To be or not programmable Dimitri Papadimitriou, Bernard Sales Alcatel-Lucent April 2013 COPYRIGHT 2011 ALCATEL-LUCENT. ALL RIGHTS RESERVED.

Transcription

1 To be or not programmable Dimitri Papadimitriou, Bernard Sales Alcatel-Lucent April 2013

2 Introduction SDN research directions as outlined in IRTF RG outlines i) need for more flexibility and programmability at data plane level What does it mean from CS perspective? and implications? and ii) need for higher-level languages for programming together with testing and debugging Program testing fails to prove program correctness Consequently, 3 main challenges - Programming language and Abstraction (programmable abstractions) - Concurrency - Automated verification 2

3 Objectives Need for programmability? - Operate network function/states (instead of protocol/engine configuration) - Control network execution (instead of control protocol procedures/states) - Function and execution (decisions) at domain/network instead of node-level Note: SDN = new term given to programmable networks A survey of programmable networks A.T.Campbell et al., ACM SIGCOMM Computer Communication Review, Volume 29 Issue 2, April 1999 Multiple tradeoffs - Flexibility vs Performance - Horizontal vs Vertical integration - Complexity (node) vs Cost (operation) 3

4 Programmable networks: implications Conventional software design - Step 0: solve a given problem (formulation) - Step 1: program (supposed to solve this problem) written in programming language - Step 2: compilation (executable program) - Step 3: program execution (test) Test results However, test can only confirm existence of errors NOT absence of errors Program testing fails to prove program correctness 4

5 Formalization Program (formal spec.) Automated program (formal) verification Program (formal spec.) Program transformation Program (data file) Compilation Program (exec.file) Instruction execution (hardware) Informal specification Formal specifications : i) Algebraic specifications (*) provide a mathematical framework for describing abstract data types Examples of specification languages Calculus of Communicating Systems (CCS) [Milner1980] Communicating Sequential Processes (CSP) [Hoare1985] Algebra of Communicating Processes (ACP) [Bergstra & Klop's1984] Common Algebraic Specification Language (CASL) ii) Functional specification iii) State-oriented specification Interface Node formal program Verification Transform Verification Transform Verification Transform Proof that the program meets the specification of the Abstract Data Type (ADT) Compilation Compilation Compilation Execution (hardware) Execution (hardware) Execution (hardware) (*) Note: the class of models of an algebraic specification forms an ADT 5

6 Critical question: which formal language? Formal specification language - Algebraic or axiomatic specifications (see previous slide) - Functional specification (operations are modelled as functions on data) match functional programming languages (LISP, Scheme, Haskell, etc.). Other (more) applied specification languages (VDM, Z): imperative or state-oriented specification - Execution of an operation may change the state of an algebra - Requires algebras with state: evolving algebras or abstract state machines Tradeoff: state oriented specification languages are more complex but "closer" to the (real) system Moreover, doesn't necessarily need to be "unique": formal specification language to choose depends also on network functions and objects it manipulates 6

7 Imperative vs Functional Programming Functional programming: form of declarative programming involves composing the problem as a set of functions to be executed by defining carefully the input to each function, and what each function returns Imperative (procedural) programming: code describes in exacting detail the steps that the computer must take to accomplish the goal (sometimes referred to as algorithmic programming) Characteristic Imperative Functional Programming task How to design algorithms and how to track changes in state. What information is desired and what transformations are required State changes Important Non-existent Order of execution Important Low importance Primary flow control Loops, conditionals, and function (method) calls Function calls, including recursion Primary manipulation unit Instances of structures or classes Functions as first-class objects and data collections 7

8 Problem These challenges are identical to the most critical issues in computer science ( moving 30 years old problems to 80 year old problems cf. Turing-Church thesis --Every effectively calculable function is a computable function) Functional vs declarative language Main selection criteria: data types (strength, safety, expressive, composition, checking), I/O, performance and verification Despite advantage of FP, declarative language still preferred because of Von Neumann computer model VonNeumann bottleneck: logical operations are performed one after another; thus, the instructions are executed sequentially which is a slow process (serial logic operation) Speed of program execution limited by (inherently sequential) rate at which data/instructions move between memory and CPU Use of concurrency? 8

9 Programmable abstractions ADT (definition): set of data structures/objects defined by the set of operations that may be performed on it (without defining how), and the mathematical properties of those operations - ADT algebra in which the data sets and the operations can be programmed - Example Graph G=(V,E) as mathematical object - Graph formal entity (graph) with set of operations (add, remove, etc.) - Data structure (underneath): table, list, array <-> what is the relationship with nodes and networks? Principles - Modularization to decompose into independent programming tasks - Information hiding to protect the data structure from outside interference or manipulation - Encapsulation of data structures and their routines to manipulate structures into one unit Key point: formalize the relationship(s) between aggregated representation of node/network data and ADT 9

10 Programmable abstractions Abstraction: data => abstract data type (control) action => control flow Define ADT (for network level) and relationships Topology: G=(V,E) most common ADT (but other exists) V={node} - E={link} + link attributes (e.g. spatial (e.g. unused capacity), administrative (e.g. weight or cost), associated destinations, etc.) + node attributes (commonly referred to as resources) - Buffering capacity - Switching fabric capacity - Transmission capacity Sequence of packets: there are multiple choices - Spatio-temporal statistical distribution(s) - Matrix representing <s,d> pairs + attributes - Mixes + attributes (rate, size, burstiness) - Etc. ADT at "node level" Link-level/interface: TX/RX, encoding, etc. Node-level: line cards, fabric, etc. 10

11 Automated verification Objective - Demonstrates correctness of software design in conformance with its specification - Does not demonstrate correctness of specification itself (doesn't validate correctness of the specification) Distinction between - Formal verification - Formal equivalence verification (equivalence checking): compares two models to check their equivalence - Formal properties verification (model checking) - Functional verification: black box - Structural verification: white box Not covered 11

12 Formal Verification Hierarchy Space Coverage Higher-Order Theorem Proving First-Order Theorem Proving TL-Based Model Checking Equivalence Checking Simulation source: ASPDAC/VLSI 2002 Tutorial, 2002 Degree of Automation 12

13 Formal Property Verification Basic steps - Property specification: using a language for formally specifying functional requirements and behaviors of a function (taking into account performance constraints) - Analysis: using a procedure for establishing that requirements (properties) hold Model checking (MC): method to automatically decide whether a temporal logic (TL) formula is satisfied in a FSM model - Automatic method for verifying finite state concurrent systems - Formal method for proving functional properties (specifications) on the behavior of program design - Prove a property by showing it holds for all possible input combinations, across all execution paths - Methods - Explicit Model Checking [Clarke & Emerson, 1981] - Symbolic Model Checking [McMillan, 1992] - LTL Model Checking [Vardi & Wolper, 1986] 13

14 Model Checking Input - Model and Initial State: convert a design into a formalism accepted by a model checking tool; design often modeled as automaton - States and State transitions - Often represented as state graph - Specification: state the properties that the design must satisfy; (often) expressed in temporal logic (which can assert how the behavior of the system evolves over time) -> Propositional logic with temporal aspect - Describes ordering of events without explicitly using the concept of time - Several variants: - Linear Temporal Logic (LTL): add temporal operators to predicate logic (addition of predicates and quantifiers to basic Boolean logic) - Computational Tree Logic (CTL): formulas are constructed from path quantifiers and temporal operators Verification (automatic) - Visit each state and evaluate specification Output - Terminates with a positive answer when the property holds for the original state graph - Otherwise, it produces a counterexample 14

15 Model Checking Technique: LTL model checking [Vardi-Wolper, 1986] Model checker Model State graph automat A Check that ϕ by checking that L(A ) L(A ϕ) = True False (+ counterexample) Property ϕ LTL-formula ϕ Convert ϕ to Büchi automaton A ϕ so that L( ϕ) = L(A ϕ) 15

16 Standards perspective Proposed method ("IT-centric"): more effort at design time to save at run time (to ensure provable operational gain) - Centered on formal specification language and ADT - IRTF/IETF already following different track Is ETSI the right place to consider - "Distributed multi-level programming" architecture? - Specification of formal specification language (if specialized)? - Based on selection criteria and applicability (understanding of requirements and needs) - and even reconsider implications of computer architecture model (VonNeumann bottleneck)? 16

17

18

19