Message Passing Dr. Liam OConnor University of Edinburgh LFCS (and - - PowerPoint PPT Presentation

Distributed Programming Reasoning about Synchronous Message Passing

Message Passing

• Dr. Liam O’Connor

University of Edinburgh LFCS (and UNSW) Term 2 2020

1

Distributed Programming Reasoning about Synchronous Message Passing

Where we are at

In the last lecture, we saw monitors and the readers and writers problem, concluding

• ur examination of shared variable concurrency.

For the rest of this course, our focus will be on message passing, both as a useful concurrency abstraction on one computer, as well as the foundation for distributed programming. In this lecture, we will introduce message passing and discuss simple non-compositional proof techniques for synchronous message passing.

2

Distributed Programming Reasoning about Synchronous Message Passing

Distributed Programming

concurrent program: processes + communication + synchronization distributed program: processes can be distributed across machines → they cannot use shared variables (usually; DSM exception) processes do share communication channels they access channels by message passing, remote procedure call (RPC),

• r rendezvous

languages: Promela (synchronous and asynchronous MP), Java (RPC), Ada (rendezvous) libraries: sockets, message passing interface (MPI), parallel virtual machine (PVM), JCSP etc.

3

Distributed Programming Reasoning about Synchronous Message Passing

Message Passing

A channel is a typed FIFO queue between processes. We distinguish synchronous from asynchronous channels. Ben-Ari Promela send a message ch ⇐ x ch ! x recieve a message ch ⇒ y ch ? y Synchronous channels If the channel is synchronous, the queue has capacity 0. Both the send and the receive

• peration block until they both are ready to execute. When they are, they proceed at

the same time and the value of x is assigned to y. Asynchronous channels If the channel is asynchronous, the send operation doesn’t block. It appends the value

• f x to the FIFO queue associated with the channel ch. Only the receive operation

blocks until the channel ch contains a message. When it does, the oldest message is removed and its content is stored in y.

4

Distributed Programming Reasoning about Synchronous Message Passing

Taxonomy of Asynchronous Message Passing

RelFIFO Rel RelDupFIFO RelDup FairFIFO Fair FairDupFIFO FairDup Rel = “reliable”, Dup = “with duplication” FiFo = “order-preserving”, Fair = “lossy but fair” RelFIFO ≃ TCP and FairDup ≃ UDP (if only it was fair)

5

Distributed Programming Reasoning about Synchronous Message Passing

Algorithm 2.1: Producer-consumer (channels) channel of integer ch producer consumer integer x integer y loop forever loop forever

p1:

x ← produce

q1:

ch ⇒ y

p2:

ch ⇐ x

q2:

consume(y)

6

Distributed Programming Reasoning about Synchronous Message Passing

Conway’s Problem

Example Input on channel inC: a sequence of characters Output on channel outC: The sequence of characters from inC, with runs of 2 ≤ n ≤ 9 occurrences of the same character c replaced by the n and c a newline character after every Kth character in the output. Let’s use message-passing for separation of concerns:

✲ ✲ ✲

compress

• utput

inC pipe

• utC

7

Distributed Programming Reasoning about Synchronous Message Passing

Algorithm 2.2: Conway’s problem constant integer MAX ← 9 constant integer K ← 4 channel of integer inC, pipe, outC compress

• utput

char c, previous ← 0 char c integer n ← 0 integer m ← 0 inC ⇒ previous loop forever loop forever

p1:

inC ⇒ c

q1:

pipe ⇒ c

p2:

if (c = previous) and

q2:

• utC ⇐ c

(n < MAX − 1)

p3:

n ← n + 1

q3:

m ← m + 1 else

p4:

if n > 0

q4:

if m >= K

p5:

pipe ⇐ i2c(n+1)

q5:

• utC ⇐ newline

p6:

n ← 0

q6:

m ← 0

p7:

pipe ⇐ previous

q7: p8:

previous ← c

q8:

8

Distributed Programming Reasoning about Synchronous Message Passing

Reminder: Matrix Multiplication

Example   1 2 3 4 5 6 7 8 9   ×   1 2 1 2 1   =   4 2 6 10 5 18 16 8 30   Let p, q, r ∈ N. Let A = (ai,j)1≤i≤p

1≤j≤q

∈ Tp×q and B = (bj,k)1≤j≤q

1≤k≤r

∈ Tq×r be two (compatible) matrices. Recall from math that another matrix C = (ci,k)1≤i≤p

1≤k≤s

∈ Tp×s is their product, A × B, iff, for all 1 ≤ i ≤ p and 1 ≤ k ≤ r: cij =

q

• j=1

ai,jbj,k

9

Distributed Programming Reasoning about Synchronous Message Passing

Algorithms for Matrix Multiplication

The standard algorithm for matrix multiplication is: for all rows i of A do: for all columns k of B do: set ci,k to 0 for all columns j of A do: add ai,jbj,k to ci,k Because of the three nested loops, its complexity is O(p · q · r). In case both matrices are quadratic, i.e., p = q = r, that’s O(p3). (Subtle optimisations exist for this very common case. The current best yields an upper bound of O(p2.3727). Ask Aleks in your next algorithms class.)

10

Distributed Programming Reasoning about Synchronous Message Passing

Process Array for Matrix Multiplication

Sink Sink Sink Result Result Result Zero Zero Zero Source Source Source

✛ ✛ ✛ ✛ ✛ ✛ ✛ ✛ ✛ ✛ ✛ ✛ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄

1 2 3 4 5 6 7 8 9 4,2,6 3,2,4 3,0,0 0,0,0 10,5,18 6,5,10 6,0,0 0,0,0 16,8,30 9,8,16 9,0,0 0,0,0 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 1 1 1 1 11

Distributed Programming Reasoning about Synchronous Message Passing

Computation of One Element

Result Zero 7 8 9

✛ ✛ ✛ ✛ ❄ ❄ ❄ 2 2 16 30

12

Distributed Programming Reasoning about Synchronous Message Passing

Algorithm 2.3: Multiplier process with channels integer FirstElement channel of integer North, East, South, West integer Sum, integer SecondElement loop forever

p1:

North ⇒ SecondElement

p2:

East ⇒ Sum

p3:

Sum ← Sum + FirstElement · SecondElement

p4:

South ⇐ SecondElement

p5:

West ⇐ Sum

13

Distributed Programming Reasoning about Synchronous Message Passing

Algorithm 2.4: Multiplier with channels and selective input integer FirstElement channel of integer North, East, South, West integer Sum, integer SecondElement loop forever either

p1:

North ⇒ SecondElement

p2:

East ⇒ Sum

• r

p3:

East ⇒ Sum

p4:

North ⇒ SecondElement

p5:

South ⇐ SecondElement

p6:

Sum ← Sum + FirstElement · SecondElement

p7:

West ⇐ Sum

14

Distributed Programming Reasoning about Synchronous Message Passing

Multiplier Process in Promela

1

proctype Multiplier(byte Coeff;

2

chan North;

3

chan East;

4

chan South;

5

chan West)

6

{

7

byte Sum, X;

8

for (i : 0..(SIZE-1)) {

9

if :: North ? X -> East ? Sum;

10

:: East ? Sum -> North ? X;

11

fi;

12

South ! X;

13

Sum = Sum + X*Coeff;

14

West ! Sum;

15

}

16

}

15

Distributed Programming Reasoning about Synchronous Message Passing

Algorithm 2.5: Dining philosophers with channels channel of boolean forks[5] philosopher i fork i boolean dummy boolean dummy loop forever loop forever

p1:

think

q1:

forks[i] ⇐ true

p2:

forks[i] ⇒ dummy

q2:

forks[i] ⇒ dummy

p3:

forks[i+1] ⇒ dummy

q3: p4:

eat

q4: p5:

forks[i] ⇐ true

q5: p6:

forks[i+1] ⇐ true

q6:

16

Distributed Programming Reasoning about Synchronous Message Passing

Synchronous Message Passing

Recall that, when message passing is synchronous, the exchange of a message requires coordination between sender and receiver (sometimes called a handshaking mechanism). In other words, the sender is blocked until the receiver is ready to cooperate. Examples MPI_SSend in MPI synchronous languages such as Signal Lustre Esterel

17

Distributed Programming Reasoning about Synchronous Message Passing

Synchronous Transition Diagrams

Definition A synchronous transition diagram is a parallel composition P1 . . . Pn of some (sequential) transition diagrams P1, . . . , Pn called processes. The processes Pi do not share variables communicate along unidirectional channels C, D, . . . connecting at most 2 different processes by way of

• utput statements C ⇐ e

for sending the value of expression e along channel C input statements C ⇒ x for receiving a value along channel C into variable x

18

Distributed Programming Reasoning about Synchronous Message Passing

Edges in (Sequential) Transition Diagrams

For shared variable concurrency, labels b; f , where b is a Boolean condition and f is a state transformation sufficed. Example

t = 1; in1 ← True

ℓ ℓ′ Now, we call such transitions internal.

19

Distributed Programming Reasoning about Synchronous Message Passing

I/O Transitions

We extend this notation to message passing by allowing the guard to be combined with an input or an output statement: ℓ ℓ′ b; C ⇒ x; f ℓ ℓ′ b; C ⇐ e; f

20

Distributed Programming Reasoning about Synchronous Message Passing

Example 1

Let P = P1 P2 be given as: s1 t1 C ⇐ 1

• s2

t2 C ⇒ x Obviously, {True} P {x = 1}, but how to prove it?

21

Distributed Programming Reasoning about Synchronous Message Passing

Semantics: Closed Product

Definition Given Pi = (Li, Ti, si, ti), for 1 ≤ i ≤ n, with disjoint local variable sets, define their closed product as P = (L, T, s, t) such that: L = L1 × . . . × Ln, s = s1, . . . , sn, t = t1, . . . , tn and, ℓ

a

→ ℓ′ ∈ T iff, either

1

ℓ = ℓ1, . . . , ℓi, . . . , ℓn, ℓ′ = ℓ1, . . . , ℓ′

i, . . . , ℓn,

ℓi

a

− → ℓ′

i ∈ Ti an internal transition, or

2

ℓ = ℓ1, . . . , ℓi, . . . , ℓj, . . . , ℓn, ℓ′ = ℓ1, . . . , ℓ′

i, . . . , ℓ′ j, . . . , ℓn,

i = j, with ℓi

b;C⇐e;f

− − − − − → ℓ′

i ∈ Ti and ℓj b′;C⇒x;g

− − − − − − → ℓ′

j ∈ Tj, and

a is b ∧ b′; f ◦ g ◦ x ← e

22

Distributed Programming Reasoning about Synchronous Message Passing

Example 1 cont’d

Observe that the closed product is just

s1, s2 t1, t2

x ← 1 so validity of {True} P {x = 1} follows from | = True = ⇒ (x = 1) ◦ x ← 1 which is immediate.

See the glossary of notation for the meaning of all these strange symbols.

23

Distributed Programming Reasoning about Synchronous Message Passing

Verification

To show that {φ} P1 . . . Pn {ψ} is valid, we could simply prove {φ} P {ψ} for P being the closed product of the Pi. This can be done using the same method as for ordinary transition diagrams because there are no I/O transitions left in P. Disadvantage As with the standard product construction for shared-variable concurrency, the closed product construction leads to a number of verification conditions exponential in the number of processes. Therefore, we are looking for an equivalent of the Owicki/Gries method for synchronous message passing.

24

Distributed Programming Reasoning about Synchronous Message Passing

A Simplistic Method

For each location ℓ in some Li, find a local predicate Qℓ, only depending on Pi’s local variables.

1

Prove that, for all i, the local verification conditions hold, i.e., | = Qℓ ∧ b → Qℓ′ ◦ f for each ℓ b;f − − → ℓ′ ∈ Ti.

2

For all i = j and matching pairs of I/O transitions ℓi

b;C⇐e;f

− − − − − → ℓ′

i ∈ Ti and

ℓj

b′;C⇒x;g

− − − − − − → ℓ′

j ∈ Tj show that

| = Qℓi ∧ Qℓj ∧ b ∧ b′ = ⇒ (Qℓ′

i ∧ Qℓ′ j) ◦ f ◦ g ◦ x ← e . 3

Prove | = φ = ⇒ Qs1 ∧ . . . ∧ Qsn and | = Qt1 ∧ . . . ∧ Qtn = ⇒ ψ.

25

Distributed Programming Reasoning about Synchronous Message Passing

Proof of Example 1

There are no internal transitions. There’s one matching pair. True = ⇒ (x = 1) ◦ x ← 1 ≡ 1 = 1 ≡ True

26

Distributed Programming Reasoning about Synchronous Message Passing

Soundness & Incompleteness

The simplistic method is sound but not complete. It generates proof obligations for all syntactically-matching I/O transition pairs, regardless of whether these pairs can actually be matched semantically (in an execution).

27

Distributed Programming Reasoning about Synchronous Message Passing

Example 2

Let P = P1 P2 be given as: s1 ℓ1 t1 C ⇐ 1 T1 C ⇐ 2 T2

• s2

ℓ2 t2 C ⇒ x T3 C ⇒ x T4 We cannot prove {True} P {x = 2} using the simplistic method. Proof obligations for the transition pairs (T1, T4) and (T2, T3) should not, but have to be, discharged, and lead to a contradiction, meaning that no inductive assertion network for applying the simplistic method to this example can be found.

28

Distributed Programming Reasoning about Synchronous Message Passing

Remedy 1: Adding Shared Auxiliary Variables

Use shared auxiliary variables to relate locations in processes by expressing that certain combinations will not occur during execution. Only output transitions need to be augmented with assignments to these shared auxiliary variables. Pro easy Con re-introduces interference freedom tests for matching pairs ℓi

bi;C⇐e;fi

− − − − − − → ℓ′

i ∈ Ti and ℓj bj;C⇒x;fj

− − − − − − → ℓ′

j ∈ Tj, and location ℓm of process

Pm, m = i, j: | = Qℓi ∧ Qℓj ∧ Qℓm ∧ bi ∧ bj = ⇒ Qℓm ◦ fi ◦ fj ◦ x ← e [This method is due to Levin & Gries.]

29

Distributed Programming Reasoning about Synchronous Message Passing

Example 2 cont’d

s1 ℓ1 t1 s2 ℓ2 t2 C ⇒ x C ⇒ x C ⇐ 1 C ⇐ 2 C ⇐ 1; k ← 1 C ⇐ 2; k ← 2 k = 0 k = 1 k = 2 k = 0 k = 1 ∧ x = 1 k = 2 ∧ x = 2

30

Distributed Programming Reasoning about Synchronous Message Passing

Levin & Gries-style Proof for Example 2

There are no internal transitions. Four matching pairs of I/O transitions exist, the same as in the simplistic method. The proof obligations are: | = k = 0 = ⇒ (k = 1 ∧ x = 1) ◦ k ← 1 ◦ x ← 1 (1) | = k = 0 ∧ k = 1 ∧ x = 1 = ⇒ (k = 1 ∧ k = 2 ∧ x = 2) ◦ k ← 1 ◦ x ← 1 (2) | = k = 1 ∧ k = 0 = ⇒ (k = 2 ∧ k = 1 ∧ x = 1) ◦ k ← 2 ◦ x ← 2 (3) | = k = 1 ∧ x = 1 = ⇒ (k = 2 ∧ x = 2) ◦ k ← 2 ◦ x ← 2 (4) No interference freedom proof obligations are generated in this example since there is no third process.

31

Distributed Programming Reasoning about Synchronous Message Passing

Levin & Gries-style Proof for Example 2 cont’d

Thanks to contradicting propositions about the value of k, (2) and (3) are vacuously true because their left-hand-sides are false. The right-hand-sides of the implications (1) and (4) simplify to True, which discharges those proof obligations, e.g., for the RHS of (1): (k = 1 ∧ x = 1) ◦ k ← 1 ◦ x ← 1 ≡ 1 = 1 ∧ 1 = 1 ≡ True

32

Distributed Programming Reasoning about Synchronous Message Passing

Remedy 2: Local Auxiliary Variables + Invariant

Use only local auxiliary variables + a global communication invariant I to relate values

• f local auxiliary variables in the various processes.

Pro no interference freedom tests Con more complicated proof obligation for communication steps: | = Qℓi ∧ Qℓj ∧ b ∧ b′ ∧ I = ⇒ (Qℓ′

i ∧ Qℓ′ j ∧ I) ◦ f ◦ g ◦ x ← e

[This is the AFR-method, named after Apt, Francez, and de Roever.]

33

Distributed Programming Reasoning about Synchronous Message Passing

Example 2 cont’d

s1 ℓ1 t1 s2 ℓ2 t2 C ⇐ 1 C ⇐ 2 C ⇒ x C ⇒ x C ⇐ 1; k1 ← 1 C ⇐ 2; k1 ← 2 C ⇒ x; k2 ← 1 C ⇒ x; k2 ← 2 k1 = 0 k1 = 1 k1 = 2 k2 = 0 k2 = 1 ∧ x = 1 k2 = 2 ∧ x = 2

34

Distributed Programming Reasoning about Synchronous Message Passing

AFR-style Proof for Example 2

There are no internal transitions. Four matching pairs of I/O transitions exist, the same as in the simplistic method. The proof obligations are: | =k1 = 0 ∧ k2 = 0 ∧ k1 = k2 = ⇒ (k1 = 1 ∧ k2 = 1 ∧ x = 1 ∧ k1 = k2) ◦ k1 ← 1 ◦ k2 ← 1 ◦ (x ← 1) (5) | =k1 = 0 ∧ k2 = 1 ∧ x = 1 ∧ k1 = k2 = ⇒ (k1 = 1 ∧ k2 = 2 ∧ x = 2 ∧ k1 = k2) ◦ k1 ← 1 ◦ k2 ← 2 ◦ x ← 1 (6) | =k1 = 1 ∧ k2 = 0 ∧ k1 = k2 = ⇒ (k1 = 2 ∧ k2 = 1 ∧ x = 1 ∧ k1 = k2) ◦ k1 ← 2 ◦ k2 ← 1 ◦ x ← 2 (7) | =k1 = 1 ∧ k2 = 1 ∧ x = 1 ∧ k1 = k2 = ⇒ (k1 = 2 ∧ k2 = 2 ∧ x = 2 ∧ k1 = k2) ◦ k1 ← 2 ◦ k2 ← 2 ◦ x ← 2 (8)

35

Distributed Programming Reasoning about Synchronous Message Passing

AFR-style Proof for Example 2 cont’d

Thanks to the invariant k1 = k2, (6) and (7) are vacuously true. The right-hand-sides of the implications (5) and (8) simplify to True, which discharges those proof obligations, e.g., for the RHS of (8): (k1 = 2 ∧ k2 = 2 ∧ x = 2 ∧ k1 = k2) ◦ k1 ← 2 ◦ k2 ← 2 ◦ x ← 2 ≡ 2 = 2 ∧ 2 = 2 ∧ 2 = 2 ∧ 2 = 2 ≡ True

36

Distributed Programming Reasoning about Synchronous Message Passing

What Now?

Next lecture, we’ll be looking at proof methods for termination (convergence and deadlock freedom) in sequential, shared-variable concurrent, and message-passing concurrent settings. Next week, we have a break! After the break, we’ll be looking at a compositional proof method for verification, proving properties for asynchronous communication, and, if time on Thursday, we’ll talk about process algebra. Then, Vladimir will take over for two weeks, discussing distributed algorithms and commitment and consensus topics. Assignment 1 is out! Read the spec ASAP!.

37