Crash failures can drive protocols to arbitrary states

Abstract

A crashing network protocol is an asynchronous protocol that has no non-volatile memory at nodes that can survive a node crash and restart. Thus after a crash and restart, a node in such a protocol returns to a prespecified start state. We consider crashing protocols that work with links that can drop packets. Our main theorem states that such crashing protocols can be driven by a sequence of crashes to any global state, where each node is in a state reached in some (possibly different) run, and each link has an arbitrary mixture of packets sent in (possibly different) runs. Our theorem can be used to give an alternate proof of an earlier result, due to Fekete et al, which states that there is no correct crashing Data Link Protocol. Our theorem can also be used to derive new results. We prove that there is no correct crashing token passing protocol. We also prove that there is no correct crashing protocol for many other resource allocation protocols such as k-exclusion, and the drinking and dining philosophers problems. Our theorem shows that existing crashing network protocols (that are widely deployed) are either incorrect or are self-stabilizing.