A Timestamp Based Transformation of. Computing Environments. real distributed computing environment; therefore, programs developed

Transcription

1 A Timestamp Based Transformation of Self-Stabilizing Programs for Distributed Computing Environments Masaaki Mizuno 1? and Hirotsugu Kakugawa 2?? 1 Dept. of Comp. and Info. Sci. Kansas State University, Manhattan, KS Dept. of Elect. Engineering, Hiroshima University, Higashi-Hiroshima, Japan Abstract. There are several models for which self-stabilizing (SS) programs have been developed. The distributed model accurately reects a real distributed computing environment; therefore, programs developed for the model should run directly on a distributed system. However, many SS programs have been developed for the serial model which has the strongest assumptions, because it is much easier to develop and verify a program for the model than one for other models. This paper presents a transformation method that converts a program designed for the serial model to a program for the distributed model. An SS concurrency control protocol is incorporated in a transformed program to guarantee that if the original program is SS, the transformed program is also SS and performs exactly like the original program. We have implemented transformed versions of several serial model SS algorithms and tested them with various initial congurations. 1 Introduction A distributed system consists of a set of processes and communication links that connect the processes. The processes cooperate with each other by communicating through the links. Dijkstra introduced the notion of self-stabilization in the context of distributed systems [4]. A system is dened to be self-stabilizing (SS) with respect to a set of legitimate states if regardless of its initial state, the system is guaranteed to arrive at a legitimate state in a nite number of steps and will never leave legitimate states after that. Thus, an SS system need not be initialized and is able to recover from transient failures by itself. An SS system consists of two components: a program and a run-time support system. A run-time system provides a program with an execution environment and services. Many SS programs have been developed with various assumptions on their execution environments. These assumptions include the semantics of concurrency and communication primitives that the run-time support systems? This work was supported in part by the National Science Foundation under Grant CCR This work was supported in part by the Telecommunication Advancement Foundation.??

2 provide. Huang et al. classied the execution environments into four models based on the assumptions: serial model, synchronous model, synchronous distributed model, and distributed model [6]. Among the four models, the serial and distributed models have the strongest and weakest assumptions on execution environments, respectively. 1. In the serial model, an atomic execution step consists of (1) a read sub-step: which reads the states of its neighbor processes, followed by (2) a write substep which modies its own state (based on the neighbors' current states and its own state). The communication and concurrency semantics are such that each process can always see the current states of its neighbors, and only one process at a time executes an atomic step. 2. In the distributed model, an atomic execution step is either a read sub-step (that reads the states of its neighbors and records them locally) or a write sub-step (that modies its own state based on the locally recorded neighbors' states and its own state). A process does not always see the current states of its neighbors since local copies of the neighbors' states may hold obsolete values. The degree of concurrency is such that an arbitrary subset of the processes simultaneously execute their atomic steps. The distributed model accurately reects a real distributed computing environment. Thus, programs developed for the distributed model should run on a real distributed system, with only minor modications if any. On the other hand, the other three models have stronger assumptions, and programs developed for these models do not run in a real distributed system without major modications. However, many proposed SS systems assume the serial model. This is because it is much easier to develop and verify a program for the serial model than one for other models. Several attempts have been made to develop an automatic transformation that converts a program for one model to a program for another model that has weaker assumptions [5, 6, 7, 10]. Huang et al. proposed a transformation method that converts a program for the serial model (denoted by a \serial model program") to a program for the distributed model (denoted by a \distributed model program") [6]. However, in a transformed program, processes run concurrently without any synchronization among them. As a result, not all transformed programs run in the same way as their original programs. Therefore, in their approach, each transformed program needs to be proven correct. In this paper, we will present a transformation from a serial model program to a distributed model program. A timestamp based concurrency control protocol is incorporated in a transformed program to guarantee that for each execution of a transformed distributed model program, there always exists an equivalent execution of the original serial model program. We have dened a correctness criterion for self-stabilizing concurrency control protocols (called \postx serializability") and designed the concurrency control protocol to be self-stabilizing. Therefore, if the original program is correct with respect to self-stabilization, the transformed program is also self-stabilizing. The transformation works with serial model programs that do not terminate or that have xed-points. In the

3 later case, due to timeout timers, even if a transformed program reaches the xed-point, it does not terminate. We have implemented transformed versions of Dijkstra's K-state and three state mutual exclusion algorithms [4] and the minimum spanning tree algorithms [3], on our distributed/parallel algorithm development system [9]. All the implementations were tested with many dierent initial congurations. The organization of the paper is as follows: Section 2 gives formal denition of programs for the serial model and for the distributed model. The section also denes the correctness criterion for the transformation. Our transformation and its correctness proofs are presented in Sections 3 and 4, respectively. Finally, Section 5 discusses performance of transformed algorithms. 2 Denitions 2.1 A self-stabilizing program for the serial model A serial model program is represented by a ve-tuple S s = (n; P s ; R s ; Q s ; A s ), where 1. n is the number of processes in S s ; 2. P s = f 1 ; 2 ; ; n g is a set of processes; 3. R s P s P s is a set of dependency relations such that ( i ; j ) 2 R s if j refers to the state of i in its execution; If i and j refer to each others' states then ( i ; j ); ( j ; i ) 2 R s. If ( i ; j ) 2 R s, we say that i is a writer of j and that j is a reader of i. We dene Writers( i ) = f j j( j ; i ) 2 R s g and Readers( i ) = f j j( i ; j ) 2 R s g. Processes i and j are said to be neighbors if ( i ; j ) 2 R s or ( j ; i ) 2 R s. 4. Q s = (Qs 1 ; Qs 2 ; ; Qs n ) is an n-tuple of sets of states such that Qs i is a set of possible states that i may be in; Process i maintains variable q i to store its current state. We use q i to denote both variable q i itself and its contents. A global state of an execution of S s is dened by an n-tuple of states fq 1 ; q 2 ; ; q n g. The set of all possible global states is denoted by G s (i.e., G s = Qs 1 Qs 2 Qs n ). 5. A s = (As 1 ; As 2 ; ; As n ) is an n-tuple of algorithms, where As i is the algorithm executed by i. Each As i is described in the following form: [ [] [] g i1 (q i ; q i1 ; q i2 ; ; q ik )! q i := f i1 (q i ; q i1 ; q i2 ; ; q ik )..

4 ] g im (q i ; q i1 ; q i2 ; ; q ik )! q i := f im (q i ; q i1 ; q i2 ; ; q ik ) where { Writers( i ) = f i1 ; i2 ; ; ik g ( ij denotes the j th writer process of i, and q ij denotes the ij 's state). { Each g ij ( )! q i := f ij ( ) is called a guarded command (g ij ( )! denotes the j th guarded command in As i ). { g ij is a predicate: Q i Q i1 Q ik! boolean, and g ij ( ) is called a guard, and { f ij is a function: Q i Q i1 Q ik! Q i, q i := f ij ( ) is called a command, and f ij is called a command function. Each process i stores Writers( i ), Readers( i ), As i, and its unique identier in read only memory. These values are assumed to be incorruptible. In the serial model, each process can obtain the current states of all of its writer processes without delay. Thus, q i1 ; q i2 ; ; q ik in a guarded command in any As i represent the exact current states of i 's writer processes. If a process i has a guard g ij that is true, i is said to have a privilege. At any point in time, there may be more than one process that have privileges. The system executes the following three steps forever: 1. All the processes evaluate all of their guards. 2. The centralized scheduler, called the c-daemon, nondeterministically selects one process, say i, among all processes that have privileges. 3. Process i nondeterministically chooses one guarded command out of all the guarded commands whose associated guards are true and executes its command. A serial model program S s is self-stabilizing with respect to a predicate T dened over the set of global states, if it satises the following properties [10]: 1. Closure: T is closed under the execution of S s ; that is, once T is established in the execution, it cannot be falsied; and 2. Convergence: Starting from an arbitrary global state, S s is guaranteed to reach a global state satisfying T within a nite number of state transitions. States that satisfy T, L s G s, are called legitimate states. For example, Dijkstra's K-state algorithm [4] for n processes is represented in our formalization as follows: { ( i ; ((i mod n)+1) ) 2 R s for 1 i n { Qs i = f1; 2; ; Kg for 1 i n, where K > n { As 1 : [q 1 = q n! q 1 := (q 1 mod K) + 1] As i : [q i 6= q i?1! q i := q i?1 ] for 2 i n { T is true i exactly one process in the system has privileges.

5 2.2 The distributed model We now consider a transformation that transforms an SS serial model program S s to an SS distributed model program S d. The goal of the transformation is that given any S s, the transformation generates S d such that for each execution of S d, say H d, there exists an execution of S s that is equivalent to H d. The notion of equivalent executions is formally dened in Section 2.3. Intuitively, if traces of process states in two executions are indistinguishable to outside observers, they are said to be equivalent. In this way, the transformation guarantees that if S s is self-stabilizing with respect to T, S d is also self-stabilizing with respect to T. The following assumptions are made in transformed distributed model programs: 1. The system does not provide a shared memory or a global clock, communication between processes is done only by message passing, and the execution speeds of the processes may vary but are bounded. 2. For each dependency relation ( j ; i ) 2 R s in the serial model, the system provides a bidirectional communication link between the processes of S d that simulate behaviors of i and j. The communication system provides FIFO delivery with unpredictable but bounded communication delay. 3. Any transient failures may occur in the system; however, a process does not fail. For example, a message may be lost; contents of a message may change; the program counter (control point) of a process may be reset to an unexpected address; or a state of a process may change. Formally, a transformed program is a six-tuple S d = (n; P d ; R d ; Q d ; C d ; A d ), where 1. P d = fp 1 ; P 2 ; ; P n g is a set of n processes; Process P i of S d simulates behavior of process i of S s. 2. R d P d P d is a set of dependency relations such that (P i ; P j ) 2 R d i ( i ; j ) 2 R s ; We use terms \writers" and \readers" and notations Writers(P i ) and Readers(P i ) in the same way as those in S s. 3. Q d = (Qd 1 ; Qd 2 ; ; Qd n ) is an n-tuple of sets of states such that Qd i is a set of possible states that process P i may be in; Qd i is represented by the Cartesian product of all the variables maintained by P i. Since P i simulates behavior of i, one of the variables is q i. Other variables are used internally to control behavior of P i. For outside observers, the only interest is a trace of q i. We dene a simulated global state of execution of S d to be the same as that of S s ; that is, fq 1 ; q 2 ; ; q n g. Furthermore, the set of all possible simulated global states G d and the set of legitimate states L d are the same as G s and L s, respectively. 4. C d = ( ; Cd i;j ; ) is a tuple of sets of link states such that Cd i;j is a set of possible link states that a link from P i to P j may be in; Cd i;j is represented by a sequence of messages in transit from P i to P j. We dene a global state of execution of S d to be a tuple of states, one from each process and link.

6 5. A d = (Ad 1 ; Ad 2 ; ; Ad n ) is an n-tuple of algorithms such that Ad i is executed by P i (1 i n). Each algorithm Ad i is represented by guarded commands (refer to Fig. 1). Process P i evaluates all of its guards and the underlying scheduler nondeterministically selects one guarded command out of all the guarded commands whose associated guards are true and executes its command. The underlying scheduler is assumed to guarantee a weakly fair scheduling in selection of guarded commands. That is, when P i executes statement [g 1! C 1 [] []g m! C m ], if a guard g k becomes true and thereafter remains true, the associated command C k will be executed in nite time. As does the serial model program, each process P i stores Writers(P i ), Readers (P i ), Ad i, and its unique identier in incorruptible read only memory. Each process P i maintains an array variable of n entries, denoted nq i. Entry nq i [j] stores the value of q j. Whenever P j updates q j, each one of P j 's reader processes P i updates, by message passing, its nq i [j] to the new value of q j. Due to message delay, nq i [j] does not always hold the current value of q j. 2.3 Transaction view of execution steps We can view each q i as a data item. Then, an execution of one iteration of algorithm Ad i at process P i, called an \execution step," S can be viewed as a n transaction that updates q i in a database of domain j=1 fq jg; that is, 1. an update of nq i [j] to a new value of q j is considered to be a read operation by P i on q j, denoted r i (q j ), and 2. an assignment by P j, q j := f jk ( ), is considered to be a write operation by P j on q j, denoted w j (q j ). Furthermore, we introduce an imaginary commit and abort operations, denoted c i and a i, respectively. Each execution step ends with a commit operation. When a commit operation c j is performed by P j, its computational eects (i.e, updates of q j and nq i [j] of P i 2 Readers(P j )) become permanent. On the other hand, if an abort operation is executed, its computational eects are nullied. In this way, each process can be viewed as a sequence of transactions. In the rest of the paper, we use the terms \(execution) step" and \transaction" interchangeably. An execution of one iteration of the algorithm As i of i that executes a guarded command g ij (q i, q i1 ;, q ik )! q i := f ij (q i ; q i1 ; ; q ik ) is simulated by P i in one execution step consisting of the following 4 substeps: 1. k read operations r i (q il )(1 l k) and r i (q i ), 2. an internal execution (checking guards and an execution of a command f ij ), 3. a write operation w(q i ), and 4. a commit operation c i. Note that since i can only access nq i [l] and has no direct access to q l, the following guarded command in As i g ij (q i ; q i1 ; q i2 ; ; q ik )! q i := f ij (q i ; q i1 ; q i2 ; ; q ik )

7 is modied in Ad i to g ij (q i ; nq i [1]; nq i [2]; ; nq i [k])! q i := f ij (q i ; nq i [1]; nq i [2]; ; nq i [k]): Let?! Ti t denote a transaction representing the t th step of P i. We use wi t(q i), ri t(q j), c t i, and at i to denote the operations issued by?! Ti t when it is important to emphasize that they are issued by the \t th " transaction. Also, the value of q i written by?! Ti t is denoted by qi t. Formally, a transaction is dened as: Denition1 [1]. An execution step (transaction)?! T t i is a partial order (T t i ; <t i ), where 1. Ti t frt i (q j)jp j 2 Writers(P i )g [ fri t(q i); wi t(q i)g [ fa t i ; ct i g 2. a t i 2 T i t i ct i 62 T i t 3. if s is c t i or a t i, for any other operation p 2 Ti t, p < t i s 4. if ri t t (x) denotes any read operation of Ti and wi t(q i) 2 Ti t, then rt i (x) <t i wi t(q i). Denition2 [1]. Two operations are said to conict if they are on the same data item and at least one of them is a write operation. A transaction view of execution (or history) of an SS program is dened as follows: Denition3 [1]. Let T = f?! T1 1 ;?! T1 2 ; : : : ;??! T m1 1 ;?! T2 1 ; : : : ;??! T m2 2 ; : : : ;?! Tn 1 ; : : : ;??! Tn mn g be a set of transactions. An execution (or history)?! H over T is a partial order (H; < H ) where 1. H = S n i=1 2. < H S n i=1 S mi j=1 T j i S, mi j=1 <j i, 3. for operations p t1 i and q t2 i, pt1 i < H q t2 i if t 1 < t 2, and 4. for any pair of conicting operations p i and q j, either p i < H q j or q j < H p i. Denition4 [1].?! Ti t is committed in?! H if c t i 2 H. The committed projection, C(?! H ) = (C(H); < C(H) ), of an execution?! H is the restriction of?! H to the transactions that are committed in?! H. In the concurrency control theory, the notion of (conict) equivalence is de- ned as follows: Denition5 [1]. Two executions?! H 1 and?! H 2 are equivalent if (1) C(H 1 ) = C(H 2 ), and (2) for any pair of conicting operations p and q in C(?! H 1 ), p < H1 q i p < H2 q.

8 It has been shown that if two executions are equivalent, from the view of an outside observer, the values in each data item (i.e., q i ) are changed in exactly the same order in both executions, and the two executions are indistinguishable [1]. In the serial model, transactions are executed serially one after another. Such an execution is called a serial execution: Denition6 [1]. An execution?! H is a serial execution if for any pair?! T i and?! T j of?! H, either all operations of?! T i appear before any operation of?! T j or vice-versa. In the distributed model, multiple processes may execute their steps concurrently. Thus, without proper control, it is possible for the distributed model to produce executions that do not have equivalent execution in the serial model. For example, assume that P i and P j are neighbors of each other. The following execution sequence is possible in the distributed model: r i (q j ) < H r j (q i ) < H r i (q i ) < H r j (q j ) < H w i (q i ) < H w j (q j ) < H c i < H c j We cannot nd any serial execution which is equivalent to the above execution. Some form of concurrency control is required in S d to make each of its executions equivalent to some execution of S s in the serial model. The notion of serialization is dened as follows: Denition7 [1]. An execution is serializable if there exists a serial execution that is equivalent to it. The goal of the concurrency control protocol in a transformed program S d is to make executions of S d serializable. It is important that the concurrency control protocol itself be self-stabilizing to guarantee that S d is self-stabilizing. Starting with any initial state and given an execution?! H, self-stabilizing concurrency control guarantees that the committed projection of some postx of?! H is serializable. Formally, we dene such serializability to be postx serializability. First, we introduce the following notations: 1. Given some execution?! H, j?! H j denotes the number of operations in?! H. 2. Let?! H 1 and?! H 2 be executions.?! H 1??! H 2 is dened to be a restriction of?! H 1 to the set of operations (H 1? H 2 ). Let PRE(?! H ) denote some prex of execution?! H. Denition8. An execution?! H is postx serializable if there exists PRE(?! H ) such that jpre(?! H )j = K for some non-negative integer K and C(?! H? PRE(?! H )) is serializable. In order to easily determine whether a given execution?! H is postx serializable, we use the following serialization graph. Denition9 [1]. The serialization graph for an execution?! H, denoted SG(?! H ), is a directed graph whose nodes are transactions in C(?! H ) and whose edges (!) are dened as follows:

9 1. wr-edge: if w i (x) < C(H) r j (x), then?! T i!?! T j. 2. ww-edge: if w i (x) < C(H) w j (x), then?! T i!?! T j. 3. rw-edge: if r i (x) < C(H) w j (x), then?! T i!?! T j. Theorem (Serialization Theorem [1]). An execution?! H is serializable i SG(?! H ) is acyclic. ut It is obvious that the following corollary holds: Corollary 10. Given an execution?! H, if SG(?! H?PRE(?! H )) is acyclic for some PRE(?! H ) such that K = jpre(?! H )j for some non-negative integer K, then?! H is postx serializable. ut The SS concurrency control protocol in S d guarantees that any execution?! H produced by Sd is postx serializable. Consider the simulated global state fq 1 ; ; q n g of an execution of S d, right after the execution PRE(?! H ) has nished, to be the initial global states of an execution of S s. Since command functions f ik are dened in the same way in both S s and S d, there exists an execution of S s that is equivalent to C(?! H? PRE(?! H )). Therefore, the execution of S d is guaranteed to stabilize if S s is self-stabilizing. Such S d is said to simulate S s. Denition11. S d simulates S s if for each execution?! H of S d, there exists PRE(?! H ) such that jpre(?! H )j = K for some non-negative integer K and there exists an execution of S s that is equivalent to C(?! H? PRE(?! H )). Theorem 12. S d simulates S s if every execution produced by S d is postx serializable. ut 3 Timestamp-based Transformation 3.1 Overview of timestamp based concurrency control In this section, we describe transformation from an SS serial model program S s to an SS distributed model program S d that simulates S s. The transformation algorithm transforms each algorithm As i, which is executed by process i of S s, into algorithm Ad i, which is executed by process P i of S d. In the concurrency control incorporated in a transformed program, each process P i maintains a Lamport's logical clock req ts i [8]. The req ts i value while P i is executing execution step?! Ti x is called the timestamp associated with?! Ti x. A process with privileges, say P i, executes a command as a transaction?! Ti x by optimistically assuming that the resulting execution will be serializable. For?! Ti x to actually assign a new value to q i by executing the assignment statement q i := f ij ( ), it must successfully execute a commit operation c x i. In SG, if c x i succeeds, a new node corresponding to?! Ti x and the associated new edges are created (recall that SG maintains only committed transactions in its node set).

10 Given an edge E, let????! src(e) and tgt(e)???! denote the source node and target node of E, respectively. Given a node?! T in SG, let ts(?! T ) denote the timestamp associated with the node. The idea of a commit operation is to guarantee the following property: For each edge E in SG, ts(????! src(e)) < ts(???! tgt(e)). If this property is maintained, SG is acyclic and the resulting execution is serializable. 3.2 Description of the algorithm A transformed algorithm Ad i is given in Fig. 1. Process P i executes a set of guarded commands forever. A receive statement and a timeout statement may appear in a guard. A receive statement is a boolean function that is evaluated true i there is a pending message of the specied type in the incoming link. Actual delivery of a message takes place when the guarded command is selected for execution. A timeout statement becomes true when the associated timer (described below) goes o. A process may be in one of two execution modes: PRIV and NO PRIV. A process is in PRIV when it has a privilege and is executing toward the commit; in NO PRIV otherwise. Five types of messages are exchanged among processes: req commit, grant, abort, commit, and state messages. When a process P i has privileges and executes a command, it sends req commit messages to all of its writer processes. When a process P j receives a req commit message from P i, it replies P i with either a grant or abort message. If P i receives grant messages from all of its writer processes, it commits and sends commit messages to all of its reader processes. A state message is used to inform its reader processes of its current state. Every message carries the current timestamp value req ts i. In addition to the timestamp, each grant and abort message returns the timestamp carried by the associated req commit message. This returned timestamp is used to verify whether the abort or grant message is a reply for the outstanding req commit message (B02 and C02 in Fig. 1). Each state and commit message by P i carries its current state q i. In addition to q i, nq i [j], and req ts j, each process P i maintains the following variables: { mode i : stores the current mode of P i, either PRIV or NO PRIV. { max ts i : maintains the maximum timestamp value that P i has seen. { q tmp i : temporarily stores a new q i value that was just computed, until the commit succeeds. { granted i : maintains a set of writer processes (identiers) that have already replied with grant messages. This is used to check whether P i has received grant messages from all of its writer processes.

11 *[ A01 (mode = NO PRIV) ^ (9j : g ij (:::) = true)! A02 q tmpi := fij (:::); modei := PRIV; grantedi := ;; req tsi := max tsi; A03 multicast req commit(req ts i) to all P j 2 Writers(P i) A04 commit timer.start timer(); B01 [] receive grant(ts j, ts' i) from P j! B02 if (mode i = PRIV) ^ (req ts i = ts' i) B03 granted i := granted i [ fjg; B04 if (grantedi = Writers(Pi)) B05 q i := q tmp i; mode i := NO PRIV; B06 multicast commit(req ts i, q i) to all q j 2 Readers(P i); B07 state timer.start timer(); B08 update timestamps (); /* max ts i := req ts i := max ts i + delta */ B09 B10 C01 [] receive abort(ts j, ts' i) from P j! C02 if (ts'i = req tsi) modei := NO PRIV; D01 [] receive commit(ts j, q j) from P j! D02 nqi[j] := qj; modei := NO PRIV; D03 update timestamps (); /* max ts i := req ts i := max ts i + delta */ E01 [] receive state(ts j, q j) from P j! E02 if (q j 6= nq i[j]) E03 nqi[j] := qj; modei := NO PRIV; E04 update timestamps (); /* max ts i := req ts i := max ts i + delta */ E05 F01 [] receive req commit(ts j) from P j! F02 if (mode i = NO PRIV) _ (ts j < req ts i) /* use PIDs to break a tie */ F03 send grant(req ts i, ts j) to P j; F04 else F05 send abort(req ts i, ts j) to P j; F06 G01 [] commit timer goes o! G02 modei := NO PRIV; commit timer.start timer(); H01 [] state timer goes o! H02 multicast state(req tsi, qi) to all Pj 2 Readers(Pi); H03 state timer.start timer(); ] Fig. 1. Transformation Algorithm

12 Whenever a process P i receives a message with timestamp req ts j from process P j, it updates max ts i by max ts i := max(max ts i ; req ts j ) (this procedure is implicit and not shown in Fig. 1). The value in max ts i is used to execute Lamport's logical clock algorithm to update req ts i (B08, D03, E04). Each process P i maintains two timers: 1. state timer i : This timer is used to inform P i 's reader processes of the current state of P i at least once every period, where is a predened value and described in more detail in Section commit timer i : This timer goes o if P i does not receive all the grant messages or at least one abort message in t c period after P i has sent req commit messages, where t c is slightly longer than the expected upper bound of the maximum round trip message latency plus execution time for a process to send a grant or abort message. Each timer has a counter. The value of a counter is decremented by one every unit time (second, millisecond, etc.). When the counter value becomes zero, the timer goes o. The only operation provided with the timers is start timer(), which assigns a predened initial counter value ( or t c associated with the timer) to the timer counter. Even though a timer counter is not properly initialized at the beginning of an execution, the associated timer will eventually go o. The following are some remarks on the algorithm: 1. When P i receives a req commit message from a reader process P j (F01), there are two cases to consider: (a) if P i does not have a privilege or if req ts j < req ts i (P j 's execution step has higher priority), P j 's execution step should be allowed to commit; thus, P i sends a grant message to P j (F03); (b) otherwise (P i has a privilege and req ts i < req ts j ), P i 's current execution step should commit before P j 's. Thus, P i sends an abort message to P j to force P j to abort (F05). Note that when comparing two timestamp values, process identiers, which are stored in incorruptible read only memory, are used to break a tie, as suggested in [8]; in this way, all timestamps are totally ordered. 2. When P i receives a state or commit message, it sets its mode to NO PRIV. This is because P i must abandon the current execution step and start a new execution step with the new nq i [] values, one of which was just updated. Note that if the message is a state message, it does this only when a value in nq i [] is actually changed (E02). 3. Timer state timer i is restarted every time it sends commit or state messages (B07, H03). When it goes o, it sends state messages to all of its reader processes (H02). In this way, P i informs all of its reader processes of P i 's current state at least once every time. 4. Timer commit timer i should go o only when the process is in PRIV, waiting for grant or abort messages too long. However, since the timer cannot be stopped, it may go o even when the process is in NO PRIV. It has no eect in such a case (G02).

13 4 Correctness of the algorithm 4.1 Safety property To prove that S d simulates S s, we will show that every execution of S d is postx serializable. First, we dene a predicate T on the global states of an execution?! H of Sd and show that S d is self-stabilizing with respect to T. Then, we show that SG(?! H ) is acyclic if T is true; thus, a history produced by S d is postx serializable. We assume that initially, at any process P i, its communication links may contain nite number of garbage messages and that its variables may hold arbitrary values. A process replies with a grant or abort message when it receives a garbage req commit message (F03, F05). Such a grant or abort message is also considered to be a garbage message. Note that P i returns no message when it receives any other types of garbage messages. We dene predicate T over global states of the transformed program S d as follows: Denition (Predicate T ). T is true in execution?! H if 1. there is no garbage message in communication links; and 2. for all processes P i, either (a) its mode (mode i ) is NO PRIV and for each P j 2 W riters(p i ), i. q j = nq i [j] and no commit message is in transit from P j to P i, or ii. a commit message that carries q j is in transit from P j to P i ; or (b) mode i is PRIV and P i was in NO PRIV prior to the current mode, and the above i. or ii. was satised then 3. Lemma 13. S d is self-stabilizing with respect to T. Proof. We show that the convergence and closure properties hold with respect to T for S d. To prove the convergence property, we show that for any execution?! H of Sd, there exists a nite length of period t init such that after t init in?! H, (1) all the initial garbage messages in the communication links will have been received (and consumed), and then (2) for each process P i, (2a) nq i [j] will hold q j for each P j 2 W riters(p j ) or a non-garbage commit message that carries q j is in transit from P j to P i, and then (2b) P i will enter NO PRIV. In the following discussions, since each process executes its steps without being interfered with by any other processes, we may assume that a selected guarded command is executed instantaneously. First, consider the above (1). The algorithm executed by P i does not have a loop construct in any of the commands. Thus, whichever guarded command 3 T refers to a history of the global states of Sd. It is possible to dene T to refer to only the current global states. However, T would become very complex since it must capture all the possible legitimate combinations of link and process states. Thus, in this paper, we slightly abuse formality and allow T to refer to a history of the global states.

14 that P i selects, P i always nishes the execution in nite time and moves to the next execution step. Since we assume a weakly fair scheduling in selection of guarded commands in Fig. 1, all the garbage messages in communication links are received by associated receive statements in nite time, say t m. Next, consider the above (2a). Due to the state timers, each process receives its writers' states periodically (i.e., once every period). Thus, in t v time ( plus a period required to execute a receive statement) after t m, it is guaranteed that each nq i [j] will have held q j for all processes P i. During this period, if P j commits, a commit message is in transit from P j to P i, or P i receives the commit message and nq i [j] is set to the new q j. Finally, consider the above (2b). After t m +t v, even if mode i is PRIV for some P i, (1) its commit timer will go o (to turn the mode to NO PRIV), (2) it will receive a commit, state, or abort message, or (3) it will (possibly erroneously) receive enough grant messages and commit. In either case, all processes will enter mode NO PRIV in nite time, say t p. As time goes, some process may enter the PRIV mode. Note that the condition for T holds for such processes. Let t init = t m + t v + t p. Then, T will hold within t init of the execution. Once T holds, if P i is in NO PRIV, either nq i [j] = q j or a commit message that carries q j is in transit from P j to P i since only the time a P i 's writer process P j changes its state is when it commits. If P i is in PRIV, it must have entered the PRIV mode by executing the rst guarded command (A01); therefore, its previous mode NO PRIV exists. ut Lemma 14. When T is true, whenever an execution step commits, for all edges E created upon the commit in SG(?! H ), ts(????! src(e)) < ts(???! tgt(e)). Proof. Consider the execution of?! H after T becomes true. Let P i and P j be processes such that P j is a writer process of P i. Let?! T y j be a committed execution step at P j (or an imaginary execution step that determines the initial state of P j ). Suppose that??! T y+1 j is the current executing step at P j and that?! Ti x is the current executing step at P i such that nq i [j] of?! Ti x holds q y j (this is guaranteed by T ). Let req ts i (x) denote the timestamp associated with?! Ti x. For each edge E in SG(?! H ), ts( src(e))????! and ts(???! tgt(e)) have the following properties 4 : 1. A wr-edge from?! T y j to?! Ti x : This is created when?! Ti x commits. When?! T y j committed (before?! Ti x commits), it sent a commit message along with req ts j (y) and q y j to P i. When P i received the commit message, it updated the timestamp to be greater than req ts j (y) (D03). Thus, req ts j (y) < req ts i (x) holds. Consider a case in which?! Ti x is aborted later. Since req ts i never decreases, a new step (also denoted?! Ti x ) is at least as large as the old?! Ti x. Thus, req ts j (y) < req ts i (x) always holds. 4 Note that SG dened in Section 2 is a transitive closure of the graph dened here.

15 2. A ww-edge from?! T y??! j to T y+1 j : This is created when??! T y+1 j commits. When?! T y??! j committed, it updated the timestamp of T y+1 j to be greater than req ts j (y) (B08). Thus, req ts j (y) < req ts j (y + 1) holds. 3. An rw-edge from?! Ti x to??! T y+1 j : Suppose that?! Ti x has committed based on q y j. An rw-edge?! Ti x!??! T y+1 j is created when??! T y+1 j commits. Before?! Ti x committed, it had sent a req commit message along with req ts i (x) to P j and obtained a grant message from P j. There are two cases to consider when P j received the req commit message: (a) P j was in NO PRIV: P j set max ts j to be no smaller than req ts i (x). Later when commit and/or state messages arrive from P j 's writer processes (otherwise P j 's mode could not have become PRIV), P j sets a timestamp for??! T y+1 j to be greater than max ts j (D03, E04). Thus, req ts i (x) < req ts j (y + 1) holds. (b) Execution step??! T y+1 j was under progress at P j : P j returned a grant message because its timestamp was greater than req ts i (x) (F02-F03). Thus, req ts i (x) < req ts j (y + 1) holds. In all cases, ts( src(e))????! < ts(???! tgt(e)) holds. ut In the scenario given in the proof, T guarantees that?! T x i reads q y j. Theorem 15. An execution?! H of S d is postx serializable. Proof. Lemma 13 has shown that after t init, T becomes true and will never become false after that in?! H. Let PRE(?! H ) denote the computation of?! H up to time t init. Let?! H 0 be?! H? PRE(?! H ). We show that SG(?! H 0 ) is acyclic. Since T holds in C(?! H 0 ), from Lemma 14, ts( src(e))???! < ts( tgt(e))???! holds for any edge in SG(?! H 0 ). Assume, on the contrary, there is a cycle?! T 1!!?! T k!?! T 1 in SG(?! H 0 ). Then, ts(?! T 1 ) < ts(?! T 2 ) ts(?! T 2 ) < ts(?! T 3 ) ts(?! T k ) < ts(?! T 1 ); that is, ts(?! T 1 ) < ts(?! T 1 ). This is a contradiction. Thus, SG(?! H 0 ) is acyclic. ut From Theorems 12 and 15, the following theorem holds. Theorem 16. Every history produced by S d is postx serializable; that is, S d simulates S s. ut As we discussed in Section 2, S d is self-stabilizing if S s is self-stabilizing and S d works just like S s. 4.2 Liveness property Theorem 17. Let?! H be an execution of program S d.?! H progresses after t init as long as there exist processes that have privileges (i.e., the program has not reached a xed point if there is one).

16 Proof. Since the program has not reached the xed point, only the situation in which an execution of S d would not progress is that privileged processes keep aborting one another forever. A process may be aborted by other processes when it receives a commit or abort message. Note that after t init, each nq i [j] at P i holds a valid value when no commit message is in transit to P i. Therefore, a state message does not abort a process. Let P p be a set of processes in P d that are in mode PRIV. We show that at least one process in P p will commit. Let P p1 be the process in P p that has the smallest timestamp. No process can send an abort message to P p1. Thus, P p1 is aborted only if it has received a commit message. This implies that either P p1 will commit or there is another process that commits. In either case, at least one process in P p will commit. Therefore,?! H progresses as long as there exist processes that have privileges. ut Note that Theorem 17 does not guarantee fair scheduling among individual processes. However, many self-stabilizing programs in the serial model do not assume fair scheduling in the c-daemon. These programs include Dijkstra's k-state and three state mutual exclusion algorithms [4] and Burns and Pachl's uniform self-stabilizing mutual exclusion algorithm [2]. They realize fair scheduling in the algorithms themselves, and therefore, their associated transformed programs S d work without starvation. Furthermore, in most self-stabilizing algorithms, no processes continuously keep holding privileges. 5 Performance evaluation In this section, we evaluate our algorithm with respect to the number of required messages for each execution step. Once the system is stabilized and no further transient failures occur, state messages do not have to be exchanged. Thus, (the timeout value of a state timer) should be very large for better performance. If is longer than the duration between two consecutive execution steps at each process, no state messages are sent. However, as we saw in Section 4, the time taken for the system to stabilize depends on. Let w i and r i be the numbers of P i 's reader and writer processes, respectively. For an execution step to commit, P i needs to exchange 2 w i + r i messages; w i req commit messages, w i grant messages, and r i commit messages. If an execution step is aborted, P i exchanges maximum of 2 w i messages; w i req commit messages, w i? 1 grant messages, and one abort message. There is no upper bound on how many times a process is aborted before its execution step is committed. However, in many SS algorithms, conicts are rare once the system is stabilized. For example, in Dijkstra's K-state and three-state mutual exclusion algorithms, once the system is stabilized, no conict will occur. We conducted performance evaluation on our implementation of Dijkstra's K-state algorithm by using a simulation feature of the underlying development system [9]. In the K-state algorithm, w i = r i = 1 for all processes. After the system is stabilized, aborts will not occur. Thus, if no state messages are exchanged, 3 messages are required for each CS entry.

17 In the performance evaluation, the following execution parameters are used 5 : 1. the number of nodes (n): 6 2. network transmission latency : (2 time units); 3. execution time inside a CS [denoted by MXTIME]: (10 time units); and 4. execution time of each guard : (0.2 time units). 5. commit timer counter value t c : 10.0 We run the program with three values: (1) MXTIME(= 10), (2) MXTIME (n? 1)(= 50), and (3) MXTIME (n? 1) 5(= 250). Table 1 shows the numbers of messages exchanged for each CS entry that are averaged over time units. Table 1. Average numbers of messages value messages/entry Even though the value is chosen to be very large (MXTIME(n?1)5), the number of messages for a CS entry is still slightly greater than 3. This is because (1) extra messages were exchanged at the beginning of computation while the system is stabilizing and (2) commit timers went o several times. 6 Conclusion This paper has presented a transformation method that converts an SS serial model program S s to a distributed model program that simulates S s. A timestamp based SS postx serializable concurrency control protocol is incorporated in a transformed program. Therefore, if the original serial model program is correct with respect to self-stabilization, the transformed distributed model program is also self-stabilizing and runs exactly like the original program. We have implemented transformed versions of several SS serial model algorithms and tested the implementations with many dierent initial congurations. Acknowledgements We would like to thank the anonymous referees for their constructive comments. 5 Parameters (2){(4) use exponential distribution with the average time units given in parentheses

18 References 1. Bernstein, P.A, Hadzilacos, V., and Goodman, N. Concurrency Control and Recovery in Database Systems. Addison-Wesley Publishing Co., Burns J.E. and Pachl J. Uniform self-stabilizing rings. ACM Transactions on Programming Languages and Systems, 11(2):330{344, April Chen N.S, Yu F.P, and Huang S.T. A self-stabilizing algorithm for constructing spanning trees. Inf. Process. Lett., 39:147{151, Dijkstra E.W. Self-stabilizing systems in spite of distributed control. Communications of the ACM, 17(11):643{644, November Dolev S., Israeli A., and Moran S. Self stabilization of dynamic systems assuming only read/write atomicity. Distributed Computing, 7:3{16, Huang S.T., Wuu L.C., and Tsai M.S. Distributed execution model for selfstabilizing systems. In Proceedings of the 14th International Conference on Distributed Computing Systems, pages 432{439. IEEE, Katz S. and Perry K.J. Self-stabilizing extensions for message passing systems. Distributed Computing, 7:17{26, Lamport L. Time, clocks and ordering of events in distributed systems. Communications of the ACM, 21(7):558{564, Mizuno M. A Distributed/Parallel Algorithm Development System. Kansas State University, Schneider M. Self-stabilization. ACM Computing Surveys, 25(1):45{67, March This article was processed using the LATEX macro package with LLNCS style