Recovery Block Research Articles

Implementation of the conversation scheme in message-based distributed computer systems

Several different approaches for implementing conversations in message-based distributed computer systems (DCSs) are discussed. Two different exit control strategies (synchronous and asynchronous) and three different approaches to execution of the conversation acceptance test (centralized, decentralized, and semicentralized) are examined and compared in terms of system performance and implementation cost. An efficient approach to run-time management of recovery information based on an extension of the recovery cache scheme is also discussed. The two major types of conversation structures, name-linked recovery block and abstract data type conversations, are examined to analyze which execution approaches are the most efficient for each conversation structure. As a case study, an unmanned vehicle system is used to illustrate how the approaches can be used in a realistic real-time application. >

A new approach to the modeling of recovery block structures

A reliability model is proposed for recovery block structures based on error events which can be observed and distinguished during testing. Strategies are then described for the collection of failure histories needed to estimate the model parameters and obtain dependability predictions. Given that the software goes through different testing stages, the model can be employed at different points of the development cycle to assess or forecast the quality of project choices and the resulting product.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Cost modelling of fault-tolerant software

Costs of a simplex or single-version system are compared with the following three-version fault-tolerant software systems: N-version programming (NVP), recovery block (RB), and consensus recovery block (CRB). Cost is minimized subject to a system reliability constraint. The objective function of the optimization program is of the form ∑ β i /(1 − r i ) χ i where the constants β i and α i are fixed and the r, are variables that are reliabilities of the versions, the acceptance test in the case of RB and CRB and the voter in the case of NVP and CRB. The costs are compared for different values of β i and for values of α i = 0.5, I, and 2. Assuming that failures are independent, CRB followed by RB are the most cost-justifiable fault-tolerant techniques considered. Unless the voter is perfect, NVP does not compete cost-wise with the other two methods. Indeed, in some cases it is worse than a simplex system.

An approach to the reliability optimization of software with redundancy

An approach to the optimization of software reliability is proposed. The emphasis is put on the software redundancy to achieve fault tolerance, i.e. the results of the optimization process are used to determine the optimal structure of the software to be developed. Two optimization models are formulated covering, respectively, modified recovery block scheme and multiversion programming approaches. Both cases are illustrated by simple examples. The models show that it is possible to formulate and solve some software related reliability optimization problems. They further show that the concept of redundancy to achieve fault tolerance (basic for the traditional theory of reliability) can be used in the field of software reliability optimization. >

Fault-tolerant software reliability modeling using Petri nets

We propose reliability models using timed Petri nets for a variety of fault-tolerant software, including mechanisms such as recovery blocks, N-version programming, and some variations. The reliability of each model is evaluated using a package based on Generalized Stochastic Petri Nets. The numerical results are then analyzed and compared. We have shown that a recovery block with independent tests can reach a higher level of reliability. We also identified the coverage factor of the acceptance test as the most critical parameter affecting reliability. For N-version programs and consensus recovery blocks the most significant factor is the correlation between the errors in different versions.

Resourceful systems for fault tolerance, reliability, and safety

Above all, it is vital to recognize that completely guaranteed behavior is impossible and that there are inherent risks in relying on computer systems in critical environments. The unforeseen consequences are often the most disastrous [Neumann 1986]. Section 1 of this survey reviews the current state of the art of system reliability, safety, and fault tolerance. The emphasis is on the contribution of software to these areas. Section 2 reviews current approaches to software fault tolerance. It discusses why some of the assumptions underlying hardware fault tolerance do not hold for software. It argues that the current software fault tolerance techniques are more accurately thought of as delayed debugging than as fault tolerance. It goes on to show that in providing both backtracking and executable specifications, logic programming offers most of the tools currently used in software fault tolerance. Section 3 presents a generalization of the recovery block approach to software fault tolerance, called resourceful systems . Systems are resourceful if they are able to determine whether they have achieved their goals or, if not, to develop and carry out alternate plans. Section 3 develops an approach to designing resourceful systems based upon a functionally rich architecture and an explicit goal orientation.

Distributed execution of recovery blocks: an approach for uniform treatment of hardware and software faults in real-time applications

The concept of distributed execution of recovery blocks is examined as an approach for uniform treatment of hardware and software faults. A useful characteristic of the approach is the relatively small time cost it requires. The approach is thus suitable for incorporation into real-time computer systems. A specific formulation of the approach that is aimed at minimizing the recovery time is presented, called the distributed recovery blocks scheme. The DRB scheme is capable of effecting forward recovery while handling both hardware and software faults in a uniform manner. An approach to incorporating the capability for distributed execution of recovery blocks into a load-sharing multiprocessing scheme is also discussed. Two experiments aimed at testing the execution efficiency of the scheme in real-time applications have been conducted on two different multimicrocomputer networks. The results clearly indicate the feasibility of achieving tolerance of hardware and software faults.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Sheaved memory: architectural support for state saving and restoration in pages systems

The concept of read-one/write-many paged memory is introduced and given the name sheaved memory . It is shown that sheaved memory is useful for efficiently maintaining checkpoints in main memory and for providing state saving and state restoration for software that includes recovery blocks or similar control structures. The organization of sheaved memory is described in detail, and a design is presented for a prototype sheaved-memory module that can be built easily from inexpensive, off-the-shelf components. The module can be incorporated within many available computers without altering the computers' hardware design. The concept of sheaved memory is simple and appealing, and its potential for use in a number of software contexts is foreseen.

Encoded 16-PSK: a study for the receiver design

The authors present the results of a design study of the receiver in a digital transmission system using the combined coding and modulation schemes known as Ungerboeck codes. Specifically, they examine the design of the receiver for encoded 16-PSK (phase shift keying) modulation, presenting first the traditional structure for the optimum receiver and then a simpler structure. The decoding depth of the Viterbi algorithm, the quantization of the metrics inside the Viterbi processor, and the phase jitter in the recovered carrier are considered. The impact of branch and path metric quantization inside the receiver is discussed, showing that a reasonable number of bits (8) is sufficient to obtain nearly optimum performance when the code complexity is limited. The effect of imperfect carrier recovery inside the receiver is studied, providing accurate analytical estimates of the error event probability as well as an upper bound to the symbol error probability. Results of a detailed simulation, including carrier and bit timing recovery blocks, show that the effects of imperfections on the bit error probability are very small, even at low signal-to-noise ratios. On the whole, results show the robustness of the Viterbi algorithm with respect to fairly rough quantizations of the metrics and indicate that carrier recovery is not as critical as expected. >

Reliability analysis of a class of fault-tolerant systems

An architecture called the digital-data system is proposed to increase the reliability of a class of communication and network control systems. A general expression for the reliability of this system is derived using the total probability theorem, and the issue of minimizing the system cost is discussed. The architecture is quite general in that it models software fault-tolerant systems such as the recovery block scheme. Other software fault-tolerance schemes like the deadline mechanism for real-time recovery can also be modeled using this technique. A numerical example is given to illustrate the technique. >

PH regulatory mechanisms in rat pancreatic ductal cells.

The mechanisms underlying regulation of intracellular pH (pHi) by rat pancreatic duct cells were studied by use of the pH-sensitive, fluorescent, cytoplasmically trapped dye 2',7'-bis(carboxyethyl)-5(6)-carboxyfluorescein (BCECF). Cells exhibited a mean pHi of 7.18 +/- 0.14 in bicarbonate-buffered medium, as calculated from the BCECF fluorescence ratio. Removal of extracellular Na (Nao) caused an intracellular acidification that was rapidly reversed by Na replacement and occurred independently of Clo. Amiloride (10(-3) M) reversibly blocked Na-dependent recovery after Na-free-induced acidification. These results demonstrate the presence of a Na+-H+ exchange mechanism in pancreatic duct cells. Replacement of Clo with gluconate caused an intracellular alkalinization that was reversed by replacement of Cl. Application of the disulfonic stilbene derivatives, 4,4'-diisothiocyanostilbene-2,2'-disulfonic acid (DIDS) and dihydro-DIDS (2 X 10(-4) M), resulted in block of both Cl-dependent recovery from Na-gluconate and the onset of alkalinization of transition from NaCl to Na-gluconate. Chloride-dependent alteration of pHi occurred independently of Nao. These results demonstrate the presence of an anion exchange mechanism consistent with Cl--HCO3- exchange. Thus pancreatic duct cells contain both Na+-H+ and Cl--HCO3- exchangers.

Programmer-transparent coordination of recovering concurrent processes: philosophy and rules for efficient implementation

An approach to coordination of cooperating concurrent processes, each capable of error direction and recovery, is presented. Error detection, rollback, and retry in a process are specified by a well-structured language construct called recovery block. Recovery points of processes must be properly coordinated to prevent a disastrous avalanche of process rollbacks. The approach relies on an intelligent processor system (that runs processes) capable of establishing and discarding the recovery points of interacting processes in a well coordinated manner such that a process never makes two consecutive rollbacks without making a retry between the two, and every process rollback becomes a minimum-distance rollback. Following a discussion of the underlying philosophy of the author's approach, basic rules of reducing storage and time overhead in such a processor system are discussed. Examples are drawn from the systems in which processes communicate through monitors.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

A recovery block scheme for a VAX11/750 running unix

AbstractIn this paper we describe an implementation of a scheme that is widely used in software fault tolerance, the recovery block scheme. This scheme is usually implemented using special purpose hardware and software. Our implementation runs on a VAX11/750 which has not been modified in any way. This machine uses a very slightly altered version of Berkeley's 4.2 UnixUnix is a trademark of AT&amp;T Bell Laboratories in the USA and other countries. .

Data diversity: an approach to software fault tolerance

Data diversity is described, and the results of a pilot study are presented. The regions of the input space that cause failure for certain experimental programs are discussed, and data reexpression, the way in which alternate input data sets can be obtained, is examined. A description is given of the retry block which is the data-diverse equivalent of the recovery block, and a model of the retry block, together with some empirical results is presented. N-copy programming which is the data-diverse equivalent of N-version programming is considered, and a simple model and some empirical results are also given.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Optical recording of electrical activity from axons and glia of frog optic nerve: potentiometric dye responses and morphometrics.

Voltage-sensitive dyes were used to study the changes in membrane potential in axons and glial cells of the frog optic nerve following electrical stimulation. The lack of a signal in the unstained nerve and the multiphasic action spectra after staining indicated that the optical responses were from the extrinsic dyes. Changes in dye absorption and fluorescence had rapid and slow phases. The rapid phases resulted from action potentials in myelinated and unmyelinated axons. The kinetics of the slow phase of the optical response were similar to the depolarization recorded from the glial cells with intracellular electrodes. The ratio of the amplitudes of the fast and slow phases was characteristic for each type of dye. Pharmacological analysis of the action potential of the unmyelinated axons revealed tetrodotoxin-sensitive sodium channels and 4-aminopyridine-sensitive potassium channels. Repeated exposure of the stained preparation to light led to photodynamic damage as shown by a block of recovery of the glial depolarization. An electron microscopic morphometric study of the nerve was carried out in an effort to understand the contribution of the various anatomical elements to the compound optical response. The ratio of unmyelinated axon membrane to glial membrane was much greater than was the ratio of the fast and slow components of the signal, suggesting that the dyes either had a higher affinity for glial membrane or did not penetrate the nerve uniformly.

Fault-Tolerant SoFtware Reliability Modeling

In situations in which computers are used to manage life-critical situations, software errors that could arise due to inadequate or incomplete testing cannot be tolerated. This paper examines three methods of creating fault-tolerant software systems, Recovery Block, N-Version Programming, and Consensus Recovery Block, and it presents reliability models for each. The models are used to show that one method, the Consensus Recovery Block, is more reliable than the other two.

Testbed-based validation of design techniques for reliable distributed real-time systems

Two tightly coupled multi-computer testbeds, one providing efficient inter-node communications tailored to the application, and the other providing more flexible full connectivity among processors and memories are used to support validation of the design techniques for distributed real-time systems. The testbeds are valuable tools for evaluating, analyzing, and studying the behavior of many algorithms for distributed systems. We have used the testbeds in studying distributed recovery block scheme for handling hardware and software faults. A testbed has also been used to analyze database locking techniques and a fault-tolerant locking protocol for recovery from faults that occur during updating of replicated copies of files in tightly coupled distributed systems. Testbeds can be configured to represent the operating environments and input scenarios more accurately than software simulation. Therefore, testbed-based evaluation provides more accurate results than simulation and yields greater insight into the characteristics and limitations of proposed concepts. This is an important advantage in the complex field of distributed real-time system design evaluation and validation. Therefore, testbed-based experimentation is an effective approach to validate system concepts and design techniques for distributed systems for real-time applications.

On selecting rollback points for error recovery

In a concurrent processing system with recovery blocks, the occurrence of a fault in one process can contaminate the data used by other processes because of interprocess communications. One of the effective techniques to deal with faults in such a system is rollback and recovery with global checkpoints. In global checkpointing, N ( N > 1) checkpoints are maintained, since the faults may not be detected on occurrence. The time required for rollback and recovery depends on the number of checkpoints maintained, the intercheckpoint interval, and the way checkpoints are selected for rollback. This paper discusses the problem of checkpoint selection. A generalized formulation for checkpoint selection is given from which three different schemes are derived. Each scheme is shown to have a smaller expected cost of recovery and a larger optimal checkpoint interval than rolling back to the most recent checkpoint.

Software Fault-Tolerance and Design Diversity: Past Experience and Future Evolution

Interest in software fauIt-tolerance (following an interest in fault-tolerance in general, and prompted by the so-called “software crisis”) is now exhibited by many institutions.Though many software fault-tolerance techniques are known, their use is limited by the lack of consistent, flexible methodologies, of support mechanisms in operating systems and of design tools.In this paper, we discuss the known software fault-tolerance techniques, with particular reference to the two coherent methodologies proposed, Multiple Version Software and Recovery Blocks. We argument that a more general methodology is needed for use in complex software system, and outline how the necessary mechanisms could be included in low-level system software.

Reliability Versus Safety

This paper discusses the impact of computer based control systems on the reliability and safety of the total real-time system. It deals with applications. where safety is of utmost importance, but reliability is also an important goal. Both aspects are fundamental qualities of real-time systems, their tradeoff is discussed.Based on a high level view of the system a quantitative model for an analysis of the impact of the computer system on the reliability and safety of the system is presented This model is applied to different software fault tolerant techniques, the following methods are compared: single version. “2 out of 2”- voting. “2 out of 3”-voting (N-version-programming) and the recovery block technique The degree of correlation between faults is an important parameter of the model Finally the impact of a binary output space, which occurs quite often in safety critical real-time systems, is analysed.