I MPOSSIBILITY OF C ONSENSUS IN A SYNCHRONOUS E NVIRONMENTS Ellis - - PowerPoint PPT Presentation

β–Ά
i mpossibility of c onsensus in
SMART_READER_LITE
LIVE PREVIEW

I MPOSSIBILITY OF C ONSENSUS IN A SYNCHRONOUS E NVIRONMENTS Ellis - - PowerPoint PPT Presentation

Mar 31, 2023 232 likes β€’1.17k views

I MPOSSIBILITY OF C ONSENSUS IN A SYNCHRONOUS E NVIRONMENTS Ellis Michael C ONSENSUS processes, all of which have an input value from some domain. Processes output a value by calling decide ( ). Non-faulty processes continue correctly

slide-1
SLIDE 1

IMPOSSIBILITY OF CONSENSUS IN ASYNCHRONOUS ENVIRONMENTS

Ellis Michael

slide-2
SLIDE 2

CONSENSUS

π‘œ processes, all of which have an input value from some domain. Processes output a value by calling decide(𝑀). Non-faulty processes continue correctly executing protocol steps forever. We denote the number of faulty processes 𝑔.

  • Agreement: No two correct processes decide different values.
  • Integrity: Every correct process decides at most one value, and if a

correct process decides a value 𝑀, some process had 𝑀 as its input.

  • Termination: Every correct process eventually decides a value.
slide-3
SLIDE 3

BINARY CONSENSUS

π‘œ processes, all of which have an input value from {0, 1}. Processes output a value by calling decide(𝑀). Non-faulty processes continue correctly executing protocol steps forever. We denote the number of faulty processes 𝑔. Here, we only consider crash failures.

  • Agreement: No two processes decide different values.
  • Integrity: Every process decides at most one value, and if a process

decides a value 𝑀, some process had 𝑀 as its input.

  • Termination: Every correct process eventually decides a value.
slide-4
SLIDE 4

BINARY CONSENSUS

π‘œ processes, all of which have an input value from {0, 1}. Processes output a value by calling decide(𝑀). Non-faulty processes continue correctly executing protocol steps forever. We denote the number of faulty processes 𝑔. Here, we only consider crash failures.

  • Agreement: No two processes decide different values.
  • Integrity: Every process decides at most one value, and if a process

decides a value 𝑀, some process had 𝑀 as its input.

  • Termination: Every correct process eventually decides a value.

If you can solve consensus, you can solve binary consensus.

slide-5
SLIDE 5

Aside: Both safety and liveness properties are necessary to create a meaningful specification!

slide-6
SLIDE 6

Theorem (FLP Impossibility Result): In an asynchronous environment in which a single process can fail by crashing, there does not exist a protocol which solves binary consensus.

slide-7
SLIDE 7

INTUITION

  • In an asynchronous setting, failed processes are

indistinguishable from slow processes.

  • Waiting for failed processes will take forever.
  • Not waiting for slow processes could violate

safety.

slide-8
SLIDE 8

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

slide-9
SLIDE 9

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

slide-10
SLIDE 10

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

(𝑛, π‘ž3)

slide-11
SLIDE 11

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

(𝑛, π‘ž3)

slide-12
SLIDE 12

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

(𝑛, π‘ž3)

slide-13
SLIDE 13

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

slide-14
SLIDE 14

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

  • Special empty message, always deliverable to any

process (even if there are messages for it in the network).

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

slide-15
SLIDE 15

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

  • Special empty message, always deliverable to any

process (even if there are messages for it in the network).

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

βˆ…

slide-16
SLIDE 16

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

  • Special empty message, always deliverable to any

process (even if there are messages for it in the network).

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

βˆ… βˆ…

slide-17
SLIDE 17

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

  • Special empty message, always deliverable to any

process (even if there are messages for it in the network).

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

βˆ…

slide-18
SLIDE 18

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

  • Special empty message, always deliverable to any

process (even if there are messages for it in the network).

  • Any message sent to a non-faulty processes is

eventually received. (Stronger assumption than usual!)

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

βˆ…

slide-19
SLIDE 19

COMPUTATION MODEL

  • Processes are deterministic I/O automata (just like

in your labs; timers are just messages sent from process to itself).

  • They send messages by adding to message buffer,

a multi-set (i.e., messages aren't duplicated by network). Processes only send finitely-many messages in a single step.

  • Special empty message, always deliverable to any

process (even if there are messages for it in the network).

  • Any message sent to a non-faulty processes is

eventually received. (Stronger assumption than usual!)

Message Buffer (network)

π‘ž1 π‘ž2 π‘ž3 π‘ž4 π‘ž5 ... π‘žπ‘œ

βˆ…

Makes the impossibility result is stronger!

slide-20
SLIDE 20

CONFIGURATIONS

A configuration (usually denoted 𝐷) consists of the states of all processes and the state of the message buffer. An event is the delivery of a single message (or βˆ…) to a process. An event is applicable to 𝐷 if it is a βˆ… or a message in 𝐷's message buffer. A configuration 𝐷ʹ is reachable from 𝐷 if there is a (possibly empty) sequence of applicable events starting from 𝐷 that results in 𝐷ʹ. Configuration 𝐷 is decided if at least one process has decided in 𝐷.

slide-21
SLIDE 21

RUNS

A run is an infinite sequence of events starting from an initial configuration. A process is non-faulty in a run if it takes infinitely many steps. It is faulty otherwise. A run is admissible if at most one process is faulty and every message sent to a non-faulty process is eventually delivered.

slide-22
SLIDE 22

In other words, the FLP theorem states that any protocol for binary consensus either doesn't satisfy safety or allows for an admissible run in which no value is ever decided (i.e., that it doesn't satisfy termination, the liveness property). From now on, we'll consider a safe and live binary consensus protocol and show a contradiction.

slide-23
SLIDE 23

VALENCY

By assumption of safety, no configuration has processes deciding different values. 𝐷 is 0-valent if there are decided configurations reachable from 𝐷 that decide 0, but none that decide 1. 1-valency is defined in the analogous way. 𝐷 is univalent if it is 0-valent or 1-valent. 𝐷 is bivalent if both 0-deciding and 1-deciding are reachable from 𝐷.

𝐷

slide-24
SLIDE 24

VALENCY

By assumption of safety, no configuration has processes deciding different values. 𝐷 is 0-valent if there are decided configurations reachable from 𝐷 that decide 0, but none that decide 1. 1-valency is defined in the analogous way. 𝐷 is univalent if it is 0-valent or 1-valent. 𝐷 is bivalent if both 0-deciding and 1-deciding are reachable from 𝐷.

𝐷

1

slide-25
SLIDE 25

Observation: bivalent configurations are not themselves decided.

slide-26
SLIDE 26

Observation: 1-valent and bivalent configurations are not reachable from 0-valent configurations. 0-valent and bivalent configurations are not reachable from 1-valent configurations.

slide-27
SLIDE 27

COMMUTATIVE EVENTS

Lemma 1: If two sequences of events, 𝜏1 and 𝜏2, are taken by disjoint sets of processes from configuration 𝐷, then 𝜏1(𝜏2(𝐷)) = 𝜏2(𝜏1(𝐷)).

𝐷

𝜏1 𝜏1 𝜏2 𝜏2

p1 p2 p3 p4

𝐷

slide-28
SLIDE 28

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

slide-29
SLIDE 29

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

0β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ...

slide-30
SLIDE 30

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

0-valent!

0β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ...

slide-31
SLIDE 31

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

0-valent!

0β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 1β†’π‘ž2 1β†’π‘ž3 1β†’π‘žn ...

slide-32
SLIDE 32

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

0-valent! 1-valent!

0β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 1β†’π‘ž2 1β†’π‘ž3 1β†’π‘žn ...

slide-33
SLIDE 33

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

0-valent! 1-valent!

0β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 1β†’π‘ž2 1β†’π‘ž3 1β†’π‘žn ...

slide-34
SLIDE 34

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

0-valent! 1-valent!

0β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 1β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 1β†’π‘ž2 1β†’π‘ž3 1β†’π‘žn ...

slide-35
SLIDE 35

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

0-valent! 1-valent!

...

0β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 0β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 1β†’π‘ž2 0β†’π‘ž3 0β†’π‘žn ... 1β†’π‘ž1 1β†’π‘ž2 1β†’π‘ž3 1β†’π‘žn ...

slide-36
SLIDE 36

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

There must be 0-valent 𝐷0 and 
 1-valent 𝐷1 that differ only in the input value of a single process, π‘ž.

1β†’π‘ž β‡’ 1 is decided 0β†’π‘ž β‡’ 0 is decided

slide-37
SLIDE 37

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

There must be 0-valent 𝐷0 and 
 1-valent 𝐷1 that differ only in the input value of a single process, π‘ž. What if π‘ž crashes at the beginning?

1β†’π‘ž β‡’ 1 is decided 0β†’π‘ž β‡’ 0 is decided

slide-38
SLIDE 38

BIVALENT INITIAL CONFIGURATIONS

Lemma 2: There exists a bivalent initial configuration.

There must be 0-valent 𝐷0 and 
 1-valent 𝐷1 that differ only in the input value of a single process, π‘ž. What if π‘ž crashes at the beginning? These two configurations are indistinguishable to the rest of the processes.

1β†’π‘ž β‡’ 1 is decided 0β†’π‘ž β‡’ 0 is decided

slide-39
SLIDE 39

DELAYING EVENTS

Lemma 3 (The Delay Lemma): For every bivalent configuration, 𝐷, and every event applicable to 𝐷, 𝑓, there exists a sequence of applicable events 𝜏 such that 𝐷ʹ = 𝑓(𝜏(𝐷)) is bivalent.

𝐷 𝐷ʹ

𝜏 𝑓

slide-40
SLIDE 40

PROVING THE MAIN THEOREM

slide-41
SLIDE 41

PROVING THE MAIN THEOREM

Constructing the non-terminating execution:

slide-42
SLIDE 42

PROVING THE MAIN THEOREM

Constructing the non-terminating execution: 1: Let 𝐷 be a bivalent initial configuration (Lemma 2).

slide-43
SLIDE 43

PROVING THE MAIN THEOREM

Constructing the non-terminating execution: 1: Let 𝐷 be a bivalent initial configuration (Lemma 2).

𝐷

slide-44
SLIDE 44

PROVING THE MAIN THEOREM

Constructing the non-terminating execution: 1: Let 𝐷 be a bivalent initial configuration (Lemma 2). 2: For the process which least recently took a step, take the oldest message left in the network for it (βˆ… if none exists), 𝑓. By Lemma 3, we first take a sequence of steps 𝜏 and then deliver 𝑓 and remain in a bivalent configuration.

𝐷

slide-45
SLIDE 45

PROVING THE MAIN THEOREM

Constructing the non-terminating execution: 1: Let 𝐷 be a bivalent initial configuration (Lemma 2). 2: For the process which least recently took a step, take the oldest message left in the network for it (βˆ… if none exists), 𝑓. By Lemma 3, we first take a sequence of steps 𝜏 and then deliver 𝑓 and remain in a bivalent configuration.

𝐷 𝐷ʹ

𝜏 𝑓

slide-46
SLIDE 46

PROVING THE MAIN THEOREM

Constructing the non-terminating execution: 1: Let 𝐷 be a bivalent initial configuration (Lemma 2). 2: For the process which least recently took a step, take the oldest message left in the network for it (βˆ… if none exists), 𝑓. By Lemma 3, we first take a sequence of steps 𝜏 and then deliver 𝑓 and remain in a bivalent configuration. 3: Go to 2.

𝐷 𝐷ʹ

𝜏 𝑓

slide-47
SLIDE 47

PROVING THE MAIN THEOREM

Constructing the non-terminating execution: 1: Let 𝐷 be a bivalent initial configuration (Lemma 2). 2: For the process which least recently took a step, take the oldest message left in the network for it (βˆ… if none exists), 𝑓. By Lemma 3, we first take a sequence of steps 𝜏 and then deliver 𝑓 and remain in a bivalent configuration. 3: Go to 2.

𝐷 𝐷ʹ

𝜏 𝑓

𝐷ʹʹ

𝑓ʹ 𝜏ʹ

slide-48
SLIDE 48

PROVING THE MAIN THEOREM

Constructing the non-terminating execution: 1: Let 𝐷 be a bivalent initial configuration (Lemma 2). 2: For the process which least recently took a step, take the oldest message left in the network for it (βˆ… if none exists), 𝑓. By Lemma 3, we first take a sequence of steps 𝜏 and then deliver 𝑓 and remain in a bivalent configuration. 3: Go to 2.

𝐷 𝐷ʹ

𝜏 𝑓

𝐷ʹʹ

𝑓ʹ 𝜏ʹ

. . .

slide-49
SLIDE 49

PROVING THE MAIN THEOREM

Constructing the non-terminating execution: 1: Let 𝐷 be a bivalent initial configuration (Lemma 2). 2: For the process which least recently took a step, take the oldest message left in the network for it (βˆ… if none exists), 𝑓. By Lemma 3, we first take a sequence of steps 𝜏 and then deliver 𝑓 and remain in a bivalent configuration. 3: Go to 2.

Every process takes infinitely many steps (i.e., no process is faulty). Every message sent is eventually delivered. This is an admissible execution. We take infinitely many steps, and no process decides! The protocol fails to meet the termination property of the spec.

𝐷 𝐷ʹ

𝜏 𝑓

𝐷ʹʹ

𝑓ʹ 𝜏ʹ

. . .

slide-50
SLIDE 50

PROVING THE DELAY LEMMA

Consider a bivalent configuration, 𝐷, and an applicable event, 𝑓.

slide-51
SLIDE 51

PROVING THE DELAY LEMMA

Consider a bivalent configuration, 𝐷, and an applicable event, 𝑓. If 𝑓(𝐷) is bivalent, then we're done.

slide-52
SLIDE 52

PROVING THE DELAY LEMMA

Consider a bivalent configuration, 𝐷, and an applicable event, 𝑓. If 𝑓(𝐷) is bivalent, then we're done. Otherwise, let π’Ÿ be the set of events reachable from 𝐷 without applying 𝑓 and 𝒠 be 𝑓(π’Ÿ) = { 𝑓(𝐷) : 𝐷 ∈ π’Ÿ } (i.e., the set of all configurations reachable from 𝐷 where 𝑓 was the last event taken).

slide-53
SLIDE 53

PROVING THE DELAY LEMMA

Consider a bivalent configuration, 𝐷, and an applicable event, 𝑓. If 𝑓(𝐷) is bivalent, then we're done. Otherwise, let π’Ÿ be the set of events reachable from 𝐷 without applying 𝑓 and 𝒠 be 𝑓(π’Ÿ) = { 𝑓(𝐷) : 𝐷 ∈ π’Ÿ } (i.e., the set of all configurations reachable from 𝐷 where 𝑓 was the last event taken).

𝐷

π’Ÿ

slide-54
SLIDE 54

PROVING THE DELAY LEMMA

Consider a bivalent configuration, 𝐷, and an applicable event, 𝑓. If 𝑓(𝐷) is bivalent, then we're done. Otherwise, let π’Ÿ be the set of events reachable from 𝐷 without applying 𝑓 and 𝒠 be 𝑓(π’Ÿ) = { 𝑓(𝐷) : 𝐷 ∈ π’Ÿ } (i.e., the set of all configurations reachable from 𝐷 where 𝑓 was the last event taken).

𝐷

π’Ÿ 𝑓

slide-55
SLIDE 55

PROVING THE DELAY LEMMA

Consider a bivalent configuration, 𝐷, and an applicable event, 𝑓. If 𝑓(𝐷) is bivalent, then we're done. Otherwise, let π’Ÿ be the set of events reachable from 𝐷 without applying 𝑓 and 𝒠 be 𝑓(π’Ÿ) = { 𝑓(𝐷) : 𝐷 ∈ π’Ÿ } (i.e., the set of all configurations reachable from 𝐷 where 𝑓 was the last event taken).

𝐷

π’Ÿ 𝒠 𝑓

slide-56
SLIDE 56

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't.

π’Ÿ 𝒠 𝑓

𝐷

slide-57
SLIDE 57

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠.

π’Ÿ 𝒠 𝑓

𝐷

slide-58
SLIDE 58

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠. Because 𝐷 is bivalent, there exist reachable 0-valent and 1-valent configurations. For each, this configuration is either:

π’Ÿ 𝒠 𝑓

𝐷

slide-59
SLIDE 59

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠. Because 𝐷 is bivalent, there exist reachable 0-valent and 1-valent configurations. For each, this configuration is either:

  • 1. In 𝒠,

π’Ÿ 𝒠 𝑓

𝐷

slide-60
SLIDE 60

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠. Because 𝐷 is bivalent, there exist reachable 0-valent and 1-valent configurations. For each, this configuration is either:

  • 1. In 𝒠,

π’Ÿ 𝒠 𝑓

𝐷

slide-61
SLIDE 61

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠. Because 𝐷 is bivalent, there exist reachable 0-valent and 1-valent configurations. For each, this configuration is either:

  • 1. In 𝒠,
  • 2. In π’Ÿ (just apply 𝑓),

π’Ÿ 𝒠 𝑓

𝐷

slide-62
SLIDE 62

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠. Because 𝐷 is bivalent, there exist reachable 0-valent and 1-valent configurations. For each, this configuration is either:

  • 1. In 𝒠,
  • 2. In π’Ÿ (just apply 𝑓),

π’Ÿ 𝒠 𝑓

𝐷

slide-63
SLIDE 63

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠. Because 𝐷 is bivalent, there exist reachable 0-valent and 1-valent configurations. For each, this configuration is either:

  • 1. In 𝒠,
  • 2. In π’Ÿ (just apply 𝑓),

π’Ÿ 𝒠 𝑓

𝐷

slide-64
SLIDE 64

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠. Because 𝐷 is bivalent, there exist reachable 0-valent and 1-valent configurations. For each, this configuration is either:

  • 1. In 𝒠,
  • 2. In π’Ÿ (just apply 𝑓),
  • 3. Or past 𝒠 (the ancestor in 𝒠 must also be of the

same valency since it's not bivalent by assumption).

π’Ÿ 𝒠 𝑓

𝐷

slide-65
SLIDE 65

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠. Because 𝐷 is bivalent, there exist reachable 0-valent and 1-valent configurations. For each, this configuration is either:

  • 1. In 𝒠,
  • 2. In π’Ÿ (just apply 𝑓),
  • 3. Or past 𝒠 (the ancestor in 𝒠 must also be of the

same valency since it's not bivalent by assumption).

π’Ÿ 𝒠 𝑓

𝐷

slide-66
SLIDE 66

PROVING THE DELAY LEMMA

We want to show 𝒠 contains a bivalent configuration. Suppose, for the sake of contradiction, that it doesn't. Then, we first show there must exist both 0-valent and 1-valent configurations in 𝒠. Because 𝐷 is bivalent, there exist reachable 0-valent and 1-valent configurations. For each, this configuration is either:

  • 1. In 𝒠,
  • 2. In π’Ÿ (just apply 𝑓),
  • 3. Or past 𝒠 (the ancestor in 𝒠 must also be of the

same valency since it's not bivalent by assumption).

π’Ÿ 𝒠 𝑓

𝐷

slide-67
SLIDE 67

PROVING THE DELAY LEMMA

Now, consider the valency of 𝑓(𝐷). Without loss

  • f generality, let's say it's 0.

π’Ÿ 𝒠 𝑓

𝐷

slide-68
SLIDE 68

PROVING THE DELAY LEMMA

Now, consider the valency of 𝑓(𝐷). Without loss

  • f generality, let's say it's 0.

Because there are 1-valent configurations in 𝒠, there must be a path from 𝐷 to one of these.

π’Ÿ 𝒠 𝑓

𝐷

slide-69
SLIDE 69

PROVING THE DELAY LEMMA

Now, consider the valency of 𝑓(𝐷). Without loss

  • f generality, let's say it's 0.

Because there are 1-valent configurations in 𝒠, there must be a path from 𝐷 to one of these.

π’Ÿ 𝒠 𝑓

𝐷

1

slide-70
SLIDE 70

PROVING THE DELAY LEMMA

Now, consider the valency of 𝑓(𝐷). Without loss

  • f generality, let's say it's 0.

Because there are 1-valent configurations in 𝒠, there must be a path from 𝐷 to one of these. Then, there must exist adjacent configurations, 𝐷0 and 𝐷1, where 𝑓(𝐷0) is 0-valent and 𝑓(𝐷1) is 1-valent.

π’Ÿ 𝒠 𝑓

𝐷

1

slide-71
SLIDE 71

PROVING THE DELAY LEMMA

Now, consider the valency of 𝑓(𝐷). Without loss

  • f generality, let's say it's 0.

Because there are 1-valent configurations in 𝒠, there must be a path from 𝐷 to one of these. Then, there must exist adjacent configurations, 𝐷0 and 𝐷1, where 𝑓(𝐷0) is 0-valent and 𝑓(𝐷1) is 1-valent.

π’Ÿ 𝒠 𝑓

𝐷

1 1

𝐷1 𝐷0

slide-72
SLIDE 72

PROVING THE DELAY LEMMA

Now, consider the valency of 𝑓(𝐷). Without loss

  • f generality, let's say it's 0.

Because there are 1-valent configurations in 𝒠, there must be a path from 𝐷 to one of these. Then, there must exist adjacent configurations, 𝐷0 and 𝐷1, where 𝑓(𝐷0) is 0-valent and 𝑓(𝐷1) is 1-valent. Let's call the event that takes 𝐷0 to 𝐷1 𝑕.

π’Ÿ 𝒠 𝑓

𝐷

1 1

𝐷1 𝐷0

slide-73
SLIDE 73

PROVING THE DELAY LEMMA

Now, consider the valency of 𝑓(𝐷). Without loss

  • f generality, let's say it's 0.

Because there are 1-valent configurations in 𝒠, there must be a path from 𝐷 to one of these. Then, there must exist adjacent configurations, 𝐷0 and 𝐷1, where 𝑓(𝐷0) is 0-valent and 𝑓(𝐷1) is 1-valent. Let's call the event that takes 𝐷0 to 𝐷1 𝑕.

π’Ÿ 𝒠 𝑓

𝐷

1 1

𝐷1 𝐷0

𝑕

slide-74
SLIDE 74

PROVING THE DELAY LEMMA

Almost done! First, we will show that the processes taking steps 𝑓 and 𝑕 must be the same process.

1

𝐷1 𝐷0

𝑕 𝑓 𝑓

slide-75
SLIDE 75

PROVING THE DELAY LEMMA

Almost done! First, we will show that the processes taking steps 𝑓 and 𝑕 must be the same process. If not, 𝑕 is applicable to 𝑓(𝐷0) and results in a 1-valent configuration (Lemma 1).

1

𝐷1 𝐷0

𝑕 𝑓 𝑓

slide-76
SLIDE 76

PROVING THE DELAY LEMMA

Almost done! First, we will show that the processes taking steps 𝑓 and 𝑕 must be the same process. If not, 𝑕 is applicable to 𝑓(𝐷0) and results in a 1-valent configuration (Lemma 1).

1

𝐷1 𝐷0

𝑕 𝑓 𝑓 𝑕

slide-77
SLIDE 77

PROVING THE DELAY LEMMA

Almost done! First, we will show that the processes taking steps 𝑓 and 𝑕 must be the same process. If not, 𝑕 is applicable to 𝑓(𝐷0) and results in a 1-valent configuration (Lemma 1). Let's call the process taking these steps π‘ž.

1

𝐷1 𝐷0

𝑕 𝑓 𝑓 𝑕

slide-78
SLIDE 78

PROVING THE DELAY LEMMA

Since the protocol is correct and tolerates

  • ne failure, it must be able to reach a

decided configuration, 𝐡, without π‘ž taking steps. 1

𝐷1 𝐷0

𝑕 𝑓 𝑓

slide-79
SLIDE 79

PROVING THE DELAY LEMMA

Since the protocol is correct and tolerates

  • ne failure, it must be able to reach a

decided configuration, 𝐡, without π‘ž taking steps. 1

𝐷1 𝐷0

𝑕 𝑓 𝑓

𝐡

𝜏

slide-80
SLIDE 80

PROVING THE DELAY LEMMA

Since the protocol is correct and tolerates

  • ne failure, it must be able to reach a

decided configuration, 𝐡, without π‘ž taking steps. By Lemma 1, we get the commutative diagram on the right. A decided configuration, 𝐡, can reach both 1-valent and 0-valent configurations. 1

𝐷1 𝐷0

𝑕 𝑓 𝑓

𝐡

𝜏

slide-81
SLIDE 81

PROVING THE DELAY LEMMA

Since the protocol is correct and tolerates

  • ne failure, it must be able to reach a

decided configuration, 𝐡, without π‘ž taking steps. By Lemma 1, we get the commutative diagram on the right. A decided configuration, 𝐡, can reach both 1-valent and 0-valent configurations. 1

𝐷1 𝐷0

𝑕 𝑓 𝑓

𝐡

𝜏 𝜏

slide-82
SLIDE 82

PROVING THE DELAY LEMMA

Since the protocol is correct and tolerates

  • ne failure, it must be able to reach a

decided configuration, 𝐡, without π‘ž taking steps. By Lemma 1, we get the commutative diagram on the right. A decided configuration, 𝐡, can reach both 1-valent and 0-valent configurations. 1

𝐷1 𝐷0

𝑕 𝑓 𝑓

𝐡

𝜏

1

𝜏 𝜏

slide-83
SLIDE 83

PROVING THE DELAY LEMMA

Since the protocol is correct and tolerates

  • ne failure, it must be able to reach a

decided configuration, 𝐡, without π‘ž taking steps. By Lemma 1, we get the commutative diagram on the right. A decided configuration, 𝐡, can reach both 1-valent and 0-valent configurations. 1

𝐷1 𝐷0

𝑕 𝑓 𝑓

𝐡

𝜏

1

𝜏 𝜏 𝑓

slide-84
SLIDE 84

PROVING THE DELAY LEMMA

Since the protocol is correct and tolerates

  • ne failure, it must be able to reach a

decided configuration, 𝐡, without π‘ž taking steps. By Lemma 1, we get the commutative diagram on the right. A decided configuration, 𝐡, can reach both 1-valent and 0-valent configurations. 1

𝐷1 𝐷0

𝑕 𝑓 𝑓

𝐡

𝜏

1

𝜏 𝜏 𝑓 𝑕 𝑓

slide-85
SLIDE 85

PROVING THE DELAY LEMMA

Since the protocol is correct and tolerates

  • ne failure, it must be able to reach a

decided configuration, 𝐡, without π‘ž taking steps. By Lemma 1, we get the commutative diagram on the right. A decided configuration, 𝐡, can reach both 1-valent and 0-valent configurations. As desired, contradiction! 1

𝐷1 𝐷0

𝑕 𝑓 𝑓

𝐡

𝜏

1

𝜏 𝜏 𝑓 𝑕 𝑓

slide-86
SLIDE 86

PROVING THE DELAY LEMMA

Since the protocol is correct and tolerates

  • ne failure, it must be able to reach a

decided configuration, 𝐡, without π‘ž taking steps. By Lemma 1, we get the commutative diagram on the right. A decided configuration, 𝐡, can reach both 1-valent and 0-valent configurations. As desired, contradiction! 1

𝐷1 𝐷0

𝑕 𝑓 𝑓

𝐡

𝜏

1

𝜏 𝜏 𝑓 𝑕 𝑓

QED

slide-87
SLIDE 87

IS IT OVER? DO WE GIVE UP NOW?

slide-88
SLIDE 88

IS IT OVER? DO WE GIVE UP NOW?

slide-89
SLIDE 89

IS IT OVER? DO WE GIVE UP NOW?

Options:

  • Only guarantee termination during periods of synchrony

(Paxos); implies that no configuration is ever dead

  • Use randomization to guarantee termination with probability

1 (Ben-Or)

  • Strengthen the assumptions (consensus is solvable in a

synchronous system)

  • Constrain/weaken the problem
slide-90
SLIDE 90

SOME RELATED PROBLEMS

  • 𝒍-set Agreement: allows up to 𝑙 different

decision values

  • Generalized Lattice Agreement: processes

decide on sets of values, all decision sets are comparable by βŠ†

  • Shared read/write register: processes can read

and write to a register

slide-91
SLIDE 91

SOME RELATED PROBLEMS

  • 𝒍-set Agreement: allows up to 𝑙 different

decision values

  • Generalized Lattice Agreement: processes

decide on sets of values, all decision sets are comparable by βŠ†

  • Shared read/write register: processes can read

and write to a register

Still can't guarantee liveness when 𝑔 β‰₯ 𝑙

slide-92
SLIDE 92

SOME RELATED PROBLEMS

  • 𝒍-set Agreement: allows up to 𝑙 different

decision values

  • Generalized Lattice Agreement: processes

decide on sets of values, all decision sets are comparable by βŠ†

  • Shared read/write register: processes can read

and write to a register

Still can't guarantee liveness when 𝑔 β‰₯ 𝑙 Solvable, can guarantee both safety and liveness! Of questionable utility.

slide-93
SLIDE 93

SOME RELATED PROBLEMS

  • 𝒍-set Agreement: allows up to 𝑙 different

decision values

  • Generalized Lattice Agreement: processes

decide on sets of values, all decision sets are comparable by βŠ†

  • Shared read/write register: processes can read

and write to a register

Still can't guarantee liveness when 𝑔 β‰₯ 𝑙 Solvable, can guarantee both safety and liveness! Of questionable utility. Also solvable! And useful!