A verification technique for self-stabilizing algorithms based on Ljapunov's &rdquo;Second Method&ldquo; (brief announcement)
Authors: Oliver Theel
Venue: Proceedings of the nineteenth annual ACM symposium on Principles of distributed computing (2000)

A very promising design strategy for constructing a robust application is to design it as a self-stabilizing algorithm. Informally, an algorithm is self-stabilizing if &mdash; starting from an illegal state &mdash; it is guaranteed to return to a specified set of legal states in bounded time (convergence) and to remain in one of those states under normal system execution (closure). A major problem of self-stabilizing algorithms is their verification. Interestingly, self-stabilization algorithms exhibit analogies to stable control circuits used in various engineering domains. Contrary to the self-stabilization research domain, which is a rather new area of research in computer science, control theory in engineering domains has a century-old background and offers a well-understood theoretical foundation with powerful criteria for reasoning about the stability of control circuits. Based on this observation, we propose the use of criteria originally derived for deciding on the stability of control circuits for proving self-stabilization of algorithms. The basic idea of our alternative verification approach is to take advantage of a technique called Ljapunov's &ldquo;Second Method&rdquo; [1]. Figure 1 shows a system model for which Ljapunov's method can be adopted. It represents a time-discrete variable structure dynamic system. It is comprised of a plant, regulators, and a switching function. Plant and regulators are specified as sets of difference equations. The plant has an (possibly arbitrary) initial state and is expected to reach a given desired state w in bounded time and subsequently remain in it. We assume an algorithm to be given as a collection of processes whose program bodies are guarded commands. In the system model, the guarded commands lead to a particular specification of the switching function and the regulators. These entities cooperate such that whenever a guard (which is a boolean expression) evaluates to &ldquo;true&rdquo; then the corresponding regulator may become active, leading to a certain modification of the system state. Through a final step of the modeling, it must be assured that the resulting system exhibits a unique equilibrium state xe = w = 0. (0 is the zero vector of adequate dimension.)THEOREM 1 (LJAPUNOV'S &ldquo;SECOND METHOD&rdquo; [1]).The transformed system represents a time-discrete, free, stationary dynamic system x(k + 1) = Ax(k) + Bu(k) where A0+B0 = 0. Suppose there exists a scalar function V(x(k)) such that V(0) = 0 and V(x(k)) is positive definite, i.e., there exists a continuous, nondecreasing scalar function &agr; such that &agr;(0) = 0 and for all x(k) &ne; 0, 0 < &agr;(&Verbar;x(k)&Verbar;) &le; V(x(k)), there exists a continuous scalar function &ggr; such that &ggr;(0) = 0 and for all x(k) &ne; 0, &Dgr;V(x(k)) := V(x(k+1)) - V(x(k)) &le; -&ggr;(&Verbar;x(k)&Verbar;) < 0, there exists a continuous, nondecreasing scalar function &bgr; such that &bgr;(0) = 0 and for all x(k) &ne; 0, V(x(k)) &le; &bgr;(&Verbar;x(k)&Verbar;), &agr;(&Verbar;x(k)&Verbar;) &rarr; &infin; when &Verbar;x(k)&Verbar; &rarr; &infin; then the equilibrium state xe = 0 is uniformly asymptotically stable in the large and V(x(k)) is a so-called Ljapunov function of the system. By Ljapunov's theorem, verification of the self-stabilization property of an algorithm is transformed into the identification of a Ljapunov function exhibiting the above properties. If such a function can be identified then &ldquo;uniform asymptotical stability in the large&rdquo; is guaranteed.Various strategies for constructing a suitable Ljapunov function are known from literature. Those strategies, sometimes dating back to the beginning of the last century, are waiting to be used. We are reluctant that our approach helps to turn the goal of verifying self-stabilization of algorithms &ldquo;into a craft rather than preserving it an art.&rdquo;