A Family of Distributed Deadlock Avoidance Protocols and their Reachable State Spaces

Transcription

1 A Family of Distibuted Deadlock Avoidance Potocols and thei Reachable State Spaces Césa Sánchez, Henny B. Sipma, and Zoha Manna Compute Science Depatment Stanfod Univesity, Stanfod, CA Abstact. We study esouce management in distibuted systems. Incoect handling of esouces may lead to deadlocks, missed deadlines, pioity invesions, and othe foms of incoect behavio o degaded pefomance. While in centalized systems deadlock avoidance is commonly used to ensue coect and efficient esouce allocation, distibuted deadlock avoidance is hade, and geneal solutions ae consideed impactical due to the high communication ovehead. Howeve, solutions that use only opeations on local data exist if some static infomation about the possible sequences of emote invocations is known. We pesent a family of efficient distibuted deadlock avoidance algoithms that subsumes peviously known solutions as special instances. Even though diffeent potocols within the family allow diffeent levels of concuency and consequently fewe o moe executions, we pove that they all have the same set of eachable states, expessed by a global invaiant. This esult enables: (1) a design pinciple: the use of diffeent potocols at diffeent sites does not compomise deadlock avoidance; (2) a poof pinciple: any esouce allocation potocol that peseves the global invaiant and whose allocation decisions ae at least as libeal as those of the least libeal in the family, guaantees absence of deadlock. 1 Intoduction Middlewae sevices play a key ole in the development of moden distibuted eal-time and embedded (DRE) systems. DRE systems often consist of a vaiety of hadwae and softwae components, each with thei own potocols, intefaces, opeating systems, and API s. Middlewae sevices hide this heteogeneity, allowing the softwae enginee to focus on the application, by poviding a high-level unifom inteface, and handling management of esouces and communication and coodination between components. Howeve, this appoach is effective only if these sevices ae well-defined, flexible and efficient. In this pape we focus on esouce allocation sevices fo DRE systems. Computations in distibuted systems often involve a distibution of method calls ove This eseach was suppoted in pat by NSF gants CCR , CCR , CCR , CNS , and CCF , and by NAVY/ONR contact N

2 2 multiple sites. At each site these computations need esouces, fo example in the fom of theads, to poceed. With multiple pocesses stating and unning at diffeent sites, and a limited numbe of theads at each site, deadlock may aise. Taditionally thee methods ae used to deal with deadlock: pevention, avoidance and detection. In deadlock pevention a deadlock state is made uneachable by, fo example, imposing a total ode in which esouces ae acquied, such as in monotone locking [1, 4]. This stategy can substantially educe pefomance, by atificially limiting concuency. With deadlock detection, common in databases, deadlock states may occu, but ae upon detection esolved by, fo example, oll-back of tansactions. In embedded systems, howeve, this is usually not an option, especially in systems inteacting with physical devices. Deadlock avoidance methods take a middle oute. At untime a potocol is used to decide whethe a esouce equest is ganted based on cuent esouce availability and possible futue equests of pocesses in the system. A esouce is ganted only if it is safe, that is, if thee is a stategy to ensue that all pocesses can complete. To make this test feasible, pocesses that ente the system must announce thei possible esouce usage. This idea was fist poposed in centalized systems by Dijksta in his Banke s algoithm [2, 3, 13, 11], whee pocesses epot the maximum numbe of esouces that they can equest. When esouces ae distibuted acoss multiple sites, howeve, deadlock avoidance is hade because the diffeent sites may have to consult each othe to detemine whethe a paticula allocation is safe. Consequently, a geneal solution to distibuted deadlock avoidance is consideed impactical [12]; the communication costs involved simply outweigh the benefits gained fom deadlock avoidance ove deadlock pevention. We study distibuted deadlock avoidance algoithms that do not equie any communication between sites. Ou algoithms ae applicable to distibuted systems in which pocesses pefom emote method invocations and lock local esouces (theads) until all emote calls have etuned. In paticula, if the chain of emote calls aives back to a site peviously visited, then a new esouce is needed. This aises, fo example, in DRE achitectues that use the WaitOnConnection policy fo nested up-calls [9, 10, 14]. Ou algoithms succeed in poviding deadlock avoidance without any communication ovehead by using static pocess infomation in the fom of call gaphs that epesent all possible sequences of emote invocations. In DRE systems, this infomation can usually be extacted fom the component specifications o fom the souce code diectly by static analysis. In this pape we analyze the common popeties of a family of deadlock avoidance potocols that include the potocols we pesented in ealie papes [8, 7, 6]. We show that the two potocols Basic-P intoduced in [8] and Live-P pesented in [6] ae the two extemes of a spectum of potocols that allow, going fom Basic-P to Live-P, inceasing levels of concuency. Despite these diffeent levels of concuency, and thus executions pemitted, we pove that all potocols in the family have the same set of eachable states. The significance of this esult is that it allows unning diffeent potocols fom the family at diffeent sites

3 3 without compomising deadlock. In addition, it consideably simplifies poving coect modifications and efinements of these potocols, as poofs educe to showing that the new potocol peseves the same invaiant. The est of this pape is stuctued as follows. Section 2 descibes the computational model and Section 3 intoduces the potocols. Section 4 chaacteizes the diffeent levels of concuency by compaing allocation sequences fo the diffeent potocols, and Section 5 pesents the poof that all potocols have the same set of eachable states. Section 6 concludes with some emaks about the design pinciple enabled by ou esults and some open poblems. 2 Computational Model We model a distibuted system as a set of sites that pefom computations and a call gaph, which povides a static epesentation of all possible esouce usage pattens. Fomally, a distibuted system is a tuple S : R, G consisting of R : { 1,..., R }, a set of sites, and G : V,, I a call gaph specification. A call gaph specification G : V,, I consists of a diected acyclic gaph V,, which captues all the possible sequences of emote calls that pocesses can pefom. The set of initial nodes I V contains those methods that can be invoked when a pocess is spawned. A call-gaph node n: epesents a method n that uns in site. We also say that node n esides in site. If two nodes eside in the same site we wite n R m. An edge fom n: to m:s denotes that method n, in the couse of its execution may invoke method m in site s. We assume that each site has a fixed numbe of pe-allocated esouces. Although in many moden opeating systems theads can be spawned dynamically, many DRE systems pe-allocate fixed sets of theads to avoid the elatively lage and vaiable cost of thead ceation and initialization. Each site maintains a set of local vaiables V that includes the constant T 1 denoting the numbe of esouces pesent in, and a vaiable t that epesents the numbe of available esouces. Initially, t = T. The execution of a system consists of pocesses, ceated dynamically, executing computations that only pefom emote calls accoding to the edges in the call gaph. When a new pocess is spawned it stats its execution with the gaph node whose outgoing paths descibe the emote calls that the pocess can pefom. All invocations to a call gaph node equie a new esouce in the coesponding site, while call etuns elease a esouce. We impose no estiction on the topology of the call gaph o on the numbe of pocess instances, and thus deadlocks can be eached if all equests fo esouces ae immediately ganted. Example 1. Conside a system with two sites R = {, s}, a call gaph with fou nodes V = {n 1, n 2, m 1, m 2 }, whee n 1 and m 1 ae initial, and edges: n 1 n 2 s m 1 s m 2 This system has eachable deadlocks if no contolle is used. Let sites s and handle exactly two theads each. If fou pocesses ae spawned, two instances of

4 4 n 1 and two of m 1, all esouces in the system will be locked afte each pocess stats executing its initial node. Consequently, the allocation attempts fo n 2 and m 2 will be blocked indefinitely, so no pocess will teminate o etun a esouce. This allocation sequence is depicted below, whee a epesents an existing pocess that ties to acquie a esouce at a node (if pecedes the node) o has just been ganted the esouce (if appeas afte the node). n 1 t = 2 t s = 2 n 2 s t = 0 t s = 2 n 1 n 2 s t = 0 t s = 0 n 1 n 2 s m 1 s m 2 m 1 s m 2 m 1 s m 2 Ou deadlock avoidance solution consists of two pats: (1) the offline calculation of annotations, maps fom call-gaph nodes to natual numbes; and (2) a un-time potocol that contols esouce allocations based on these annotations. Infomally, an annotation measues the numbe of esouces equied fo a computation. The potocols gant a equest based on the emaining local esouces (and possibly othe local vaiables) and the annotation of the equesting node. Potocol A potocol fo contolling the esouce allocation in node n : is implemented by a pogam executed in befoe and afte method n is dispatched. This code can be diffeent fo diffeent call-gaph nodes even if they eside in the same site. The schematic stuctue of a potocol fo a node n: is: n :: f() when En n (V ) do In n (V, V ) Out n (V, V ) } enty section } method invocation } exit section Upon invocation, the enty section checks esouce availability by inspecting local vaiables V of site. If the pedicate En n (V ), called the enabling condition, is satisfied we say that the enty section is enabled. In this case, the equest can be ganted and the local vaiables ae updated accoding to the elation In n (V, V ) (whee V stands fo the local vaiables afte the action is taken). We assume that the enty section is executed atomically, as a test-and-set. The method invocation section executes the code of the method, hee epesented as f(), which may pefom emote calls accoding to the edges outgoing fom node n in the call gaph. The method invocation can only teminate afte all its invoked calls (descendants in the call gaph) have teminated and etuned. The exit section eleases the esouce and may update some local vaiables in site, accoding to the elation Out n (V, V ). In n is called the enty action and Out n is called the exit action.

5 5 Annotations Given a system S and annotation α, the annotated call gaph (V,, ) is obtained fom the call gaph (V, ) by adding one edge n m between any two nodes that eside in the same site with annotation α(n) α(m). A node n depends on a node m, which we epesent n m, if thee is a path in the annotated gaph fom n to m that follows at least one edge. The annotated gaph is acyclic if no node depends on itself, in which case we say that the annotation is acyclic. 3 A Family of Local Potocols Ou goal is to constuct potocols that (1) avoid deadlock in all scenaios, (2) equie no communication between sites, and (3) maximize esouce utilization (gant equests as much as possible without compomising deadlock feedom). The fist potocol we poposed was Basic-P [8], shown in Fig. 1 fo a node n: [ ] with annotation α(n) = i. Upon a esouce when i t do equest, Basic-P checks whethe the num- t -- be of available esouces is lage enough, n :: f() as indicated by the annotation i. This check t ++ ensues that pocesses (local o emote) that could potentially be blocked if the esouce is ganted, have enough esouces to Fig. 1. The potocol Basic-P. complete. The coectness of Basic-P is based on the acyclicity of the annotations: Theoem 1 (Annotation Theoem fo Basic-P [8]). Given a system S and an acyclic annotation, if Basic-P is used to contol esouce allocations then all executions of S ae deadlock fee. Example 2. Reconside the system fom Example 1. The left diagam below shows an annotated call gaph with α(n 1 ) = α(n 2 ) = α(m 2 ) = 1 and α(m 1 ) = 2. It is acyclic, and thus by Theoem 1, if Basic-P is used with these annotations, the system is deadlock fee. n 1 1 n 2 s 1 n 1 1 n 2 s 1 m 1 s 2 m 2 1 m 1 s 1 m 2 1 Let us compae this with Example 1 whee a esouce is ganted simply if it is available. This coesponds to using Basic-P with the annotated call gaph above on the ight, with α(n) = 1 fo all nodes. In Example 1 we showed that a deadlock is eachable, and indeed this annotated gaph is not acyclic; it contains dependency cycles, fo example n 1 n 2 m 1 m 2 n 1. Theefoe Theoem 1 does not apply. In the diagam on the left all dependency cycles ae boken by the annotation α(m 1 ) = 2. Requiing the pesence of at least two esouces fo ganting a esouce at m 1 ensues that the last esouce available in s can only be obtained at n 2, which beaks all possible cicula waits.

6 6 2» 3 2» 3 when 1 t do when i p 1 t do n :: 6 t f() 5 n :: 6 p --, t f() 5 t ++ t ++, p ++ If i = 1 If i > 1 Fig. 2. The potocol Efficient-P. The potocol Basic-P can be impoved using the obsevation that pocesses equesting esouces to execute nodes with annotation 1 can always teminate, in spite of any othe pocess in the system. This obsevation leads to Efficient-P (shown in Fig. 2), which uses two countes: t, as befoe; and p, to keep tack of the potentially ecoveable esouces, which include not only the available esouces but also the esouces ganted to pocesses in nodes with annotation 1. A simila vesion of the Annotation Theoem fo Efficient-P establishes that in the absence of dependency cycles, Efficient-P can each no deadlocks. The poof of the Annotation Theoem fo Basic-P and Efficient-P [8] elies on showing that the following global invaiant ϕ is maintained: ϕ def = = A [k] T (k 1). R k T ϕ [k] with ϕ [k] def whee a [k] stands fo the numbe of active pocesses unning in site executing nodes with annotation k and A [k] stands fo j k a [j], that is, A [k] epesents the numbe of active pocesses unning in site executing nodes with annotation [ ] (i) when ϕ do a [i]++ n :: f() a [i]-- Fig. 3. The potocol Live-P. k o highe. In [6] we exploited this fact by constucting the potocol Live-P, shown in Fig. 3, which gants access to a esouce pecisely wheneve ϕ is peseved. This potocol not only guaantees absence of deadlock, it also povides, in contast with Basic-P, individual liveness fo all pocesses. Its enabling condition, pecondition fo ϕ of the tansition that gants the esouce: def = A [k] T (k 1) k>i A [k] + 1 T (k 1) k i, is exactly the weakest We use [j] fo the clause of that coesponds to annotation j. Obseve that [j] is syntactically identical to ϕ [j] fo j > i. Moeove, fo j i, [j] implies ϕ [j]. To compae the potocols we estate Basic-P and Efficient-P in tems of the notation intoduced fo Live-P. The enabling condition of Basic-P be-

7 2 " # 3 when χ (i) [1] do a n :: [i] f() 5 a [i]-- (a) 1-Efficient-P 2 n :: 6 4 f() " when ϕ (i) a [i]-- [1] χ (i) a [i]++ (b) 2-Efficient-P # 3 [2] do Fig. 4. Basic-P and Efficient-P estated using stengthenings. comes: A [1] T (i 1) which is, as we will see, stonge than, that is, the enabling condition of Basic-P implies that of Live-P. Given k i we define the k-th stengthening fomula fo a equest in node n: with annotation i as: χ (i) [k] def = A [k] T (i 1) It is easy to see that the following holds fo all k j i, χ (i) [k] [j] and theefoe χ (i) [k] [j]. k j i Also, if ϕ holds befoe the esouce is ganted, then [j] also holds fo all i j, since the fomulas fo [j] and ϕ [j] ae identical in this case. Hence: χ (i) [k] [j]. (1) k j Finally, if can be concluded: [j] is satisfied fo all values less than k, and χ (i) ( j<k [j]) χ (i) [k] ( j<k [j]. [j]) ( j k [j]) [k] is ensued, Theefoe, if a potocol ensues that fo some k, both j<k ϕ(i) [j] and the k- stengthening χ (i) [k] hold, then ϕ is an invaiant. In geneal, the lowe the value of the stengthening point k, the less computation is needed to compute the pedicate (the numbe of compaisons is educed) but the less libeal the enabling condition becomes. In the case of k = 1 the stengthening is χ (i) [1], and the potocol obtained (see Fig. 4(a)) is equivalent

8 8 Fig. 6. A compaison of Basic-P, k-efficient-p and Live-P. to Basic-P. Note that this potocol is logically equivalent to Basic-P: the esult of the enabling condition, and the effect of the input and output actions on futue tests ae the same. The implementation of Basic-P intoduced ealie uses a single counte t, while in this estated vesion, seveal countes ae used: a [i] and A [1]. Howeve, the effect on A [1] of the incements and decements of a [i] ae independent of i. Theefoe, these actions can be implemented as A [1]++ and A [1]-- espectively. Similaly, with a stengthening point of k = 2 we obtain a potocol equivalent to Efficient-P, shown in Fig. 4(b). The geneal fom of ou family of potocols can now be given as k-efficient- P, shown in Fig. 5. It coves the full spectum of potocols with Basic-P, which is equivalent to 1-Efficient-P, at one end and Live-P, which is equal to T - Efficient-P at the othe end of the spectum. The potocols k-efficient- P can be implemented in seveal ways. The simplest implementation needs when ( j<k n :: f() a [i]-- [j]) χ (i) a [i]++ [k] do Fig. 5. The potocol k-efficient-p. space O(k log T ) to stoe k countes and equies O(k) opeations pe allocation decision. A moe sophisticated implementation using an active tee data-stuctue still needs O(k log T ), but equies only O(log k) opeations pe allocation decision [6]. Fig. 6 pesents some expeimental esults that compae concuency levels allowed by the diffeent potocols. The figues depict the maximum annotation allowed by each potocol as a function of the load (total numbe of active pocesses). The load is ceated by annotations picked unifomly at andom. 4 Allocation Sequences In this section we compae the set of uns allowed by each potocol. We captue these sets by languages ove an alphabet of allocations and deallocations. Given a call gaph (V, ) let the set V contain a symbol n fo evey n in V. The allocation alphabet Σ is the disjoint union of V and V. Symbols in V

9 9 ae called allocation symbols, while symbols in V ae efeed to as deallocation symbols. Given a sting s in Σ and a symbol v in Σ we use s v fo the numbe of occuences of v in s, and s n to stand fo s n s n. A well-fomed allocation sting s is one fo which evey deallocation occus afte a matching allocation, that is, fo evey pefix p of s, p n 0. An admissible allocation sequence is one that coesponds to a pefix un of the system, accoding to the call gaph. This equies (1) that the sting be well-fomed, (2) that evey allocation of a nonoot node is peceded by a matching allocation of its paent node, and (3) that evey deallocation of a node is peceded by a coesponding deallocation of its childen nodes. Fomally, Definition 1 (Admissible Stings). A well-fomed allocation sting s is called admissible if fo evey pefix p of s, and evey emote call n m: p n p m. Admissible stings ensue that the numbe of child pocesses (callees) is not highe than the numbe of paents (calle pocesses), so that thee is a possible match. Fo bevity, we simply use sting to efe to admissible sting. We say that a potocol is completely local if all the enabling conditions ae detemined by: (1) the annotation of the call-gaph node equested, and (2) the set of active pocesses in the local site and thei annotations. It is easy to see that the potocols k-efficient-p ae completely local. We use the values of a [ ] and A [ ] as the (abstact) global states of the system since these values captue all effects of completely local potocols in the outcomes of futue equests. The initial state of the system, denoted by Θ, is a [i] = A [i] = 0 fo all sites and annotations i. Given a state σ and a potocol P, if the enabling condition of P fo a node n is satisfied at σ we wite En P n (σ). Fo convenience, we intoduce a new state to captue sequences that a potocol fobids, and equie that En P n ( ) does not hold. We denote by P (s) the 1 state eached by P afte execising the allocation sting s, defined inductively as P (ɛ) = Θ and: P (s n) = { In P n (P (s)) if EnP n (P (s)) othewise P (s n) = { Out P n (P (s)) if P (s) othewise We say that a sting s is accepted by a potocol P if P (s). The set of stings accepted by P is denoted by L(P ), and we use P Q fo the patial ode defined by language inclusion L(P ) L(Q). Example 3. Reconside the system in Example 1. The allocation sequence that leads to a deadlock is s : n 1 n 1 m 1 m 1. Even though n 1 n 1 m 1 is in L(Basic-P), the enabling condition of m 1 becomes disabled, so Basic-P(s) = and s / L(Basic-P). Lemma 1. The following ae equivalent: 1 All ou potocols ae deteministic but the esults can be adapted fo nondeteministic potocols as well.

10 10 (i) L(P ) L(Q). (ii) Fo all stings s and allocation symbols n, if En P n (P (s)) then En Q n (Q(s)). Poof. We pove both implications sepaately: Assume L(P ) L(Q), and let s and n be such that En P n (P (s)). Since s L(P ) then s L(Q). Moeove, s n L(P ) and then s n L(Q). Hence, En Q n (Q(s)). Assume now (ii). We eason by induction on stings: Fist, both ɛ L(P ) and ɛ L(Q). Let s n L(P ). Then En P n (P (s)), so also En Q n (Q(s)). Hence, s n L(Q). Let s n L(P ). This implies s L(P ) and by inductive hypothesis s L(Q). Then s n L(Q), as desied. Theefoe (i) and (ii) ae equivalent. Let P, Q be any two of Basic-P, Efficient-P, k-efficient-p and Live-P. We showed in Section 3 that the enty and exit actions ae identical fo all these potocols. Theefoe, if s is in the language of both P and Q then the states eached ae the same, i.e., P (s) = Q(s). It follows that if fo all states σ, En P n (σ) implies EnQ n (σ), then L(P ) L(Q). Lemma 2. If j-efficient-p allows an allocation then k-efficient-p also allows the allocation, povided j k. Poof. Let j k. It follows fom the definition that χ (i) [j] implies χ (i) [k]. Moeove, by (1), χ (i) [j] implies j l k ϕ(i) [l]. Consequently, l<j [l] χ (i) [j] } {{ } En j-efficient-p n l<k [l] χ (i) [k] } {{ } En k-efficient-p n Theefoe if j-efficient-p allows a equest so does k-efficient-p. Lemma 2 states that the enabling condition of k-efficient-p becomes weake as k gows, that is, the enabling condition of Basic-P is stonge than that of Efficient-P, which in tun is stonge than k-efficient-p, which is stonge than Live-P. An immediate consequence of Lemma 2 is: Basic-P Efficient-P... k-efficient-p... Live-P The following examples show that these language containments ae stict: Basic-P Efficient-P... k-efficient-p... Live-P which is depicted in Fig 7(a).

11 L(Live-P) L(k-Efficient-P) L(Efficient-P) ϕ a-states = = S(Live-P) = S(Efficient-P) L(Basic-P) = S(k-Efficient-P) = S(Basic-P) (a) Allocation sequences (b) Reachable state spaces Fig. 7. Compaison of the family of potocols 11 Example 4. Conside the following call-gaph, with initial esouces T = 2. n 2 2 n 1 1 m 1 1 The sting m 1 n 2 is accepted by Efficient-P but not by Basic-P. This system can be genealized to show that thee is a sting accepted by k-efficient-p but not by j-efficient-p (fo j < k). Conside the following annotated call gaph, with initial esouces T = j + 1. n j+1 j+1 n j j n j 1 j 1 n 1 1 m j j j 1 m j 1 m 1 1 The sting m j n j+1 is accepted by k-efficient-p, but is not accepted by j- Efficient-P. 5 Reachable State Spaces The eachable state space of a potocol P, denoted by S(P ), is the set of global states that P can each following some admissible allocation sequence. Clealy, fo two potocols P and Q, if thei actions ae equivalent and P Q then evey state eachable by P is also eachable by Q. Indeed any allocation sting that eaches a state fo P also eaches that same state fo Q. Lemma 3. Fo evey two potocols P and Q with the same enty and exit actions, if P Q then S(P ) S(Q). Consequently, S(Basic-P) S(Efficient-P)... S(k-Efficient-P)... S(Live-P)

12 12 Let S(ϕ a ) descibe the set of states that satisfy ϕ and that ae eachable by some admissible allocation sting. In the est of this section we show that the above containment elation collapses into equalities by poving S(Basic-P) = S(Live-P) = S(ϕ a ) The poof elies on the existence of a pefeence ode on the nodes of the annotated call gaph, such that, if allocations ae made following this ode, then evey allocation equest that succeeds in Live-P also succeeds in Basic-P. 5.1 Pefeence Odes A pefeence ode of an annotated call gaph is an ode on the nodes such that, if all allocations in a given admissible sting ae pefomed following that ode, then (1) the sequence obtained is also admissible, and (2) highe annotations fo each site ae visited fist. This will allow us to show that Basic-P can each all ϕ a -states. Given a call gaph, a total ode > on its nodes is called topological if it espects the descendant elation, that is, if fo evey pai of nodes n and m, if n m then n > m. Analogously, we say that an ode > espects an annotation α if fo evey pai of nodes n and m esiding in the same site, if α(n) > α(m) then n > m. A total ode that is topological and espects annotations is called a pefeence ode. Lemma 4. Evey acyclically annotated call gaph has a pefeence ode. Poof. The poof poceeds by induction on the numbe of call-gaph nodes. The esult tivially holds fo the empty call gaph. Fo the inductive step, assume the esult holds fo all call gaphs with at most k nodes and conside an abitay call gaph with k + 1 nodes. Fist, thee must be a oot node whose annotation is the highest among all the nodes esiding in the same site. Othewise a dependency cycle can be fomed: take the maximal nodes fo all sites, which ae intenal by assumption, and thei oot ancestos. Fo evey maximal (intenal) node thee is + path eaching it, stating fom its coesponding oot. Similaly, fo evey oot thee is an incoming edge fom the maximal intenal node that esides in its site. A cycle exists since the (bipatite) subgaph of oots and maximal nodes is finite, and evey node has a successo (a + fo oot nodes, and a fo maximal nodes). This contadicts that the annotation is acyclic. Now, let n be a maximal oot node, and let > be a pefeence ode fo the gaph that esults by emoving n, which exists by inductive hypothesis. We extend > by adding n > m fo evey othe node m. The ode is topological since n is a oot. The ode espects annotations since n is maximal in its site. 5.2 Reachable States A global state of a distibuted system is admissible if all existing pocesses (active o waiting) in a node n ae also existing, and active, in evey node ancesto of

13 13 n. That is, if the state coesponds to the outcome of some admissible allocation sequence. Theoem 2. The set of eachable states of a system using Live-P is pecisely the set of ϕ a -states. Poof. It follows diectly fom the specification of Live-P that all eachable states satisfy ϕ. Theefoe, we only need to show that all ϕ a -states ae eachable. We poceed by induction on the numbe of active pocesses in the system. The base case, with no active pocess, is the initial state of the system Θ, which is tivially eachable by Live-P. Fo the inductive step, conside now an abitay ϕ a -state σ with some active pocess. Since the call gaph is acyclic and finite, thee must be some active pocess P in σ with no active descendants. The state σ obtained by emoving P fom σ is an admissible ϕ a -state (all the conditions of admissibility and the clauses of ϕ ae eithe simplified o identical); by the inductive hypothesis, σ is eachable by Live-P. Since σ is obtained fom σ by an allocation that peseves ϕ (othewise σ would not be a ϕ a -state), then σ is eachable by Live-P. Theoem 2 states that fo evey sequence s that leads to a ϕ a -state thee is a sequence s aiving at the same state fo which all pefixes also each ϕ a -states. The sequence s is in the language of Live-P. Pehaps somewhat supisingly, the set of eachable states of Basic-P is also the set of all ϕ a -states. To pove this we fist need an auxiliay lemma. Lemma 5. In evey ϕ a -state, an allocation equest in site with annotation k has the same outcome using Basic-P and Live-P, if thee is no active pocess in with annotation stictly smalle than k. Poof. Fist, in evey ϕ a -state, if Basic-P gants a esouce so does Live-P, by Lemma 2. We need to show that in evey ϕ a -state, if Live-P gants a equest of k and a [j] = 0 fo all j < k, then Basic-P also gants the equest. In this case, T T T t = A [1] = a [j] = a [j] = A [k], (2) j=1 and since Live-P gants the equest, then A [k] + 1 T (k 1) and A [k] T k. Using (2), T t T k, and t k, so Basic-P also gants the esouce. Theoem 3. The set of eachable states of a system using Basic-P is pecisely the set of ϕ a -states. Poof. The poof is analogous to the chaacteization of the eachable states of Live-P, except that the pocess P emoved in the inductive step is chosen to be a minimal active pocess in some pefeence ode >. This guaantees that P has no childen (by the topological popety of >), and that thee is no active pocess in the same site with lowe annotation (by the annotation especting popety of >). Consequently, Lemma 5 applies, and the esulting state is also eachable by Basic-P. j=k

14 14 Theoem 3 can also be estated in tems of allocation sequences. Fo evey admissible allocation sting that aives at a ϕ a -state thee is an admissible allocation sting that aives at the same state and (1) contains no deallocations, and (2) all the nodes occu accoding to some pefeence ode. It follows fom Theoem 3 that S(Basic-P) = S(ϕ a ), and hence, as depicted in Fig 7(b): S(Basic-P) = S(Efficient-P) =... = S(k-Efficient-P) =... = S(Live-P). 6 Applications and Conclusions We have genealized ou ealie distibuted deadlock avoidance algoithms by intoducing a family of potocols defined by stengthenings of the global invaiant ϕ. The most libeal potocol, Live-P, also ensues liveness, at the cost of maintaining moe complicated data-stuctues (which equie a non-constant numbe of opeations pe allocation equest). The simplest potocol, Basic-P, can be implemented with one opeation pe equest, but allows less concuency. We have shown that all the eachable state spaces of the potocols ae the same. This esult allows a system designe moe feedom in the implementation of a deadlock avoidance potocol, because it follows that evey local potocol P that satisfies the following conditions fo evey equest is guaanteed to avoid deadlock: (1) if Basic-P is enabled then P is enabled, and (2) if P is enabled then Live-P is enabled This holds because all P -eachable states satisfy ϕ, and fom those states Basic- P guaantees deadlock feedom. Infomally, (2) guaantees that the system stays in a safe egion, while (1) ensues that enough pogess is made. This esult implies, fo example, that the combination of diffeent potocols at diffeent sites is safe. If a site has a constaint in memoy o CPU time, then the simple Basic-P is pefeable, while Live-P is a bette choice if a site needs to maximize concuency. This esult also facilitates the analysis of altenative potocols. Poving a potocol coect (deadlock feedom) can be a had task if the potocol must deal with scheduling, extenal envionment conditions, etc. With the esults pesented in this pape, to show that an allocation manage has no eachable deadlocks, it is enough to map its eachable state space to an abstact system fo which all states guaantee ϕ, and all allocation decisions ae at least as libeal as in Basic-P. This technique is used in [5] to ceate an efficient distibuted pioity inheitance mechanism whee pioities ae encoded as annotations, and pioity inheitance is pefomed by an annotation decease. Although this annotation decease tansition is not allowed by the potocols pesented hee, since the esulting state is still a ϕ-state, it is also eachable by Basic-P (maybe using a diffeent sequence). Theefoe, deadlocks ae avoided. Topics fo futhe eseach include (1) the question whethe Live-P is optimal, that is, does thee exist a completely local potocol P that guaantees deadlock avoidance such that Live-P P, and (2) the question whethe k- Efficient-P is optimal with O(k log T ) stoage space.

15 15 Refeences 1. Andew D. Biell. An intoduction to pogamming with theads. Reseach Repot 35, Digital Equipment Copoation Systems Reseach Cente, Edsge W. Dijksta. Coopeating sequential pocesses. Technical Repot EWD- 123, Technological Univesity, Eindhoven, the Nethelands, Aie N. Habemann. Pevention of system deadlocks. Communications of the ACM, 12: , James W. Havende. Avoiding deadlock in multi-tasking systems. IBM Systems Jounal, 2:74 84, Césa Sánchez, Henny B. Sipma, Chistophe D. Gill, and Zoha Manna. Distibuted pioity inheitance fo eal-time and embedded systems. In Alex Shvatsman, edito, Poceedings of the 10th Intenational Confeence On Pinciples Of Distibuted Systems (OPODIS 06), volume 4305 of LNCS, Bodeaux, Fance, Spinge-Velag. 6. Césa Sánchez, Henny B. Sipma, Zoha Manna, and Chistophe Gill. Efficient distibuted deadlock avoidance with liveness guaantees. In Sang Lyul Min and Wang Yi, editos, Poceedings of the 6 th ACM & IEEE Intenational Confeence on Embedded Softwae (EMSOFT 06), pages 12 20, Seoul, South Koea, Octobe ACM & IEEE. 7. Césa Sánchez, Henny B. Sipma, Zoha Manna, Venkita Subamonian, and Chistophe Gill. On efficient distibuted deadlock avoidance fo distibuted eal-time and embedded systems. In Poceedings of the 20th IEEE Intenational Paallel and Distibuted Pocessing Symposium (IPDPS 06), Rhodas, Geece, IEEE Compute Society Pess. 8. Césa Sánchez, Henny B. Sipma, Venkita Subamonian, Chistophe Gill, and Zoha Manna. Thead allocation potocols fo distibuted eal-time and embedded systems. In Fan Wang, edito, 25th IFIP WG 2.6 Intenational Confeence on Fomal Techniques fo Netwoked and Distibuted Systems (FORTE 05), volume 3731 of LNCS, pages , Taipei, Taiwan, Octobe Spinge-Velag. 9. Douglas C. Schmidt. Evaluating Achitectues fo Multi-theaded CORBA Object Request Bokes. Communications of the ACM Special Issue on CORBA, 41(10):54 60, Octobe Douglas C. Schmidt, Michael Stal, Hans Rohnet, and Fank Buschmann. Patten- Oiented Softwae Achitectue: Pattens fo Concuent and Netwoked Objects, Volume 2. Wiley & Sons, New Yok, Abaham Silbeschatz, Pete B. Galvin, and Geg Gagne. Opeating System Concepts. John Wiley & Sons, Inc., New Yok, NY, Sixth edition, Mukesh Singhal and Nianjan G. Shivaati. Advanced Concepts in Opeating Systems: Distibuted, Database, and Multipocesso Opeating Systems. McGaw- Hill, Inc., New Yok, NY, William Stallings. Opeating Systems: Intenals and Design Pinciples. Pentice Hall, Inc., Uppe Saddle Rive, NJ, Thid edition, Venkita Subamonian, Guoliang Xing, Chistophe D. Gill, Chenyang Lu, and Ron Cyton. Middlewae specialization fo memoy-constained netwoked embedded systems. In Poc. of 10th IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS 04). IEEE Compute Society Pess, May 2004.