Alexander I. Tomlinson

On the Fly Testing of Regular Patterns in Distributed Computations

A class of properties of distributed computations is described and an algorithm which detects them is presented. This class of properties called regular patterns allows the user to specify an expected (or unwanted) behavior of a computation as sequences of relevant events (or as sequences of local predicates that must be successively verified). The sequences are defined by a finite state automaton (hence the name regular patterns) A computation verifies the property if and only if one of its causal paths matches a sequence.

An algorithm for minimally latent global virtual time

Global virtual time (GVT) is used in distributed simulations to reclaim memory, commit output, detect termination, and handle errors. It is a global function that is computed many times during the course of a simulation. A small GVT latency (delay between its occurrence and detection) allows for more efficient use of resources. We present an algorithm which minimizes the latency, and we prove its correctness. The algorithm is unique in that a target virtual time (TVT) is predetermined by an initiator who then detects when GVT ≥ TVT. This approach eliminates the avalanche effect because the collection phase is spread out over time, and it allows for regular and timely GVT updates. The algorithm does not require messages to be acknowledged, which significantly reduces the message overhead of the simulation. One possible application is with interactive simulators, where regular and timely updates would produce output that is up to date and appears smooth.

Monitoring Functions on Global States of Distributed Programs

The domain of a global function is the set of all global states of an execution of a distributed program. We show how to monitor a program in order to determine if there exists a global state in which the sumx1+x2+ \cdots +xNexceeds some constantK, wherexiis defined in processi. We examine the cases wherexiis an integer variable forN= 2 and wherexiis a boolean variable for generalN. For both cases we provide algorithms, prove their correctness, and analyze their complexity.

Using induction to prove properties of distributed programs

Proofs of distributed programs are often informal due to the difficulty of developing formal proofs. Properties of distributed programs are often stated using Lamports causally-precedes relation and its complement, not-causally-precedes. Properties that involve the causally-precedes relation are fairly straight forward to prove using induction. However, properties that involve not-causally-precedes are quite difficult to prove. Such properties are common since predicates on the global state of a system implicitly use the not-causally-precedes relation. This paper presents a method of induction on the not-causally-precedes relation and demonstrates the technique by formally proving a variant of the well known algorithm for maintaining a vector clock.<<ETX>>

Observation of Software for Distributed Systems with RCL

Program observation involves formulating a query about the behavior of a program and then observing the program as it executes in order to determine the result of the query. Observation is used in software development to track down bugs and clarify understanding of a programs behavior, and in software testing to ensure that a program behaves as expected for a given input set. RCL is a recursive logic built upon conjunctive global predicates. Computational structures of common paradigms such as butterfly synchronization and distributed consensus can be expressed easily in RCL. A nonintrusive decentralized algorithm for detecting RCL predicates is developed and proven correct.

Expressing and detecting control flow properties of distributed computations

Properties of distributed computations can be either on their global states or on their control flows. This paper addresses control flow properties. It first presents a simple yet powerful logic for expressing general properties on control flows, seen as sequences of local states. Among other properties, we can express invariance, sequential properties (20 satisfy such a property a control flow must match a pattern described as a word on some alphabet) and non-sequential properties (these properties are on several control flows at the same time). A decentralized detection algorithm for properties described by this logic is then presented. This algorithm, surprisingly simple despite the power of the logic, observes the underlying distributed computation, does not alter its control flows and uses message tags to carry detection-related information.

Using the causal domain to specify and verify distributed programs

Abstract. A system for specification and proof of distributed programs is presented. The method is based directly on the partial order of local states (poset) and avoids the notions of time and simultaneity. Programs are specified by documenting the relationship between local states which are adjacent to each other in the poset. Program properties are defined by stating properties of the poset. Many program properties can be expressed succinctly and elegantly using this method because poset properties inherently account for varying processor execution speeds. The system utilizes a proof technique which uses induction on the complement of the causally precedes relation and is shown to be useful in proving poset properties. We demonstrate the system on three example algorithms: vector clocks, mutual exclusion, and direct dependency clocks.

Causality versus time: how to specify and verify distributed algorithms

This paper presents and advocates a method for formally specifying and verifying distributed programs. The method, which is based on the partial order of local states generated during execution, avoids the notion of time or physical global state. Programs are specified by documenting the relationship between states which are adjacent to each other in the partial order. Program properties are proven using induction on the happens-before relation and its complement. The technique is illustrated by specifying and proving Lamports algorithm for mutual exclusion.<<ETX>>