No abstract

Abrial's Generalised Substitution Language (GSL) [4] can be modified to operate on arithmetic expressions, rather than Boolean predicates, which allows it to be applied to probabilistic programs [13]. We add a new operator p ⊕ to GSL, for probabilistic choice, and we get the probabilistic Generalised Substitution Language (pGSL): a smooth extension of GSL that includes random algorithms within its scope. In this paper we begin to examine the effect of pGSL on B 's larger-scale structures: its machines. In particular, we suggest a notion of probabilistic machine invariant. We show how these invariants interact with pGSL, at a fine-grained level; and at the other extreme we investigate how they affect our general understanding "in the large" of probabilistic machines and their behaviour. Overall, we aim to initiate the development of probabilistic B (pB), complete with a suitable probabilistic AMN (pAMN). We discuss the practical extension of the B-Toolkit [5] to support pB , and we give examples to show how pAMN can be used to express and reason about probabilistic properties of a system.

Algorithms by which peers join and leave structured overlay networks can be classified as passive or active. Passive topology maintenance relies on periodic background repair of neighbor pointers. When a node passively leaves the overlay, subsequent lookups may fail silently. Active maintenance has been proven only for fault-free networks. We develop an active topology maintenance algorithm for practical, fault-prone networks. Unlike prior work, it a) maintains ring continuity during normal topology changes and b) guarantees consistency and progress in the presence of faults. The latter property is inherited by novel extension of the Paxos Commit algorithm. The topology maintenance algorithm is formally developed using the B Method and its event-driven extensions for dynamic systems. Messaging and storage overheads are quantified.

Abstract. In earlier work, we introduced probability to the B-Method (B ) by providing a probabilistic choice substitution and by extending B 's semantics to incorporate its meaning [8]. This, a first step, allowed probabilistic programs to be written and reasoned about within B . This paper extends the previous work into refinement within B . To allow probabilistic specification and development within B , we must add a probabilistic specification substitution; and we must determine the rules and techniques for its rigorous refinement into probabilistic code. Implementation in B frequently contains loops. We generalise the standard proof obligation rules for loops giving a set of rules for reasoning about the correctness of probabilistic loops. We present a small casestudy that uses those rules, the randomised Min-Cut algorithm.