Hengming Zou and Farnam Jahanian. The University of Michigan. Ann Arbor, Michigan fzou,

Transcription

1 Optmzaton of a Real-Tme Prmary-Backup Replcaton Servce Hengmng Zou and Farnam Jahanan Real-tme Computng Laboratory Department of Electrcal Engneerng and Computer Scence The Unversty of Mchgan Ann Arbor, Mchgan fzou, farnamg@eecs.umch.edu Abstract The prmary-backup replcaton model s one of the commonly adopted approaches to provdng fault tolerant data servces. Its extenson to the real-tme envronment, however, mposes the addtonal constrant of tmng predctablty, whch requres a bounded overhead for managng redundancy. Ths paper dscusses the trade-o between reducng system overhead and ncreasng (temporal) consstency between the prmary and backup, and explores ways to optmze such a system to mnmze ether the nconsstency or the system overhead whle mantanng the temporal consstency guarantees of the system. An mplementaton bult on top of the exstng RTPB model [20] was developed wthn the x-kernel archtecture on the Mach OSF platform runnng MK 7.2. Results of an expermental evaluaton of the proposed optmzaton technques are dscussed. 1 Introducton A common approach to buldng fault-tolerant dstrbuted systems s to replcate servers that fal ndependently. The man approaches for structurng fault-tolerant servers are actve (state-machne) and passve (prmary-backup) replcaton. In actve replcaton, a collecton of dentcal servers mantan copes of the system state. Clent wrte operatons are appled atomcally to all of the replcas so that after detectng a server falure, the remanng servers can contnue the servce. The man attracton of the statemachne approach s the transparency n falure recovery. The clent does not see, nor does t need to know, that there are faulty servers. However, the desgn and mplementaton of the underlyng agreement protocol s often trcky and complcated. Passve replcaton, on the other hand, s smpler n desgn and nvolves less redundant processng. It dstngushes one replca as the prmary server, whch handles all clent requests. A wrte operaton at the prmary server nvokes the transmsson of an update message to the backup servers whch updates the backups. If the prmary fals, a falover occurs and one of the backups becomes the new prmary. The major drawback of the passve approach s that the clents need to partcpate n the recovery process and the recovery takes longer than that of the actve scheme. Whle each of the two approaches has ts advantages and dsadvantages, nether drectly solves the problem of accessng data n a real-tme envronment. Many embedded real-tme applcatons, such as computer-aded manufacturng and process control, requre tmely executon of tasks, and ther own processng needs should not be compromsed by fault tolerant access to data repostores. Therefore t s mportant for replcaton servers to provde tmely access to the servce. In such a real-tme envronment, the scheme employed n most of the conventonal replcaton systems may prove nsucent for the needs of applcatons. Partcularly, when tme s scarce and the overhead for managng redundancy s too hgh, an alternatve soluton s requred to provde both tmng predctablty and fault tolerance. Ths paper bulds on our Real-Tme Prmary- Backup (RTPB) Replcaton [20] model that acheves a balance between fault tolerance and tmng dependablty. However, the proposed schedulng algorthm n [20] s not optmal n the sense that t mnmzes nether the temporal nconsstency between the prmary and backup nor the system overhead n mantanng a gven bound on the nconsstency. The objectve of ths paper s to extend the desgn of the RTPB servce to support optmzaton wthn the system n the above two aspects. The most mportant contrbutons of ths paper are the formulaton of the optmzaton

2 problems and the solutons to them. As a by-product, we prove that the problem of mnmzng system overhead n mantanng a gven bound on the temporal nconsstency between the prmary and backup s ntractable but the soluton n the case when a temporal bound s mposed for each ndvdual object s polynomal. Expermental data that valdates the results are presented. The next secton descrbes the underlyng RTPB model and denes the concept of average temporal dstance. Secton 3 and 4 dscuss the optmzaton problem from the two perspectves we have mentoned. Secton 5 extends the results by consderng faults. Secton 6 s the mplementaton followed by performance analyss n Secton 7. Secton 8 dscusses the related work, and nally, Secton 9 s our concluson. 2 The RTPB model The RTPB scheme developed n [20] s an extenson of the tradtonal prmary-backup approach to support real-tme computaton and temporal consstency guarantees. The man features that set RTPB apart from ts tradtonal counterpart are the decouplng of clent request processes from backup updates and bounded temporal nconsstency between the prmary and backup. Ths earler work ntroduced the concepts of phase varance, external and nter-object temporal consstency, and the consstency model and schedulng algorthm that guarantees such consstences. External temporal consstency deals wth the relatonshp between an object n the external world and ts mage on the servers. For example, a trackng system must update the postonal data of an arplane quckly after t changes poston n the ar. The nterobject temporal consstency concerns the relatonshp between derent objects or events. For example, n an ar trac control system, there s a tme bound between the updates of the postons of two arplanes that are watng to land at the same arport. The RTPB system conssts of a prmary and a backup wth the prmary beng responsble for processng clent requests and keepng the backup n a temporal consstent state. We assume that the consstency at the prmary s mantaned by the tmely updates of objects by the clents of the system. The external temporal consstency stpulates that the tmestamp of any object at tme t s no more than P tme unts apart from t on prmary and B on backup; the nter-object temporal consstency requres that the derence between the tmestampes of any two related objects and j s no more than j. Fgure 1 llustrates the model. External World t 6 jt, T P jt, T B (t)j P (t)j B jt P j (t), T P (t)j P j jt B j (t), T B (t)j B j? Prmary Backup T - P (t);tp(t) j T B (t);tb j (t) Fgure 1: real-tme prmary-backup replcaton The derence between the tmestamps of object 's copes at the prmary and backup s a good measurement of the closeness of the two servers wth respect to object, and s convenently called temporal dstance of the object n the system. If we know the temporal dstance for every object n the system, we can dene the overall closeness between the prmary and backup to be the arthmetc average of the closeness wth respect to each object. We call ths arthmetc average average temporal dstance (ATD) or temporal nconsstency between the prmary and backup. Let O P and O B denote object at the prmary and backup, respectvely, and T P (t) and T B (t) denote the correspondng tmestamps of O P and O B at tme t: Denton 1: The temporal dstance between the prmary and backup wth regard to object at tme t s jt P (t), T B (t)j. The average temporal dstance between the prmary and backup at tme t P s n =1 jt P (t), T B (t)j=n, where n s the total number of objects regstered n the replcaton servce. The dentons of temporal dstance and average temporal dstance also suggest a way to compute ther values. In partcular, to compute the temporal dstance for any sngle object at any tme t, we need to calculate the absolute derences between the tme nstants at whch object was last updated on the prmary and backup, respectvely. To compute ATD n artpb system at any gven tme t, we need to compute the temporal dstance for each object and then take ther arthmetc average. In the followng sectons, we dscuss ways to mnmze the ATD and the system overhead n mantanng a gven bound on the ATD.

3 3 Mnmzng the ATD Observe that the more frequently updates are sent to backup, the smaller the ATD wll be. Thus, f the perod of the updates sent tobackup for each object s mnmzed, the ATD between the prmary and backup s also mnmzed. Furthermore, the mnmzaton of the update perod at the backup for each object results n the mnmzaton of the sum of the update perods for all objects, and vce versa. Hence, we can use the sum of the update perods for all objects as our objectve functon. Let: p P denote the perod of the task that updates O P. e P denote the executon tme of the task updatng O P. p U denote the perod of the task that updates O B. e U denote the executon tme of the task updatng O B. P ;B denote temporal constrant for O P ;OB. Then our optmzaton problem can be stated as: mnmze P P objectve functon: p U under constrant: =1 (eu =pu n + e P =pp ) 2n(21=2n, 1) and ;=1; 2;:::;n p P p U B The constrant P n =1 (eu =pu +ep =pp ) 2n(21=2n, 1) s needed to guarantee task schedulablty under both the Rate-Monotonc [14] and Dstance- Constraned [4] schedulng algorthms. 1 The nequalty p U B ensures that the temporal constrant mposed on object at the backup s mantaned whle nequalty p P p U guarantees that no unnecessary update s sent to the backup snce more frequent updates at backup would not make any derence when there s no message loss between servers. However, such formulaton of the optmzaton problem s not very useful n practce because t s not n a normalzed form and the solutons to t are skewed towards the boundares. In other words, for most objects, the perods are ether very hgh or very low. For example, f we have four objects n the system wth e P = e U = f1; 2; 3; 4g;p P = f10; 20; 30; 40g; B = f50; 50; 60; P 70g, respectvely, then the mnmzaton of p U s acheved f p U = f45; 20; 30; 40g. All values except one n the p U vector are on the lower lmts (skewed soluton) n the constrantng nequaltes. In fact, we can show that n any optmal soluton (f one exsts) for the above optmzaton problem, there s only exactly one object that has ts perod strctly bounded between the boundares gven n the constranng nequaltes. Indeed, we can generalze ths observaton to the followng theorem: 1 An exposton of schedulng algorthms s beyond the scope of ths paper, refer to the references for detal. P n =1 c x subject to P n Theorem 1: The optmal soluton n maxmzng =1 a x b, l x u for =1;:::;n has at most one of the varables bounded strctly between ts lower and upper boundares Snce our optmzaton problem can be converted to the form stated n Theorem 1, any soluton to t s skewed toward boundares and thus not acceptable n practce. Ths analyss necesstates a need to nd a normalzed objectve functon whose solutons are not skewed toward any extreme. One sutable alternatve sthemaxmzaton of the mnmum p P =pu, =1; 2;:::;n. Ths objectve functon s smple and ts soluton can be easly found by a polynomal tme algorthm. Furthermore, all the perods are made as small as possble together wthout skew. Now the optmzaton problem can be formulated as: maxmze P objectve functon mn(p P =pu) under constrant n =1 (eu =pu + e P =pp ) 2n(21=2n, 1) and p P p U B ; = 1; 2;:::;n The proof that the above functon ndeed mnmzes the ATD s beyond the scope of ths paper. However, t correctness can be explaned ntutvely as follows: snce the maxmzaton of the mnmum of (p P =pu) mnmzes the update transmsson perod p U proportonally to ts correspondng update perod at the prmary, the overall update frequency at the backup s therefore maxmzed proportonally, whch results n the mnmzaton of the ATD. The above formulaton states that to mnmze the ATD, one needs to mnmze the maxmum perod of the update tasks for the object set subject to both schedulablty and temporal constrant tests. A polynomal tme algorthm that acheves ths objectve s dscussed below. We dstngush between Statc and dynamc allocaton. Statc allocaton deals wth the case where the set of objects to be regstered are known ahead of tme. The goal s to assgn the update schedulng perod for each object such that the vaule of the object functon s maxmzed. Dynamc allocaton deals wth the case where a new object s watng to be regstered n a runnng system n whch a set of objects have already been regstered. Statc allocaton: Snce all objects are know a pror, the algorthm for schedulng updates from prmary to 2 Due to space lmtaton, we omt the proof here. Refer to the extended verson [19] for all the proofs of the theorems

4 backup s relatvely straghtforward: 1. Assgn p U = B ntally 2. Check schedulablty test usng rate-monotonc [14] or dstance-constraned [4] schedulng. If the test fals, then t s mpossble to schedule the task set wthout volatng the gven temporal constrant. 3. Otherwse, sort the terms p P =pu ; =1;:::;n nto ascendng order. 4. Shorten the update perod (p U ) of the rst term n the ordered lst untl ether t becomes the second smallest term, or the update perod reaches the lower bound (p P ), or the utlzaton rate of the whole task set s saturated. 5. Repeat steps 3-4 untl the utlzaton becomes saturated. Note that steps 3-4 can be mplemented ecently by usng bnary nserton whch s bounded by log n, and the runnng tme of the algorthm s domnated by the number of teratons of steps 3-4 whch s bounded by (max(p P =pu ), mn(pp =pu ))2, the total runnng tme of our algorthm s O((max(p P =pu ), mn(p P =pu ))2 log n). Dynamc allocaton: A new object s beng regstered wth a system n whch other objects have already been checked n. We want to nd out f the new object can be admtted and at what frequency we can optmally schedule ts update task. We can pursue ether a local optmum or global optmum wth the dfference beng that local optmum algorthm does not adjust the perods of tasks that are already admtted and global optmum algorthm consders all tasks n devsng an optmal schedulng. Local optmal 1. Assgn the smallest value that s p P but B to the new task such that the total utlzaton of the task set s stll under 2n(2 1=2n, 1) (Ths ensures that the whole task set s schedulable under ratemonotonc [14] or dstance-constraned schedulng [4]). 2. If Step 1 fals, then reject the object. Global optmal 1. Insert term p P =pu nto the ordered lst that we obtaned n statc or prevous allocatons. 2. Rerun the statc allocaton algorthm. 3. If Step 2 fals, then reject the new object. The runnng tme for local optmum algorthm s lnear (wth respect to the number of objects); The tme complexty for the global optmum algorthm s the same as that of the statc allocaton algorthm whch s polynomal. 4 Mnmzng system overhead Ths secton dscusses the problem of mnmzng system overhead n mantanng a gven bound on the ATD. Snce system overhead s manly caused by the schedulng of updates from the prmary to backup, the mnmzaton of ths overhead means the mnmzaton of the number of updates sent to the backup, whch s equvalent to the maxmzaton of the perods of the update tasks under the gven ATD. We assume that the transmsson of an update message of any object takes the same amount of prmary resource. Snce the temporal dstance s determned by the frequency of the updates that are sent to the backup, the bound on the ATD can be converted to a bound on the perods of the updatng tasks. Moreover, f we normalze the perod of each update task wth the denomnator P, p P, the gven constrant P onatd can be transformed to the nequalty p U =(P,pP ) B, where B s the bound derved from the gven constrant on the ATD. Observe that we do not need to know the actual value of B. The mportant thng here s that B can be derved from the bound on ATD. Thus, our optmzaton problem P can be formulated as maxmzaton of functon p P U under constrant p U =(P, p P ) B, where B s some postve constant. Unfortunately, ths problem turns out to be ntractable. Theorem 2: The problem of the mnmzng the number of updates from prmary to backup n mantanng a gven bound on the ATD s NP-complete. 2 However, the problem becomes polynomal f we mpose a temporal constrant onevery ndvdual object (nstead of global temporal constrant on the ATD for the whole object set). Ths polynomal soluton can be used as an approxmaton to the soluton of the NPcomplete verson of the problem. Suppose we have the addtonal constrant p U B ;=1; 2;:::;n, then the followng algorthm acheves the mnmzaton of overhead n mantanng the temporal constrants for the correspondng objects n the system: 1. For each object, assgn perod: p U = B. 2. Perform schedulablty test. If the test fals, then we cannot guarantee the temporal consstency of the object set. Reject the object set. 3. Otherwse, accept the object. The ratonale behnd the algorthm s that to mnmze the overhead n achevng the gven temporal

5 constrant, we smply schedule the least number of updates to the backup as possble for each object subject to the ndvdual temporal constrant whch s acheved by assgnng the update perod from the prmary to backup to the ndvdual temporal constrant. The runnng tme complexty of the above algorthm s lnear. 5 Optmzaton under faults The dscusson n the prevous two sectons does not take nto consderaton message loss. Update messages from the prmary to backup can be lost due to a send omsson, receve omsson, or lnk falure. In ths secton, we devse a new schedulng protocol that takes message loss nto consderaton. We dene the probablty of a message loss from the prmary to the backup to be, and the probablty of the temporal consstency guarantee we want to acheve tobep. Then for an update to reach backup wth probablty P, the number of transmssons needed s log(1, P )= log(). Hence, the problem of mnmzng the ATD between prmary and backup can be formulated as: maxmze objectve functon mn((p P log())=(pu log(1,p ))) under constrant P n =1 (eu =pu + e P =pp ) 2n(21=2n, 1) and (p P log())= log(1, P ) pu B The goal s to send updates to the backup more frequently n case of a message loss. The frequency of update transmsson can be ncreased up to the frequency at whch any update wll reach the backup wth the probablty P. The maxmzaton of the mnmum term n the objectve functon results n the overall mnmzaton of perods of the update tasks, whch consequently results n the mnmzaton of the ATD wth probablty P. The constrants n the formulaton ensure schedulablty whle mantanng temporal consstency of each ndvdual object and avodng unnecessary updates to the backup. Wth proper substtuton of terms, the same algorthm ntroduced n secton 3 can be appled here. Due to space lmtaton, we omt t. Smlarly, the mnmzaton of system overhead n mantanng a gven temporal bound on the ATD when message loss occurs becomes the maxmzaton P P n of =1 P U under the constrant of p U log(1, P )=[log (P, p P )] B. Agan, the problem s NP-complete but an alternate formulaton of the problem, where a temporal bound on each ndvdual object s mposed, can be solved n polynomal tme. The same algorthm descrbed n Secton 4 can be used here f we substtute the upper bound B n the constranng nequalty by B log()= log(1, P ). 6 Implementaton We have ntegrated the optmzaton technques developed n ths paper nto the RTPB prototype that was bult n our prevous work [20]. The new prototype s mplemented as a user-level x-kernel [7] based server on the MK 7.2 mcrokernel from the Open Group. 3 Our system ncludes a prmary server and a backup server. A clent applcaton resdes on the same machne as the prmary. The clent contnuously senses the envronment and perodcally sends updates to the prmary. The prmary s responsble for backng up the data on the backup ste and lmtng the nconsstency of the data between the two stes wthn some speced wndow. The followng assumptons are made n the mplementaton: Lnk falures are handled usng physcal redundancy such that network parttons are avoded. An upper bound exsts on the communcaton delay between the prmary and backup. Mssed message deadlnes are treated as performance falures. Servers are assumed to suer crash falures only. Fgure 2 shows the RTPB system archtecture wthn the x-kernel protocol stack. At the top level s the RTPB API whch s used to connect the outsde clents to the Mach server on one end, and Mach server to the x-kernel on the other end. The RTPB protocol sts rght below the API layer and serves as an anchor protocol n the x-kernel protocol stack. From above, t provdes an nterface between the x-kernel and the outsde host operatng system (the MK kernel n ths case). From below, t connects wth the rest of the protocol stack through the x-kernel unform protocol nterface. The underlyng transport protocol s UDP. The prmary host nteracts wth the backup host through the underlyng RTPB protocol. There are two dentcal versons of the clent applcaton resdng on the prmary and backup hosts. Normally, only the prmary clent applcaton s runnng. But when the backup takes over n case of prmary falure, t also actvates the backup clent applcaton and brngs t up to a consstent system state. 6.1 Admsson control Before a clent starts to send perodc updates of a data object to the prmary, t rst regsters the object wth the RTPB servce so that the prmary can 3 formerly known as the Open Software Foundaton (OSF).

6 Prmary RTPB API RTPB UDP IP ETH ETHDRV RTPB server OSF MACH KERNEL x-kernel paths Ethernet Backup RTPB API RTPB UDP IP ETH ETHDRV RTPB server OSF MACH KERNEL Fgure 2: system archtecture and protocol stack perform admsson control. Durng regstraton, the clent reserves the necessary resource for the object on the prmary and backup servers. In addton, the clent speces the update perod p and the temporal constrants for the object on both the prmary P and backup B. Because the copy of object on the prmary changes only when the clent sends a new update, the nconsstency between the real data and ts mage on the prmary s dependent on the frequency of clent updates. The prmary server performs the temporal constrant test by comparng the value of P and p. If p P, then the nconsstency between the real data and the prmary copy wll always fall nto the speced consstency wndow. If the condton does not hold, the prmary wll not admt the object. Each nter-object temporal constrant j for object, j can be met at the prmary f p j and p j j. The temporal constrant for object on the backup s also checked to ensure that t can be met [20]. After testng that the temporal constrants hold for object, the prmary needs to check f t can schedule a perodc update event (to the backup) for object that wll meet the consstency constrant of the object on the backup wthout volatng the consstency constrants of all exstng objects by performng a schedulablty test based on the rate-monotonc or dstanceconstraned schedulng algorthm. If the test s successful, the object s admtted nto the system. 6.2 Update schedulng In our model, clent updates are decoupled from the updates to the backup. The prmary needs to send updates to the backup perodcally for all objects admtted n the servce. If ATD mnmzaton s desred, then the algorthm descrbed n secton 3 s used. If the mnmzaton of system overhead s sought, then the algorthm dscussed n secton 4 s used. But n ether of these cases, f a clent modes an object, the prmary must send an update for the object to backup wthn the next,` tme unts, where = B,P s the wndow of allowed nconsstency between the prmary and the backup; otherwse the object on backup may fall out of the consstency wndow. For nterobject temporal constrant, the prmary need not send updates to the backup wthn the next,` tme unts after the prmary s updated. But rather, t schedules the two updates for object and j wthn j tme unts. If both the probablty of message loss from the prmary to backup and the probablty toacheve guarantees of temporal consstency n the system are gven, then we apply the optmzaton technque that deals wth faults descrbed n secton Falure detecton and recovery Falure detecton and recovery s a key component of the replcaton servce. Our approach requres that all replcaton servers exchange perodc png messages whch serve as the heartbeats among those servers. Each server acknowledges the png message from the other one. If a server receves no acknowledgment for repeated png messages, t wll declare the other end dead. If the backup s dead, the prmary cancels the png messages as well as update events for each regstered object. If the prmary crashes, the backup takes over as the new prmary. The new prmary nvokes a backup verson of the clent applcaton at the local machne, feeds the new clent wth nformaton stored n ts memory va an upcall, starts lstenng to all clent requests, and then wats to recrut a new backup. The new clent replaces the clent at the crashed machne to perform the applcaton task. Our mplementaton supports the ntegraton of a new backup after a falure s detected. 7 Performance Evaluaton Ths secton evaluates the proposed optmzaton technques aganst the RTPB servce developed n [20]. we consder two metrcs: average temporal dstance and average duraton of backup nconsstency, whch are nuenced by several parameters ncludng clent

7 wrte rate, number of objects beng accepted, wndow sze, and message loss probablty. 7.1 The ATD metrcs To demonstrate the optmzaton technque proposed n ths paper, we measured the ATD under two condtons wth and wthout optmzaton. Fgure 3(a) and (b) compare the results of optmzaton to that of wthout optmzaton assumng no message loss. As Average Maxmum Dstance (mllseconds) W = 100 mllseconds W = 300 mllseconds W = 700 mllseconds W = 1000 mllseconds Number of Objects Accepted at Prmary (a) wthout optmzaton Average Maxmum Dstance (mllseconds) W = 100 mllseconds W = 300 mllseconds W = 700 mllseconds W = 1000 mllseconds Number of Objects Accepted at Prmary (b) wth optmzaton Fgure 3: Average prmary-backup temporal dstance shown by the two graphs, the ATD wth optmzaton n eect s about 40% smaller than that wthout optmzaton under the same set of parameters. The optmzed RTPB attempts to send as many updates as possble to the backup. It must be noted that n both graphs, larger wndow sze results n smaller ATD, whch conforms to the result presented n [20]. Fgure 4 does the same comparson but wth consderaton of message losses. The two graphs show an Average Maxmum Dstance (mllseconds) W = 100 mllseconds W = 300 mllseconds W = 700 mllseconds W = 1000 mllseconds Probablty of Message Loss (a) wthout optmzaton Average Maxmum Dstance (mllseconds) W = 100 mllseconds W = 300 mllseconds W = 700 mllseconds W = 1000 mllseconds Probablty of Message Loss (b) wth optmzaton Fgure 4: ATD under fault assumpton approxmate 35% mprovement on the ATD due to the applcaton of the optmzaton technques descrbed n ths paper. Furthermore, we note that the shape of the graph under optmzaton s much smoother than that when no optmzaton s used, because the effect of message loss s compensated by more frequent schedulng of update messages. 7.2 Duraton of backup nconsstency Snce the optmzed RTPB mnmzes the ATD between the prmary and backup, t s expected that the duraton of backup nconsstency should also be reduced under the new moded RTPB model. Fgure 5(a) and (b) show the duraton of backup nconsstency as a functon of the probablty of message loss between the prmary and backup. The gures show Average Duraton of Inconsstency (mllseconds) W = 100 mllseconds W = 300 mllseconds W = 700 mllseconds W = 1000 mllseconds Probablty of Message Loss (a) wthout optmzaton Average Duraton of Inconsstency (mllseconds) W = 100 mllseconds W = 300 mllseconds W = 700 mllseconds W = 1000 mllseconds Probablty of Message Loss (b) wth optmzaton Fgure 5: duraton of backup nconsstency that the optmzed RTPB has a hgher degree of tolerance to message loss than that of normal schedulng. Wth optmzaton, there s no backup nconsstency untl the message loss rate exceeds 6%, and after that the duraton of nconsstency ncreases slowly. But the one wthout optmzaton suers backup nconsstency when the message loss rate exceeds approxmately 1%, and the duraton of nconsstency ncreases rapdly as message loss rate ncreases. In both cases, for the same message loss rate, the larger the wndow sze, the shorter s the perod n whch the backup stays n an nconsstent state. Larger wndow sze would mean shorter duraton of backup nconsstency because the update frequency at the backup s much hgher than that at the prmary. Before we leave ths secton, t should be mentoned that wehave studed the clent response tme wth and wthout optmzaton and found out that ther performance are not much derent. The orgnal RTPB model already schedules a mnmum number ofup- dates to the backup (hence leaves maxmum avalable resources at the prmary for clent request processng). See Fgure 6 and 7 n [20] for graphs of ths metrcs.

8 8 Related work 8.2 Consstency semantcs 8.1 Replcaton models Past work on synchronous and asynchronous replcaton protocols has focused, n most cases, on applcatons for whch tmng predctablty s not a key requrement. Real-tme applcatons, however, operate under strct tmng and dependablty constrants that requre the system to ensure tmely delvery of servces and to meet certan consstency constrants. Hence, the problem of server replcaton posses addtonal challenges n a real-tme envronment. In recent years, several expermental projects have begun to address the problem of replcaton n dstrbuted hard real-tme systems. For example, TTP [6] s a tme-trggered dstrbuted real-tme system: ts archtecture s based on the assumpton that the worst-case load s determned apror at desgn tme, and the system response to external events s cyclc at predetermned tme-ntervals. The TTP provdes faulttolerance by mplementng actve redundancy through a collecton of replcated components wth each reles on a number of hardware and software mechansms for error detecton to ensure a fal-slent behavor. RTCAST [18] s a lghtweght fault-tolerant multcast and membershp servce for real-tme process groups whch exchange perodc and aperodc messages. The servce supports bounded-tme message transport, atomcty, and order for multcasts wthn a group of communcatng processes n the presence of processor crashes and communcaton falures. It guarantees agreement on membershp among the communcatng processors, and ensures that membershp changes resultng from processor jons or departures are atomc and ordered wth respect to multcast messages. Both TTP and RTCAST are based on actve replcaton whereas RTPB s a passve scheme. Rajkumar [2, 3] presents a publsher/subscrber model for dstrbuted real-tme systems. It provdes a smple user nterface for publshng messages on a logcal \channel", and for subscrbng to selected channels as needed by each applcaton. In the absence of faults each message sent by a publsher on a channel should be receved by all subscrbers. The abstracton hdes a portable, analyzable, scalable and ecent mechansm for group communcaton. It does not, however, attempt to guarantee atomcty and order n the presence of falures, whch may compromse consstency. The approach proposed n ths paper bounds the overhead by relaxng the requrements on the consstency of the replcated data. For a large class of realtme applcatons, the system can recover from a server falure even though the servers may not have mantaned dentcal copes of the replcated state. Ths facltates alternatve approaches that trade atomc or causal consstency amongst the replcas for less expensve replcaton protocols. Enforcng a weaker correctness crteron has been studed extensvely for derent purposes and applcaton domans. In partcular, anumber of researchers have observed that seralzablty s too strct as a correctness crteron for realtme databases. Relaxed correctness crtera facltate hgher concurrency by permttng a lmted amount of nconsstency n how a transacton vews the database state [5,8, 9, 11{13,16, 17]. For example, a recent work [10] [11] proposed a class of real-tme data access protocols called SSP (Smlarty Stack Protocol) applcable to dstrbuted real-tme systems. The correctness of the SSP protocol s just- ed by the concept of smlarty whch allows derent but sucently tmely data to be used n a computaton wthout adversely aectng the outcome. Data tems that are smlar would produce the same result f used as nput. SSP schedules are deadlock-free, subject to lmted blockng and do not use locks. Furthermore, a schedulablty bound can be gven for the SSP scheduler. Smulaton results show that SSP s especally useful for schedulng real-tme data access on multprocessor systems. Smlarly, the noton of mprecse computaton [15] explores weaker applcaton semantcs and guarantees tmely completon of tasks by relaxng the accuracy requrements of the computaton. Ths s partcularly useful n applcatons that use dscrete samples of contnuous tme varables, snce these values can be approxmated when there s not sucent tme to compute an exact value. Weak consstency can also mprove performance n non-real-tme applcatons. For nstance, the quas-copy model permts some nconsstency between the central data and ts cached copes at remote stes [1]. Ths gves the scheduler more exblty n propagatng updates to the cached copes. In the same sprt, the RTPB replcaton servce allows computaton that may otherwse be dsallowed by exstng actve or passve protocols that support atomc updates to a collecton of replcas.

9 9 Concluson Ths paper presents the optmzaton of a real-tme prmary-backup replcaton servce from two perspectves. By applyng the approprate optmzaton technque, we can mnmze ether the average temporal dstance or the system overhead n mantanng temporal consstency between the prmary and backup. Expermental results ndcate that the technques developed n ths work can ndeed mprove system performance over the orgnal RTPB model. Avenues for future studes nclude extenson of the concepts of ths paper to actve replcaton and a probablstc analyss of the system. References [1] R. Alonso, D. Barbara, and H. Garca-Molna. Data cachng ssues n an nformaton retreval system. ACM Transacton on Database Systems, 15(3):359{384, September [2] R. Rajkumar et al. The real-tme publshersubscrber nter-process communcaton model for dstrbuted real-tme systems: Desgn and mplementaton. In Proc. Real-Tme Technology and Applcatons Symposum, pages 66{75, May [3] M. Gaglard, R.Rajkumar, and L. Sha. Desgnng for evolvablty: Buldng blocks for evolvable real-tme systems. In Proc. Real-Tme Technology and Applcatons Symposum, June [4] C-C Han and K-J Ln. Schedulng dstanceconstraned real-tme tasks. In Proc. RTSS'92. [5] H.F.Korth, N.Soparkar, and A. Slberschatz. Trggered real-tme databases wth consstency constrants. In Proc. Int'l Conf. on Very Large Data Bases, August [6] H.Kopetz and G. Grunstedl. Ttp - a protocol for fault-tolerant real-tme systems. In IEEE Computer, volume 27, pages 14{23, January [7] N. C. Hutchnson and L. L. Peterson. The x- kernel: An archtecture for mplementng network protocols. IEEE Transactons on Software Engneerng, 17(1):64{76, Janruary [8] B. Kao and H. Garca-Molna. An overvew of real-tme database systems. In S.H. Son, edtor, Advances n Real-Tme systems, pages 463{486. Prentce Hall, [9] T-W Kuo and A.K.Mok. Ssp: A semantcsbased protocol for real-tme data access. In Proc. RTSS'93. [10] T-W Kuo and A.K.Mok. Ssp: A semantcs-based protocol for real-tme data access. In Proceedngs of IEEE 14th Real-Tme Systems Symposum, December [11] Te-We Kuo, D. Locke, and F. Wang. Error propagaton analyss of real-tme data ntensve applcaton. In IEEE Real-Tme Technology and Applcatons Symposum, June [12] K-J Ln. Consstency ssues n real-tme database systems. In Proc. ICSS'89, pages 654{661. [13] K-J Ln and F. Jahanan. Issues and applcatons. In Sang Son, edtor, Real-tme Database Systems. Kluwer Academc Publshers, [14] C. L. Lu and J. W. Layland. Schedulng algorthms for multprogrammng n a hard real-tme envronment. Journal of the ACM, 20(1):46{61, January [15] J.W.S. Lu, W.-K. Shh, and K.-J. Ln. Imprecse computaton. In Proceedngs of IEEE, volume 82, pages 83{94, January [16] C. Pu and A. Le. Replca control n dstrbuted systems: An asynchronous approach. In Proc. of ACM SIGMOD, pages 377{386, May [17] S.B.Davdson and A. Watters. Partal computaton n real-tme database systems. In Proc. Workshop on Real-Tme Operatng Systems and Software, pages 117{121, May [18] T.Abdelzaher, A.Shakh, S.Johnson, F.Jahanan, and K.G.Shn. Rtcast: Lghtweght multcast for real-tme process groups. In IEEE Real-Tme Technology and Applcatons Symposum, [19] H. Zou and F. Jahanan. Optmzaton of a realtme prmary-backup replcaton servce. Techncal Report CSE-TR , Unversty of Mchgan, July [20] H. Zou and F. Jahanan. Real-tme prmarybackup replcatons wth temporal consstency guarantees. In Proc. ICDCS, pages 48{56, May 1998.