Fault-Tolerant Real-Time Networks Tom Henzinger UC Berkeley MURI Kick-off Workshop Berkeley, May 2000

Participants Mostafa Ammar (Georgia Tech) Luca de Alfaro (Univ of California, Berkeley) Tom Henzinger (Univ of California, Berkeley) Idit Keidar (MIT) Nancy Lynch (MIT) Kang Shin (Univ of Michigan) Kishor Trivedi (Duke Univ) Avideh Zakhor (Univ of California, Berkeley)

Network Protocols: The Conventional Research Tasks Design Experiment Analysis validatepredict

Network Protocols: Our View of the Research Tasks Design Experiment Analysis validatepredict Theory Practice Formal Modeling Design Methodology

Network Protocols: The Research Issues Rely on weaker assumptions: Dynamic traffic changes Dynamic network changes (e.g. faults) Heterogeneous network properties (e.g. wireless) Heterogeneous collection of protocols Provide stronger guarantees: Reliability (e.g. no packet loss) Real time (e.g. multimedia) Inter-stream and inter-protocol fairness Network stability and utilization Security

Formal Modeling and Analysis: The Algorithmic Approach Model Checking Tool Formal model Desired property Affirmation or Failure scenario State space exploration Decomposition of the analysis Protocol Formal Automatic

Formal Modeling and Analysis: The Algorithmic Approach What we know how to do well: Highly concurrent systems Very large but regular systems (e.g. hardware) Reliability and fairness properties What we don’t know how to do well: Real time “Global” properties (e.g. performance, utilization) Dynamically changing systems Heterogeneous systems Uncertain behavior (probabilistic models) Adversarial behavior (game modes)

Formal Modeling and Analysis: The Algorithmic Approach What helps? Design structure which enables the decomposition of the analysis

Formal Modeling and Analysis: The Algorithmic Approach What helps? Design structure which enables the decomposition of the analysis Examples of design structure: Spatial hierarchy (e.g. process, host, subnet) Temporal hierarchy (e.g. bit, packet, message) Orthogonalize concerns (e.g. syntax, process semantics, communication semantics, timing, probabilities)

Assume-Guarantee Reasoning R < S Sender Receiver Property || has

Assume-Guarantee Reasoning R R < < S S

R R < < S R S S S R < <

R R < < S R S S S R < <

R R < < S S m! a? m! a? m? a! m? a! m?

Assume-Guarantee Reasoning R R < < S R S S RS RS < <

R R -> S R S S RS RS & & & &

Assume-Guarantee Reasoning R R -> S S RS & & & & R R S S R R S S Need Receptiveness!

Decomposing the Analysis We have assume-guarantee methods: Parallel (spatial) composition Reliability properties We need assume-guarantee methods: Sequential (temporal) composition Real-time properties Probabilistic properties (e.g. fault tolerance, performance) Adversarial properties (e.g. security)

Masaccio: A Formal Model for Hierarchical Real-Time Processes Predecessor models and tools: Reactive Modules and Mocha (spatial hierarchy) Hybrid Automata and HyTech (real time) The new model includes: Parallel and sequential composition, arbitrarily nested Real-time behavior

Masaccio: A Formal Model for Hierarchical Real-Time Processes Short-term plan: Assume-guarantee decomposition Model checking algorithms Long-term plan: Stochastic behavior and analysis Adversarial behavior and analysis

Masaccio: A Formal Model for Hierarchical Real-Time Processes Semantics: Process = interface + behaviors Interface (the “statics”): Input and output variables (data) Some of the variables are real-valued clocks Entry and exit locations (control) Behavior (the “dynamics”): Sequence of transitions (instantaneous) and delays (real-valued duration) Variables may change with transitions Clocks change with delays

Masaccio: A Formal Model for Hierarchical Real-Time Processes Syntax: Process = operators applied to atomic processes Operators (six): Parallel and sequential composition Variable and location renaming (connection) Variable and location hiding (abstraction) Atomic processes (two): Atomic discrete process = guarded difference equation Atomic continuous process = guarded differential equation

Masaccio: A Formal Model for Hierarchical Real-Time Processes Example: Send a message every 5 time units. P = hide x in (C+D) /* m: message (output) */ /* x: clock (hidden) */ C: x x’:=1 D: x=5 -> m’:=msg; x’:=0 Behavior: delay of duration 5 followed by transition that sends a message and resets the clock x to 0, followed by delay of duration 5 etc.

Summary of Activities Compositional modeling of hierarchical real-time processes Time, games, and probabilities in model checking Rich APIs for network protocols (Luca de Alfaro)