Priority Scheduling of Distributed Systems based on Model Checking

1. Priority Scheduling of Distributed Systems based on Model Checking Saddek Bensalem, Sussane Graf, Doron Peled, Sophie Quinton, Joseph Sifakis

2. 3 trains: TGV, regular, freight, compete on tracks to enter the station.We want to implement the system such that each track decides “locally”, without a centralized control.

3. Main problem • Refining a concurrent system that needs to satisfy some global restrictions. • Local actions are based on the knowledge of the process, of being in a certain collection of global states. • This “knowledge” is calculated in advance (model checking), and then the program is transformed to exploit it. • Practical motivation: Verimag’s BIP system.

4. Transition system with priorities • We are given a transition system, e.g., a Petri Net. • Priorities: a partial order between the transitions. • At each global state, we can execute a transition that has a maximal priority among enabled transitions.

5. A (safe) Petri Net p1 t1 p7 p3 t1 – a transition. With input places p1 and p7, and output place p3. A transition fires executes if the input transition have tokens and the output transitions do not have tokens (is empty). APetri Net is safe if when the input places to a transition have tokens, the output transitions do not have tokens.

6. p2 p1 t2 t1 p7 p4 p3 t3 t4 p5 p6 A (safe) Petri Net A state is a set of places, e.g., {p1, p2, p7}. Can be written as p1 /\ p2 /\ ¬ p3 /\ ¬ p4 /\ ¬ p5 /\ ¬ p6 /\ p7.

7. A (safe) Petri Net p2 p1 t2 t1 p7 p4 p3 t3 t4 p5 p6

8. A (safe) Petri Net p2 p1 p7 is a “semaphore”! t2 t1 p7 p4 p3 t3 t4 p5 p6

9. A (safe) Petri Net p2 p1 t2 t1 p7 p4 p3 t3 t4 p5 p6

10. A (safe) Petri Net p2 p1 t2 t1 p7 p4 p3 t3 t4 p5 p6 Transitions are independent (concurrent) if they do not share input and out places

11. A (safe) Petri Net with priorities:Partial order between transitions. p2 p1 t2 t1 p4 p3 t3 t4 p5 p6 t1<<t4, t2<<t3

12. A (safe) Petri Net with priorities. Partial order between transitions. p2 p1 t2 t1 p4 p3 t3 t4 p5 p6 t1<<t4, t2<<t3

13. A (safe) Petri Net with priorities. Partial order between transitions. p2 p1 t2 t1 p4 p3 t3 t4 p5 p6 t1<<t4, t2<<t3

14. Problem: how to guarantee execution according to priorities? • Execute only maximally enabled transitions. • Make a distributed (local) decision. • Is it even possible? • Can we check when it is possible? • What if we cannot make the distributed decision?

15. So, what can we do? • Main question: what do we know in each local state? • Use logic of knowledge to state (and check) if a process knows that its enabled transition has maximal priority. • Transform the program to act based on the knowledge. • There are variations of knowledge (based on the ability to recall our local history); tradeoff on price of transformation.

16. Some definitions p2 p1 • A process is a set oftransitions.[No two transitions of a process can execute independently at any moment].The processes cover all the transitions (there can be additional constraints). • The neighborhoodof a process is the set of all input and output places of it. t2 t1 p7 p4 p3 t3 t4 p5 p6 The local information of a process in a state, is the state limited to the neighborhood of the process. E.g., for the left process, in state { p1, p2, p7}, it is {p1,p7}. (=“local state”).

17. p2 p1 t2 t1 p7 p4 p3 t3 t4 p5 p6 We are ready to define “knowledge” • Given a “local information” as a process, a process knows everything that is consistent with it. • Easy to calculate what a process knows. • That is: I know of any property that holds in all global states with the same “local information”. • This is a standard definitions (e.g., [FMHV]). • Later: “knowledge with perfect recall”. When left process is given that p1 /\ p7, it knows that p4. (p1 /\ p7)  Kl p4

18. Calculating what a process knows given some local information • We can write a formula that represents “all reachable states”: reach • We can write a formula that represents “a given local information x”: x • Intersect the above two formulas, and obtain “the states given some local information”:reach /\x. • We know, when x holds, whatever is implied from this intersection (reach /\x )  . • The standard notation is K and we can embed this within temporal logic.

19. What is known, during execution can be model checked: 1Each process knows which of its enabled transitions have maximal priorities. 2Each process knows about at least one of its enabled transitions that has a maximal priority. 3In each non-deadlock state, at least one process knows about at least one enabled maximal priority transition.

20. The supporting process policy • A transition can belong to multiple processes (e.g., communication). • If enabled, andat least one process knows of it having maximal priority, then it can fire. • Related to a problem in control theory:we are seeking a distributed disjunctive controller with limited observability (this is, in general: undecideable). • Build for each process a “support table”: for each local information, which transition, if any, is supported.

21. What is known, during execution can be model checked: 1Each process knows which of its enabled transition have maximal priorities. Preserves correctness under transition fairness/justice. 2Each process knows about at least one of its enabled transitions to have a maximal priority. Preserves correctness under process fairness/justice. 3In each non-deadlock state, at least one process knows about at least one enabled maximal priority transition. Does not introduce deadlocks.

22. Some important points: • The knowledge is calculated based on the states of the original (priorityless) program. • Then transitions are being controlled, which generates a different program. • The transformation adds conditions to the enabledness conditions, based on the support table. • What is known about the original program remains known in the transformed program, since the reachable states can only reduce reachable states and executions!

23. And what if neither of these invariants hold? • Combine processes. The “knowledge of several processes” is bigger than of single processes. • Compromise, and allow transitions that are not maximal, to complete support table, such that in any reachable state, at least one transition is enabled. Experimentally measure how far is a compromised execution from a perfectly prioritized one. • Switch to ”knowledge of perfect recall”.

24. t3<<t5<<t4<<t7 Motivation: given local information {p3} for left process: t3 is enabled, can it be fired? p2 p1 t2 t1 p8 p7 p4 p3 t3 t4 t5 p5 p6 p9 t6 p10 t7 p11

25. t3<<t5<<t4<<t7 Motivation: when t3 is enabled, can it be fired? Now it has a maximal priority. p2 p1 t2 t1 p8 p7 p4 p3 t3 t4 t5 p5 p6 p9 t6 p10 t7 p11

26. t3<<t5<<t4<<t7 Motivation: when t3 is enabled, can it be fired? Continuing the execution… p2 p1 t2 t1 p8 p7 p4 p3 t3 t4 t5 p5 p6 p9 t6 p10 t7 p11

27. t3<<t5<<t4<<t7 Motivation: when t3 is enabled, can it be fired? Continuing the execution… p2 p1 t2 t1 p8 p7 p4 p3 t3 t4 t5 p5 p6 p9 t6 p10 t7 p11

28. t3<<t5<<t4<<t7 Motivation: when t3 is enabled, can it be fired? Continuing the execution… p2 p1 t2 t1 p8 p7 p4 p3 t3 t4 t5 p5 p6 p9 t6 p10 t7 p11

29. t3<<t5<<t4<<t7 Motivation: when t3 is enabled, can it be fired? Same local information as before for left process: {p3}. Now t5 has maximal priority! p2 p1 t2 t1 p8 p7 p4 p3 t3 t4 t5 p5 p6 p9 t6 p10 t7 p11

30. t3<<t5<<t4<<t7 Based on this, the left process does not know if t3 has the highest priority at both times. But if we remember how many times t1 fired, we can distinguish between these two cases! p2 p1 t2 t1 p8 p7 p4 p3 t3 t4 t5 p5 p6 p9 t6 p10 t7 p11

31. Knowledge of perfect recall • Knowledge is based on the history that a process can sense, up to any point in its computation. • A process can sense changes in its neighborhood, including changes to the neighborhood by other processes. • This way we can distinguish between two local states (local information) with different histories. So, we know more! • But don’t we need infinite amount of information?

32. Knowledge of perfect recall: finite information. • Ron Van der Meyden has shown that finite amount of information is sufficient. • Given some history of computation, the rest of the system can be in a finite number of states consistent with it (a “subset construction”). • If a process makes a single transition, or some process changes the neighborhood, the system can be in any global state that is obtained by making that transition, plus any sequence of (independent) transitions that do not change the neighborhood. • For the transformation, we can keep the information as an automaton. This can become a gigantic automaton: with each change to the neighborhood, we move to a state that represent a set of global states of the system.

33. 3 trains: TGV, regular, freight, compete on tracks to enter the station.Priority of transitions (trains moving from one segment to another) depend on speed of trains.

34. Experiments Penalty: how far we are from perfect priority execution for an execution of 100,000 steps (0= 1st-priority transition, 1= 2nd highest, 2= 3rd highest). Without our construction, the penalty is 34,442.

35. Another solution • When there are states where no one knows which transition as higher priority: offer interactions between processes that may have the knowledge. • Interaction is offered through a coordinating algorithm called -core.

36. The -core algorithm • Perez, Corchuelo, Toro, Concurrency – Practice and Experience 16(12):1173-1206, 2004. • There are several kinds of coordinations, each between a set of processes. Each coordination is controlled by a separate process. • A process may have several choices between coordinations. • Program processes and coordination processes exchange messages until coordination is established. P1 P2 C2 C1 P3 P4 P4 has multiple choice at some state.

37. We can mark each local state of a process p as follows: • K1:p knows he has a transition with maximal priority. • K2: p does not know …, but knows that some other process knows … (not necessarily the same process for each state consistent with the local state). • K3: Both above cases do not hold. 3 : for each global state, there is a local state where 1 holds

38. Calculating K2 • We first mark local states by K1 according to the previous algorithm. • Then K2holds in a local state, if all the global states containing it have a local state where K1 holds. • If a local state of some process satisfies K2, then the process “shouldn’t worry” – “someone else will do the job”.

39. What if 3 does not hold? • We set up a table that tells us about combined knowledge. • Useless local states to worry about satisfy k3. • Take some tuples of them (start with pairs), and check whether they have a combined knowledge of maximal priority. • Make a table of such tuples. • Each tuple is a coordination! • Add tuples until each global state includes such a tuple. • Each tuple suggests a coordination where combined knowledge about who has maximal priority exists.

40. Finally: minimize the number of interactions

41. Finally: minimize the number of interactions

42. Conclusions • We can employ model checking to implement priorities in a distributed way. • May apply to other problem of distributed implementation, while solving some global constraints. • We use logic of knowledge, and model checking of knowledge. • Solves a distributed controllability with limited observability problem. • Does not provide a perfect solution (not always the least constrained solution)! • Space/performance tradeoff in using logic of perfect recall. • Can combine knowledge of several processes temporarily through a coordination algorithm. • Apply various compromises when knowledge is not enough. May also need to employ abstraction.