Preserving Stabilization while Practically Bounding State Space

TL;DR

This paper introduces an algorithm that transforms stabilizing programs with unbounded variables into ones with bounded variables and practical physical time, ensuring stabilization with limited space.

Contribution

It presents a novel transformation algorithm applicable to various problems, enabling stabilization with bounded variables and physical time, extending prior work on non-stabilizing programs.

Findings

Applicable to logical clocks, vector clocks, mutual exclusion, leader election, and Paxos.

Enables stabilization with bounded variables in diverse systems.

Can be combined with existing methods to bound counters in stabilization.

Abstract

Stabilization is a key dependability property for dealing with unanticipated transient faults, as it guarantees that even in the presence of such faults, the system will recover to states where it satisfies its specification. One of the desirable attributes of stabilization is the use of bounded space for each variable. In this paper, we present an algorithm that transforms a stabilizing program that uses variables with unbounded domain into a stabilizing program that uses bounded variables and (practically bounded) physical time. While non-stabilizing programs (that do not handle transient faults) can deal with unbounded variables by assigning large enough but bounded space, stabilizing programs that need to deal with arbitrary transient faults cannot do the same since a transient fault may corrupt the variable to its maximum value. We show that our transformation algorithm is applicable to several problems including logical clocks, vector clocks, mutual exclusion, leader election, diffusing computations, Paxos based consensus, and so on. Moreover, our approach can also be used to bound counters used in an earlier work by Katz and Perry for adding stabilization to a non-stabilizing program. By combining our algorithm with that earlier work by Katz and Perry, it would be possible to provide stabilization for a rich class of problems, by assigning large enough but bounded space for variables.

Full text

In this paper, we present an algorithm that transforms a stabilizing program that uses variables with unbounded domain into a stabilizing program that uses bounded variables and (practically bounded) physical time. While non-stabilizing programs (that do not handle transient faults) can deal with unbounded variables by assigning large enough but bounded space, stabilizing programs –that need to deal with arbitrary transient faults– cannot do the same since a transient fault may corrupt the variable to its maximum value.

We show that our transformation algorithm is applicable to several problems including logical clocks, vector clocks, mutual exclusion, leader election, diffusing computations, Paxos based consensus, and so on. Moreover, our approach can also be used to bound counters used in an earlier work by Katz and Perry for adding stabilization to a non-stabilizing program. By combining our algorithm with that earlier work by Katz and Perry, it would be possible to provide stabilization for a rich class of problems, by assigning large enough but bounded space for variables.

I Introduction

Self stabilization is one of the highly desirable dependability properties of distributed systems. Self-stabilization ensures that a system affected by a fault eventually stabilizes to or reaches a valid state in finite time. Stabilizing fault-tolerance is especially useful for dealing with unexpected transient faults. Transient faults can perturb the system to potentially arbitrary state, and guaranteeing that the program recovers to legitimate states ensures that the effect of these faults would only be temporary.

A key desirable property of stabilizing systems is for them to utilize only variables with a bounded domain. For non-stabilizing systems (i.e. systems that do not handle transient faults), one could utilize counters that grow unbounded by ensuring that the value of the variable remains manageable during the length of the system computation. For example, one could argue that if a variable increases by at most $10$ every second and the system can run for at most $1000$ seconds then the value would never be more than $10,000$. However, for stabilizing systems with variables with a bounded domain, this argument does not hold true. This is because a transient fault could perturb the system to a state where the value has already reached $10,000$ i.e. the bound. The same argument was made by Lamport and Lynch [18] and we recall the argument in the following quote,

”Simply bounding the number of instance identifiers is of little practical significance, since practical bounds on an unbounded number of identifiers are easy to find. For example, with 64-bit identifiers, a system that chooses ten per second and was started at the beginning of the universe would not run out of identifiers for several billion more years. However, through a transient error, a node might choose too large an identifier, causing the system to run out of identifiers billions of years too soon–perhaps within a few seconds. A self-stabilizing algorithm using a finite number of identifiers would be quite useful, but we know of no such algorithm.”

However, the above quote about unbounded counters conflicts with usage in distributed systems where one often utilizes time as a variable whose value is theoretically unbounded. This is because with time there is a guarantee for convergence offered by protocols like NTP, i.e. any inconsistency can be easily detected and corrected in finite time.

Based on this conflict –we seem to find the use of physical time (that is theoretically unbounded but practically bounded) acceptable but find the use of other unbounded variables unacceptable, so we consider the question: Why is the usage of unbounded time reasonable, but the usage of other unbounded variables is not? We observe that there is an inherent difference between the variable time and any other variable. In particular, detecting whether time is corrupted is much easier than detecting if other variables are corrupted. With the usage of redundancy, atomic clocks, etc., one can ensure that the time of a process is close to the correct value. In other words, if transient faults perturb a clock to a value that is far away from the current value, this corruption can be detected before using that clock value.

Observe that this property of time may not be satisfied by other variables in a given program. For example, if we use logical clocks by Lamport [17], it is possible that clocks of two processes could genuinely differ by a large value.

Our goal in this paper is to identify a class of programs for which we can begin with a stabilizing program that relies on unbounded counters and transform it into a program with bounded counters and (theoretically unbounded but practically bounded) physical time.

**Contributions of the paper. **

• •

We introduce the notion of free and dependent counters and utilize them to develop an algorithm that transforms a stabilizing program with unbounded counters into a stabilizing program with bounded counters.

• •

We demonstrate that our approach can be combined with that by Katz and Perry [15]. Specifically, [15] provides a mechanism to transform a non-stabilizing program into a stabilizing program with unbounded counters. We show that the generated stabilizing program can then be transformed into a stabilizing program that uses bounded counters and (practically bounded) physical clock.

• •

We demonstrate our algorithm in the context of several classical problems such as consensus, logical/vector clocks, mutual exclusion, diffusing computation, etc.

• •

We show that even with trivially satisfiable parameters for a practical system (like clock drift of less than $100$ seconds, messages are either delivered or lost within an hour, etc), the size of counters in our programs is small.

**Organization of the paper. ** The rest of the paper is organized as follows: We define distributed programs and relate their execution with time in Section II. We define the notion of free and dependent counters in Section III and illustrate them with the example of Lamport’s logical clocks in Section IV. We present our algorithm in Section V and discuss some applications of it in Section VI (and some in Appendix A-C, A-D and A-E). Section VI also demonstrates that our approach can be combined with the approach in [15] by Katz and Perry, so that an existing program can be transformed into a stabilizing program that uses bounded variables and physical time. Section VII discusses related work and questions raised by our work. In Section VIII, we present concluding remarks and future work. In Appendix A-A and A-B, we present the step-by-step illustration of our algorithm and its proof of correctness. In Appendix A-F we summarize the notations used in this paper.

II Preliminaries

II-A Modeling Distributed Programs

A distributed program consists of a set of processes. Each process has a set of actions and the program executes in an interleaving manner where an action of some process is executed in every step. Execution of the program is captured with a set of program variables, each of which is associated with a domain. With this intuition, we now formally define a program in terms of its variables and actions. Definitions II.1 to II.6 are from standard literature such as [13, 5, 8].

Definition II.1**.**

(Program).

A program $p$ is of the form $\langle V_{p},A_{p}\rangle$, where $V_{p}$ is a set of variables, and $A_{p}$ is a set of actions that are of the form $guard\rightarrow statement$, where $guard$ is a condition involving the variables in $V_{p}$ and the $statement$ updates a subset of variables in $V_{p}$.

Definition II.2**.**

(State). A state $s$ of program $p$ is obtained by assigning each variable in $V_{p}$ a value from its domain.

Definition II.3**.**

(Enabled). An action of the form $guard\rightarrow statement$ is enabled in state $s$ iff $guard$ evaluates to true in state $s$.

Definition II.4**.**

(Computation). A computation is a sequence of states $s_{0},s_{1},s_{2},\cdots$, where a state $s_{l+1}$, $l\geq 0$, is obtained by executing some enabled action in state $s_{l}$.

Remark II.1**.**

For the sake of simplicity, we assume that there is at least one action enabled in state $s$. If such an action does not exist, we pretend that the program has an action corresponding to a self-loop at state $s$.

Definition II.5**.**

(Computation Prefix). A finite sequence of states $s_{0},s_{1},s_{2},$ $\cdots,s_{n}$ is a computation-prefix of program $p$ iff it is a prefix of some computation of $p$.

Finally, we recall the definition of stabilization from [8]:

Definition II.6**.**

(Stabilization). Program $p$ is stabilizing to $S$, where $S$ is a set of states, iff

• •

Starting from an arbitrary state, every computation of $p$ reaches $S$, and

• •

Starting from a state in $S$, no computation of $p$ reaches a state outside $S$.

II-B Relating Program Computation and Time

As discussed in the Introduction, our goal is to combine the existence of (reasonably synchronized) global time achieved through services such as NTP with reasonable timing properties in the given algorithm. Since the definitions in Section II-A are time-independent, in this section, we identify the role of time and the relation between program steps and time in our algorithm.

Our algorithm relies on NTP-like algorithm to provide physical clock for each process, which is close to an abstract global clock (this global clock is not available to processes themselves). We partition the abstract global time say $t$ into regions of size $\mathcal{RS}$. Thus, the (global) region is identified by $\lfloor\frac{t}{\mathcal{RS}}\rfloor$. Likewise, each process $j$ is also associated with a physical time, say $t_{j}$. This time is also mapped to the region of process $j$. Thus, the region of process $j$ is $\lfloor\frac{t_{j}}{\mathcal{RS}}\rfloor$. Note that due to clock drift the global region and region associated with process $j$ may not be identical. Likewise, region associated with process $j$ may not be the same as that associated with process $k$.

We choose $\mathcal{RS}$ such that (1) the region identified by the process from its own local physical clock differs from the region identified by the global clock by at most $1$, and (2) the regions identified by two processes from their local clocks differ by at most $1$. Given the current technology, choosing $\mathcal{RS}$ to be a few milliseconds would be reasonable for many existing systems to satisfy this assumption. In our analysis, we assume $\mathcal{RS}$ to be $100$ seconds. Note that achieving clock synchronization to be within $100$ seconds is trivial in any practical system.

For a given computation, we identify a program subsequence that occurred in a given (abstract) global region. Although the processes themselves are not aware of this (abstract) global time, this association allows us to model assumptions such as any message would be delivered within time $\delta$ or it will be lost. We can model such assumptions in terms of regions; if we utilize regions to be $100$ second long and we are guaranteed that messages would either be received or lost within one hour (3600 seconds) then this would mean that a message has a lifetime of at most $36$ regions.

III Free Counters and Dependent Counters

In this section, we define the notion of free and dependent counters that form the basis of our transformation algorithm. However, before we do that, we focus on the structure of the variables in the program. In particular, for program $p$, we partition its variables $V_{p}$ into two types: simple variables and complex variables. Simple variables are those variables with domain that is either a finite set or $N$, the set of natural numbers. And, complex variables are collections (e.g., set, sequence, list, etc.) of simple variables, and the constituent variables can be removed/added dynamically. To define the notion of free and dependent counters, we will unravel the structure of a complex variable and focus only on the simple variables contained in it. For example, if the program contains a complex variable, say $C$, which is a set and its current value is $\{3,5,7\}$, then we visualize this as having three simple variables $c_{1}$, $c_{2}$ and $c_{3}$ whose values are 3, 5 and 7 respectively.

With this intuition, we can view a program $p$ with variables $V_{p}$ as an equivalent program with variables $SV_{p}$, where $SV_{p}$ is a dynamically changing collection of simple variables. Moreover, the domain of any variable in $SV_{p}$ is either finite or equal to $N$, the set of natural numbers.

Remark III.1**.**

A reader might wonder why we do not define program $p$ in terms of $SV_{p}$ in the first place. As mentioned above, $SV_{p}$ is a dynamic set that has a flexible size. To update a dynamic set of variables one would require a dynamic or infinite set of actions. Without making explicit efforts, such a model has the potential to model programs that are not recursively enumerable. Our modeling with complex variables in $V_{p}$ avoids this problem, as the set of actions is always finite.

The set $SV_{p}$ is dynamic. We say that a variable in $SV_{p}$ is a permanent variable if it is guaranteed to be present in every state of $p$. For example, any simple variable in $V_{p}$ would be a permanent variable since it will be present in $SV_{p}$ at all times. A variable that is not a permanent variable is called a temporary variable.

Definition III.1**.**

(Valuation of variable in $V_{p}$). Let $x$ be a variable in $V_{p}$ and let $s$ be a state of program $p$. $x(s)$ denotes the value of $x$ in state $s$.

We overload this definition for $SV_{p}$. Specifically, if variable $x$ is present in $SV_{p}$ in the given state, the value of that variable is defined in the same manner as in the above definition. And, if the variable $x$ is not present in that state (entries in complex variables in $V_{p}$ or their equivalent simple variables in $SV_{p}$ may be added/removed), we denote its value as $\bot$. In other words,

Definition III.2**.**

(Valuation of variable in $SV_{p}$). Let $x$ be a variable in $SV_{p}$ and let $s$ be a state of program $p$. If $x$ is present in state $s$, then $x(s)$ denotes the value of $x$ in state $s$. And, if $x$ is not present in $s$, then we denote it as $x(s)=\bot$.

With the help of $SV_{p}$ and permanent/temporary variables, we define the notion of free and dependent counters. Intuitively, a free counter is a permanent variable whose value never decreases. Moreover, if we increase the value of the free counter in the final state of a computation-prefix then the resulting sequence is also a valid computation prefix of the given program. Formally,

Definition III.3**.**

(Free counter). A permanent variable $fc$ of program $p$ is a free counter iff for any computation prefix $\rho=s_{0},s_{1},s_{2},\cdots,s_{l}$ of $p$ the following conditions hold:

(i) $\forall w:0\leq w<l:fc(s_{w+1})\geq fc(s_{w})$,

(ii) $\rho^{\prime}=\rho+s_{l+1}$ is also a valid computation prefix, where state $s_{l+1}$ is reached from state $s_{l}$ by increasing the value of $fc$ (and leaving other variables unchanged), and $\rho+s_{l+1}$ denotes concatenation of $\rho$ and $s_{l+1}$.

Thus, if $fc(s_{l})$ is the value of the free counter $fc$ in program $p$ in state $s_{l}$, then $fc(s_{l+1})$ (i.e., the value of the free counter $fc$ in the subsequent state $s_{l+1}$) is never less than its value in the previous state $s_{l}$. Also, if $\rho=s_{0},s_{1},s_{2},\cdots,s_{l}$ is a valid computation prefix of $p$, appending state $s_{l+1}$ where $fc(s_{l+1})=fc(s_{l})+d$ (where $d\geq 0$) to $\rho$ results in another valid computation prefix $\rho^{\prime}=\rho+s_{l+1}$.

Next, we define the notion of dependent counters. A dependent counter is a temporary variable. We require that when this variable is created/added, its value is set to the value of some free counter within at most $k_{b}$ preceding steps. Moreover, after $k_{f}$ steps, this temporary variable is removed. And, in between the value remains unchanged.

Remark III.2**.**

Note that this requirement is not restrictive, because essentially, the requirement is just that the value assigned to the dependent counter is somehow related to a free counter in the recent past. For example, if variable $dc$ is set to $fc-5$ where $fc$ is a free counter, then we can treat it as having two variables $dc1$ and $dc2$, where setting $dc$ to $fc-5$ is modeled as setting $dc1$ to be same as $fc$ and $dc2$ to $-5$, and using $dc1+dc2$ instead of $dc$. Note that the latter is a bounded variable whereas the former can be used to satisfy the requirements of dependent counters. Likewise, setting $dc$ to $2*fc$ or $fc^{2}+10$ would be acceptable as well. Since there are too many such choices, to keep the transformation algorithm simple, we use the above definition. However, in practice it may require some syntactic tweaking of a given program without affecting its properties.

Remark III.3**.**

The goal of this requirement is that the value of the counter will eventually become obsolete and hence will no longer affect the program execution. We discuss this further in Section VI, where this requirement is handled by syntactic changes to a given program.

Definition III.4**.**

((Step based) Dependent counter). A temporary variable $dc$ of program $p$ is a ($k_{b}$,$k_{f}$)-(step-based) dependent counter iff for any computation $\rho=s_{0},s_{1},s_{2},\cdots$ of $p$ the following condition holds: $\forall a:a\geq 0:$

$dc(s_{a})=\bot\wedge dc({s_{a+1}})\neq\bot\\ \Rightarrow\exists w:a-k_{b}\leq w\leq a+1:dc({s_{a+1}})=fc(s_{w})$,

where $fc$ is a free counter in $p$ 3. 2.

$dc(s_{a})\neq\bot\Rightarrow\forall w:w>a+k_{f}:dc(s_{w})=\bot$ 4. 3.

$dc(s_{a})\neq\bot\wedge dc(s_{a+1})\neq\bot\ \ \ \Rightarrow\ \ \ dc(s_{a})=dc(s_{a+1})$

Recall that one of the assumptions in Section II-B was intended to translate the steps of a program into the corresponding time. Based on this assumption, next we define the notion of (region-based) dependent counters where the value of the dependent counter is based on the value of free counters in preceding regions. In particular, we translate $k_{b}$ and $k_{f}$ in Definition III.4 into corresponding region values. We treat a counter as $(r_{b},r_{f})$-dependent counter (1) when the dependent counter is set to a value different from $\bot$, it is set to the value of some free counter in at most $r_{b}$ (global) regions in the past, and (2) after the value of the dependent counter is set to a value different from $\bot$, within $r_{f}$ (global) regions it is set back to $\bot$. Hence, we define region based dependent counters as follows:

Definition III.5**.**

((Region based) Dependent counter). A temporary variable $dc$ of program $p$ is a ($r_{b}$,$r_{f}$)-dependent counter iff for any computation $\rho=s_{0},s_{1},s_{2},\cdots$ of program $p$ the following conditions hold: $\forall a:a\geq 0:$

$dc(s_{a})=\bot$ $\wedge$ $dc({s_{a+1}})\neq\bot$ $\wedge$ $\{s_{a+1}$ is in (global) region $r$} $\Rightarrow\exists w:w\leq a+1:dc({s_{a+1}})=fc(s_{w})$,

where $fc$ is a free counter in $p$ and $s_{w}$ is in (global) region [$r-r_{b}$..$r$] 3. 2.

$dc(s_{a})\neq\bot$

$\Rightarrow\forall w:$ region of $s_{w}$ is greater than $r+r_{f}:dc(s_{w})=\bot$ 4. 3.

$dc(s_{a})\neq\bot\wedge dc(s_{a+1})\neq\bot\ \ \ \Rightarrow\ \ \ dc(s_{a})=dc(s_{a+1})$

Remark III.4**.**

Observe that the above definition overloads the definition of step-based dependent counter. Specifically, we use the term $(k_{b},k_{f})$-(step-based) dependent counter while viewing the counter in terms of number of steps. And, we use $(r_{b},r_{f})$ while viewing it in terms of regions. In the rest of the paper, unless specified otherwise, we assume that dependent counters are specified in terms of regions.

Remark III.5**.**

In a given system, irrespective of what kind of collection (a set or a list or a sequence) that a complex variable may correspond to, our algorithm focuses only on bounding each constituent simple variable or entry in the complex variable, whereas the overall structure or the complex variable itself remains unaffected by the algorithm. In other words, operations associated with the data structure itself (e.g., the next element in the list) are performed as is. However, any operation on the data item (e.g., if first item in the list is equal to [math]) would be affected by our transformation algorithm. In this case, before the equality operation is performed, we apply the transformation based on the properties (defined in the subsequent discussion) of that list item.

IV Illustrating Free and Dependent Counters

In this section, we illustrate our definitions of free and dependent counters with the help of Lamport’s logical clocks [17]. In this program, the processes in the system communicate through messages. At any point in time each process $j$ has a logical clock value $cl.j$ associated with it, and $cl.j$ increases whenever an event occurs at $j$.

Next, using our formalism from Section II-A, we specify the actions of this program. Also, we identify the notion of simple versus complex variables, dependent versus free counters, etc. The actions of a process, say $j$, in this program are as follows:

Action Local Event

$true\longrightarrow cl.j=cl.j+d;$ 2. 2.

Action Send Event, say to process $k$

$true\longrightarrow cl.j=cl.j+d;cl.m=cl.j;$

$channel_{j,k}=channel_{j,k}\cup\{m\}$. 3. 3.

Action Receive Event, say from process $k$

$m\in channel_{j,k}\longrightarrow cl.j=max(cl.j,cl.m)+d;$

$channel_{j,k}=channel_{j,k}-\{m\}$

where $d$ is any positive integer that can be different at different instances of the actions. Observe that for every process $j$, $cl.j$ is a permanent variable. The variable $channel_{j,k}$ is a complex variable which contains timestamps of messages in transit. If we unravel this variable, we get multiple timestamps, each corresponding to a message in transit.

Theorem 1**.**

In Lamport’s logical clock program,

$cl.j$ is a free counter

Proof. The permanent variable $cl.j$ is a free counter of process $j$ that satisfies definition III.3. In particular if $\langle s_{0},s_{1},s_{2},\cdots,s_{n}\rangle$ is a computation prefix of $p$, then:

(i) at a given state $s_{l}$ when an event occurs, the value of $cl.j$ is computed as $cl.j(s_{l})=cl.j(s_{l-1})+d$, $d>0$, or $cl.j(s_{l})=max(cl.j(s_{l-1}),cl.m)+d$, $d>0$, i.e., it is higher than the logical clock value of $j$ in its previous state $s_{l-1}$. Thus $cl.j$ is an unbounded counter that has the form $cl.j(s_{l})>cl.j(s_{l-1})$ i.e. it never decreases.

(ii) Also, if $\rho=\langle s_{0},s_{1},s_{2},\cdots,s_{l}\rangle$ is a valid computation prefix of $p$, appending state $s_{l+1}$ to $\rho$, where $cl.j(s_{l+1})=cl.j(s_{l})+d$ results in $\rho^{\prime}=\rho+s_{l+1}$ which is also a valid computation prefix that contains one extra event. In other words, an increase in the logical clock value of a process by $d$ continues to preserve the correctness of the overall system. Thus the logical clock value associated with any process is a free counter. 2. 2.

Each entry in $channel_{j,k}$ is a (0,$v$)-(step-based) dependent counter provided any message is guaranteed to be received within $v$ steps.

Proof. Entries in $channel_{j,k}$ i.e., message timestamps are dependent counters in the system, since they are temporary variables that have the form outlined in definition III.4. In particular, let $\langle s_{0},s_{1},s_{2},\cdots\rangle$ be a computation of $p$ and let $cl.m$ denote the timestamp of a message $m$ in $channel_{j,k}$ . Then, $cl.m(s_{j})$ is equal to $\bot$ when $m$ is not in transit (before transmission or after reception) and $cl.m$ equals the timestamp of $m$ when message $m$ is in transit.

(i) if there exists a state $s_{a}$ such that $cl.m(s_{a})=\bot$ and $cl.m(s_{a+1})\neq\bot$ then this corresponds to sending of $m$. In this case, $cl.m(s_{a+1})$ is set to $cl.j(s_{a+1})$. It follows that this satisfies condition $1$ of Definition III.4.

(ii) if $cl.m(s_{a})\neq\bot$ in some state $s_{a}$ then it means that message $m$ is in transit in state $s_{a}$. Since we assume that every message would be delivered in $v$ steps, it follows that after $v$ steps, in state $s_{a+v}$, message $m$ will no longer be in transit. It follows that this satisfies condition $2$ of Definition III.4.

(iii) a message $m$ is timestamped only once, i.e. when it is added to $channel_{j,k}$ and $cl.m$ is set to $\bot$ only after it is removed from $channel_{j,k}$. When $m$ is in transmission the value of $cl.m$ is never changed. This satisfies condition $3$ of Definition III.4.

V Transformation Algorithm

Our transformation focuses on a three-step approach. In the first step (Section V-A), we focus on revising a given program such that the free counters in the program, while still being unbounded, are closely related to the physical time. In the second step (Section V-B), we do the same for dependent counters. Finally, in the third step (Section V-C), we revise the program obtained in the second step such that all counters become bounded. Due to reasons of space, we illustrate our algorithm in the context of the example in Section IV in Appendix A-A.

Our algorithm utilizes the observation that while the counters used in a program can grow unbounded, their growth in a given time period (assuming no transient faults) can be computed. In particular, consider a computation within one region as determined by the global clock. We assume that the growth of the counter (from its original value) would be bounded by a constant in this region. As an illustration, for the program in Section IV, we can identify this bound by considering the number of events that could be created in the given region. Note that the region from the perspective of the global clock may not be the same as that of a process, (cf. Figure 1). Hence, from the perspective of the process, the growth of the counter in its region may be different.

V-A Algorithm for Step 1: Adjusting Free Counters

Let $max_{inc}$ be the maximum increase in any free counter in one global region. Since free counters can be increased at will, the natural approach is to try to keep the value of the free counter in region $r$ to be $[r*max_{inc}..(r+1)*max_{inc}]$. It turns out that this is not feasible since the process regions may not be identical. So, a process in region $r+1$ may send a message to process in region $r$ causing it to receive values that are outside this range. Hence, in our algorithm, we proceed as follows: we try to ensure that any free counter is in the range $[3r*max_{inc}..3(r+1)*max_{inc}-1]$. However, in practice, since the regions of two processes may not be identical, we will ensure that the value of the free counter is in the range $[3r*max_{inc}..3(r+1)*max_{inc}+2*max_{inc}-1]$.111The reason for parameters 2 and 3 in this equation is discussed in Appendix A-A, where we illustrate the first step with the problem of logical clocks. Each process will first ensure that this constraint is satisfied. If it is not, it will restore the value of the free counter to $3r*max_{inc}$, where $r$ is its current region. This can be achieved by checking the values of the free counter (1) as soon as the region of the process changes (II.1 in Figure 2), or (2) the process updates its free counter as part of its actions (III.4 in Figure 2), or (3) the process uses the free counter (in evaluating guard of an action) (III.1 in Figure 2). Thus, the algorithm for transformation is as shown in Figure 2.

V-B Algorithm for Step 2: Adjusting Dependent Counters

Let $dc$ be a $(r_{b},r_{f})$ region-based dependent counter. Now, we identify the possible values of $dc$ that may happen under legitimate states, i.e., in the absence of faults.

Consider the case where a process is in region $r$, the value of its free counter is in the range $[3*r*max_{inc}..3*(r+1)*max_{inc}+2*max_{inc}-1]$. At this time, the global region is at least $r-1$. If the counter $dc$ is used in global region $r-1$, then it was initialized in global region greater than or equal to $r-1-r_{f}$. Moreover, the value it was set to can only come from a free counter $r_{b}$ regions earlier. In other words, the value of $dc$ was set to the value of a free counter in global region $r-1-r_{b}-r_{f}$ or higher. Since the process region and global region may differ by $1$, the region of the process that set the value of $dc$ is at least $r-2-r_{b}-r_{f}$. Hence, the value of $dc$ is at least $3*(r-2-r_{b}-r_{f})*max_{inc}$ Moreover, the maximum value of $dc$ is the maximum value of some free counter, i.e., it is $3*(r+1)*max_{inc}+2*max_{inc}-1$.

Hence, in Step 2 of our algorithm, we ensure that the value of a given dependent counter is always within this range. If it is not in this range, we set it to the minimum permitted value in this range, i.e., we set it to $3*(r-2-r_{b}-r_{f})*max_{inc}$. Similar to free counters, this is done (1) as soon as the region of the process changes (II.2 in Figure 2), or (2) when the process sets a dependent counter as part of its actions (III.5 in Figure 2), or (3) the process uses the dependent counter (in evaluating guard of an action) (III.2 in Figure 2). Each dependent counter is characterized by parameters $r_{b}$ and $r_{f}$. Let the maximum value of $r_{b}+r_{f}$ for any dependent counter be $max_{r}$, Thus, if a process is in region $r$, its dependent counters must be in $[3*(r-2-max_{r})*max_{inc}..3*(r+1)*max_{inc}+2*max_{inc}-1]$.

V-C Algorithm for Step 3: Bounding the Counters

Steps 1 and 2 focused on relating free and dependent counters to physical time. Recall that if a process is in region $r$, then any free counter is in the range $[3*r*max_{inc}..3*(r+1)*max_{inc}+2*max_{inc}-1]$. Recall that the value of any dependent counter is in the range [$3*(r-2-max_{r})*max_{inc}$..$3*(r+1)*max_{inc}+2*max_{inc}-1$ ]. Observe that the size of the above range is $max_{inc}*(11+3*max_{r})$. In Step 3, we revise the program so that instead of maintaining each counter to be an unbounded variable, we only maintain it in modulo $m$ arithmetic, where $m$ is 3 times the range of any dependent counter. In other words, $m=3*[max_{inc}*(11+3*max_{r})]$.

Next, we give a brief description of why the value 3*[$max_{inc}*(11+3*max_{r})$] is chosen. Towards this end, we split 3*[$max_{inc}*(11+3*max_{r})$] into three intervals, $[0..max_{inc}*(11+3*max_{r})-1],[max_{inc}*(11+3*max_{r})..2max_{inc}*(11+3*max_{r})-1]$ and $[2max_{inc}*(11+3*max_{r})..3max_{inc}*(11+3*max_{r})-1]$. Each interval corresponds to the range of dependent counters.

First observe that the interval is long enough to ensure that all free counters stabilize to their expected values. Regarding dependent counters, consider the case where a process, say $j$, is about to move from Interval [math] to Interval $1$. Since the program can be perturbed to an arbitrary state, at this point, a dependent counter could be in any interval. However, any dependent counter that exists when $j$ is about to move to Interval $1$ will be removed from the system before process $j$ moves to Interval $2$. (Note that the length of the interval was chosen in order to guarantee this property.)

Now, consider the computation of the program where process $j$ just enters Interval $1$ and continues its execution until it enters Interval 2. During this computation, process $j$ will discard all dependent counters in Interval $2$. This is due to the fact that only valid values for dependent counters in Interval $1$ are from Interval [math] or Interval $1$. Moreover, given the life-span of dependent counters, any dependent counter generated in Interval [math] will be removed before $j$ enters Interval $2$. In other words, when the first process enters Interval $2$, all dependent counters are from Interval $1$. Moreover, this property will be preserved for all subsequent intervals.

V-D Correctness of Transformation Algorithm

Let $p$ be the given stabilizing program. Let $p^{\prime}$ be the program obtained after Steps 1, 2 and 3. Starting from a legitimate state, we show that there is a mapping of a computation of $p^{\prime}$ to a computation of $p$. And, we also show that starting from an arbitrary state, any computation of $p^{\prime}$ has a suffix that maps to a computation of $p$. Taken together, this shows that if $p$ is stabilizing then so is $p^{\prime}$. For reasons of space, we present the proof in Appendix A-B in Theorem 2.

VI Application of our Algorithm

In this section, we demonstrate how our algorithm can be used to transform stabilizing programs that use unbounded variables to stabilizing programs that use bounded variables and (practically bounded) physical time. First, in Section VI-A, we show that our approach can be applied to any algorithm that can benefit from earlier seminal work by Katz and Perry [15] that focuses on adding stabilization to any program. One issue with that approach is that they need to utilize unbounded counters. We show that our approach can be used to bound counters in those applications. In Section VI-B, we demonstrate its application in Paxos. In Appendix A-C, we show that our algorithm can be applied to diffusing computation which is also applicable to leader election, mutual exclusion, loop free routing, distributed reset, etc. In Appendix A-D, we show that our algorithm can be applied to vector clocks and the resulting algorithm is similar to that in [2]. And, in Appendix A-E, we demonstrate that our approach can be used for mutual exclusion algorithm.

Due to reasons of space, we include only an outline of our approach and why the unbounded variables in these programs are either free or a dependent counter. We have chosen these applications because they demonstrate the generality of our approach and also they provide several insights into how the algorithm can be applied in a setting where free and dependent counters may not be immediately visible. These insights are discussed in remarks after corresponding sections.

VI-A Application in Katz and Perry Framework [15] for adding Stabilization

In [15], Katz and Perry presented an algorithm to add stabilization to an existing program. The key idea of the algorithm is as follows: (1) An initiator performs a snapshot of the system using the algorithm by Chandy and Lamport [6]. (2) If the snapshot indicates that the program state is not legitimate then it performs a reset whereby the program state is restored to a legitimate state and the computation proceeds thereafter.

To enable calculation of the snapshot and to perform reset without stopping the program execution, they utilize a round number –which is an unbounded integer variable– This value is incremented every time a new reset is performed. Furthermore, if a process in round $x$ receives a message with round $y$ then (1) if $x<y$, the process moves to round $y$, (2) if $x=y$ then the process treats it as a normal program execution and (3) if $x>y$ then it ignores that message.

While the round number in [15] does not meet the requirements of the free or dependent counter directly, we can modify the program slightly so that the new variables meet the constraints of free/dependent counter. First, we change the algorithm so that after every snapshot, a reset is performed. However, a Boolean variable is used to identify that this reset is fake and, hence, processes should simply move to the next round but continue accepting previous messages and not perform actual reset. Towards this end, we maintain the following variables: (1) variable $nr$ that is maintained at the initiator only to identify the next round it should use for performing reset, (2) variable $cr$ that is maintained at all processes to identify the current round. This variable is in the same spirit as the algorithm in [15]. (3) variable $b$ is a Boolean that identifies whether the reset being done is real or fake. This variable is always [math] except for the moment when the process wants to perform a real reset because the snapshot indicated that the state is not legitimate, and (4) variable $lr$ that denotes the sequence number of the last real reset performed in the system.

With this change, we can observe that (1) $nr$ is a free counter; it can be increased at will. (2) $cr$ can be viewed as a dependent counter provided we split the action that increases the current round into $cr=\bot;$ and $cr=$ new value of current round. In this case, whenever $cr$ is changed, we treat it as if it was first set to $\bot$ thereby removing this dependent counter from the system. Then, we set it to the new value thereby creating a new dependent counter in the system. (3) $lr$ is a dependent counter since $lr$ needs to be set when a new real reset is performed. It can be set to $\bot$ after sufficient time to ensure that all existing messages in the system have been delivered.

In [15], authors have utilized channel bounds as a mechanism to bound the counters. The above discussion shows that bounding is possible without using channel bounds.

Figure 4 shows the size of counters that is sufficient to preserve stabilization provided by [15]. For the sake of analysis, we consider parameters that are satisfied by any practical system. Hence, we consider the clock drift between any two processes as at most 100 seconds. Note that protocols such as NTP [21, 22] provide clock synchronization within 100 milliseconds. In such a system, we consider different parameters for message delay on a single channel and number of resets performed in one 100 second window to compute the size of counters. Even if one makes really conservative assumptions namely, a message delay of up to one hour and as many as 100 resets could be performed in a 100 second window, the size of the counters is very small ($21$ bits). The size is even lower for more reasonable parameters. Furthermore, Figure 4 shows that the size of counters is not very sensitive to the message delay and number of resets in one window. Therefore, the designer can make very conservative assumptions without increasing the size of counters.

Remark VI.1**.**

Note that the above discussion also illustrates that neither the requirement that the dependent counter cannot be changed nor that it is reset to $\bot$ is restricting. Essentially, we need to treat an update of a dependent variable as a two-step process where we first remove the old value of the dependent counter and then initialize it as a new dependent counter (which happens to have the same name) with the new value. All that our definition requires is that the old value is no longer relevant for the subsequent computations and that the new value of the dependent counter is set to a recent value of some free counter.

VI-B Paxos Based Consensus

A Paxos based consensus protocol has the following features: (1) Proposer $c$ proposes a prepare request with a sequence number $c.seq$ to the acceptors (2) Each replica accepts the request if it has not accepted a request with a higher sequence number. To do so, each acceptor $a$ maintains $a.seq$ which is the highest sequence number it has seen. (3) If an acceptor replies NO, it also notifies the proposer the value of $a.seq$ so that the proposer can choose a number higher than $a.seq$ for its subsequent request. (4) If a proposer receives sufficiently many YES responses (the precise number depends upon the number of failstop/byzantine faults we want to tolerate) it sends accept request to the acceptors. (5) An acceptor accepts this request iff it has not already responded to a prepare request with a higher sequence number. (6) A value is chosen provided sufficiently many acceptors accept the accept request.

Observe that in this protocol we have sequence numbers maintained by proposers and acceptors. We associate two sequence numbers for each proposer; $PendingSeq$ that denotes the sequence number of a pending request, if any. And, $NextSeq$, that denotes the sequence number it would use for a future request. Observe that $NextSeq$ is a free counter. The proposer can increase it at will without affecting the correctness of the Paxos based consensus algorithm. On the other hand, $PendingSeq$ is a dependent counter; it is set to be equal to $NextSeq$ whenever a request is made. As long as there exists a bound on message delivery and time required for acceptors to send a YES or NO message, $PendingSeq$ will be valid for a limited time since each pending request will be accepted or rejected within a finite time. After this time, the value of $PendingReq$ will no longer be relevant and can be set to $\bot$. If the proposer chooses to send a new request, $PendingReq$ will be set to a different value.

Remark VI.2**.**

A paxos algorithm typically uses only one variable to model $NextSeq$ and $PendingSeq$, which is always an integer (and is never set to $\bot$). However, in this case, this variable is neither a free nor a dependent counter, as it is never set to $\bot$ and it cannot be increased at will. However, by having two variables, we can observe that $NextSeq$ is a free counter. To make $PendingReq$ a dependent counter, we split the action where the proposer learns that its previous request has failed (when we set $PendingReq$ to $\bot$) and when it starts a new request. In this case, each instance of the pending request is a new dependent counter.

Finally, the sequence number associated with acceptors is also a dependent counter. It is relevant only until (1) it receives a new request with a higher sequence number or (2) if it has not received a request for a long enough time, thereby it can treat a future request as if it is the first request it has ever received.

Once again, we use very conservative assumptions to identify the size of these counters. Similar to Section VI-A, we assume that clocks are synchronized to be within $100$ seconds of each other. In such a system, even if a message can be delayed upto 1 hour and there are $10^{9}$ requests in one $100$ second window, $46$ bits are sufficient. And, for more reasonable assumptions, even less bits are required for each counter. Once again, since the number of bits do not increase substantially as we increase message delay/number of requests, the designer can utilize extremely conservative assumptions. For example, the number of bits for a counter only increases from $41$ to $46$ bits even if the message delay is increased from $1$ second to $4000$ seconds.

VII Discussion and Related Work

One of the questions raised by our work is whether the timing properties utilized in our transformation algorithm affect the generality of the algorithm. We note that given the impossibility of solving consensus, leader election and several other interesting problems in asynchronous systems [11], any fault-tolerant solution to these programs must make some reasonable assumptions about the underlying system. Some typical guarantees are process speeds, message delays etc. Our algorithm utilizes assumptions of this nature to identify free and dependent counters. **Also, as shown in our case studies, even trivially satisfiable requirements –such as clocks differ by at most $100s$ (when current state of art guarantees synchronization to be less than $10$ milliseconds) or number of events in a given region is $10^{9}$ or a message is delivered within an hour– are suffice to bound the variables within acceptable limits. **

Not all programs that use unbounded counters can be used with our transformation algorithm. For example, consider algorithms such as those for causal broadcast that maintain an unbounded counter to keep track of the number of messages sent by each process. We cannot treat this as a free counter since incrementing it would require us to send broadcast messages. In other words, there are programs where unbounded counters may be neither free nor dependent.

Our work also differs from previous work that uses distributed reset mechanism [1, 16] to bound the values of counters. Distributed reset affects all processes. By contrast, stabilization can often be achieved by only processes in the vicinity of the affected processes [7, 14]. Compared with the work in [4] which assumes the counter size to be equal to the size of integers (32/64 bit in most systems), our approach has the potential to reduce the size of the counters. For example, the analysis from Section A-A, shows a bound of $780$ is sufficient. In other words, the bound depends upon the need of the given application. Also, the algorithm in [4] requires multiple/all processes to reset their counters if some process has to reset its counters. By contrast, our algorithm, when applied in the context of Paxos, addresses this issue by ignoring messages and resetting processes whose counters are affected rather than affecting all processes. Thus, if perturbation is small, it is anticipated that our solution will affect only the corrupted processes.

VIII Conclusion and Future Work

Our work addresses a key conflict in the context of stabilization: (1) use of unbounded variables in stabilizing programs should be avoided since any implementation of that stabilizing program would rely on allocating large enough but bounded memory to each variable and transient faults could perturb the program to a state where the large bound associated with the variable is reached, and (2) use of (practically bounded) physical time is used in many systems because corruption associated with time is typically easily detectable and correctable. It provides an alternate approach for providing practically bounded-space stabilization by utilizing system and application properties such as clock synchronization properties, message delivery properties, etc. Since a rich class of problems easily admit unbounded state-space solutions, our approach can be used to provide solutions where all program variables are bounded.

We demonstrated that our algorithm is applicable in several classic problems in distributed computing, namely logical clocks, mutual exclusion, vector clocks, diffusing computation and Paxos based consensus. We also demonstrated that our work can be combined with that of [15]. This work transforms a given program into a stabilizing program with unbounded counters. Our work can be used to convert those unbounded counters into bounded counters while still preserving stabilization. This work also demonstrates that for a rich class of programs, the approach taken by non-stabilizing programs to deal with unbounded variables –provide large enough but bounded space– is feasible even with stabilizing programs.

Appendix A Proof of Correctness

In this section, we present proofs of correctness and the step-by-step illustration of our algorithm along with some of its applications –that were omitted due to reasons of space.

A-A Illustration of Our Algorithm in Logical Clocks (Section IV)

**Illustration of the Step 1. **

In this section, we identify the reason for choosing free counters of a process in region $r$ to be in the range [$3*r*max_{inc}$..$3*(r+1)*max_{inc}+2*max_{inc}-1$ ].

We use the context of logical clocks by Lamport from Section IV to identify how this bound was derived. Note that in this program, the value of $cl.j$ for every process $j$ is a free counter.

For the sake of illustration, let us assume that the maximum increase in any free counter (i.e., $cl.j$ for any process $j$) in one global region is at most $10$. In other words, the value of $cl.j$ in a computation that goes on for $\mathcal{RS}$ global time increases by at most $10$. Assume that initially, all values of $cl.j$ are $-1$ (i.e.,logical clock value of every process) and the region of every process is $-1$. As soon as it creates the first event, it is in region [math]. Thus, in one $\mathcal{RS}$ time, the value of $cl.j$ would increase to at most $10$. In $2\mathcal{RS}$ time, it would increase to at most $20$ and so on.

Our first attempt to revise this program would be to require that in region [math] the value of $cl.j$ would be between $[0..9]$. In region $1$, $cl.j$ would be between $[10..19]$ and so on. Observe that the first property is already satisfied by the original program. However, the second property may be violated since $cl.j$ may be less than $10$ even in region $1$. We can remedy this by increasing the value of $cl.j$ as needed. Note that in this instance, the fact that $cl.j$ is a free counter is important, as it guarantees that $cl.j$ will never decrease and we are permitted to increase $cl.j$ as needed. With region $1$, we need to ensure that $cl.j$ does not increase beyond $19$, as we are not allowed to decrease it. We can try to ensure this property by the length of computation which guarantees a bound on the number of events that can be created in region $1$.

While the above approach is reasonable, it suffers from a problem that the processes do not always agree on what the current region is. In particular, process $j$ could be in region $1$ but process $k$ could still be in region [math]. Now, if $j$ sends a message to $k$, it can cause $k$ to have a value for $cl.k$ that is outside $[0..9]$.

Also, if process $j$ moves quickly to region $1$ while process $k$ is still in region [math] then it creates some additional difficulties. In such a system, the clock synchronization may force $j$ to slow down its clock to ensure that $k$ can catch up. (An alternative is to let process $k$ advance its clock more quickly. But we assume that we do not control the clock synchronization algorithm.) In other words, as far as process $j$ is concerned, even if it starts with initial value of $cl.j$ to be $10$ at the beginning of region $1$, the value of $cl.j$ may exceed $19$ before $j$ enters region $2$. We can remedy the above problems with the observation that region of two processes differ by at most $1$. So, even if the clock of $j$ is forced to slow down to let $k$ catch-up, as long as process $j$ is in the same region, its clock will not increase by more than $30$. (Note that the value $30=10$*$3$ is due to the fact that region $1$ of process $j$ can overlap with global regions $0,1$ and $2$ and in each global region the increase in $cl.j$ is bounded by $10$.)

With this approach, we proceed as follows: In region [math], we try to ensure that the value of $cl.j$ is between $[0..29]$, in region $1$, the value of $cl.j$ is between $[30..59]$, in region $2$, the value of $cl.j$ is between $[60..89]$ and so on. Observe that with this change, when the first process, say $j$, moves to region $1$, all values were less than $30$. Based on the assumption about number of events in the region, as long as process $j$ is in region $1$, $cl.j$ cannot increase beyond $59$.

We can summarize the above approach by the constraint that if the region of process $j$ equals $r$ then we try to ensure that $cl.j$ is between $[30r..30r+29]$. However, while process $j$ is in region $r$, process $k$ could move to region $r+1$ and if process $k$ communicates with process $j$, it could force process $j$ to increase $cl.j$ to be more than $30r+29$. However, as long as process $j$ is in region $r$ and process $k$ is in region $r+1$ (which can last for at most $2\mathcal{RS}$ time), values of $cl.j$ or $cl.k$ cannot increase beyond $30r+29+20$.

Based on this observation, we define $r_{min}$ and $r_{max}$ that identify the minimum region value held by some process and maximum region value held by some process. (Note that these values differ by at most $1$. Furthermore, the processes themselves are not aware of these values. They only know that the value of their region equals one of them.) From the above discussion, we observe that the value of $cl.j$ is in the interval $[30r_{min}..30r_{min}+29+20]$. Moreover, it is also guaranteed to be in $[30r_{max}-30..30r_{max}+19]$. In addition, due to the property of regions, at some point, all processes must be in the same region. (If some processes are in region $r-1$ and some are in region $r$, then no process can move to region $r+1$ as long as some process is in region $r-1$. Thus, just before the first process moves to region $r+1$, all processes must be in the same region, namely region $r$.) Let this region be $r$. Clearly, $r_{min}$ and $r_{max}$ are equal to $r$ at this time. From the above discussion, at this point, $cl.j$ must be in $[30r..30r+19]$.

The above analysis is correct if we assume that the value of $cl.j$ started with initialized values. However, if the values are corrupted, the above property may not hold. To rectify this, we change the value of $cl.j$ when we know that it is corrupted. For example, let process $j$ be in region $r$. Since $r_{min}$ is at least $r$, the value of $cl.j$ is at least $30r$. Also, since $r_{max}$ is at most $r+1$, the value of $cl.j$ is at most $30(r+1)+19$. If process $j$ finds itself in a situation where the value of $cl.j$ is outside this domain, then it resets it to $30r$.

Additionally, as discussed above, there exists a time when all processes are in the same region. Given the local correction action to ensure that $cl.j$ is in the range $[30r..30(r+1)+19]$, it follows that when the first process is about to move to region $r+1$, the highest $cl$ value of any process is $30(r+1)+19$. When the first process moves to region $r+2$ (the overlap can be with at most two global regions), the increase can be up to $20$ so the highest $cl$ value is $30(r+2)+9$. Using the same argument, when the first process moves to region $r+3$, all $cl$ values are less than $30(r+3)$. Thus, when all processes move to region $r+3$, their $cl$ values are in the range $[30(r+3)..30(r+3)+29]$. And, this property is preserved for all future regions. Observe that this implies that within 3 regions, the value of the free counters is within their expected range.

The above discussion rested on the assumption that the number of events created in one region is at most $10$. Our algorithm generalizes this (as $max_{inc}$) to adjust the free counters in the first step of our algorithm.

Illustration of the Step 2.

For the sake of illustration, suppose that in Lamport’s algorithm for logical clocks, any message sent in region $x$ will be received or lost before region $x+5$.

In Logical clocks, the value of $cl.m$ is a dependent counter. When the value of $cl.m$ is set, it is set to some current value of free counter (namely, $cl$ value of the sender process). Moreover, the value will be available for at most $5$ additional regions. In other words, $cl.m$ is a $\langle 0,5\rangle$-dependent counter. Hence, the above analysis requires that when a process receives a message $m$ in region $r$, it checks whether its timestamp is at least $3*(r-7)*max_{inc}$ and at most $3*(r+1)*max_{inc}+2*max_{inc}-1$, where $max_{inc}$ equals $10$.

Illustration of the Step 3.

Since we assume that $cl.m$ is a $\langle 0,5\rangle$-dependent counter, $max_{r}=5$. Putting this value in 3*[$max_{inc}*(11+3*max_{r})$], we obtain 780. Hence, instead of maintaining variables $cl.j$ and $cl.m$, we maintain them as $cl.j\ mod\ 780$ and $cl.m\ mod\ 780$ respectively. Thus, 10 bits are sufficient to represent $cl.j$ and $cl.m$.

A-B Proof of Correctness

In this section, we show that our algorithm consisting of 3 steps preserves correctness and stabilization property of the original program. Let $p$ be the original program and let $p^{\prime}$ be the program obtained after all 3 steps. To facilitate the proof we define the notion of modulo state.

Definition A.1**.**

(modulo $m$ state). Let $s$ be a state, modulo $m$ state of $s$, where $m$ is an integer, denoted by $s^{m}$ is obtained by changing each variable $x$ with unbounded domain in $s$ to $x$ $mod$ $m$.

We extend this to modulo state predicate and modulo computation. For example, $s_{0}^{m},s_{1}^{m}\cdots$ is a modulo $m$ computation of $p$ iff $s_{0},s_{1},\cdots$ is a computation of $p$ and $\forall w:s_{w}^{m}$ is the modulo $m$ state of $s_{w}$.

Lemma 1**.**

In the absence of faults, (i.e., starting from a valid initial state), any computation of $p^{\prime}$ is also a modulo $m$ computation of $p$, where $m=3*[max_{inc}*(11+3*max_{r})]$.

Proof.

Observe that the bounds on free counters are derived based on the property that in any global region, the value of the free counter would be in the range $[3*r*max_{inc}..3*(r+1)*max_{inc}+2*max_{inc}-1]$. Hence, starting from an initial state, there would be no need to reset a free counter before/after execution of an action. Likewise, there is no need to reset a dependent counter. The only additional change to free counters is when a process moves from one region to another.

Now, consider a computation of $p^{\prime}$, say $\langle s_{0},s_{1},s_{2},\cdots\rangle$. Since $s_{0}$ is an initial state of $p$, $\langle s_{0}\rangle$ is a modulo $m$ computation-prefix of $p$ from an initial state.

Next, assume that $\langle s_{0},s_{1},\cdots s_{j}\rangle$ is a modulo computation-prefix of $p$. From the above discussion, $(s_{j},s_{j+1})$ either executes an action of $p$ or it increases a free counter. In the former case, $\langle s_{0},s_{1},\cdots s_{j},s_{j+1}\rangle$ is clearly a modulo $m$ computation of $p$. In the latter case, $\langle s_{0},s_{1},\cdots s_{j},s_{j+1}\rangle$ is also a modulo $m$ computation of $p$ by the property of free counters, namely that their value can be incremented at anytime.

From the above discussion it follows that $\langle s_{0},s_{1},s_{2},\cdots\rangle$ is a modulo $m$ computation of $p$, where $m=3*[max_{inc}*(11+3*max_{r})]$. ∎

Lemma 2**.**

A computation of $p^{\prime}$ that starts from an arbitrary state has a suffix that is a modulo $m$ computation of $p$, where $m=3*[max_{inc}*(11+3*max_{r})]$.

Proof.

Consider a computation of $p^{\prime}$. Due to local correction of free counters, the value of any free counter of a process in region $r$ would be in the range $[3*r*max_{inc}..3*(r+1)*max_{inc}+2*max_{inc}-1]$. Note that even with taking modulo under 3*[$max_{inc}*(11+3*max_{r})$], this value can be uniquely identified given the physical time, As discussed above, we partition 3*[$max_{inc}*(11+3*max_{r})$] into three intervals as shown in Figure 3. Wlog, let us assume that the current Interval is [math] as determined by the physical time. As discussed above, if we consider the computation of $p^{\prime}$ in the entire Interval $1$ then when the first process enters Interval $2$, all counters are within Interval $1$. Hence, the value of any counter can be uniquely determined from the physical time even if it is maintained in modulo 3*[$max_{inc}*(11+3*max_{r})$] arithmetic. Thus, from this point forward, every transition of $p^{\prime}$ is also a modulo $m$ transition of $p$. It follows that, every computation of $p^{\prime}$ has a suffix that is a modulo $m$ computation of $p$, where $m=3*[max_{inc}*(11+3*max_{r})]$. ∎

Theorem 2**.**

If $p$ is stabilizing to state predicate $S$ then $p^{\prime}$ is stabilizing to $S^{m}$, where $S^{m}=\{s^{m}|s\in S$ and $s^{m}$ is the modulo $m$ state of $s$ }, where $m=3*[max_{inc}*(11+3*max_{r})]$.

Proof.

To show that $p^{\prime}$ is stabilizing, we need to show that

If $p^{\prime}$ starts from an arbitrary state then it recovers to its legitimate states. This follows from Lemma 2. 2. 2.

If $p^{\prime}$ starts from a legitimate state then in the absence of faults, it remains in legitimate states forever and it is correct with respect to its specification. This follows from Lemma 1.

∎

A-C Application of our Algorithm in Diffusing Computation

The problem of diffusing computation [9] is intended to check/modify all processes in a given system. It is used in many applications such as ensuring loop free routing[12], leader election [23, 19], termination detection [9], mutual exclusion [3], and distributed reset [1]. A key property of diffusing computation is that some process (or more than one process) may initiate it. This process is called the initiator. Upon initiation, the process forwards it to its neighbors. This is called the propagation phase. When the neighbors receive this diffusing computation for the first time, they forward it to their neighbors. If they receive the same diffusing computation again –it can happen since there are several paths from the initiator to the given process– they acknowledge it but do not forward it to others. When a process receives the diffusing computation from all its neighbors, it begins the completion phase and sends an acknowledgement to its parent, i.e., the process from which it received the diffusing computation for the first time. When the initiator completes its diffusing computation, it is guaranteed that all processes in the system (that were present throughout the computation) have received and completed their diffusing computation.

One important requirement of diffusing computation is that a process will have to know whether the diffusing computation that it has received is the same as the one it had received before. This is achieved by using sequence numbers; the initiator utilizes a higher sequence number every time it begins a new diffusing computation. A straightforward approach to achieve this is via an unbounded sequence number. (If there are multiple initiators, we can use the ID of the initiator and sequence number.)

Following our algorithm, we can observe the following:

• •

The sequence number of the initiator is a free counter; it can be increased by any value when the initiator begins a new diffusing computation.

• •

The sequence number at other (non-initiator) processes is a dependent counter. It is only relevant when the process begins propagation of the diffusing computation and ends when it completes the diffusing computation. The specific values of $(r_{b},r_{f})$ for this dependent counter would be determined by the worst case time it would take for a diffusing computation to complete.

Thus, our algorithm can be applied to bound the variables of a stabilizing diffusing computation algorithm. Figure 5 shows the size of counters needed to achieve this. Once again, even if the number of diffusing computations initiated by one process in a $100$ seconds window is $100$ and message delay is up to $1$ hour, the number of bits required is $26$. Furthermore, a process can ensure that the number of diffusing computations initiated by it satisfies this limit by simply counting the number of resets in one window.

A-D Application of our Algorithm in Vector Clocks

We discussed the application of our algorithm in Lamport’s logical clocks in Section IV. We can also extend it to vector clocks [10, 20] or hybrid vector clocks [24]. Vector clocks maintain the variable $vc.j.k$ for each pair $j$ and $k$. This variable captures the knowledge that $j$ has about $k$. And, $vc.j.j$ denotes a counter maintained by $j$ for itself. In this program, $vc.j.j$ is a free counter; $j$ can increment the counter maintained by itself by any value it desires. For $j\neq k$, $vc.j.k$ is a dependent counter, provided the underlying communication graph is strongly connected and there exists a time $t$ such that a message (timestamped with vector clocks) is sent on every link in time $t$. Following this approach, we can obtain a stabilizing program for vector clocks that uses bounded counters. The resulting program is the same as that in [2]. In other words, our algorithm can be utilized to derive the program in [2]. The size of a counter with vector clocks is small as shown in Figure 5 even in scenarios where $10^{9}$ events are created in each window (of size 100 seconds) and message delay as long as an hour.

A-E Application of our Algorithm in Mutual Exclusion

The classic algorithm by Lamport [17] for mutual exclusion utilizes logical clocks (recalled in Section IV). It works as follows: (1) All messages are timestamped with logical timestamps presented in Section IV. (2) When a process wants to access the critical section, it sends a request to all processes. (3) When a process receives the request, it adds the request timestamp to its queue and replies to the requesting process. (3) A process enters critical section iff it has received replies from all processes and if the smallest request contained in its queue corresponds to its own request. And, (4) finally, after a process is done with its critical section, it sends a release message to all other processes thereby allowing others to remove its corresponding request from their queues.

While this algorithm is typically not viewed as a stabilizing algorithm, it can be made stabilizing with simple local checks and corrections. For example, if the queue of process $j$ contains a request from $k$, but process $k$ did not make the request then this request should be removed. The algorithm will ensure stabilization from this state, but it would still involve counters that are unbounded.

In this program, we can observe the following: (1) As shown in Section IV, the value of $cl.j$, the timestamp of process $j$ is a free counter. (2) Timestamps contained in any message are dependent counters. And, (3) the timestamps saved in the request queue or contained in a request/release message are dependent counters.

Remark A.1**.**

Observe that in the timestamping algorithm [17], the timestamp of a message became irrelevant as soon as the message was received. However, when the same timestamp was used in the mutual exclusion algorithm, even though the message timestamp became irrelevant, it was also saved in the request queue. In other words, it extended how long a dependent counter remains relevant. In other words, superimposing another program on an existing stabilizing program may increase the time for which a dependent counter is relevant thereby making it necessary to increase the bound associated with those counters.

A-F Summary of Notations

Generic Variables

[TABLE]

Variables in Lamport’s Logical Clocks example

[TABLE]

Variables in Katz and Perry example

$x,y$ round number

$nr$ next round

$cr$ current round

$lr$ round number when the last real reset was

performed

$b$ boolean variable that identifies if the reset was

real or fake

Variables in Paxos based Consensus example

$c.seq$ sequence number of the request made

by proposer $c$

$a.seq$ highest sequence number seen by the

acceptor $a$

$PendingSeq$ sequence number of pending request

$NextSeq$ sequence number that would be used

for a future request

Variables in Vector Clocks example

$vc.j$ vector clock maintained at process $j$

$vc.j.k$ highest clock or counter value of process $k$

that process $j$ is aware of