Benign Failure Models for Shared Memory (Preliminary Version)

This paper introduces two benign failure models for shared memory in distributed systems, crash-omission and crash-eventual. These models are of intermediate power between the crash model and omission models of [JCT92]. (They exhibit more faulty behaviors than crash and fewer than omission.) Unlike the crash model, crash-omission is shown to have universal, gracefully-degrading constructions. That is, for any integer k, any shared object may be constructed from shared registers and consensus objects, so that: (1) if no more than k of the components suffer crash-omission failures, the constructed object exhibits no failures, and (2) if more than k of the components suffer crash-omission failures, the constructed object exhibits crash-omission failures. Simple constructions also demonstrate that registers and consensus objects in the (apparently) less benign crash-eventual model can be used to construct corresponding objects in the crash-omission model. These results are cited as evidence that the crash-omission failure model may be an appropriate choice to consider in the formulation of a more extensive theory of fault-tolerant shared objects. 1 Benign failure models for shared memory Shared memory is widely considered a useful programming abstraction for concurrent systems, masking the details of inter-procedural or inter-processor communication, while supporting natural proof-theoretic techniques [Owi75, OG76]. Many experimental and commercial processors provide direct support for this abstraction: indeed, Gordon Bell has predicted that “... the mainline, generalpurpose computer is almost certain to be the shared memory multiprocessor after 1995” [Bel92]. Increasing attention is being paid to implementing shared memory systems either in hardware or in software [Bel92, CG89, LH89, TKB92]. This paper investigates fault-tolerance in shared memory systems, with an emphasis on benign, or constrained, fault models. Benign fault models are easier to program than are more malicious models. Just as shared memory is itself an abstraction of much more complex, timing-dependent implementations, benign fault models hide complex implementation details, and provide a simple programming abstraction. Together with David Greenberg, we introduced the problem of tolerating failures in shared memory objects—previous work had considered the possibility of process failures, but assumed the shared memory was reliable [AGMT92]. Jayanti, et al independently posed this problem, and focused particular attention on whether fault models support modular, gracefully degrading constructions, in which failures of the abstract object are as benign as the failures of the components. They show that their crash model does not support such constructions, while their omission fault model does. This paper further explores benign failure models that support gracefully degrading constructions. An appropriate model, serving as a contract between implementor and programmer, can greatly facilitate the development of faulttolerant shared memory systems. This contract is ultimately a compromise between ease of implementation and ease of programming—motivating a search for “the most benign, implementable failure model”. We define two failure models that are more benign than omission faults, and stress the most benign, crash-omission faults. In this model, a shared memory object suffers a failure of type crash-omission if operations concurrent with the crash may respond with a special “?” value, and all operations after the crash always respond with ⊥. Operations concurrent with the crash may respond normally to some requests because those requests may not access (or be through accessing) the crashed parts of the object. Our argument in favor of this choice of model will use the same framework, and several of the same techniques and constructions as are used by Jayanti, et al in support of the omission model. The principal contribution of this paper lies in the definition of (an inherently) more benign failure model, and observations that it nevertheless has the same positive attributes as the omission model.