Unreliable Failure Detectors for Reliable Distributed Systems

246 T. D. CHANDRAAND S. TOUEGSince $3 satisfies eventual weak accuracy, there is a correct process q and atime t such that no correct process suspects q after t.Let t‘ z t be a timesuch that all faulty processes crash. Note that after time t‘ no processsuspects q. From this and the above claim, there must be a round r such that:(a) All correct processes reach round r after time t’ (when no processsuspects q).(b) q is the coordinator of round r (i.e., q = (r mod n) + 1).In Phase 1 of round r, all correct processes send their estimates to q. InPhase 2, q receives T(n + 1)/21 such estimates, and sends (q, r, estimateg)to all processes. In Phase 3, since q is not suspected by any correct processafter time t, every correct process waits for q‘s estimate, eventually receivesit, and replies with an ack to q. Furthermore, no process sends a nack to q(that can only happen when a process suspects q). Thus, in Phase 4, qreceives r(n + 1)/21 messages of the type (–, r, ack) (and no messages ofthe type (–, r, nack)), and q R-broadcasts (q, r, estimateq, decide). By thevalidity and agreement properties of Reliable Broadcast, eventually allcorrect processes R-deliver q‘s message and decide—a contradiction. Thus,case 2 is impossible, and this concludes the proof of the lemma. •lTHEOREM 6.2.3. The algorithm in Figure 6 solves Consensus using 09’ inasynchronous tystems with f < rn/21.PROOF. Lemma 6.2.1 and Lemma 6.2.2 show that the algorithm in Figure 6satisfies the (uniform) agreement and termination properties of Consensus,respectively. From the algorithm, it is clear that no process decides more thanonce, and hence the uniform integrity property holds. From the algorithm it isalso clear that all the estimates that a coordinator receives in Phase 2 areproposed values. Therefore, the decision value that a coordinator selects fromthese estimates must be the value proposed by some process. Thus, uniformvalidity of Consensus is also satisfied. •lBy Theorems3,4 and 6.2.3, we have:COROLLARY6.2.4. Consensus is so fvable using OW in asynchronous systemswith f < Tn/21.Thus, Consensus can be solved in asynchronous systems using any failuredetector in OW, the weakest class of failure detectors considered in this paper.This leads to the following question: What is the weakest failure detector forsolving Consensus? The answer to this question, given in a companion paper[Chandra et al. 1992], is summarised below.Let OWO be the “weakest” failure detector in OW. Roughly speaking, OWO isthe failure detector that exhibits all the failure detector behaviors allowed bythe properties that define OW. More precisely, OWO consists of all the failuredetector histories that satisfy weak completeness and eventual weak accuracy (fora formal definition see Chandra et al. [1992]). Chandra et al. [1992] show thatO’WOis the weakest failure detector for solving Consensus in asynchronoussystems with a majority of correct processes.