Fault Tolerant Network Constructors

TL;DR

This paper investigates the limits of constructing various graph languages in a network model under adversarial crash faults, proposing fault-tolerant protocols and analyzing their capabilities and limitations.

Contribution

It introduces a fault-tolerant universal constructor for graph languages, extending the model with fault notifications and analyzing the impact of waste and memory on constructibility.

Findings

Only spanning cliques are constructible with unbounded faults.

Finite faults prevent constructing non-hereditary graph languages.

Fault notifications enable universal construction with controlled waste.

Abstract

In this work, we consider adversarial crash faults of nodes in the network constructors model $[$Michail and Spirakis, 2016$]$. We first show that, without further assumptions, the class of graph languages that can be (stably) constructed under crash faults is non-empty but small. In particular, if an unbounded number of crash faults may occur, we prove that (i) the only constructible graph language is that of spanning cliques and (ii) a strong impossibility result holds even if the size of the graphs that the protocol outputs in populations of size $n$ need only grow with $n$ (the remaining nodes being waste). When there is a finite upper bound $f$ on the number of faults, we show that it is impossible to construct any non-hereditary graph language. On the positive side, by relaxing our requirements we prove that: (i) permitting linear waste enables to construct on $n/(2f)-f$ nodes, any graph language that is constructible in the fault-free case, (ii) partial constructibility (i.e. not having to generate all graphs in the language) allows the construction of a large class of graph languages. We then extend the original model with a minimal form of fault notifications. Our main result here is a fault-tolerant universal constructor: We develop a fault-tolerant protocol for spanning line and use it to simulate a linear-space Turing Machine $M$. This allows a fault-tolerant construction of any graph accepted by $M$ in linear space, with waste $min\{n/2+f(n),\; n\}$, where $f(n)$ is the number of faults in the execution. We then prove that increasing the permissible waste to $min\{2n/3+f(n),\; n\}$ allows the construction of graphs accepted by an $O(n^2)$-space Turing Machine, which is asymptotically the maximum simulation space that we can hope for in this model. Finally, we show that logarithmic local memories can be exploited for a no-waste fault-tolerant simulation of any such protocol.

Equations

$$\begin{array}{rl}{n}_p& =\frac{n_{p-1}-1}{2}=\frac{n_{p-1}}{2}-\frac{1}{2}=\frac{\frac{n_{p-2}}{2}-\frac{1}{2}}{2}-\frac{1}{2}=\\ & =\frac{n_{p-2}}{4}-\frac{1}{4}-\frac{1}{2}=\cdots =\frac{n_0}{2^p}-\sum _{i=1}^p\frac{1}{2^i}=\frac{n_0}{2^p}-(1-2^{-p})>\frac{n_0}{2^p}-1\end{array}$$

$$\begin{array}{rl}E[X]& =E[\sum _{j=0}^{m_i-2}{X}_j]=\sum _{j=0}^{m_i-2}E[X_j]=n(n-1)\sum _{j=0}^{m_i-2}\frac{1}{(m_i-j)(m_i-j-1)}\\ & =n(n-1)\sum _{j=2}^{m_i}\frac{1}{j(j-1)}<n(n-1)\sum _{j=2}^{m_i}\frac{1}{(j-1{)}^2}\\ & =n(n-1)\sum _{j=1}^{m_i-1}\frac{1}{j^2}=n(n-1)(1-\frac{1}{m_i})<n^2\end{array}$$

Full text

Keywords: network construction; distributed protocol; self stabilization; fault tolerant protocol; dynamic graph formation; population; fairness; self-organization;

1 Introduction and Related Work

In this work, we address the issue of the dynamic formation of graphs under faults. We do this in a minimal setting, that is, a population of agents running Population Protocols that can additionally activate/deactivate links when they meet. This model, called Network Constructors, was introduced in [MS16], and is based on the Population Protocol (PP) model [AAD*+*06, AAER07] and the Mediated Population Protocol (MPP) model [MCS11]. We are interested in answering questions like the following: If one or more faults can affect the formation process, can we always re-stabilize to a correct graph, and if not, what is the class of graph languages for which there exists a fault-tolerant protocol? What are the additional minimal assumptions that we need to make in order to find fault-tolerant protocols for a bigger class of languages?

Population Protocols run on networks that consist of computational entities called agents. One of the challenging characteristics is that the agents have no control over the schedule of interactions with each other. In a population of $n$ agents, repeatedly a pair of agents is chosen to interact. During an interaction their states are updated based on their previous states. In general, the interactions are scheduled by a fair scheduler. When the execution time of a protocol needs to be examined, a typical fair scheduler is the one that selects interactions uniformly at random.

Network Constructors (and its geometric variant [Mic18]) is a theoretical model that may be viewed as a minimal model for programmable matter operating in a dynamic environment [MS17]. Programmable matter refers to any type of matter that can algorithmically transform its physical properties, for example shape and connectivity. The transformation is the result of executing an underlying program, which can be either a centralized algorithm or a distributed protocol stored in the material itself. There is a wide range of applications, spanning from distributed robotic systems [GKR10], to smart materials, and many theoretical models (see, e.g., [DDG*+*14, DDG*+*18, MSS19, DLFS*+*19] and references therein), try to capture some aspects of them.

The main difference between PPs and Network Constructors is that in the PP (and the MPP) models, the focus is on computation of functions of some input values, while Network Constructors are mostly concerned with the stable formation of graphs that belong to some graph language. Fault tolerance must deal with the graph topology, thus, previous results on self-stabilizing PPs [AAFJ08, BBB13, DLFI*+*17, CLV*+*17] and MPPs [MOKY12] do not apply here.

In [MS16], Michail and Spirakis gave protocols for several basic network construction problems, and proved several universality results by presenting generic protocols that are capable of simulating a Turing Machine and exploiting it in order to stably construct a large class of networks, in the absence of crash failures.

In this work, we examine the setting where adversarial crash faults may occur, and we address the question of which families of graph languages can be stably formed. Here, adversarial crash faults mean that an adversary knows the rules of the protocol and can select some node to be removed from the population at any time. For simplicity, we assume that the faults can only happen sequentially. This means that in every step at most one fault may occur, as opposed to the case where many faults can occur during each step. These cases are equivalent in the Network Constructors model w.l.o.g., but not in the extended version of this model (which allows fault notifications) that we consider later. We discuss more about it in Section 4.

A main difference between our work and traditional self-stabilization approaches is that the nodes are supplied with constant local memory, while in principle they can form linear (in the population size) number of connections per node. Existing self-stabilization approaches that are based on restarting techniques cannot be directly applied here [DIM93, Dol00], as the nodes cannot distinguish whether they still have some activated connections with the remaining nodes, after a fault has occurred. This difficulty is the reason why it is not sufficient to just reset the state of a node in case of a fault. In addition, in contrast to previous self-stabilizing approaches [GK10, DT01] that are based on shared memory models, two adjacent nodes can only store $1$ bit of memory in the edge joining them, which denotes the existence or not of a connection between them.

Angluin et al. [AAFJ08] incorporated the notion of self-stabilization into the population protocol model, giving self-stabilizing protocols for some fundamental tasks such as token passing and leader election. They focused on the goal of stably maintaining some property such as having a unique leader or a legal coloring of the communication graph.

A previous work of Delporte-Gallet et al. [DGFGR06] studies the issue of correctly computing functions on the node inputs in the Population Protocol model [AAD*+*06], in the presence of crash faults and transient faults that can corrupt the states of the nodes. They construct a transformation which makes any protocol that works in the failure-free setting, tolerant in the presence of such failures, as long as modifying a small number of inputs does not change the output. Guerraoui and Ruppert [GR09] introduced an interesting model, called Community Protocol, which extends the the Population Protocol model with unique identifiers and enough memory to store a constant number of other agents’ identifiers. They show that this model can solve any decision problem in NSPACE($n\log{n}$) while tolerating a constant number of Byzantine failures.

In [Pel09], Peleg studies logical structures, constructed over static graphs, that need to satisfy the same property on the resulting structure after node or edge failures. He distinguishes between the stronger type of fault-tolerance obtained for geometric graphs (termed rigid fault-tolerance) and the more flexible type required for handling general graphs (termed competitive fault-tolerance). It differs from our work, as we address the problem of constructing such structures over dynamic graphs.

1.1 Our contribution

The goal of any Network Constructor (NET) protocol is to stabilize to a graph that belongs to (or satisfies) some graph language $L$, starting from an initial configuration where all nodes are in the same state and all connections are disabled. In [MS16], only the fault-free case was considered. In this work, we formally define the model that extends NETs allowing crash failures, and we examine protocols in the presence of such faults. Whenever a node crashes, it is removed from the population, along with all its activated edges. This leaves the remaining population in a state where some actions may need to be taken by the protocol in order to eventually stabilize to a correct network.

We first study the constructive power of the original NET model in the presence of crash faults. We show that the class of graph languages that is in principle constructible is non-empty but very small: for unbounded number of faults, we show that the only stably constructible language is the Spanning Clique. We also prove a strong impossibility result, which holds even if the size of graphs that the protocol outputs in populations of size $n$ need only grow with $n$ (the remaining nodes being waste). For bounded number of faults, we show that any non-hereditary graph language is impossible to be constructed. However, we show that by relaxing our requirements we can extend the class of constructible graph languages. In particular, permitting linear waste enables to construct on $n/(2f)-f$ nodes, where $f$ is a finite upper bound on the number of faults, any graph language that is constructible in a failure-free setting. Alternatively, by allowing our protocols to generate only a subset of all graphs in the language (partial constructibility), a large class of graph languages becomes constructible (see Section 3).

In light of the impossibilities in the Network Constructors model, we introduce the minimal additional assumption of fault notifications. In particular, after a fault on some node $u$ occurs, all the nodes that maintain an active edge with $u$ at that time (if any) are notified. If there are no such nodes, an arbitrary node in the population is notified. In that way, we guarantee that at least one node in the population will sense the removal of $u$. Nevertheless, we show some constructions that work without notifications in the case of a crash fault on an isolated node (Section 4).

We obtain two fault-tolerant universal constructors. One of the main technical tools that we use in them, is a fault-tolerant construction of a stable path topology (i.e., a line). We show that this topology is capable of simulating a Turing Machine (abbreviated “TM” throughout this paper), and, in the event of a fault, is capable of always reinitializing its state correctly (Section 4.2). Our protocols use a subset of the population (called waste) in order to construct there a TM, while the graph which belongs to the required language is constructed in the rest of the population (called useful space). The idea is based on [MS16], where they show several universality results by constructing on $k$ nodes of the population a network $G_{1}$ capable of simulating a TM, and then repeatedly drawing a random network $G_{2}$ on the remaining $n-k$ nodes. The idea is to execute on $G_{1}$ the TM which decides the language $L$ with input the network $G_{2}$. If the TM accepts, it outputs $G_{2}$, otherwise the TM constructs a new random graph.

This allows a fault-tolerant construction of any graph accepted by a TM in linear space, with waste $min\{n/2+f(n),n\}$, where $f(n)$ is the number of faults in the execution. We finally prove that increasing the permissible waste to $min\{2n/3+f(n),\;n\}$ allows the construction of graphs accepted by an $O(n^{2})$-space Turing Machine, which is asymptotically the maximum simulation space that we can hope for in this model.

In order to give fault-tolerant protocols without waste, we design a protocol that can be composed in parallel with any protocol in order to make it fault-tolerant. The idea is to restart the protocol whenever a crash failure occurs. We show that restarting is impossible with constant local memory, if the nodes may form a linear (in the population size) number of connections; hence, to overcome this we supply the agents with logarithmic memory (Section 4.3).

Finally, in Section 5 we conclude and discuss further interesting research directions opened by this work.

The following table summarizes all results proved in this paper.

[TABLE]

2 Model and Definitions

A Network Constructor (NET) is a distributed protocol defined by a 4-tuple $(Q,q_{0},Q_{out},\delta)$, where $Q$ is a finite set of node-states, $q_{0}\in Q$ is the initial node-state, $Q_{out}\subseteq Q$ is the set of output node-states, and $\delta:Q\times Q\times\{0,1\}\rightarrow Q\times Q\times\{0,1\}$ is the transition function.

In the generic case, there is an underlying interaction graph $G_{U}=(V_{U},E_{U})$ specifying the permissible interactions between the nodes, and on top of $G_{U}$, there is a dynamic overlay graph $G_{O}=(V_{O},E_{O})$. A mapping function $F$ maps every node in the overlay graph to a distinct underlay node. In this work, $G_{U}$ is a complete undirected interaction graph, i.e., $E_{U}=\{uv:u,v\in V_{U}$ and $u\neq v\}$, while the overlay graph consists of a population of $n$ initially isolated nodes (also called processes or agents).

The NET protocol is stored in each node of the overlay network, thus, each node $u\in G_{O}$ is defined by a state $q\in Q$. Additionally, each edge $e\in E_{O}$ is defined by a binary state (active/connected or inactive/disconnected). Initially, all nodes are in the same state $q_{0}$ and all edges are inactive. The goal is for the nodes, after interacting and activating/deactivating edges for a while, to end up with a desired stable overlay graph, which belongs to some graph language $L$.

During a (pairwise) interaction, the nodes are allowed to access the state of their joining edge and either activate it ($\text{state}=1$) or deactivate it ($\text{state}=0$). When the edge state between two nodes $u,v\in G_{O}$ is activated, we say that $u$ and $v$ are connected, or adjacent at that time $t$, and we write $u\underset{t}{\sim}v$.

In this work, we present a version of this model that allows adversarial crash failures. A crash (or halting) failure causes an agent to cease functioning and play no further role in the execution. This means that all the adjacent edges of $F(u)\in G_{U}$ are removed from $E_{U}$, and, at the same time, all the adjacent edges of $u\in G_{O}$ become inactive.

The execution of a protocol proceeds in discrete steps. In every step, an edge $e\in E_{U}$ between two nodes $F(u)$ and $F(v)$ is selected by an adversary scheduler, subject to some fairness guarantee. The corresponding nodes $u$ and $v$ interact with each other and update their states and the state of the edge $uv\in G_{O}$ between them, according to a joint transition function $\delta$. If two nodes in states $q_{u}$ and $q_{v}$ with the edge joining them in state $q_{uv}$ encounter each other, they can change into states $q_{u}^{\prime}$, $q_{v}^{\prime}$ and $q_{uv}^{\prime}$, where $(q_{u}^{\prime},q_{v}^{\prime},q_{uv}^{\prime})\in\delta(q_{u},q_{v},q_{uv})$. In the original model, $G_{U}$ is the complete directed graph, which means that during an interaction, the interacting nodes have distinct roles. In our protocols, we consider a more restricted version, that is, symmetric transition functions ($\delta(q_{u},q_{v},q_{uv})=\delta(q_{v},q_{u},q_{uv})$), as we try to keep the model as minimal as possible.

A configuration is a mapping $C:V_{I}\cup E_{I}\rightarrow Q\cup\{0,1\}$ specifying the state of each node and each edge of the interaction graph. An execution of the protocol on input $I$ is a finite or infinite sequence of configurations, $C_{0},C_{1},C_{2},\dots$, each of which is a set of states drawn from $Q\cup\{0,1\}$. In the initial configuration $C_{0}$, all nodes are in state $q_{0}$ and all edges are inactive. Let $q_{u}$ and $q_{v}$ be the states of the nodes $u$ and $v$, and $q_{uv}$ denote the state of the edge joining them. A configuration $C_{k}$ is obtained from $C_{k-1}$ by one of the following types of transitions:

Ordinary transition: $C_{k}=(C_{k-1}-\{q_{u},q_{v},q_{uv}\})\cup\{q_{u}^{\prime},q_{v}^{\prime},q_{uv}^{\prime}\}$ where $\{q_{u},q_{v},q_{uv}\}\subseteq C_{k-1}$ and $(q_{u}^{\prime},q_{v}^{\prime},q_{uv}^{\prime})\in\delta(q_{u},q_{v},q_{uv})$. 2. 2.

Crash failure: $C_{k}=C_{k-1}-\{q_{u}\}-\{q_{uv}:uv\in E_{I}\}$ where $\{q_{u},q_{uv}\}\subseteq C_{k-1}$.

We say that $C^{\prime}$ is reachable from $C$ and write $C\rightsquigarrow C^{\prime}$, if there is a sequence of configurations $C=C_{0},C_{1},\dots,C_{t}=C^{\prime}$, such that $C_{i}\rightarrow C_{i+1}$ for all $i$, $0\leqslant i<t$. The fairness condition that we impose on the scheduler is quite simple to state. Essentially, we do not allow the scheduler to avoid a possible step forever. More formally, if $C$ is a configuration that appears infinitely often in an execution, and $C\rightarrow C^{\prime}$, then $C^{\prime}$ must also appear infinitely often in the execution. Equivalently, we require that any configuration that is always reachable is eventually reached.

We define the output of a configuration $C$ as the graph $G(C)=(V,E)$ where $V=\{u\in V_{O}:C(u)\in Q_{out}\}$ and $E=\{uv:u,v\in V,\;u\neq v,\text{ and }C(uv)=1\}$. If there exists some step $t\geq 0$ such that $G_{Ο}(C_{i})=G$ for all $i\geq t$, we say that the output of an execution $C_{0},C_{1},\dots$ stabilizes (or converges) to graph $G$, every configuration $C_{i}$, for $i\geq t$, is called output-stable, and $t$ is called the running time under our scheduler. We say that a protocol $\Pi$ stabilizes eventually to a graph $G$ of type $L$ if and only if after a finite number of pairwise interactions, the graph defined by ’on’ edges does not change and belongs to the graph language $L$.

Definition 1**.**

We say that a protocol $\Pi$ constructs a graph language $L$ if: (i) every execution of $\Pi$ on $n$ nodes stabilizes to a graph $G\in L$ s.t. $|V(G)|=n$ and (ii) $\forall G\in L$ there is an execution of $\Pi$ on $|V(G)|$ nodes that stabilizes to $G$, where $|V(G)|$ is the degree of the graph $G$.

Definition 2**.**

We say that a protocol $\Pi$ partially constructs a graph language $L$, if: (i) from Definition 1 holds and (ii) $\exists G\in L$ s.t. no execution of $\Pi$ on $|V(G)|$ nodes stabilizes to $G$.

Definition 3** (Fault-tolerant protocol).**

Let $\Pi$ be a NET protocol that, in a failure-free setting, constructs a graph $G\in L$. $\Pi$ is called $f$-fault-tolerant if for any population size $n>f$, any execution of $\Pi$ constructs a graph $G\in L$, where $|V(G)|=n-f$. We also call $\Pi$ fault-tolerant if the same holds for any number $f\leq n-2$ of faults.

Definition 4** (Constructible language).**

A graph language $L$ is called constructible (partially constructible) if there is a protocol that constructs (partially constructs) it. Similarly, we call $L$ constructible under $f$ faults, if there is an $f$-fault-tolerant protocol that constructs $L$, where $f$ is an upper bound on the maximum number of faults during an execution.

Definition 5** (Critical node).**

Let $G$ be a graph that belongs to a graph language $L$. Call $u$ a critical node of $G$ if by removing $u$ and all its edges, the resulting graph $G^{\prime}=G-\{u\}-\{uv:v\sim u\}$, does not belong to $L$. In other words, if there are no critical nodes in $G$, then any (induced) subgraph $G^{\prime}$ of $G$ that can be obtained by removing nodes and all their edges, also belongs to $L$.

Definition 6** (Hereditary Language).**

*A graph language $L$ is called Hereditary if for any graph $G\in L$, every induced subgraph of $G$ also belongs to $L$. In other words, there is no graph $G\in L$ with critical nodes. *

This notion is known in the literature as hereditary property of a graph w.r.t. (with respect to) some graph language $L$. Observe that if there exists a graph $G$ s.t. for any induced subgraph $G^{\prime}$ of $G$, $G^{\prime}\in L$, does not imply that the same holds for any graph in $L$. For example, consider the graph language $L=\{G:G\text{ has an even number of edges}\}$ and a graph $G$ which consists of any number of connected pairs of nodes. Then, by removing any number of nodes, the number of the edges remains even. However, a different topology, such as a star with even number of edges does not have this property.

Some examples of Hereditary Languages are “Bipartite graph”, “Planar graph”, “Forest of trees”, “Clique”, “Set of cliques”, “Maximum node degree $\leq\Delta$” and so on.

In this work, unless otherwise stated, a graph language $L$ is an infinite set of graphs satisfying the following properties:

(No gaps): For all $n\geq$ c, where $c\geq 2$ is a finite integer, $\exists G\in L$ of order $n$. 2. 2.

(No Isolated Nodes): $\forall G\in L$ and $\forall u\in V(G)$, it holds that $d(u)\geq 1$ (where $d(u)$ is the degree of $u$).

Even though graph languages are not allowed to contain isolated nodes, there are cases in which a protocol might be allowed to output one or more isolated nodes. In particular, if a protocol $\Pi$ constructing $L$ is allowed a waste of at most $w$, then whenever $\Pi$ is executed on $n$ nodes, it must output a graph $G\in L$ of order $|V(G)|\geq n-w$, leaving at most $w$ nodes in one or more separate components (could be all isolated).

3 Network Constructors without Fault Notifications

In this section, we study the constructive power of the original NET model in the presence of crash faults. We start from the case in which the number of nodes that crash during an execution can be anything from [math] up to $n-2$ nodes. We are interested in characterizing the class of constructible graph languages. Observe that we cannot trivially conclude that the adversary can always leave us with just $2$ nodes, only allowing our protocols to form a line of length $1$. This is because our definition of constructible languages under faults takes into account all possible executions with $f$ faults, for all values of $f\in\{0,1,\dots,n-2\}$. We show that in the case where the number of faults cannot be bounded by a constant number, the only language that is constructible under any number of faults is the $L_{c}=\{G:G\text{ is a spanning clique}\}$.

We then consider the setting where only a constant number of faults can occur during an execution, and we show that there is no protocol that constructs any graph language $L$, tolerating even a single fault if $L$ is not Hereditary. However, if we allow linear waste in the population, any language that is constructible without faults, is now constructible.

Finally, we show a family of graph languages that is partially constructible (without waste in the population). The exact characterization of the class of partially constructible languages remains as an open problem.

3.1 Unbounded Number of Faults

In this section we consider the setting where the number of faults can be any number up to $n-2$, where $n$ is the number of nodes. We first present a protocol which constructs the language $\textit{Spanning Clique}=\{G:G\text{ is a spanning clique}\}$, and we prove that this protocol can tolerate any number of faults.

Let Clique be the following $2-$state symmetric protocol. If we consider the case where no crash faults are allowed, for any population size, Clique Protocol stabilizes to a clique with all the nodes in state r.

Lemma 1**.**

Clique* (Protocol 1) is a fault-tolerant protocol for Spanning Clique.*

Proof.

Let $f<n$ and assume that $f$ nodes crash during the execution. Call $S$ the remaining $n-f$ nodes.

(a) If all nodes in $S$ are in state $b$, then the remaining nodes shall form a clique (in state $r$).

(b) If all nodes in $S$ are in state $r$, then again, Clique Protocol stabilizes to a clique.

(c) If $S$ contains both colors, then the $r-$nodes will convert the $b-$nodes to $r$ and again Clique Protocol stabilizes to a clique. ∎

By Lemma 1, we know that the language Spanning Clique is constructible under $n-2$ faults. To clarify, this means that for any execution of Protocol 1 on $n$ nodes, $f$ of which crash ($f\in\{0,1,\dots,n-2\}$), Protocol 1 is guaranteed to stabilize to a clique of order $n-f$.

We will now prove that (due to the power of the adversary), no other graph language is constructible under unbounded faults.

Lemma 2**.**

Let $\Pi$ be a protocol constructing a language $L$ and $G\in L$ a graph that $\Pi$ outputs on $|V(G)|$ nodes. If $G$ has an independent set $S\subseteq V$, s.t. $|S|\geq 2$, then there is an execution of $\Pi$ on $n$ nodes which stabilizes on $|S|$ isolated nodes (where $|S|=n-f$ and $f$ is the number of faults in that execution).

Proof.

Consider an execution of $\Pi$ that outputs $G$. By definition, there is a point in this execution after which no further edge updates can occur (no matter what the infinite execution suffix will be). Take any configuration $C_{stable}$ after that point and consider its sub-configuration $C_{S}$ induced by the independent set $S$. Observe that $C_{S}$ encodes the state of each node $u\in S$ in that particular stable configuration $C_{stable}$. Denote also by $Q_{S}$ the multiset of all states assigned by $C_{S}$ to the nodes in $S$.

Every state in $Q_{S}$ is reachable (in the sense that there exists an execution that produces it). For each $q\in Q_{S}$ consider the smallest population $V_{q}$ in which there is some execution $a_{q}$ of protocol $\Pi$ that produces state $q$. Consider the population $V=\bigcup_{q\in Q_{S}}V_{q}$ (or equivalently of size $n=\sum_{q\in Q_{S}}{|V_{q}|}$).

For each $V_{q}$ in population $V$ we execute $a_{q}$ until $q$ is produced on some node $u_{q}$. After this, every $q\in Q_{S}$ is present in the population $V$. Then, the adversary crashes all nodes in $V_{q}\setminus\{u_{q}\}$ (i.e., only $u_{q}$ remains alive in each $V_{q}$). This leaves the execution with a set of alive nodes equivalent in cardinality and configurations to the independent set $S$ under $C_{S}$.

The above construction is a finite prefix of fair executions. For the sake of contradiction, assume that in any fair continuation of the above prefix, $\Pi$ eventually stabilizes to a graph with no isolated nodes (as required by the fact that $\Pi$ constructs a graph language $L$). Take one such continuation $\gamma$. As $\gamma$ starts from a configuration in all respects equivalent to that of $S$ under $C_{stable}$, it follows that $\gamma$ can also be applied to $C_{stable}$ and in particular on the independent set $S$ starting from $C_{S}$. It follows that $\gamma$ must have exactly the same effect as before, that is, eventually it will cause the activation of at least one edge between the nodes in $S$. But this violates the fact that $C_{stable}$ is a stable configuration, therefore no edge could have been activated by $\Pi$ in the continuation, implying that the continuation must have been an execution stabilizing on $|S|$ isolated nodes. ∎

Theorem 1**.**

Let $L$ be any graph language such that $L\neq\text{Spanning Clique}$. Then, there is no protocol that constructs $L$ if an unbounded number of crash failures may occur.

Proof.

As $L\neq\textit{Spanning Clique}$, there exists $G\in L$ such that $G$ is not complete (and by definition no $G^{\prime}\in L$ has isolated nodes). Therefore $G$ has an independent set $S$ of size at least $2$. If there exists a protocol $\Pi$ that constructs $L$, then by Lemma 2 there must be an execution of $\Pi$ which stabilizes on at least $2$ isolated nodes. The latter is a stable output not in $L$, therefore a contradiction. ∎

Theorem 2**.**

If an unbounded number of faults may occur, the Spanning Clique is the only constructible language.

Proof.

Directly from Lemma 1 and Theorem 1. ∎

Theorem 3**.**

Let $L$ be any graph language such that the graphs $G\in L$ have maximum independent sets whose size grows with $|V(G)|$. If the useful space of protocols is required to grow with $n$, then there is no protocol that constructs $L$ in the unbounded-faults case.

Proof.

The proof is a direct application of Lemma 2. As the size of the maximum independent set of $G$ grows with $|V(G)|$ in $L$, and the useful space is a non-constant function of $n$, it follows that, as $n$ grows, the stable output-graph (on the useful space) has an independent set of size that grows with $n$ (consider, for example, the leaves of binary trees of growing size as such a growing independent set). As any such stable independent set of size $g(n)$ implies that another execution has to stabilize to $g(n)$ isolated nodes, it follows that any protocol for $L$ would produce infinitely many stable outputs of isolated nodes. The latter is contradicting the fact that the protocol constructs $L$. ∎

3.2 Bounded Number of Faults

The exact characterization established above, shows that when an unbounded number of crash faults may occur, we cannot hope for non-trivial constructions. We now relax the power of the faults adversary, so that there is a finite upper bound $f$ on the number of faults. In particular, fixing any such $f\geq 0$ in advance, it is guaranteed that $\forall n\geq 0$ and all executions of a protocol on $n$ nodes, at most $f$ nodes may fail during the execution. Then the class of constructible graph languages is naturally parameterized in $f$. We first show that non-hereditary languages are not constructible under $1$ fault.

Theorem 4**.**

If there exists a critical node in $G$, there is no 1-fault-tolerant NET protocol that stabilizes to it.

Proof.

Let $\Pi$ be a NET protocol that constructs a graph language $L$, tolerating one crash failure. Consider an execution $E$ and a sequence of configurations $C_{0},C_{1},\;\dots$ of $E$. Assume a time $t$ that the output of $E$ has stabilized to a graph $G\in L$ (i.e., $G(C_{i})=G$, $\forall i\geq t$). Let $u$ be a critical node in $G$. Assume that the scheduler removes $u$ and all its edges (crash failure) at time $t^{\prime}>t$, resulting to a graph $G^{\prime}\notin L$. In order to fix the graph (i.e., re-stabilize to a graph $G^{\prime\prime}\in L$), the protocol must change at some point $t^{\prime\prime}$ the configuration. This can only be the result of a state update on some node $v$. Now, call $E^{\prime}$ the execution that node $u$ does not crash and, besides that, is the same as $E$. Then, between $t^{\prime}$ and $t^{\prime\prime}$ the node $v$ has the same interactions as in the previous case where node $u$ crashed. This results to the same state update in $v$, since it cannot distinguish $E$ from $E^{\prime}$. The fact that $u$ either crashes or not, leads to the same result (i.e., $v$ tries to fix the graph thinking that $u$ has crashed). This means that if we are constantly trying to detect faults in order to deal with them, this would happen indefinitely and the protocol would never be stabilizing. Consider that the network has stabilized to $G$. At some point, because of the infinite execution, a node will surely but wrongly detect a crash failure. Thus, $G$ has not really stabilized. ∎

By Definition 6 and Theorem 4 it follows that.

Corollary 1**.**

If a graph language $L$ is non-hereditary, it is impossible to be constructed under a single fault.

Note that this does not imply that any Hereditary language is constructible under constant number of faults. We leave this as an interesting open problem.

On the positive side we show that in the case of bounded number of faults, there is a non-trivial class of languages that is partially constructible. Consider the class of graph languages defined as follows. Any such language $L_{D,f}$ in the family is uniquely specified by a graph $D=([k],H)$ and the finite upper bound $f<k$ on the number of faults. A graph $G=(V,E)$ belongs to $L_{D,f}$ iff there are $k$ partitions $V_{1},V_{2},\dots,V_{k}$ of $V$ s.t. for all $1\leq i,j\leq k$, $||V_{i}|-|V_{j}||\leq f+1$. In addition, $E$ is constructed as follows. The graph $D=([k],H)$, possibly containing self-loops, defines a neighboring relation between the $k$ partitions. For every $(i,j)\in H$ (where possibly $i=j$), $E$ contains all edges between partitions $V_{i}$ and $V_{j}$, i.e., a complete bipartite graph between them (or a clique in case $i=j$). As no isolated nodes are allowed, every $V_{i}$ must be fully connected to at least one $V_{j}$ (possibly itself).

We first consider the case where $k=2^{\delta}$, for some constant $\delta\geq 0$, and we provide a protocol that divides the population into $k$ partitions. The protocol works as follows: initially, all nodes are in state $c_{0}$ (we call this the partition [math]). When two nodes in states $c_{i}$, where $i\geq 0$ interact with each other, they update their states to $c_{2i+1}$ and $c_{2i+2}$, moving to partitions $2i+1$ and $2i+2$ respectively. When $j=2i+1\geq k-1$ (or $j=2i+2\geq k-1)$ for the first time, it means that the node has reached its final partition. It updates its state to $P_{m}$, where $m=j-k+1$, thus, the final partitions are $\{P_{0},P_{1},\dots,P_{k-1}\}$.

This process divides each partition into two partitions of equal size. However, in the case where the number of nodes is odd, a single node remains unmatched. For this reason, all nodes participate to the final formation of $H$ regardless of whether they have reached their final partitions or not. There is a straightforward mapping of each internal partition to a distinct leaf of the binary tree, that is, each partition $c_{i}$ behaves as if it were in partition $P_{i}$. In order to avoid false connections between the partitions, we also allow the nodes to disconnect from each other if they move to a different partition. This process guarantees that eventually all nodes end up in a single partition, and their connections are strictly described by $H$.

Lemma 3**.**

In the absence of faults, Protocol 2, divides the population into $k$ partitions of at least $n/k-1$ nodes each.

Proof.

Initially all nodes are in state $c_{0}$. When two $c_{0}$ nodes interact with each other, one of them becomes $c_{1}$ and the other one $c_{2}$. This means that all $n$ nodes split into two partitions of equal size. No node can become $c_{0}$ again at any time during the execution. In addition, there is only one partition $c_{j}$ that produces nodes of some other partition $c_{i}$, where $i$ is either $2j+1$ or $2j+2$, and the size of them are half the size of $c_{j}$. This process can be viewed as traversing a labelled binary tree, until all nodes reach to their final partition. A node in state $c_{i}$ has reached its final partition when $i\geq k-1$. This process describes a subdivision of the nodes, where each partition splits into two partitions of equal size. The final partitions are $\{c_{k-1},c_{k},\dots,c_{2k-2}\}$.

Assume now that the initial population size is $n_{0}$ (level [math] of the binary tree). If $n_{0}$ is even, the size of the following two partitions $c_{1}$ and $c_{2}$ will be $n_{0}/2$. If $n_{0}$ is odd, one node remains unmatched, thus, the size of $c_{1}$ and $c_{2}$ will be $n_{1}=\frac{n_{0}-1}{2}$. In the next level of the binary tree, at most one node will remain unmatched in each partition, thus $n_{2}=\frac{n_{1}-1}{2}$. Consequently, the size of a partition in level $p$ can be calculated recursively, and (in the worst case) it is $n_{p}=\frac{n_{p-1}-1}{2}$.

[TABLE]

For $p=\log{k}$ levels, each partition has either $\frac{n_{0}}{k}$ or $\frac{n_{0}}{k}-1$ nodes. ∎

Lemma 4**.**

Protocol 2, terminates after $\Theta(kn^{2})$ expected time.

Proof.

Protocol 2 operates in phases, where each phase doubles the number of partitions. After $\log{k}$ phases, there exist $k$ groups in the population and the nodes terminate.

We now study the time that each group $c_{i}$ needs in order to split into two partitions. Here, for simplicity, $i$ indicates the level of a partition $c$ in the binary tree and $m_{i}$ the number of nodes of partition $c_{i}$.

Let $X$ be a random variable defined to be the number of steps until all $m_{i}$ nodes move to their next partitions. Call a step a success if two nodes in $c_{i}$ interact, thus, moving to their next partitions. We divide the steps of the protocol into epochs, where epoch $j$ begins with the step following the $j$th success and ends with the step at which the $(j+1)$st success occurs. Let also the r.v. $X_{j}$, $1\leq j\leq m_{i}$ be the number of steps in the $j$th epoch.

The probability of success during the $j$th epoch, for $0\leq j\leq m_{i}$, is $p_{j}=\frac{(m_{i}-j)(m_{i}-j-1)}{n(n-1)}$ and $E[X_{j}]=1/p_{j}$. By linearity of expectation we have

[TABLE]

The above uses the fact that $m_{i}\leq n$ for any $i\geq 0$.

For the lower bound, observe that the last two remaining nodes in $c_{i}$ need on average $n(n-1)/2$ steps to meet each other. Thus, we conclude that $E[X]=\Theta(n^{2})$.

In total, $\sum_{0}^{\log{(k)}-1}2^{i}=2^{\log{k}}-1=k-1$ partitions split, thus, the total expected time to termination is $\Theta(kn^{2})$ steps. ∎

Lemma 5**.**

In the case where up to $f$ faults occur during the execution of Protocol 2, each final partition has at least $n/k-f$ nodes, where $k$ is the number of partitions and $f<k$.

Proof.

Consider the case where $f$ faults occur in the first partition $c_{0}$. Then, we can assume that we run a failure-free execution on a population of size $n_{0}=n-f$. By Lemma 3, each partition will end up having either $\frac{n-f}{k}>\frac{n}{k}-2$ or $\frac{n-f}{k}-1>\frac{n}{k}-3$ nodes.

Now, consider the case where $f$ crash faults occur in some partition $c_{j}$. The nodes of each partition $c_{j}$ operate independently from the rest of the population, that is, they never update their states and/or connections when they interact with nodes from a different partition. Thus, as in the previous case, if no more faults occur, we can assume that we have a failure-free execution on $|c_{j}|-f$ nodes. Again, by Lemma 3, after $p$ subdivisions, each final partition that was obtained by $c_{j}$ will either have $\frac{|c_{j}|-f}{p}$ or $\frac{|c_{j}|-f}{p}-1$ nodes. Consequently, any number of faults in a partition $c_{i}$ are equally split into the partitions following $c_{i}$.

It is then obvious that in the worst case, a final partition might have $\frac{n}{k}-f-1$ nodes, and this is the result of $f$ faults in a final partition. ∎

By Lemma 5:

Corollary 2**.**

$||V_{i}|-|V_{j}||\leq f+1$, $\forall 1\leq i,j\leq k$.

By Lemma 5 and the definition of partial constructibility (Definition 4):

Theorem 5**.**

The language $L_{D,f}$, where $k$ is a constant number, is partially constructible under $f$ faults.

We now show that if we permit a waste linear in $n$, any graph language that is constructible in the fault-free NET model, becomes constructible under a bounded number of faults.

Theorem 6**.**

Take any NET protocol $\Pi$ of the original fault-free model. There is a NET $\Pi^{\prime}$ such that when at most $f$ faults may occur on any population of size $n$, $\Pi^{\prime}$ successfully simulates an execution of $\Pi$ on at least $\frac{n}{2f}-f$ nodes.

Proof.

Consider any constructible language $L$ and a protocol $\Pi$ that constructs it. For any bounded number of faults $f$, set $k=2^{\delta}$, where $2^{\delta-1}<f$. Consider a protocol $\Pi^{\prime}$, which consists of the rules $1$ and $2$ of Protocol 2. These rules partition the population into $k$ groups, where $k$ is an input parameter of $\Pi^{\prime}$. By Lemma 5, each group has at least $n/k-f$ nodes. For $2f$ partitions in the worst case, the number of nodes in each partition is at least $\frac{n}{2f}-f$. Then assume that when a node reaches its final partition, it starts executing protocol $\Pi$, updating its state and connections only when interacting with nodes of the same partition. As the number of partitions is strictly more that the upper bound on the number of faults $f$, there exists at least one partition that no fault has occurred. ∎

4 Notified Network Constructors

In this section, in light of the impossibility result of Section 3, we allow fault notifications when nodes crash. In particular, we introduce a fault flag in each node, which is initially zero. When a node $u$ crashes at time $t$, every node $v$ which was adjacent to $u$ at time $t$ is notified, that is, the fault flag of all $v$ becomes $1$. In the case where $u$ is an isolated node (i.e., it has no active edges), an arbitrary node $w$ in the graph is notified, and its fault flag becomes $2$. Then, the fault flag becomes immediately zero after applying a corresponding rule from the transition function.

More formally, the set of node-states is $Q\times\{0,1,2\}$, and for clarity in our descriptions and protocols, we define two types of transition functions. The first one determines the node and connection state updates of pairwise interactions ($\delta_{1}:Q\times Q\times\{0,1\}\rightarrow Q\times Q\times\{0,1\}$), while the second transition function determines the node state updates due to fault notifications ($\delta_{2}:Q\times\{0,1,2\}\rightarrow Q\times\{0,1,2\}$). This means that during a step $t$ that a node $u$ crashes, all its adjacent nodes are allowed to update their states based on $\delta_{2}$ at that same step. If there are no any adjacent nodes to $u$, an arbitrary node is notified, thus updating its state based on $\delta_{2}$ at step $t$.

We have assumed that the faults can only occur sequentially (at most one fault per step). This assumption was equivalent to the case where many faults can occur in each step in the original NET model. However, when fault notifications are allowed, this does not hold, unless the fault flag could be used as a counter of faults in each step. We want to keep the model as minimal as possible, thus, we only allow the adversary to choose one node at most in each step to crash.

As long as only one fault at most can occur in each step, the separation of these transition functions is equivalent to the case where only one transition function exists $\delta:(Q\times\{0,1,2\})\times(Q\times\{0,1,2\})\times\{0,1\}\rightarrow(Q\times\{0,1,2\})\times(Q\times\{0,1,2\})\times\{0,1\}$. Consider the case where a node $u$ crashes, notifying a node $w$ in the population (its fault flag becomes either $1$ or $2$). Then, in the first case (separate transition functions), $w$ is instantly allowed to update its state, while in the second case (unified transition functions), $w$ waits until its next interaction with a node $v$, applying the rule of $\delta_{2}$ independently of the state and connection of $v$. During the same interaction, $w$ and $v$ can also update their states and connections based on the corresponding rule of $\delta_{1}$.

In this section, we investigate whether the additional information in each agent (the fault flag) is sufficient in order to design fault-tolerant or $k-$fault-tolerant protocols, overcoming the impossibility of certain graph languages in the NET model.

Such a minimal fault notification mechanism can be exploited to construct a larger class of graph languages that in the original Network Constructors model where no form of notifications was available.

4.1 Fault-Tolerant Protocols

In this section, our goal is to design protocols that after a fault, the nodes try to fix the configuration and eventually stabilize to a correct network. We give protocols for some basic network construction problems, such as spanning star, cycle cover, and in Section 4.2 we give a fault-tolerant spanning line protocol which is part of our generic constructor capable of constructing a large class of networks.

Proposition 1**.**

FT Spanning Star is fault-tolerant.

Proof.

Assume that any number of faults $k<n$ occur during an execution. Initially, all nodes are in state $b$ (black). Two nodes connect with each other, if either one of them is black, or both of them are black, in which case one of them becomes $r$ (red). A black node can become red only by interaction with another black node, in which case they also become connected. Thus, with no crash faults, a connected component always includes at least one black node. In addition, all isolated nodes are always in state $b$. This is because, if a red node removes an edge it becomes black.

Then, if a (connected) node crashes, the adjacent nodes are notified and the red nodes become black, thus, any connected component should again include at least one black node. Now, consider the case where only one black node remains in the population. Then the rest of the population (in state $r$) should be in the same connected component as the unique $b$ node. Then, if $b$ crashes, at least one black node will appear, thus, this protocol maintains the invariant, as there is always at least one black node in the population. FT Spanning Star then stabilizes to a star with a unique black node in the center. ∎

Similarly, we can show the following.

Proposition 2**.**

FT Cycle-Cover is fault-tolerant.

4.2 Universal Fault-Tolerant Constructors

In this section, we ask whether there is a generic fault-tolerant constructor capable of constructing a large class of graphs. We first give a fault-tolerant protocol that constructs a spanning line, and then we show that we can simulate a given TM on that line, tolerating any number of crash faults. Finally, we exploit that in order to construct any graph language that can be decided by an $O(n^{2})-$space TM, paying at most linear waste.

Lemma 6**.**

FT Spanning Line (Protocol 5) is fault-tolerant.

Proof.

Initially, all nodes are in state $q_{0}$ and they start connecting with each other in order to form lines that eventually merge into one.

When two $q_{0}$ nodes become connected, one of them becomes a leader (state $l_{0}$) and starts connecting with $q_{0}$ nodes (expands). A leader state $l_{0}$ is always an endpoint. The other endpoint is in state $e_{i}$ (initially $e_{1}$), while the inner nodes are in state $q_{2}$. Our goal is to have only one leader $l_{0}$ on one endpoint, because $l_{0}$ are also used in order to merge lines. Otherwise, if there are two $l_{0}$ endpoints, the line could form a cycle.

When two $l_{0}$ leaders meet, they connect (line merge) and a $w$ node appears. This state performs a random walk on the line and its purpose is to meet both endpoints (at least once) before becoming an $l_{0}$ leader. After interacting with the first endpoint, it becomes $w_{1}$ and changes the endpoint to $e_{1}$. Whenever it interacts with the same endpoint they just swap their states from $e_{1}$, $w_{1}$ to $e_{2}$, $w_{2}$ and vice versa. In this way, we guarantee that $w_{i}$ will eventually meet the other endpoint in state $e_{j},\;j\neq i$, or $l_{0}$. In the first case, the $w_{i}$ node becomes a leader ($l_{0}$), after having walked the whole line at least once.

Now, consider the case where a fault may happen on some node on the line. If the fault flag of an endpoint state becomes $1$, it updates its state to $q_{0}$. Otherwise, the line splits into two disjoint lines and the new endpoints become $l_{1}$. An $l_{1}$ becomes a walking state $w_{1}$, changes the endpoint into $e_{1}$ and performs the same process (random walk).

If there are more than one walking states on a line, then all of them are $w$, or $w_{i}$ and they perform a random walk. None of them can ever satisfy the criterion to become $l_{0}$ before first eliminating all the other walking states and/or the unique leader $l_{0}$ (when two walking states meet, only one survives and becomes $w$), simply because they form natural obstacles between itself and the other endpoint. If a new fault occurs, then this can only introduce another $w_{i}$ state which cannot interfere with what existing $w_{i}$’s are doing on the rest of the line (can meet them eventually but cannot lead them into an incorrect decision).

If an $l_{0}$ leader is merging while there are $w_{i}$’s and/or $w$’s on its line (without being aware of that), the merging results in a new $w$ state, which is safe because a $w$ cannot make any further progress without first succeeding to beat everybody on the line. A $w$ can become $l_{0}$ only after walking the whole line at least once (i.e., interact with both endpoints) and to do that it must have managed to eliminate all other walking states of the line on its way.

We have shown that despite the presence of faults, any expansion or merging eventually succeeds, meaning that the population eventually forms a line with a single leader in one endpoint. ∎

Lemma 7**.**

There is a NET $\Pi$ (with notifications) such that when $\Pi$ is executed on $n$ nodes and at most $k$ faults can occur, $0\leq k<n$, $\Pi$ will eventually simulate a given TM $M$ of space $O(n-k)$ in a fault-tolerant way.

Proof.

The state of $\Pi$ has two components $(P,S)$, where $P$ is executing a spanning line formation procedure, while $S$ handles the simulation of the TM $M$. Our goal is to eventually construct a spanning line, where initially the state of the second component of each node is in an initial state $s_{0}$ except from one node which is in state head and indicates the head of the TM.

In general, the states $P$ and $S$ are updated in parallel and independently from each other, apart from some cases where we may need to reset either $P$, $S$ or both.

In order to form a spanning line under crash failures, the $P$ component will be executing our FT Spanning Line protocol which is guaranteed to construct a line, spanning eventually the non-faulty nodes.

It is sufficient to show that the protocol can successfully reinitialize the state of all nodes on the line after a final event has happened and the line is stable and spanning. Such an event can be a line merging, a line expansion, a fault on an endpoint or an intermediate fault. The latter though can only be a final event if one of the two resulting lines is completely eliminated due to faults before merging again. In order to re-initialize the TM when the line expands to an isolated node $q_{0}$, we alter a rule of the FT Spanning Line protocol. Whenever, a leader $l_{0}$ expands to an isolated node $q_{0}$, the leader becomes $q_{2}$ while the node in $q_{0}$ becomes $l_{1}$, thus introducing a new walking state.

We now exploit the fact that in all these cases, FT Spanning Line will generate a $w$ or a $w_{i}$ state in each affected component.

Whenever a $w_{1}$ or $w_{2}$ state has just appeared or interacted with an endpoint $e_{1}$ or $e_{2}$ respectively, it starts resetting the simulation component $S$ of every node that it encounters. If it ever manages to become a leader $l_{0}$, then it finally restarts the simulation on the $S$ component by reintroducing to it the tape head.

When the last event occurs, the final spanning line has a $w$ or $w_{i}$ leader in it, and we can guarantee a successful restart due to the following invariant. Whenever a line has at least one $w/w_{i}$ state and no further events can happen, FT Spanning Line guarantees that there is one $w$ or $w_{i}$ that will dominate every other $w/w_{i}$ state on the line and become an $l_{0}$, while having traversed the line from endpoint to endpoint at least once.

In its final departure from one endpoint to the other, it will dominate all $w$ and $w_{i}$ states that it will encounter (if any) and reach the other endpoint. Therefore, no other $w/w_{i}$ states can affect the simulation components that it has reset on its way, and upon reaching the other endpoint it will successfully introduce a new head of the TM while all simulation components are in an initial state $s_{0}$. ∎

Lemma 8**.**

There is a fault-tolerant NET protocol $\Pi$ (with notifications) which partitions the nodes into two groups $U$ and $D$ with waste at most $2f(n)$, where $f(n)$ is an upper bound on the number of faults that can occur. $U$ is a spanning line with a unique leader in one endpoint and can eventually simulate a TM $M$. In addition, each node of $D$ is connected with exactly one node of $U$, and vice versa.

Proof.

Initially all nodes are in state $q_{0}$. Protocol $\Pi$ partitions the nodes into two equal sets $U$ and $D$ and every node maintains its type forever. This is done by a perfect matching between $q_{0}$’s where one becomes $q_{u}$ and the other becomes $q_{d}$. Then, the nodes of $U$ execute the FT Spanning Line protocol, which guarantees the construction of a spanning line, capable of simulating a TM (Lemma 7). The rest of the nodes ($D$), which are connected to exactly one node of $U$ each, are used to construct on them random graphs. Whenever a line merges with another line or expands towards an isolated node, the simulation component $S$ in the states of the line nodes, as described in Lemma 7, is reinitialised sequentially.

Assume that a fault occurs on some node of the perfect matching before that pair has been attached to a line. In this case, it’s pair will become isolated therefore it is sufficient to switch that back to $q_{0}$.

If a fault occurs on a $D$ node $u$ after its pair $w$ has been attached to a line, $w$ goes into a detaching state which disconnects it from its line neighbors, turning them into $l_{1}$ and itself becoming a $q_{0}$ upon release. An $l_{1}$ state on one endpoint is guaranteed to walk the whole line at least once (as $w_{i}$) in order to ensure that a unique leader $l_{0}$ will be created. If $u$ fails before completing this process, it’s neighbors on the line shall be notified becoming again $l_{1}$, and if one of its neighbors fails we shall treat this as part of the next type of faults. This procedure shall disconnect the line but may leave the component connected through active connections within $D$. But this is fine as long as the FT-Spanning Line guarantees a correct restart of the simulation after any event on a line. This is because eventually the line in $U$ will be spanning and the last event will cause a final restart of the simulation on that line.

Assume that a fault occurs on a node $u\in U$ that is part of the line. In this case the neighbors of $u$ on the line shall instantly become $l_{1}$. Now, its $D$ pair $v$, which may have an unbounded number of $D$ neighbors at that point, becomes a special deactivating state that eventually deactivates all connections and never participates again in the protocol, thus, its stays forever as waste. This is because the fault partially destroys the data of the simulation, thus, we cannot safely assume that we can retrieve the degree of $v$ and successfully deactivate all edges. As there can be at most $f(n)$ such faults we have an additional waste of $f(n)$. Now, consider the case where $u$ is one neighbor of a node $w$ which is trying to release itself after its $v$ neighbor in $D$ failed. Then, $w$ implements a $2$-counter in order to remember how many of its alive neighbours have been deactivated by itself or due to faults in order to know when it should become $q_{0}$. ∎

Theorem 7**.**

For any graph language $L$ that can be decided by a linear space TM, there is a fault-tolerant NET $\Pi$ (with notifications) that constructs a graph in $L$ with waste at most $min\{n/2+f(n),\;n\}$, where $f(n)$ is an upper bound on the number of faults that can occur.

Proof.

By Lemma 8, there is a protocol that constructs two groups $U$ and $D$ of equal size, where each node of $U$ is matched with exactly one node of $D$, and vice versa. In addition, the nodes of $U$ form a spanning line, and by Lemma 7 it can simulate a TM $M$. After the last fault occurs, $M$ is correctly initialized and the head of the TM is on one of the endpoints of the line. The two endpoints are in different states, and assume, that the endpoint that the head ends up is in state $e_{l}$ (left endpoint), and the other is in state $e_{r}$ (right endpoint).

We now provide the protocol that performs the simulation of the TM $M$, which we separate into several subroutines. The first subroutine is responsible for simulating the direction on the tape and is executed once the head reaches the endpoint $e_{l}$. The simulation component $S$ (as in Lemma 7) of each node has three sub-components $(h,c,d)$. $h$ is used to store the head of the TM, i.e., the actual state of the control of the TM, $c$ is used to store the symbol written on each cell of the TM, and $d$ is either $l$, $r$ or $\sqcup$, indicating whether that node is on the left or on the right of the head (or unknown). Assume that after the initialization of the TM, $d=\sqcup$ for all nodes of the line. Finally, whenever the head of the TM needs to move from a node $u$ to a node $w$, $h_{w}\leftarrow h_{u}$, and $h_{u}\leftarrow\sqcup$.

Direction. Once the head of the TM is introduced in the endpoint $e_{l}$ by the lines’ leader, it moves on the line, leaving $l$ marks on the $d$ component of each node. It moves on the nodes which are not marked, until it eventually reaches the $e_{r}$ endpoint. At that point, it starts moving on the marked nodes, leaving $r$ marks on its way back. Eventually, it reaches again the $e_{l}$ endpoint. At that time, for each node on its right it holds that $d=r$. Now, every time it wants to move to the right it moves onto the neighbor that is marked by $r$ while leaving an $l$ mark on its previous position, and vice versa. Once the head completes this procedure, it is ready to begin working as a TM.

Constructing a random graph in $D$. This subroutine of the protocol constructs a random graph in the nodes of $D$. Here, the nodes are allowed to toss a fair coin during an interaction. This means that we allow transitions that with probability $1/2$ give one outcome and with $1/2$ another. To achieve the construction of a random graph, the TM implements a binary counter $C$ ($\log{n}$ bits) in its memory and uses it in order to uniquely identify the nodes of set $D$ according to their distance from $e_{l}$. Whenever it wants to modify the state of edge $(i,j)$ of the network in $D$, the head assigns special marks to the nodes in $D$ at distances $i$ and $j$ from the left of the endpoint $e_{l}$. Note that the TM uses its (distributed) binary counter in order to count these distances. If the TM wants to access the $i-$th node in $D$, it sets the counter $C$ to $i$, places a mark on the left endpoint $e_{l}$ and repeatedly moves the mark one position to the right, decreasing the counter by one in each step, until $C=0$. Then, the mark has been moved exactly $i$ positions to the right. In order to construct a random graph in $D$, it first assigns a mark $r_{1}$ to the first node $e_{l}$, which indicates that this node should perform random coin tosses in its next interactions with the other marked nodes, in order to decide whether to form connections with them, or not. Then, the leader moves to the next node on its line and waits to interact with the connected node in $D$. It assigns a mark $r_{2}$, and waits until this mark is deleted. The two nodes that have been marked ($r_{1}$ and $r_{2}$), will eventually interact with each other, and they will perform the (random) experiment. Finally the second node deletes its mark ($r_{2}$). The head then, moves to the next node and it performs the same procedure, until it reaches the other endpoint $e_{r}$. Finally, it moves back to the first node (marked as $r_{1}$), deletes the mark and moves one step right. This procedure is repeated until the node that should be marked as $r_{1}$ is the right endpoint $e_{r}$. It does not mark it and it moves back to $e_{l}$. The result is an equiprobable construction of a random graph. In particular, all possible graphs over $|D|$ nodes have the same probability to occur. Now, the input to the TM $M$ is the random graph that has been drawn on $D$, which provides an encoding equivalent to an adjacency matrix. Once this procedure is completed, the protocol starts the simulation of the TM $M$. There are $m=(\frac{k}{2})^{2}$ edges, where $k=|D|$ and $M$ has available $\frac{k}{2}=\sqrt{m}$ space, which is sufficient for the simulation on a $\sqrt{m}-$space TM.

Read edges of $D$. We now present a mechanism, which can be used by the TM in order to read the state of an edge joining two nodes in $D$. Note that a node in $D$ can be uniquely identified by its distance from the endpoint $e_{l}$. Whenever the TM needs to read the edge joining the nodes $i$ and $j$, it sets the counter $C$ to $i$. Assume w.l.o.g. that $i<j$. It performs the same procedure as described in the subroutine which draws the random graph in $D$. It moves a special mark to the right, decreasing $C$ by one in each step, until it becomes zero. Then, it assigns a mark $r_{3}$ on the $i-$th node of $D$, and then performs the same for $C=j$, where it also assigns a mark $r_{4}$ (to the $j-$th node). When the two marked nodes ($r_{3}$ and $r_{4}$) interact with each other, the node which is marked as $r_{4}$ copies the state of the edge joining them to a flag $f$ (either [math] or $1$), and they both delete their marks. The head waits until it interacts again with the second node, and if the mark has been deleted, it reads the value of the flag $f$.

After a simulation, the TM either accepts or rejects. In the first case, the constructed graph belongs to $L$ and the Turing Machine halts. Otherwise, the random graph does not belong to $L$, thus the protocol repeats the random experiment. It constructs again a random graph, and starts over the simulation on the new input.

A final point that we should make clear is that if during the simulation of the TM an event occurs (crash fault, line expansion, or line merging), by Lemma 7 and Lemma 8, the protocol reconstructs a valid partition between $U$ and $D$, the TM is re-initialized correctly, and a unique head is introduced in one endpoint. At that time, edges in $D$ may exist, but this fact does not interfere with the (new) simulation of the TM, as a new random experiment takes place for each pair of nodes in $D$ prior to each simulation. ∎

We now show that if the constructed network is required to occupy $1/3$ instead of half of the nodes, then the available space of the TM-constructor dramatically increases from $O(n)$ to $O(n^{2})$. We provide a protocol which partitions the population into three sets $U$, $D$ and $M$ of equal size $k=n/3$. The idea is to use the set $M$ as a $\Theta(n^{2})$ binary memory for the TM, where the information is stored in the $k(k-1)/2$ edges of $M$.

Lemma 9**.**

Protocol 3-Partition partitions the nodes into three groups $U$, $D$ and $M$, with waste $3f(n)$, where $f(n)$ is an upper bound on the number of faults that can occur. $U$ is a spanning line with a unique leader in one endpoint and can eventually simulate a TM, each node in $D\cup M$ is connected with exactly one node of $U$, and each node of $U$ is connected to exactly one node in $D$ and one node in $M$.

Proof.

Protocol $3-$Partition constructs lines of three nodes each, where one endpoint is in state $q_{d}$, the other endpoint in state $q_{m}$, and the center is in state $q_{u}$. The nodes of $U$ operate as in Lemma 8 (i.e., they execute the FT Spanning Line protocol). A (connected) pair of nodes waits until a third node is attached to it, and then the center becomes $q_{u}$ and starts executing the FT Spanning Line protocol. Note that at some point, it is possible that the population may only consists of pairs in states $q_{d}$ and $q_{u}^{\prime}$. For this reason, we allow $q_{u}^{\prime}$ nodes to connect with each other, forming lines of four nodes. One of the $q_{u}^{\prime}$ nodes becomes $q_{u}$ and the other becomes $q_{m}^{\prime}$. A node in $q_{m}^{\prime}$ becomes $q_{m}$ only after deactivating its connection with a $q_{d}$ node (its previous pair). This results in lines of three nodes each with nodes in states $q_{d}$, $q_{u}$ and $q_{m}$. Then, the $q_{u}$ nodes start forming a line, spanning all nodes of $U$. In a failure-free setting, the correctness of this protocol follows from Lemma 8. In addition, by Lemma 7, the TM of the line is initialized correctly after the last occurring event (line expansion, line merging, or crash fault).

If we consider crash failures, it is sufficient to show that eventually $U$ is a spanning line and $M$ and $D$ are disjoint. If a node ever becomes $q_{d}$ or $q_{m}$, it might form connections with other nodes in $D$ or $M$ respectively, because of a TM simulation. A node in $M$ never forms connections with nodes in $D$. After they receive a fault notification, they become the deactivating state $s$. A node in state $s$ is disconnected from any other node, thus, it eventually becomes isolated and never participates in the execution again. We do this because nodes in $M$ and $D$ can form unbounded number of connections. The data of the TM have been partially destroyed (because of the crash failure), therefore it is not safe to assume that we can retrieve the degree of them and successfully re-initialize them.

A node $u$ in state $q_{m}^{\prime}$ (inner node of a line of four nodes), after a fault notification it becomes $q_{w}$. A node in $q_{w}$ waits until its next interaction with a connected node $v$. If $v$ is in state $q_{u}$, this means that now a triple has been formed, thus $u$ becomes $q_{m}$. If $v$ is in state $q_{d}$, they delete the edge joining them, $u$ becomes $q_{0}$ and $v$ becomes $s$ ($v$ might have formed connections with other nodes in $D$).

A node $u$ in $q_{u}$, after a fault notification it becomes $q_{w}^{\prime}$ and waits until its next interaction with a connected node $v$. At that point, $v$ can be either $q_{d}$, $q_{m}^{\prime}$, or $q_{m}$. In all cases they disconnect from each other and $u$ becomes $q_{0}^{\prime}$. The state $q_{0}^{\prime}$ indicates that the node should release itself from the spanning line in $U$. This procedure works as described in Lemma 8, thus, after releasing itself from the line, it becomes $q_{0}$. If $v$ is in state $q_{d}$ or $q_{m}$, it becomes $s$. If $v$ is in state $q_{m}^{\prime}$, it becomes $q_{u}^{\prime}$, as its (unique) adjacent node can only be in state $q_{d}$.

A node in $q_{u}^{\prime}$ or $q_{w}$, after a fault notification it becomes $q_{0}$ and continues participating in the execution again. Finally, a node in state $q_{w}^{\prime}$, after receiving a fault notification, it becomes $q_{0}^{\prime}$ (a $q_{w}^{\prime}$ is the result of a fault notification in a $U-$ node).

Note that a node in any state except from $q_{d}$ and $q_{m}$ can be re-initialized correctly, thus they may participate in the execution again. It is apparent that no node that might have formed unbounded number of connections can participate in the execution again after a crash fault. This guarantees that the connections in $D$ and $M$ can be correctly initialized after the final event, and that no node in $D\cup M$ can be connected with more than one node in $U$. In addition, if a $U-$node receives a fault notification, it releases itself from the line, thus introducing new walking states in the resulting line(s). By Lemma 7, this guarantees the correct re-initialization of the TM. Finally, a crash failure can lead in deactivating two more nodes, in the worst case. These nodes never participate in the execution again, thus they remain forever as waste. This means that after $f(n)$ crash failures, the partitioning will be constructed in $n-3f(n)$ nodes. ∎

Theorem 8**.**

For any graph language $L$ that can be decided by an $O(n^{2})-$space TM, there is a protocol that constructs $L$ equiprobably with waste at most $min\{2n/3+f(n),\;n\}$, where $f(n)$ is an upper bound on the number of faults.

Proof.

Protocol 6 partitions the population in three groups $U$, $D$ and $M$ and by Lemma 9, it tolerates any number of crash failures, while initializing correctly the TM after the final event (line expansion, line merging, or crash fault). Reading and writing on the edges of $M$ is performed in precisely the same way as reading/writing the edges of $D$ (described in Theorem 7). Thus, the Turing Machine has now a $O(n^{2})-$space binary memory (the edges of $M$) and $O(n)-$space on the edges of the spanning line $U$. The random graph is constructed on the $k$ nodes of $D$ (useful space), where by Lemma 9, $k=(n-3f(n))/3=n/3-f(n)$ in the worst case. ∎

4.3 Designing Fault-Tolerant Protocols without Waste

A very simple, (yet impractical) idea that could tolerate any number $k<n$ of faults is to restart the protocol each time a node crashes. The implementation of this idea requires the ability of some nodes to detect the removal of a node.

Definition 7**.**

Consider any execution $E_{i}$ of a finite protocol $\Pi$. There exists a finite number of different executions, and for each execution a step $t_{i}$ that $\Pi$ stabilizes. Call $C_{i,j}$ the $j-$th configuration of execution $E_{i}$, where $j\leq t_{i}$. Then, we call maximum reachable degree of $\Pi$ the value $\textit{d}=max\{\text{Degree}(G(C_{i,j}))\},\;\forall i,j$.

We first show that even in the case where the whole population is notified about a crash failure, global restart is impossible for protocols with unbounded maximum reachable degree, if the nodes have constant memory. However, we provide a protocol that restarts the population, but we supply the nodes with $O(\log{n})$ bits of memory. In our approach, we use fault notifications, and if a node $w$ crashes, the set $N_{w}$ of the nodes that are notified, has the task to restart the protocol (i.e., to convert the current configuration into an initial one).

Consider a protocol $\Pi$ with the initial state $q_{0}$. We define as global restart the process which leads all alive nodes to the initial state $q_{0}$ without any enabled connections among them and then $\Pi$ gradually starts again.

Theorem 9**.**

Consider a protocol $\Pi$ with unbounded maximum reachable degree. Then, global restart of $\Pi$ is impossible for nodes with constant memory, even if every node $u$ in the population is notified about the crash failure.

Proof.

Consider a protocol $\Pi$ with constant number of states $k$ and unbounded maximum reachable degree, which stabilizes to a graph $G$ of type $L$. Then any degree more than $k$ cannot be remembered by a node, that is, a state $q$ cannot indicate the degree of a node.

Assume that at time $t$ a crash failure occurs and that there are some edges in the graph (call them spurious edges).

Protocol $\Pi$ is allowed to have rules that are triggered by the fault and try to erase those edges (erasing process). We assume that all nodes in the population are notified about the crash failure. But, as long as the nodes are not aware of their degree, they do not know when the edge erasing process stops in order to allow the restart. To stop the erasing process is equivalent to counting the remaining edges and wait until the degree reaches zero. After a node deletes an edge it either stays in the same state or updates it in order to remember it. No more than $k$ such changes can happen, thus it is impossible to delete all edges and restart $\Pi$ with constant memory.

So, any self-stabilizing protocol will inherit (after restarting gradually) some arbitrary spurious edges. Thus, global restart is impossible. ∎

A very interesting related question is to ask whether a protocol $\Pi$ with unbounded maximum reachable degree can still stabilize to a correct graph after an unsuccessful restart, where some edges exist in the beginning of the execution. This is equivalent to ask whether $\Pi$ can still stabilize to a correct $G$, is we enable arbitrarily some connections prior to the execution.

Theorem 10**.**

Consider a NET protocol $\Pi$ which stabilizes to a graph $G\in L$. Given that all nodes are in an initial state $q_{0}$ and assuming an adversary that can initialize arbitrarily any subset of edges among nodes, $\Pi$ stabilizes to a graph $G^{\prime}\notin L$.

Proof.

Assume w.l.o.g. that $\Pi$ stabilizes to a spanning line. Since the nodes have constant memory (i.e., constant number of states), there exists at least one state $q_{1}$ which $O(n)$ nodes stabilize to. Consider an execution $E$ where two nodes $v$ and $w$ are in the same state $q_{1}$ after stabilization at time $t$. Consider also a node $u$ in state $q_{2}$ which is adjacent to $v$ but not to $w$, and that $u$ and $w$ never interacted with each other until time $t$.

Consider now that the adversary initializes the edge between $u$ and $w$ to on, and we run an execution of $\Pi$ which is exactly the same as $E$ ($u$ and $w$ won’t update their connection state, as they do not interact until $t^{\prime}>t$). Then, node $u$ stabilizes having three enabled connections. Since $v$ and $w$ are both in the same state $q_{1}$, $u$ cannot distinguish $v$ and $w$. If there was a rule in $\Pi$ which disconnects $q_{2}$ and $q_{1}$, this would also happen in the case where $u$ was not adjacent to $w$, resulting $\Pi$ to stabilize to a graph with at least two disjoint lines, as $u$ would be disconnected from $v$. ∎

In light of the impossibility result of Theorem 9, we allow the nodes to use non-constant local memory in order to develop a fault tolerating procedure based on restart. Our goal is to come up with a protocol $A$ that can be composed with any NET protocol $\Pi$ (with notifications), so that their composition is a fault-tolerant version of $\Pi$. Essentially, whenever a fault occurs, $A$ will restart all nodes in a way equivalent to as if a new execution of $\Pi$ had started on the whole remaining population.

We give a protocol that achieves this as follows. All nodes are initially leaders. Through a standard pairwise leader elimination procedure, a unique leader would be guaranteed to remain in the absence of failures. But because a fault can remove the last remaining leader, the protocol handles this by generating a new leader upon getting a fault notification. This guarantees the existence of at least one leader in the population and eventually (after the last fault) of a unique one. There are two main events that trigger a new restarting phase: a fault and a leader elimination. As any new event must trigger a new restarting phase that will not interfere with an outdated one, eventually overriding the latter and restarting all nodes once more, we use phase counters to distinguish among phases. In the presence of a new event it is always guaranteed that a leader at maximum phase will eventually increase its phase, therefore a restart is guaranteed after any event. The restarts essentially cause gradual deactivation of edges (by having nodes remember their degree throughout) and restoration of nodes’ states to $q_{0}$, thus executing $\Pi$ on a fresh initial configuration. For the sake of clarity, we first present a simplified version of the restart protocol that guarantees resetting the state of every node to a uniform initial state $q_{0}$. So, for the time being we may assume that the protocol to be restarted through composition is any Population Protocol $\Pi$ that always starts from the uniform $q_{0}$ initial configuration (all $u\in V$ in $q_{0}$ initially). Later on we shall extend this to handle with protocols that are Network Constructors instead.

Description of the PP Restarting Protocol. The state of every node consists of two components $C_{1}$ and $C_{2}$. $C_{1}$ runs the restart protocol $A$ while $C_{2}$ runs the given PP $\Pi$. In general, they run in parallel with the only exception when $A$ restarts $\Pi$. The $C_{1}$ component of every node stores a leader variable, taking values from $\{l,f\}$, and is initially $l$, a phase variable, taking values from $\mathbb{N}_{\geq 0}$, initially [math], and a fault binary flag, initially [math].

The transition function is as follows. We denote by $x(u)$ the value of variable $x$ of node $u$ and $x^{\prime}(u)$ the value of it after the transition under consideration.

If a leaders’ flag becomes $1$ or $2$, it sets it to [math], increases its phase by one, and restarts $\Pi$. If a followers’ flag becomes $1$ or $2$, it sets it to [math], increases its phase by one, becomes a leader, and restarts $\Pi$. We now distinguish three types of interactions.

When a leader $u$ interacts with a leader $v$, one of them remains leader (state $l$) and the other becomes a follower (state $f$), both set their phase variable to $max\{\text{phase}(u),\text{phase}(v)\}+1$ and both reset their $C_{2}$ component (protocol $\Pi$) to $q_{0}$ (i.e., restart $\Pi$).

When a leader $u$ interacts with a follower $v$, if $\text{phase}(u)=\text{phase}(v)$, do nothing in $C_{1}$ but execute a transition of $\Pi$ (both $u$ and $v$ involved). If $\text{phase}(u)<\text{phase}(v)$, then both set their phase variable to $max\{\text{phase}(u),\text{phase}(v)\}+1$ and both restart $\Pi$, and finally, if $\text{phase}(u)>\text{phase}(v)$, then $\text{phase}^{\prime}(v)=\text{phase}(u)$ and $v$ restarts $\Pi$.

When a follower $u$ interacts with a follower $v$, if $\text{phase}(u)=\text{phase}(v)$ do nothing in $C_{1}$ but execute transition of $\Pi$. If $\text{phase}(u)>\text{phase}(v)$, then $v$ sets $\text{phase}^{\prime}(v)=\text{phase}(u)$ and $v$ restarts $\Pi$, and finally, if $\text{phase}(u)<\text{phase}(v)$, then $u$ sets $\text{phase}^{\prime}(u)=\text{phase}(v)$ and $u$ restarts $\Pi$.

We now show that given any such PP $\Pi$, the above restart protocol $A$ when composed as described with $\Pi$, gives a fault-tolerant version of $\Pi$ (tolerating any number of crash faults).

Lemma 10** (Leader Election).**

In every execution of $A$, a configuration $C$ with a unique leader is reached, such that no subsequent configuration violates this property.

Proof.

If after the last fault there is still at least one leader, then from that point on at least one more leader appears (due to the fault flags) and only pairwise eliminations can decrease the number of leaders. But pairwise elimination guarantees eventual stabilization to a unique leader. It remains to show that there must be at least one leader after the last fault. The leader state becomes absent from the population only when a unique leader crashes. This generates a notification, raising at least one follower’s fault flag, thus introducing at least one leader. ∎

Call a leader-event any interaction that changes the number of leaders. Observe that after the last leader-event in an execution there is a stable unique leader $u_{l}$.

Lemma 11** (Final Restart).**

On or after the last leader-event, $u_{l}$ will go to a phase such that $\text{phase}(u_{l})>\text{phase}(u),\;\forall u\in V^{\prime}\setminus\{u_{l}\}$, where $V^{\prime}$ denotes the remaining nodes after the crash faults. As soon as this happens for the first time, let $S$ denote the set of nodes that have restarted $\Pi$ exactly once on or after that event. Then $\forall u\in V^{\prime}\setminus S,\;u\in S$, an interaction between $u$ and $v$ results in $S\leftarrow S\cup\{u\}$. Thus, $S$ will eventually be $S=V^{\prime}$.

Proof.

We first show that on or after the last leader-event there will be a configuration in which $\text{phase}(u_{l})>\text{phase}(u),\;\forall u\in V^{\prime}\setminus\{u_{l}\}$ and it is stable. As there is a unique leader $u_{l}$ and follower-to-follower interactions do not increase the maximum phase within the followers population, $u_{l}$ will eventually interact with a node that is in the maximum phase. At that point it will set its phase to that maximum plus one and we can agree that before that follower also sets its own phase during that interaction to the new max, it has been satisfied that $\text{phase}(u_{l})>\text{phase}(u),\;\forall u\in V^{\prime}\setminus\{u_{l}\}$.

When the above is first satisfied, $S=\{u_{l},u\}$ and $\text{phase}(u_{l})=\text{phase}(u)>\text{phase}(v),\;\forall v\in V^{\prime}\setminus S$. Any interaction within $S$, only executes a normal transition of $\Pi$, as in $S$ they are all in the same phase. Any interaction between a $u\in V^{\prime}\setminus S$ and a $v\in S$, results in $S\leftarrow S\cup\{u\}$, because interactions between followers in $V^{\prime}\setminus S$ cannot increase the maximum phase within $V^{\prime}\setminus S$, thus $\text{phase}(v)>\text{phase}(u)$ holds and the transition is: $\text{phase}^{\prime}(u)=\text{phase}(v)$ and $u$ restarts $\Pi$, thus enters $S$. It follows that $S$ cannot decrease and any interaction between the two sets increases $S$, thus $S$ eventually becomes equal to $V^{\prime}$. ∎

Putting Lemma 10 and Lemma 11 together gives the aforementioned result.

Theorem 11**.**

For any such PP $\Pi$, it holds that $(A,\Pi)$ is a fault-tolerant version of $\Pi$.

Lemma 12**.**

The required memory in each agent for executing protocol $A$ is $O(\log{n})$ bits.

Proof.

Initially all nodes are potential leaders, and they eliminate each other, moving to next phases at the same time. In the worst case, a single leader $u$ will eliminate every other leader, turning them into followers, thus in a failure-free setting the phase of $u$ becomes at most $n-1$. If we consider the case where crash faults may occur, each fault can result in notifying the whole population. This will happen if $u$ was adjacent to every other node by the time it crashed. Thus, all nodes increase their phase by one and become leaders again. In the worst case, a single leader eliminates all the other leaders, thus, after the first fault, the maximum phase will be increased by $n-2$. The maximum phase than can be reached is $\sum_{i=0}^{k}(n-i)=O(kn)$, where $k$ is the maximum number of faults that may occur ($k<n$). Thus, each node is required to have $O(\log{n})$ bits of memory. ∎

NET Restarting Protocol (with Notifications). We are now extending the PP Restarting Protocol in order to handle any NET protocol $\Pi$ (with notifications). Call this new protocol $B$. We store in the $C_{1}$ component of each node $u\in V$ a degree variable, that is, whenever a connection is formed or deleted, $u$ increases or decreases the value of degree by one respectively. In addition, whenever the fault flag of a node $u$ becomes one, it means that an adjacent node of it has crashed, thus it decreases degree by one. In the case of Network Constructors, the nodes cannot instantly restart the protocol $\Pi$ by setting their state to the initial one $q_{0}$. By Theorem 10, it is evident that we first need to remove all the edges in order to have a successful restart and eventually stabilize to a correct network.

We now define an intermediate phase, called Restarting Phase $R$, where the nodes that need to be restarted enter by setting the value of a variable restart to $1$ (stored in the $C_{1}$ component). As long as their degree is more that zero, they do not apply the rules of the protocol $\Pi$ in their second component $C_{2}$, but instead they deactivate their edges one by one. Eventually their degree reaches zero, and then they set restart to [math] and continue executing protocol $\Pi$. We can say that a node $u$, which is in phase $i$ ($\text{phase}(u)=i$), becomes available for interactions of $\Pi$ (in $C_{2}$) only after a successful restart. This guarantees that a node $u$ will not start executing the protocol $\Pi$ again, unless its degree firstly reaches zero.

The additional Restarting Phase does not interfere with the execution of the PP Restarting Protocol, but it only adds a delay on the stabilization time.

Lemma 13**.**

The variable degree of a node $u$ always stores its correct degree.

Proof.

In a failure-free setting, whenever a node $u$ forms a new connection, it increases its degree variable by one, and whenever it deactivates a connection, it decreases it by one. In case of a fault, all the adjacent nodes are notified, as their fault flag becomes one. Thus, they decrease their degree by one. In case of a fault with no adjacent nodes, a random node is notified, and its fault flag becomes two. In that case, it leaves the value of degree the same. ∎

Theorem 12**.**

For any NET protocol $\Pi$ (with notifications), it holds that $(B,\Pi)$ is a fault-tolerant version of $\Pi$.

Proof.

Consider the case where a node $u$ (either leader or follower) needs to be restarted. It enters to the restarting phase in order to deactivate all of its enabled connections, and it will start executing $\Pi$ only after its degree becomes zero (by Lemma 13 this will happen correctly), thus, $\Pi$ always run in nodes with no spurious edges (edges that are the result of previous executions). Whenever two connected nodes $u\in R$ and $v\notin R$ interact with each other, they both decrease their degree variable by one, and they delete the edge joining them. Obviously, this fact interferes with the execution of $\Pi$ in node $v$ (which is not in the restarting phase), but $v$ is surely in a previous phase than $u$ and will eventually also enter in $R$. This follows from the fact that a node in some phase $i$ can never start forming new edges before it has successfully deleted all of its edges before. New edges are only formed with nodes in the same phase $i$.

The new Restarting Phase does not interfere with the states of the PP Restarting Protocol, thus the correctness of $B$ follows by Lemma 10 and Lemma 11. ∎

Lemma 14**.**

The required memory in each agent for executing protocol $B$ is $O(\log{n})$ bits.

Proof.

The maximum value that the variable degree can reach is the maximum reachable degree (d) of protocol $\Pi$. Thus, by Lemma 12, the states that each node is required to have is $O(dkn)$. Both $d$ and $k$ are less that $n-1$, thus, $O(n^{3})\;\text{states}=O(\log{n})$ bits. ∎

5 Conclusions and Open Problems

A number of interesting problems are left open for future work. Our only exact characterization was achieved in the case of unbounded faults and no notifications. If faults are bounded, non-hereditary languages were proved impossible to construct without notifications but we do not know whether hereditary languages are constructible. Relaxations, such as permitting waste or partial constructibility were shown to enable otherwise impossible transformations, but there is still work to be done to completely characterize these cases. In case of notifications, we managed to obtain fault-tolerant universal constructors, but it is not yet clear whether the assumptions of waste and local coin tossing that we employed are necessary and how they could be dropped. Apart from these immediate technical open problems, some more general related directions are the examination of different types of faults such as random, Byzantine, and communication/edge faults. Finally, a major open front is the examination of fault-tolerant protocols for stable dynamic networks in models stronger than NETs.