Architectural Issues on Fault Tolerance in CORBA

Transcription

1 Pceedings f the SSRR 2000 Cmte & Bsiness Cnfeence, L'Aqila, Italy, 2000 Achitectal Isses n Falt Tleance in CA 1 Cal Machetti, Massim Mecella, Rbet Baldni Abstact -- The Cmmn Reqest Bke Achitecte (CA) is ne f the mst la standad f middlewae latfms based n bject technlgy. CA shields distibted alicatins fm the hetegeneity f the bae distibted system. Till ecently CA did nt addess the falt tleance isse which is actally ne f the ce asects f distibted alicatins nning n an hetegenes envinment. As a cnseqence, in the last few yeas many eseach sals have aeaed in the liteate t add eliability and availability t CA alicatins. This ae fist analyzes the advantages and dawbacks f sch sals and shws that nne f them cmletely exlits the latfm indeendence vided by CA. Then it ses a nvel CA-cmliant aach, which diffes in allwing the delyment f a deendable infastcte in hetegenes envinments. Index Tems Distibted Systems, Middlewae, CA, Falt Tleance. I. INTRODUCTION distibted alicatin is falt-tleant if it can be Aely exected desite the ccence f falts. Many diffeent classes f distibted alicatins may eqie falttleance, sch as ai taffic cntl systems, e-cmmece alicatins, WEB sevices, telecmmnicatin systems, etc. Hweve, sch alicatins can need diffeent levels f eliability, availability and elicated data cnsistency. F examle, stateless sevices like elicated web seves, need, at client side, simle failve mechanisms, statefl sevices, like telecmmnicatin nes, eqie n dwntime f the sevice alng with stng data cnsistency. Falt-tleance can be btained by sftwae edndancy: a sevice can svive t a falt if it is vided by a set f seve elicas. If sme elicas fail, the thes can cntine Cal Machetti is a Ph.D stdent in Cmte Engineeing at Diatiment di Infmatica e Sistemistica f the Univesità di Rma La Saienza, Via Salaia 113, Rma, Italy (telehne: , machet@dis.nima1.it). Massim Mecella is a Ph.D stdent in Cmte Engineeing at Diatiment di Infmatica e Sistemistica f the Univesità di Rma La Saienza, Via Salaia 113, Rma, Italy (telehne: , mecella@dis.nima1.it) Rbet Baldni is an Assciate Pfess at Diatiment di Infmatica e Sistemistica f the Univesità di Rma La Saienza, Via Salaia 113, Rma, Italy (telehne: , baldni@dis.nima1.it). t ffe the sevice. At this end, seves can be elicated accding t ne f the fllwing elicatin techniqes: active elicatin assive elicatin (imay-back aach) [9]. The Relicatin Lgic is the set f tcls, mechanisms and sevices that allw a distibted system t handle bject elicatin. The Cmmn Reqest Bke Achitecte (CA) [16][19] is a standad f bject iented distibted alicatins. It cnsists f a middlewae n t f which alicatins can be designed, imlemented and delyed in a vey easy way. Hweve, CA did nt vide any tl f enhancing the eliability f sch distibted alicatins. This had tw maj cnseqences: Many CA systems added elicatin lgic t standad s t ce with bject failes and site cashes, like Etenal [14], OS [6][7], DOORS [3], Isis+Obix [12], Electa [12], AQA [4] jst t name a few. The Management (OM) issed a RFP in 1998 that dced, in ealy 2000, the Falt Tleant CA secificatin [5]. FT CA actally embeds many ideas cming t fm the exeience f evis systems and, fm an eatinal viewint, it vides a set f IDL intefaces t an infastcte imlementing the elicatin lgic. In this ae falt-tleant CA systems will be cmaed accding t (i) the intsiveness f the elicatin lgic with esect t the, (ii) the alicatin bject inteeability, i.e., the caacity f caying t a client-seve inteactin when the client esides n an while seve elicas eside n the, ssibly distinct, s. Then we esent an Inteeable Relicatin Lgic (IRL), develed in deatment, which has been designed fllwing a nn-intsive aach with esect t the and, t get inteeability, it has been flly develed abve the. Meve, IRL has been designed t be FT CA cmliant. This ae is ganized as fllws. Sectin II intdces the ntin f elicatin lgic, f (nn-)intsive design and f inteeability. Sectin III esents the Inteeable Relicatin Lgic : the achitecte, the cmmnicatin tcls and the main mechanisms f handling falttleance. The same sectin cntains a discssin abt the main diffeences between IRL and the falt-tleant CA systems. Sectin IV cncldes the ae.

2 2 II. REPLICATION LOIC In this sectin we esent the ntin f elicatin lgic, then we cmae CA systems that have been sed in the liteate with the aim f adding availability and eliability t CA. These systems ae cmaed with esect t: (i) hw the and the elicatin lgic inteacts and (ii) hw they st inteeability amng alicatin bjects in an hetegenes mlti envinment. A. Relicatin Lgic definitin Falt-tleance can be btained by sftwae edndancy sing ne f the fllwing elicatin techniqes: active elicatin assive elicatin (imay-back aach). In active elicatin a client sends a sevice eqest t a set f deteministic elicas, and waits f a cetain nmbe f identical elies. This nmbe deends n the tye f falts a elica can exhibit and n the cnsistency citein we want t ense n elicated data, i.e., the desied level f availability, cnsistency and eliability f the sevice. As an examle, a stateless sevice (n data cnsistency is eqied) needs nly a failve mechanism. Hence, the client can etn the eslt when eceiving the fist ely. If elicated data cnsistency is eqied, at least the majity f elicas has t be awae f the eqest dne by the client. If elicas can exhibit an abitay behavi [1], the nmbe f elicas that shld be awae f the eqest ges t tw-thids. In assive elicatin, a client sends a eqest nly t a aticla elica, namely the imay. Relicas, diffeent fm the imay, ae called back elicas (backs). If the imay fails, the backs elect a new imay. When the imay eceives a eqest, (i) it efms the sevice, (ii) mlticasts a message t the backs t ntify the ccence f the sevice and the date f elicated data and (iii) it sends back the ely t the client. If the sevice is stateless, ste (ii) is nt eqied. We want t emak that bth active and assive elicatin eqie seveal mechanisms in de t wk ely: a eliable mlticast tcl, a faile detectin mechanism and an ageement tcl. The mlticast and the ageement tcls can be cmbined t vide a ttal de mlticast imitive that can be sed in active elicatin t have a cnsistent evltin f the deteministic elicas. The faile detectin mechanism and the ageement tcl can be sed, in assive elicatin, t detect when a imay fails and f the electin f a new ne. Meve, in bth elicatin schemes, the sage f all these mechanisms can vide the nice ntin f g abstactin with the elative sevices sch as g abstactin, membeshi, state tansfe, etc. Fm an eatinal int f view, these mechanisms and tcls can be imlemented by g tlkits [18], sch as Isis [2], Ensemble/Maest [10][20], Ttem [15], etc. We call elicatin lgic the set f tcls, mechanisms and sevices that have t be sed in de t imlement a elicatin techniqe, i.e., t ffe falt-tleance f a secific entity. B. Intsiveness Falt-tleant CA systems can be classified accding t the degee f intsiveness f the elicatin lgic with esect t the standad (Fige 1) 1 : Intsive design: a system is intsive if its design eqies t embed a at ( all) f the elicatin lgic inside the. Intsive systems diffe n hw many cmnents f the elicatin lgic ae embedded int the ( dee vs. shallw intsin). Nn-intsive design: a system is nn-intsive if its design decles the elicatin lgic fm the. Nnintsive systems diffe n whethe the elicatin lgic is lcated abve the (i.e., the elicatin lgic exlits nly feates) nt. In the latte case we say that the elicatin lgic is belw the 2. Relicatin Lgic Relica Relica Fige 1. Intsive and nn-intsive design intsin level Intsive design has been fllwed by systems as Obix+Isis and Electa [12] ( dee intsin), and AQA [4] ( shallw intsin). Obix+Isis has been the fist cmmecial dct ffeing falt-tleance and high availability t CA cmliant alicatins. The Obix ce [11] has been mdified in de t distingish between invcatins t bject gs and t standad bjects. These invcatins ae handled by the Isis g tlkit [1] and by the Obix ce esectively. Meve, the mdified exlits fnctinalities ffeed by the Isis g tlkit sch as cess g ceatin/deletin, eliable mlticast, deing f events, falt mniting, all embedded in a vital synchny mdel. A CA bject, in de t becme membe f a g, veides sme methds inheited fm a ietay base class, and exses these methds in its inteface. These methds ae invked diectly fm the mdified bth t efm secific actin (i.e., state tansfe, falt mniting) and t ntify events (i.e., view changes). Electa diffes fm Obix+Isis mainly f the ssibility f 1 2 A evis classificatin f falt-tleant CA systems was sed by Felbe et al. [8]. This taxnmy classifies aaches int integatin, intecetin and sevice, accding t sme achitectal isses and sevice secificatin asects. Nte that a nn-intsive elicatin lgic that ses even a single mechanism which is nt vided by the is cnsideed belw the.

3 3 integating diffeent g tlkits by ewiting an adatatin laye. In bth systems elicatin lgic is embedded bth int the (g abstactin) and int the g tlkit (mlticast tcl, faile detectin and ageement tcl). This makes the intsin dee. AQA achieves availability and eliability by elacing the IIOP imlementatin with a ietay gateway. This gateway was IIOP calls made by the t bject gs int invcatins t Maest/Ensemble g tlkit [10][20]. In this case the elicatin lgic is handled by the gateway and by the g tlkit. As it is necessay nly t ewite the IIOP mdles f the, AQA is a shallw intsin system. Intecetin laye Relicatin Lgic Relica Relica Fige 2. Relicatin lgic belw the : the Etenal system Nn-intsive design has been fllwed by systems as Etenal [13] (elicatin lgic belw the ), Sevice (OS) [6][7] and DOORS [3] (elicatin lgic abve the ). The atinale behind Etenal is t intecet all netwk system calls made t the OS and t distingish between nn- IIOP and IIOP messages. IIOP messages ae fwaded t a g tlkit (e.g. Ttem [15]). In Etenal the elicatin lgic is entiely managed by the g tlkit while the intecetin f IIOP messages is dne by a thin intecetin laye (Fige 2). Cntaily t evis systems, OS defines a Cmmn Sevice (COS) [17] with IDL intefaces designed t invke the fnctinalities f a g tlkit. It is a nn-intsive system whse elicatin lgic is abve the (Fige 3). OS is designed as a layeed stack f sevices, ths, a client can invke the sevice it needs; OS is nt limited t handling falt tleance: it can be exlited f lad balancing, mltivesin bject management, falt mniting and cntl. Relicatin Lgic Relica Relica Fige 3. Relicatin lgic abve the : OS and DOORS systems DOORS is a COS ffeing faile detectin and ecvey mechanisms t falt-tleant alicatins. DOORS is imlemented by tw main cmnents, namely the RelicaManage and the WatchDg (a distibted faile detect). The fme cmnent handles g definitin, elica cnsistency and ses the latte t detect failes and t detemine when a ecvey actin n a set f elicas has t stat. C. Inteeability With the tem inteeability we mean the ssibility f n-time inteactins f alicatin bjects delyed n t f distinct s (this ntin des nt inclde the isse f the inteactin f diffeent elicatin lgics). This scenai is shwn in Fige 4. In aticla, we addess the fllwing isse: the elicatin lgic is able t manage alicatin bjects nning n t f distinct s (ssibly diffeent fm the ne whee the elicatin lgic ns),, cnvesely, the elicatin lgic and the alicatin bjects need t n n the same latfm. In the fllwing, we give an idea f the cst that falt-tleant CA systems have t ay t get sch an inteeability. This cst takes int accnt the amnt f mdificatins that alicatin bjects and the s need. 1 Relica 1 Relica Falt Tleant CA system Fige 4. Inteeability in an hetegenes mlti envinment etting inteeability deends n hw the inteactins amng emte bjects (i.e., amng seve elicas, nnelicated bjects and elicatin lgic cmnents) ae imlemented. A system is inteeable nly if it ses as cmmnicatin mechanisms the standad emte methd invcatins ffeed by the via IIOP. As a cnseqence, nn-intsive falt-tleant CA systems (e.g. OS,

4 4 DOORS) develed abve the ae inteeable witht any mdificatin (i.e., fee inteeability). Isis+Obix and Electa (i.e., dee intsive falt-tleant CA systems) d nt get inteeability as it is necessay t vide the same (e.g. Isis+Obix) t all cmting esces. AQA (i.e., shallw intsive falt-tleant CA system) can be inteeable vided that we devel ne gateway f each distinct ai <OS, > inclded in the hetegenes envinment. Etenal (i.e., nn-intsive belw the falt-tleant CA system) eqies t wite a intecetin laye f each distinct OS. This cmaisn is shwn in the fist w f Fige 12. III. INTEROPERABLE REPLICATION LOIC (IRL) IRL is a sftwae infastcte n t f which eliable distibted alicatins can be bilt. IRL has been develed fllwing a nn-intsive design abve the (Fige 5), ths emte bjects inteact thgh standad IIOP messages. IRL final taget is t devel a FT CA cmliant infastcte. namely statefl seves and stateless seves. The fme ae geneic deteministic seves f which the ely t a eqest deends n the initial state and n the seqence f evisly invked eqests. The latte ae deteministic seves whse state is nt mdified by the methd invcatins. A. Achitectal Oveview IRL (Fige 6) is cmsed by a cllectin f diffeent CA bjects ackaged int thee main cmnents, namely IRL Ce, SmatPxy and SeveRnTimeSt (SeveRTSt, SRTS). IRL Ce is cmsed by a set f CA bjects nning int a single cess ve a geneic. IRL Ce imlements the elicatin lgic f bth the alicatin bjects and IRL Ce itself. In fact, in de t event IRL Ce t be a single int f faile, it is elicated nt diffeent hsts, sing the assive elicatin techniqe. SmatPxy is a cmnent esiding abve the client that hides seve elicatin t the client. Seve- RTSt cntains a set f CA bjects that has t be delyed n each hst cntaining, at least, a nning elica f a seve alicatin bject. These bjects allw t manage a tin f the faile detectin and ecvey mechanisms and t hide the active elicatin tcl details (sch as eqest filteing) t the seve bject elica. Relica Relica IRL ce Manage Relica Relica Smat Pxy PesistenceManage SRTS SRTS IRL Inteeable Relicatin Lgic (IRL) Fige 6. The IRL achitecte Fige 5. Relicatin lgic abve the : the IRL design In IRL, the elicatin lgic has been centalized int a single lgical cmnent. Cntaily t the nn-intsive aaches esiding abve the (i.e., OS and DOORS), IRL des nt define sevice intefaces (sch as mlticast cmmnicatin imitives, faile detectin mechanisms, etc). In IRL, a client inteacts with a set f seve elicas as they wee singletn bjects and seve elicas ae nt awae f thei elicatin (excet they have t vide sme intefaces). IRL ffes intefaces f the management f the seve elicatin (e.g. active assive elicatin) and f the desied level f cnsistency f elicated data. This aach is clse t the FT-CA secificatin. Cently, IRL sts active elicatin f seve bjects, nning n diffeent CA 2.3 cmliant s (inteeability), f tw tyes f seve alicatin bjects, B. Oveview f the IRL Ce IRL Ce cnsists f thee tyes f CA bjects: a set f bjects, an Manage bject and a PesistenceManage bject. An bject is lgically assciated t each set f elicas (i.e., a g) f a given alicatin seve bject: it eceives all the eqests diected t a aticla g, exectes them n each elica and is esnsible, in the case f a statefl seve, f maintaining cnsistency amng the elicated data managed by elicas. Meve, an bject imlements a tin f the faile detectin mechanism (the the tin is imlemented by the SeveRTSt), it can tigge elica ecveing and it can add/emve elicas t the g. T efm these tasks, each bject maintains the fllwing infmatin, dented OI ( Infmatin): the Inteeable Refeences (IORs) f the bject elicas and the infmatin abt thei intenal state and

5 5 availability; the eties f a g, i.e., minimm nmbe f elicas, the elicatin style, etc. The additin/emval f elicas t/fm a g can be dne by extenal IRL management alicatins. As a cnseqence, the Manage bject ffes in its intefaces methds t execte sch eatins. The PesistenceManage bject is the cmnent esnsible f the elicatin f the IRL Ce. IRL Ce fllws a assive elicatin aadigm, ths at any time it exists at mst ne imay IRL Ce and ssibly ne me backs. The PesistenceManage bject n the imay IRL Ce behaves as client f the PesistenceManage bjects n the backs, ntifying them each change in the intenal state f the imay IRL Ce (e.g. g membeshi mdificatins) thgh CA ne-way invcatins. Meve, back PesistenceManage bjects mnit the imay IRL Ce f failes. If a imay cashes, they stat an ageement tcl t elect a new imay. The IRL Ce elicatin design is t f the aim f the ae. The inteested eade can efe t [13]. C. An veview f the client/seve inteactin A client inteactin with singletn bjects fllws standad CA secificatin. An inteactin between a client and a g f elicas is based n thee main mechanisms: indiect bject g addessing; seializatin f bject g eqests; mlticast tcl fmed by int-t-int cmmnicatins. Indiect bject g addessing. A eqest t an bject g is made by the client thgh a secial tye f IIOP 1.1 cmliant IOR, namely OR ( Refeence). OR actally is a lcal efeence t the SmatPxy bt cntains, in its TaggedCmnent field, a efeence t the bject t be invked. Ths, eqests ae nt diectly invked by the client n the bjects: the SmatPxy actally eceives the eqest and fwads it t the imay IRL Ce (indiect bject g addessing). This 3-tie mechanism allws t hide the elicatin f the IRL Ce t clients. Seializatin f bject g eqests. An bject acts as a seialize f eqests incming fm distinct clients. It eceives eqests sent t its g and mlticasts them t the g elicas. This simle engineeing mechanism allws elicas t eceive the same seqence f eqests incming fm distinct clients. Mlticast tcl. As we devel the tcl abve the, we assme eliable cmmnicatin channels between bjects and the g elicas (this is actally the case as all inteactins amng bjects ae imlemented as CA emte methd invcatins based n IIOP that is layeed ve TCP/IP). Meve, we assme it always exists a cect elica in each g, i.e., a seve that fllws its secificatin. Cnside Fige 7: when a eqest fm a client aives at the cesnding bject, if anthe eqest is being cessed, it is qeed ntil evis eqests have been cessed. Othewise, the bject sends the eqest t the g elicas by sing a int-t-int eliable cmmnicatin, ne f each elica. Then, the bject waits f the fist ely. When it aives, the bject fwads the ely t the client and kees waiting f the thes f a sht eid f time (t be fixed at n-time as a fnctin f the nd ti time). All the seves that d nt ely within this eid, ae cnsideed ssected. &OLHQW 2EMHFW*URXS 6HUYHU 6HUYHU 6HUYHU WLPHRXW DUH \RX DOLYH",DP DOLYH Fige 7. /seve inteactin If a elica is ssected f a cetain nmbe f times cnsectively, the bject stats a falt mniting cess in de t decide if the elica shld be cnsideed as cashed 3. The falt mniting cess cnsists in eidically invking an aeyalive() eatin n the SeveRTSt elated t the elica. If the elica is neithe cashed n blcked and the cmmnicatin netwk is nt cngested, it will ely befe a cetain amnt f time, thewise it will be cnsideed falty. In this case the bject emves the elica fm the g and can take aiate decisins accding t the g eties. F examle, if the nmbe f active elicas is belw the nmbe defined when the g was ceated, the bject stats anthe elica. Ptcl Details In this sectin sme cnsideatins and details abt the tlined tcl ae esented. The details f the tcl ae shwn in Fige 8. Let α be the efeence f a g f elicas (bject g). When the client invkes a geneic methd α.f(), this eqest is caght by the SmatPxy that, in tn, fwad it t the α. This ne invkes the methd α i.f(), in a defeed synchns way n each elica. As sn as the 3 The faile detectin is efmed by an bject nly ding the exectin f a eqest.

6 6 α eceives the fist ely, the eslt is sent back t the client bject (line 4.3) thgh its SmatPxy. Othe elies fm the the elicas ae filteed t (line 4.1) and discaded (line 4.2). Reqests ae dlicated and fwaded by sing the CA Dynamic Invcatin Inteface (DII). (1) when a eqest m is fwaded t α (1.1) m.sn := SN; m.sende:= client; (1.2) i {1, n} send(m) in defeed synchns way t αi ; (1.3) fist SN := te; SN := SN +1; (2) when a eqest m is caght by the αi SeveRTSt (2.1) wait (m.sn = SN m.sende ); (2.2) ass (m) t bject αi ; (2.3) SN m.sende := SN m.sende +1; (3) when a ely m fm a elica is etned t α (4.1) if (fist m.sn ) (4.2) then discad(m); (4.3) else ass(m) t client SmatPxy; fist m.sn :=false; Fige 8. The tcl f a client/seve inteactin By sing this tcl, it is indeed ssible that sme eqests, sent fm the same bject, aive t-f-de t sme elicas. As an examle, Fige 9 shws a cmmnicatin atten in which Req 2 aives at elica α 3 befe Req 1. Ot-f-de methd exectin may lead t a diffeent state in bject elicas. Hence, Req 2 mst be delayed till Req 1 aives. it extacts the seqence nmbe and waits ntil the seqence nmbe f the incming eqest is the ne exected by the elica (line 2.1). Then the eqest is assed t the bject and SN client is inceased. D. /seve inteactin: tcl design Fige 10 illstates the class diagam in UML ntatin f the imlementatin. It shws the gamming langage bjects that imlements the fnctins. An bject exses in its IDL inteface the invke(), called by the SmatPxy t invke a client eqest n the g. RelicatedSev ehandle sev e : CA:: inf : SeveInf ssectlev el : Intege inv k e() ecv e() ssendinv ke() statfaltmniting() stfaltmniting() <<abstact>> invke() <<Reslt>> St atef ls ev e H a ndle ef metstate() ef msetstate() StatelessSev ehandle 0..* 0..* Stat ef l ecvesevestate() S tate less Fige 10. Class diagam f the invke() <<Reslt>> SsectTimet RS1:: Relicated SeveHandle RS2:: Relicated SeveHandle invke() ssendinvke() S1:: CA. <<Oeatin>> <<Reslt>> <<abstact>> name : Sting addrelica() inv k e() em v er elic a() <<Oeatin>> S2:: CA. α.f 1 () α.f 2 () [SUSPECT LEVEL = MaxNmbeOfSsects] statfaltmniting() stfaltmniting() [RS2=FAULTY] ecve() is_alive() α Fige 11. Seqence diagam f a client/seve inteactin α1 α2 α3 Req 1 Req 2 S 1 S 1 S 2 Fige 9. Odeed cmmnicatin S 2 S 1 S 2 The simle tcl embedded in the and in the SeveRTSt slves this blem. An bject maintains an intege vaiable SN, initialized t ze, that eesents the seqence nmbe f a eqest. This vale is, fist, iggybacked n the tging eqest (line 1.1) and then it is inceased by ne (line 1.3). The SeveRTSt endws a vaiable, dented SN client (initialized t ze), indicating the exected eqest fm each client. Un the aival f a eqest at the seve intecet, Each elica f a seve alicatin bject belnging t a g is assciated t an instance f the RelicatedSeveHandle class. It maintains infmatin abt the lcatin and the stats f the emte seve, and ffes methds t invke eatins n the seve, detect its failes and ecve its state. IRL sts statefl and stateless seves. Stateless seves can be elicated witht any mdificatin, while statefl seves mst imlement the getstate() and setstate() methds eqied f thei ecvey. T ecve a aticla elica the Statefl bject (i.e., an bject g f statefl elicas) exses the ecvesevestate() methd. This methd ses the efmsetstate() and efmetstate() methds f the StateflSeveHandle() bjects.

7 7 Intsive Nn-intsive dee shallw belw the abve the (Isis+Obix, Electa) (AQA) (Etenal) (OS) (IRL) Inteeability (see Sectin 2.3) Relicatin Lgic Imlementatin Relicatin Lgic Visibility Imssible Vey Exensive Exensive Fee Fee Tlkit Tlkit Tlkit Distibted Centalized with Passive Relicatin Black bx Black bx Black bx White bx Black bx (fine gained sevices) Fige 12. Cmaisn amng falt-tleant CA systems These methds ses the getstate() and setstate() methds f the assciated elicas in de t esectively date and ead the elica state. The class eesents a g f elicated alicatin seve bjects. It ffes methds t mlticast a aticla eqest t the elicas belnging t the g (i.e., the invke() methd) and t manage the g cmsitin (i.e., the addrelica() and emverelica() methds). The class is secialized by eithe the Statefl class the Stateless class. A seqence diagam f a client/seve inteactin is shwn in Fige 11, whee standad inta-hst gamming langage invcatins ae eesented with staight lines and CA inte-hst emte methd invcatins ae eesented with dashed lines. Finally, we wld like t emak that even if client/seve inteactins elated t a single g ae seialized by its bject, inteactins invlving distinct bject gs can be cncently exected by thei bjects. E. Discssin Let s stat this discssin by cmaing IRL with the falt-tleant CA systems accding t thee achitectal isses, i.e., inteeability (see Sectin II.C), elicatin lgic imlementatin and elicatin lgic visibility. This cmaisn is smmaized in Fige 12. Inteeability. IRL gets inteeability, sch as OS and DOORS, witht any mdificatin t its design, as it is based n a nn-intsive aach abve the. Relicatin lgic imlementatin. Intsive systems and Etenal ely n a secialized, ietay g tlkit. Cnvesely, OS ffes a cmletely distibted elicatin lgic imlemented abve the. IRL centalizes the elicatin lgic in its Ce, viding deendability by assive elicatin. Relicatin lgic visibility, i.e., what a distibted alicatin sees f the sevices vided by the elicatin lgic. A system is black bx if its elicatin lgic ffes t alicatins nly ety management intefaces (i.e., the mechanisms imlementing falt-tleance ae nt accessible fm tside); a system is white bx if its elicatin lgic is cmsed by a set f sevices ffeed t alicatins. IRL, Etenal and intsive systems ffe black bx elicatin lgics. OS, instead, is a white bx elicatin lgic system: it ffes intefaces t se a set f sevices. Nte that the black bx aach is the ne adted by FT CA secificatin. Let s finally cnside a me clse cmaisn with OS, which is histically the fist nn-intsive system fm which IRL has inheited sme design ideas. Hweve, IRL emlys a centalized elicatin lgic imlementatin (with assive elicatin), while OS fllws a flly distibted aach. This makes easie IRL imlementatin, bt the centalizatin can be a efmance bttleneck. As an examle, eqests sent t a g f elicas need t be seialized by the elated bject; n the the hand, this seializatin makes mch easie t enfce the same de f eqest delivey t each elica. We lan t evalate IRL efmance with esect t OS in de t check if this efmance ga eally exists and t qantify its wideness. IV. CONCLUSIONS AND FUTURE WORK This ae has esented a nvel elicatin lgic (IRL) that allws a CA system t bild deendable and eliable alicatins by sing sftwae elicatin. IRL is based n a nn-intsive design develed abve the. The ae has als shwn a cmaisn with the me elevant falttleant CA systems esented in the liteate. We ae cently adating IRL t be FT CA cmliant. As a fte wk we lan t add scalability t IRL by cnsideing cncent exectin f IRL Ces. Each f them is assively elicated and manages a sbset f the bjects nning in the system. V. ACKNOWLEDEMENTS The aths wld like t thank Pal Paa and Antnin Vigillit f thei hel in imlementing the fist IRL ttye. REFERENCES [1] R. Baldni, J.M. Helay, M. Raynal, Fm Cash Falt Tleance t Abitay Falt Tleance: Twads a Mdla Aach, t aea in

8 Pceedings f Intenatinal Cnfeence n Deendable Systems and Netwks (fmely FTCS), New Yk, NY, [2] K. Biman, R. Van Renesse (eds.), Reliable Distibted Cmting with the ISIS tlkit. IEEE CS Pess, [3] P. Chng, Y. Hang, S. Yajnik, D. Liang, and J. Shih, DOORS - Pviding falt tleance t CA bjects ste sessin at IFIP Intenatinal Cnfeence n Distibted Systems Platfms and Oen Distibted Pcessing (Middlewae 98), The Lake Distict, England, [4] M. Ckie, J. Ren, C. Sabnis et al., AQA: An Adative Achitecte that Pvides Deendable Distibted s, in Pceedings f the IEEE 17th Symsim n Reliable Distibted Systems (SRDS-17), West Lafayette, IN, [5] Eicssn, Etenal Systems et al., Falt Tleant CA. Jint Revised Sbmissin. OM TC Dcment bs/ , Management, Famingham, MA, [6] P. Felbe, The CA Sevice: A Sevice Aach t s in CA. PhD thesis (n. 1867), Écle Plytechniqe Fédéale de Lasanne, Switzeland, [7] P. Felbe, B. abinat, R. eai, The design f a CA Cmmnicatin Sevice, in Pceedings f the 15th Symsim n Reliable Distibted Systems (SRDS-15), Niagaa-n-the-Lake, Canada, [8] P. Felbe, R. eai, A. Shie, Relicating s sing the CA Event Sevice, in Pceedings f the 6th IEEE Cmte Sciety Wksh n Fte Tends in Distibted Cmting Systems (FTDCS-6), Tnis, Tnisia, [9] R. eai, A. Shie, Sftwae-Based Relicatin f Falt Tleance, in A.K. Smani, N.H. Vaidya (eds.), Secial Sectin n Falt Tleance, IEEE Cmte, Ail [10] M.. Hayden, The Ensemble System. Ph.D thesis, Cnell Univesity, Ithaca, NY, [11] IONA Technlgies Inc., The Obix system. htt:// [12] S. Landis, S. Maffeis, Bilding Reliable Distibted Systems with CA, They and Pactice f Systems, vl. 3, n. 1, [13] C. Machetti, M. Mecella, A. Vigillit, R. Baldni, An Inteeable Relicatin Lgic f CA Systems, Diatiment di Infmatica e Sistemistica, Univesità di Rma La Saienza, T be eqested via t: mecella@dis.nima1.it. [14] L.E. Mse, P.M. Mellia-Smith, P. Naasimhan, L.A. Tewksby, V. Kalgeaki, The Etenal System: an Achitecte f Enteise Alicatins, in Pceedings f the 3d Intenatinal Enteise Distibted Cmting Cnfeence (EDOC 99), Mannheim, emany, [15] L.E. Mse, P.M. Mellia-Smith, D.A. Agawal, R.K. Bdhia, C.A. Lingley-Paadls, Ttem: A Falt-Tleant Mlticast Cmmnicatin System, Cmmnicatins f the ACM, vl.39, n.4, [16] Management (OM), The Cmmn Reqest Bke Achitecte and Secificatins. Revisin 2.3. OM Dcment fmal/ , OM, Famingham, MA, [17] Management (OM), CASevices: Cmmn Sevices Secificatin. OM Dcment fmal/ , OM, Famingham, MA, [18] D. Pwell (ed.), Secial Sectin n Cmmnicatin, Cmmnicatins f the ACM, vl. 39, n. 4, , Ail [19] R. Sley (ed.), Management Achitecte (OMA) ide. Secnd Revisin. OM Famingham, MA, [20] A. Vaysbd, K. Biman, Bilding Reliable Adative Distibted s with the Maest Tls, in Pceedings f Wksh n Deendable Distibted Systems. 8