Automated Analysis of Fault-Tolerance in Distributed Systems
Formal Methods in System Design
| Hi-index | 0.00 |
Almost ten years ago, Gilles Kahn used the fixed point theory of Dana Scott to define a formal and elegant model of computation for determinate dataflow graphs, networks of determinate processes communicating asynchronously through unbounded channels. Kahn viewed each process as a function mapping each tuple of streams, or sequences of values, received through its input channels to the tuple of streams produced at its output channels. Determinacy was defined as the requirement that the mapping be functional--that for each input stream tuple there be only one possible output stream tuple. Although most useful computation can be accomplished with only determinate processes, there are many important, inherently non-determinate application areas to which Kahn''s theory cannot be applied. In this thesis, a formal model of computation for non-determinate networks is presented in which each possible computation of a network is represented by a scenario. A scenario is a pair consisting of an input stream tuple and an output stream tuple, together with a causality order relating each element of the input and output stream to those elements which played a role in its creation. A non-determinate network is represented by a set of scenarios, just as a determinate network is represented by a set of pairs of input and output stream tuples. Scenario sets contain but a little more information than the most straightforward extension of Kahn''s theory, the representation of graphs as relations on tuples of streams. We justify the addition of this causality information by demonstrating that the relational representation is inadequately detailed for describing non-determinate computation. A formal algebra for deriving the scenario set of a graph from the scenario sets of its components is also presented. Our scenario set composition rules are very simple. Only an elementary knowledge of partial orders is required in order to understand them. We prove the correctness of our model by showing its consistency with the standard operational model of dataflow computation.