Unreliable Failure Detectors for Reliable Distributed Systems

Unreliable Failure Detectors for Reliable Distributed Systems 251algorithm, if p A-delivers messages in A _de/iver~, it previously executed propose(1, –). From part (1) of the lemma, all correct processes eventually executepropose( 1, –). By termination and uniform integrity of Consensus, every correctprocess eventually executes decide(l, -) and it does so exactly once. Byagreement of Consensus, all correct processes eventually executedecide( 1, msgSet ]) with the same msgSet 1. Since A _deiiveredP and A _delivered~are initially empty, and msgSet~ = msgSet~, we have A _deliver~ = A _de!iver~.Now assume that the lemma holds for all k, 1 < k < /. We first show that ifp executes propose(l, - ), then q eventually executes propose(l, - ). When pexecutes propose(l, – ), R_de/ivered must contain some message m that is not inA _deliveredP. Thus, m is not in U~l]l A _deliver~. By the induction hypothesis,A _deliver~ = A _deliver$ for all 1 s k s 1 – 1. So m is not in U~j*l A _deliver~.Since m is in R_deliveredP, by Lemma 7.1.1, m is eventually in R_deliveredq.Thus, there is a time after q A-delivers A _deliver&- ] such that there is a messagein R _delivered~ – A _deliveredq. So q eventually executes Task 3 andpropose(l, –).We now show that if p A-delivers messages in A _deliver~, then q A-deliversmessages in A _deliver~, and A _deliver~ = A _deliver~. Since p A-deliversmessages in A _deliver~, itmust have executed propose(l, –). By part (1) of thislemma, all correct processes eventually execute propose(l, –). By terminationand uniform integrity of Consensus, every correct process eventually executesdecide(l, – ) and it does so exactly once. By agreement of Consensus, all correctprocesses eventually execute decide(l, msgSet~) with the same msgSet’. Notethat A _deliver~ = msgSet~ – U jL1l A _deliver~, and A _deliver~ = msgSet~ –U~~’l A _deliver~. By the induction hypothesis, A _deliver~ = A _deliver~ for all1 s k s i – 1. Since msgSet~ = msgSet~, A_deliver~ = A_deliver~. ❑LEMMA 7.1.3. The algorithm in Figure 7 satisfies the agreement and total orderproperties of A-broadcast.PROOF. Immediate from Lemma 7.1.2 and the fact that correct processesA-deliver messages in each batch in the same deterministic order. ❑LEMMA 7.1.4 (VALIDITY). If a correct process A-broadcasts m, then it eventuallyA-delivers m.PROOF. The proof is by contradiction. Suppose a correct process p A-broadcastsm but never A-delivers m, By Lemma 7.1.3, no correct process A-deliversm.By Task 1 of Figure 7, p R-broadcasts m. By the validity and agreementproperties of Reliable Broadcast, every correct process q eventually R-deliversm, and inserts m in R_deliveredq (Task 2). Since correct processes neverA-deliver m, they never insert m in A _delivered. Thus, for every correct processq, there is a time after which m is permanently in R_deliveredq-A _deiivered~.From Figure 7 and Lemma 7.1.2, there is a kl, such that for all 1> kl, all correctprocesses execute propose(l, –), and they do so with sets that always include m.Since all faulty processes eventually crash, there is a k2 such that no faultyprocess executes propose(l, – ) with 1 a kz. Let k = max(k ~, k2). Since allcorrect processes execute propose(k, –), by termination and agreement ofConsensus, all correct processes execute decide(k, msgSet~) with the samemsgSetk. By uniform validity of Consensus, some process q executed