On the Number of Opinions Needed for Fault-Tolerant Run-Time Monitoring in Distributed Systems

Abstract

Decentralized runtime monitoring involves a set of monitors observing the behavior of system executions with respect to some correctness property. It is generally assumed that, as soon as a violation of the property is revealed by any of the monitors at runtime, some recovery code can be executed for bringing the system back to a legal state. This implicitly assumes that each monitor produces a binary opinion, true or false, and that the recovery code is launched as soon as one of these opinions is equal to false. In this paper, we formally prove that, in a failure-prone asynchronous computing model, there are correctness properties for which there is no such decentralized monitoring. We show that there exist some properties which, in order to be monitored in a wait-free decentralized manner, inherently require that the monitors produce a number of opinions larger than two. More specifically, our main result is that, for every k, 1 ≤ k ≤ n, there exists a property that requires at least k opinions to be monitored by n monitors. We also present a corresponding distributed monitor using at most k + 1 opinions, showing that our lower bound is nearly tight.

The Opinion Number of Set-Agreement

“…It has indeed been shown in [11] that there are correctness properties that cannot be monitored by interpreting the opinions produced by the monitors using the logical conjunction of all the opinions, where the system is in legal state if and only if all opinions are true. Even more problematic is the fact that it was also shown [12] later on that there are correctness properties for which no decentralized monitoring exists, even if we let the number of opinions grow to an arbitrary large constant k ≥ 2. This holds no matter what the interpretation of the opinions is (logical conjunction or otherwise).…”

“…This holds no matter what the interpretation of the opinions is (logical conjunction or otherwise). The model studied in [11,12] consists of a distributed system composed of n asynchronous processes communicating by reading and writing to a shared memory, and in which any number of processes may fail by crashing. This classical model has been studied in depth in the literature (see textbooks [14,16]).…”

“…To be more specific, we consider the same crash-prone asynchronous distributed system, and assume as in [11,12] that each process has a variable that contains the output of a computation that needs to be monitored. The simplest situation is considered, i.e., where the variable at each process is written only once.…”

“…This set is called a distributed language. The following illustrative example was detailed in [12], as it is arising often in practice [5]. Let us consider a system where requests are sent by clients, and acknowledged by servers.…”

“…In the most common setting, each opinion is in the set {true, false}, and the (global) interpretation of opinions is the logical conjunction of these opinions. However, as mentioned above, there are languages that require more opinions and more complex interpretations than logical conjunction [11,12].…”