Simple Representative Instantiations for Multicast Protocols
چکیده
We present a formal model for multicast network protocols working on arbitrary tree structures. We give sufficient conditions under which correctness of the protocol for all structures reduces to correctness for the structures with at most one layer of internal nodes. If additional conditions hold, we can reduce further to correctness for one single structure. All these results can be applied to (an abstract version of) the Pragmatic General Multicast protocol. In the last years, much effort has been devoted to the verification of parameterised distributed systems, i.e., distributed systems designed to work correctly independently of the number of processes taking part in them. Classical examples of these systems are distributed algorithms for leader election, byzantine agreement, or distributed termination, and communication protocols, like cache coherence or network protocols. In this paper we study multicast network protocols working on tree structures.1 In these protocols, data are exchanged between a sender (the root of the tree) and several receivers (the leaves) via network elements (the internal nodes). Messages flowing from sender to receivers can be multicasted, i.e., simultaneously sent to several successors. Examples of such multicast network protocols are PGM (Pragmatic General Multicast) [S+00] and LMS (Light-weight Multicast Services) [PPV]. Verifying a property φ of a parameterised system consists of checking that φ for all possible structures (in our case, for all possible trees). This may be difficult, and so a common approach is to first reduce the task to checking φ for a restricted class of structures (see for instance [EN95]). This is also the approach of this paper. We first provide a general formal model for multicast networks. The only assumption is that messages can overtake other messages and can get lost, but cannot be duplicated. This is a reasonable assumption for protocols in which channels are just an abstraction for a routing mechanism that may send different messages—or different fragments of the same message—through various routes, as in the PGM and LMS protocols. For protocols in which messages cannot overtake others or get lost, the assumption overapproximates the behaviour of the protocol. In this case, correctness in our model still implies correctness of 1 Actually, these protocols run on arbitrary networks, but use a distribution tree to broadcast messages. We assume that this tree has already been established. H. Garavel and J. Hatcliff (Eds.): TACAS 2003, LNCS 2619, pp. 128–143, 2003. c © Springer-Verlag Berlin Heidelberg 2003 Simple Representative Instantiations for Multicast Protocols 129 the protocol. We define a notion of simulation that preserves stuttering-invariant linear-time properties, i.e., if the simulating structure satisfies the property, then the simulated structure also satisfies it. Equipped with this formal setting, we identify general sufficient conditions for a protocol P to be collapsable, meaning that a property holds for all instantiations N (P ) of P if and only if it holds for the set of instantiations N 1(P ) with at most one level of internal elements. We prove that for every instantiation T in N (P ) there is an instantiation T ′ in N 1(P ) that simulates T .2 Then, all instantiations in N 1(P ) satisfy φ if and only if all instantiations in T ∈ N (P ) satisfy φ, because simulation preserves properties and N 1(P ) ⊆ N (P ). In particular, our conditions are satisfied by network elements that only perform ‘forwarding’, i.e., only forward messages down from the parent to all children, and up from some child to the parent. Hence, our result can be applied to telecommunication protocols that do not assume that router support can be used and that use a fixed distribution tree. We show that they are also satisfied by the PGM protocol, where network elements have a much richer functionality, which is used to make communication between the sender and receivers more reliable and efficient. While the collapse of N (P ) to N 1(P ) removes the problem of dealing with different tree topologies, it still leaves us with an infinite number of possible instantiations. This cannot be avoided as long as more receivers can generate more behaviour. However, we prove that if the number of different messages that can circulate is finite and receivers and network elements can repeatedly send the same message upwards, then the verification task can be further reduced: Given a property φ, all instantiations of N 1(P ) satisfy φ if and only if one single universal instantiation U , which depends on Φ. Again, we prove that if the number of messages in the PGM protocol is bounded, then the result can be applied, and the protocol has a universal instantiation. The paper is structured as follows. In section 1 we introduce (a version of) the PGM protocol, in order to introduce network protocols and have a rich running example for our definitions and results. Section 2 contains our formal model. Our notions of property and simulation are given in Section 3. Section 4 presents the sufficient conditions for a network to be collapsable. This section is divided into two parts; the first part deals with the special case, in which network elements can only forward messages, and the second deals with the general case. The section also shows that the PGM protocol satisfies the conditions. Finally, section 5 presents the universal instance that can simulate any other instantiation of a collapsable protocol, assuming that the number of messages is finite. The paper is accompanied by a technical report [EM02] which contains full proofs. 2 Notice that we always speak of instantiations of the same protocol. Given a protocol P , one can always find another protocol P ′ such that every T ∈ N (P ) is simulated by some T ′ ∈ N (P ′) by making the sender, receiver and internal processes more complicated. 130 J. Esparza and M. Maidl