Unreliable Failure Detectors for Reliable Distributed Systems

250 T. D, CHANDRAAND S. TOUEGdelivered. Processes disambiguate between these executions by tagging all themessages pertaining to the kth execution of Consensus with the counter k.Tagging each message with this counter constitutes a minor modification to anygiven Consensus algorithm. The propose and decide primitives corresponding tothe kth execution of Consensus are denoted by propose(k, –) and decide(k, –).Our Atomic Broadcast algorithm also uses the R-fvoadcast(m ) and R-deliver(m) primitives of Reliable Broadcast. To avoid possible ambiguities betweenAtomic Broadcast and Reliable Broadcast, we say that a process A-broadcasts orA-delivers to refer to a broadcast or a delivery associated with Atomic Broadcast;and R-broadcasts or R-delivers to refer to a broadcast or delivery associated withReliable Broadcast.The Atomic Broadcast algorithm described in Figure 7 consists of three tasks,Task 1, Task 2, and Task 3, such that: (1) any task that is enabled is eventuallyexecuted, and (2) Task i can execute concurrently with Task j’ provided i # j.When a process wishes to A-broadcast a message M, it R-broadcasts m(Task 1). When a process p R-delivers m, it adds m to the set R_deliveredP(Task 2). When p A-delivers a message m, it adds m to the set A_de/iveredP(Task 3). Thus, R_deliveredP – A _deliveredP, denoted A _undeliveredP, is the setof messages that p R-delivered but not yet A-delivered. Intuitively, these are themessages that were submitted for Atomic Broadcast but are not yet A-delivered,according top.In Task 3, process p periodically checks whether A _unde/iveredP containsmessages. If so, p enters its next execution of Consensus, say the kth one, byproposing A _undeliveredP as the next batch of messages to be A-delivered.Process p then waits for the kth Consensus decision, denoted nngSet ‘. Finally, pA-delivers all the messages in msgSetk except those it already A-delivered. Moreprecisely, p A-delivers all the messages in the set A _deliver~ = msgSetk –A _deliveredP, and it does so in some deterministic order that was agreed a prioriby all processes, for example, in lexicographical order.LEMMA 7.1.1. For any two correct processes p and q, and any message m, ifm E R_deliveredP, then eventually m E R_delivered~.PROOF. If m G R_deliveredP, then p R-delivered m (in Task 2). Since p iscorrect, by the agreement property of Reliable Broadcast q eventually R-deliversm, and inserts m into R_delivered~. •lLEMMA 7.1.2. For any two correct processes p and q, and all k z 1:(1) Ifp executes propose(k, –), then q eventually executes propose(k, - ).(2) If p A-delivers messages in A _deliverP,k then q eventually A -delivers messages inA _deliver$ and A _deliver~ = A _deliver~.PROOF. The proof is by simultaneous induction on (1) and (2). Fork = 1, wefirst show that if p executes propose(l, –), then q eventually executespropose(l, –). When p executes propose(l, -), R_de/iveredP must contain somemessage m. By Lemma 7.1.1, m is eventually in R_delivered~. Since A_de/iveredgis initially empty, eventually R_delivered~ - A _deliveredq # 0. Thus, q eventuallyexecutes Task 3 and propose(l, –).We now show that if p A-delivers messages in A _deliver~, then q eventuallyA-delivers messages in A_deliver& and A _deliver~ = A _deliver~. From the