Computing Scores of Forwarding Schemes in Switched Networks with Probabilistic Faults

0.37 MB·

by  Guy Avni

Computing Scores of Forwarding Schemes in
Switched Networks with Probabilistic Faults‹
GuyAvni1,ShubhamGoel2,ThomasA.Henzinger1,andGuillermo
Rodriguez-Navas3
1 ISTAustria
7 2 IITBombay
1 3 Ma¨lardalenUniversity
0
2

n
a Abstract. Time-triggeredswitchednetworksareadeterministiccommunication
J infrastructureusedbyreal-timedistributedembeddedsystems.Duetothecriti-

2 calityoftheapplicationsrunningoverthem,developersneedtoensurethatend-
1 to-endcommunicationisdependableandpredictable.Traditionalapproachesas-
sumestaticnetworksthatarenotflexibletochangescausedbyreconfigurations

] or,moreimportantly,faults,whicharedealtwithintheapplicationusingredun-
C
dancy.Weadopttheconceptofhandlingfaultsintheswitchesfromnon-real-time
D
networkswhilemaintainingtherequiredpredictability.
. Westudyaclassofforwardingschemesthatcanhandlevarioustypesoffailures.
s
c Weconsiderprobabilisticfailures.Foragivennetworkwithaforwardingscheme
[ and a constant (cid:96), we compute the score of the scheme, namely the probability

(inducedbyfaults)thatatleast(cid:96)messagesarriveontime.Wereducethescoring
1
problemtoareachabilityproblemonaMarkovchainwitha“product-like”struc-
v
ture.Itsspecialstructureallowsustoreasonaboutitsymbolically,andreducethe
9
1 scoringproblemto#SAT.Oursolutionisgenericandcanbeadaptedtodifferent
5 networksandothercontexts.Also,weshowthecomputationalcomplexityofthe
3 scoringproblemis#P-complete,andwestudymethodstoestimatethescore.We
0 evaluatetheeffectivenessofourtechniqueswithanimplementation.
.
1
0
7 1 Introduction
1
: An increasing number of distributed embedded applications, such as the Internet-of-
v
Things(IoT)ormodernCyber-PhysicalSystems,mustcoverwidegeographicalareas
i
X andthusneedtobedeployedoverlarge-scaleswitchedcommunicationnetworks.The
r switches used in such networks are typically fast hardware devices with limited com-
a
putationalpowerandwithaglobalnotionofdiscretetime.Duetothecriticalityofsuch
applications, developers need to ensure that end-to-end communication is dependable
andpredictable,i.e.messagesneedtoarriveattheirdestinationontime.Theweakness
oftraditionalhardreal-timetechniquesisthattheyassumenearlystatictrafficcharac-
teristics and a priori knowledge about them. These assumptions do not fit well with
‹ThisresearchwassupportedinpartbytheAustrianScienceFund(FWF)undergrantsS11402-
N23 (RiSE/SHiNE) and Z211-N23 (Wittgenstein Award) and by the People Programme
(Marie Curie Actions) of the European Union’s Seventh Framework Programme FP7/2007-
2013/underREAgrantagreement607727.
setups where highly dynamic traffic and evolving network infrastructure are the rule
andnottheexception;e.g.see[25].Forthisreason,thereisapressingneedtocombine
flexibilityandadaptabilityfeatureswithtraditionalhardreal-timemethods[10,29,11].
The Time-Triggered (TT) scheduling paradigm has been advocated for real-time
communicationoverswitchednetworks[27].Theswitchesfollowastaticschedulethat
prescribeswhichmessageissentthrougheachlinkateverytimeslot.Thescheduleis
synthesizedoffline,anditisrepeatedcyclicallyduringthesystemoperation[21].TT-
schedulesarebothpredictableandeasytoimplementusingasimplelookuptable.Their
disadvantageisthattheylackrobustness;evenasinglefaultcancausemuchdamage(in
termsofnumberoflostmessages).Error-handlingislefttotheapplicationdesignerand
istypicallysolvedbystaticallyintroducingredundancy[4].Staticallocationofredun-
dancyhasitslimitations:i)itaddstothedifficultyoffindingaTT-schedule,whichisa
computationallydemandingproblemevenbeforetheadditionofredundantmessages,
andii)itreducestheeffectiveutilizationofresources.
Incontrast,nonreal-timecommunicationnetworkstypicallyimplementerror-recovery
functionalitywithintheswitches,usingsomekindofflexiblerouting,toreducetheim-
pactofcrashes.Suchanapproachisusedinsoftwaredefinednetworking(SDN)[16],
which is a booming field in the context of routing in the Internet. Handling crashes
has been extensively studied in such networks (c.f., [32,7,23] and references therein),
thoughthegoalisdifferentthaninreal-timenetworks;amessageintheirsettingshould
arriveatitsdestinationaslongasapathtoitexistsinthenetwork.Thus,unlikereal-
timeapplications,thereisnonotionofa“deadline”foramessage.
Inthisworkweexplorethefrontierbetweenbothworlds.Weadopttheconceptof
programmableswitchesfromSDNtothereal-timesettinginordertocopewithnetwork
faults. The challenge is to maintain the predictability requirement, which is the focus
of this work. We suggest a class of deterministic routing schemes, which we refer to
asforwardingschemes,andweshowhowtopredictthebehaviorofthenetworkwhen
usingaparticularforwardingscheme.Moreformally,theinputtoourproblemconsists
of a network N that is accompanied with probabilities of failures on edges, a set of
messages M to be routed through N, a (deterministic) forwarding scheme F that is
usedtoforwardthemessagesinM,atimeoutt P Nonthearrivaltimeofmessages,
i.e.,ifamessagearrivesaftertimet,itisconsideredtobelost,andaguarantee(cid:96) P N
onthenumberofmessagesthatshouldarrive.OurgoalistocomputethescoreofF,
whichisdefinedastheprobability(inducedbyfaults)thatatleast(cid:96)messagesarriveat
theirdestinationsontimewhenforwardingusingF.
Our score is a means for predicting the outcome of the network. If the score is
too low, a designer can use redundancy techniques to increase it. Also, it is a means
tocompareforwardingschemes.Whenconstructingaforwardingscheme,beitaTT-
scheduleoranyotherscheme,adesignerhascontrolonsomeofthecomponentsand
others are fixed by the application. For example, in many networks, the size of the
switches’queuesarefixedtobesmall,makingitimpossibletousealgorithmsthatrely
onlargememories.Asasecondexample,themessageprioritiesareoftenfixedbytheir
criticality. The choices made by the designer can highly influence the performance of
thesystemontheonehand,andareveryhardtopredictontheother;especiallywhen
faults come into the picture. Our score can be used to compare different forwarding
schemes,allowingthedesignertoevaluatehisalgorithmofchoice.Also,oursolution
can be used for sensitivity analysis with respect to certain parameters of the network;
forexample,onecanfixthedesiredscoreofascheme,andcomputethethreshold(cid:96)that
guaranteesthisscore,orthescoreand(cid:96),andfindtheerrorprobabilitiesforthechannels
[3].
Afirststeptowardshandlingfaultsintheswitcheswasmadein[2].Intheirframe-
work, the switches follow a TT-schedule and resort to a forwarding algorithm once
a crash occurs. Our forwarding scheme is simpler and allows consideration of richer
faultsinacleanandelegantmanner,whichwereimpossibletohandlein[2]’sframe-
work. More importantly, they study adversarial faults whereas we study probabilistic
ones, which are a better model for reality while they are considerably more compli-
catedtohandle.Usingfailoverpathstoallowforflexibilityinswitchednetworkswas
consideredin[19,31].
Thedefinitionoftheclassofforwardingschemesrequirescare.Ontheonehand,the
switches computation power is limited, so forwarding rules in the switches should be
specifiedaspropositionalrules.But,ontheotherhand,itisinfeasibletomanuallyspec-
ifytherulesateachswitchasthenetworkislargeandissubjecttofrequentchanges.
So,wearerequiredtouseacentralsymbolicdefinitionofanalgorithm.However,while
thedefinitionofthecentralalgorithmusespropositionalrules,itshouldallowforvari-
abilitybetweentheswitchesandthemessages’behaviorinthem.Therearemanyways
toovercomethesechallenges,andwesuggestonesolution,whichissimpleandrobust.
Ourforwardingschemeconsistsofthreecomponents.Thefirstcomponentisaforward-
ingalgorithmthattheswitchesrunandisgivenbymeansofpropositionalforwarding
rules. The two other components allow variability between the switches, each switch
hasprioritiesonmessages,andeachmessagehasapreferenceonoutgoingedgesfrom
eachswitch.Theforwardingrulesofthealgorithmtaketheseprioritiesandpreferences
intoconsideration.Asimilarpriority-listmodelistakenin[13].Ouralgorithmforcom-
putingthescoreofaschemeisgeneralandcanhandlevariousforwardingschemesthat
aregivenaspropositionalrulesasweelaborateinSection8.
In order to score a given forwarding scheme, we first reduce the scoring problem
to a reachability problem on a certain type of Markov chain, which is constructed in
twosteps.First,wefocusonanindividualmessagemandconstructadeterministicau-
tomatonD thatsimulatestheforwardingschemefromtheperspectiveofthemessage.
m
Then, we combine the automata of all the messages into an automaton that simulates
theirexecutionsimultaneously,andconstructaMarkovchainC ontopofitbyassum-
ing a distribution on input letters (faults). The size of C is huge and the crux of our
approach is reasoning about it symbolically rather than implicitly using PRISM [17]
forexample.WeconstructaBooleanformulaψ thatsimulatestheexecutionofC.The
specialproduct-likestructureofC allowsustoconstructψ thatisproportionalinsize
tothesumofsizesoftheD automataratherthantheproductoftheirsizes,whichis
m
thesizeofC.Thereisaone-to-onecorrespondencebetweensatisfyingassignmentsto
ψand“goodoutcomes”,namelyoutcomesinwhichatleast(cid:96)messagesarriveontime.
Wetheninferthescoreoftheforwardingschemefromtheweightedcountofsatisfying
assignmentstoψ;theweightofasatisfyingassignmentistheprobabilityofthecrashes
inthecorrespondingexecutionofthenetwork.
The problem of counting the number of satisfying assignments of a Boolean for-
mulaiscalled#SATandithasreceivedmuchattention.Thepracticaldevelopmentson
this problem are quite remarkable given its computational intractably; even deciding
whetheraBooleanformulahasonesolutionisanNP-completeproblemthatwascon-
sideredimpossibletosolvepracticallytwentyyearsago,afortioricountingthenumber
of solutions of a formula, which is a #P-complete problem and “closer” to PSPACE
than to NP. Still, there are tools that calculate an exact solution to the problem [28]
and a recent line of work that adapts the rich theory of finding approximate solutions
withhighprobability[15]topractice(see[20]foranoverview).Also,extensionsofthe
original problem were studied; strengthening of the formula to SMT rather than SAT
[8]andreasoningaboutassignmentswithweights,referredtoweighted#SAT.Asmen-
tioned above, our solution requires this second extension. We show that we can alter
theformulaweconstructabovetofitintheframeworkof[6],allowingustousetheir
reductionandgenerateanequivalent#SATinstance.
While solving #SAT is becoming more practical, it is still far from solved and it
would be surprising if the tools will ever be able to compete with tools for solving
SAT, e.g., [9]. Thus, one can question our choice of using such a heavy tool to solve
ourscoringproblem.Weshowthataheavytoolisessentialbyshowingthatscoringa
forwarding scheme is #P-complete, by complementing the upper bound above with a
reductionintheotherdirection:from#SATtoscoringaforwardingscheme.
Wealsostudyapproachestoestimatethescoreofaforwardingscheme.Weruna
randomized algorithm that, with high probability, finds a solution that is close to the
actualscore.UsinganapproximatecountingtooltocounttheBooleanformulawecon-
structabove,performsverypoorlyasthereductionof[6]constructsaninstancewhich
isparticularlyhardfortheapproximatecountingtechniques.Thus,inordertoemploy
thetoolstoapproximatelysolve#SATweneedtobypassthereduction.Wesuggestan
iterative algorithm that takes advantage of the fact that in practice, the probability of
failure is low, so traces with many faults have negligible probability. A second tech-
niqueweuseisaMonte-Carlosimulation,whichhasbeenfoundveryusefulinreason-
ingaboutnetworks[24]aswellasinstatisticalmodelcheckingintoolslikePLASMA
[14],UPPAAL[18],andPVeSta[1].
Wehaveimplementedallourtechniques.Weshowthattheexactsolutionscalesto
smallnetworks.Thesolutionthatreliesonapproximatedcountingscalesbetter,butis
overshadowedbytheMonte-Carloapproach,whichscalesnicelytomoderatenetworks.
WealsousetheexactsolutiontoevaluatethescoresoftheMonte-Carloapproachand
wefindthatitisquiteaccurate.Wenotethatourcountingtechniquesrelyoncounting
toolsasblack-boxesand,asmentionedabove,improvingthesetechniquesisanactive
line of work. We expect these tools to improve over time, which will in turn improve
thescalabilityofoursolution.
2 Preliminaries
We model a network as a directed graph N “ xV,Ey. For a vertex v P V, we use
outpvq Ď E todenotethesetofoutgoingedgesfromv,thusoutpvq “ txv,uy P Eu.
AcollectionMofmessagesaresentthroughthenetwork.Eachmessagem P Mhas
asourceandatargetvertex,whichwerefertoasspmqandtpmq,respectively.Timeis
discrete.Thereisaglobaltimeoutt P Nandamessagemeetsthetimeoutifitarrives
atitsdestinationbytimet.
Forwardingmessages
A forwarding scheme is a triple F “ xA,tă u ,tăv u y, where A is a
v vPV m mPM,vPV
forwardingalgorithmthattheswitchesrunandwedescribethetwoothercomponents
below. For ease of notation, we assume the same number of edges d P N exit all the
switchesinthenetworkandineachswitchtheyareorderedinsomemanner4.Then,our
rules forward messages with respect to this order. For example, we can specify a rule
that says “forward a message m on the first edge” by writing FORWARDpm,e1q. The
two other components of F allow variability; each switch v P V has an order ă on
v
messages,whichareprioritiesonmessages,andeachmessagemPMhasanordering
ăv ontheoutgoingedgesfromv,whicharepreferenceonedges.
m
ThepropositionalrulesinAareoftheformϕ Ñ FORWARDpm,eq.Werefertoϕ
astheassertionoftheruleanditssyntaxisasfollows
ϕ ::“ m|e |măm1|e ă e |ϕ_ϕ|(cid:32)ϕ
i i m j
Notethatmandm1 refertospecificmessagesinMwhilee referstothei-thexiting
i
edgesfromaswitch.Theforwardingataswitchisdeterminedonlybythelocalinfor-
mationithas;themessagesinitsqueueanditsoutgoingactiveedges.Inotherwords,
switchesarenotawareoffaultsindistantpartsofthenetworkandthisfitswellwiththe
philosophyofthesimplenetworkswemodel.
Intuitively, the algorithm takes as input the messages in the queue as well as the
active edges, and the output is the forwarding choices. Accordingly, the semantics of
an assertion ϕ is with respect to a set of messages M Ď M (the messages in the
queue) and a set of edges T Ď te ,...,e u (the active edges). Consider a rule ϕ Ñ
1 d
FORWARDpm,eiq.WedenotebypM,Tq|ùăv,tăvmumPM ϕthefactthatpM,Tqsatisfies
ϕ. Then, m is forwarded on the i-th outgoing edge from v, namely e . When ă and
i v
ăv areclearfromthecontext,weomitthem.Thesemanticsisdefinedrecursivelyon
m
thestructureofϕ.Forthebasecases,wehavepM,Tq|ùmiffmPM,thusmisinv’s
queue,wehavepM,Tq|ùe iffe PT,thuse isactive,wehavepM,Tq|ùpmăm1q
i i i
iffmă m1,thusm1 hasprecedenceoverminv,andwehavepM,Tq|ùpe ă e q
v i m j
iffe ăv e ,thusmprefersbeingforwardedonthej-thedgeoverthei-thedge.The
i m j
inductivecasesareasexpected.
The algorithm forwards messages on active links. We think of its output as pairs
O Ď M ˆ E, where xm,ey P O implies that the algorithm forwards m on e. We
requirethatthealgorithmobeytheconstraintsofthenetwork;atmostonemessageis
forwardedonalink, messages areforwardedonlyonactivelinks,messagesoriginate
onlyfromtheirsourceswitch,theyareforwardedonlyaftertheyarereceived,andthey
arenotforwardedfromtheirdestination.
Itissometimesconvenienttousedefinitionsofsetsinanalgorithmasweillustrate
in the examples below. A definition of a set is either a collection of messages or a
4Inmanysettings,messagesaregroupedintofewprioritiesmaking“priorityties”common.We
assumeatotalorderonmessagepriorities,i.e.,thereissomearbitraryproceduretobreakties.
collectionofedgesthatsatisfyanassertionasintheabove.Wealsoallowsetoperations
likeunion,intersection,anddifference,forsetsoverthesametypesofelements.Later
on, when we simulate the execution of the forwarding algorithm as a propositional
formula,weuseextravariablestosimulatetheseoperations.
Example1. TT-schedule A time-triggered schedule (TT-schedule, for short) assigns
messages to edges such that (1) the schedule assigns a message m on a path from its
sourcetotarget,i.e.,itisnotpossiblethatmisscheduledonebeforeitreachesspeq,
(2)twomessagescannotbesentonthesamelinkatthesametime,and(3)allmessages
mustarrivebytimet.GivenaTT-scheduleS,wecanconstructanequivalentforward-
ing scheme assuming there is no redundant waiting, namely assuming a message m
arrives at a switch v at time i and should be forwarded on e at a later time, then, if
m stays in v, it is only because e is occupied by a different message. We note that a
scheduleinducesanorderonthemessagesateachvertex,whichweuseasă ,andit
m
inducesapathπ foreachmessage,whichinducesanorderăv inwhichtheedgeson
m m
π havethehighestpreference.
m
In order to describe the rules of the algorithm (as well as the rules in the follow-
ing example), we introduce several definition. For S Ď M, we define an assertion
prioritypm,SqthatissatisfiedinswitcŹheswheremhasthehighestpriorityoutofthe
messagesinS,thusprioritypm,Sq “ pm1 ă mq.Next,wedefineanassertion
m1PS
preferspm,eiqthatissaŹtisfied`inverticeswherem˘ prefersei overalltheactiveedges,
thuspreferspm,e q “ e Ñ pe ă e q .Finally, wedefine aset ofmessage
i j‰i j j m i
S “ tm P M : preferspm,e qu,namelyS atavertexv containsthemessagesthat
ei i ei
areforwardedoni-thoutgoingedgefromv.
Wearereadytodescribethealgorithmusingforwardingrules.Foreverym P M
and i “ 1,...,d, m is forwarded on e when (1) m is in the queue, (2) m prefers
i
e , (3) e is active, and (4) m has the highest priority of the messages in S . The
i i ei
correspondingruleism^preferspm,eiq^ei^prioritypm,SeiqÑ FORWARDpm,eiq.
Example2. Hot-potatoThisalgorithmisintendedfornetworksinwhichtheswitches’
queue size is limited. Intuitively, messages are ordered in decreasing priority and are
allowedtochoosefreeedgesaccordingtotheirpreferences.So,assumethatthesetof
activeoutgoingedgesofaswitchvisT Ď te ,...,e u,andthemessageinthequeue
1 d
are M “ tm ,...,m u ordered in increasing priority, i.e., for 1 ď i ă j ď k, we
1 k
havem ă m .Then,m choosesitshighestpriorityedgeeinT,i.e.,foreveryother
j v i 1
edge e1 P T, we have e1 ăv e. Following m , the message m chooses its highest
m 1 2
priorityedgeinTzteu,andsoforth.Ifamessageisleftwithnofreeoutgoingedge,it
staysinv’squeue.Thealgorithmhasalowmemoryconsumption:ratherthankeepinga
messageminthequeuetillitspreferrededgeisfree,theswitchforwardsmonalower-
preferenceedge.NotethatunlikethealgorithminExample1,thehot-potatoalgorithm
hasfaulttolerantcapabilities.
We alter the assertion prefers by adding to it a set T Ď te ,...,e u, so that
1 d
preferspm,e,Tq is satisfies when m prefers e over all active edges in the set T. Let
k “mint|M|,du,thuskisanupperboundonthenumberofmessagesthatcanbefor-
wardedfromaswitchateachtime.WedefinesetsofmessagesS Ě S Ě ... Ě S ,
1 2 k
where S is the set of messages in the queue, and for 1 ă i ď k, we have S “
1 i
Ž
S ztm : prioritypm,S qu.Thatis,for1 ď i ď |M|,thesetS containsthe
i´1 mPSi i i
messages after the i-highest priority messages have been forwarded. Now, we define
a sequence of k sets of edges T Ě ... Ě T . The set T is the set of edges that are
1 k i
availableforthemessageofpriorityi.Thus,wehaveT isthesetofactiveedges,and,
1
forią1,thesetTi containstheedgesinTŽi´1 minustheedgethatthemessageofpri-
orityi´1selected,thusT “T zte : prioritypm,S q^preferspm,e,T qu.
i i´1 j mPM i i
Finally,foreverym P Mand1 ď i ď k,and1 ď j ď d,ifmisthehighestpriority
message in S , and e is its highest priority edge in T , we forward m on e , thus we
i j i j
havearuleprioritypm,Siq^preferspej,TiqÑ FORWARDpm,ejq.
FaultsandOutcomes
We consider two types of faults. The first type are crashes of edges. We distinguish
between two types of crashes: temporary and permanent crashes in which edges can
andcannotrecover,respectively.Asecondtypeoffaultmodelweconsiderarefaultson
sentmessages.Weconsideromissionsinwhichasentmessagecanbelost.Weassume
theswitchesdetectsuchomissions,sowemodelthesefaultsasasentmessagethatdoes
notreachitsdestinationandre-appearsinthesendingswitch’squeue.Asweelaborate
inSection8,ourapproachcanhandleotherfaultssuchas“clockglitches”,whichare
commoninpractice.
TheoutcomeofaforwardingschemeF isasequenceofsnapshotsofthenetwork
at each time point. Each snapshot, which we refer to as a configuration, includes the
positionsofallthemessages,thusitisasetof|M|pairsoftheformxm,vy,meaning
thatmisonvertexv intheconfiguration.WeuseO todenotethesetofalloutcomes.
Each outcome in O has t`1 configurations, thus O Ď pMˆVqt`1. All outcomes
startfromthesameinitialconfigurationtxm,spmqy : m P Muinwhichallmessages
are at their origin. Consider a configuration C. Defining the next configuration C1 in
theoutcomeisdoneintwosteps.Inthefirststep,werunF inallvertices.Considera
vertexv,letT Ď outpvqbeasetofactiveedges.Thesetofmessagesinv’squeueis
M “tm:xm,vyPCu.Intuitively,werunF atvwithinputM andT.Theforwarding
algorithmkeepssomeofthemessagesS Ď M inv’squeueandforwardsothers.The
messagesinS stayinv’squeue,thuswehavexm,vy P C1 foreverymessagem P S.
Recall that the algorithm’s output is O Ď pMˆEq, where xm,ey P O means that
m is forwarded on the link e. In the second step, we allow omissions to occur on the
pairsinO.Ifanomissionoccursonxm,xv,uyy P O,thenmreturnstothesourceof
the edge and we have xm,vy P C1, and otherwise, sending is successful and we have
xm,uyPC1.
We consider probabilistic failures. For every edge e P E, we assume there is a
probabilitype thatecrashesaswellasaprobabilitype thataforwardedmessage
crash omit
on e is omitted. Allowing different probabilities for the edges is useful for modeling
settingsinwhichthelinksareofdifferentquality.Notethatweallow“ideal”linkswith
probability 0 of failing. Faults occur independently though some dependencies arise
from our definitions and we highlight them below. In the temporary-crash model, the
probability that e is active at a time i is 1 ´ pe . In the permanent-crash model,
crash
crashesaredependent.ConsiderasetofactiveśedgesT Ď E.Thepśrobabilitythatthe
activeedgesinthenexttimestepareT1 ĎT is p1´pe q¨ pe .
ePT1 crash ePpTzT1q crash
We define omissions similarly. Consider a configuration C, active edges T, and let O
be the output of the algorithm. The probability that an omission occurs to a pair in
xm,ey P O ispe .Heretoothereisdependencybetweenomissionsandcrashes:an
omit
omission can only occur on an edge that a message is sent on, thus the edge must be
active. Such fault probabilities give rise to a probability distribution on O, which we
refertoasDpOq.
Definition1. Consider1 ď (cid:96) ď |M|.LetGbethesetofoutcomesinwhichatleast(cid:96)
messagesarriveontime.WedefineSCOREpFq“Prπ„DpOqrπ PGs.
3 FromScoringtoMarkovChain
In this section we show how to reduce the problem of finding the score of a for-
warding scheme to a reachability problem on a Markov chain. We start with tem-
porary crashes and omissions. A deterministic automaton (DFA, for short) is a tuple
D “ xΣ,Q,δ,q ,Fy, where Σ is an alphabet, Q is a set of states, δ : QˆΣ Ñ Q
0
is a transition function, q P Q is an initial state, and F Ď Q is a set of accept-
0
ing states. We use |D| to denote the number of states in D. An automaton frame is
a DFA with no accepting states. A Markov chain is a tuple xQ,P,q y, where Q is
0
a set of states, P : Qřˆ Q Ñ r0,1s is a probability function such that for every
state q P Q, we have Pres “ 1, and q P Q is an initial state. A
e“xq,pyPQˆQ 0
Markov chain induces a probability distribution on finite paths. The probability of a
pathπ “π1,...,πn,whśereπ1 “q0 istheproductofprobabilitiesofthetransitionsit
traverses,thusPrrπs“ Prrxπ ,π ys.ForaboundtPN,weusePr
1ďiăn i i`1 tπ:|π|ďtu
tohighlightthefactthatwearerestrictingtotheprobabilityspaceonrunsoflengthat
mostt.
ConsideranetworkN “xV,Ey,asetofmessagesM,aforwardingschemeF,and
amessagemPM.WedescribeanautomatonframeD rN,M,Fsthatsimulatesthe
m
routingofminN usingF.WehaveD rN,M,Fs“xp2Mˆ2EqYpEYtKuq,V Y
m
E,δ ,spmqy,wherewedescribeδ below.WeomitN,M,andF whentheyareclear
m m
fromthecontext.Intuitively,thesubsetofstatesV modelpositionsinthenetworkand
thesubsetofstatesE areintermediatestatesthatallowustomodelomissions.When
D is at state v P V, it models the fact that m is in the switch v. Accordingly, the
m
initial state is spmq and the transition function δ simulates the forwarding scheme
m
F: every outgoing transition τ from a state v P V corresponds to forwarding rule
ϕÑ FORWARDpm,eiqform.Thetransitionτ islabeledbyanalphabetletterpM,Tq,
whereM ĎMmodelsthemessagesinv’squeue,andT ĎEmodelstheactiveedges.
Furthermore,wehavepM,Tq|ùϕ,thusmisforwardedonthei-thedgeleavingv.We
refer to the state at the end-point of the transition τ as e P E, thus e is the i-th edge
leaving v. Recall that e is used to model omission. Accordingly, it has two outgoing
transitions:onedirectsbacktov,andthesecondmodelsasuccessfultransmissionand
directstothestatethatcorrespondstothevertextpeq.Wedefinethetransitionfunction
δ formally. For e “ xv,uy P E, we have δ pe,eq “ u and δ pe,Kq “ v, and for
m m m
v PV,M ĎM,andT ĎE,wehave
#
δ pv,pM,Tqq“ e ifDϕÑ FORWARDpm,eiqPA, e“ei, andpM,Tq|ùϕ
m
xv,vy otherwise.
Next, given a network N, a set of messages M, and a forwarding scheme F, we
constructanautomaton-frameDFADrN,M,FsthatsimulatestherunsofalltheD
m
frames. Consider a guarantee constant 1 ď (cid:96) ď |M|. The constant (cid:96) determines the
acceptingstatesofDrN,M,Fs:statesinwhichatleast(cid:96)messagesarriveontimeare
accepting. Formally, we have D(cid:96)rN,M,Fs “ x2E,V|M| YE|M|,δ,qD,F y, where
0 (cid:96)
wedescribethedefinitionofqD,δ,andF below.WeomitN,M,F,and(cid:96)whenthey
0 (cid:96)
areclearfromthecontext.RecallthatD simulatestheexecutionofthenetworkwhen
routingaccordingtoF.Astatexv ,v ,...,v yinDrepresentsthefactthat,for1ď
1 2 |M|
iď|M|,messagem isintheswitchv anditsframeisinthecorrespondingstate,and
i i
similarlyforastateinE|M|.Accordingly,theinitialstateqD isxspm q,...,spm qy
0 1 |M|
and a state is accepting iff at least (cid:96) messages arrive at their destination, thus F “
(cid:96)
txv ,...,v y : |tj : v “ tpm qu| ě (cid:96)u. Recall that the alphabet of a frame D
1 |M| j j m
consists of two types of letters; a letter M Ď M models the messages in a switch’s
queueandaletterT Ď E modelsfailures.SinceinD,themessagesinthequeuescan
beinducedbythepositionsoftheframes,thealphabetoftheframeDconsistsonlyof
thesecondtypeofletters.Considerastatexv ,v ,...,v yinD andaninputletter
1 2 |M|
T Ď E. For 1 ď i ď |M|, let M Ď M be the messages at vertex v , thus M “
i
tm : v “ v u. Then, the i-th component in the next state of D is δ pv ,pM,Tqq.
j j i mi i
ThedefinitionforstatesinE|M|issimilar,thoughhere,whenanoutgoingtransitionis
labeledbyaletterO ĎE,itmodelsthemessagesthatwheresuccessfullydelivered.
RecallthatthelettersinDrN,M,Fsmodelfailures.Weassumeprobabilisticfail-
ures, thus in order to reason about N we construct a Markov chain CrN,M,Fs on
thestructureofDrN,M,Fsbyassumingadistributiononinputletters.Formally,we
have CrN,M,Fs “ xV|M| YE|M|,P,qDy, where τ “ xv,ey P V|M| ˆE|M| has
0
aśpositive śprobability iff there exists T Ď E such that δpv,Tq “ e, then Prτs “
p ¨ p1´p q, and the definition of edges from states in E|M| to V|M| is
ePT e eRT e
similar. We can now specify the score of a forwarding scheme as the probability of
reachingF inCrN,M,Fs.
(cid:96)
Theorem1. Let N be a network, M a set of messages, F be a forwarding scheme,
and 1 ď (cid:96) ď |M| a guarantee. For a timeout t P N, we have that Pr rtπ :
tπ:|π|ďtu
πreachesF(cid:96)usinCrN,M,FsequalsSCOREpFq.
Theconstructionaboveconsiderstemporarycrashes.Recallthatinpermanentcrashes,
onceanedgecrashesitdoesnotrecover.Inordertoreasonaboutsuchcrashes,wetake
aproductofDwith2|E|.AstatethatisassociatedwithasetT ĎE representsthefact
thattheedgesinEzT havecrashed.Thus,inputlettersfromsuchastateincludeonly
edgesinT.
4 ComputingtheScoreofaForwardingScheme
WhileTheorem1suggestsamethodtocomputethescoreofaforwardingschemeby
solvingareachabilityproblemontheMarkovchainC,thesizeCistoobigforpractical
purposes. In this section we reason about C without constructing it implicitly by re-
ducingthescoringproblemto#SAT,theproblemofcountingthenumberofsatisfying
assignmentsofaBooleanformula.Weproceedintwosteps.
SimulatingexecutionsofD RecallthattheMarkovchainCsharesthesamestructure
asanautomatonDwhoseinputalphabetrepresentsfaults.WereasonaboutDbycon-
structing a Boolean formula ψ whose satisfying assignments correspond to accepting
runsoflengthtofD,whichcorrespondinturnto“goodoutcomes”ofthenetwork,i.e.,
outcomes in which at least (cid:96) messages arrive on time. The crux of the construction is
thatthesizeofψ isproportionaltothesumofsizesoftheD automatathatcompose
m
D ratherthantheproductoftheirsizes,whichisthesizeofD.Inordertoensurethat
therunasatisfyingassignmentsimulates,isaccepting,weneedtoverifythatatleast(cid:96)
messagesarriveontime.WeshowhowtosimulateacounterusingaBooleanformula
inthefollowinglemma.
Lemma1. ConsiderasetX of|M|variables,atruthassignmentf :X Ñttt,ffu,
andaconstant1ď(cid:96)ď|M|.ThereisaBooleanformulaCNT overvariablesXYY
(cid:96)
such that there is a satisfying assignment to CNT that agrees with f on X iff |tx P
(cid:96)
X : fpxq “ ttu| ě (cid:96).ThesizeofY is|M|¨logr(cid:96)`1sandCNT haslinearmany
(cid:96)
constraintsin|XYY|.
Proof. LetX “ tx ,...,x ubeasetofvariablesthatisorderedarbitrarilyand1 ď
1 n
(cid:96) ď n. We simulate a Boolean circuit that has n bits of input (corresponding to an
assignmenttothevariablesinX),countsthenumberofvariablesthatareassigned1,
andreturns1iffthereareatleast(cid:96)suchvariables.Sinceweneedtocountto(cid:96),weneed
rlog(cid:96)sbits,andweneedŤncopiesofthebits.For1 ď i ď n,letyi “ tyij : 1 ď j ď
rlog(cid:96)su.WedefineY “ y .Thefirstcopyofthecountingbitsisinitializedto
1ďiďn i
0,thuswehaveaconstraint(cid:32)y1^...^(cid:32)yrlog(cid:96)s.For1 ď i ď n,weaddconstraints
1 1
sothatiftheassignmenttox is0,theny “y (i.e.,thecounterisnotincremented),
i i i`1
and if x is 1, then (roughly) y “ y `1. Both can be achieved with polynomial
i i`1 i
manyconstraintsinrlog(cid:96)s.Finally,weaddconstraintsthatrequirethatatleastoneof
thecountersequals(cid:96).
Weproceedtoconstructtheformulaψ.
Theorem2. GivenaforwardingschemeF foranetworkN,asetofmessagesM,and
twoconstantst,(cid:96)PN,thereisaBooleanformulaψsuchthatthereisaone-to-onecor-
respondencebetweensatisfyingassignmenttoψ andacceptingrunsofD(cid:96)rN,M,Fs.
Thesizeofψispolyp|N|,|F|,|M|,t,log(cid:96)q.
Proof. Weuse|M|¨|N|¨tvariablestosimulatetheexecutionoftheunderlying|M|
frames.Avariableoftheformx representsthefactthatmessagemisonswitchv
m,v,i
attimei.Wemodelthefaultsusingvariables:avariablex representsthefactthateis
e,i
activeattimeiandavariablex representsthefactthatsendingmessagemonlink
e,m,i
eattimeiwassuccessful.Recallthatthetransitionfunctionoftheframescorresponds
totheforwardingalgorithm,whichisgivenbyasetofpropositionalrules.Wesimulate
theserulesusingaBooleanformulaoverthevariables.Finally,weaddconstraintsthat
require that the run starts from the initial state, i.e., x “ tt, and ends in an
m,spmq,1
accepting state, i.e., |tm P M : x “ ttu| ě (cid:96). For the later we use the
m,tpmq,t
assertionCNT thatisdescribedinLemma1withX “tx :mPMu.
(cid:96) m,tpmq,t
Weconstructψ formally.ConsideranetworkN “ xV,Ey,asetofmessagesM,
a forwarding scheme F, and constants (cid:96),t P N. We describe the variables in ψ. For