Hugues Fauconnier

Communication-efficient leader election and consensus with limited link synchrony

We study the degree of synchrony required to implement the leader election failure detector Ω and to solve consensus in partially synchronous systems. We show that in a system with <i>n</i> processes and up to <i>f</i> process crashes, one can implement Ω and solve consensus provided there exists some (unknown) correct process with <i>f</i> outgoing links that are eventually timely. In the special case where <i>f</i> = 1 , an important case in practice, this implies that to implement Ω and solve consensus it is sufficient to have just <i>one</i> eventually timely link -- all the other links in the system, Θ(<i>n</i>²) of them, may be asynchronous. There is no need to know which link <i>p</i> → <i>q</i> is eventually timely, when it becomes timely, or what is its bound on message delay. Surprisingly, it is not even required that the source <i>p</i> or destination <i>q</i> of this link be correct: either <i>p</i> or <i>q</i> may actually crash, in which case the link <i>p</i> → <i>q</i> is eventually timely in a trivial way, and it is useless for sending messages. We show that these results are in a sense optimal: even if every process has <i>f</i> - 1 eventually timely links, neither Ω nor consensus can be solved. We also give an algorithm that implements Ω in systems where some correct process has <i>f</i> outgoing links that are eventually timely, <i>such that eventually only f links carry messages</i>, and we show that this is optimal. For <i>f</i> = 1 , this algorithm ensures that all the links, except for one, eventually become quiescent.

Stable Leader Election

We introduce the notion of stable leader election and derive several algorithms for this problem. Roughly speaking, a leader election algorithm is stable if it ensures that once a leader is elected, it remains the leader for as long as it does not crash and its links have been behaving well, irrespective of the behavior of other processes and links. In addition to being stable, our leader election algorithms have several desirable properties. In particular, they are all communication-efficient, i.e., they eventually use only n links to carry messages, and they are robust, i.e., they work in systems where only the links to/from some correct process are required to be eventually timely. Moreover, our best leader election algorithm tolerates message losses, and it ensures that a leader is elected in constant time when the system is stable. We conclude the paper by applying the above ideas to derive a robust and efficient algorithm for the eventually perfect failure detector lP.

On implementing omega with weak reliability and synchrony assumptions

We study the feasibility and cost of implementing Ω---a fundamental failure detector at the core of many algorithms---in systems with weak reliability and synchrony assumptions. Intuitively, Ω allows processes to eventually elect a common leader. We first give an algorithm that implements Ω in a weak system S where processes are synchronous, but: (a) any number of them may crash, and (b) only the output links of an unknown correct process are eventually timely (all other links can be asynchronous and/or lossy). This is in contrast to previous implementations of Ω which assume that a quadratic number of links are eventually timely, or systems that are strong enough to implement the eventually perfect failure detector P. We next show that implementing Ω in S is expensive: even if we want an implementation that tolerates just one process crash, all correct processes (except possibly one) must send messages forever; moreover, a quadratic number of links must carry messages forever. We then show that with a small additional assumption---the existence of some unknown correct process whose asynchronous links are lossy but fair---we can implement Ω efficiently: we give an algorithm for Ω such that eventually only one process (the elected leader) sends messages.

Mutual exclusion in asynchronous systems with failure detectors

This paper considers the fault-tolerant mutual exclusion problem in a message-passing asynchronous system and determines the weakest failure detector to solve the problem, given a majority of correct processes. This failure detector, which we call the trusting failure detector, and which we denote by T, is strictly weaker than the perfect failure detector P but strictly stronger than the eventually perfect failure detector @?P. The paper shows that a majority of correct processes is necessary to solve the problem with T. Moreover, T is also the weakest failure detector to solve the fault-tolerant group mutual exclusion problem, given a majority of correct processes.

A realistic look at failure detectors

This paper shows that, in an environment where we do not bound the number of faulty processes, the class P of perfect failure detectors is the weakest (among realistic failure detectors) to solve fundamental agreement problems like uniform consensus, atomic broadcast, and terminating reliable broadcast (also called Byzantine generals). Roughly speaking, in this environment, we collapse the Chandra-Toueg failure detector hierarchy, by showing that P ends up being the only class to solve those agreement problems. This contributes in explaining why most reliable distributed systems we know of do rely on some group membership service that precisely aims at emulating P. As an interesting side effect of our work, we show that, in our general environment, uniform consensus is strictly harder than consensus, and we revisit the view that uniform consensus and atomic broadcast are strictly weaker than terminating reliable broadcast.

Tight failure detection bounds on atomic object implementations

This article determines the weakest failure detectors to implement shared atomic objects in a distributed system with crash-prone processes. We first determine the weakest failure detector for the basic register object. We then use that to determine the weakest failure detector for all popular atomic objects including test-and-set, fetch-and-add, queue, consensus and compare-and-swap, which we show is the same.

Local and temporal predicates in distributed systems

The definitions of the predicates Possibly &fgr; and Definitely &fgr;, where &fgr; is a global predicate of a distributed computation, lead to the definitions of two predicate transformers <italic>P</italic> and <italic>D</italic>. We show that <italic>P</italic> plays the same role with respect to <italic>time</italic> as the predicate transformers <italic>K<subscrpt>i</subscrpt></italic> in knowledge theory play with respect to <italic>space</italic>. Pursuing this analogy, we prove that local predicates are exactly the fixed points of the <italic>K<subscrpt>i</subscrpt></italic>s while the stable predicates are the fixed points of <italic>P</italic>. In terms of the predicate transformers <italic>P</italic> and <italic>D</italic>, we define a new class of predicates that we call <italic>observer-independent</italic> predicates and for which the detection of Possibly &fgr; and Definitely &fgr; is quite easy. Finally, we establish a temporal counterpart to the knowledge change theorem of Chandy and Misra which formally proves that the global view of a distributed system provided by its various observations does not differ too much from its truth behavior.

On implementing omega in systems with weak reliability and synchrony assumptions

We study the feasibility and cost of implementing Ω—a fundamental failure detector at the core of many algorithms—in systems with weak reliability and synchrony assumptions. Intuitively, Ω allows processes to eventually elect a common leader. We first give an algorithm that implements Ω in a weak system S where (a) except for some unknown timely process s, all processes may be arbitrarily slow or may crash, and (b) only the output links of s are eventually timely (all other links can be arbitrarily slow and lossy). Previously known algorithms for Ω worked only in systems that are strictly stronger than S in terms of reliability or synchrony assumptions.We next show that algorithms that implement Ω in system S are necessarily expensive in terms of communication complexity: all correct processes (except possibly one) must send messages forever; moreover, a quad-ratic number of links must carry messages forever. This result holds even for algorithms that tolerate at most one crash. Finally, we show that with a small additional assumption to system S—the existence of some unknown correct process whose links can be arbitrarily slow and lossy but fair—there is a communication-efficient algorithm for Ω such that eventually only one process (the elected leader) sends messages. Some recent experimental results indicate that two of the algorithms for Ω described in this paper can be used in dynamically-changing systems and work well in practice [Schiper, Toueg in Proceedings of the 38th International Conference on Dependable Systems and Networks, pp. 207–216 (2008)].

Consensus with Byzantine Failures and Little System Synchrony

We study consensus in a message-passing system where only some of the n2 links exhibit some synchrony. This problem was previously studied for systems with process crashes; we now consider Byzantine failures. We show that consensus can be solved in a system where there is at least one non-faulty process whose links are eventually timely; all other links can be arbitrarily slow. We also show that, in terms of problem solvability, such a system is strictly weaker than one where all links are eventually timely

When birds die: making population protocols fault-tolerant

In the population protocol model introduced by Angluin et al. [2], a collection of agents, which are modelled by finite state machines, move around unpredictably and have pairwise interactions. The ability of such systems to compute functions on a multiset of inputs that are initially distributed across all of the agents has been studied in the absence of failures. Here, we show that essentially the same set of functions can be computed in the presence of halting and transient failures, provided preconditions on the inputs are added so that the failures cannot immediately obscure enough of the inputs to change the outcome. We do this by giving a general-purpose transformation that makes any algorithm for the fault-free setting tolerant to failures.