1. Evaluating and Optimizing Stabilizing Dining Philosophers
Jordan Adamek
Mikhail Nesterenko
Sébastien Tixeuil
Paris, France
September 7-14, 2015

2. Why Evaluate Stabilizing Philosophers
(self-)stabilizing algorithm: eventually behaves correctly even if started from an arbitrary initial state
attractive concept:
does not need initialization
recovers from a fault regardless of its nature once fault stops
challenge: designing and proving correct a self-stabilizing algorithm is challenging: have to examine complete state space
approach:
use high-atomicity model with (relatively) small state space to self-stabilizing algorithm design
automatically transform high-atomicity algorithm into realistic low-atomicity model
transformation can be done using a stabilizing dining-philosophers algorithm
dining-philosophers algorithm – preserves high-atomicity algorithm's correctness
safety: precludes neighbors from executing high-atomicity actions concurrently
liveness: ensures all actions eventually executed
need for evaluation
a large number of self-stabilizing dining philosophers algorithms published in literature
unclear how existing algs compare with each other or perform in practice

3. Results at a Glance
we evaluate five most widely known stabilizing dining-philosophers algorithms
LRA – Cantarell, Datta, Petit (2003)
Fuzzy – Huang (2000)
Transformation – Mizuno, Nesterenko (1998)
Alternator – Kulkarni et al (2005)
Refinement – Nesterenko, Arora (2002)
determine that LRA, Fuzzy, Transformation are incorrect – violate safety
simulate all algorithms, to evaluate
fault-tolerance: average number of safety violations
functional metrics:
latency: average number of states between request and CS response
throughput: average number of CS accesses per action

4. Why Fuzzy, LRA, Transformation Are Incorrect
all use high-atomicity action syntax but have to execute in low atomicity semantics
executing Dining Philosophers solution in high atomicity is not necessary:
actions do not overlap by model assumption
still need correct solution to execute in low-atomicity
in low-atomicity execution, high-atomicity actions may overlap
to analyze overlap, we broke up high-atomicity actions that access neighbors and update local state into:
accessing neighbors actions
updating local state actions
we are able to construct computations where
a process starts with incorrect (obsolete) info on neighbor state
more than one process may enter the CS  violating safety of Dining Philosophers
a process repeatedly gets obsolete neighbor state: may violate CS infinitely often

5. Execution Model & Experiment Setup
direct simulation of action execution
interleaving (centralized), powerset (distributed), synchronous action execution semantics
only interleaving semantics shown, other - similar
experiment setup
100 processes
1000 simulated computations per data point,
each computation is 1000 states
new random graph topology for each computation
example random graph

6. Safety Violations, Load Rate 50%

7. Safety Violations, Fault Rate 50%

8. No Faults, Latency

9. No Faults, Throughput

10. Optimizing Dining Philosophers
between correct algorithms (Refinement and Alternator) – no clear advantage on functional properties
throughput of Alternator better at higher loads, worse at lower
we design Combined Algorithm that estimates load and switches between Refinement and Alternator:
rooted tree
processes report their load up the tree, root estimates load and decides on switch
insensitivity range to mitigate thrashing
for safety – process executes CS only when all neighbors run the same algorithm
we simulate Combined Algorithm, evaluate
fidelity of load detection
speed of switching and
number of switches depending on insensitivity range width

11. Combined Alg, Load Estimation by Root Process

12. Combined Alg, Time to Switch Basic Algorithms
switching from Alternator to Refinement, reverse data is similar

13. Combined Alg, Sensitivity to Load Variations
number of basic alg switches initiated by root node depending on load
interleaving semantics,
various basic alg. switching thresholds around breakeven point load – 60%
number of basic alg switches initiated by root node depending on load

14. Questions? Conclusions algorithm evaluation is important
brings new insights
spurns further research
future research directions
investigate probabilistic convergence of incorrect algorithms
Combined Algorithm may potentially switch between arbitrary algorithms. Is there a universal self-stabilizing algorithm switcher?
Questions?