fault-tolerant real-time networks tom henzinger uc berkeley muri kick-off workshop berkeley, may...
Post on 18-Dec-2015
217 views
TRANSCRIPT
Fault-Tolerant Real-Time Networks
Tom HenzingerUC Berkeley
MURI Kick-off WorkshopBerkeley, May 2000
Participants
• Mostafa Ammar (Georgia Tech)• Luca de Alfaro (Univ of California, Berkeley)• Tom Henzinger (Univ of California, Berkeley)• Idit Keidar (MIT)• Nancy Lynch (MIT) • Kang Shin (Univ of Michigan)• Kishor Trivedi (Duke Univ)• Avideh Zakhor (Univ of California, Berkeley)
Network Protocols: The Conventional Research
Tasks
Design
Experiment
Analysis
validate
predict
Network Protocols: Our View of the Research Tasks
Design
Experiment
Analysis
validate
predict
Theory
Practice
Formal Modeling
Design Methodolog
y
Network Protocols: The Research Issues
Rely on weaker assumptions:• Dynamic traffic changes • Dynamic network changes (e.g. faults) • Heterogeneous network properties (e.g. wireless) • Heterogeneous collection of protocols
Provide stronger guarantees:• Reliability (e.g. no packet loss)• Real time (e.g. multimedia)• Inter-stream and inter-protocol fairness• Network stability and utilization• Security
Formal Modeling and Analysis:
The Algorithmic Approach
Model Checking Tool
Formal model
Desired property
Affirmation or Failure scenario
State space exploration
Decomposition of the analysis
Protocol
• Formal• Automatic
Formal Modeling and Analysis:
The Algorithmic Approach What we know how to do well:• Highly concurrent systems • Very large but regular systems (e.g. hardware) • Reliability and fairness properties
What we don’t know how to do well:• Real time• “Global” properties (e.g. performance,
utilization) • Dynamically changing systems • Heterogeneous systems • Uncertain behavior (probabilistic models)• Adversarial behavior (game modes)
Formal Modeling and Analysis:
The Algorithmic Approach What helps? Design structure which enables the decomposition of
the analysis
Formal Modeling and Analysis:
The Algorithmic Approach What helps? Design structure which enables the decomposition of
the analysis
Examples of design structure:• Spatial hierarchy (e.g. process, host, subnet)• Temporal hierarchy (e.g. bit, packet, message) • Orthogonalize concerns (e.g. syntax, process
semantics, communication semantics, timing, probabilities)
Assume-Guarantee Reasoning
R <S
Sender Receiver Property|| has
Assume-Guarantee Reasoning
R R< <S S
Assume-Guarantee Reasoning
R R< <S
R
S
S
S
R<
<
Assume-Guarantee Reasoning
R R< <S
R
S
S
S
R<
<
Assume-Guarantee Reasoning
R R< <S S
m! a?
a?
m! a? m? a!
m? a!
m?
Assume-Guarantee Reasoning
R R< <S
R
S
S
R S
RS <
<
Assume-Guarantee Reasoning
R R->S
R
S
S
R S
RS ->
->
&
&
&
&
Assume-Guarantee Reasoning
R R->S S
RS ->
->
&
&
&
&
R
R
S
S
RR
S
S
Need Receptiveness!
Decomposing the Analysis
We have assume-guarantee methods:• Parallel (spatial) composition • Reliability properties
We need assume-guarantee methods:• Sequential (temporal) composition• Real-time properties• Probabilistic properties (e.g. fault tolerance,
performance) • Adversarial properties (e.g. security)
Masaccio:A Formal Model for Hierarchical Real-Time
Processes
Predecessor models and tools:• Reactive Modules and Mocha (spatial hierarchy)• Hybrid Automata and HyTech (real time)
The new model includes:• Parallel and sequential composition, arbitrarily
nested • Real-time behavior
Masaccio:A Formal Model for Hierarchical Real-Time
Processes
Short-term plan: • Assume-guarantee decomposition • Model checking algorithms
Long-term plan:• Stochastic behavior and analysis• Adversarial behavior and analysis
Masaccio:A Formal Model for Hierarchical Real-Time
Processes Semantics: Process = interface + behaviors
Interface (the “statics”): • Input and output variables (data)• Some of the variables are real-valued clocks • Entry and exit locations (control)
Behavior (the “dynamics”):• Sequence of transitions (instantaneous) and delays (real-
valued duration)• Variables may change with transitions• Clocks change with delays
Masaccio:A Formal Model for Hierarchical Real-Time
Processes Syntax: Process = operators applied to atomic processes
Operators (six):• Parallel and sequential composition• Variable and location renaming (connection)• Variable and location hiding (abstraction)
Atomic processes (two):• Atomic discrete process = guarded difference equation• Atomic continuous process = guarded differential equation
Masaccio:A Formal Model for Hierarchical Real-Time
Processes Example:Send a message every 5 time units.
P = hide x in (C+D) /* m: message (output) */ /* x: clock (hidden) */
C: x<5 -> x’:=1 D: x=5 -> m’:=msg; x’:=0
Behavior: delay of duration 5 followed by transition that sends a message and resets the clock x to 0, followed by delay of duration 5 etc.
Summary of Activities
• Compositional modeling of hierarchical real-time processes
• Time, games, and probabilities in model checking
• Rich APIs for network protocols (Luca de Alfaro)