Self-Stabilization in Spite of Distributed Control

Abstract

A systematic way for finding the algorithm ensuring some desired form of co-operation between a set of loosely coupled sequential processes can in general terms be described as follows: the relation “the system is in a legitimate state” is kept invariant. As a consequence, each intended individual process step that could possibly cause violation of that invariant relation has to be preceded by a test that it won’t do so, and depending on the outcome of that test the critical process step is either caused to take place or it —and with it the process of which it is a part— is delayed until a more favourable system state has been reached. With a suitable choice of the set of legitimate states one can indeed introduce the rule that a critical process step will be delayed only as long as its execution would lead to violation of the corresponding invariant relation.[Excerpt] We consider a connected graph in which the majority of the possible edges are missing and a finite statemachine is placed at each node; machines placed indirectly connected nodes are called each other's neighbors.For each machine one or more so-called "privileges"are defined, i.e. boolean functions of its ownstate and the states of its neighbors; when such aboolean function is true, we say that the privilege is"present." In order to model the undefined speedratios of the various machines, we introduce a centraldaemon--its replacement by a distributed daemon fallsoutside the scope of this article--that can "select" oneof the privileges present. The machine enjoying theselected privilege will then make its "move"; i.e. it isbrought into a new state that is a function of its oldstate and the states of its neighbors. If for such amachine more than one privilege is present, the newstate may also depend on the privilege selected. Aftercompletion of the move, the daemon will select a newprivilege.[] Furthermore there is a global criterion, tellingwhether the system as a whole is in a "legitimate" state.We require that: (I) in each legitimate state one or moreprivileges will be present; (2) in each legitimate stateeach possible move will bring the system again in alegitimate state; (3) each privilege must be present inat least one legitimate state; and (4) for any pair oflegitimate states there exists a sequence of moves transferringthe system from the one into the other.[] We call the system "self-stabilizing" if and only if,regardless of the initial state and regardless of theprivilege selected each time for the next move, at leastone privilege will always be present and the system isguaranteed to find itself in a legitimate state after afinite number of moves.