Veto Number and the Respective Power of Eventual

Brief Announcement: Veto Number and the Respective Power of Eventual Failure Detectors Roy Friedman

Achour Mostefaoui

Michel Raynal

Computer Science Dpt The Technion, Haifa Israel

IRISA, Campus Beaulieu 35042 Rennes Cedex France

IRISA, Campus Beaulieu 35042 Rennes Cedex France

Categories and Subject Descriptors C.4 [Computer Systems Organization]: Performance Of Systems—Fault tolerance; F.1.1 [Computation By Abstract Devices]: Models of Computation—Relations between models,Networks of machines; F.2.0 [Analysis Of Algorithms And Problem Complexity]: General

General Terms Algorithms,Reliability,Theory

Keywords Agreement Problem, Asynchronous Distributed System, Computational Power, Failure Detector, Process Crash The class of eventually perfect failure detectors (denoted ✸P) contains all the failure detectors that, after some unknown but finite time, no longer make mistakes. The class of eventually strong failure detectors (denoted ✸S) contains all the failure detectors that, after some unknown but finite time, suspect all processes that crash and do not suspect one correct process. Notice that failure detectors of these classes can make an infinite number of mistakes Although ✸S appears to be weaker than ✸P (yet, most implementations of ✸S in fact attempt to provide ✸P), an interesting open problem concerns the computational power of those classes of failure detectors. On one hand, up to date, no one has exhibited a one-shot agreement problem that can be solved with ✸P and cannot with ✸S. On the other hand, the properties defining ✸S are weaker than the ones defining ✸P. Hence the following fundamental question: “In asynchronous distributed systems with reliable links but prone to process crash failures, are there one-shot agreement problems that can be solved when those systems are augmented with ✸P, but cannot be solved when they are augmented only with ✸S?” Surprisingly, [1] shows that the answer to this question is “no”. It is important to notice that this does not mean that the classes ✸P and ✸S are equivalent in the sense that it could be possible to simulate a failure detector of the class ✸P in an asynchronous system equipped with a failure detector of the class ✸S. The intuition underlying this apparent contradiction can be explained by the fact that the Copyright is held by the author/owner. PODC’04, July 25–28, 2004, St. Johns, Newfoundland, Canada. ACM 1-58113-802-4/04/0007.

problem domain is not continuous. Interestingly, this result has an important consequence that answers an open problem, namely, it shows that ✸P cannot be the weakest class of failure detectors that enables solving one-shot agreement problems in asynchronous distributed systems prone to process crash failures. To prove this, [1] introduces new notions related to distributed one-shot agreement problems. The first is the notion of veto number associated with those problems. Intuitively, the veto number of a one-shot agreement problem P is the smallest number ℓ of processes that control the decision value. For example, ℓ = 1 for the interactive consistency problem; if a process changes its input value, the decided vector becomes different. Differently, ℓ = n for the Consensus problem; in the worst case, all processes have to change the value they propose to force a different decided value. (Additional ℓ-veto problems with 1 < ℓ < n are discussed in a followup paper [?].) The main result of [1] can be stated as follows. Let P be a one-shot agreement problem, with veto number ℓ, that cannot be solved without the help of a failure detector: • If ℓ > f and f < n/2, then P can be solved in asynchronous distributed systems equipped with a failure detector of the class ✸S (i.e., ✸S is sufficient to solve P ), • If ℓ ≤ f or f ≥ n/2, then P cannot be solved in asynchronous distributed systems equipped with a failure detector of the class ✸P (i.e., ✸P is not “strong” enough to solve P ). To formally define the veto number of a problem, and to prove the main theorem, a (new) notion of irreconcilable input vectors is introduced. This notion generalizes in some way the notion of valence that has been introduced to show the impossibility to deterministically solve Consensus despite process crashes. The full version [1] also addresses more severe failures than process crashes. It first shows that the previous results hold in presence of message omission failures, and then focuses on Byzantine failures. In such a context, it considers failure detectors that are capable of detecting only silence failures.

1. REFERENCES [1] Friedman R., Mostefaoui A. and Raynal M., On the Respective Power of ✸P and ✸S to Solve One-Shot Agreement Problems. Tech Report #1547, 20 pages, irisa, Universit´ e de Rennes 1, (France), 2003. http://www.irisa.fr/bibli/publi/pi/2003/1547/1547.html.