fault-tolerant real-time networks tom henzinger uc berkeley muri kick-off workshop berkeley, may...

24
Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Post on 18-Dec-2015

217 views

Category:

Documents


2 download

TRANSCRIPT

Page 1: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Fault-Tolerant Real-Time Networks

Tom HenzingerUC Berkeley

MURI Kick-off WorkshopBerkeley, May 2000

Page 2: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Participants

• Mostafa Ammar (Georgia Tech)• Luca de Alfaro (Univ of California, Berkeley)• Tom Henzinger (Univ of California, Berkeley)• Idit Keidar (MIT)• Nancy Lynch (MIT) • Kang Shin (Univ of Michigan)• Kishor Trivedi (Duke Univ)• Avideh Zakhor (Univ of California, Berkeley)

Page 3: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Network Protocols: The Conventional Research

Tasks

Design

Experiment

Analysis

validate

predict

Page 4: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Network Protocols: Our View of the Research Tasks

Design

Experiment

Analysis

validate

predict

Theory

Practice

Formal Modeling

Design Methodolog

y

Page 5: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Network Protocols: The Research Issues

Rely on weaker assumptions:• Dynamic traffic changes • Dynamic network changes (e.g. faults) • Heterogeneous network properties (e.g. wireless) • Heterogeneous collection of protocols

Provide stronger guarantees:• Reliability (e.g. no packet loss)• Real time (e.g. multimedia)• Inter-stream and inter-protocol fairness• Network stability and utilization• Security

Page 6: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Formal Modeling and Analysis:

The Algorithmic Approach

Model Checking Tool

Formal model

Desired property

Affirmation or Failure scenario

State space exploration

Decomposition of the analysis

Protocol

• Formal• Automatic

Page 7: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Formal Modeling and Analysis:

The Algorithmic Approach What we know how to do well:• Highly concurrent systems • Very large but regular systems (e.g. hardware) • Reliability and fairness properties

What we don’t know how to do well:• Real time• “Global” properties (e.g. performance,

utilization) • Dynamically changing systems • Heterogeneous systems • Uncertain behavior (probabilistic models)• Adversarial behavior (game modes)

Page 8: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Formal Modeling and Analysis:

The Algorithmic Approach What helps? Design structure which enables the decomposition of

the analysis

Page 9: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Formal Modeling and Analysis:

The Algorithmic Approach What helps? Design structure which enables the decomposition of

the analysis

Examples of design structure:• Spatial hierarchy (e.g. process, host, subnet)• Temporal hierarchy (e.g. bit, packet, message) • Orthogonalize concerns (e.g. syntax, process

semantics, communication semantics, timing, probabilities)

Page 10: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Assume-Guarantee Reasoning

R <S

Sender Receiver Property|| has

Page 11: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Assume-Guarantee Reasoning

R R< <S S

Page 12: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Assume-Guarantee Reasoning

R R< <S

R

S

S

S

R<

<

Page 13: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Assume-Guarantee Reasoning

R R< <S

R

S

S

S

R<

<

Page 14: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Assume-Guarantee Reasoning

R R< <S S

m! a?

a?

m! a? m? a!

m? a!

m?

Page 15: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Assume-Guarantee Reasoning

R R< <S

R

S

S

R S

RS <

<

Page 16: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Assume-Guarantee Reasoning

R R->S

R

S

S

R S

RS ->

->

&

&

&

&

Page 17: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Assume-Guarantee Reasoning

R R->S S

RS ->

->

&

&

&

&

R

R

S

S

RR

S

S

Need Receptiveness!

Page 18: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Decomposing the Analysis

We have assume-guarantee methods:• Parallel (spatial) composition • Reliability properties

We need assume-guarantee methods:• Sequential (temporal) composition• Real-time properties• Probabilistic properties (e.g. fault tolerance,

performance) • Adversarial properties (e.g. security)

Page 19: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Masaccio:A Formal Model for Hierarchical Real-Time

Processes

Predecessor models and tools:• Reactive Modules and Mocha (spatial hierarchy)• Hybrid Automata and HyTech (real time)

The new model includes:• Parallel and sequential composition, arbitrarily

nested • Real-time behavior

Page 20: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Masaccio:A Formal Model for Hierarchical Real-Time

Processes

Short-term plan: • Assume-guarantee decomposition • Model checking algorithms

Long-term plan:• Stochastic behavior and analysis• Adversarial behavior and analysis

Page 21: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Masaccio:A Formal Model for Hierarchical Real-Time

Processes Semantics: Process = interface + behaviors

Interface (the “statics”): • Input and output variables (data)• Some of the variables are real-valued clocks • Entry and exit locations (control)

Behavior (the “dynamics”):• Sequence of transitions (instantaneous) and delays (real-

valued duration)• Variables may change with transitions• Clocks change with delays

Page 22: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Masaccio:A Formal Model for Hierarchical Real-Time

Processes Syntax: Process = operators applied to atomic processes

Operators (six):• Parallel and sequential composition• Variable and location renaming (connection)• Variable and location hiding (abstraction)

Atomic processes (two):• Atomic discrete process = guarded difference equation• Atomic continuous process = guarded differential equation

Page 23: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Masaccio:A Formal Model for Hierarchical Real-Time

Processes Example:Send a message every 5 time units.

P = hide x in (C+D) /* m: message (output) */ /* x: clock (hidden) */

C: x<5 -> x’:=1 D: x=5 -> m’:=msg; x’:=0

Behavior: delay of duration 5 followed by transition that sends a message and resets the clock x to 0, followed by delay of duration 5 etc.

Page 24: Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Summary of Activities

• Compositional modeling of hierarchical real-time processes

• Time, games, and probabilities in model checking

• Rich APIs for network protocols (Luca de Alfaro)