Deriving a Good Trade-off Between System Availability and ...phoenix/docs/ufirst09.pdf · Deriving a Good Trade-o Between System Availability and Time Redundancy Nils Mullner [email protected]

Deriving a Good Trade-off BetweenSystem Availability and Time Redundancy

Nils [email protected]

System Software and Distributed Systems Group,Universitat Oldenburg, Germany

June 30, 2009

Nils Mullner (Universitat Oldenburg) Trade-off: System Avbl vs Time Redundancy 1 / 19

Table of contents

1 Motivation

2 New Availability Metric

3 Results from Analysis and Simulation

4 Conclusion

5 Future Work


Orientation

Trade-off between time (steps to wait for intended service)and availability increase (to get intended service)in distributed systems

How much ddelay is desired? ⇒ as short as possible...

How available should your system be? ⇒ as high as possible...

What is a good trade-off in between delay and availability?


Orientation






Orientation






Orientation






Orientation






Orientation






Orientation






Orientation






Orientation

masking nonmasking

self-stabilizing

t ime for stabil ization


Instantaneous Window Availability

request response

fault

masker

system

user

system

service unavailable service available

k+1k k+1k

request response

time redundancy

maximal

(a) (b)

k+2 k+w


Availability

Availability : A =MTTF

MTBF(1)

instantaneous availability: at some arbitrary time k the system isavailable: A(k)limiting availability: the same, as k approaches ∞analysis determines limiting, but for simulation we can only choosehigh kat some arbitrary point k, what are the chances that we get theintended (correct) service?and what would happen if the system fails but we can wait for atmost w timesteps for the system to recover?Instantaneous Window Availability (IWA): given that a system isnot available at k , what is the availability increase if we wait for atmost w steps?How many steps must one wait to achieve a certain overallavailability?


Availability


MTBF(1)



Availability


MTBF(1)



Availability


MTBF(1)



Availability


MTBF(1)



Availability


MTBF(1)



Availability


MTBF(1)



Availability


MTBF(1)



Availability


MTBF(1)



System Model

serial execution semantics

central demon/scheduler/monitor

shared memory model

perfect fault detection

fault model: transient faults strike mem register with static probability

distributed self-stabilizing algorithm

convergence: ∃t ≥ t0 : c(t) |= Pconsistency: ∀tl > tk : c(tk) |= P ⇒ c(tl) |= P

two systems:

distributed self-stabilizing breadth first search (BFS) [Dol00]


System Model



shared memory model





two systems:



System Model



shared memory model





two systems:



System Model



shared memory model





two systems:



System Model



shared memory model





two systems:



System Model



shared memory model





two systems:



System Model



shared memory model





two systems:



System Model



shared memory model



distributed self-stabilizing algorithmconvergence: ∃t ≥ t0 : c(t) |= Pconsistency: ∀tl > tk : c(tk) |= P ⇒ c(tl) |= P

two systems:

a

b c



System Model



shared memory model




two systems:

a

b c

a

d

e

b c



System Model



shared memory model




two systems:

a

b c

a

d

e

b c



Methods

1 Analysis: build state space (3p: 6561, 5p: ∼7 Billion), form IWA inPCTL with final argument, calculate with PRISM [KNP07]

P =?[F <= 100”state6523”{true}{min}]

2 Simulation: build system, execute n steps, see, if c(t) |= P, if not,count i until c(t + i) |= P [MDT08]


Methods


P =?[F <= 100”state6523”{true}{min}]



Methods


P =?[F <= 100”state6523”{true}{min}]



Results 3p System - Analysis

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 300.00

0.05

0.10

0.15

0.20

0.25

0.30

Analysis, 3 Processes, BFS

0.010.050.1

Window Size w, w > 0

IWA


Results 3p System - Simulation

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 300.00

0.05

0.10

0.15

0.20

0.25

0.30Simulation, 3 Processes, BFS

0.010.050.1


IWA


Results 3p System - Simulation - Standard Deviation

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 300.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40Simulation, 3 Processes, BFS, μ±σ

0.010.050.1


IWA



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 300.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40

Comparison, 3 Processes, BFS, p(fault) = 0.01, μ±σ

Analysis


IWA



1 2 3 4 5 6 7 8 9 1011121314151617181920212223242526272829300.00

0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40

0.45

0.50Comparison, 3 Processes, BFS, p(fault) = 0.01, μ±2*σ

Analysis


IWA


Comparison - Analysis & Simulation

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 300.00

0.05

0.10

0.15

0.20

0.25

0.30Comparison, 3 Processes, BFS, p(fault) = 0.01

SimulationAnalysis


IWA


Results 5p System - Simulation

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 300.00

0.01

0.02

0.03

0.04

0.05

Simulation, 5 Processes, BFS300,000 Experiments

0.010.050.1


IWA


Conclusion

Relation: IWA vs. Delay

Notion of IWA necessary to argue for trade-off.

Analysis & Simulation coincide well.

Limits of analysis (state space explosion) obvious,for simulation important for larger systems


Conclusion






Conclusion






Conclusion






Future Work

1 Framework for the Automatic Derivation of Trade-off solutions

find Pareto-optimal solutionsmore dimensions (consistency, frequency, ...)distributed analysis to cope with complex systems

2 Real world experiments with WSNs: constistency vs. availability vs.energy consumption vs. collisions vs. code strength vs. delay vs. ...


Future Work





Future Work





Future Work





Future Work





Future Work





Future Work





Future Work





Abhishek Dhama, Oliver E. Theel, and Timo Warns.Reliability and Availability Analysis of Self-Stabilizing Systems.In SSS, pages 244–261, 2006.

Shlomi Dolev.Self-Stabilization.MIT Press, Cambridge, MA, USA, 2000.

Nils Mullner, Abhishek Dhama, and Oliver Theel.Derivation of Fault Tolerance Measures of Self-Stabilizing Algorithmsby Simulation.In Proc. of AnSS’08, pages 183–192. April 2008.

Edsger W. Dijkstra.Self-Stabilizing Systems in Spite of Distributed Control.Commun. ACM, 17(11):643–644, 1974.

M. Kwiatkowska, G. Norman, and D. Parker.Stochastic Model Checking.InProc. of SFM’07, volume 4486 of LNCS (Tutorial Volume), pages220–270. Springer, 2007.


Thank your for your attention!

[email protected]

Questions?



[email protected]

Questions?



[email protected]

Questions?


Documents

Deriving a Good Trade-off Between System Availability and ...phoenix/docs/ufirst09.pdf · Deriving a Good Trade-o Between System Availability and Time Redundancy Nils Mullner [email protected]