a probabilistic quantitative analysis of … probabilistic quantitative analysis of...

A Probabilistic Quantitative Analysis ofProbabilistic-Write/Copy-Select

Christel Baier1, Benjamin Engel2, Sascha Kluppelholz1,Steffen Marcker1, Hendrik Tews2, Marcus Volp2

1Institute for Theoretical Computer Science

2Operating-Systems Group

Technische Universitat Dresden, Germany

NASA Formal Methods Symposium (NFM’13)May 16, 2013

1 / 48

Motivation

Observation: traditional locking does not scale any more

atomic operations are slow and become increasingly expensive

locking schemes will become more complex and

scalability becomes problematic on future hardware systems

Idea: Probabilistic-Write/Copy-Select (PWCS) [Mc Guire’11]

no locks, no atomic operations

make inconsistencies detectable (e.g., tags, hashes)

sufficiently high probability to find a consistent replica

Properties of PWCS

measure-based experiments [Mc Guire’11]: promising approach

promising to work with more relaxed memory models

instance of a new class of algorithms (inherent randomness)

2 / 48

Motivation









Properties of PWCS




3 / 48

Motivation









Properties of PWCS




4 / 48

The PWCS protocol [Mc Guire’11]

Writer Replica Reader

for i=1..nE1Data1B1

E2Data2B2

.

.

.

EnDatanBn

for i=n..1

r = replica[i]; r = replica[i];

r.end tag++; ta = r.begin tag;

r.write data(); r.copy data();r.begin tag++; tb = r.end tag;

endfor if (ta == tb)

return data;

endfor

// error case

5 / 48

The PWCS protocol [Mc Guire’11]

Writer Replica Reader

for i=1..nE1Data1B1

E2Data2B2

.

.

.

EnDatanBn

for i=n..1

r = replica[i]; r = replica[i];

r.end tag++; ta = r.begin tag;

r.write data(); r.copy data();r.begin tag++; tb = r.end tag;

endfor if (ta == tb)

return data;

endfor

// error case

CTMC model transition system CTMC modelmodel

6 / 48

Contribution (NFM’13)

continuous-time Markov chain (CTMC) model for PWCSwith multiple writers

identify quantitative measures for the evaluation of PWCS

formalization of quantitative measures in terms ofcontinuous stochastic reward logic (CSRL)

formal quantitative analysis of PWCS using theprobabilistic model checker PRISM

7 / 48

Outline

1 Motivation

2 PWCS model

3 PWCS properties

4 PWCS analysis

5 Conclusion and future work

8 / 48

Continuous-time Markov chain (CTMC)

Definition (CTMC)

A CTMC is a tuple M = 〈S ,Act,R , µ〉, where

S a finite state space,

Act a finite set of action names,

R : S × Act × S → R≥0 the rate matrix of M,

µ : S → [0, 1] a distribution on S , i.e.,∑s∈S

µ(s) = 1

9 / 48


Definition (CTMC)






µ(s) = 1

Probability for sλ:α−→ s ′ ready to fire in [0, t] is

1− e−λt

Thus, the average delay of this transition is 1/λ.

10 / 48


Definition (CTMC)






µ(s) = 1

Probability for firing sλ:α−→ s ′ in [0, t] is

P(s, α, s ′) ·(1− e−E(s)·t)

where E (s) denotes the exit rate of state s, i.e., the sum ofthe rates of all outgoing transitions of state s.

11 / 48


Definition (CTMC)






µ(s) = 1

Probability for firing sλ:α−→ s ′ in [0, t] is

λ/E (s) ·(1− e−E(s)·t)

where E (s) denotes the exit rate of state s, i.e., the sum ofthe rates of all outgoing transitions of state s.

12 / 48

PWCS composed CTMC model

Product of CTMC for the writers, CTMC for the readers, andordinary (non-stochastic) transition systems for the replicas.

sλ:α−−→ s ′

〈s, x〉 λ:α−−→ 〈s ′, x〉w

λ:!a−−→ w ′, r?a−→ r ′

〈w , r , y〉 λ:a−−→ 〈w ′, r ′, y〉

x : local states of all other componentsy : local states of all readers and remaining writers and replicas

13 / 48

PWCS model

consistentk currently modifiedk

damagedk

?writing startedk

?writing finishedk

?writing startedk

?writing startedk

?writing startedk

?writing finishedk

Transition system model of a replica

14 / 48

PWCS model

success j

error j

idle j

readingj1

checkj1

readingjK−1

checkjK−1

.

.

.

.

.

.

readingjK check

jK

κ : reading startedjK

δ : reading finishedj1

ρ : reading startedj1

δ : reading finishedjK−1

ρ : reading startedjK−1

δ : reading finishedjK

σ : return to read idle j

ν : return to read idle j

CTMC model of a reader

15 / 48

PWCS model

CTMC model of a writer

idle i writing i

1ready i

1

writing i

2ready i

2

.

.

....

writing i

K ready i

K

γ : !writing started i

1λ : !writing finished i

1

µ : !writing started i

2

λ : !writing finished i

2

µ : !writing started i

K

λ : !writing finished i

K

η : return to write idle i

16 / 48

Outline

1 Motivation

2 PWCS model

3 PWCS properties

4 PWCS analysis


17 / 48

Interesting quantitative measures

M1: probability to successfully read the data

18 / 48



M2: 99% time-quantile for successful reading

19 / 48




20 / 48




M3: fraction of time in which all replicas are damaged

M4: average time for repairing a damaged replica

M5: 99% time-quantile for repairing a damaged replicawithin time t

M6: probability to write at least c consistent replicawithin one write cycle

21 / 48




M3: fraction of time in which all replicas are damaged

M4: average time for repairing a damaged replica

M5: 99% time-quantile for repairing a damaged replicawithin time t

M6: probability to write at least c consistent replicawithin one write cycle

... on the long run ...

22 / 48

Long-run behavior

Steady-state distribution

Function θ : S → [0, 1] with

θ(s)def= lim

t→∞θ(s, t) with

θ(s, t) the probability for being in state s at time t ∈ R≥0.

23 / 48

Long-run behavior



θ(s)def= lim



Important:

θ is well-defined distribution on S for finite CTMCs.

24 / 48

Long-run behavior



θ(s)def= lim



Important:

θ is well-defined distribution on S for finite CTMCs.

Long-run probabilities

Let M = 〈S ,Act,R , µ〉 be a CTMC. We refer to theprobability measure obtained for the CTMCMθ = 〈S ,Act,R , θ〉.

25 / 48

Conditional long-run behavior

Probability measure

Let M = 〈S ,Act,R , µ〉 be a CTMC and U ⊆ S be a set ofstates s.t. θ(U) > 0. We refer to the probability measureobtained for the CTMC MU

θ =Mν = 〈S ,Act,R , ν〉

26 / 48


Probability measure


θ =Mν = 〈S ,Act,R , ν〉, where

ν(s) =

{0 if s ∈ S \ Uθ(s)/θ(U) if s ∈ U

27 / 48


Probability measure



ν(s) =

{0 if s ∈ S \ Uθ(s)/θ(U) if s ∈ U

Conditional long-run queries

Pr(Π∣∣U) : conditional long-run probability

where Π is a measurable set of infinite paths, U ⊆ S a set of

states with θ(U) > 0.

28 / 48


Probability measure



ν(s) =

{0 if s ∈ S \ Uθ(s)/θ(U) if s ∈ U

Conditional long-run queries

Pr(Π∣∣U) : conditional long-run probability

AccRew(♦T∣∣U) : conditional long-run accumulated reward

where Π is a measurable set of infinite paths, U ⊆ S a set of

states with θ(U) > 0. We assume Pr(♦T |U

)= 1.

29 / 48

Queries for interesting long run properties

Q1: probability to successfully read a replica

Pr(¬error j U idle j

∣∣ reading started jK

)Q2: time-quantile for successful reading within time bound t

min{t : p ≤ Pr

(¬error j U≤t idle j

∣∣ reading started jK

)}

30 / 48


Q3: fraction of time in which all replicas are damaged

θ(damaged1 ∧ . . . ∧ damagedK

)

31 / 48




)Q4: average time for repairing a damaged replica

AccRew(♦ consistentk

∣∣ just damagedk

)

32 / 48







)Q5: time-quantile for repairing a damaged replica within time t

min{t : p ≤ Pr

(♦≤t consistentk


)}

33 / 48







)Q5: time-quantile for repairing a damaged replica within time t

min{t : p ≤ Pr

(♦≤t consistentk


)}Q6: probability to write at least c replica within one cycle

Pr(Πc

∣∣ writing started i1

)34 / 48

Outline

1 Motivation

2 PWCS model

3 PWCS properties

4 PWCS analysis


35 / 48

Selected parameters and scenarios

Common parameters

time ratewrite duration 2 λ = 0.5read duration 1 δ = 1other 0.01 µ = ρ = σ = ν = 100

Selected scenarios

frequent reads moderate readsmoderate writes moderate writes

time rate time rateidle time (writer) 20 γ = 0.05 200 γ = 0.005idle time (reader) 2 κ = 0.5 20 κ = 0.05

36 / 48

Selected parameters and scenarios

Common parameters

time ratewrite duration 2 λ = 0.5read duration 1 δ = 1other 0.01 µ = ρ = σ = ν = 100

Selected scenarios

frequent reads moderate readsmoderate writes moderate writes

time rate time rateidle time (writer) 20 γ = 0.05 200 γ = 0.005idle time (reader) 2 κ = 0.5 20 κ = 0.05

37 / 48

Results

Q1: probability to successfully read the datamoderate reads, moderate writes

1 2 3 4 5no. of replica K

0.75

0.80

0.85

0.90

0.95

1.00pro

babili

ty p

1 writer

2 writers

3 writers

4 writers

5 writers

38 / 48

Results

Q1: probability to successfully read the datafrequent reads, moderate writes


0.75

0.80

0.85

0.90

0.95

1.00pro

babili

ty p

1 writer

2 writers

3 writers

4 writers

5 writers

39 / 48

Results

Q2: time-quantile for successful readingmoderate reads, moderate writes, 5 replicas

0 2 4 6 8 10 12time bound t

0.0

0.2

0.4

0.6

0.8

1.0pro

babili

ty p

1 writer

2 writers

3 writers

4 writers

5 writers

40 / 48

Results

Q2: time-quantile for successful readingfrequent reads, moderate writes, 5 replicas

0 2 4 6 8 10 12time bound t

0.0

0.2

0.4

0.6

0.8

1.0pro

babili

ty p

1 writer

2 writers

3 writers

4 writers

5 writers

41 / 48

Results

Q3: time fraction in which all replicas are damagedmoderate reads, moderate writes


0.000

0.005

0.010

0.015

0.020

0.025

0.030

0.035

0.040pro

babili

ty p

2 writers

3 writers

4 writers

5 writers

42 / 48

Results

Q3: time fraction in which all replicas are damagedfrequent reads, moderate writes


0.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35pro

babili

ty p

2 writers

3 writers

4 writers

5 writers

43 / 48

Results

Q5: time-quantile for repairing a damaged replica within time tttmoderate reads, moderate writes, 5 replicas

0 50 100 150 200 250 300 350 400time bound t

0.0

0.2

0.4

0.6

0.8

1.0pro

babili

ty p

2 writers

3 writers

4 writers

5 writers

44 / 48

Results

Q5: time-quantile for repairing a damaged replica within time tttfrequent reads, moderate writes, 5 replicas

0 5 10 15 20 25 30 35 40time bound t

0.0

0.2

0.4

0.6

0.8

1.0pro

babili

ty p

2 writers

3 writers

4 writers

5 writers

45 / 48

Outline

1 Motivation

2 PWCS model

3 PWCS properties

4 PWCS analysis


46 / 48

Conclusion and future work

Conclusion

CTMC model for PWCS with multiple writers

identification of quantitative measures for the evaluation of PWCS

formalization of quantitative measures in terms of CSRL queries

formal quantitative analysis of PWCS using PRISM

47 / 48

Conclusion and future work

Conclusion

CTMC model for PWCS with multiple writers

identification of quantitative measures for the evaluation of PWCS

formalization of quantitative measures in terms of CSRL queries

formal quantitative analysis of PWCS using PRISM

Future work

comparative quantitative analysis with alternative protocols

stronger object consistency in PWCS (e.g., multiple objects)

other synchronization primitives (e.g., barriers)

formal methods for quantile and (conditional) long run properties

48 / 48

a probabilistic quantitative analysis of … probabilistic quantitative analysis of...

Documents