Bettina Weiss

Impossibility Results and Lower Bounds for Consensus under Link Failures

We provide a suite of impossibility results and lower bounds for the required number of processes and rounds for synchronous consensus under transient link failures. Our results show that consensus can be solved even in the presence of

Formally verified Byzantine agreement in presence of link faults

O(n^2)

Synchronous consensus under hybrid process and link failures

moving omission and/or arbitrary link failures per round, provided that both the number of affected outgoing and incoming links of every process is bounded. Providing a step further toward the weakest conditions under which consensus is solvable, our findings are applicable to a variety of dynamic phenomena such as transient communication failures and end-to-end delay variations. We also prove that our model surpasses alternative link failure modeling approaches in terms of assumption coverage.

An algorithm for fault-tolerant clock state & rate synchronization

This paper shows that deterministic consensus in synchronous distributed systems with link faults is possible, despite the impossibility result of Gray (1978). Instead of using randomization, we overcome this impossibility by moderately restricting the inconsistency that link faults may cause system-wide. Relying upon a novel hybrid fault model that provides different classes of faults for both nodes and links, we provide a formally verified proof that the m+1-round Byzantine agreement algorithm OMH (Lincoln and Rushby (1993)) requires n > 2f/sub l//sup s/ + f/sub l//sup r/ + f/sub l//sup ra/ + 2(f/sub a/ + f/sub s/) + f/sub o/ + f/sub m/ + m nodes for transparently masking at most f/sub l//sup s/ broadcast and f/sub l//sup r/ receive link faults (including at most f/sub l//sup ra/ arbitrary ones) per node in each round, in addition to at most f/sub a/, f/sub s/, f/sub o/, f/sub m/ arbitrary, symmetric, omission, and manifest node faults, provided that m /spl ges/ f/sub a/ + f/sub o/ + 1. Our approach to modeling link faults is justified by a number of theoretical results, which include tight lower bounds for the required number of nodes and an analysis of the assumption coverage in systems where links fail independently with some probability p.

A case study in efficient microcontroller education

We introduce a comprehensive hybrid failure model for synchronous distributed systems, which extends a conventional hybrid process failure model by adding communication failures: Every process in the system is allowed to commit up to fℓs send link failures and experience up to fℓr receive link failures per round here, without being considered faulty; up to some fℓsa≤fℓs and fℓra≤fℓr among those may even cause erroneous messages rather than just omissions. In a companion paper (Schmid et al. (2009) [14]), devoted to a complete suite of related impossibility results and lower bounds, we proved that this model surpasses all existing link failure modeling approaches in terms of the assumption coverage in a simple probabilistic setting. In this paper, we show that several well-known synchronous consensus algorithms can be adapted to work under our failure model, provided that the number of processes required for tolerating process failures is increased by small integer multiples of fℓs, fℓr, fℓsa, fℓra. This is somewhat surprising, given that consensus in the presence of unrestricted link failures and mobile (moving) process omission failures is impossible. We provide detailed formulas for the required number of processes and rounds, which reveal that the lower bounds established in our companion paper are tight. We also explore the power and limitations of authentication in our setting, and consider uniform consensus algorithms, which guarantee their properties also for benign faulty processes.

A system for automatic testing of embedded software in undergraduate study exercises

We propose a fault-tolerant algorithm for synchronizing both state and rate of clocks in a distributed system. This algorithm is based on rounds, uses our fault-tolerant optimal precision (OF) convergence function as the means of synchronization, and maintains a collection of intervals to keep track of real-time, internal global time, and clock rates. The analysis shows that the interlocking between state and rate synchronization can be easily solved, and that oscillator stabilities together with the transmission delay uncertainties of packets predominate the internal synchronization. In addition, average case results gathered from simulation experiments with our SimUTC toolkit prove to be about one order of magnitude better than the worst case ones from the analysis of our state & rate algorithm.

The SimUTC fault-tolerant distributed systems simulation toolkit

Undergraduate education typically is characterized by a large number of students. Therefore, courses must be conducted efficiently and should not only focus on conveying the course material, but must also be oriented towards a maximum transfer of knowledge with a minimum amount of invested time on the instructors part. At the same time, courses should be flexible to accommodate different student needs.In this paper, we identify the needs of a practical course in microcontroller programming with respect to course structure and grading, present our solutions, and discuss our experiences.

Consensus in the presence of mortal Byzantine faulty processes

As student numbers in embedded systems lab courses increase, it becomes more and more time-consuming to verify the correctness of their homework and exam programs. Automatic verification can vastly improve the speed and quality of such tests. This paper describes a system that can carry out black-box tests to verify whether the embedded software running on a target system meets predefined requirements. To this aim, we employ a special test board using an ATmega128 microcontroller which is connected to both the target system and to a host computer. Tests can be selected and started remotely, the results are presented to the user on the host. Monitoring and control via Internet is also easily possible. A special meta-language is used to describe the correct behavior of the tested program, and this description is compiled and downloaded to the test system via a standard RS-232 interface, where the test is executed. The same interface is used to control the tests and for transfer of data and end results.

Consensus with written messages under link faults

We introduce our SimUTC toolkit, a fault-tolerant distributed systems simulation built upon the discrete event simulation package C++SIM. SimUTC has been developed in the course of our project SynUTC and targets distributed algorithms for high-accuracy fault-tolerant clock synchronization. This application domain requires detailed simulation models for network transmission and local clock devices, fault-injection capabilities, flexible system configuration facilities, and customized data capture and analysis tools. We explain how SimUTC addresses those issues and provide a few samples of simulation results gathered from the evaluation of the well-known fault-tolerant average clock synchronization algorithm.

Synchronous Consensus with Mortal Byzantines

We consider the problem of reaching agreement in distributed systems in which some processes may deviate from their prescribed behavior before they eventually crash. We call this failure model “mortal Byzantine”. After discussing some application examples where this model is justified, we provide matching upper and lower bounds on the number of faulty processes, and on the required number of rounds in synchronous systems. We then continue our study by varying different system parameters. On the one hand, we consider the failure model under weaker timing assumptions, namely for partially synchronous systems and asynchronous systems with unreliable failure detectors. On the other hand, we vary the failure model in that we limit the occurrences of faulty steps that actually lead to a crash in synchronous systems.