Perfect Failure Detector Research Articles

Perfect failure detection with very few bits

A failure detector is a distributed oracle that provides each process with a module that continuously outputs an estimate of which processes in the system have failed. The perfect failure detector provides accurate and eventually complete information about process failures. We show that, in asynchronous failure-prone message-passing systems, perfect failure detection can be achieved using an oracle that outputs at most ⌈log⁡α(n)⌉+1 bits per process in n-process systems, where α denotes the inverse-Ackermann function. This result is essentially optimal, as we also show that, in the same environment, no failure detector outputting a constant number of bits per process can achieve perfect failure detection.

Uniform reliable broadcast in anonymous distributed systems with fair lossy channels

Uniform reliable broadcast (URB) is an important abstraction in distributed systems, offering delivery guarantee when spreading messages between processes. Informally, URB guarantees that if a process (correct or not) delivers a message m, then all correct processes deliver m. This abstraction has been extensively investigated in distributed systems where all processes have unique identifiers. Furthermore, the majority of papers in the literature usually assume that the communication channels of the system are reliable, which is not always the case in real systems. In this paper, the URB abstraction is investigated in anonymous asynchronous message passing distributed systems with process crash failures and fair lossy channels. For that, we assume the availability of a random number generator that generates unique global values with very high probability. Firstly, a simple URB algorithm is given assuming a majority of correct processes. Then, we prove the impossibility of solving URB without a majority of correct processes if no failure detector is used. Subsequently, a new failure detector class $$A{\varTheta }$$ is proposed, which can be used to implement URB with any number of correct processes. However, the two previous URB algorithms are non-quiescent because every correct process, to offset the loss of messages caused by fair lossy channels, has to broadcast all URB $$\_$$ delivered messages forever. Hence, a perfect anonymous failure detector $$AP^*$$ is proposed, together with $$A{\varTheta }$$ , to make the URB algorithm quiescent. Finally, we discuss an alternative failure detector $$A{\varTheta }P^*$$ , which combines the properties of $$A{\varTheta }$$ and $$AP^*$$ .

An Eventually Perfect Failure Detector for Networks of Arbitrary Topology Connected with ADD Channels Using Time-To-Live Values

We present an implementation of an eventually perfect failure detector in an arbitrarily connected, partitionable network. We assume ADD channels: for each one there exist constants [Formula: see text], [Formula: see text], not known to the processes, such that for every [Formula: see text] consecutive messages sent in one direction, at least one is delivered within time [Formula: see text]. The best previous implementation used messages of bounded size, but exponential in [Formula: see text], the number of nodes. The main contribution of this paper is a novel use of time-to-live values in the design of failure detectors, obtaining a flexible implementation that uses messages of size [Formula: see text].

Implementing ♢P with Bounded Messages on a Network of ADD Channels

We present an implementation of the eventually perfect failure detector [Formula: see text] from the original hierarchy of the Chandra-Toueg [3] oracles on an arbitrary partitionable network composed of unreliable channels that can lose and reorder messages. Prior implementations of [Formula: see text] have assumed different partially synchronous models ranging from bounded point-to-point message delay and reliable communication to unbounded message size and known network topologies. We implement [Formula: see text] under very weak assumptions on an arbitrary, partitionable network composed of Average Delayed/Dropped (ADD) channels [11] to model unreliable communication. Unlike older implementations, our failure detection algorithm uses bounded-sized messages to eventually detect all nodes that are unreachable (crashed or disconnected) from it.

Reliable broadcast in anonymous distributed systems with fair lossy channels

Reliable Broadcast (RB) is a basic abstraction in distributed systems, because it allows processes to communicate consistently and reliably to each other. It guarantees that all correct process reliable deliver the same set of messages. This abstraction has been extensively investigated in distributed systems where all processes have different identifiers, and the communication channels are reliable. However, more and more anonymous systems appear due to the motivation of privacy. It is significant to extend RB into anonymous system model where each process has no identifier. In another hand, the requirement of reliable communication channels is not always satisfied in real systems. Hence, this paper is aimed to study RB abstraction in anonymous distributed systems with fair lossy communication channels. In distributed systems, symmetry always mean that two systems should be considered symmetric if they behave identically, and two components of a system should be considered symmetric if they are indistinguishable. Hence, the anonymous distributed systems is symmetry. The design difficulty of RB algorithm lies in how to break the symmetry of the system. In this paper, we propose to use a random function to break it. Firstly, a non-quiescent RB algorithm tolerating an arbitrary number of crashed processes is given. Then, we introduce an anonymous perfect failure detector AP?. Finally, we propose an extended and quiescent RB algorithm using AP?.

Reliable broadcast in anonymous distributed systems with fair lossy channels

Reliable broadcast (RB) is a basic abstraction in distributed systems, because it allows processes to communicate consistently and reliably with each other. This abstraction has been extensively investigated in eponymous distributed systems (i.e., all processes have different identifiers) in contrast to the study in anonymous systems (i.e., all processes have no ID). Hence, this paper is aimed to study RB in anonymous distributed systems with fair lossy communication channels. Firstly, a non-quiescent RB algorithm tolerating an arbitrary number of crashed processes is given. Then, we introduce an anonymous perfect failure detector AP*. Finally, we propose an extended and quiescent RB algorithm using AP*, in which eventually no process sends messages.

Communication-optimal eventually perfect failure detection in partially synchronous systems

Since Chandra and Toueg introduced the failure detector abstraction for crash-prone systems, several algorithms implementing failure detectors in partially synchronous systems have been proposed. Their performance can be measured by their Communication efficiency, defined as the number of links used forever. In this regard, in a communication-efficient algorithm only n links are used forever, n being the number of processes in the system. In this paper, we present communication optimality, a communication efficiency degree reached when only c links are used forever, c being the number of correct processes. We show that c is the minimum number of links used forever required to implement ◇P and that c is also optimal for ◇S and Ω when c<n. Finally, we propose two communication-optimal ◇P algorithms following respectively one-to-all and one-to-one communication patterns to manage suspicions, showing that there is a trade-off between detection latency and sporadic communication overhead.

Quorum-based mutual exclusion in asynchronous distributed systems with unreliable failure detectors

This paper considers the fault-tolerant quorum-based mutual exclusion problem in a message-passing asynchronous system and determines a failure detector to solve the problem. This failure detector, which we call the modal failure detector star, and which we denote by M ?, is strictly weaker than the perfect failure detector P but strictly stronger than the eventually perfect failure detector ?P. The paper shows that at any environment, the problem is solvable with M ?. In addition, we make an analysis of our algorithm performance in terms of the number of messages and synchronization delay.

연속시간 흡수 마코프체인을 활용한 신뢰도 중복 최적화 문제

The increasing level of operation in high-tech industry is likely to require ever more complex structure in reliability problem. Furthermore, system failures are more significant on society as a whole than ever before. Reliability redundancy optimization problem (RROP) plays a important role in the designing and analyzing the complex system. RROP involves selection of components with multiple choices and redundancy levels for maximizing system reliability with constraints such as cost, weight, etc. Meanwhile, previous works on RROP dealt with system with perfect failure detection, which gave at most a good solution. However, we studied RROP with imperfect failure detection and switching. Using absorbing Markov Chain, we present not a good solution but the optimal one. In this study, the optimal system configuration is designed with warm and cold-standby redundancy for k-out-of-n system in terms of MTTF that is one of the performance measures of reliability.

Anonymous asynchronous systems: the case of failure detectors

Due to the multiplicity of loci of control, a main issue distributed systems have to cope with lies in the uncertainty on the system state created by the adversaries that are asynchrony, failures, dynamicity, mobility, etc. Considering message-passing systems, this paper considers the uncertainty created by the net effect of asynchrony and process crash failures in systems where the processes are anonymous (i.e., processes have no identity and locally execute the same algorithm). Trivially, agreement problems such as consensus, that cannot be solved in non-anonymous asynchronous systems prone to process failures, cannot be solved either if the system is anonymous. The paper investigates failure detectors that allow processes to circumvent this impossibility. It has several contributions. It first presents four failure detectors (denoted AP, $${\overline{AP}}$$ , AΩ, and AΣ) and show that they are the “identity-free” counterparts of perfect failure detectors, eventual leader failure detectors, and quorum failure detectors, respectively. AΣ is new and showing that AΣ and Σ have the same computability power in a non-anonymous system is not trivial. The paper also shows that the notion of failure detector reduction is related to the computation model. Then, the paper presents and proves correct a uniform anonymous consensus algorithm based on the failure detector pair (AΩ, AΣ) (“uniform” means here that not only processes have no identity, but no process is aware of the total number of processes). This new algorithm is not a simple “straightforward extension” of an algorithm designed for non-anonymous systems. To benefit from AΣ, it uses a novel broadcast facility which encapsulates an AΣ-based message exchange pattern that provides the processes with an interesting intersection property on the set of messages they have exchanged. Finally, the paper discusses the notions of failure detector hierarchy, weakest failure detector for anonymous consensus, and the implementation of identity-free failure detectors in anonymous systems.

Exploiting partitioned synchrony to implement accurate failure detectors

We exploit the concept of partitioned synchrony to show that it is possible to implement accurate failure detectors in a non-synchronous distributed system. To realise that, we introduce the partitioned synchronous system (Spa) that is weaker than the conventional synchronous system. Based on some properties we introduce (such as strong partitioned synchrony) that must be valid in Spa and a trivially implementable timeliness oracle, we show how to implement a perfect failure detector P in Spa. Moreover, we show that even if strong partitioned synchrony is not valid, we are still able to take advantage of the existing synchronous partitions for improving the robustness of applications, by introducing a partially perfect (and accurate) failure detector named xP. We also discuss how applications can benefit from these failure detectors and present some related experimental data. The necessary properties and algorithms for implementing P and xP are presented in the paper, as well as the related correctness proofs.

The Price of Anonymity

This article addresses the consensus problem in asynchronous systems prone to process crashes, where additionally the processes are anonymous (they cannot be distinguished one from the other: they have no name and execute the same code). To circumvent the three computational adversaries (asynchrony, failures, and anonymity) each process is provided with a failure detector of a class denoted ψ , that gives it an upper bound on the number of processes that are currently alive (in a nonanonymous system, the classes ψ and P ---the class of perfect failure detectors---are equivalent). The article first presents a simple ψ -based consensus algorithm where the processes decide in 2 t + 1 asynchronous rounds (where t is an upper bound on the number of faulty processes). It then shows one of its main results, namely 2 t + 1 is a lower bound for consensus in the anonymous systems equipped with ψ . The second contribution addresses early-decision. The article presents and proves correct an early-deciding algorithm where the processes decide in min(2 f + 2, 2 t + 1) asynchronous rounds (where f is the actual number of process failures). This leads us to think that anonymity doubles the cost (with respect to synchronous systems) and it is conjectured that min(2 f + 2, 2 t + 1) is the corresponding lower bound. The article finally considers the k -set agreement problem in anonymous systems. It first shows that the previous ψ -based consensus algorithm solves the k -set agreement problem in Rt = 2⌊t k⌋ + 1 asynchronous rounds. Then, considering a family of failure detector classes { ψℓ }0 ≤ ℓ &lt; k that generalizes the class ψ (= ψ 0 ), the article presents an algorithm that solves the k -set agreement in Rt,ℓ = 2 ⌊ t k − ℓ ⌋ + 1 asynchronous rounds. This last formula relates the cost ( Rt,ℓ ) the coordination degree of the problem ( k ), the maximum number of failures ( t ), and the the strength ( ℓ ) of the underlying failure detector. Finally the article concludes by presenting problems that remain open.

A Novel Failure Detection Algorithm for Reliable Distributed Systems

A failure detection service is perfect if it eventually detects all failures and every detection correctly identifies a failure that has occurred. Such a perfect failure detection service serves as a basic building block for many reliable distributed systems, for example in distributed lock services. In this paper, we introduce a perfect failure detection scheme in order to improve the fault tolerance of the service. We provide the precise system model and specification for a failure detection service. We present two novel algorithms that implement the failure detection service. We further develop a set of quality-of-service (QoS) metrics for perfect failure detection services, and apply probabilistic analysis to quantify the QoS metrics of the two algorithms.

Oracle-based flocking of mobile robots in crash-recovery model

This paper considers a system of autonomous mobile robots that can move freely in a two-dimensional plane, and where a number of them can fail by crashing. The crash of a robot can be either permanent or temporary, that is, after its crash the robot either executes no action or it recovers from its failure. These robots repeatedly go through a succession of activation cycles during which they observe the environment, compute a destination and move. In particular, we assume weak robots, in the sense that robots cannot communicate explicitly between each other. Also, they cannot remember their past computations (i.e., they are oblivious). Finally, robots do not agree on a common coordinate system. In this paper, we address the fault-tolerant flocking problem under the crash-recovery model. That is, starting from any initial configuration, a group of non-faulty robots are required to form a desired pattern, and move together while following a robot leader moving on some trajectory, and keeping such a pattern in movement. Specifically, we propose a fault-tolerant flocking algorithm in the semi-synchronous model that allows correct robots to dynamically form a regular polygon in finite time, and maintain it in movement infinitely often. Our algorithm relies on the existence of two devices, namely an eventually perfect failure detector device to ensure failure detection, and also an eventual leader device to handle leader election. The algorithm tolerates permanent crash failures, and also crash-recovery failures of robots due to its oblivious feature. The proposed algorithm ensures the necessary restrictions on the movement of robots in order to avoid collisions between them. In addition, it is robust with respect to changes in the environment.

The impossibility of boosting distributed service resilience

We study f-resilient services, which are guaranteed to operate as long as no more than f of the associated processes fail. We prove three theorems asserting the impossibility of boosting the resilience of such services. Our first theorem allows any connection pattern between processes and services but assumes these services to be atomic (linearizable) objects. This theorem says that no distributed system in which processes coordinate using f-resilient atomic objects and reliable registers can solve the consensus problem in the presence of f + 1 undetectable process stopping failures. In contrast, we show that it is possible to boost the resilience of some systems solving problems easier than consensus: for example, the 2-set-consensus problem is solvable for 2 n processes and 2 n - 1 failures (i.e., wait-free) using n-process consensus services resilient to n - 1 failures (wait-free). Our proof is short and self-contained. We then introduce the larger class of failure-oblivious services. These are services that cannot use information about failures, although they may behave more flexibly than atomic objects. An example of such a service is totally ordered broadcast. Our second theorem generalizes the first theorem and its proof to failure-oblivious services. Our third theorem allows the system to contain failure-aware services, such as failure detectors, in addition to failure-oblivious services. This theorem requires that each failure-aware service be connected to all processes; thus, f + 1 process failures overall can disable all the failure-aware services. In contrast, it is possible to boost the resilience of a system solving consensus using failure-aware services if arbitrary connection patterns between processes and services are allowed: consensus is solvable for any number of failures using only 1-resilient 2-process perfect failure detectors. As far as we know, this is the first time a unified framework has been used to describe both atomic and non-atomic objects, and the first time boosting analysis has been performed for services more general than atomic objects.

비동기적 분산 시스템에서 결함허용 상호 배제 프로토콜의 설계

This paper defines the quorum-based fault-tolerant mutual exclusion problem in a message-passing asynchronous system and determines a failure detector to solve the problem. This failure detector, which we call the modal failure detector star, and which we denote by , is strictly weaker than the perfect failure detector P but strictly stronger than the eventually perfect failure detector ◇P. The paper shows that at any environment, the problem is solvable with .

Global data computation in chordal rings

Existing Global Data Computation (GDC) protocols for asynchronous systems are round-based algorithms designed for fully connected networks. In this paper, we discuss GDC in asynchronous chordal rings, a non-fully connected network. The virtual links approach to solve the consensus problem may be applied to GDC for non-fully connected networks, but it incurs high message overhead. To reduce the overhead, we propose a new non-round-based GDC protocol for asynchronous chordal rings with perfect failure detectors. The main advantage of the protocol is that there is no notion of rounds. Every process creates two messages initially, with one message traversing in a clockwise direction and visiting each and every process in the chordal ring. The second message traverses in a counterclockwise direction. When there is direct connection between two processes, a message is sent directly. Otherwise, the message is sent via virtual links. When the two messages return, the process decides according to the information maintained by the two messages. The perfect failure detector of a process need only detect the crash of neighboring processes, and the crash information is disseminated to all other processes. Analysis and comparison with two virtual links approaches show that our protocol reduces message complexity significantly.

Optimal message-driven implementations of omega with mute processes

We investigate the complexity of algorithms in message-driven models. In such models, events in the computation can only be caused by message receptions, but not by the passage of time. Hutle and Widder [2005a] have shown that there is no deterministic message-driven self-stabilizing implementation of the eventually strong failure detector and thus Ω in systems with uncertainty in message delays and channels of unknown capacity using only bounded space. Under stronger assumptions it was shown that even the eventually perfect failure detector can be implemented in message-driven systems consisting of at least f + 2 processes ( f being the upper bound on the number of processes that crash during an execution). In this article we show that f + 2 is in fact a lower bound in message-driven systems, even if nonstabilizing algorithms are considered. This contrasts time-driven models where f + 1 is sufficient for failure detector implementations. Moreover, we investigate algorithms where not all processes send message, that is, are active, but some (in a predetermined set) remain passive. Here, we show that the f + 2 processes required for message-driven systems must be active, while in time-driven systems it suffices that f processes are active. We also provide message-driven implementations of Ω. Our algorithms are efficient in the sense that not all processes have to send messages forever, which is an improvement to previous message-driven failure detector implementations.

On termination detection in crash-prone distributed systems with failure detectors

We investigate the problem of detecting termination of a distributed computation in systems where processes can fail by crashing. Specifically, when the communication topology is fully connected, we describe a way to transform any termination detection algorithm A that has been designed for a failure-free environment into a termination detection algorithm B that can tolerate process crashes. Our transformation assumes the existence of a perfect failure detector. We show that a perfect failure detector is in fact necessary to solve the termination detection problem in a crash-prone distributed system even if at most one process can crash. Let μ ( n , M ) and δ ( n , M ) denote the message complexity and detection latency, respectively, of A when the system has n processes and the underlying computation exchanges M application messages. The message complexity of B is O ( n + μ ( n , 0 ) ) messages per failure more than the message complexity of A . Also, its detection latency is O ( δ ( n , 0 ) ) per failure more than that of A . Furthermore, application message size increases by at most log ( f + 1 ) bits, where f is the actual number of processes that fail during an execution. We show that, when the communication topology is fully connected, under certain realistic assumption, any fault-tolerant termination detection algorithm can be forced to exchange Ω ( n f ) control messages in the worst-case even when at most one process may be active initially and the underlying computation does not exchange any application messages. This implies that our transformation is optimal in terms of message complexity when μ ( n , 0 ) = O ( n ) . The fault-tolerant termination detection algorithm resulting from the transformation satisfies three desirable properties. First, it can tolerate the failure of up to n − 1 processes. Second, it does not impose any overhead on the fault-sensitive termination detection algorithm until one or more processes crash. Third, it does not block the application at any time. Further, using our transformation, we derive a fault-tolerant termination detection algorithm that is the most efficient fault-tolerant termination detection algorithm that has been proposed so far to our knowledge. Our transformation can be extended to arbitrary communication topologies provided process crashes do not partition the system.

Pronto: High availability for standard off-the-shelf databases

Enterprise applications typically store their state in databases. If a database fails, the application is unavailable while the database recovers. Database recovery is time consuming because it involves replaying the persistent transaction log. To isolate end users from database failures we introduce Pronto, a protocol to orchestrate the transaction processing by multiple, standard databases so that they collectively implement the illusion of a single, highly available database. Pronto is a novel replication protocol that handles non-determinism without relying on perfect failure detection, does not require any modifications in existing applications and databases, and allows databases from different providers to be part of the replicated compound.