A dynamic primary configuration group communication service

Quorum-based methods for managing replicated data are popular because they provide availability of both reads and writes in the presence of faulty behavior by some sites or communication links. Over a very long time, it may become necessary to alter the quorum system, perhaps because some sites have failed permanently and others have joined the system, or perhaps because users want a different trade-off between read-availability and write-availability. There are subtle issues that arise in managing the change of quorums, including how to make sure that any operation using the new quorum system is aware of all information from operations that used an old quorum system, and how to allow concurrent attempts to alter the quorum system. In this paper we use ideas from group management services, especially those providing a dynamic notion of primary view; with this we define an abstract specification of a system that presents each user with a consistent succession of identified configurations, each of which has a membership set, and a quorum system for that set. T he key contribution here is the intersection property, that determines how the new configurations must relate to previous ones. W e demonstrate that our proposed specification is neither too strong, by showing how it can be implemented, nor too weak, by showing the correctness of a replicated data management algorithm running above it.