The impossibility of boosting distributed service resilience

详细信息    查看全文

• 作者：Paul Attie^a ; ^{paul.attie@aub.edu.lb} ; Rachid Guerraoui^b ; ^{rachid.guerraoui@epfl.ch} ; Petr Kuznetsov^c ; ^{pkuznets@acm.org} ; Nancy Lynch^d ; ^{lynch@theory.lcs.mit.edu} ; Sergio Rajsbaum^e ; ^{rajsbaum@math.unam.mx}
• 关键词：Distributed services ; Resilience ; Boosting ; Consensus ; Atomic objects ; Failure detectors ; I/O automata
• 刊名：Information and Computation
• 出版年：2011
• 出版时间：June 2011
• 年：2011
• 卷：209
• 期：6
• 页码：927-950
• 全文大小：1373 K

文摘

We study f-resilient services, which are guaranteed to operate as long as no more than f of the associated processes fail. We prove three theorems asserting the impossibility of boosting the resilience of such services. Our first theorem allows any connection pattern between processes and services but assumes these services to be atomic (linearizable) objects. This theorem says that no distributed system in which processes coordinate using f-resilient atomic objects and reliable registers can solve the consensus problem in the presence of f+1 undetectable process stopping failures. In contrast, we show that it is possible to boost the resilience of some systems solving problems easier than consensus: for example, the 2-set-consensus problem is solvable for 2n processes and 2n-1 failures (i.e., wait-free) using n-process consensus services resilient to n-1 failures (wait-free). Our proof is short and self-contained.

We then introduce the larger class of failure-oblivious services. These are services that cannot use information about failures, although they may behave more flexibly than atomic objects. An example of such a service is totally ordered broadcast. Our second theorem generalizes the first theorem and its proof to failure-oblivious services.

Our third theorem allows the system to contain failure-aware services, such as failure detectors, in addition to failure-oblivious services. This theorem requires that each failure-aware service be connected to all processes; thus, f+1 process failures overall can disable all the failure-aware services. In contrast, it is possible to boost the resilience of a system solving consensus using failure-aware services if arbitrary connection patterns between processes and services are allowed: consensus is solvable for any number of failures using only 1-resilient 2-process perfect failure detectors.

As far as we know, this is the first time a unified framework has been used to describe both atomic and non-atomic objects, and the first time boosting analysis has been performed for services more general than atomic objects.