Feasibility of Stepwise Design of Multitolerant Programs

Abstract

The complexity of designing programs that simultaneously tolerate multiple classes of faults, called multitolerant programs, is in part due to the conflicting nature of the fault tolerance requirements that must be met by a multitolerant program when different types of faults occur. To facilitate the design of multitolerant programs, we present sound and (deterministically) complete algorithms for stepwise design of two families of multitolerant programs in a high atomicity program model, where a process can read and write all program variables in an atomic step. We illustrate that if one needs to design failsafe (respectively, nonmasking) fault tolerance for one class of faults and masking fault tolerance for another class of faults, then a multitolerant program can be designed in separate polynomial-time (in the state space of the faultintolerant program) steps regardless of the order of addition. This result has a significant methodological implication in that designers need not be concerned about unknown fault tolerance requirements that may arise due to unanticipated types of faults. Further, we illustrate that if one needs to design failsafe fault tolerance for one class of faults and nonmasking fault tolerance for a different class of faults, then the resulting problem is NP-complete in program state space. This is a counterintuitive result in that designing failsafe and nonmasking fault tolerance for the same class of faults can be done in polynomial time. We also present sufficient conditions for polynomial-time design of failsafe-nonmasking multitolerance. Finally, we demonstrate the stepwise design of multitolerance for a stable disk storage system, a token ring network protocol and a repetitive agreement protocol that tolerates Byzantine and transient faults. Our automatic approach decreases the design time from days to a few hours for the token ring program that is our largest example with 200 million reachable states and 8 processes.

The Complexity of Adding Multitolerance

“…c 2014 ACM 1556-4665/2014/10-ART15 $15.00 DOI: http://dx.doi.org/10.1145/2629664 Table I. Complexity of Different Types of Multitolerance The asterisk (*) denotes that the complexity differs from the restricted version considered in Ebnenasir and Kulkarni [2011]. alone.…”

“…In addition, if the designer concludes that the probability of f 1 and f 2 occurring simultaneously is negligible, then the designer can decide to provide no fault tolerance in such a situation. Ebnenasir and Kulkarni [2011] have considered a restricted version of such multitolerant systems, where they require that if a system provides some tolerance individually to f 1 and individually to f 2 , then it must provide the minimum of these tolerances when f 1 and f 2 occur simultaneously. For example, if masking fault tolerance is provided to f 1 and nonmasking fault tolerance is provided to f 2 , then in Ebnenasir and Kulkarni [2011] it is required that nonmasking fault tolerance must be provided when both f 1 and f 2 occur simultaneously.…”

“…Ebnenasir and Kulkarni [2011] have considered a restricted version of such multitolerant systems, where they require that if a system provides some tolerance individually to f 1 and individually to f 2 , then it must provide the minimum of these tolerances when f 1 and f 2 occur simultaneously. For example, if masking fault tolerance is provided to f 1 and nonmasking fault tolerance is provided to f 2 , then in Ebnenasir and Kulkarni [2011] it is required that nonmasking fault tolerance must be provided when both f 1 and f 2 occur simultaneously. This restriction prevents one from considering systems where the probability of simultaneous occurrence of f 1 and f 2 is negligible and hence ignored by the designer.…”

“…In this article, we investigate the problem of adding multitolerance to concurrent programs in a more general setting than Ebnenasir and Kulkarni [2011], where the desired behavior when multiple faults occur is given by the designer. More specifically, instead of hard coding a specific definition for what a multitolerant system should do (e.g., providing the minimum level of tolerance) when different types of faults occur simultaneously, we leave it up to the designers to determine what they expect from the multitolerant system when several faults occur.…”

“…This result (marked with an asterisk in Table I) is especially surprising given that the corresponding problems can be solved in polynomial time for the restricted version of multitolerance considered in Ebnenasir and Kulkarni [2011]. (3) We present a sound and complete algorithm for automated addition of FF multitolerance and MN multitolerance.…”