Design, Implementation, and Verification of the Reliable Multicast Protocol

This document describes the Reliable Multicast Protocol (RMP) design, first implementation, and formal verification. RMP provides a totally ordered, reliable, atomic multicast service on top of an unreliable multicast datagram service. RMP is fully and symmetrically distributed so that no site bears an undue portion of the communications load. RMP provides a wide range of guarantees, from unreliable delivery to totally ordered delivery, to K-resilient, majority resilient, and totally resilient atomic delivery. These guarantees are selectable on a per message basis. RMP provides many communication options, including virtual synchrony, a publisher/subscriber model of message delivery, a client/server model of delivery, mutually exclusive handlers for messages, and mutually exclusive locks. It has been commonly believed that total ordering of messages can only be achieved at great performance expense. RMP discounts this. The first implementation of RMP has been shown to provide high throughput performance on Local Area Networks (LAN). For two or more destinations a single LAN, RMP provides higher throughput than any other protocol that does not use multicast or broadcast technology. The design, implementation, and verification activities of RMP have occurred concurrently. This has allowed the verification to maintain a high fidelity between design model, implementation model, and the verification model. The restrictions of implementation have influenced the design earlier than in normal sequential approaches. The protocol as a whole has matured smoother by the inclusion of several different perspectives into the product development

An approach to verification and validation of a reliable multicasting protocol: Extended Abstract

This paper describes the process of implementing a complex communications protocol that provides reliable delivery of data in multicast-capable, packet-switching telecommunication networks. The protocol, called the Reliable Multicasting Protocol (RMP), was developed incrementally using a combination of formal and informal techniques in an attempt to ensure the correctness of its implementation. Our development process involved three concurrent activities: (1) the initial construction and incremental enhancement of a formal state model of the protocol machine; (2) the initial coding and incremental enhancement of the implementation; and (3) model-based testing of iterative implementations of the protocol. These activities were carried out by two separate teams: a design team and a V&V team. The design team built the first version of RMP with limited functionality to handle only nominal requirements of data delivery. This initial version did not handle off-nominal cases such as network partitions or site failures. Meanwhile, the V&V team concurrently developed a formal model of the requirements using a variant of SCR-based state tables. Based on these requirements tables, the V&V team developed test cases to exercise the implementation. In a series of iterative steps, the design team added new functionality to the implementation while the V&V team kept the state model in fidelity with the implementation. This was done by generating test cases based on suspected errant or off-nominal behaviors predicted by the current model. If the execution of a test in the model and implementation agreed, then the test either found a potential problem or verified a required behavior. However, if the execution of a test was different in the model and implementation, then the differences helped identify inconsistencies between the model and implementation. In either case, the dialogue between both teams drove the co-evolution of the model and implementation. We have found that this interactive, iterative approach to development allows software designers to focus on delivery of nominal functionality while the V&V team can focus on analysis of off nominal cases. Testing serves as the vehicle for keeping the model and implementation in fidelity with each other. This paper describes (1) our experiences in developing our process model; and (2) three example problems found during the development of RMP. Although RMP has provided our research effort with a rich set of test cases, it also has practical applications within NASA. For example, RMP is being considered for use in the NASA EOSDIS project due to its significant performance benefits in applications that need to replicate large amounts of data to many network sites

An Approach to Verification and Validation of a Reliable Multicasting Protocol

This paper describes the process of implementing a complex communications protocol that provides reliable delivery of data in multicast-capable, packet-switching telecommunication networks. The protocol, called the Reliable Multicasting Protocol (RMP), was developed incrementally using a combination of formal and informal techniques in an attempt to ensure the correctness of its implementation. Our development process involved three concurrent activities: (1) the initial construction and incremental enhancement of a formal state model of the protocol machine; (2) the initial coding and incremental enhancement of the implementation; and (3) model-based testing of iterative implementations of the protocol. These activities were carried out by two separate teams: a design team and a V&V team. The design team built the first version of RMP with limited functionality to handle only nominal requirements of data delivery. In a series of iterative steps, the design team added new functionality to the implementation while the V&V team kept the state model in fidelity with the implementation. This was done by generating test cases based on suspected errant or offnominal behaviors predicted by the current model. If the execution of a test was different between the model and implementation, then the differences helped identify inconsistencies between the model and implementation. The dialogue between both teams drove the co-evolution of the model and implementation. Testing served as the vehicle for keeping the model and implementation in fidelity with each other. This paper describes (1) our experiences in developing our process model; and (2) three example problems found during the development of RMP

Fault recovery in the reliable multicast protocol

The Reliable Multicast Protocol (RMP) provides a unique, group-based model for distributed programs that need to handle reconfiguration events at the application layer. This model, called membership views, provides an abstraction in which events such as site failures, network partitions, and normal join-leave events are viewed as group reformations. RMP provides access to this model through an application programming interface (API) that notifies an application when a group is reformed as the result of a some event. RMP provides applications with reliable delivery of messages using an underlying IP Multicast (12, 5) media to other group members in a distributed environment even in the case of reformations. A distributed application can use various Quality of Service (QoS) levels provided by RMP to tolerate group reformations. This paper explores the implementation details of the mechanisms in RMP that provide distributed applications with membership view information and fault recovery capabilities

Reliable multicast protocol specifications flow control and NACK policy

This appendix presents the flow and congestion control schemes recommended for RMP and a NACK policy based on the whiteboard tool. Because RMP uses a primarily NACK based error detection scheme, there is no direct feedback path through which receivers can signal losses through low buffer space or congestion. Reliable multicast protocols also suffer from the fact that throughput for a multicast group must be divided among the members of the group. This division is usually very dynamic in nature and therefore does not lend itself well to a priori determination. These facts have led the flow and congestion control schemes of RMP to be made completely orthogonal to the protocol specification. This allows several differing schemes to be used in different environments to produce the best results. As a default, a modified sliding window scheme based on previous algorithms are suggested and described below

The transmission of trauma in refugee families: associations between intra-family trauma communication style, children’s attachment security and psychosocial adjustment

This study explores the transmission of trauma in 30 Middle Eastern refugee families in Denmark, where one or both parents were referred for treatment of PTSD symptoms and had non-traumatized children aged 4–9 years. The aim of the study was to explore potential risk and protective factors by examining the association between intra-family communication style regarding the parents’ traumatic experiences from the past, children’s psychosocial adjustment and attachment security. A negative impact of parental trauma on children might be indicated, as children’s Total Difficulties Scores on the Strengths and Difficulties Questionnaire (SDQ) were significantly higher than the Danish norms. A negative association between children’s attachment security as measured by the Attachment and Traumatization Story Task and higher scores on the SDQ Total Difficulties Scale approached significance, suggesting that the transmission of trauma may be associated with disruptions in children’s attachment representations. Furthermore a significant association between parental trauma communication and children’s attachment style was found

Monocoque structure for the SKITTER three-legged walker

The SKITTER 2 design is a monocoque version of the proposed lunar three-legged walker. By the definition of monocoque, the body and legs are a shell with no internal ribbing or supports added for absorbing stresses. The purpose of the monocoque is to encase the elements used for power transmission, power supply, and control of the motion. The material for the structure is a vinyl ester resin, Derakane 8084. This material is easily formable and locally obtainable. The body consists of a hexagonally shaped cylinder with truncated hexagonal pyramids on the top and botton. The legs are eight inch diameter cylinders. The legs are comprised of a tibia section and a femur section. The SKITTER 2 is powered by six actuators which provide linear forces that are transformed into rotary torques by a series of chains and sprockets. The joints connect the femur to the body and the tibia to the femur. Surrounding the joints are flexible rubber hoses that fully encase the chains and sprockets. The SKITTER 2 is capable of walking upside down, righting itself after being overturned, and has the ability to perform in many environments. Applications for this walker include lunar transport or drilling, undersea exploration, and operation in severe surroundings such as arctic temperatures or high radiation

Clinical Utility and Concordance of Upper Urinary Tract Cytology and Biopsy in Predicting Clinicopathologic Features of Upper Urinary Tract Urothelial Carcinoma

5% of urothelial carcinoma occurs in the upper urinary tract (UUT), a challenging location to biopsy. We aim to evaluate concordance between biopsy, cytology, and resection specimens in a large upper tract urothelial carcinoma (UTUC) cohort.117 UTUC resections with UUT biopsy and/or cytology specimens from 2000–2016 were retrieved; pathologic material was re-reviewed, evaluated for concordance, and correlated with clinical information. 14% pre-operative biopsies, including 8 from renal pelvis and 6 from ureter, lacked neoplastic diagnoses. 77% diagnostic biopsies included subepithelial tissue; 11% demonstrated reclassification of grade and 30% demonstrated reclassification of invasion status. 26% of renal pelvis UTUC and 36% ureter UTUC were invasive only on resection. Of 18 UTUC reclassified from noninvasive high-grade papillary urothelial carcinoma (HGPUC) to invasive HGPUC, 39% had prior radical cystectomy (versus 8% invasive UTUC and 11% noninvasive UTUC with concordant biopsies). Most high-grade UTUC (88%) and some low-grade UTUC (58%) resections had abnormal cytology results. Biopsy-resection pairs with concordant invasion status and pairs with discordant invasion status showed similar rates of recurrence (38% versus 38%) and metastasis (25% versus 27%). 14% of UUT biopsies lacked diagnostic neoplastic material. Grade concordance between biopsy and resection was high (89%), but 30% of cases showed invasion only on resection. Subepithelial tissue was less commonly present in ureter biopsies, particularly from mid or proximal ureter. UTUC in patients with prior cystectomy were more likely to show invasion on resection but not biopsy

Lead exposure in adult males in urban Transvaal Province, South Africa during the apartheid era

Human exposure to lead is a substantial public health hazard worldwide and is particularly problematic in the Republic of South Africa given the country’s late cessation of leaded petrol. Lead exposure is associated with a number of serious health issues and diseases including developmental and cognitive deficiency, hypertension and heart disease. Understanding the distribution of lifetime lead burden within a given population is critical for reducing exposure rates. Femoral bone from 101 deceased adult males living in urban Transvaal Province (now Gauteng Province), South Africa between 1960 and 1998 were analyzed for lead concentration by Inductively Coupled Plasma Mass Spectrometry (ICP-MS). Of the 72 black and 29 white individuals sampled, chronic lead exposure was apparent in nearly all individuals. White males showed significantly higher median bone lead concentration (ME = 10.04 µg·g−1), than black males (ME = 3.80 µg·g−1) despite higher socioeconomic status. Bone lead concentration covaries significantly, though weakly, with individual age. There was no significant temporal trend in bone lead concentration. These results indicate that long-term low to moderate lead exposure is the historical norm among South African males. Unexpectedly, this research indicates that white males in the sample population were more highly exposed to lead