Design of Distributed Systems

(1)

Created by XMLmind XSL-FO Converter.

Design of Distributed Systems

Melinda Tóth, Zoltán Horváth

(2)

Design of Distributed Systems

Melinda Tóth, Zoltán Horváth Publication date 2014

Supported by TÁMOP-4.1.2.A/1-11/1-2011-0052.

(3)

iii

Chapter 1. Lecture 1

1. Syllabus

1.1. Syllabus

• Dining/drinking philosophers

• Distributed problems

• Formal specification and properties of distributed systems

• Safety and progress properties of distributed programs

• Verification of safety critical properties

• Program compositions from components with proved properties

• Computing the value of an associative function

2. Motivation

2.1. Motivation

Motivation for using formal methods:

• safety critical applications

• safe application of software components

• primary goal: sound concepts about distributed and parallel programs

3. Literature

3.1. Literature 1.

• Chandy, K.M., Misra, J.: Parallel Program Design - A Foundation. Addison-Wesley, 1989.

• Misra, J.: A Discipline of Multiprogramming - Programming Theory for Distributed Applications. Springer, 2001.

• Horváth Z.: Parallel asynchronous computation of the values of an associative function. Acta Cybernetica, Vol.12, No. 1, Szeged (1995) 83-94.

• Horváth Z.: The Formal Specification of a Problem Solved by a Parallel Program – a Relational Model.

• Fóthi Á.- Horváth Z.- Kozsik T.: Parallel Elementwise Processing – A Novel Version. Annales Uni. Sci.

Budapest de R. Eötvös Nom. Sectio Computatorica (1996).

• Horváth Z.- Kozsik T.- Venczel T.: On Composing Problems and Parallel Programs. In: Paakki J., ed., Proceedings of the Fifth Symposium on Programming Languages and Software Tools, Jyväskylä, Finland, June 7-8, 1997 (1997) Report C-1997-37, University of Helsinki, 1-12.

• Horváth Z.- Kozsik T.- Venczel T.: Parallel Programs Implementing Abstract Data Type Operations. Pure Mathematics and Applications (PU.M.A.)., Volume 11 (2000), Number 2. pp. 293-308.

(12)

Lecture 1

4. Introduction

4.1. Properties of the formal model 1.

We need a formal model, which is appropriate for specification of problems and developing the solutions of problems in case of parallel and distributed systems.

4.2. Properties of the formal model 2.

The introduced model

• is an extension of a relational model of nondeterministic sequential programs,

• provides tools for stepwise refinement of problems, in a functional approach,

• uses the concept of iterative abstract program of UNITY,

• the concept of solution is based on the comparison of the problem as a relation and the behaviour relation of the program.

4.3. Dining philosophers

States:

• thinking: t

(13)

Lecture 1

3

• forks in hands: f

• eating: e

• at home: h

4.4. Problem specification (requirements)

:

• unless:

• ensures:

• inevitable leads-to:

• invariant:

• fixed point:

• termination:

(14)

Lecture 1

Help: thinking: t, forks in hands: f, eating: e, at home: h

4.5. Execution model

, if .

Abstract execution model

• No control flow, free processors select assignments asynchronously

4.6. Program, Solution

, if .

Program

• scheduling, processes, location, communication infrastructure, language Solution

• Specification requirements are satisfied by program properties

4.7. Example

, if .

Example

• C/PVM PC-cluster (Parallel Virtual Machine)

• Erlang VM cluster

4.8.

• The notion of the state space makes it possible to define the semantical meaning of a problem independently of any program.

• The generalized concept of a problem is applicable for cases in which termination is not required but the behaviour of the specified system is restricted by safety and progress properties.

• The solution of a problem may be a sequential program, a parallel one, or even a program built up from both sequential and parallel components.

(15)

5

Chapter 2. Lecture 2

1. Example

1.1. An Example: sorting

1.2. An Implementation: Sorting

A valid implementation: the code for the i-th processor:

loop

< lock a(i) and a(i+1) >

x := a(i);

y := a(i+1);

if x > y then a(i+1):=x;

a(i):= y;

end if;

< unlock a(i) and a(i+1) >

end loop;

processes.

1.3. An Implementation: Sorting

A sequential program:

loop

for i=1 to n-1 do x := a(i);

y := a(i+1);

if x > y then a(i+1):=x;

a(i):= y;

end if;

end for end loop

2. Basic Concepts of the Relational Model

2.1. Concepts

A programming model defines

• the semantics of problems and programs

• operations for problem and program constructions

• when a program solves a program.

Relational model:

• the elements of the semantic domain are relations

(16)

Lecture 2

2.2. Relations

• An arbitrary subset of a direct product of sets is called a relation.

• Let where and are arbitrary sets. The domain of the relation is defined by

2.3. State Space

• Let is a finite or numerable set.

• The set is called state space, the sets are called type value sets.

• The projections are called variables.

• is the set of the finite sequences of the points of the state space and the set of the infinite sequences.

• Let .

• A statement is a subset of the direct product .

2.4. Statements and Effect Relation

• The effect relation of a statement is denoted by .

• The effect relation expresses the functionality of the statement.

• .

2.5. Example

var i,j : integer;

j:=2;

while i <> 5 loop i:=i+j

end loop

• State space: ,

• variables: ,

• seq. program:

,

, etc.

• effect relation: .

2.6. Partial Function and Logical Relation

(17)

Lecture 2

7

• A relation is called a partial function, if for all the set has at most one element. If then is a function.

• If is a relation, where is an arbitrary set and is the set of the logical values, then is called a logical relation.

2.7. Truth Set

• The truth set of the logical function is defined as

• The logical functions are defined by their truth

sets. .

2.8. Transitive Disjunctive Closure

• The power-set (set of subsets) of set is denoted by .

• relation is the transitive disjunctive closure of relation , if

is the smallest relation, for which holds:

(18)

Lecture 2

•

• if and , then

• for any numerable set : .

2.9. Example TDC Relation

, ,

,

(19)

9

Chapter 3. Lecture 3

1. Problem

1.1. Problem

• The problem is defined as a set of specification relations.

• Every specification relation is defined over the powerset of the state space.

• Let be logical functions.

• We define

• and

•

1.2. Specification Relations

• - ( stable unless ),

• - ( ensures -t),

• - ( is inevitable from ),

• , - (fixed point is inevitable from ),

• - ( holds in any fixed point),

• - ( is invariant),

• ( initially).

1.3. Example

• , .

• According to specification requirement the program is enabled to change state to

state only.

• According to the specification relation the variable is non-decreasing and can be increased one by one.

(20)

Lecture 3

1.4. Problem Definition

• Let be a state space and let be a finite or numerable set.

• The relation , where

is called a problem defined over the state space .

• is called the parameter space of the problem.

Two relations expressing boundary properties and five relations expressing transition properties are associated to every point of set .

1.5. Notation

• Let denote an arbitrary element of the domain of the problem.

• Let denote an element of .

• The components of are denoted by and by

respectively.

• If then we use instead of in the indices for the sake of simplicity.

1.6. Notation

•

(21)

Lecture 3

11

1.7. Example – Value of a Function

, .

2. Abstract Parallel Program

2.1. Abstract parallel program

The abstract program is a relation

• generated by a set of conditional assignments;

• assignments are selected nondeterministically,

• executions of different processors are fairly interleaved.

• a fixed point is said to be reached in a state, if any statement in that state leaves the state unchanged.

2.2. General Assignment

• A statement over the state space is called empty and termed , if

.

• Let , , where .

• The statement is a general assignment defined by , if

•

(22)

Lecture 3

.

2.3. Example

• x,y : N,

• x,y := x+y, x-y,

• ,

• F(2,3)=?, F(3,2)=?

2.4. Extension

• We extend the domain of a relation for the whole state space in the following way:

• ,

• where .

• Let .

• The relation is the extension of for the truth set of condition , i.e.,

• , if and

• , otherwise.

• .

2.5. Conditional Assignment

• Let be an assignment, for which .

• This kind of (simultaneous, nondeterministic) assignment is called a conditional assignment, if .

• We denote the conditional assignment the following way: , if .

• Simultaneous, nondeterministic, conditional assignment: , if

, if .

• Abbreviation:

2.6. Example – Abstract Program

(23)

Lecture 3

13

, if

• Atomicity:

• if no atomicity:

• there is no state, when is 6.

(24)

Chapter 4. Lecture 4

1. Reminder

1.1. Problem

• The problem is defined as a set of specification relations.

• Every specification relation is defined over the powerset of the state space.

• Let be logical functions.

• We define

• and

•

1.2. Abstract Parallel Program

The abstract program is a relation

• generated by a set of conditional assignments;

• assignments are selected nondeterministically,

• executions of different processors are fairly interleaved.

• a fixed point is said to be reached in a state, if any statement in that state leaves the state unchanged.

1.3. Example

, if

2. Semantics of the Abstract Program

2.1. State Transition Trees

• Let be an ordered pair of a conditional assignment and of a nonempty, finite set of conditional assignments, such that

• ,

• where , .

• The semantics of the abstract program is defined as a binary relation which associates equivalence classes of correctly labeled state transition trees to the points of the state space.

2.2. State Transition Trees

• The labeled state transition trees are generated by the ordered pair

(25)

Lecture 4

15

• of the effect relation of the initial assignment and

• of the UP(S) disjoint union of the effect relations of the elements of the abstract program.

2.3. Abstract Parallel Program – Definition

• The relation is called an abstract parallel program, if

• it associates equivalence classes of labelled transition trees to the element ,

• which trees are generated at by the ordered pairs of relations and

• have a correct labelling.

2.4. Abstract Parallel Program – Notation

• The abstract parallel program generated by is abbreviated by in the

following.

• The conditional assignment is called the initialization in and

• is said to be an element of the program .

2.5. Execution

(26)

Lecture 4

• Any path of a representative of the equivalence class is called an execution path of the abstract parallel program starting in the state .

• Any concurrent execution of conditional assignments should satisfy the requirement of serializibility.

• Every execution path of the abstract parallel program represents a possible sequential execution sequence of the assignments.

• The introduced semantics is an interleaving semantics of parallel programs.

2.6. Reachable States

• The labels (states) along the execution paths of set is denoted by .

• is the set of reachable states from state .

2.7. Unconditionally Fair Scheduling

• An execution path corresponds to the requirement of unconditionally fair scheduling,

• if every statement is selected infinitely times along the path, i.e.

• every label from index set is associated infinitely often to the vertices of the path.

3. Program Properties of the Abstract Program

3.1. Weakest Precondition

• The program properties are defined in terms of the weakest precondition of the element statements of the abstract program.

• The logical function is called the weakest precondition of the postcondition in respect to the statement .

• We define .

3.2. Weakest Precondition

• .

(27)

Lecture 4

17

3.3. Strongest Postcondition

• The logical function is called the strongest postcondition of in respect to .

• .

(28)

Chapter 5. Lecture 5

1. Reminder

1.1. Abstract Parallel Program and Scheduling

• The abstract parallel program generated by is abbreviated by in the

following.

• An execution path corresponds to the requirement of unconditionally fair scheduling, if every statement is selected infinitely times along the path, i.e. every label from index set is associated infinitely often to the vertices of the path.

1.2. Weakest Precondition and Strongest Postcondition

• .

2. Program Properties of the Abstract Program

2.1. Invariant Properties, Definition

• is the set of logical functions of which truth are preserved by the elements of if the program is started from a state satisfying .

• .

• and .

(29)

Lecture 5

19

2.2. Strongest Invariant

Lemma 1 (Conjunction of invariants). is closed for the conjunction operation.

• is the conjunction of the elements of the set

• is the strongest invariant.

Theorem 1. The truth set of is the set of reachable states from .

2.3. Always True Properties, Definition

• .

•

• Always true is not invariant.

(30)

Lecture 5

(31)

21

Chapter 6. Lecture 6

1. Reminder

1.1. Invariant Properties

• is the set of logical functions of which truth are preserved by the elements of if the program is started from a state satisfying .

• is the conjunction of the elements of the set

• is the strongest invariant.

2. Program Properties of the Abstract Program

2.1. Unless Properties, Definition

• is stable while .

• .

Unless.

2.2. Unless and Invariant Property

Theorem 2. If and , then .

Theorem 3. If and , then

.

(32)

Lecture 6

2.3. Ensures Property, Definition

• is stable while in and there is a conditional assignment which ensures the transition from

to .

• .

Ensures.

.

2.4. Leads-to Property, Definition

• is the transitive disjunctive closure of relation .

(33)

Lecture 6

23

is the smallest binary relation satisfying the conditions:

• .

• if and , then .

• Let denote a countable set. If , then

.

(34)

Chapter 7. Lecture 7

1. Reminder

1.1. Program Properties

•

• is the smallest binary relation satisfying the conditions:

• .

• if and , then .

• Let denote an countable set. If , then

.

2. Program Properties of the Abstract Program

2.1. Inevitability

Inevitability.

, if and only if when on all execution paths leading from and satisfying the axiom of the unconditionally fair scheduling there is a node at a finite unbounded distance from of which label is an element of the truth set of , i.e., the program inevitable reaches the truth set of started from .

Theorem 6 ( sound and complete). =

2.2. Fixed Point Properties

• A fixed point is said to be reached in a state of the state space , if none of the statements changes the state.

• and is a simultaneous, non deterministic conditional assignment, i.e.

: , if

• denotes the logical function, which characterizes the set of states over which the relation is

deterministic, i.e., .

2.3. Definitions

Set of fixed point.

Set of fixed point with deterministic assignments.

(35)

Lecture 7

25

Fixed point properties.

Let us denote by the set .

2.4. Example

• , ha .

• .

2.5. Weakening of fixed point property

Theorem 7. If and , then .

2.6. Termination properties

Termination properties.

denotes the set

2.7. Behaviour relation of abstract program

Behaviour relation.

Let be a program over the state space . The system of relations

is called the behaviour relation of the parallel program .

(36)

Chapter 8. Lecture 8

1. Reminder

1.1. Program Properties

• Invariant

• Unless

• Ensures

• Leads-to

• Fixed point

• Termination

2. Solution

2.1. Solution

Definition.

The abstract parallel program is a solution of the problem

,

• if , such that

• the program satisfies all the specification properties given in the , , ,

, , components

of

• assuming that the program starts from a state satisfying all the elements of .

2.2. Reachable states

• The truth set of an invariant property may be regarded as a characterization of a subset of reachable states.

• It is sufficient for us, if the program satisfies all properties over the truth set of an invariant property.

2.3. Satisfies a specification property

Definition.

The program satisfies the specification property , if and only if

• there exists an invariant property such that the program satisfies with respect to , i.e.,

• and .

(37)

Lecture 8

27

Theorem 8. The program satisfies the specification property , if it satisfies with respect to the strongest invariant, i.e. is an always true program property: (

).

2.4. Satisfies a specification property

Definition.

• there exists an invariant property such that the program satisfies with respect to , i.e.,

• and .

Theorem 9. The program satisfies the specification property , if it satisfies with respect to the strongest invariant, i.e.

.

2.5. Satisfies a specification property

Definition.

• there exists an invariant such that the program satisfies with respect to , i.e.,

• and

Theorem 10. The program satisfies the specification property , if it satisfies with respect to the strongest invariant, i.e.

.

2.6. Satisfies a specification property

Definition.

• and

.

(38)

Lecture 8

2.7. Satisfies a specification property

Definition.

• and .

Theorem 12. The program satisfies the specification property , if it satisfies with respect to the strongest invariant, i.e.

.

2.8. Satisfies a specification property

Definition.

• there exists an invariant such that the program satisfies ( ) with respect to , i.e.,

• and .

.

2.9. Solved by a program

Definition.

The problem is said to be solved by the program with respect to an invariant property

, if such that and satisfies all

the specification properties given in with respect to and the initial conditions .

2.10. Set of solutions

Definition.

We define as the set of all abstract parallel programs that solve the problem .

(39)

29

Chapter 9. Lecture 9

1. Reminder

1.1. Solution

Definition.

The abstract parallel program is a solution of the problem

,

• if , such that

• the program satisfies all the specification properties given in the , , ,

, , components

of

• assuming that the program starts from a state satisfying all the elements of .

1.2. Solved by a Program

Definition.

The problem is said to be solved by the program with respect to an invariant property

, if such that and satisfies all

the specification properties given in with respect to and the initial conditions .

2. Derivation Rules

2.1. Refinement of a Problem

Definition.

Let be problems defined over the state space .

If : solves solves , then the problem is a refinement of the

problem .

2.2. Refinement of Invariant Specification Property

Theorem 14. If the abstract program satisfies the specification properties and

, then satisfies the specification property too.

2.3. Refinement of Inevitable Specification Property in Finite Steps

Theorem 15. satisfies to the specification property , if it can be derived by finite number of application of the following rules:

1.

(40)

Lecture 9

if satisfies , then satisfies too.

2.

Transitivity: if satisfies and satisfies , then satisfies

too.

3.

Disjunctivity: for all W numerable set: if satisfies

, then satisfies too.

2.4. Variant Function

Definition.

• is a variant function.

• are logical functions:

• ,

• .

2.5. Application of a Variant Function

Theorem 16. logical functions, is a variant function, for

which .

If satisfies , then

satisfies too.

2.6. and Variant Function

Theorem 17. logical functions, is a variant function, for

which .

If satisfies , then

satisfies too.

2.7. Termination

Theorem 18. and is a variant function, for which

. If satisfies

for all , then satisfies .

2.8. Refinement of fixed point requirement

Theorem 19. If satisfies and , and , then

satisfies .

(41)

31

Chapter 10. Lecture 10

1. Reminder

1.1. Reminder

• Problem

• Parallel Abstract Program

• Properties of the Programs

• Solution

• Derivation Rules

2. Program Constructions

2.1. Union

Definition.

• Let and be two subspaces of the state space .

• Let denote the largest common subspace of and .

• Let and be the

extensions to of two programs on and respectively.

• If all variables belonging to get the same value in the assignments and

(i.e. ), then the program

that is defined on , is called the union of and .

2.2. Behaviour Relation of Union

Theorem 20. Let . Then:

1.

2.

3.

4.

for which :

(42)

Lecture 10

5.

6.

7.

.

2.3. Behaviour Relation of Union

Theorem 21. Let and be two problems over a common state space and parameter space

1.

2.

, 3.

, 4.

, 5.

, 6.

, 7.

.

2.4. Derivation Rule of Union

Theorem 22.

1.

Let and be two problems over a common state space and parameter space . 2.

(43)

Lecture 10

33

Let and be two programs extended to state space , and let the union of this programs exist.

3.

If is a solution of with respect to and is a solution of with respect to and

4.

, 5.

then is a solution of .

2.5. Union and Subset of the State Spaces (1)

Theorem 23. Let , a logical function on state space in such a way,

that and . In this

case:

• if , then ,

• if , then .

2.6. Union and Subset of the State Spaces (2)

Theorem 24. Let , a logical function on state space in such a way that

, . In this case

• if , then ,

• if and , then .

2.7. General Locality Theorem

Theorem 25. and are programs on the same state space. denotes the

variables in abstract program . . If ¹, then

• ,

•

• és

.

1

(44)

Chapter 11. Lecture 11

1. Reminder

1.1. Union

Definition.

• Let and be two subspaces of the state space .

• Let denote the largest common subspace of and .

• Let and be the

extensions to of two programs on and respectively.

• If all variables belonging to get the same value in the assignments and

(i.e. ), then the program

that is defined on , is called the union of and .

2. Program Constructions

2.1. Superposition

Definition.

• Let be a subspace of and let be a program over .

• Let be a conditional assignment defined over in such a way, that none of the variables of appear on the left hand side in .

• Let denote the superposition of and .

• Let be the extension of to .

The

a) and the

b) , where

programs are called superpositions of the program and the assignment.

2.2. Behaviour Relation of Superposition

Theorem 26. Let the program over state space be a superposition of the program

and the statement , if , where is a program over

the subspace of . Let and be two logical functions over and let and denote the extension of and to . is the extension of the logical function

and .

(45)

Lecture 11

35

1.

, 2.

, 3.

, 4.

, 5.

, 6.

,

2.3. Weak Extension of a Problem

Definition.

is the weak extension of the problem if it is derived from the extension of , from , by leaving out the " " type specification conditions.

2.4. Derivation Rule of Superposition

Theorem 27. Let be a problem over the subspace of state space and over the parameter space . If is a solution of then any superposition of the program and the statement is a solution of the weak extension of .

2.5. Sequence of Programs

Definition.

• Let , be two subspaces of state space .

• Let be a program over ,

be a program over .

• Let denote the extension of to .

• Let be a logical variable, where the state space component of neither belongs to nor to .

2.6. Sequence of Programs (cont.)

Definition (cont.)

(46)

Lecture 11

• Let denote the program defined on state space ,

where

• ,

• , if ).

• Let denote the program defined on state space

, where

• , if ).

• , if .

2.7. Sequence of Programs (cont.)

Definition (cont.)

The program is called the sequence of

and is denoted as .

2.8. Behaviour Relation of Sequence

Theorem 28. In the following we suppose that the predicates , , etc. are independent of the variable . and are the extensions of the logical functions of and

respectively. Let . Then:

1.

if , then ,

2.

if , then ,

3.

if , then ,

4.

if , then ,

5.

if , then ,

6.

if , then ,

(47)

Lecture 11

37

7.

, 8.

if then ,

2.9. Behaviour Relation of Sequence (cont.)

Theorem 29. In the following we suppose that the predicates , , etc. are independent of the variable . and are the extensions of the logical functions of and

respectively. Let . Then:

1.

iff , iff

, 2.

and iff ,

3.

if then ,

4.

if and then .

2.10. Derivation Rule of Program Sequencing

Theorem 30.

• Let and subspaces of state space .

• Let and deterministic problems over and resp. and over parameter space .

• Let ; be the sequence of (defined over ) and (defined over ).

• For any we mark the components of with , the components of with .

2.11. Derivation Rule of Program Sequencing (cont.)

Theorem 31.

• If satisfies and conditions under precondition

,

• satisfies and conditions under precondition

, and

(48)

Lecture 11

• , then

.

satisfies and conditions under

precondition.

(49)

39

Chapter 12. Lecture 12

1. Reminder

1.1. Program Constructions

• Union

• Superposition

• Sequence

2. Computation of the Value of an Associative Function

2.1. Notations

• Let be a set.

• Let denote an arbitrary associative binary operator over .

• is a function describing the single or multiple application of the operator .

2.2. Notations

• Since is associative, for any arbitrary sequence of length at least three:

• We write instead of the infix notation in the following.

• We extend for sequences of length one: .

2.3. Notations – The Problem

• Let a finite sequence of the elements of be given.

• .

• Let us compute the value of the function for all , where and

.

2.4. The Formal Specification of the Problem

• We represent the sequences and the values of function by arrays.

• We specify that the program inevitably reaches a fixed point and the array contains the values of in any fixed point.

(50)

Lecture 12

• .

2.5. The Formal Specification of the Problem

2.6. Properties of Associative Operators

• The computation of the values of at place is made easier with the knowledge of the value of for

subsequences indexed by the elements of an arbitrary interval.

• The result computed for a subsequence is useful in the computation of the value of for any sequence which includes the subsequence.

2.7. Auxiliary Function

• Let us introduce the auxiliary function .

• Let denote the value of for the sequence of which the first element is and its length is or the last element is , if .

Definition.

The precise definition of the partial function is:

2.8. Auxiliary Function

Lemma 2. If , then

.

2.9. Substitution of a Function by a Variable

• The two-dimensional array is introduced to store the known values of .

• This method is called the substitution of a function by a variable.

• The lines on the next Figure illustrate the connections among the elements of the matrix .

• In fixed points and ,

(51)

Lecture 12

41

i.e. is the value of for an at most length prefix.

2.10. Substitution of a Function by a Variable

2.11. Variant Function

• Let us choose the variant function in the following way:

.

• The variant function depends on the number of elements of the matrix which elements are different from the value of function at the corresponding place and on the number of places where the value of the array

is different from the value of function .

2.12. Refining the Specification of the Problem

• We extend the state space and refine the specification of the problem.

2.13. Refining the Specification of the Problem

(52)

Lecture 12

2.14. Refining the Specification of the Problem

• The connection between the variables and the function is given by the invariants (6)-(8).

2.15. Refining the Specification of the Problem

Lemma 3. The given specification ((4)-(9)) is a refinement of the original specification ((1)- (3)).

Proof. and in fixed point according to (6).

Using (7) it follows that the equation holds in

fixed point.

Since , after the application of the definition of we get

, which is the same as property (3).

(53)

43

Chapter 13. Lecture 13

1. Reminder

1.1. Computation of the Value of an Associative Function

1.2. The Formal Specification of the Problem

1.3. Refined Specification of the Problem

1.4. Refined Specification of the Problem

(54)

Lecture 13

2. Solution of the Problem

2.1. Solution of the Problem

2.2. Solution of the Problem

Theorem 32. The abstract program below is a solution for the problem specified by (4)-(9), i.e., a solution for the problem of the computation of the values of an associative function.

2.3. The Program Solves the Problem

Proof. (6): using the definition of :

We use invariant properties and apply mathematical induction on to prove that the program

satisfies in fixed points.

2.4. The Program Solves the Problem

(55)

Lecture 13

45

Base Case. . From (7) and follows .

Inductive hypothesis. .

2.5. The Program Solves the Problem

Proof.

• Since , contradicts the hypothesis.

• This means (12) can be simplified to .

• If , then , else (11) does not hold.

• Using the inductive hypothesis and we get ,

i.e., .

2.6. The Program Solves the Problem

Proof.

• The last statement contradicts the initial condition:

.

• This means .

• , else (12) does not hold.

• .

• Using the invariant (7) we get .

• Based on (10) .

2.7. The Program Solves the Problem

Proof. (5):

• Every statement of the program decreases the variant function by 1 or does not cause state transition.

• If the program is not in one of its fixed points, then there exists an and a corresponding conditional assignment, which assignment increases the value of , or

there exists an for which and the value of is different from the

value of

2.8. The Program Solves the Problem

Proof. (8):

• Since implies and , the equality holds

initially.

• All the assignments change the value of and simultaneously.

(56)

Lecture 13

2.9. The Program Solves the Problem

Proof. (7):

• Since , .

• Since is initially , .

• After calculating the weakest preconditions of the assignments it is sufficient to show that ...

2.10. The Program Solves the Problem

Proof.

• After calculating the weakest preconditions of the assignments it is sufficient to show that

• and

implies the equality for , i.e., and ,

• and

implies the equality for , i.e., and .

2.11. The Program Solves the Problem

Proof.

• .

• n the first case implies and

implies .

• In the second case implies and

implies .

• We use the Lemma: If , then

.

• In both of the cases the application of the Lemma leads to the statement.

(57)

47

Chapter 14. Lecture 14

1. Reminder

1.1. Computation of the Value of an Associative Function

2. Channels

2.1. Channels

• – queue, buffer for one directional communication

• Error-free, unbounded or bounded

• – the history of the channel

• Operations:

• (P1)

• (P2)

•

2.2. Semantics of Operations

•

(58)

Lecture 14

.

• .

• Locality: any property P of P1 is stable in the other process(es), if contains local variables and outgoing channels variables of P1 only.

• For any property , if and , then is stable in the system.

3. Natural Number Generator

3.1. Example – Natural Number Generator (NNG)

3.2. NNG –Refinement of the Problem

3.3. NNG –Solution

(59)

Lecture 14

49

3.4. The Program Solves the Problem

Proof. (5):

• We show

•

3.5. The Program Solves the Problem

Proof. (6):

•

3.6. The Program Solves the Problem

Proof. (7):

•

• and

•

4. Pipeline

4.1. Pipeline

• .

•

4.2. Specification of Pipeline

(60)

Lecture 14

4.3. Refinement of the Problem

4.4. Refinement of the Problem

Proof.

• By fixed point refinement it is sufficient: .

• Proof by using the lemma: .

• The lemma is proved by induction.

4.5. Solution

(61)

51

Chapter 15. Practice 1

1. Definitions

1.1. Relations

• An arbitrary subset of a direct product of sets is called a relation.

• Let where and are arbitrary sets. The domain of the relation is defined by

1.2. State Space

• Let is a finite or numerable set.

• The set is called state space, the sets are called type value sets.

• The projections are called variables.

• is the set of the finite sequences of the points of the state space and the set of the infinite sequences.

• Let .

1.3. Statements and Effect Relation

• .

1.4. Partial Function and Logical Relation

• A relation is called a partial function, if for all the set has at most one element. If then is a function.

• If is a relation, where is an arbitrary set and is the set of the logical values, then is called a logical relation.

1.5. Truth Set

• The truth set of the logical function is defined as

• The logical functions are defined by their truth

sets. .

1.6. General Assignment

(62)

Practice 1

• A statement over the state space is called empty and termed , if

.

• Let , , where .

• The statement is a general assignment defined by , if

•

.

1.7. Conditional Assignment

• Let be an assignment, for which .

• This kind of (simultaneous, nondeterministic) assignment is called a conditional assignment, if .

• We denote the conditional assignment the following way: , if .

• Simultaneous, nondeterministic, conditional assignment: , if

, if .

• Abbreviation:

1.8. Abstract Parallel Program

•

1.9. Weakest precondition

• .

1.10. Strongest Postcondition

• The logical function is called the strongest postcondition of in respect to .

• .

1.11. WP of the Abstract Parallel Program

(63)

Practice 1

53

• .

• ,

• where .

1.12. Properties of WP

•

• , if

•

1.13. Properties of WP

• ,

• If , then ,

• ,

• .

1.14. Calculating the WP

• , is a function and is a logical relation then

•

2. Calculating the WP

2.1. Exercise 1.

(64)

Practice 1

2.2. Exercise 1.(cont.)

2.3. Exercise 2.

2.4. Exercise 3.

2.5. Exercises

• ,

(65)

55

Chapter 16. Practice 2

1. Reminder

1.1. Effect Relation

• .

1.2. Weakest precondition

• .

1.3. WP of the Abstract Parallel Program

• .

• ,

• where .

1.4. Properties of WP

•

• , if

•

1.5. Properties of WP

• ,

Design of Distributed Systems

Design of Distributed Systems

Melinda Tóth, Zoltán Horváth

Design of Distributed Systems

Table of Contents

Chapter 1. Lecture 1

1. Syllabus

1.1. Syllabus

2. Motivation

2.1. Motivation

3. Literature

3.1. Literature 1.

4. Introduction

4.1. Properties of the formal model 1.

4.2. Properties of the formal model 2.

4.3. Dining philosophers

4.4. Problem specification (requirements)

4.5. Execution model

4.6. Program, Solution

4.7. Example

4.8.

Chapter 2. Lecture 2

1. Example

1.1. An Example: sorting

1.2. An Implementation: Sorting

1.3. An Implementation: Sorting

2. Basic Concepts of the Relational Model

2.1. Concepts

2.2. Relations

2.3. State Space

2.4. Statements and Effect Relation

2.5. Example

2.6. Partial Function and Logical Relation

2.7. Truth Set

2.8. Transitive Disjunctive Closure

2.9. Example TDC Relation

Chapter 3. Lecture 3

1. Problem

1.1. Problem

1.2. Specification Relations

1.3. Example

1.4. Problem Definition

1.5. Notation

1.6. Notation

1.7. Example – Value of a Function

2. Abstract Parallel Program

2.1. Abstract parallel program

2.2. General Assignment

2.3. Example

2.4. Extension

2.5. Conditional Assignment

2.6. Example – Abstract Program

Chapter 4. Lecture 4

1. Reminder

1.1. Problem

1.2. Abstract Parallel Program

1.3. Example

2. Semantics of the Abstract Program

2.1. State Transition Trees

2.2. State Transition Trees

2.3. Abstract Parallel Program – Definition

2.4. Abstract Parallel Program – Notation

2.5. Execution

2.6. Reachable States

2.7. Unconditionally Fair Scheduling

3. Program Properties of the Abstract Program

3.1. Weakest Precondition

3.2. Weakest Precondition

3.3. Strongest Postcondition

Chapter 5. Lecture 5

1. Reminder

1.1. Abstract Parallel Program and Scheduling

1.2. Weakest Precondition and Strongest Postcondition

2. Program Properties of the Abstract Program

2.1. Invariant Properties, Definition

2.2. Strongest Invariant

2.3. Always True Properties, Definition

Chapter 6. Lecture 6

1. Reminder

1.1. Invariant Properties