tee is obtained. This otocol seves as a steing stone fo the loo-less otocols that we esent in the next sections. To eesent the edges in the tee, each ocess has a vaiable t indicating its aent in the tee. Also, each ocess has a local constant N indicating its set of neighbo ocesses. Thus, t is always chosen fom the set N. Fo each neighbo q of, contains an inut (, q).v, which is the metic vecto of the link fom to q. Futhemoe, each ocess stoes in vaiable V its best estimate of the metic vecto of the ath to the oot. To build the sanning tee, we use an algoithm simila to the Bellman-Fod algoithm, but tailoed towads metic vectos athe than a single metic. It consists of two stes. Fist, each ocess eiodically comaes its metic vecto V with that of its aent, t.v, and udates V if necessay. This is necessay because, at any time, the metic of the ath to the oot via the aent may change. The second ste consists of choosing a new aent, if ossible. Fo each neighbo q of, eads the cuent values of q.v and (, q).v, and chooses q as its new aent iff the metic of the ath to the oot via q is bette than the metic of the ath to the oot via its cuent aent. That is, chooses q as its new aent iff vud(q.v, (, q).v).v The basic otocol fo a non-oot ocess is given below. Refeences to local vaiables have no efix, while efeences to neighbo' s vaiables have the neighbo' s identifie as a efix. ocess N : { x x is a neighbo of } n : intege aametes q : element of N (* q is any neighbo of *) inuts (, q).v : aay [1.. n] of intege vaiables t : element of N V : aay [1.. n] of intege vud(t.v, (, t).v) V [] vud(q.v, (, q).v) V t := q; The ocess contains two actions. In the fist action, the ocess checks if its estimate, V, of the metic of the ath to the oot is an accodance with the metic of the aent and the metic of the link to the aent. If they do not match, the estimate V is udated. In the second action, a neighbo q is checked to see if it offes a ath to the oot with a bette metic than that of the cuent ath to the oot. If this is tue, q is chosen as the aent, and the metic vecto V is udated accodingly. The oot ocess may be secified as follows. ocess oot n : intege vaiable t : intege V : aay [1.. n] of intege V t oot t := oot; V := Thee is only a single action. Since the oot has no aent, we set t to the oot itself. Also, its metic vecto should be set to a vecto of bottom values, since no ocess can have a metic bette than the oot s metic. It can be shown that if the fist metic of the metic vecto is an inceasing metic, then the otocol is coect and conveges to a minimum metic tee. Howeve, if the fist metic is a non-deceasing metic, then the aent vaiables may initially fom a loo, and the minimum metic tee is neve obtained The Poagated Metic Potocol Is easy to show that, as the metics of edges change, the otocol above suffes fom temoay outing loos. That is, a ocess will choose one of its descants as its 1 Fo a non-deceasing initial metic, if at least one metic in the vecto metic is inceasing, and if an ue bound on this metic is known fo any ath, a coection is ossible. It consists of choosing a diffeent aent if the inceasing metic eaches the ue bound. Howeve, we will see in a late section that this tick is inaoiate in the late loo-avoiding otocol. Since the tick is not suitable fo this late case, we chose not to include it in ou basic otocol.

4 aent, foming a loo. This occus because the oagation of outing udates fom to its descants is not instantaneous, and believes that its descant offes a bette ath to the oot than s cuent ath. To avoid outing loos, we use a technique simila to the one oiginally oosed in [9]. Vaiations of this technique have been used to event loos in leade election otocols [0] and minimum cost outing otocols [3] [11]. Conside the case of a single metic (n = 1). Each ocess has a Boolean bit, called clean, which if tue imlies that all descants of in the tee have a metic wose than s metic. We efe to this equiement as the clean bit invaiant. If ' s clean bit is tue, then may chose any neighbo as its aent, ovided ' s metic imoves. This is because all descants of have metics wose than s, and hence, they will not be chosen as s aent, avoiding the fomation of loos. What emains to be decided is when to set the clean bit to tue o false. When udates its metic fom its aent s metic, and its new metic is wose, clean is set to false. When notices that all its childen have metics wose than its own, and all its childen have clean equal to tue, then may set its clean bit to tue. It is easy to show by induction that these actions eseve the clean bit invaiant. We next exand the above loo-avoidance technique to metic vectos. One way to do so is simly the following: ' s clean bit becomes false when.v becomes wose, and ' s clean bit becomes tue when all of its childen ae clean, and thei metic vecto is no bette than.v. Howeve, this is too estictive, and should be elaxed. Fo examle, assume V has two metics, and is clean. If udates.v becoming wose in the second metic, and the fist metic emains equal, then sets.clean to false, and cannot change aents until it becomes clean again. Howeve, a neighbo may offe a ath whose fist metic is bette than ' s fist metic. In this case, should be able to change aents, but it cannot since.clean is false. Thus, we choose instead to elax when ocess can change aents as follows. Let.clean be an intege vaiable in the ange 0.. n. If.clean = 0, then ocess can make no assumtions about the metics of its descants. If.clean > 0, then fo each descant of,.v.clean.v.clean (2) We efe to (2) as the clean vecto invaiant. Futhemoe, can choose neighbo q as its aent if vud(q.v, (, q).v).clean.v.clean No loos ae ceated because, if the above holds, then q.v.clean and fom (2), we have.v.clean.v.clean.v.clean and thus q. What emains is choosing how to change the value of.clean such that the clean vecto invaiant is eseved. Let.V be the new value of.v afte.v is udated fom the aent of. Assume fist that.clean = 0 o.v.clean =.V.clean. In eithe case,.clean should emain unchanged, since nothing new may be deduced about the metics of ' s descants. Assume next that.clean > 0 and.v.clean.v.clean. In this case, since (2) holds, then fom Obsevation 1(a),.V.V fo any descant of, and thus.clean can be set to n. Finally, assume.clean > 0 and.v.clean.v.clean. In this case,.clean needs to be set to the maximum i, 1 i <.clean, such that.v i =.V i. Fom Obsevation 1(b), this is the lagest value of.clean that eseves the clean vecto invaiant. If no such i exists,.clean is set to zeo. We ae now eady to esent the secification of any non-oot ocess in ou loo-less outing otocol. The oot ocess emains the same as befoe. ocess N : { x x is a neighbo of } n : intege aametes q : element of N (* q is any neighbo of *) j : 1.. n inuts (, q).v : aay [1.. n] of intege vaiables t : element of N V : aay [1.. n] of intege clean : 0.. n vud(t.v, (, t).v) V if V clean [] [] vud(t.v, (, t).v) clean clean > 0 clean := maxclean [] vud(t.v, (, t).v) clean V clean clean > 0 clean := n [] vud(t.v, (, t).v) clean = V clean clean = 0 ski fi; clean > 0 vud(q.v, (, q).v) clean t := q; V := vud(q.v, (, q).v); clean := n V clean ) clean < j ( : N.t = : j.clean V j.v j ) clean := j Above, maxclean is the maximum i such that

5 x s Tee edge of bandwidth x x 5 q 5 Netwok edge of 10 bandwidth x Figue 2: Routing loo 1 i < clean V i = vud(t.v, (,t).v) i o zeo if no such i exists. The ocess has thee actions. The fist action is simila to the fist action in the evious section. Howeve, the value of.clean is udated as exlained ealie. In the second action, a new aent is chosen, but only if it will imove the metic vecto of, and if the clean vaiable is lage enough to ensue the clean vecto invaiant is eseved. In the last action, the ocess inceases its clean value ovided all its childen have at least the same clean value, and a metic no bette than ' s metic. 6. The Poagated Timestam Potocol The oagated metic otocol above is vey sensitive to the initial state of the system. Fo examle, conside Figue 2, whee thee is a single non-deceasing metic, namely, the bottleneck bandwidth of the ath to the oot. The aows indicate the aent elationshis, e.g., has chosen q as its aent. The numbes indicate the bandwidth of each edge. If V = 10 fo each ocess in the loo, the loo will not be boken, because all edges not included in the loo have a lowe bandwidth than the loo edges. Ou goal is to esent a otocol that will each a nomal oeating state (loo-less outing tables) even though it stated fom an abitay initial state. To do so, initial loos like the one in Figue 2 must be boken. One is temted to attemt to beak such loos by ensuing that the metic vecto contains at least one inceasing metic, such as a ho count. When the ho count eaches a value that exceeds the netwok diamete, then the ocess abandons its cuent aent and chooses anothe neighbo as its aent. Howeve, this simle technique does not always wok, deing on the metic vecto. Fo examle, if the fist metic is bottleneck bandwidth, and the second metic is ho count, we can obtain a scenaio whee the ho count estimate at some nodes gows beyond bound duing nomal execution of the otocol. Theefoe, the otocol cannot distinguish between an unbounded ho count due to a loo, and an unbounded ho count due to nomal execution. Hence, a moe oweful technique is needed. We beak loos using a novel timestam oagating technique. Using timestams to avoid the fomation of loos in netwok otocols has been done in the ast [1] [2]. Howeve, ou method of oagating timestams is novel because it beaks existing loos, and in addition, it does not intefee with the nomal behavio of the otocol q aent oot Netwok edge not on tee q oot a).ts = 8, q.ts = 10 b).ts = 10, q.ts = 10 c) Figue 3: Beaking loos with oagated timestams when loos ae not esent. This timestam oagation will allow ou outing otocol to be self-stabilizing. The stategy is as follows. The oot ocess has a timestam vaiable, oot.ts. Peiodically, the oot inceases its timestam. When a child of the oot notices that the timestam of the oot, oot.ts, is geate than its own timestam,.ts, assigns oot.ts to.ts. Similaly, a child q of will assign.ts to q.ts ovided q.ts >.ts, etc.. Thus, the oot timestam oagates down the tee. We would like to bound the diffeence between the timestam of the oot and that of its descants to at most one. To do so, each ocess maintains a Boolean vaiable,.tclean, with the following meaning..tclean ( q : q descant of : q.ts.ts ) (3) We say that is timestam clean iff.tclean equals tue, othewise is timestam dity. If is timestam clean, it imlies that all its descants have a timestam at least the timestam of. To guaantee Relation (3), makes itself timestam dity when it inceases its timestam by coying its aent' s timestam into its own. Pocess makes itself timestam clean when each child of q is timestam clean and has a timestam at least that of. If the oot ocess does not incease its timestam until it is timestam clean, then its timestam is always at most one geate than that of its descants. I.e., timestams oagate in "waves". When all ocesses have a timestam equal to k, and the oot is timestam clean, the oot inceases its timestam to k+1 and becomes timestam dity. Then, timestam k+1 oagates down the tee until it eaches the leaves. The leaves then become timestam clean (since they have no childen), which in tun allows thei aents to become timestam clean, and so on, until the oot becomes timestam clean once again. To detect loos, conside the following. Assume ocess notices that it has a neighbo q, whee q.ts.ts + 2. This imlies that is disconnected fom the oot, and is most likely involved in a loo. That is, neve eceived timestam.ts + 1 fom its aent, and hence its aent does not lead to the oot. If this is the case fo ocess, then must choose a diffeent aent. The stes to do so ae illustated in Figue 3. Initially (Figue 3(a)), q.ts.ts + 2. Thus, detects a loo, and beaks it by setting.t =, (Figue 3(b)), and also sets.ts = q.ts, because the timestam of the oot should be at least q.ts. Since no longe has a aent, each child of, e.g., also sets.t =. Thus, eventually is q oot

6 childless. Then, may choose any aent whose timestam is at least.ts (Figue 3(c)), ejoining the tee. We next esent the non-oot ocess. Hee,.clean, which indicates the clean level of metic vecto.v, is enamed.vclean, to distinguish it fom.tclean. ocess N : { x x is a neighbo of } n : intege aametes q : element of N (* q is any neighbo of *) j : 1.. n inuts (, q).v : aay [1.. n] of intege vaiables t : element of N V : aay [1.. n] of intege vclean : 0.. n-1 (* clean level of V *) ts : intege (* timestam *) tclean : boolean (* timestam clean bit *) vud(t.v, (, t).v) V if V vclean vud(t.v, (, t).v) vclean vclean > 0 vclean := maxclean [] vud(t.v, (, t).v) vclean V vclean vclean 0 vclean := n [] vud(t.v, (, t).v) vclean = V vclean vclean > 0 ski fi; [] tclean ts = q.ts (q.t q q = oot) vclean > 0 vud(q.v, (, q).v) vclean V vclean ) t := q; clean := n; [] ( : N.t = : j.vclean V j.v j ) vclean < j vclean := j [] t.ts > ts tclean, ts := false, t.ts [] ( : N.t = :.tclean.ts ts) tclean := tue [] (q.ts ts + 2 (t.t = t t oot)) t t, ts, tclean :=, max(ts, q.ts), false [] ( : N :.t ) t = (q.t q q = oot) q.ts ts t, vclean, tclean, ts := q, n, tue, q.ts; Pocess contains seven actions. As befoe, the fist action udates V and.vclean fom t.v and (, t).v. The second action changes aents. We have stengthened the guad to ensue that is timestam clean, that the new aent has a timestam equal to ' s, and that the new aent is not disconnected fom the tee. The thid action is the same as in the oagated metic otocol. The fouth action udates the timestam to that of the aent, and makes timestam dity. The fifth action makes timestam clean. The sixth action detects that a neighbo q has q.ts.ts + 2, o that the aent of has no aent. In this case, could be in a loo, so it sets t to. The timestam of is inceased to at least the timestam of the neighbo. In the last action, ejoins the tee. If has no aent no childen, and it finds a neighbo who has a aent and whose timestam is at least ' s times tam, then chooses that neighbo as its new aent, it udates its timestam and metic accodingly, and becomes timestam clean and vecto clean (i.e., vclean = n). The secification oot ocess is simila to befoe, excet fo the following additional action: ( q : q N q.t=oot : q.tclean q.ts ts) ts := ts+1 This otocol can be shown to be self-stabilizing, to emain loo-less unde a fault-fee execution, and to achieve the minimum metic tee. Refeences [0] A. Aoa and A. Singhai, "Fault-Toleant Reconfiguation of Tees and Rings in Netwoks", IEEE Intenational Confeence on Netwok Potocols, 1994, age 221. [1] A. Aoa, M. G. Gouda, and T. Heman, "Comosite Routing Potocols", Poc. of the Second IEEE Symosium on Paallel and Distibuted Pocessing, [2] J. Cobb, M. Gouda, "The Request-Rely Family of Gou Routing Potocols", to aea in ACM ToC, [3] J. J. Gacia-Luna-Aceves, "Loo-Fee Routing Using Difussing Comutations", IEEE/ACM Tansactions on Netwoking, Vol 1, No. 1., Feb. 1993, age 130. [4] M. Gouda, "Potocol Veification Made Simle", Comute Netwoks and ISDN Systems, Vol. 25, [5] M. Gouda, The Elements of Netwok Potocols, Wiley, [6] M. Gouda, "The Tiumh and Tibulation of System Stabilization", Int l Woksho on Dist. Algoithms, [7] M.Gouda and M. Schneide, "Stabilization of Maximum Flow Tees", Poceedings of the thid Annual Joint Confeence on Infomation Sciences, [8] M. Gouda and M. Schneide, "Maximum Flow Routing", Second Woksho on Self-Stabilizing Systems, [9] P. M. Melin and A. Segall, "A Failsafe Distibuted Routing Potocol", IEEE Tansactions on Communications, Vol. COM-27, No. 9, [10] M. Schneide, "Self-Stabilization", ACM Comuting Suveys, Vol. 25, No. 1, Mach [11] A. Segall, "Distibuted Netwok Potocols", IEEE Tans. on Inf. Theoy, Vol. IT-29, No. 1, , Jan [12] W. Zhao, S. Tiathi, "Routing Guaanteed Quality of Sevice Connections in Integated Sevice Packet Netwoks", Poceedings of the 1997 IEEE Int' l Conf. on Netwok Potocols.