Federated Transaction Management with Snapshot Isolation

Transcription

1 Federated Trasactio Maagemet with Sapshot Isolatio Ralf Schekel, Gerhard Weikum Norbert Weißeberg Xuequ Wu Uiversity of the Saarlad Frauhofer ISST Deutsche Telekom AG Abstract Federated trasactio maagemet (also kow as multidatabase trasactio maagemet i the literature) is eeded to esure the cosistecy of data that is distributed across multiple, largely autoomous, ad possibly heterogeeous compoet databases ad accessed by both global ad local trasactios. While the global atomicity of such trasactios ca be eforced by usig a stadardized commit protocol like XA or its CORBA couterpart OTS, global serializability is ot self-guarateed as the uderlyig compoet systems may use a variety of potetially icompatible local cocurrecy cotrol protocols. The problem of how to achieve global serializability, by either costraiig the compoet systems or implemetig additioal global protocols at the federatio level, has bee itesively studied i the literature, but did ot have much impact o the practical side. A major deficiecy of the prior work has bee that it focused o the idealized correctess criterio of serializability ad disregarded the subtle but importat variatios of SQL isolatio levels supported by most commercial database systems. This paper recosiders the problem of federated trasactio maagemet, more specifically its cocurrecy cotrol issues, with particular focus o isolatio levels used i practice, especially the popular sapshot isolatio provided by Oracle. As poited out i a SIGMOD 1995 paper by Bereso et al., a rigorous foudatio for reasoig about such cocurrecy cotrol features of commercial systems is sorely missig. The curret paper aims to close this gap by developig a formal framework that allows us to reaso about local ad global trasactio executios where some (or all) trasactios are ru uder sapshot isolatio. The paper derives criteria ad practical protocols for guarateeig global sapshot isolatio at the federatio level. It further geeralizes the wellkow ticket method to cope with combiatios of isolatio levels i a federated system. 1 Itroductio 1.1 Revivig the Problem of Federated Trasactios With the ever-icreasig demad for iformatio itegratio both withi ad across eterprises, there is reewed iterest i providig seamless access to multiple, idepedetly developed ad largely autoomously operated databases. Such a settig is kow as a database federatio or heterogeeous multidatabase system. More specifically, the approach of buildig a additioal itegratio software layer o top of the uderlyig compoet systems is referred to as a federated database system [LMR90, SL90, HBP93, BE96, Cor97, ÖV98]. Amog the challeges posed by such a system architecture is the problem of eforcig the cosistecy of the data across the boudaries of the idividual compoet systems. Trasactios that access ad modify data i more tha oe compoet system are referred to as federated or global trasactios [BGS92, BGS95]; for example, a electroic commerce applicatio could require a trasactio to update data i a merchat s database as well as the databases of a credit card compay ad a service broker that poited the customer to the merchat ad requests a provisioig fee for each sale. Providig the usual ACID properties for such federated trasactios is iheretly harder tha i a homogeeous, cetrally admiistered distributed database system, oe reaso beig that the uderlyig compoet systems of a federatio may employ differet protocols for their local trasactio maagemet. A caoical example is the followig schedule of three trasactios, t 1, t 2, ad t 3, that read ad write data

2 objects x, y, ad z i two databases, DB 1 ad DB 2, maaged by two differet database systems (or differetly cofigured istaces of the same database system) with differet cocurrecy cotrol protocols: DB 1 r 1 (x) w 1 (x) C 1 r 2 (x) w 2 (x) C 2 DB 2 : r 3 (y) r 1 (y) w 1 (y) C 1 r 2 (z) w 2 (z) C 2 r 3 (z) C 3 Both local schedules, as see by each of the two compoet systems aloe, are serializable, but the problem is that the resultig serializatio orders are icompatible from a global viewpoit. I DB 1, the serializatio order requires that t 1 precede t 2, whereas i DB 2, the oly possible serializatio order is the oe i which t 2 precedes t 3 ad t 3 precedes t 1. Thus, the overall executio of the three trasactios is ot globally serializable ad may potetially result i data icosistecies. These kids of problems with regard to federated trasactios have bee itesively studied i the late eighties ad early ieties. The proposed solutios rage from imposig additioal costraits o the trasactio protocols of the uderlyig compoet systems to buildig a additioal trasactio maager i the federated software layer o top of the compoet systems to recocile or cotrol the uderlyig local executios. The most otable result i the first category probably is that global serializability is self-guarateed if all compoet systems allow oly coflict-serializable schedules where the commit order coicides with the serializatio order [BGRS91, BS92, Raz92, Weihl89], with rigorous schedules beig the most importat special case [BGRS91]. I the secod category, the family of ticket methods [GRS94] has bee amog the most promisig approaches, complemetig kowledge about local serializatio orders with graph-cycle testig at the federatio level. All this ample work has led to iterestig theoretical isights, but appears to have made little impact o the practical side. Cosequetly, the subject of federated trasactios has ot bee pursued further by the research commuity i the last few years. The curret paper aims to revive the subject, pushig it i a ew ad practically relevat directio. We believe that the prior work has ot succeeded i the iteded techology trasfer because it made some fudametal assumptios that did ot match the typical settig of commercial database systems ad their real-life applicatios. Essetially, the prior work made too liberal assumptios o the recovery protocols of practically used systems, ad it made too restrictive assumptios o their local cocurrecy cotrol protocols: O the recovery side, the poit that the uderlyig compoet systems are largely autoomous ad may therefore ot ecessarily be willig to cooperate for esurig the atomicity of global trasactios has bee way overrated. Today, stadardized distributed commit protocols like XA or its CORBA couterpart OTS [OMG97] are supported by virtually all commercially relevat database systems, request brokers (TP moitors, ORBs, etc.), ad eve packaged busiess-object software systems. Rather tha buildig complex recovery protocols at the federatio level, it is much easier ad more maageable to rely o those protocols for global atomicity. For log-ruig workflow-style applicatios, a distributed commit protocol would admittedly icur severe performace problems, but for reasoably short federated trasactios (e.g., the kid that arises i electroic commerce applicatios) it is a perfectly viable solutio. O the cocurrecy cotrol side, virtually all prior work assumed that the compoet systems would guaratee at least coflict-serializability for their local schedules. I real life, however, various kids of isolatio levels are provided by commercial database systems ad widely used by performace-coscious applicatio developers. These iclude the isolatio levels of the SQL stadard, such as read committed (kow as cursor stability

3 i some commercial systems), as well as vedor-specific optios like Oracle s sapshot isolatio feature. Noe of the prior work o federated trasactio maagemet has take these isolatio level optios ito accout, despite their udebatable practical relevace. Eve worse, there is geerally a wide gap i the theoretical foudatio of trasactio maagemet as far as such cocurrecy tuig optios are cocered. To our kowledge, the oly exceptios are the remarkable paper by Bereso et al. [BBGM+95], discussig SQL-stadard as well as vedor-specific isolatio levels from a coceptual viewpoit without truly foudatioal ambitios, however, ad the work by Atluri et al. [ABJ97] extedig the classical serializability theory to icorporate weaker isolatio levels from a formal ad rather abstract viewpoit. Both papers restrict themselves to a cetralized database settig. 1.2 Cotributio ad Outlie of the Paper The curret paper aims to arrow the aforemetioed gap i the foudatio of trasactio maagemet, while also pursueig practically viable solutios for federated trasactio maagemet i the presece of isolatio levels differet from stadard serializability. We essetially cocetrate o cocurrecy cotrol issues, disregardig recovery for the fact that stadardized distributed commit protocols like XA ad OTS ca esure global atomicity across system boudaries, as discussed above. We focus o covetioal types of trasactios, the key problem beig their federated, heterogeeous ature, ad do ot address workflow-style activities that may ru for hours or days. Further ote that the problem of federated cocurrecy cotrol arises eve if the same database system is used for all compoet databases of the federatio, sice the system may be cofigured with differet isolatio level optios for differet databases (ad trasactio classes). Our approach is largely drive by cosiderig the capabilities of commercial systems. I particular, Oracle provides iterestig optios that are fairly represetative for the subtle but importat deviatios from the pure school of serializability theory. Like several other commercial systems, Oracle supports trasiet versioig for ehaced cocurrecy, ad exploits versios, by meas of a timestamp-based protocol, to offer the followig two isolatio level optios [Orac95, Orac97]: 1. A trasactio ru uder the read committed optio reads the most recet versios of the requested data objects that were committed at the time whe the read operatio is issued. Note that these read accesses to committed versios ca proceed without ay lockig. All updates that the trasactio may ivoke are subject to exclusive lockig of the affected data objects, ad such locks are held util the trasactio s commit. 2. For trasactios ru uder the sapshot isolatio level, all operatios read the most recet versios as of the time whe the trasactio bega, thus esurig a cosistet view of the data through the trasactio. A particularly beeficial special case is that all readoly trasactios are perfectly isolated i the sese of the multiversio serializability theory [BHG87]. For read-write trasactios, o the other had, the sketched protocol caot esure (multiversio) serializability. I additio, Oracle performs the followig check upo commit of a trasactio: if ay data object writte by the trasactio has bee writte by aother, already committed trasactio that ra cocurretly to the cosidered oe (i.e., committed after the cosidered trasactio bega), the the curret trasactio is aborted ad rolled back. Additioally, exclusive locks are used for updates ad held util the trasactio s commit. If a trasactio has to wait for a lock ad the trasactio holdig that lock commits, the waitig trasactio is aborted. This is a special case of the committime test, allowig prevetio of cocurret writes before they happe.

4 Disallowig cocurret writes aims to provide a additioal level of saity, ad Oracle eve advocates this optio uder the ame serializability. Noetheless, the protocol caot esure full (multiversio) serializability, with the followig schedule as a couterexample (x i deotes the versio of x geerated by trasactio t i, ad t 0 is a fictitious iitializig trasactio): r 1 (x 0 ) r 1 (y 0 ) r 2 (x 0 ) r 2 (y 0 ) w 1 (x 1 ) C 1 w 2 (y 2 ) C 2 The example may lead to icosistet data, for example, violatig a costrait such as x + y < 100 although both trasactios aloe would eforce the costrait. However, give that such aomalies are very ifrequet i practice, the protocol is widely popular i Oracle applicatios. As poited out by Bereso et al. [BBGM+95], such o-serializable isolatio levels, ad especially the sapshot isolatio optio, are extremely useful i practice, despite their lack of theoretical uderpiigs. Sice Oracle would obviously be a major player also i a federated database settig, we cocetrate i this paper o uderstadig the impact of sapshot isolatio for federated trasactio maagemet. I fact, the work preseted here is part of a larger effort to build a federated database architecture, coied VHDBS, that curretly supports Oracle ad O2 databases [Wu96, HWW98, SW99]. The paper s pla of attack proceeds i three steps, leadig to the followig cotributios: We develop a formal model that allows us to reaso about isolatio levels i the cotext of federated trasactios, ad we derive results that relate local ad global isolatio levels. Sice sapshot isolatio exploits trasiet versioig, all our formal cosideratios are cast i a multiversio schedule framework. Based o these theoretical results, we develop ew algorithms for federated cocurrecy cotrol, to esure global sapshot isolatio or global (coflict-) serializability, whatever the applicatio demads. The latter algorithm is based o a geeralizatio of the ticket method to cope with compoet systems that provide sapshot isolatio. The rest of the paper is orgaized as follows. I Sectio 2, we itroduce the basic model ad otatios, ad we develop the theoretical uderpiigs for copig with sapshot isolatio i cocurret trasactio executios. I Sectio 3, we derive results o how to relate the isolatio levels i local schedules with the desired correctess criteria at the federatio level, ad develop a algorithm for esurig global sapshot isolatio uder the assumptio that all compoet systems guaratee local sapshot isolatio. Sectio 4 develops a practically viable protocol to guaratee global serializability i a federated system with some compoet systems providig sapshot isolatio, extedig ad geeralizig the ticket method of [GRS94]. We coclude the paper with a outlook o future work. All proofs of theorems are give i the paper s Appedix. 2 Basic Model ad Notatio This sectio itroduces the formal apparatus that is ecessary for our study of sapshot isolatio. We briefly itroduce the otatio ad some results of the stadard theory of (multiversio) serializability i Subsectio 2.1, ad the develop a formal characterizatio of sapshot isolatio i Subsectio 2.2.

5 2.1 Prelimiaries Defiitio: (trasactio) A trasactio t i is a sequece, i.e., total order <, of read ad write actios o data objects from oe or more databases, alog with a set of begi ad commit actios, oe for each database accessed by t i, such that all begi actios precede all read ad write actios i the order < ad all commit actios follow all other actios w.r.t. <. The readset ad writeset of t i are the sets of objects for which t i icludes read ad write actios, respectively. We deote the j-th read or write step of t i by a ij (x) where x is the accessed object, or r ij (x) (for reads) ad w ij (x) (for writes) whe the kid of actios is relevat. Whe we wat to idicate the database to which a step refers, we exted the otatio for a actio as follows: a (k) ij (x) deotes the j-th step of trasactio t i accessig object x that resides i database DB k. The begi ad commit actios for database DB k, explicitly deoted wheever they are relevat, are writte as B (k) i ad C (k) i, respectively. For all trasactios, we further restrict the sequece of read ad write accesses to allow a write o object x oly if there the trasactio icludes also a read o x that precedes the write i the actio order <. Furthermore, we allow at most oe read ad at most oe write o the same object withi a sigle trasactio. Noe of these two properties preset serious restrictios of the executios that we ca model; i practice, writes are usually preceded by reads, ad multiple reads or writes to the same object ca be easily elimiated by usig temporary program variables. Note that we do ot cosider partial orders withi a trasactio for the sake of simpler otatio, although this relaxatio could be icorporated i the model quite easily. Similarly, disallowig multiple reads or writes o the same object is also oly a matter of otatio. The oly sematically relevat restrictio of our model is that we do ot cosider trasactio aborts ad assume all trasactios to be committed. This paper addresses federated cocurrecy cotrol; extesios to icorporate recovery issues i the formal model would be the subject of future work. Defiitio: (global ad local trasactios) A global trasactio (GT) is a trasactio that accesses objects from at least two differet databases. I cotrast, a local trasactio (LT) accesses oly a sigle database. The projectio of a global trasactio t i oto a database DB k is the set of actios of t i that refer to objects from DB k, alog with their correspodig order <. This projectio will be referred to as a global subtrasactio (GST) ad deoted by t (k) i. Note that the dichotomy betwee GTs ad LTs is a purely sytactic oe i our defiitio. I practice, a additioal key differece is that LTs are ot routed through a additioal federatio software layer but rather access a database directly through the ative database system ad othig else. Defiitio: (schedule, multiversio schedule, mooversio schedule) A schedule of trasactios T={t 1,...} is a sequece, i.e., total order <, of the uio of the actios of all trasactios i T such that the actio orderig withi trasactios is preserved. A multiversio schedule of trasactios T={t 1,...} is a schedule with a additioal versio fuctio that maps each read actio r i (x) i the schedule to a write actio w j (x) that precedes

6 the read i the order <. The read actio is the also writte as r i (x j ) with x j deotig the versio created by the write of t j. A mooversio schedule of trasactios T={t 1,...} is a multiversio schedule whose versio fuctio maps each read actio r i (x) to the most recet write actio w j (x) that precedes it (i.e., w j (x) < r i (x) ad there is o other write actio o x i betwee). The usual correctess criterio for multiversio cocurrecy cotrol is that a give multiversio schedule should be view-equivalet to a serial mooversio schedule, with viewequivalece beig defied by the reads-from relatio amog the actios of a schedule [BHG87, Pa86]. Defiitio: (MVSR) A multiversio schedule s is multiversio serializable (MVSR), if it is view-equivalet to a mooversio serial schedule. Defiitio: (versio order, MVSG) Give a multiversio schedule s ad a object x, a versio order is a total order of the versios of x i s. A versio order for s is the uio of the versio orders for all objects. Give a multiversio schedule s ad a versio order for s, the multiversio serializatio graph for s ad, MVSG(s, ), is the directed graph with the trasactios as odes ad the followig edges: For each operatio r j (x i ) i the schedule there is a edge t i t j (WR pair). For each pair of operatios r k (x j ) ad w i (x i ) where i, j ad k are distict, there is a edge (i) t i t j, if x i x j (WW pair), (ii) t k t i, if x j x i (RW pair). The followig theorem is the most importat characterizatio of MVSR by meas of the MVSG, servig as the basis for correctess proofs of practical multiversio cocurrecy cotrol protocols (see, e.g., [BHG87]). Theorem: (characterizatio of MVSR [BHG87]) A multiversio schedule s is i MVSR if ad oly if there exists a versio order such that MVSG(s, ) is acyclic. Whe we cosider oly (o-serial) mooversio schedules (for which each write is preceded by a read of the same trasactio) ad wish to reaso about their correctess, the criterio of MVSR automatically degeerates ito the well-kow otio of coflict-serializability (SR) [Pa86]. This results from the restrictio of the versio fuctio. So with this restrictio, MVSR becomes equivalet to the stadard defiitio of coflict-serializability (SR) based o read-write, write-write, ad write-read coflicts (ad the correspodig coflict-graph costructio. 2.2 Formalizig the Sapshot Isolatio Level (SSI) So far we have itroduced the traditioal apparatus of multiversio serializability. We are ow ready to discuss relaxatios, i the sese of isolatio levels, withi this model. I this paper we cocetrate o the situatio where a etire schedule satisfies a certai relaxed isolatio level. The geeral case where oly a specific subset of trasactios tolerates a relaxed isola-

7 tio level ad the rest of the schedule should still be serializable or MVSR is the subject of future work. Defiitio: (sapshot isolatio) A multiversio schedule of trasactios T={t 1,...} satisfies the criterio of sapshot isolatio (SSI) if the followig two coditios hold: (SSI-V) SSI versio fuctio: The versio fuctio maps each read actio r i (x) to the most recet committed write actio w j (x) as of the time of the begi of t i, or more formally: r i (x) is mapped to w j (x) such that w j (x)<c j <B i <r i (x) ad there are o other actios w h (x) ad C h (h j) with w h (x)<b i ad C j <C h <B i. (SSI-W) disjoit writesets: The writesets of two cocurret trasactios are disjoit, or more formally: if for two trasactios t i ad t j, either B i <B j <C i or B j <B i <C j, the t i ad t j must ot write a commo object x. SSI is weaker tha MVSR i the sese that it allows o-serializable schedules, for example the followig: r 1 (x 0 ) r 1 (y 0 ) r 2 (x 0 ) r 2 (y 0 ) w 1 (x 1 ) w 2 (y 2 ) C 1 C 2 This schedule satisfies both (SSI-V) ad (SSI-W), but it is ot equivalet to a serial mooversio schedule. O the other had, SSI is ot a superset of MVSR, because there are serializable multiversio schedules that are ot i SSI, for example r 1 (x 0 ) r 2 (y 0 ) w 2 (y 2 ) C 2 r 1 (y 2 ) w 1 (y 1 ) C 1 This schedule is ot i SSI because r 1 (y) is mapped to w 2 (y 2 ) rather tha w 0 (x 0 ), ad because t 1 ad t 2 are cocurret ad write the same object y. It is, however, equivalet to the serial mooversio schedule r 2 (y) w 2 (y) C 2 r 1 (x) r 1 (y) w 1 (y) C 1 The key poit here is that this schedule uses a versio fuctio differet from the SSI versio fuctio. We ow characterize the SSI membership of a give multiversio schedule by the absece of cycles i a graph. Defiitio: (SSI versio order) The SSI versio order s is the order that is iduced by the order of the commit operatios of the trasactios that wrote the versios, or more formally: x i s x j : C i < C j Defiitio: (SSI-MVSG) The SSI multiversio serializatio graph SSI-MVSG for a give multiversio schedule s satisfyig the property (SSI-V) is a directed graph with the trasactios as odes ad the followig edges: For each operatio r j (x i ) i the schedule there is a edge t i t j, labeled with x (WR pair). For each pair of operatios r k (x j ) ad w i (x i ), there is a edge (i) t i t j, if x i s x j (WW pair),

8 (ii) t k t i, if x j s x i (RW pair), labeled with x i both cases. Edges i the graph that are labeled with x are called x-edges. A cycle i the graph that cosists completely of x-edges is called a x-cycle. SSI-MVSG is exactly the same as the usual multiversio serializatio graph MVSG defied above, exteded by the edge labels. Similarly to the MVSG theorem cited i Subsectio 2.1, the followig theorem gives a characterizatio for schedules that are sapshot isolated: Theorem 1: (Equivalece of SSI ad cycle-free SSI-MVSG) A multiversio schedule satisfyig (SSI-V) is a) i MVSR, if ad oly if its correspodig SSI-MVSG is acyclic, b) i SSI, if ad oly if there is o object x such that the SSI-MVSG has a x-cycle As a example, cosider the two schedules s 1 := r 1 (x 0 ) r 1 (y 0 ) r 2 (x 0 ) r 2 (y 0 ) w 1 (x 1 ) w 2 (y 2 ) C 1 C 2 s 2 := r 1 (x 0 ) r 1 (y 0 ) r 2 (x 0 ) r 2 (y 0 ) w 1 (x 1 ) w 2 (x 2 ) C 1 C 2 s 1 is i SSI while s 2 is ot (the trasactios are cocurret ad both write x). For both schedules, the correspodig SSI-MVSG, show i Figure 1, cotais a cycle; thus either of the two schedules is MVSR. But oly the MVSG for s 2 (o the right of Figure 1) cotais a cycle that cosists solely of edges labeled by the same object x. So s 2 is ot SSI whereas s 1 is SSI. t 0 x,y x,y x t 1 t 2 y t 0 x,y x,y x t 1 t 2 x Figure 1 - SSI-MVSG for two schedules 3 Guarateeig Global Sapshot Isolatio 3.1 The Problem of Global Sapshot Isolatio The goal of this sectio is to derive ecessary ad sufficiet coditios for schedules of federated trasactios to be globally SSI, provided that all uderlyig compoet systems geerate oly schedules that are locally SSI. I the followig, we assume that all federated trasactios employ a atomic commit protocol (ACP) across the affected compoet systems with a coceptually cetralized coordiator such that the relative order of the local commit operatios of differet global trasactios is the same i all compoet systems (i.e., if t i commits before t j i DB 1, the t i must commit before t j i DB 2 etc. as well) ad the local commit operatios are totally ordered amog all trasactios, i.e., o two commit operatios happe cocurretly. With these assumptios, the local commit operatios of a trasactio ca be safely replaced by the global commit operatio i all local schedules.

9 The followig example shows that it is ot at all trivial to guaratee global SSI eve if all compoet systems eforce local SSI. DB 1 : r (1) 1 (a 0 ) r (1) 2 (x 0 ) w (1) 2 (x 2 ) C 2 r (1) 1 (x 0 ) C 1 DB 2 : r 2 (2) (y 0 ) w 2 (2) (y 2 ) C 2 r 1 (2) (y 2 ) w 1 (2) (y 1 ) C 1 I database DB 1, the subtrasactios t (1) 1 ad t (1) 2 of the two global trasactios t 1 ad t 2 ru cocurretly, so they both read from a prior trasactio (here this is the fictitious, iitializig trasactio t 0 ). Oly t (1) 2 writes a object. This subschedule therefore is SSI. The other subschedule, i database DB 2, is SSI, too: the two subtrasactios t (2) (2) 1 ad t 2 ru serially ad they both read the correct values accordig to the SSI versio fuctio. However, combiig the two subschedules ito a global schedule (with database superscripts omitted) yields: r 1 (a 0 ) r 2 (x 0 ) w 2 (x 2 ) r 2 (y 0 ) w 2 (y 2 ) C 2 r 1 (x 0 ) r 1 (y 2 ) w 1 (y 1 ) C 1 This schedule is ot i SSI: t 1 reads y from t 2 rather tha t 0 (so (SSI-V) does ot hold), ad both trasactios ru cocurretly ad both write y (so (SSI-W) does ot hold either). The problem lies i the fact that the local scheduler i DB 2 does ot kow whe t 2 started at the global federatio level, so it fails to assig the globally correct versios, restrictig itself to local correctess. Aalogous argumets hold for the cosideratio of global writesets versus local writesets ad global cocurrecy versus local cocurrecy. The followig two subsectios preset two algorithms that overcome these problems ad guaratee that the global schedule is SSI. The first, pessimistic approach, discussed i Subsectio 3.2, achieves its objective by sychroizig the local begi operatios of trasactios (i additio to the implicit sychroizatio of the local commits that results from the ACP). The secod, optimistic approach, discussed i Subsectio 3.3., is based o testig the potetial violatio of global SSI. 3.2 Pessimistic Approach: Sychroizig Subtrasactio Begis A idea towards a globally correct executio is to start all local subtrasactios t (k) i upo the first operatio of the global trasactio t i. The ituitio behid this is that we wat all subtrasactios of a global trasactio to have the same start time as the global trasactio i the global schedule. If we ca achieve this, ay violatio of the SSI property of the global schedule could be mapped to a correspodig violatio i oe of the local schedules, ad the latter would be preveted by the fact that all local schedulers geerate SSI schedules. The obvious way to simultaeously start the local subtrasactios is by issueig a explicit local begi i each compoet system DB k o which the trasactio will possibly issue read or write operatios. Ufortuately, this aloe does ot etirely solve the problem. It may occur that a global trasactio t 1 commits while aother trasactio t 2 is i the process of submittig its local begi operatios. If i some database the begi operatio is executed before the commit of t 1 ad this order is reversed i aother database, global SSI property ca still ot be guarateed. The followig part of a schedule illustrates this problem: DB 1 : r (1) 1 (x 0 ) w (1) 1 (x 1 ) B (1) 2 C 1 r (1) 2 (x 0 ) C 2 DB 2 : r (2) 1 (y 0 ) w (2) (2) 1 (y 1 ) C 1 B 2 r (2) 2 (y 1 ) w (2) 2 (y 2 ) C 2 This executio is ot globally SSI. However, both local schedules are SSI, so merely addig the local begi operatios did ot fix the problem. Obviously, the above problem arises because a global commit is executed i betwee several local begi operatios of the same federated trasactio. So we eed to delay the commit request of a global trasactio whe aother trasactio is executig its begi operatios, util

10 all local begi operatios have retured. Likewise, we have to delay the begi operatios if aother trasactio is already i the process of committig, util the commit is fiished. With this kid of begi sychroizatio ad the implicit sychroizatio by the ACP, we ca ow assume that all subtrasactios of a global trasactio t i start at the same time B i ad ed at the same time C i i all uderlyig compoet systems. Therefore, the versio fuctios of the various compoet systems are sychroized as well. This cosideratio leads us to a criterio for globally correct executio, as expressed by the followig theorem. Theorem 2: Let s be a schedule i a federated database system whose compoet systems guaratee local SSI for the local schedules (ad with a ACP based o a coceptually cetralized coordiator). If each federated trasactio issues local begi operatios o each potetially accessed compoet system ad the federatio level prevets global commit operatios from beig cocurretly executed with a trasactio s set of local begi operatios, the s is SSI. This approach is relatively easy to implemet, but it has potetial performace problems: At the start time of a federated trasactio, it is ot ecessarily kow which compoet systems the trasactio may access durig its executio (or ca this iformatio be easily iferred from the trasactio program). To be o the safe side, local begi operatios would have to be executed i a coservatively chose set of compoet systems if ot eve all compoet systems of the federatio. Although each of the local begi operatios is fairly iexpesive, the total overhead may icur a sigificat pealty i terms of the trasactio throughput. Eve worse, sice global commit operatios may have to be delayed by begi operatios, there is also a potetially severe performace drawback as far as trasactio respose time is cocered. 3.3 Optimistic Approach: Testig for Global SSI Violatios Lookig agai at the example i the previous Subsectio 3.2, we observe a specific situatio: the two trasactios are cocurret i oe database (DB 1 ), while havig a reads-from relatioship i the serial executio i the other database (DB 2 ). This type of situatio is i fact the oly case whe global SSI ca be violated despite all compoet systems eforcig local SSI. Note that the cocurret executio i oe database implies that the writesets of the two trasactios must be disjoit because of the local SSI property. However, this cocurret executio may result i a versio fuctio that is icompatible with the versio fuctio of the secod compoet system. Further ote that i the compoet system where the subtrasactios are cocurret, o reads-from relatioship is possible betwee the two trasactios. So it seems that all we eed to do is to avoid that two trasactios are a) cocurret i oe database ad b) have a (serial) reads-from relatioship i aother database. Ufortuately, the followig example shows that this cosideratios does still ot capture all relevat cases, as it disregards schedules where oe trasactio accesses oly a proper subset of the databases accessed by the other trasactio (e.g., oly oe out of DB1 ad DB2): DB 1 : r (1) 1 (a 0 ) C 1 DB 2 : r (2) 2 (x 0 ) w (2) 2 (x 2 ) C 2 r (2) 1 (x 2 ) w (2) 1 (x 1 ) C 1 This global schedule is ot SSI, because both trasactios are cocurret ad write the same object x. However, our above cosideratio does ot capture this uacceptable case, because all operatios of t 1 are strictly after those of t 2 i DB 2, ad t 2 does ot have ay operatios i DB 1. I the approach of the previous Subsectio 3.2 with sychroized begi operatios, such a executio would be impossible because the local begi operatio of t 1 i DB 2 would make

11 t 1 locally start before t 2 so that t 1 would read x 0 rather tha x 2. However, the sychroized begi operatios would have performace drawbacks that we would like to avoid i the curret approach. Here, to fix the above problem, we first exted our model of a schedule by itroducig additioal pseudo-operatios B (k) i ad C (k) i for each trasactio t i ad each database DB k that is ot accessed by t i. The orderig of the artificial C (k) i operatios is such that it is compatible with all real commit operatios i the other databases ad arbitrary with regard to read ad write operatios, ad the artificial B (k) i operatios are placed immediately before the correspodig local commit. Ulike the local begi operatios of the previous Subsectio 3.2, the ewly itroduced operatios here are ideed oly placeholders for the purpose of correctess reasoig about federated schedules; they do o have to be issued i the real system. The et effect of this sytactical extesio is that we ca ow easily tell, i our model, for each (k) pair of trasactios t i ad t j ad each DB k if t i fully precedes t (k) j, deoted t (k) i < t (k) j (or more precisely: C (k) i < B (k) j ), or if t (k) j fully precedes t (k) i, or if t (k) i ad t (k) j are cocurret, the latter beig deoted as t (k) i t (k) j. Theorem 3: (characterizatio of the global SSI versio fuctio) Let s be a schedule, exteded i the above way, that is executed i a federated database system (usig a ACP) whose compoet systems guaratee local SSI. The versio fuctio of s, that is, the uio of the versio fuctios of the uderlyig local schedules, satisfies (SSI-V) if ad oly if there are o two trasactios t i ad t j ad o two databases DB k ad DB l such that t (k) i < t (k) j, t (k) j reads from t (k) i, ad t (l) (l) i t j. From this ecessary ad sufficiet coditio for a global schedule to satisfy (SSI-V), we ca further derive the followig theorem that tells us whe a global schedule is SSI. Theorem 4: (sufficiet ad ecessary coditio for global SSI) Let s be a exteded schedule i a federated database system (usig a ACP) whose compoet systems guaratee local SSI. The s is SSI if ad oly if there are o two trasactios t i ad t j ad o two databases DB k ad DB l such that t (k) i < t (k) j, t (k) j reads from t (k) i, ad t (l) i t j (l)ṅ This theorem forms the basis of a algorithm to eforce global SSI, uder the assumptio that all compoet systems guaratee local SSI. The idea is to moitor the three coditios of the theorem ad take appropriate actios at the federated level whe all three are cojuctively violated for a pair of trasactios. Moitorig the property whether two trasactios execute serially or cocurretly i oe compoet system is straightforward. Moitorig the readsfrom relatioship, however, is very difficult if ot ifeasible i a practical system settig. The problem is that we caot tell by merely observig the operatio requests ad replies at a compoet system s iterface which versio, idetified by the creatig trasactio s umber, was read by a read operatio. So we eed to build a actual algorithm for global SSI o a coarser versio of Theorem 4 where the reads-from coditio is omitted ad thus the set of allowed schedules is restricted eve further. Corollary 1: (sufficiet coditio for global SSI) Let s be a exteded schedule i a federated database system (usig a ACP) whose compoet systems guaratee local SSI. The s is SSI if there are o two trasactios t i ad t j ad o two databases DB k ad DB l such that t i (k) < t j (k) ad t i (l) t j (l). So for global SSI to hold, the situatio to be disallowed is that the subtrasactios of two global trasactios are ruig cocurretly i oe database ad serial i aother oe, regard-

12 less of whether oe trasactio reads from the other trasactio or ot. This leads to the followig algorithm for esurig the SSI property of global schedules. I the federatio layer, we assig a uique timestamp B (k) i to the subtrasactio of trasactio t i i database DB k before it issues its first operatio there. This does ot require ay additioal operatio o the compoet system, oly some bookkeepig by at the federatio level. Whe trasactio t i requests its global commit, we assig a timestamp C i to it. I additio, we keep iformatio about the relative executio order of subtrasactios i a array R[i,j], where (k) serial, if there is a database DB k where C i < B j R[i,j] = cocurret, if there is a database DB k where B i (k) < B j (k) < C i or B j (k) < B i (k) < C j udefied, if at least oe of the trasactios has ot yet submitted ay operatio Iitially, there are o trasactios i the system, so R is empty. Oce a trasactio t i eters the system, all the B (k) i ad C i values are set to, ad R[i,j]=R[j,i]=udefied for all active trasactios t j. Upo the first operatio of trasactio t i i database DB k, the timestamp B (k) i is assiged ad R is updated as follows: for all trasactios t j i the system do if (C j < B i (k)) the // serial executio if (R[i,j]=cocurret) the abort t i else R[i,j] := R[j,i] := serial (k) else if (B j < B i (k)) the // cocurret executio if (R[i,j]=serial) the abort t i else R[i,j] := R[j,i] := cocurret Whe trasactio t i attempts to commit, our bookkeepig eeds to add pseudo operatios for each database DB k that t i has ot accessed at all. To do so, we set B (k) i =C i ad update R as if t i just submitted a operatio to this database. If addig these pseudo operatios does ot force t i to abort, we allow it to commit. Obviously this algorithm ca cause uecessary aborts, sice it does ot take ito accout the actual reads-from relatioship. However, as oted before, this is a iescapable cosequece of the fact that the federatio layer caot easily observe the details of the local executios i a real-life system settig. Despite this drawback of possibly uecessary aborts, the algorithm appears to be sigificatly more efficiet tha the begi-sychroizatio approach of the previous Subsectio 3.2. I particular, the preseted algorithm icurs overhead oly for those compoet systems that are actually accessed, ad does ot delay ay begi or commit requests. 3.4 Remarks O Global Sapshot Isolatio with No-SSI Compoet Systems I the previous two subsectios we have show how to guaratee global SSI whe all compoet systems guaratee local SSI. It would, of course, also be a desirable optio to eforce global SSI eve if some compoet systems may support a correctess criterio other tha local SSI. A particularly iterestig combiatio would be oe database supportig local SSI ad aother database supportig stadard coflict-serializability. Assume that a compoet system guaratees coflict-serializability i combiatio with the avoidace of cascadig aborts (ACA). The the first read operatio of a trasactio establishes a reads-from relatioship that costrais the feasibility of subsequet reads if we wat to guaratee that the resultig schedule is also locally SSI (i.e., actually a member of the schedule class SR ACA SSI). The trasactio must ot read ay data that are committed later tha at the time of that first read. Brute-force methods to eforce this costrait are coceivable (e.g., by abortig all trasactios that iitiate a commit betwee our trasactio s first read ad its commit), but it is very likely that they restrict the possible cocurrecy i a udue maer. This problem

13 aloe has discouraged us from proceedig further alog these lies. I additio, oe would have to esure that the versio fuctios of the differet local schedules are compatible ad that writesets of cocurret trasactios are disjoit, both at the level of global trasactios. Obviously, this settig calls for future research. 4 Guarateeig Global Serializability Although SSI is a popular optio i practice, there are certaily may missio-critical applicatios that still demad the more rigid correctess criterio of global (coflict-) serializability (SR). I this sectio, we study the problem of esurig global SR i the presece of compoet systems that merely provide SSI. We develop a algorithm that exteds the well-kow ticket method [BGRS91, GRS94] so that it supports local SSI schedulers, while guarateeig global SR. I Subsectio 4.1, we briefly review the stadard ticket method ad discuss its beefits ad potetial shortcomigs. I Subsectio 4.2, we show that, with a mior extesio, the ticket method yields correct executios eve whe applied to local SSI schedulers, but poit out that this approach has certai severe drawbacks. I Subsectio 4.3, we fially preset a geeralizatio of the ticket method that icreases performace for applicatios with a large fractio of read-oly (sub-)trasactios. 4.1 Beefits ad Potetial Shortcomigs of the Ticket Method A ticket is a dedicated data object of type couter (or some other umerical type) i a compoet, used solely for the purpose of global cocurrecy cotrol. Each global subtrasactio must read the curret value of the ticket ad write back a icreased value at some poit durig its executio (the so-called take-a-ticket operatio). The orderig of the ticket values read by two global subtrasactio reflects the local serializatio order of the two subtrasactios. A ticket graph is maitaied at the federatio level to detect icompatible local serializatio orders. This graph has the global trasactios as odes, ad there is a edge from trasactio t i to trasactio t j if the ticket of t i is smaller tha that of t j i some compoet database. It has bee show i [GRS94] that the global schedule is serializable if ad oly if the ticket graph does ot cotai a cycle, provided that all compoet systems geerate oly locally SR schedules. This method is easy ad efficiet to implemet; oe merely eeds to add the take-a-ticket operatio to each subtrasactio ad to maage the global ticket graph, i.e., searchig for cycles whe a global trasactio attempts to commit (or at some earlier poit). Upo detectig a cycle, oe (or more) of the ivolved trasactios must be aborted. For compoet systems with the property of allowig oly rigorous local schedules, it is ot eve ecessary to take a ticket at all; rather the time of the commit operatio ca be used as a implicit ticket. So the ticket method has the particularly ice property of icurrig overhead oly for o-rigorous compoet systems, eve with trasactios that access both rigorous ad o-rigorous compoet systems. This makes the ticket method a very elegat ad versatile algorithm for federated cocurrecy cotrol. The ticket method has two potetial problems, however. First, the ticket object may be a potetial bottleeck i a compoet database, sice all global subtrasactios have to read ad write the ticket. Secod ad much more severely, havig to write the ticket turs read-oly trasactios ito read-write trasactios, thus prevetig the possibility of specific optimizatios for read-oly (sub-) trasactios (e.g., Oracle s Set Trasactio Read Oly optio).

14 4.2 Applyig the Ticket Method to SSI Compoet Systems The stadard ticket method requires that local schedulers geerate (coflict-) serializable schedules. Thus, it is ot clear if the method ca icorporate compoet systems that provide o-serializable SSI schedules. Cosider the effects of the additioal take-a-ticket operatio to the executio of global subtrasactios o a SSI compoet system. For each pair of cocurret global subtrasactios o such a database, both write at least oe commo object, the ticket, so that oe of them must ievitably be aborted to esure local SSI. The resultig local schedule is therefore trivially serializable, because it is i fact already serial, ad the orderig of the ticket values of two global subtrasactios reflects their local serial(izatio) order. Note that this does ot make the etire global trasactios serial; cocurrecy is still feasible i other (o-ssi, but SR) databases. Nevertheless, sequetializig all global subtrasactios i a SSI compoet system is a dramatic loss of performace ad would usually be cosidered as a overly high price for global cosistecy. What about local trasactios o a SSI compoet system, i.e., trasactios that solely access this database ad are ot routed through the federatio level? Those trasactios do ot have to take a ticket i the origial ticket method (as ay additioal overhead for them could possibly be cosidered as a breach of the local database autoomy). Nevertheless, global serializability is still esured by meas of the ticket-graph testig, as cases where local trasactios cause the serializatio order of global trasactios to be reversed would lead to local cycles ad are thus detectable. Ufortuately, with SSI compoet system, tickets for global subtrasactios aloe are isufficiet to detect those critical situatios caused by local. A example schedule for a SSI database with ticket object T, global subtrasactios t 1 ad t 2, ad a local trasactio t 3 is the followig: r 3 (y 0 ) r 1 (y 0 ) w 1 (y 1 ) r 1 (T 0 ) w 1 (T 1 ) C 1 r 2 (x 0 ) r 2 (T 1 ) w 2 (T 2 ) C 2 r 3 (x 0 ) w 3 (x 3 ) C 3 The schedule icludig the ticket operatios is SSI ad eve SR with the ticket operatios removed, but the ticket orderig of t 1 ad t 2 cotradicts the serializatio order of the ticket-less schedule. A possible ad i fact the oly solutio for this problem is to add take-a-ticket operatios also to all local trasactios. This ca be doe without modifyig the applicatio programs themselves, for example, by chagig the stub code of the commit. However, there is still a major problem usolved, as the forced serial executio o a SSI compoet system, discussed above, would ow apply to both global subtrasactios ad local trasactios. So the resultig performace loss would ivolve the local trasactios as well, ad this is surely uacceptable i almost all cases. I the ext subsectio we will preset a geeralizatio of the ticket method to cope with SSI databases while avoidig such performace problems for the most importat case of read-oly (sub-) trasactios. There is, however, o paacea that ca cope with the most geeral case without ay drawbacks. 4.3 Geeralizig Tickets for Read-Oly Subtrasactios o SSI Compoet Systems I this subsectio, we preset a geeralizatio of the ticket method that allows read-oly trasactios to ru as cocurretly as the compoet systems allow them (i.e., without additioal restrictios imposed by the federated cocurrecy cotrol). So for applicatio eviromets that are domiated by read-oly trasactios but exhibit ifrequet read-write trasactios as well, our approach recociles the cosistecy quality of global serializability with a sustaied high performace.

15 Each global subtrasactio ad local trasactio has to be marked read-oly or read-write at its begiig; a umarked trasactio is supposed to be read-write by default. A trasactio that is declared as read-oly before ca be re-labeled as read-write at ay poit durig its executio (with certai cosequeces i terms of its performace, however). A global trasactio is read-oly if all its subtrasactios are read-oly; otherwise it is a global read-write trasactio. We will first discuss how to deal with read-write trasactios i a rather crude, uoptimized way, ad the show how read-oly trasactios ca be hadled i a much more efficiet maer. Read-Write Trasactios: Our exteded ticket method requires that all global read-write trasactios are executed serially. That is, the federated trasactio maager has to esure that at most oe global readwrite trasactio is active at a time. There is o such restrictio, however, for global read-oly trasactios or for local (read-write) trasactios. Each read-write subtrasactio of a global read-write trasactio takes a ticket as i the stadard ticket method. Read-oly subtrasactios of read-write trasactios oly eed to read the correspodig ticket object, as further discussed below. Note that tickets are still ecessary for global read-write trasactios to correctly hadle the potetial iterferece with local trasactios. Although the sequetializatio of global read-write trasactios appears very restrictive, it is o more restrictive tha i the origial ticket method if SSI compoet systems are part of the federatio. O the other had, our geeralized method is much less restrictive with regard to read-oly trasactios ad local trasactios. Read-Oly Trasactios: The problem with read-oly trasactios is that the usual updatig of ticket objects would tur them ito read-write trasactios, with the obvious adverse implicatios. A careful aalysis of the possible cases, however, shows that it is sufficiet if read-oly (sub-) trasactios merely read the ticket object. A subtrasactio s ticket value shows its positio i the locally equivalet serial schedule. Whe a compoet system geerates SSI schedules, the ticket value that a trasactio t i reads from the correspodig database DB k depeds oly o the positio of its first local operatio B (k) i. The trasactio reads from other trasactios that were committed before B (k) i, so its positio i the equivalet serial schedule must be behid them. Its ticket value must therefore be greater tha that of all trasactios that committed earlier. O the other had, the trasactio t i does ot see updates made by trasactios that commit after B (k) i ; so it must precede them i the equivalet serial schedule, hece its ticket value must be smaller tha the tickets of those trasactios. Thus, a feasible solutio is to assig to a read-oly subtrasactio a ticket value that is strictly i betwee the value that was actually read from the ticket object ad the ext higher possible value that a read-write subtrasactio may write ito the ticket object. This approach ca be implemeted very easily. For example, if ticket objects are of type iteger, we ca restrict the actual ticket-object values to eve itegers with read-write subtrasactios always icremetig the ticket object by two, ad for read-oly subtrasactios we ca use the odd iteger that immediately follows the actually read ticket value for the purpose of buildig the global ticket graph. The fact that this may result i multiple read-oly subtrasactios with the same ticket value is acceptable i our protocol. Figure 2 shows a example, with the ticket values that the read-write trasactios write i the databases deoted by the umbers below the trasactio boxes. The smaller white ad black boxes deote the first operatios of two read-oly trasactios t W ad t B that spa all three databases. Lookig at the white trasactio i the first database, we see that its ticket value