Unreliable Failure Detectors for Reliable Distributed Systems

260 T. D. CIMNDRA AND S, TOUEGcontinuum of repentant failure detectors ordered by the maximum number ofmistakes that each one can make.Al, Mistakes and RepentanceWe now define a mistake. Let R = (F, H, I, S, T) be any run using afailure detector $3.$3 makes a mistake in Rat time tat process p about process q ifat time r, p begins to suspect that q has crashed even though q @ F(t). Formally:[q@ ~(~),q E ff(p, t)] and [q @ II(P, t - l)].Such a mistake is denoted by the tuple (R, p, q, t). The set of mistakes madeby ’23in R is denoted by M(R).Note that only the erroneous addition of q into $3P is counted as a mistake atp. The continuous retentwn of q into QilPdoes not count as additional mistakes.Thus, a failure detector can make multiple mistakes at a processp about anotherprocess q onIy by repeatedly adding and then removing q from the set 9P. Inpractice, mistakes are caused by premature time-outs.We define the following four types of accuracy properties for a failure detector!3 based on the mistakes made by $3:Strongly k-mistaken. Q makes at most k mistakes. Formally, $3 is stronglyk-mistaken ifiVR using Q: IM(R)I s k.Weakly k-mistaken. There is a correct process p such that 9 makes at most kmistakes about p. Formally, ~ is weakly k-mistaken itVR = (F, H, I, S, T) using ~, 3p G correct(F):I{(R, f?>P, 1):(R, q, p, t) C M(R)} I s kStrongly finitely mistaken. Qllmakes a finite number of mistakes. Formally, !3 isstrongly finitely mistaken ifiVR using 9: M(R)is finite.In this case, it is clear that there is a time t after which $3 stops making mistakes(it may, however, continue to give incorrect information).Weakly finitely mistaken. There is a correct process p such that 9 makes afinite number of mistakes about p. Formally, Qilis weakly finitely mistaken ifVR = (F, H, 1, S, T) using Q, 3p G correct(F):{(R, q, p, t): (R, q, p, t) G M(R)} is finite.In this case, there is a time t after which ~ stops making mistakes about p (itmay, however, continue to give incorrect information even about p).For most values of k, the properties mentioned above are not powerful enoughto be useful. For example, suppose every process permanently suspects everyother process. In this case, the failure detector makes at most n (n – 1)mistakes, but it is clearly useless since it does not provide any information.