AN ad hoc network is a collection of mobile nodes

Transcription

1 96 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 19, NO. 7, JULY 008 A Sel-Stabilizing Leader Election Algorithm in Highly Dynamic Ad Hoc Mobile Networks Abdelouahid Derhab and Nadjib Badache Abstract The classical deinition o a sel-stabilizing algorithm assumes generally that there are no aults in the system long enough or the algorithm to stabilize. Such an assumption cannot be applied to ad hoc mobile networks characterized by their highly dynamic topology. In this paper, we propose a sel-stabilizing leader election algorithm that can tolerate multiple concurrent topological changes. By introducing the time-interval-based computation concept, the algorithm ensures that a network partition can within a inite time converge to a legitimate state even i topological changes occur during the convergence time. Our simulation results show that our algorithm can ensure that each node has a leader over 99 percent o the time. We also give an upper bound on the requency at which network components merge to guarantee the convergence. Index Terms Mobile ad hoc networks, sel-stabilizing, leader election, concurrent and disjoint computations. Ç 1 INTRODUCTION AN ad hoc network is a collection o mobile nodes orming a temporary network without any orm o centralized administration or predeined inrastructure. In such a network, each node participating in the network acts as both a host and a router. Two nodes can communicate i they are within the transmission range o each other. Due to node mobility, link breakages and link ormations might occur requently. The ailure o some links considered as critical can split up the network into several disjoint network components. In addition, multiple components can also merge into a single connected component. Leader election is a undamental problem in distributed systems and is a useul building, especially in ad hoc networks where ailures are considered the norm and not the exception. Leader election is required in many applications, or example, when a mutual exclusion application is blocked because o the ailure o a token holding node. It is also required in a group communication service [18], key distribution and management [4], [10], and routing coordination [3], [5], [7], [8], [13], [17]. The classical property o the leader election problem in distributed systems with a ixed number o nodes states that eventually there is a unique leader [11]. However, due to ad hoc network characteristics this property cannot be guaranteed. First, the mobility o nodes may lead to requent network partitioning. Second, we cannot guarantee a unique leader in each network component at all times. When a network partitioning occurs, the network component will be without a leader until a partitioning is detected and the leader election. A. Derhab is with the Department o Computer Engineering, CEntre de Recherche sur l Inormation Scientiique et Technique (CERIST), Algiers 16030, Algeria. aderhab@mail.cerist.dz, d.ouahid@gmail.com.. N. Badache is with the Computer Science Department, University o Sciences and Technology Houari Boumediene (USTHB), Algiers 16111, Algeria. badache@mail.cerist.dz. Manuscript received 7 Aug. 006; revised 19 Apr. 007; accepted 3 Oct. 007; published online Oct Recommended or acceptance by J. Hou. For inormation on obtaining reprints o this article, please send to: tpds@computer.org, and reerence IEEECS Log Number TPDS Digital Object Identiier no /TPDS process terminates. In the same way, when two network components merge, there will temporarily be two leaders in the resulting network component. Thus, the leader election problem deinition should slightly be modiied to be the ollowing: every connected component will eventually have a unique leader. The problem o the leader election in mobile ad hoc networks is challenging and has received interest in recent years, but ew solutions have been proposed. The aim o these solutions is to bring a network aected by topological changes to a state satisying the ollowing predicate P : or every connected component, there is a unique leader, and each node o the component is aware o this leader. Malpani et al. [1] have adapted the Temporally Ordered Routing Algorithm (TORA) [15] to elect a unique leader in each network component. Every component creates a leaderoriented directed acyclic graph (DAG). They have presented two DAG-based leader election algorithms, the irst one is or one topological change and the second one is or concurrent topology changes. One topological change means that a new topology change occurs only ater the algorithm has terminated its execution triggered by a previous topology change, whereas concurrent topology changes mean that changes can occur at any time. In the algorithms, a node that detects that its current leader is no longer reachable elects itsel as leader and propagates this inormation throughout the component. It ceases to be a leader when it detects the existence o another leader o higher priority in its component. The irst algorithm is proved to stabilize to a state satisying P i the network topology stabilizes or a suiciently long time. The second algorithm is designed to tolerate concurrent topological changes. However, it has been provided with no proo o correctness. In [1], the authors have proposed a leader election algorithm based on the diusing computation concept [6]. The leader sends periodic heartbeat messages to other nodes. The absence o these messages at a node or some predeined time out indicates a departure rom the leader and triggers a diusing computation at that node to elect a new leader. The diusing computation consists o constructing a spanning tree with the node that started o the diusing computation as the root. The root then inorms all the reachable nodes about the identity o the elected leader /08/$5.00 ß 008 IEEE Published by the IEEE Computer Society

2 DERHAB AND BADACHE: A SELF-STABILIZING LEADER ELECTION ALGORITHM IN HIGHLY DYNAMIC AD HOC MOBILE NETWORKS 97 (or example, node with the highest identity). Dierent diusing computations can be executed concurrently. A total order on these diusions is deined to determine the diusing computation o the highest priority. A node participates in only one diusing computation at a time. It stops its participation in diusing computations o lower priorities in avor o the highest one. The algorithm is guaranteed to reach a state satisying P i diusing computations stop in the network. This algorithm has also some disadvantages. First, leader messages need to be periodically broadcast to all nodes in the network to detect partition. Second, i the leader migrates away, then multiple simultaneous computations are triggered in all other nodes in the component. Third, there is also an extra overhead in terms o the extra Probe-Reply required to handle ailure during leader election. In this paper, we propose a sel-stabilizing leader election algorithm that can work in a highly dynamic and asynchronous ad hoc network. The algorithm uses the DAG-based approach or designing a leader election algorithm. This approach has the advantage o detecting partitions automatically using the TORA mechanism. It has ewer message overheads as compared to the algorithm in [1]. It is localized since the knowledge o each node is limited to one hop. Nodes have synchronized clocks, either through a global positioning system (GPS) [9] or through an appropriate algorithm [14], [19], [0]. The paper addresses an open issue that has been tackled by a ew works. The issue is how to guarantee that a selstabilizing algorithm converges to a legitimate state despite requently changing ad hoc networks. In the literature, an algorithm is sel-stabilizing i it can converge to a legitimate state in a inite time regardless o the initial state, and the system remains in a legitimate state until another topological change occurs. However, the convergence is guaranteed only when the network experiences no topological changes during the convergence time. The solutions presented earlier cannot work in highly dynamic environments like ad hoc networks, because they assume that topological changes stop rom some point onward in order or the algorithms to stabilize. When the system experiences a new topological change beore completing the convergence, the algorithms restart convergence to its legitimate state rom scratch. In this case, the algorithms might never converge to the legitimate state. Our original contribution is designing a leader election algorithm that can converge to the legitimate state even i topological changes occur during the convergence time. This is achieved as ollows: In Malpani s algorithm, all the computations, which have been triggered in response to link ailures, have the same goal (that is, checking i the component is separated rom the current leader). Thereore, we propose to stop newer computations in avor o the oldest one. In addition, the merge o components triggers a computation in the component whose leader has a lower priority. We consider that an older leader has always a higher priority than a newer one. When concurrent merge computations meet, we propose to stop computations associated with newer leaders in avor o the oldest one. We also estimate the upper bound requency at which the merge o network components can occur to guarantee the convergence o the algorithm to a legitimate state. The rest o the paper is organized as ollows: In Section, we present a review o Malpani s algorithm and its behavior in the presence o concurrent topological changes. Section 3 deines the notion o time-interval-based computation. In Section 4, we describe our sel-stabilizing leader election algorithm. Section 5 shows simulation results. The correctness proo o the algorithm is given in Section 6. Finally, Section 7 concludes the paper. OVERVIEW OF MALPANI S ALGORITHM In [1], the network is arranged as a DAG with the leader node as the sink. A 6-tuple H i ¼ðlid i ; i ; oid i ;r i ; i ;iþ is associated with each node. It represents the height o node i in the DAG. The heights are compared lexicographically (where 0 < 1 <..., and A<B<C...). Links are ordered rom higher to lower heights. For each j i s neighbors ðn i Þ, the link ði; jþ is marked outgoing i H i is higher than H j. Otherwise, it is marked incoming. lid i denotes the identiier o leader in node i s component. The triple ð i ; oid i ;r i Þ denotes the reerence level. i and i induce the directions on the links among all the nodes with the same reerence level. Fig. 1a depicts a DAG constructed or the leader node L. Initially, node L sets its height to (L, 1, 1, 1, 0, L). It then propagates an Update in the network. When a node i receives such a message rom its neighbor j, it sets its height to (lid j,0,0,0, j þ 1, i). When a node i loses its last outgoing link (that is, becomes a local minimum) as a result o link ailure, the node selects a new height such that it becomes the global maximum by deining a new reerence level. i is set to the time o the ailure, oid i is set to i, the originator o this reerence level, and r i is set to zero. Then, it sends an Update message containing its new height to its neighbors. When a new reerence level is deined, it is higher than any previously deined reerence levels since it is based on the current time. This action results in link reversals that may cause other nodes to lose their last outgoing link. In this manner, the new reerence level is propagated outward rom the point o the original ailure (redirecting links in order to reestablish routes to the leader). This propagation will only extend through nodes, which, as a result o the initial link ailure, have lost all routes to the leader. Fig. 1b shows the state o the network ater the ailure o link ðl; AÞ, and Figs. 1c, 1d, and 1e show the sequence o link reversals perormed by nodes A, B, C, D, and E ollowing the ailure o ðl; AÞ. A node i changes its height under the ollowing ive dierent cases:. Case 1 (propagate). The node has no more outgoing links due to a link reversal ollowing the receipt o an Update packet, and the reerence levels o its neighbors are not equal (or example, nodes B and D in Fig. 1c). It sets its reerence level to largest among all its neighbors and sets i to a value that is lower ( 1) than the o all its neighbors with the maximum level. Formally ð i ; oid i ;r i Þ¼max ð j ; oid j ;r j Þjj N i ; ð i ;iþ¼ min j jj N i =ð j ; oid j ;r j Þ ¼ maxð i ; oid i ;r i Þgg 1;iÞ:

3 98 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 19, NO. 7, JULY 008 Fig. 1. An execution o Malpani s algorithm. (a) t ¼ 0. (b) t ¼ 1. (c) t ¼. (d) t ¼ 3. (e) t ¼ 4. () t ¼ 8. (g) t ¼ 11. (h) t ¼ 13. (i) t ¼ 14. (j) t ¼ 18. (k) t ¼.. Case (relect). The node has lost its outgoing links due to a link reversal ollowing the receipt o an Update packet, and the reerence levels o the neighbors are equal, with r equal to zero (or example, node C in Fig. 1c). The node then relects back the reerence level by setting r i to one and i to zero. The new reerence level, which is reerred to as the relected reerence level, is propagated back toward the node that originally deined the reerence level.. Case 3 (detect). The node has lost its outgoing links due to a link reversal ollowing the receipt o an Update packet, and all o i s neighbors have the same relected reerence level with oid ¼ i. Then, node i has detected a partition. In this case, node i elects itsel as the leader and starts a DAG propagation to inorm other nodes in the new component about the new leader.. Case 4 (generate). The node has lost its last outgoing link due to a link reversal ollowing the receipt o an Update packet, and all o i s neighbors have the same relected reerence level with oid 6¼ i. Because the node did not deine the new reerence level itsel, this is not necessarily an indication o a partitioning o the component. Thereore, the node starts a new reerence level. It sets its reerence level to ðt; i; 0Þ and i to zero, where t is the current time.. Case 5 (merge). The node receives an Update packet rom j such that lid j < lid i. Then, H i ¼ðlid j ; j ; oid i ;r i ; j þ 1;iÞ: Fig. 1 shows an example o executing Malpani s algorithm with time increasing rom Figs. 1a, 1b, 1c, 1d, 1e, 1, 1g, 1h, 1i, 1j, and 1k. In this igure, thick arrows indicate the direction o update messages, and thin arrows represent the constructed DAG. Because o node mobility, node L becomes disconnected rom the rest o the nodes, and the graph in Fig. 1a changes to that shown in Fig. 1b. Node A detects at time t 1 ¼ 1 that it has lost its last outgoing link toward its leader node L; it then deines a new reerence level (that is, re 1 ¼ðt 1 ;A;0Þ) and broadcasts an Update packet to its neighbors. Fig. 1c shows the state o the graph ater nodes B, C, and D have received the Update message sent by A. The reerence level o A, re 1, is now higher than that o its neighbors, so the update message has as eect the reversal o the links to B, C, and D. Nodes B and D execute case 1, and node C executes case. At time t ¼, node F loses its last outgoing link. Thereore, it deines a new reerence level (that is, re ¼ðt ;F;0Þ) and sends an Update message to node G. Fig. 1d depicts the state o the graph at a later time ater E has received re 1 rom nodes B and C and ater G has received re rom node F. In the igure, node E changes its height according to case 1 and sends re 1 to node G, whereas node G takes no action since it still has an outgoing link. In Fig. 1e, node G loses its last outgoing link ollowing the reception o re 1. Thereore, it executes case 1 and sets its reerence level to the largest among all its neighbors (that is, re ).

4 DERHAB AND BADACHE: A SELF-STABILIZING LEADER ELECTION ALGORITHM IN HIGHLY DYNAMIC AD HOC MOBILE NETWORKS 99 Fig.. Time diagram o Malpani s algorithm execution. Fig. 1 shows the state o the graph ater re has been propagated rom node G to node C. Node E, D, B, and A have executed case, and node C has executed case. At time t 3 ¼ 8, node D loses its last outgoing link ðd; AÞ. Thereore, it deines a new reerence level (that is, re 3 ¼ðt 3 ;D;0Þ) and sends an Update message to its neighbor E. The update message has as eect the reversal o the ðd; EÞ link, as shown in Fig. 1g. Fig. 1g shows the state o the graph ater the relected reerence level re has been propagated rom node A to node E. Upon reception o re, node E loses its last outgoing link. As t 3 >t, E sets its reerence level to re 3. In Fig. 1h, re 3 is propagated until it reaches node F and node A. Node F executes case and sets its reerence level to ðt 3 ;D;1Þ. In Fig. 1i, node C executes case and sets its reerence level to ðt 3 ;D;1Þin response to re 3 propagation. Node F propagates the relected reerence level o re 3 toward node D. Fig. 1j shows the state o the graph ater the relected reerence level o re 3 has been propagated back rom nodes F and C toward node D. At time t ¼ 18, node D inds that all its neighbors have the same relected reerence level with oid ¼ D, so it has detected the partition. Then, it executes case 3, elects itsel as leader, and propagates its height in the new component, which results in the creation o D-DAG, as shown in Fig. 1k. To detect network partitioning, a reerence level must pass through all nodes o the component in two phases: 1) orward phase, in which nodes propagate the reerence level with r ¼ 0, and ) backward phase, in which nodes propagate the relected reerence level with r ¼ 1. This leads to a time complexity o OðdÞ, where d is the diameter o the network component. Fig. shows the execution o the example presented in Fig. 1 on a time axis. Solid lines represent the time intervals during which the reerence levels are propagated. Dotted lines represent the remaining time required or the algorithm to complete its execution i no urther link ailures occur. The reerence level re 1 was started at time t 1 ¼ 1 (see Fig. 1b), and it was stopped by node G at time t ¼ 4 (see Fig. 1e) due to the existence o re that was started at time t ¼. Ire has not occurred, the algorithm would detect the partitioning at time t ¼ 7, since the diameter o the component at time t ¼ 1 was d ¼ 3. In the same way, the re propagation that was supposed to terminate at time t ¼ 13 was stopped by re 3 at time t ¼ 11 (Fig. 1g). The re 3 propagation was terminated at time t ¼ 18. Node D, which detected network partitioning, created a new DAG that took 4 units o time to terminate. From the example, we can conclude that each new reerence level spoils all the eorts a leader election made beore detecting network partitioning. The algorithm will never terminate i reerence level generations do not stop. Thereore, the execution o the partition detection algorithm is not bounded, and nodes can be without a leader or undetermined time. 3 THE SELF-STABILIZING LEADER ELECTION ALGORITHM 3.1 Deinitions and Assumptions The network is modeled as a graph G ¼ðU;VÞ, where U represents the set o mobile nodes, and V represents the set o edges. The set o connected nodes is called a network component. The network component to which a node i belongs is denoted by C i. We make the ollowing assumptions about the nodes and the network: 1. Communication links are bidirectional and FIFO. However, we can use the method presented in [16] that allows protocols primarily designed or bidirectional networks to work with unidirectional links.. Each node has a suiciently large receive buer to avoid buer overlow. 3. There is no assumption about the number o nodes, as well as the diameter o the network. The state o a node is deined by the values o its local variables. A coniguration o a distributed system G ¼ðU;V Þ is an instance o the states o its nodes. The set o conigurations o G is denoted as C. A computation o a system G is an ininite sequence o conigurations. Node actions change the global system coniguration. Moreover, several node actions may occur at the same time. The actions o each node i are o the orm: <guard i >!< command i >. The guard < guard i > o each action is a Boolean expression on the state o i and its neighborhood.< command i > representsalistoassignment statements and primitives such as broadcast messages. We assume that the guarded action can be atomically executed: the evaluation o the guard and the execution o the statement are executed in one atomic action. Deinition 1. Legitimate coniguration o leader election. Coniguration is a legitimate coniguration o the leader election problem or a network component C i and only i (i) 8i C9l : lid i ¼ l and C is a DAG with every node i in C except or the leader l has a directed path to l. In this case, the component is said to be in a stable state. Otherwise, it is in an unstable state. Deinition. Sel-stabilizing leader election algorithm. An algorithm is a sel-stabilizing leader election algorithm i any execution starting rom an arbitrary coniguration eventually reaches a legitimate coniguration. Deinition 3. A node in a DAG is said to be uncertain i it loses all its outgoing links due to either link ailures or link reversals, because that node still does not know i a new route toward the leader is ound. Otherwise, it is said to be certain. Deinition 4. The subgraph induced by a set o connected certain nodes is called the certain subgraph. Otherwise, it is called the uncertain subgraph. Deinition 5. A node in an uncertain subgraph that is adjacent to any node in a certain subgraph is called a rontier node, and a node in a certain subgraph that is adjacent to a rontier node is called a border node. 3. Basic Idea As shown in Section, Malpani s algorithm does not stabilize i the generation o reerence levels does not stop. Let us consider the situation where multiple reerence levels are propagating during the same time period. In case 1, the

5 930 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 19, NO. 7, JULY 008 most recent one has always a higher priority than the others. In addition, case 4 chooses to generate a new reerence level because it does not know i the component is partitioned or not. Each new reerence level spoils all the eort made beore to converge to a legitimate state and recover rom earlier link ailures. Moreover, case 5 does not deine a timebased order on the dierent DAG propagations that occur in a component. These situations raise the question o how the algorithm could stabilize in the presence o nonstop concurrent topology changes or how the eect o topological changes that occur during the convergence time could be discarded. As all the reerence level propagations, which have been triggered in response to link ailures, have the same goal (that is, checking i the component is separated rom the current leader), we can intuitively propose to change the criterion used to order reerence levels and consider the oldest reerence level as the highest priority instead o the most recent one. A reerence level re j is higher than another re i i j < i. Roughly speaking, a reerence level will be stopped when it collides with an older one. The less-resh propagation criterion incurs less message overhead, and it is closer to completion than the criterion adopted by Malpani s algorithm. However, this approach is ineicient because we cannot distinguish between concurrent computations and disjoint ones, and hence, we can make alse decisions about network partitioning. Thereore, it is not suicient to only know the time at which the reerence level is generated, because we cannot determine i two reerence levels are still propagating or one o which has been already terminated. Thereore, we propose that each node records its knowledge about the age o the reerence level it meets, that is, the time when the reerence level is started and the time when the node receives this reerence level or the last time. Hence, each node can decide i two reerence levels are disjoint or concurrent. We change case 1 as ollows: I reerence levels are disjoint, the node stops propagating the older reerence levels. Otherwise, it stops propagating the newer reerence levels in avor o the oldest one. In case o merge o components, we also propose to stop the DAG propagation associated with newer leaders in avor o the oldest one. 3.3 Time-Interval-Based Computations In distributed systems, computations have durations. They can be speciied by the instants at which they begin and end. In temporal logic, interval-based temporal logics are more expressive than instant-based ones since they are capable o describing events that occur in the system in time intervals. We could deine an interval as an ordered pair ½t; uš o instants, where t < u. I I ¼½t; uš, we write BeginðIÞ ¼t and EndðIÞ ¼u. This notation allows us to reer to the instants marking the beginning and the end to any interval we reer to. A single time instant t can also be written as an interval ½t; tš. Allen [1] has deined 13 basic binary relations between time intervals, six o which are inverses o the other six: beore and ater, overlaps and overlapped-by, starts and started-by, inishes and inished-by, during and contains, meets and met-by, and equals (see Fig. 3). Two time intervals A and B meet (or B met-by A) i A precedes B, yet there is no period between A and B, and A and B do not overlap []. Let MeetsðA; BÞ be a predicate that evaluates to true i A meets B. The predicate Fig. 3. Possible relationship between intervals and instants. (a) A beore B. (b) A meets B. (c) A overlaps B. (d) A equal B. (e) A starts B. () A inishes B. (g) A during B. BeoreðA; BÞ (or AterðB; AÞ) holds true i there exists another period that spans the time between them. Two time intervals A and B are disjoint i they do not overlap in any way. The predicate OverlapsðA; BÞ (or overlapped-byðb; AÞ) holds true i A starts beore B, and B ends ater A. The predicate EqualsðA; BÞ holds true i A and B both starts and ends at the same time. The predicate DuringðA; BÞ or ContainsðB; AÞ holds true i A has a later starting point and an earlier ending point than B. The predicate StartsðA; BÞ (or Started-byðB; AÞ) holds true i A has the same starting point as B, but it is contained in B. The predicate FinishesðA; BÞ (or F inished-byðb; AÞ) holds true i A has the same ending point as B, but it is contained in B. Ater presenting the relation between intervals, we need now to deine the relations that exist between an instant t and an interval I. Fig. 3h shows the ive possible relations. The predicate Precedesðt; IÞ and Followsðt; IÞ hold true i t < BeginðIÞ and t > EndðIÞ, respectively. The predicate Dividesðt; IÞ holds true i BeginðIÞ <t<endðiþ. Limitðt; IÞ holds true i either t ¼ BeginðIÞ or t ¼ EndðIÞ. In Fig. 3h, we have BeginðAÞ ¼B and EndðAÞ ¼B 4, and the predicates P recedesðb 1 ;AÞ, F ollowsðb 5 ;AÞ, and DividesðB 3 ;AÞ hold true. 4 ALGORITHM DESCRIPTION Each node i maintains two variables: the partition index and the height. The partition index (denoted by PI i )isa 3-tuple (Certain i, Tc i, lid i ). lid i is the identiier o the node considered to be the leader o node i. Certain i, a Boolean variable, whose value is one i node i is in a certain state and zero otherwise. Tc i denotes the time at which the node lid i has started the creation o its DAG. A new partition index is started by node i when it detects a network partitioning. The height H i ¼ðERL i ; i ;id i Þ, where ERL i is the extended reerence level. This latter is a 3-tuple (½Tb i ;Te i Š, oid i, r i ). We call the triple (Tb i, oid i, r i ) a reerence level, and it is denoted by RL i. The variable ½Tb i ;Te i Š is called the reerence level interval o i (denoted by RLI i ) and is the knowledge o node i about the time period during which the reerence level is propagating. The deinitions o oid i, r i, i, and id i are still unchanged.

6 DERHAB AND BADACHE: A SELF-STABILIZING LEADER ELECTION ALGORITHM IN HIGHLY DYNAMIC AD HOC MOBILE NETWORKS 931 Fig. 4. An example o executing the sel-stabilizing leader election algorithm. (a) t ¼ 1. (b) t ¼. (c) t ¼ 3. (d) t ¼ 4. (e) t ¼ 5. () t ¼ 8. (g) t ¼ 9. (h) t ¼ 10. (i) t ¼ Ordering o Time Intervals and Link Orientation Deinition 6. Two time intervals I and J intersect i I \ J 6¼ ;. Deinition 7. Two time intervals I and J-intersect, and we write I T J i there exists a chain o l intersections such that the ollowing statement holds true: ði \ I 1 Þ^ðI 1 \ I Þ^^ðI l \ I l 1 Þ^ðI l 1 \ JÞ: It is easy to show that the binary relation T on a set S o time intervals is an equivalence relation. Deinition 8. For the equivalence relation T, the set o elements o S that are related to a time interval, say, a, os is called the equivalence class o a, and it is denoted by S a such that S a ¼x S : x ¼ a _ a T xg. The set o equivalence classes o the equivalence relation T on a set S orm a partition o S. Deinition 9. S I1 ;S I ; ;S In g is a partition o S i 1. S Ii 6¼;; 1 i n.. S Ii \ S Ij ¼;i S Ii 6¼ S Ij, 1 i, j n. 3. S n S Ii ¼ S. i¼1 Deinition 10. An equivalence class S a is said to be more recent than S b i 8I S a, 8J S b : EndðJÞ < BeginðIÞ. Deinition 11. Let us consider two time intervals I and J, both belonging to the same equivalence class. I is said to be older than J i the ollowing holds: ðmeetsði;jþ_overlapsði;jþ_finished byði;jþ _ ContainsðI;JÞ_ LimitðJ;IÞ_ DividesðJ;IÞÞ: In DAG, a link ði; jþ is oriented rom i to j according to the ollowing conditions: 1. I nodes i and j are both certain and i > j (that is, ðd; AÞ in Fig. 4a).. I both nodes are uncertain, we check their respective RLIs:. I S RLIi is more recent than S RLIj, that is, AterðRLI i ; RLI j Þ holds true (or example, ðb; EÞ in Fig. 4c).. I RLI i and RLI j belong to the same equivalence class and RLI i is older than RLI j (or example, ðg; FÞ in Fig. 4e).

7 93 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 19, NO. 7, JULY 008. I RLI i and RLI j are not related to the same reerence level and Started-by ðrli i ; RLI j Þ holds true.. I RLI i and RLI j are related to the same reerence level and ðr i ¼ 1 ^ r j ¼ 0Þ (or example, ðe; BÞ in Fig. 4).. I RLI i and RLI j are related to the same reerence level and ðr i ¼ r j Þ and StartðRLI i ; RLI j Þ hold true (or example, ðb; EÞ in Fig. 4d and ðf;gþ in Fig. 4).. I EqualsðRLI i ; RLI j Þ holds true and ðoid i ;r i ; i ;id i Þ > ðoid j ;r j ; j ;id j Þ. 3. I node i is uncertain and node j is certain (or example, ða; DÞ in Fig. 4b). 4. Initialization Initially, each node i whose height is null (that is, H i ¼ ð½ ; Š; ; ; ;iþ) can start the construction o a DAG. It sets PI i to ð1;t;iþ and H i to ([0, 0], 0, 0, 0, i), where t is the current local time. Then, it broadcasts a CreateDagðPI i ;H i Þ message to its neighbors. Upon receiving such a message, each node j whose height is null sets PI j to PI i and H j to ð½0; 0Š; oid i ;r i ; i þ 1;jÞ. Multiple DAG constructions can be triggered at the same time. DAG construction is depicted in Algorithm 1. Algorithm 1. DAG construction Action 1: (i wants to be a leader ^H i ¼ null)! 1: PI i :¼ð1;t;iÞ; : H i :¼ð½0; 0Š; 0; 0; 0;iÞ; 3: broadcast CreateDagðPI i ;H i Þ; Action : ði receives CreationðPI j ;H j Þ^H i ¼ nullþ! 1: PI i ¼ PI j ; : H i :¼ð½0; 0Š; oid j ;r j ; j þ 1;iÞ; 3: broadcast CreateDagðPI i ;H i Þ; 4.3 Concurrent Reerence Level Propagation Algorithm consists o two actions. Action 3 shows the reaction o a certain and an uncertain node to link ailures, and Action 4 shows the instructions perormed by a node in response to link reversals. Contrary to Malpani s algorithm, we start a new reerence level only i a certain node loses all its outgoing links. When an uncertain node loses all its outgoing link, it does not need to generate a new reerence level that traverses uncertain subgraphs, which probably have no paths to the leader and have been traversed by previous reerence levels. Instead, it selects one o the existing reerence levels to resume its propagation. This choice avoids incurring more eort in terms o message overhead and time. It helps to quickly detect network partitioning i it has occurred. When a certain node i loses its last outgoing link, it creates a new reerence level. It sets Certain i to zero and ERL i to ð½t; tš;i;0þ. Then, it broadcasts FailureðPI i ;H i Þ to its neighbors. When an uncertain node i loses its last outgoing link, it invokes the HandleUncertainReverse procedure. The procedure distinguishes our conditions. First, i i s neighbors do not all have the same reerence level, it sets RL i to the maximum reerence level among its neighbors. It calculates using the unction max the reerence level interval ðrliþ with the highest priority. This unction determines the most recent equivalence class S, and then, it returns the reerence level with the oldest RLI among the intervals belonging to S. Second, i all neighbors have the same reerence level with r ¼ 0, it relects this reerence level by setting r i to one, it means that the link rom which it is supposed to receive a relected reerence level has been broken. Third, i all neighbors have the same relected reerence level with an originator other than i (that is, no route between i and the originator o the reerence level is available; this situation is likely to happen when a network partitioning occurs in the network component where the relected reerence level is propagating) the node elects itsel as leader and propagates a CreateWeakDagðPI i ;H i ; oldðlid i Þ; oldðtc i ÞÞ message. This propagation constructs what we call a weak DAG. The weak DAG will be explained later in this paper. Fourth, i all neighbors have the same relected reerence level with i as an originator, it detects network partitioning and starts the creation o a new DAG. In Action 4, when node i receives the Failure message rom its neighbor j (that is, a reerence level is propagating), it checks i it still has outgoing links. I so, this reerence level will be stopped. Otherwise, it invokes the HandleUncertainReverse procedure. Fig. 4 shows an example o executing the proposed selstabilizing leader election algorithm on the network in Fig. 1. In Fig. 4a, node A loses at time t ¼ 1 its last outgoing link toward its leader L. Thereore, it deines a new reerence level re 1 ¼ðt 1 ;A;0Þ and broadcasts its height to its neighbors. Fig. 4b shows the state o the graph ater nodes B, C, and D have received the Update message sent by A. Nodes B and D execute condition 1, and node C executes condition. At time t ¼, node F loses its last outgoing link. Thereore, it deines a new reerence level (that is, re ¼ðt ;F;0Þ) and sends an Update message to node G. Fig. 4c depicts the state o the graph ater re 1 has been sent rom nodes B and C to node E. Node E changes its height according to condition 1 and sends its height to G. In Fig. 4d, node G loses its last outgoing link ollowing the reception o re 1 rom node E. Thereore, it executes condition 1 and sets its reerence level to the one with the highest priority among all its neighbors, that is, re 1. In Fig. 4e, node F executes condition and sets its reerence level to ðt 1 ;A;1Þ. Fig. 4 shows the state o the graph ater the relected reerence level re 1 has been propagated rom node F and received by node B. At time t 3 ¼ 8, the uncertain node D loses its last outgoing link ðd; AÞ. Node D executes condition 3, elects itsel as a leader, and creates a weak DAG. In Fig. 4g, node A inds that all its neighbors have the same relected reerence level with oid ¼ A, so it has detected the partition. Then, it executes condition 4 and elects itsel as a leader and propagates its height in the new component, which results in the creation o A-DAG consisting o nodes A, B, and C, as shown in Fig. 4h. Algorithm. Reerence level propagation Action 3: (i loses all its outgoing links)! 1: i ðn i ¼ Þ then : PI i :¼ð1;t;iÞ; 3: H i :¼ð½0; 0Š; 0; 0; 0;iÞ; 4: broadcast CreateDagðPI i ;H i Þ; {i constructs a new DAG} 5: else

8 DERHAB AND BADACHE: A SELF-STABILIZING LEADER ELECTION ALGORITHM IN HIGHLY DYNAMIC AD HOC MOBILE NETWORKS 933 6: i Certain i ¼ 1 then 7: Certain i :¼ 0; 8: ERL i :¼ð½t; tš;i;0þ; 9: i :¼ 0; 10: broadcast FailureðPI i ;H i Þ; 11: else 1: HandleUncertainReverse(); 13: end i 14: end i Action 4: (node i has no outgoing links due to link reversal ollowing reception o F ailureðpi j ;H j ÞÞ! 1: Certain i ¼ 0; : HandleUncertainReverse(); Procedure HandleUncertainReverse() 1: i neighbors do not have the same reerence level {Condition 1} then : RL i :¼RL k jrli k ¼ max RLI j jj N i ; RLI i gg 3: Te i :¼ t; 4: i :¼ min j jj N i and RL j ¼ RL i g 1; 5: broadcast FailureðPI i ;H i Þ; 6: else i all neighbors have the same reerence level with r ¼ 0 {Condition } then 7: ERL i :¼ð½Tb j ;tš; oid j ; 1Þ; 8: i ¼ 0; 9: broadcast FailureðPI i ;H i Þ; 10: else i all neighbors have the same reerence level with r ¼ 1 and oid i 6¼ i {Condition 3} then 11: oldðlid i Þ :¼ lid i ; oldðtc i Þ :¼ Tc i 1: PI i :¼ð1;t;iÞ; 13: H i :¼ð½0; 0Š; 0; 0; 0;iÞ; 14: broadcast CreateWeakDagðPI i ;H i ; oldðlid i Þ; oldðtc i ÞÞ; {i constructs a weak DAG} 15: else i all neighbors have the same reerence level with r ¼ 1 and oid i ¼ i {Condition 4} then 16: PI i ¼ð1;t;iÞ; 17: H i ¼ð½0; 0Š; 0; 0; 0;iÞ; 18: broadcast CreateDagðPI i ;H i Þ; {i constructs a new DAG} 19: end i Algorithm 3. Merging o two network partitions Action 5: ððnode i detects a new neighbor j _ receives CreateDagðPI j ;H j ÞÞ ^ ðlid j 6¼ lid i ÞÞ! 1: i PI j PI i then : PI i :¼ PI j ; 3: H i :¼ð½Tb j ;Te j Š; oid j ;r j ; j þ 1;iÞ; 4: broadcast CreateDagðPI i ;H i Þ; 5: else 6: Stop j-dag propagation 7: end i Action 6: ððnode i receives CreateWeakDagðPI j ;H j ;oldðlid j Þ; oldðtc j ÞÞÞ ^ ðlid j 6¼ lid i ÞÞ! 1: i ððoldðlid j Þ¼lid i ^ oldðtc j Þ¼Tc i Þ^ðcertain j ¼ v1 _ ðcertain i ¼ 0 ^ r i ¼ 0ÞÞÞ then : broadcast FakeLeaderðlid j ;Tc j Þ; 3: else i ðpi j PI i Þ then 4: PI i :¼ PI j ; 5: H i :¼ð½Tb j ;Te j Š; oid j ;r j ; j þ 1;iÞ; 6: broadcast CreateWeakDagðPI i ;H i ; oldðlid j Þ; oldðtc j ÞÞ; 7: else 8: broadcast CreateDagðPI i ;H i Þ; 9: end i Action 7: ðnode i receives FakeLeaderðlid k ;Tc k Þ rom node jþ! 1: i ðlid i ¼ lid k ^ Tc i ¼ Tc k Þ then : PI i :¼ PI j ; 3: H i :¼ð½Tb j ;Te j Š; oid j ;r j ; j þ 1;iÞ; 4: Broadcast FakeLeaderðlid k ;Tc k Þ; 5: end i 4.4 Merging o Multiple Network Partitions Algorithm 3 consists o actions dealing with the propagation o a new leader throughout a network partition. As explained in Section 4.3, the node detecting network partitioning propagates a CreateDag message i it is the originator o the reerence level or a CreateWeakDag message otherwise. In Action 5, when a node i detects the existence o a new network partition or receives a CreateDag message rom node j such that lid i 6¼ lid j, it will adopt lid j as a leader i the partition index o j has a higher priority than that o i, and we write PI j PI i. Deinition 1. PI j PI i ððcertain j > Certain i Þ_ ððcertain j ¼ Certain i Þ^ððTc j ; lid j ÞðTc i ; lid i ÞÞÞÞ, and ðtc j ;lid j ÞðTc i ;lid i ÞðTc j <Tc i Þ_ððTc j ¼Tc i Þ^ðlid j >lid i ÞÞ: By Deinition 1, a node irst checks the value o the Certain variable. It selects the node that is sure to have a directed path toward its leader node, and it is not involved in link reversal actions. Then, it checks the DAG generation time and the leader identiier. The condition PI j >PI i incurs three cases: 1. Node j is certain, and i is uncertain.. Nodes i and j both have the same value o certain, and j s partition is created at a time older than that o i. 3. Nodes i and j both have the same value o certain and the same value o DAG creation time, and lid j > lid i. In Fig. 4g, node A, which detects network partitioning, sets PI A to (1, 9, A). Then, it propagates the CreateDag message. Upon receiving such a message, nodes o the disconnected partition, which are uncertain nodes (or example, nodes B and C in Fig. 4h), adopt A as their leader. I the condition presented in (HandleUncertainReverse: line 10) holds true, node i declares itsel a leader. As i is not the originator o the reerence level, it may happen that this declaration is alse because both node i and the originator o the reerence level are still part o the same network partition. In this case, it creates a weak DAG by generating a CreateWeakDag message that contains, besides its partition index and its height, also the identiier o its previous leader and its previous Tc(or example, node D in Fig. 4g). The weak DAG diers rom the known DAG in the act that its propagation can be stopped by an uncertain node. In Action 6, when an uncertain node receives the CreateWeakDag message rom node j, it irst checks i the condition

9 934 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 19, NO. 7, JULY 008 Fig. 5. Time diagram o the execution o the proposed algorithm. ðððoldðlid j Þ¼lid i ^ oldðtc j Þ¼Tc i Þ^ ðcertain i ¼1 _ðcertain i ¼0 ^ r i ¼ 0ÞÞÞÞ holds true. The irst part o the condition means that nodes lid i and lid j were part o the same DAG, and the second part means that either node i still has a path toward lid i or i has not yet relected its reerence level (that is, the reerence level is in the orward phase). This indicates that network partitioning has not occurred and, hence, the decision o creating a new DAG by lid j was not correct. Node lid j is called in this case a ake leader. Node i then broadcasts a FakeLeader(lid j ;Tc j ) message. I lid j is not a ake leader, node i will adopt lid j as a leader provided that PI j PI i.asd-dag is older than A-DAG, D will be the unique leader o the component as shown in Fig. 4i. In Action 7, each node that inds out that its leader is ake ollowing the reception o a FakeLeader message rom its neighbor j adopts lid j as a leader and broadcasts in turn the FakeLeader message. In this manner, a corrective action will be propagated resulting in deleting the ake leader rom all the nodes. 4.5 Time Diagram o the Execution o the Sel-Stabilizing Leader Election Algorithm Fig. 5 shows a time diagram o the sel-stabilizing leader election algorithm execution related to the example in Fig. 4. The topology change scenario o this example is the same as the one presented in Fig. 1. The reerence level re 1 that starts at time t 1 ¼ 1 blocks the newer reerence level re generated at time t ¼, since their reerence level intervals belong to the same equivalence class. A weak DAG is generated by node D at time t ¼ 8; the network partitioning is detected by node A at time t ¼ 9. The new DAG construction is terminated at time t ¼ 1. A-DAG is deleted when it detects the existence o D-DAG with Tc D ¼ 8. The policy that selects the DAG with the oldest value o time creation helps to block the propagation o any newer DAG created in the same network component. In Malpani s algorithm, the same scenario needs 1 units o time to recover rom three link ailures, detect network partitioning, and construct a leader-oriented DAG, whereas our algorithm needs only 11 units o time. In comparison with Malpani s algorithm, it is obvious that the proposed sel-stabilizing leader election algorithm shows better perormance in terms o convergence time and message overhead. 5 SIMULATION RESULTS In this section, we discuss the perormance o our selstabilizing leader election algorithm compared to Malpani s algorithm by using the GloMoSim simulator []. In our experimental results, each plotted point represents the average o ive executions. We plot the 95 percent conidence interval on the graphs. Our simulation environment is characterized by an area o 1,000 m 1,000 m, with random initial nodes location, a random waypoint mobility model, in which each mobile node randomly selects a location with a random speed uniormly distributed between zero and a certain maximum speed V max and then stays stationary during a pause time o 1 second beore moving to a new random location. The transmission power is set to 1 dbm, which is equivalent to a transmission range o 34 m. We evaluate the perormance o the algorithms using the ollowing three metrics: 1. Fraction o stabilization time. This is the raction o time that a node i has at least a directed path to its leader lid i, and lid i is the leader o the network component, that is, the network component C i is in a stable state.. Convergence time. This is deined as the mean time elapsed between the instant at which the irst topology change occurs in C i and the instant at which C i is again in a stable state. 3. Message overhead. This is deined as the number o messages generated during algorithm execution. Every 1 ms, we monitor the status o the node (that is, stable or unstable). Thus, i the algorithm can converge to a legitimate state within a time t<1ms, the change o the status is not recorded. Figs. 6, 7, and 8 show the three metrics as a unction o V max and or three levels o network densities: low (0 nodes), medium (30 nodes), and high (40 nodes). Fig. 6. Fraction o stabilization time. (a) Malpani s algorithm. (b) Our algorithm.

10 DERHAB AND BADACHE: A SELF-STABILIZING LEADER ELECTION ALGORITHM IN HIGHLY DYNAMIC AD HOC MOBILE NETWORKS 935 Fig. 7. Convergence time. (a) Malpani s algorithm. (b) Our algorithm. Fig. 8. Message overhead. (a) Malpani s algorithm. (b) Our algorithm. We observe in Fig. 6a that Malpani s algorithm shows disastrous results in terms o the raction o stabilization time. As V max increases, the raction o stabilization time decreases. This is due to the act that the number o reerence levels that are triggered during the same time period and the number o merge events also increase, and hence, the algorithm takes more time to converge to a stable state. We also remark that the stabilization time o Malpani s algorithm increases as density increases. The reason or this is that the size o the network component increases, and hence, more nodes may trigger their reerence levels during the same time period. In this case, the algorithm needs more time to recover rom all the ailures that occurred in the component. In Fig. 7a, Malpani s algorithm takes a long time to converge to a stable state than the sel-stabilizing leader election algorithm or the same reasons discussed in reerence to Fig. 6a. The irst observation we draw rom Figs. 6b and 7b is that our sel-stabilizing leader election algorithm outperorms Malpani s algorithm in terms o the raction o stabilization time and convergence time. Each node can have a path to a correct leader over 99 percent o the time, and the convergence time is less than 7 seconds. This is due to the act that reerence levels that are propagated as a result o new link ailures are stopped by the oldest one. In addition, when multiple components concurrently merge, the oldest DAG propagation encompasses new ones. We can conclude that although the network topology changes at high speed and the number o nodes that trigger reerence level propagation and DAG-propagation is high, our algorithm is slightly aected by the variation o mobility and node density. We observe in Figs. 6b and 7b that or high and medium density, the raction o stabilization time and convergence time are one and zero, respectively, when V max is less than 15 m/s. In this case, the size o network components is large, and those components remain connected or longer durations. The occurrence o concurrent topological events is unlikely to happen since node speed is low. The second observation rom the two igures is that or N ¼ 0 and V max < 15, the stabilization time is dierent rom one, and the convergence time is dierent rom zero. This is due to the act that the number o components with a ew nodes is high, and hence, more merge operations occur, which decreases the stabilization time and increases the convergence time. We also observe that or V max > 5, the algorithm under low density shows better results in terms o stabilization time and convergence time than it does under medium density. This can be explained as ollows: when N ¼ 30, large components split up in many components with a ew nodes, and hence, the number o components in the network increases, which leads to more merge operations occurring. On the other hand, or N ¼ 0, the number o components under low or high speed is not much aected. For N ¼ 40, the stabilization time and the convergence time are slightly aected by the variation o mobility because the node density becomes very high, and most o the nodes belong to a large connected component. High node density means that components remain connected or longer durations. Although nodes get disconnected rom their leaders, at high speeds, they are disconnected only or very short durations. We observe in Fig. 8 that our sel-stabilizing algorithm outperorms Malpani s algorithm in terms o message overhead. In Malpani s algorithm, the message overhead increases with N and V max since more topological changes are expected to occur, whereas the sel-stabilizing algorithm discards the eect o new topological changes.

11 936 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 19, NO. 7, JULY PROOF OF CORRECTNESS Beore proving the correctness o the sel-stabilizing leader election algorithm, we will ormally state the deinitions o predicates employed by the proo:. bcast i ðmþ (resp., recv ij ðmþ) is a predicate that is true at the instant when node i broadcasts the message m (resp. i receives a message m). It is alsiied once i terminates, executing the atomic action in which the broadcast is executed.. DeleteDAGðt; idþ is a predicate that is true when the DAG propagation generated by node id at time t is stopped, and then, it is deleted.. I i ðpi i ¼ null ^ H i ¼ nullþ.. P ð8i C i : L i )ð8j C i ;i6¼ j : :L j ÞÞ such that C i is a connected component to which i belongs. P is called the legitimate state.. L i ðlid i ¼ i ^ð8j C i ;j6¼ i : lid j ¼ i ^ j has a directed path toward iþþ. An illegitimate state is deined to be either 1. a set o nodes that do not have a path to any leader or. a set o nodes that have at least a path to a leader node but do not have the correct id in their lid variable. Assuming that each message transmission takes one time unit and each node i starts execution in a state satisying predicate I i, we prove the ollowing theorem: Theorem 1. Ater the occurrence o a topological change, the network component can within a inite time converge to a state satisying predicate P even i urther topological changes occur during the convergence time. The proo or a single topological change can be ound in [1]. In this paper, we analyze the sel-stabilizing leader election or concurrent topology changes as ollows: or each component C i, we start observing the algorithm execution when the irst topology changes occur in C i ðt s Þ. C i ðtþ denotes the component to which i belongs at time t. The observation ends when the algorithm terminates (that is, none o the actions are enabled at any node in C i ðt e Þ at time t e ) and reaches a state satisying the predicate P.Itis obvious that C i changes as time progresses. We consider the ollowing six cases o concurrent topology changes:. concurrent DAG propagations in a network component,. concurrent reerence level propagations that do not partition the network component in which they occur,. concurrent reerence level propagations that partition the network component in which they occur,. concurrent merging o network components,. concurrent merging o network components with concurrent DAG propagations in the components, and. concurrent merging o network components with concurrent reerence level propagations that partition the components. Deinition 13. level i ðkþ in a network component C i is the length o the longest path between nodes k and i, and dist i ðkþ is the shortest path distance rom i to k. Deinition 14. The set o nodes that are l-hop away rom i (denoted by A l i ) is deined as ollows: Al i ¼jjdist iðjþ ¼lg. Deinition 15. The set o nodes that are within l-hop away rom i (denoted by Ui l) is deined as ollows: Ul i ¼jjdist iðjþ lg. Case 1. Let us consider a set o nodes 1 ; ; m, each o which initiates a DAG construction at T 1 ; ;T m, respectively, such that ðt 1 ; 1 ÞðT m ; m Þ. Lemma 1. Concurrent DAG propagations in a network component will collapse in a inite time into a inal one that deines a leader-oriented DAG. Proo. A node i starts DAG propagation by perorming Action 1 or HandleUncertainReverse(line 10, 15). It sets PI i and H i to (1, t i, i) and [0, 0], 0, 0, 0, i), respectively. Then, it broadcasts a CreateDag message. Multiple DAG propagations in a network component implies that ð9j; k C i : lid j 6¼ lid k Þ. Let n be the number o time units ater node 1 has started a DAG creation. We will show by induction on n that P n ðlid i ¼ 1 ^ð8j Ui n 1 g : lid j ¼ 1 ^ j has a directed path toward 1 ÞÞ Basic case: r ¼ 0. Using the deinition o Ui l, U0 1 ¼ 1 g, and lid 1 ¼ 1. Thus, P 0 holds true. Inductive hypothesis. Let us assume that P n holds true or all l<d such that d is the diameter o C i. We will now prove that P nþ1 ðlid i ¼ 1 ^ð8j U nþ1 1 1 g : lid j ¼ 1 ^ j has a directed path toward 1 ÞÞ P n ) 8i8j : j A n 1 ^ i A nþ1 1 \ N j ð1þ ^ bcast j ðcreatedagþ ) recv ij ðcreatedagþ: Statement (1) means that when node j joins 1 -DAG, it broadcasts a CreateDag message; all nodes i that have a connection with j will receive the message ater a unit o time. From (1), it ollows that 8i8j : j A n 1 ^ i A nþ1 1 \ N j ^ ðþ recv ij ðcreatedagþ^h i ¼ null )ðlid i ¼ lid i Þ; 8i8j : j A n 1 ^ i A nþ1 1 \ N j ð3þ ^ recv ij ðcreatedagþ^pi j PI i ) lid i ¼ lid j ^ DeleteDagðTc i ; lid i Þ : By statements () and (3), when the PI j -DAG propagation arrives at node i that is not assigned to any leader, i will be annexed to PI j -DAG. IPI j PI i, PI j will continue its propagation. Otherwise, the DAG propagation o PI j will be stopped. Nodes i and j are certain, lid i ¼ lid j ¼ 1, and H i >H j. Thus, node i has an outgoing link toward j. As node j has a directed path toward i, P nþ1 holds true. Thereore, at time t 1 þ maxdist 1 ðxþjx G 1 g, all nodes will have the correct leader and a path oriented toward 1 and, thus, P holds true. tu Case. Let 1 ; ; k be a set o nodes belonging to l-dag that lose their last outgoing links at t 1 ; ;t k, respectively, and the network component in which these ailures occur remains connected.

12 DERHAB AND BADACHE: A SELF-STABILIZING LEADER ELECTION ALGORITHM IN HIGHLY DYNAMIC AD HOC MOBILE NETWORKS 937 Lemma. All reerence levels that do not partition the component in which they occur will eventually be stopped. Proo. It is easy to show that i the network component is not partitioned ater the generation o concurrent reerence levels, it means that there exists at least one border node that has a direct path to the leader, and hence, all the reerence levels will eventually be stopped. tu Lemma 3. Eventually, within a inite time, network partitioning will be detected, and the disconnected component will deine a new leader-oriented DAG. Proo. A network that is partitioned means that there is no border nodes, and the reerence level must pass through the nodes o the component in two phases. We assume that there exists a set o nodes p ; ; k such that ðp >1 ^ k>pþ, and their respective RLIs belong to the same equivalence class. We can remark that RLI p has the highest priority in this set. We will now consider two cases: Case 3a. I l-dag is partitioned at time t p, p generates a reerence level. As RLI p is the highest priority, it will terminate any new reerence level generated at time t x >t p. Thereore, the network partitioning will be detected at time ðt p þ dþ. Case 3b. l-dag was not partitioned at time t p, but the partitioning occurred at a later time t q. I the propagation o RL p is not stopped during its orward phase, the partition detection algorithm will take OðdÞ time units. By Action 4, any new reerence level RL x generated at time t x >t p will be stopped and deleted by RL p. Otherwise, the propagation o RL p is stopped by a border node m at time t p þ level p ðmþ. At time t q ½tp; tp þ level p ðmþš, a node q loses its last outgoing link, which results in network partitioning. Thereore, it generates a new reerence level. The reerence level RL q will terminate any reerence level belonging to an older equivalence class or generated ater t q. When RL q arrives at node m ater at most ðd level p ðmþþ time units, node m compares RLI p and RLI q. As OverlapsðRLI p ; RLI q Þ holds true, node m stops RL q and resumes the propagation o RL p. RL p needs ðd level p ðmþþ time units to complete the orward phase and another d time units or the backward phase. During this period, any urther ailures will be stopped by RL p. The network partitioning will be detected at ðt q þ 3d level p ðmþþ. Thereore, the partition detection time is upper bounded by Oð3dÞ. By Action 3 and Action 4, it may happen that during partition detection algorithm execution, other nodes that are not the originator o the reerence level detect partitioning and create a weak DAG. The originator in turn creates its DAG. The node with the highest PI will become the unique leader o the disconnected component. tu Case 4. We consider an ininite merging o components C 1 ;C ; with the component C i. We assume that is the requency at which new components merge with C i. X is the average time to send a message over a wireless link, and D is the average diameter o a network component. Lemma 4. I C i has the highest PI, the necessary condition so that the algorithm stabilizes is X< 1. D Proo. When C i merges with a component C x with diameter D x ðx>0þ, acreatedag message is propagated throughout C x. Initially, the component C i is in a stable state. When C 1 merges with C i at time t 1, it terminates the stable period and initiates a new unstable period. At t 1, the average remaining time required so that the CreateDag message traverses the C 1 component is ðx D 1 Þ, since it would take this period o time i no urther merging occurred beyond this instant. As time progresses rom t 1 and the CreateDag message is propagating, the average remaining time required to cover C 1 is reduced at the rate X sec=sec. At time t ½t 1 ;t 1 þ X D 1 Š, a new component C merges with the component C i ðt 1 Þ;C 1 g and orces the convergence time to increase by D. The remaining time continues to decrease until it reaches the instant t m, at which it has traversed the whole network component C i ðt m Þ. This terminates the unstable period and initiates a new stable period. The stable period is terminated at time t mþ1 when C mþ1 merges with C i ðt m Þ. The algorithm is sel-stabilizing i 9m such that the CreateDag message can traverse the component C i ðt m Þ P beore the arrival o C mþ1. Formally, m j¼1 ðd jxþ < t mþ1 t 1. The time between two mergings is 1. X ð P m j¼1 D jþ < m ) mx D<m ) X< 1. The average D convergence time in this case is upper boundedby m. tu Lemma 5. Given a set o components C 1 ;C ; ;C k 1 ;C k ;C i ; C iþ1 ; such that PI 1 PI PI k 1 PI k PI i PI iþ1. The concurrent merging o C i with some or all o these components will terminate within a inite period o time. Proo. When a network component C p merges with C q and PI p >PI q, a CreateDag message will be propagated throughout C p. To calculate the worst case o the convergence time, we assume that C i merges with the components in the ollowing order C k ;C k 1 ; ;C 1. When C i merges with C k at time t k,acreatedag message will be propagated throughout C i, and each node in C i will set its PI i to PI k. Beore this propagation is terminated, the component C k 1 merges at time t k 1 with the component C i ðt k Þ. I no urther merging occurs, the component C i will stabilize within X D i time units. The propagation o PI k 1 will take no more than XðD i þ D k Þ beore the arrival o C k and so on. As the time interval ½Tc 1 ;Tc k Š is inite, the number o network components that have a higher priority than C i is also inite. Assume that C i merges with components that have higher partition indices than its own. The time needed or a node belonging to C i ðt k Þ (that is, a node that does not leave its component) to have the highest partition index is upper bounded by Xðk D i þðk 1Þ D k þðk ÞD k 1 þþd Þ¼XDðkþðk 1Þþþ1Þ, which equals to ð kðkþ1þ X DÞ. Ater this time interval, the component C i will have the highest partition index. By Lemma 4, in the presence o ininite merging, the component C i that has now the highest partition index

13 938 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 19, NO. 7, JULY 008 will stabilize i X< 1, and it will take in the worst case D additional ð m Þ time units. Thus, the average convergence time is upper bounded by ð m þ kðkþ1þ X DÞ. tu Lemma 6. Given a set o components C 1 ;C ; ;C k 1 ;C k ;C i ; C iþ1 ; such that PI 1 PI PI k 1 PI k PI i PI iþ1 and the merging o two components occurs when a new link is ormed between their uncertain nodes. Then, the concurrent merging o C i with some or all o these components will terminate within a inite period o time. Proo. A network component C x may consist o multiple uncertain subgraphs denoted by U x and a unique certain subgraph denoted by S x. We consider that the diameter o an uncertain subgraph U x is denoted by x, and the merging o two components C x and C y occurs when a new link is ormed between their respective uncertain subgraphs U x and U y. Let us assume the execution o the ollowing scenario: When the subgraph U x merges with U y at time t x and PI y >PI x,acreatedag message will be propagated in U x. Ater traversing x hops, the CreateDag message is stopped by a certain node p C x. Node p propagates in turn a CreateDag message that traverses U x and U y until it reaches a certain node q C y. I PI q >PI p, node q triggers a lid q -DAG propagation through U y and C i. From this scenario, the maximum time needed to complete the merge o two components U i and U k is ðð i þ k ÞþD i Þ. Let denote the average diameter o uncertain subgraphs. By Lemma 5, a component C i gets the highest priority index ater the merging with k components. Thereore, it needs ðð4k þ kðkþ1þ DÞXÞ time units. By Lemma 4, ater C i has obtained the PI with the highest priority and in the presence o ininite merging, the algorithm will stabilize i X< 1, and it will take in the worst case an additional D ð m Þ time units. Thus, the average convergence time is upper bounded by ð m kðkþ1þ þð4kþ DÞXÞ. tu Case 5. Let us consider a set o nodes 1 ; ; m belonging to C i, each o which initiates a DAG construction at T 1 ; ;T m, respectively, such that ðt 1 ; 1 Þ ðt m ; m Þ. During DAG propagation, ininite components C 1 ;C ; merge with C i. Lemma 7. I C i has the highest priority index, the algorithm will stabilize i X< 1. Otherwise, it will take ðkðkþ1þ D D XÞ additional time units. Proo. By Lemma 1, the DAG propagation with the highest partition index (that is, ð1;t 1, 1 Þ) stops all other ongoing DAG propagations. The proo o ininite mergings is similar to that presented in Lemma 4. We assume that during 1 -DAG propagation, an ininite sequence o components merges with C i. The algorithm is selstabilizing i 9m such that the CreateDag message can cover the component C i ðt m Þ beore the arrival o C mþ1. Formally, ðd i þ P m j¼1 ðd j XÞ <t mþ1 T 1 Þ,ðD i þ X ð P m j¼1 D jþ < mþ1 Þ)ðmþ1ÞXD <mþ1 ) X< 1. D The average convergence time in this case is upper bounded by mþ1. By Lemma 5, the algorithm needs additional ð kðkþ1þ DXÞ units o time to stabilize i C i merges with components o higher PI. In this case, the average convergence time is upper bounded by ð mþ1 þ kðkþ1þ XDÞ. tu Case 6. We consider the case where concurrent link ailures occurring at nodes 1 ; ; k at t 1 ; ;t k, respectively, leads to the disconnection o a component C i rom l-dag. During reerence level propagations, ininite components C 1 ;C ; merge with C i. Lemma 8. I the disconnected component C i merges only with components o lower partition index, the algorithm will stabilize in worst cases ater an average time o ð mþ1 Þð þ þ 1 Þ. Otherwise, it will take 1 DX ð1 DXÞ ð ðkþðkþ1þ D XÞ additional time units. Proo. Case 6a. C i merges only with components o lower partition index. By Lemma 3, a reerence level RL q that is propagating in C i needs to traverse D i hops to complete the orward phase. I during the orward phase, components o lower priority merge with the disconnected component C i, then the new resulting components will adopt lid i ¼ l as a leader, which is now unreachable. By Lemma 5, a reerence level propagation in a component that has the highest PI while ininite mergings are occurring needs at most ðmþ1þ units o time to cover C i beore the occurrence o the ðm þ 1Þth merging. The backward phase o RL q in Lemma 3 will take at most units o time beore colliding with RL p. At this ðmþ1þ time, RL q will be stopped, and RL p resumes its orward propagation phase. During this phase, components with low priority continue to merge with C i. The average time required to cover C i is calculated as ollows: The diameter o component C i is increased at the rate o D hops/sec. At the end o RL q s backward phase, the diameter o C i is upper bounded by D 0 ¼ð ðmþ1þ DÞ. Thereore, RL p s orward phase needs T 0 ¼ D 0 X time units to traversethis new diameter. During T 0, C i is increased by DT 0 hops, which means that additional T 1 ¼ DXT 0 units o time are needed so that RL p completes its orward phase. In the same way, during T 1, C i s diameter is increased by DT 1 hops and so on. Formally, X 1 T n ¼ m þ 1 X 1 ðdxþ: n¼0 n¼0 Provided that DX < 1, P 1 n¼0 ðdxþ ¼ 1 < 1. Thus, 1 DX the orward phase duration o RL p is P 1 n¼0 T n ¼ð mþ1 Þ. 1 DX The backward phase o RL p will take the same time as the orward one. The time period to detect network partitioning is upper bounded by ð ðmþ1þ ð þ ÞÞ. At the end o 1 DX RL p s backward phase, the diameter o C i becomes D new 0 ¼ D P 1 n¼0 ðt nþ. Thereore, the p -DAG propagation needs T0 new ¼ D new 0 X time units to traverse D new 0 hops.

14 DERHAB AND BADACHE: A SELF-STABILIZING LEADER ELECTION ALGORITHM IN HIGHLY DYNAMIC AD HOC MOBILE NETWORKS 939 During T0 new, C i increases by DT0 new. Using the same method as in the RL p orward phase, the p -DAG propagation in the C i component will terminate ater P 1 n¼0 T n new ¼ ðmþ1 Þ. Thereore, the average convergence ð1 DXÞ time is upper bounded by ð mþ1 Þð þ þ 1 Þ time 1 DX ð1 DXÞ units. Case 6b. C i merges with k components o higher partition index. By Lemma 5, the algorithm needs an additional ð kðkþ1þ DXÞ units o time to stabilize. In this case, the average convergence time is upper bounded by! m þ 1 1 DX þ 1 kðk þ 1Þ ð1 DXÞ þ DX : The previous eight lemmas prove Theorem 1. 7 CONCLUSION In this paper, we have proposed a sel-stabilizing leader election algorithm that can converge to a legitimate state even in the presence o topological changes during convergence time. By deining concurrent and disjoint computations and their corresponding intervals, an older reerence level encompasses any new one belonging to its equivalence class. In the same way, an older DAG propagation encompasses new ones. Simulation results show that the proposed selstabilizing leader election algorithm experiences very optimal results in terms o the raction o stabilization time, convergence time, and message overhead compared to Malpani s algorithm. We have provided a novel observation about sel-stabilization by deining the unstable period by the time period that begins when a component C that contains a node i enters an illegitimate state and terminates when this particular component is again in a legitimate state. By determining the requency at which merging can occur, we have shown that the unstable period is bounded. REFERENCES [1] J.F. Allen, Maintaining Knowledge about Temporal Intervals, Comm. ACM, vol. 6, no. 11, pp , [] J.F. Allen and G. Ferguson, Actions and Events in Interval Temporal Logic, Technical Report TR51, Univ. o Rochester, [3] A.D. Amis, R. Prakash, T.H.P. Vuong, and D.T. Huynh, Maxmin D-Cluster Formation in Wireless Ad Hoc Networks, Proc. IEEE INFOCOM 00, pp. 3-41, 000. [4] N. Asokan and P. Ginzboorg, Key Agreement in Ad Hoc Networks, Computer Comm., vol. 3, no. 17, pp , 000. [5] D.J. Baker and A. Ephremides, The Architectural Organization o a Mobile Radio Network via a Distributed Algorithm, IEEE Trans. Comm., vol. 9, no. 11, pp , [6] E.W. Dijkstra and C.S. Scholten, Termination Detection or Diusing Computations, Inormation Processing Letters, vol. 11, no. 1, pp. 1-4, Aug [7] M. Gerla and J.T.-C. Tsai, Multicluster, Mobile, Multimedia Radio Network, ACM/Baltzer Wireless Networks, vol. 1, no. 3, pp , [8] T.-C. Hou and T.-J. Tsai, An Access-Based Clustering Protocol or Multihop Wireless Ad Hoc Networks, IEEE J. Selected Areas in Comm., vol. 19, no. 7, July 001. [9] E. Kaplan, Understanding GPS. Artech House, tu [10] B. Lehane, L. Dolye, and D. O Mahony, Ad Hoc Key Management Inrastructure, Proc. Int l Con. Inormation Technology: Coding and Computing (ITCC 05), vol., pp , 005. [11] N. Lynch, Distributed Algorithms. Morgan Kaumann, [1] N. Malpani, J.L. Welch, and N. Vaidya, Leader Election Algorithms or Mobile Ad Hoc Networks, Proc. Fourth Int l Workshop Discrete Algorithms and Methods or Mobile Computing and Comm., pp , 000. [13] A.B. McDonald and T.F. Znati, A Mobility-Based Framework or Adaptive Clustering in Wireless Ad Hoc Networks, IEEE J. Selected Areas in Comm., vol. 17, no. 8, pp , Aug [14] D. Mills, Network Time Protocol, Speciication, Implementation and Analysis, Internet drat 1119, RFC, Sept [15] V.D. Park and M.S. Corson, A Highly Adaptive Distributed Routing Algorithm or Mobile Wireless Networks, Proc. IEEE INFOCOM 97, pp , Apr [16] V. Ramasubramanian, R. Chandra, and D. Mosse, Providing a Bidirectional Abstraction or Unidirectional Ad Hoc Networks, Proc. IEEE INFOCOM, 00. [17] C.L. Richard and M. Gerla, Adaptive Clustering or Mobile Wireless Networks, IEEE J. Selected Areas in Comm., vol. 15, no. 7, pp , Sept [18] G.-C. Roman, Q. Huang, and A. Hazemi, Consistent Group Membership in Ad Hoc Networks, Proc. 3rd Int l Con. Sotware Eng. (ICSE 01), pp , 001. [19] K. Römer, Time Synchronization in Ad Hoc Networks, Proc. ACM MobiHoc 01, pp , 001. [0] J. So and N. Vaidya, MTSF: A Timing Synchronization Protocol to Support Synchronous Operations in Multihop Wireless Networks, technical report, Univ. o Illinois, Urbana-Champaign, Oct [1] S. Vasudevan, J. Kurose, and D. Towsley, Design and Analysis o a Leader Election Algorithm or Mobile Ad Hoc Networks, Proc. 1th IEEE Int l Con. Network Protocols (ICNP 04), pp , Oct [] X. Zeng, R. Bagrodia, and M. Gerla, GloMoSim: A Library or Parallel Simulation o Large-Scale Wireless Networks, Proc. 1th Workshop Parallel and Distributed Simulation (PADS 98), pp , Abdelouahid Derhab received the engineer, master s, and PhD degrees in computer science rom the University o Sciences and Technology Houari Boumediene (USTHB), Algiers, Algeria, in 001, 003, and 007, respectively. He is currently an associate researcher in the Department o Computer Engineering, CEntre de Recherche sur l Inormation Scientiique et Technique (CERIST), Algiers. His interest research areas are distributed algorithms in mobile systems, data management, and ad hoc networks. Nadjib Badache received the engineer degree in computer science rom the University o Constantine, Algeria, in 1978 and the master s and PhD degrees rom the University o Sciences and Technology Houari Boummediene (USTHB), Algiers, Algeria, in 198 and 1998, respectively. In 1995, he joined The ADP research group at IRISA, France, where he prepared a PhD thesis on the causal ordering and ault tolerance in a mobile environment. He is currently a proessor in the Computer Science Department, USTHB, where he is also the head o LSI. He is the author o many papers, and he supervised many thesis and research projects. His research interests are distributed mobile systems, mobile ad hoc networks, and security.. For more inormation on this or any other computing topic, please visit our Digital Library at