Unreliable Failure Detectors Research Articles

The missing piece: a distributed system-level diagnosis model for the implementation of unreliable failure detectors

The missing piece: a distributed system-level diagnosis model for the implementation of unreliable failure detectors

Impact FD: An Unreliable Failure Detector Based on Process Relevance and Confidence in the System

This paper presents a new unreliable failure detector, called the Impact failure detector (FD) that, contrarily to the majority of traditional FDs, outputs a trust level value which expresses the degree of confidence in the system. An impact factor is assigned to each process and the trust level is equal to the sum of the impact factors of the processes not suspected of failure. Moreover, a threshold parameter defines a lower bound value for the trust level, over which the confidence in the system is ensured. In particular, we defined a f l exi bi l i t y property that denotes the capacity of the Impact FD to tolerate a certain margin of failures or false suspicions, i.e., its capacity of considering different sets of responses that lead the system to trusted states. The Impact FD is suitable for systems that present node redundancy, heterogeneity of nodes, clustering feature, and allow a margin of failures which does not degrade the confidence in the system. The paper also includes a timer-based distributed algorithm which implements an Impact FD, as well as its proof of correctness, for systems whose links are lossy asynchronous or for those whose all (or some) links are eventually timely. Performance evaluation results, based on PlanetLab [1] traces, confirm the degree of flexible applicability of our failure detector and that, due to the accepted margin of failure, both failures and false suspicions are more tolerated when compared to traditional unreliable failure detectors.

A QoS-configurable failure detection service for internet applications

Unreliable failure detectors are a basic building block of reliable distributed systems. Failure detectors are used to monitor processes of any application and provide process state information. This work presents an Internet Failure Detector Service (IFDS) for processes running in the Internet on multiple autonomous systems. The failure detection service is adaptive, and can be easily integrated into applications that require configurable QoS guarantees. The service is based on monitors which are capable of providing global process state information through a SNMP MIB. Monitors at different networks communicate across the Internet using Web Services. The system was implemented and evaluated for monitored processes running both on single LAN and on PlanetLab. Experimental results are presented, showing the performance of the detector, in particular the advantages of using the self-tuning strategies to address the requirements of multiple concurrent applications running on a dynamic environment.

A Safe Election Protocol based on an Unreliable Failure Detector in Distributed Systems

The fault-tolerant election protocol, which implies the safety strengthened election protocol, is needed in a practical distributed computing environment. Consider a mission critical distributed system such as an electronic commerce system that runs multiple servers in which one of them roles a master (leader) and others are slaves. To have data consistency among the servers in the system, this system should not violate safety property, which means that all processes connected the system never disagree on a leader. In those systems the safety property is more important property than the liveness property. In this paper, we presents a safety strengthened leader election protocol with an unreliable failure detector and analyses it in terms of safety and liveness properties in asynchronous distributed systems.

Flow updating: Fault-tolerant aggregation for dynamic networks

Data aggregation is a fundamental building block of modern distributed systems. Averaging based approaches, commonly designated gossip-based, are an important class of aggregation algorithms as they allow all nodes to produce a result, converge to any required accuracy, and work independently from the network topology. However, existing approaches exhibit many dependability issues when used in faulty and dynamic environments. This paper describes and evaluates a fault tolerant distributed aggregation technique, Flow Updating, which overcomes the problems in previous averaging approaches and is able to operate on faulty dynamic networks. Experimental results show that this novel approach outperforms previous averaging algorithms; it self-adapts to churn and input value changes without requiring any periodic restart, supporting node crashes and high levels of message loss, and works in asynchronous networks. Realistic concerns have been taken into account in evaluating Flow Updating, like the use of unreliable failure detectors and asynchrony, targeting its application to realistic environments.

Implementing the weakest failure detector for solving the consensus problem

The concept of unreliable failure detector was introduced by Chandra and Toueg as a mechanism that provides information about process failures. This mechanism has been used to solve several agreement problems, such as the consensus problem. In this paper, algorithms that implement failure detectors in partially synchronous systems are presented. First two simple algorithms of the weakest class to solve the consensus problem, namely the Eventually Strong class (⋄S), are presented. While the first algorithm is wait-free, the second algorithm is f-resilient, where f is a known upper bound on the number of faulty processes. Both algorithms guarantee that, eventually, all the correct processes agree permanently on a common correct process, i.e. they also implement a failure detector of the class Omega (Ω). They are also shown to be optimal in terms of the number of communication links used forever. Additionally, a wait-free algorithm that implements a failure detector of the Eventually Perfect class (⋄P) is presented. This algorithm is shown to be optimal in terms of the number of bidirectional links used forever.

Quorum-based mutual exclusion in asynchronous distributed systems with unreliable failure detectors

This paper considers the fault-tolerant quorum-based mutual exclusion problem in a message-passing asynchronous system and determines a failure detector to solve the problem. This failure detector, which we call the modal failure detector star, and which we denote by M ?, is strictly weaker than the perfect failure detector P but strictly stronger than the eventually perfect failure detector ?P. The paper shows that at any environment, the problem is solvable with M ?. In addition, we make an analysis of our algorithm performance in terms of the number of messages and synchronization delay.

Eventually Strong Failure Detector with Unknown Membership

The distributed computing scenario is rapidly evolving for integrating self-organizing and dynamic wireless networks. Unreliable failure detectors (FDs) are classical mechanisms that provide information about process failures and can help systems to cope with the high dynamics of these networks. A number of failure detection algorithms have been proposed so far. Nonetheless, most of them assume a global knowledge about the membership as well as a fully communication connectivity; additionally, they are time-based, requiring that eventually some bound on the message transmission will permanently hold. These assumptions are no longer appropriate to the new scenario. This paper presents a new FD protocol that implements a new class of detectors, namely ⋄ Sℳ, which adapts the properties of the ⋄ S class to a dynamic network with an unknown membership. It has the interesting feature of being time-free, so that it does not rely on timers to detect failures; moreover, it tolerates the mobility of nodes and message losses.

Consensus in the presence of mortal Byzantine faulty processes

We consider the problem of reaching agreement in distributed systems in which some processes may deviate from their prescribed behavior before they eventually crash. We call this failure model “mortal Byzantine”. After discussing some application examples where this model is justified, we provide matching upper and lower bounds on the number of faulty processes, and on the required number of rounds in synchronous systems. We then continue our study by varying different system parameters. On the one hand, we consider the failure model under weaker timing assumptions, namely for partially synchronous systems and asynchronous systems with unreliable failure detectors. On the other hand, we vary the failure model in that we limit the occurrences of faulty steps that actually lead to a crash in synchronous systems.

A Fault-Tolerant Token-Based Atomic Broadcast Algorithm

Many atomic broadcast algorithms have been published in the last 20 years. Token-based algorithms represent a large class of these algorithms. Interestingly, all the token-based atomic broadcast algorithms rely on a group membership service and none of them uses unreliable failure detectors directly. This paper presents the first token-based atomic broadcast algorithm that uses an unreliable failure detector instead of a group membership service. It requires a system size that is quadratic in the number of supported failures. The special case of a single supported failure (f=1) requires n=3 processes. We experimentally evaluate the performance of this algorithm in local and wide area networks, in order to emphasize that atomic broadcast is efficiently implemented by combining a failure detector and a token-based mechanism. The evaluation shows that the new token-based algorithm surpasses the performance of the other algorithms in most small-system settings.

Eventual Clusterer: A Modular Approach to Designing Hierarchical Consensus Protocols in MANETs

This paper proposes a modular approach to the design of hierarchical consensus protocols for the mobile ad hoc network with a static and known set of hosts. A two-layer hierarchy is imposed on the network by grouping mobile hosts into clusters, each with a clusterhead. The messages from and to the hosts in the same cluster are merged/unmerged by the clusterhead so as to reduce the message cost and improve the scalability. The proposed modular approach separates the concerns of clustering hosts from achieving consensus. A clustering function, called eventual clusterer (denoted as diamC), is designed for constructing and maintaining the two-layer hierarchy. Similar to unreliable failure detectors, diamC greatly facilitates the design of hierarchical protocols by providing the fault-tolerant clustering function transparently. We propose an implementation of diamC based on the failure detector diamS. Using diamC, we design a new hierarchical consensus protocol. As shown by the performance evaluation results, the proposed consensus protocol can save both message cost and time cost. Our proposed modular design is therefore effective and can lead to efficient solutions to achieving consensus in mobile ad hoc networks.

Implementing the Omega failure detector in the crash-recovery failure model

Unreliable failure detectors are mechanisms providing information about process failures, that allow to solve several problems in asynchronous systems, e.g., Consensus. A particular failure detector, Omega, provides an eventual leader election functionality. This paper addresses the implementation of Omega in the crash-recovery failure model. We first propose an algorithm assuming that processes are reachable from the correct process that crashes and recovers a minimum number of times. Then, we propose two algorithms which assume only that processes are reachable from some correct process. Besides this, one of the algorithms requires the membership to be known a priori, while the other two do not.

On the computability power and the robustness of set agreement-oriented failure detector classes

Solving agreement problems deterministically, such as consensus and k-set agreement, in asynchronous distributed systems prone to an unbounded number of process failures has been shown to be impossible. To circumvent this impossibility, unreliable failure detectors for the crash failure model have been widely studied. These are oracles that provide information on failures. The exact nature of such information is defined by a set of abstract properties that a particular class of failure detectors satisfy. The weakest class of such failure detectors that allow to solve consensus is Ω. This paper considers failure detector classes from the literature that solve k-set agreement in the crash failure model, and studies their relative power. It shows that the family of failure detector classes $${\diamond\mathcal{S}_x}$$ (1 ≤ x ≤ n), and $${\diamond \psi^y}$$ (0 ≤ y ≤ n), can be “added” to provide a failure detector of the class Ω z (1 ≤ z ≤ n, a generalization of Ω). It also characterizes the power of such an “addition”, namely, $${\diamond {\mathcal S}_x +\diamond \psi^y\rightsquigarrow\Omega^z \Leftrightarrow x+y+z > t+1}$$ , $${\diamond \psi^y}$$ can construct Ω z iff y + z > t, and $${\diamond {\mathcal S}_x}$$ can construct Ω z iff x + z > t + 1, where t is the maximum number of processes that can crash in a run. As an example, the paper shows that, while $${\diamond {\mathcal S}_{t}}$$ allows solving 2-set agreement (but not consensus) and $${\diamond \psi^{1}}$$ allows solving t-set agreement (but not (t − 1)-set agreement), a system with failure detectors of both classes can solve consensus for any value of t. More generally, the paper studies the failure detector classes $${\diamond {\mathcal S}_x}$$ , $${\diamond \psi^y}$$ and Ω z , and shows which reductions among these classes are possible and which are not. The paper also presents a message-passing Ω k -based k-set agreement protocol and shows that Ω k is not enough to solve (k − 1)-set agreement. In that sense, it can be seen as a step toward the characterization of the weakest failure detector class that allows solving the k-set agreement problem.

Design and Performance Evaluation of Efficient Consensus Protocols for Mobile Ad Hoc Networks

Designing protocols for solving the consensus problem faces new challenges in mobile computing environments. Among others, how we can achieve message efficiency for saving resource consumption has been the focus of research. In this paper, we present the HC protocol, a message efficient consensus protocol for MANETs. We consider the widely used system model where the hosts fail by crashes and the system is equipped with Chandra-Toueg's unreliable failure detectors. Unlike existing consensus protocols, the HC protocol uses a two-layer hierarchy based on clusters to achieve message efficiency. The messages from and to the hosts in the same cluster are merged so as to reduce the message cost. However, adding such a hierarchy is not trivial. Due to host movements and failures, the hierarchy changes from time to time and this may cause message loss. In designing HC, we also propose methods to handle such message losses. Extensive simulations have been carried out to evaluate and compare the performance of the HC protocol and similar protocols in a MANET environment. Simulation results show that, in most cases, our protocol can significantly reduce both the message cost and time cost. With increases in the system scale or the percentage of faulty hosts, the advantage of our protocol becomes more obvious.

On the Respective Power of /spl Lozenge/P and /spl Lozenge/S to Solve One-Shot Agreement Problems

Unreliable failure detectors are abstract devices that, when added to asynchronous distributed systems, enable solving distributed computing problems (e.g., consensus) that otherwise would be impossible to solve in these systems. This paper focuses on two classes of failure detectors defined by Chandra and Toueg, namely, the classes denoted diamP (eventually perfect) and diamS (eventually strong). Both classes include failure detectors that eventually detect permanently all process crashes, but while the failure detectors of diamP eventually make no erroneous suspicions, the failure detectors of diamS are only required to eventually not suspect a single correct process. Informally, in a one-shot agreement problem, a new problem instance is created each time the processes propose new values to be decided on (e.g., consensus is one-shot). In such a context, this paper addresses the following question related to the comparative power of these classes, namely: "Are there one-shot agreement problems that can be solved in asynchronous distributed systems with reliable links but prone to process crash failures augmented with op, but cannot be solved when those systems are augmented with diamS?" Surprisingly, the paper shows that the answer to this question is "no." An important consequence of this result is that diamP cannot be the weakest class of failure detectors that enables solving one-shot agreement problems in unreliable asynchronous distributed systems

On the Respective Power of /spl Lozenge/P and /spl Lozenge/S to Solve One-Shot Agreement Problems

Unreliable failure detectors are abstract devices that, when added to asynchronous distributed systems, enable solving distributed computing problems (e.g., consensus) that otherwise would be impossible to solve in these systems. This paper focuses on two classes of failure detectors defined by Chandra and Toueg, namely, the classes denoted diamP (eventually perfect) and diamS (eventually strong). Both classes include failure detectors that eventually detect permanently all process crashes, but while the failure detectors of diamP eventually make no erroneous suspicions, the failure detectors of diamS are only required to eventually not suspect a single correct process. Informally, in a one-shot agreement problem, a new problem instance is created each time the processes propose new values to be decided on (e.g., consensus is one-shot). In such a context, this paper addresses the following question related to the comparative power of these classes, namely: "Are there one-shot agreement problems that can be solved in asynchronous distributed systems with reliable links but prone to process crash failures augmented with op, but cannot be solved when those systems are augmented with diamS?" Surprisingly, the paper shows that the answer to this question is "no." An important consequence of this result is that diamP cannot be the weakest class of failure detectors that enables solving one-shot agreement problems in unreliable asynchronous distributed systems

Designing Efficient Algorithms for the Eventually Perfect Failure Detector Class

This paper focuses on the design of unreliable failure detectors of the Eventually Perfect class (◊P) in crash-prone partially synchronous systems. We adopt a monitoring mechanism based on heartbeats over a logical ring arrangement of processes as the common design feature. This provides good communication efficiency, a performance parameter which refers to the number of links that carry messages forever. We follow two different approaches that result in two families of failure detectors: a nearly communication-efficient family, which uses n + C links forever, being C the number of correct processes out of the n processes in the system, and a communication efficient family, which uses only n links forever. Besides communication efficiency, we evaluate the algorithms in terms of QoS parameters, which include the capability of the failure detector to provide right answers as well as its reaction time.

A weakly-adaptive condition-based consensus algorithm in asynchronous distributed systems

The consensus problem is one of the most fundamental and important problems for designing fault-tolerant distributed systems. In the consensus problem, each process proposes a value, and all non-faulty processes have to agree on a common value that is proposed by a process. Despite of many applications (e.g., atomic broadcast [2, 6], shared object [1, 7], weak atomic commitment [5]), it is known that the consensus problem has no deterministic solution in asynchronous systems subject to only a single crash fault [4]. Thus, to circumvent this impossibility, several approaches, such as partial synchrony [3] and unreliable failure detectors [2], have been proposed. As one of such approaches, the condition-based approach is recently introduced [9]. This approach introduces restriction (called condition) on inputs so that the generally-unsolvable problem can be solved for the restricted set of inputs. In the case of the consensus problem, a condition is defined as a subset of all possible input vectors whose entries correspond to the proposal of each process. The first result of the condition-based approach clarifies the condition for which the uniform consensus can be solved in asynchronous systems subject to crash faults [9]. This result proposed a class of conditions, called t-legal conditions, and proved that the t-legal conditions form the class of necessary and sufficient conditions to solve the consensus in asynchronous systems where at most t process can crash. In general, for smaller number of t, the t-legal conditions become weaker restrictions and can contain more input vectors. An example of such t-legal conditions is the condition Cmax t , proposed in [9]. The condition Cmax t is the set of input vectors where the maximum value in each vector appears at t entries or more in the vector. From the definition, the condition Cmax t is a subset of the condition Cmax t−1 . In this sense, the sizes of sufficient conditions are strongly related to the number of crash faults that the system suffers. That is, the consensus algorithm designed for tolerating a larger number of faults can solve the consensus problem only for a smaller set of input vectors. However, in the system with t crash faults at a maximum, it is not often that t processes actually crashes. In other words, the actual number of crash faults is relatively smaller than the maximum. This observation brings one question as follows: Can we construct the condition-based algorithm that solves the consensus problem for more relaxed conditions than t-legal one when the actual number of crash faults is smaller than t ? In this paper, we investigate this problem by applying the adaptive condition-based approach. In the adaptive condition-based approach, a restriction to input vectors is not represented by a single subset of inputs, but represented by a hierarchical sequence of conditions called a condition sequence. Adaptive condition-based algorithms are instantiated by a condition sequence, and guarantee some property according to the position of input vector in the hierarchy of the given condition sequence (i.e., the execution for the input vector with higher position achieves better property). The first result for the adaptive condition-based approach considers time complexity in the synchronous

Implementing unreliable failure detectors with unknown membership

Implementing unreliable failure detectors with unknown membership

The inherent price of indulgence

An indulgent algorithm is a distributed algorithm that tolerates asynchronous periods of the network when process crash detection is unreliable. This paper presents a tight bound on the time complexity of indulgent consensus algorithms. We consider a round-based eventually synchronous model, and we show that any t-resilient consensus algorithm in this model, requires at least t+2 rounds for a global decision even in runs that are synchronous. We contrast our lower bound with the well-known t+1 round tight bound on consensus in the synchronous model. We then prove the bound to be tight by exhibiting a new t-resilient consensus algorithm in the eventually synchronous model that reaches a global decision at round t+2 in every synchronous run. Our new algorithm is in this sense significantly faster than the most efficient indulgent algorithm we know of, which requires 2t+2 rounds in synchronous runs. Our lower bound applies to round-based consensus algorithms with unreliable failure detectors such as ⋄ P and ⋄ S, and our matching algorithm can be adapted to such failure detectors.