Unreliable Failure Detectors for Reliable Distributed Systems

232 T. D. CHANDRAAND S. TOUEGInformally, a failure detector ~ provides (possibly incorrect) informationabout the failure pattern F that occurs in an execution. Formally, fiiihue detector$3 is a function that maps each failure pattern F to a set of failure detectorhistories !3(F). This is the set of ail failure detector histories that could occur inexecutions with failure pattern F and failure detector 9.’0In this paper, we do not define failure detectors in terms of specific implementations.Such implementations would have to refer to low-level network parameters,such as the network topology, the message delays, and the accuracy of thelocal clocks. To avoid this problem, we specify a failure detector in terms of twoabstract properties that it must satisfy completeness and accuracy. This allows usto design applications and prove their correctness relying solely on theseproperties.2.3. FAILURE DETECTORPROPERTIES. We now state two completeness propertiesand four accuracy properties that a failure detector $/l may satisfy.COMPLETENESS. We consider two completeness properties:Strong Completeness. Eventually every process that crashes is permanentlysuspected by every correct process. Formally, !21satisfies strong completeness ifVF, VH G Qb(F),3t G 9, Vp E crashed(F),Vq G correct(F), Vt’ a t :p G If(q, t’).Weak Completeness. Eventually every process that crashes is permanentlysuspected by some correct process. Formaliy, 9 satisfies weak completeness ifVF, VH E Q(F), 3 E 9, Vp ~ crashed(F),3q G correct(F), Vf’ 2 t:p C H(q, t’).However, completeness by itself is not a useful property. To see this, consider afailure detector which causes every process to permanently suspect every otherprocess in the system. Such a failure detector trivially satisfies strong completenessbut is clearly useless since it provides no information about failures. To beuseful, a failure detector must also satisfy some accuracy property that restrictsthe mistakes that it can make. We now consider such properties.ACCURACY. Considerthe following two accuracy properties:Strong Accuracy. No process is suspected before it crashes. Formally, ‘3satisfies strong accuracy ifSince it is difficult (if not impossible) to achieve strong accuraq in manypractical systems, we also define:10In general, there are ~anY executions with the same failure pattern ~ (e-g., these executions maYdiffer by the pattern of their message exchange). For each such execution, ~ may have a differentfailure detector history.