Ideal stabilisation

摘要

We propose a new approach to specifying and reasoning about forward recovery fault tolerant programs. We call it ideal stabilisation. The program is ideally stabilising if its every state is legitimate. Ideal stabilisation allows the specification designer to prescribe, with arbitrary degree of precision, not only the fault-free program behaviour but also its recovery operation. Unlike the classic variant, ideal stabilisation is particularly suitable for program composition. Specifications may or may not mention all possible states. We identify approaches to designing ideal stabilisation to both classes of specifications. For the first class, we state the necessary condition for an ideally stabilising solution. On the basis of this condition we prove that there is no ideally stabilising solution to the leader election problem. We illustrate the utility of the concept of ideal stabilisation by providing examples of well-known programs and proving them ideally stabilising. Specifically, we prove ideal stabilisation of the conflict manager, the alternator, the propagation of information with feedback and the alternating bit protocol.