Unreliable Failure Detectors for Reliable Distributed Systems

244 T. D. CHANDRA AND S. TOUEGother decision value is possible. In the third epoch, processes decide thelocked value.1’Each round of this Consensus algorithm is divided into four asynchronousphases. In Phase 1, every process sends its current estimate of the decision valuetimestamped with the round number in which it adopted this estimate, to thecurrent coordinator, c. In Phase 2, c gathers r (n + 1)/21 such estimates, selectsone with the largest timestamp, and sends it to all the processes as their newestimate, estirnateC. In Phase 3, for each process p, there are two possibilities:(1) p receives estimate= from c and sends an ack to c to indicate that it adoptedestimate= as its own estimate; or(2) upon consulting its failure detector module QIP, p suspects that c crashed,and sends a nack to c.In Phase 4, c waits for [ (n + 1)/21 replies (acks or nacks). If all replies are acks,then c knows that a majority of processes changed their estimates to estirnateC,and thus estirnateC is locked. Consequently, c R-broadcasts a request to decideestimateC. At any time, if a process R-delivers such a request, it decidesaccordingly.This algorithm relies on the assumption that ~ < Fn/21, that is, that at leastF(fr + 1)/21 processes are correct. Note that processes do not have to know thevalue of ~. But they do need to have a priori knowledge of the list of (potential)coordinators. Let R be any run of the algorithm in Figure 6 using ~ G 09’ inwhich all correct processes propose a value. We have to show that the termination,uniform validity, agreement and uniform integrity properties of Consensushold.LEMMA 6.2.1 (UNIFORM AGREEMENT). No two processes decide diflerent~.PROOF. If no process ever decides, the lemma is trivially true. If anyprocess decides, it must have previously R-delivered a message of the type(‘, ‘, –, decide). By the uniform integrity property of Reliable Broadcast andthe algorithm, a coordinator previously R-broadcast this message. This coordinatormust have received @ + 1)/21 messages of the type –, -, ack) in Phase 4.Let r be the smallest round number in which F(n + 1)/2 \ messages of the type(-, r, ack) are sent to a coordinator in Phase 3. Let c denote the coordinator ofround r, that is, c = (r mod n ) + 1. Let estimate= denote c‘s estimate at the endof Phase 2 of round r. We claim that for all rounds r’ > r, if a coordinator c‘sends estimate=, in Phase 2 of round r’, then estimateC, = estimate=.The proof is by induction on the round number. The claim trivially holds forr ‘ = r. Now assume that the claim holds for all r’, r s r’ < k. Let Ck be thecoordinator of round k, that is, Ck = (k mod n) + 1. We will show that theclaim holds for r’ = k, that is, if Ck sends estimateCk in Phase 2 of round k, thenestimate=, = estimate=.From the algorithm it is clear that if Ck sends estimate=, in Phase 2 of round kthen it must have received estimates from at least @ + 1)/21 processes. Thus,there is some process p such that (1) p sent a (p, r, ack) message to c in Phase3 of round r, and (2) (p, k, estimateP, tsP) is in msgsc,[k] in Phase 2 of round k.~TManY con~en~us algorithms in the literature have the propertyprocesses decide, see, for example, Reischuk [1982] and Dwork et al. [1988].that a value gets locked before