SelfStabilization An approach for FaultTolerance in Distributed Systems

Self-Stabilization: An approach for Fault-Tolerance in Distributed Systems Stéphane Devismes 12/11/2008 Sémimaire VERIMAG

Fault-Tolerance • Robustness: – Correct behaviour even when faults hit the system – Pessimistic approach – For permanent failures (e. g. process crash) • Self-Stabilization [Dijkstra, 1974]: – Forward recovery approach – Optimistic approach – For transient faults (e. g. memory corruption) 12/11/2008 Sémimaire VERIMAG 2

Roadmap • • • From an example to the definition A practical example Advantages Drawbacks Circumvent the drawbacks Conclusion 12/11/2008 Sémimaire VERIMAG 3

Self-Stabilization [Dijkstra, 1974] • Example: Dijkstra’s Token Ring 1 0 2 10 10 10 12/11/2008 0 1 Sémimaire VERIMAG 4

Starting from an arbitrary state 5 01 4 2 5 4 5 0 12/11/2008 0 5 Sémimaire VERIMAG 5

Does it converges in any case? (1/3) • There always exists at least one token i i 12/11/2008 i Sémimaire VERIMAG 6

Does it converges in any case? (2/3) • At each step, at least one token moves forward or disappears • Eventually, the root generates a value that did not exist in the initial configuration (because K > N) 12/11/2008 Sémimaire VERIMAG 7

Does it converges in any case? (3/3) j dj aj cj 12/11/2008 bj Sémimaire VERIMAG 8

Definition: Closure + Convergence Closure Illegitimate States Legitimate States Convergence States of the System 12/11/2008 Sémimaire VERIMAG 9

Is the Dijkstra’s token ring realistic? • Computational Model • Topology • Knowledge about the network 12/11/2008 Sémimaire VERIMAG 10

BFS Spanning Tree [Huang & Chen, 1992] d 1 =0 31 3 2 d 2=1 d 1=1 1 2� 4 3 d 3=2 53 1 4 d 4 =0 2 d 2=2 21 3 d 3=2 d 2=3 2 6 2 1 d 1=1 1 2 Variable D: d 3=2 3 2 d 2=2 2 1 d 1=1 1 d 1=2 1 0 1 d 2=2 2 d 4=3 4 d 1 =0 D=0 for the root D in [1…k] for the other (k>=Diam) Every process periodically sends D to its neighbours Every non-root process stores in di the last D-value it receives from i Each time a di variable is updated, D is set to the minimal value of the di -variables + 1 12/11/2008 Sémimaire VERIMAG 11

Advantage of self-stabilization (1/3) • Tolerance to any transient fault • Transient fault: – Duration: finite – Periodicity: rare – Effect: alter the contain of some component(s) of the network (processes and/or links) – E. g. , memory/message corruption, crashrecover, lose of messages… 12/11/2008 Sémimaire VERIMAG 12

Advantage of self-stabilization (1/3) 12/11/2008 Sémimaire VERIMAG 13

Advantage of self-stabilization (2/3) • No initialization – Large-scale network – Self-organization in sensor network 12/11/2008 Sémimaire VERIMAG 14

Advantage of self-stabilization (3/3) • Dynamicity 3 5 12/11/2008 2 5 0 1 3 4 1 1 2 3 Sémimaire VERIMAG 2 15

Drawbacks of self-stabilization (1/3) • Eventually safe 12/11/2008 Stabilization Time Sémimaire VERIMAG 16

Drawbacks of self-stabilization (2/3) • No detection of stabilization – Permanent local checks: 12/11/2008 Sémimaire VERIMAG 17

Drawbacks of self-stabilization (3/3) • Do not tolerant any kind of faults, e. g. : – Crash – Byzantine faults 12/11/2008 Sémimaire VERIMAG 18

Reduce the local checkings • Example: Maximal Independent Set 12/11/2008 Sémimaire VERIMAG 19

dominated 12/11/2008 MIS Algorithm Sémimaire VERIMAG Dominator 20

MIS Algorithm 3 2 4 12/11/2008 8 5 1 7 9 10 6 Sémimaire VERIMAG 21

MIS Algorithm • Case: 3 6 12/11/2008 Sémimaire VERIMAG 9 4 22

MIS Algorithm • Case: 3 9 6 12/11/2008 4 Sémimaire VERIMAG 23

MIS Algorithm 3 2 4 12/11/2008 8 5 1 7 9 10 6 Sémimaire VERIMAG 24

Tolerate more type of faults • E. g. Robust Stabilization – Leader Election 12/11/2008 Sémimaire VERIMAG 25

Model 1 2 3 4 12/11/2008 • Fully-connected network • Message-passing • Link: – Not necessarily FIFO – Reliable and synchronous • Process: – Synchronous or crashed – Identity Sémimaire VERIMAG 26

Leader Election (1/4) • A process p periodically sends ALIVE, p to every other if Leader = p ALIVE, 1 LEADER=1 4 LEADER=2 3 ALIVE, 2 2 E, IV AL 1 E, IV ALIVE, 1 AL 1 2 LEADER=2 ALIVE, 2 12/11/2008 Sémimaire VERIMAG 27

Leader Election (2/4) • When a process p such that LEADER = p receives ALIVE from q, then LEADER : = q if q < p ALIVE, 1 LEADER=1 4 LEADER=2 ALIVE, 2 2 E, IV AL 1 E, ALIVE, 1 IV AL 1 LEADER=1 2 LEADER=2 3 ALIVE, 2 12/11/2008 Sémimaire VERIMAG 28

Leader Election (3/4) • Any process q such that LEADER ≠ q always chooses as leader the process from which it receives ALIVE the most recently ALIVE, 1 LEADER=1 12/11/2008 4 1 E, ALIVE, 1 LEADER=2 LEADER=1 IV AL 1 2 LEADER=1 3 Sémimaire VERIMAG 29

Leader Election (4/4) • On Time out, a process p sets LEADER to p ALIVE, 1 LEADER=3 LEADER=1 4 LEADER=2 ALIVE, 2 2 E, IV AL 1 E, IV ALIVE, 1 AL 1 LEADER=4 2 LEADER=2 3 ALIVE, 2 12/11/2008 Sémimaire VERIMAG 30

Conclusion (1/3) • Start of the art: – Many stabilizing solutions for wired networks: • [Katz & Perry] • [Delaet, Ducourthial, Tixeuil] – Recently, focus on: • Large-scale networks • Peer-to-peer systems • Sensor networks 12/11/2008 Sémimaire VERIMAG 31

Conclusion (2/3) • Derived properties – Strengthened Forms: • Tolerating more types of faults, e. g. , byzantine and crash failures • Enhance the convergence property: Fault-containing Self-Stabilization 12/11/2008 Sémimaire VERIMAG 32

Conclusion (3/3) • Derived properties – Weakened Forms: • Probabilistic self-stabilization • Weak-stabilization • K-stabilization – Aim: Circumvent impossibility results, e. g. , Colouring, Leader Election, Token Circulation in anonymous network 12/11/2008 Sémimaire VERIMAG 33

12/11/2008 Sémimaire VERIMAG 34

Stabilization Time of the Dijkstra’s Token Ring? 1 0 2 0 1 3 1 12/11/2008 2 Sémimaire VERIMAG 35