Estimating Optimal Checkpoint Intervals Using GPSS Simulation

Transcription

1 Estimating Optimal Checkpoint Intervals Using GPSS Simulation Examensarbete i matematisk statistik utört vid Matematiska Institutionen, Linköpings Universitet Anita Savatović Mejra Čakić LITH-MAI-EX- -07/06 -- SE Examensarbete: Level: Supervisor: Examiner: 0p D John M. Noble Department o Mathematics, Mathematical statistics, Linköpings Universitet John M. Noble Department o Mathematics, Mathematical statistics, Linköpings Universitet Linköping: March 007

2

3 Abstract In this project we illustrate how queueing simulation may be used to ind the optimal interval or checkpointing problems and compare results with theoretical computations or simple systems that may be treated analytically. We consider a relatively simple model or an internet banking acility. From time to time, the application server breaks down. The inormation at the time o the breakdown has to be passed onto the back up server beore service may be resumed. To make the change over as eicient as possible, inormation o the state o user s accounts is saved at regular intervals. This is known as checkpointing. Firstly, we use GPSS (a queueing simulation tool) to ind, by simulation, an optimal checkpointing interval, which maximises the eiciency o the server. Two measures o eiciency are considered; the availability o the server and the average time a customer spends in the system. Secondly, we investigate how ar the queueing theory can go to providing an analytic solution to the problem and see whether or not this is in line with the results obtained through simulation. The analysis shows that checkpointing is not necessary i breakdowns occur requently and log reading ater ailure does not take much time. Otherwise, checkpointing is necessary and the analysis shows how GPSS may be used to obtain the optimal checkpointing interval. Relatively complicated systems may be simulated, where there are no analytic tools available. In simple cases, where theoretical methods may be used, the results rom our simulations correspond with the theoretical calculations. Keywords: Queueing theory, Checkpointing, Availability, Simulation o queues, M/M/ with priorities, Server eiciency.

4

5 Acknowledgements To our examiner and supervisor John Noble, we would like to express our deepest gratitude or his guidance and his patience. We would also like to thank our amilies or their support. Mejra and Anita

6 CONTENTS: INTRODUCTION... 4 OBJECTIVE METHOD Using GPSS Maximizing availability o the server Minimizing the number o customers that are blocked by the system Minimizing the expected time o customers transactions Model or the optimal checkpoint Optimum checkpoint interval by Gelenbe... 4 RESULTS Maximizing availability Minimizing the number o blocked customers... Results rom our theoretical model parameter set... 3 Results o Gelenbe s model parameter set Minimizing the expected transaction time... 5 Minimizing expected transaction time parameter set... 5 Minimizing expected transaction time - parameter set... 5 Maximizing availability parameter set... 7 Results o Gelenbe s model parameter set... 8 Results rom our model parameter set CONCLUSIONS AND DISCUSSION... 9 REFERENCES A SIMULATION CODE AND SOME RESULTS... 3 A. Simulation code or the availability problem... 3

7 A. An example o Micro-GPSS output A.3 The problem o minimizing number o customers A.3. The case with checkpointing as D/D/ queueing system A.3. The case with checkpointing as M/M/ queueing system A.4 Code or minimizing average time case... 4 A.4. The optimal choice o checkpointing interval... 4 A.4. A worse case scenario... 44

8 3

9 Introduction Queues, or queueing systems, are very oten used in computer systems. There are, or instance, queues o inquiries waiting to be processed by an interactive computer system, queue o data base requests, queues o I/O requests, etc. Typically a queue (or queueing system) has one service acility, although there may be more than one server in the service acility, and a waiting room, or a buer, o inite or ininite capacity (In practice, queues are always inite.). Customers rom a population/source enter a queueing system to receive some service. We use the word customer in its general sense, so it could be a packet in a communication network, a job or a program in a computer system, a request or an inquiry in a database system, etc. Upon arrival a customer joins the waiting acility, i all servers in the service centre are busy. When a customer has been served, he leaves the queueing system. There are many mathematical models used to evaluate perormance o an application with and without checkpointing in the presence o ailures, namely, saving the state o the program on stable storage during ailure-ree execution. The best known techniques to minimize loss o computation, when the system ails, are checkpointing and rollback, which is reloading o the program status saved at the most recent checkpoint. [] As an example, we are considering an internet banking acility, where jobs/customers arrive according to some interarrival time distribution and then wait in line or the application server. The time or a transaction is randomly distributed. Ater a job is completed, it is registered with the logging server. Arrival Customers Checkpoint Application Server Logging server Departure Breakdown Figure. System acility System acility 4

10 Occasionally, the application server breaks down. We consider the time between ailures as a random variable, independent o the density o the traic. When the system breaks down, the recovery process starts. The recovery process is the reprocessing o the program starting rom the last checkpoint until the ailure. One checkpoints to reduce the amount that the program needs to be rolled back to its beginning when the ailure occurs. However, i one checkpoints too oten, time is lost because checkpointing takes time. On the other hand, i one doesn t checkpoint oten enough, then it takes longer to read the log ollowing the last checkpoint. The log is where inormation o the applications states is stored between two successive checkpoints or between checkpoint and a ailure. When the application breaks down, this inormation (or example, the amount o money in each bank account) is lost and has to be recovered by reading the log o completed transactions. The time taken to read a transaction log may be modelled by a random variable. A checkpointing request irstly reads the state o the application and then removes the completed transactions rom the log. In this project we analyze the choice o the checkpointing interval, partly by simulation and partly by theoretical analysis. To get as many customers as possible in the system, we are mainly concerned with the availability. The simulation is modelled as a queueing system with priorities. There is server, the customers behave according to an M/M/ queueing system, checkpoint requests according to a D/D/ (D stands or deterministic). Also, the breakdown o the system behaves as M/M/. This is because the arrivals o both customers (or request to a data base server, or phone calls, or example) and ailures are random occurrences. They don t come on a regular basis. On the other hand checkpoints can be predetermined, and thereore they are deterministically distributed here. In the theoretical model, to make explicit computation possible, we have chosen an M/M/ queueing system, or all three streams. We assume arrival process to be a Poisson process, so the interarrival times have the exponential distribution. This means that it is a Markov or a memoryless process; the M denotes Markov. The Poisson process and the exponential distribution oten lead to wellmannered models and thereore have a special place in queueing theory and perormance evaluation. Memoryless property: The state o the system at uture time is decided by the system state at the current time and does not depend on the state at earlier time instants,,. 5

11 Firstly, we use the GPSS application to ind an optimal interval by simulation. Then, we apply the appropriate queueing theory to see how ar the theory can go providing an analytic solution to the problem and see whether or not this is in line with the results obtained through simulation. We also discuss a paper by Gelenbe, On the Optimum Checkpoint Interval, whose model is similar to ours. Objective The object o this project is to ind a method or inding the optimal rate, the checkpoint interval, which maximizes the availability o the server, and to show that the optimal checkpoint interval is deterministic, minimizes the customer delay. In other words, we will maximize the number o customers that go through the system by limiting the capacity o the waiting customers line, and minimizes the expected transaction time or the customers, with supporting results in simulation or all cases, as well as analyze the model treated by Gelenbe in [], or maximizing availability, and compare his results with ours. 3 Method 3.. Using GPSS To simulate our queuing system we have used a web based application called web-gpss, which is structured in blocks, and a text based version o the same program called micro-gpss. [3] Code or the simulation can be ound in the appendix Maximizing availability o the server For a simulation time we have chosen 440 minutes (time units), a day, and to get more reasonable results, i.e. some variation in our data the number o ailures varies; we set it to run 0 times (as a 0-day period). So the simulation terminates ater time units. Here we are considering a single server system where customers (requests) arrive according to Poisson process on average every 0 minutes (with rate ) 6

12 on a irst-come-irst-served basis. Customers enter the system and wait to get service, ater they have been served they (wait to) get their transactions logged and then they leave the system. The customers service time is exponentially distributed with mean o 7 minutes and logging takes on average 0.5 minutes, exponentially distributed as well. For practical purposes, the mean and the coeicient o variation,, or a random variable X (also expressed as square coeicient o variation,, are usually the only important things we need to know about a distribution. The standard deviation o an exponential distribution is equal to its mean, so its coeicient o variation is equal to. Distributions with C < (such as an Erlang distribution) are considered low-variance, while those with C > (such as a hyper-exponential distribution) are considered high-variance. When C = 0, then the distribution is deterministic. The log is where the new states o the customers accounts are stored between checkpoints (explained below), so it also keeps track o the number o customers that have completed the service. In this irst part o the simulation, we display the queue on entrance and in ront o the server, and count the time each customer spends in the system as the dierence between the exit time and the entrance time. The second part the system makes checkpoints. These record the states o all the accounts. The distribution o the arrivals o checkpoints is deterministic. A checkpoint occupies the server or minutes. The log is cleared ater checkpointing (sets the number in the log to zero). We consider a situation where the system crashes on average every 900 minutes, according to a Poisson process. This means no ageing, that is, the probabilistic uture o the process depends only on the current state and not upon the history o the process. This is the third part o the simulation. Downtime ater ailure is counted as log 0.5. We re assuming it takes exactly hal a minute to read the log o each customer in the log. This is the downtime or the system, i.e. the service time o a 7

13 ailure. When service is resumed, both the number in the log and the number o checkpoints are set to zero. Since our system is modelled by a priority queueing system, this process, o course, has a highest priority. Checkpoint arrivals have second highest priority and customers arrivals have the lowest priority. Since we are using several exponentially distributed variables, we are using dierent seeds or each so that dierent sequences o the random numbers are independent Minimizing the number o customers that are blocked by the system Another way o providing aster service is not to have long queues and thereore long waiting times. This is best modelled as an M/M//K queueing system, where K is the maximum number o customers in line. Here we want to minimize the proportion o customers who are turned away. To achieve this we have put a limit o 5 on the number o customers waiting to be served. In this simulation, customers, irstly, log their arrival on the logging server. This is exponentially distributed variable with a mean o 0.5 minutes. The time or transaction is as beore, exponentially distributed with mean 7. Ater the job is completed, it gets registered on the logging server or the second time another exponentially distributed variable with mean 0.5. This double logging may be necessary when the connection is broken. When the connection is re-established, the customer would want to know whether or not the transaction has been processed. This, o course, slows the system down. Customers Logging server Checkpoint Application Server Logging server Breakdown Figure. System acility with double logging 8

14 3..3. Minimizing the expected time o customers transactions In this third case, we are trying to ind the checkpointing interval that minimizes the expected transaction time or the customers. To illustrate this we have changed previous program slightly so that: - the arrival rate o the customers is now 5 min on average, - customer service time takes 3 min, - the checkpointing takes 7 min, - the system ails on average every 400 min, - and the downtime ater the ailure is now (The number in the log) Model or the optimal checkpoint For the theoretical part we no longer have deterministic checkpointing requests. Instead, checkpointing requests arrive according to a Poisson process and take an exponential service time. The model is that o a single server with All three o the arrival processes (customers, checkpoints and ailures) as Poisson processes with the parameters λ k, k =,,, and with exponentially distributed random interarrival times with the same parameters, The service times o checkpoints and customers are independent, exponentially distributed variables with parameters μ k, k=,, The service time o ailure, μ (recovery time), in our calculations, depends on other exponential variables and preceding arrivals (i.e. the number o customers in the log). Otherwise we consider it to be approximately close enough to the exponentially distributed variable, independent o others, so that we can regard the ailure process as an M/M/ queue, and The arrival processes and the service processes are independent o each other. Exponential Interarrival rates Service times Checkpoint Breakdown λ μ μ Customers λ μ Logging server λ 9 Figure 3. Schema o arrival rates and service times

15 So we have an M/M/ queuing system where interarrival times o - Customer is Exp ( λ ) - Checkpoint is Exp ( λ ) - Failure is Exp ( λ ) Because we have exponential random variables, which have the memoryless property, the process renews itsel at every checkpoint. τ τ cp cp cp cp cp - checkpoint Figure 4. Deining variable Y Let τ time between checkpoints and τ time between ailures, independent and exponentially distributed. So, the expected time between ailures is E[] τ =, where λ is the ailure rate. λ Then Y = min( τ, τ ). In other words, we deine a random variable Y as the time between the last two checkpoints, i there is no ailure, or the time between last checkpoint and recovery i there is a ailure. The event min, is equivalent to so min, Thus, Y is an exponentially distributed random variable with the total arrival rate λ + λ. Let N be the number o customers in the log when the system crashes and R the recovery time. Then the expected number o the customers in the log is 0

16 and the expected recovery time is, where average time to read a log, and, in our case, the average time the server is occupied by a breakdown is the expected recovery time,. We deine the availability o the server or the customers as So the expected availability or the customers is E[ A] = average time o normal operation ( time available or customers) E( τ ) μλ E( τ ) E( R) + E( τ ) total run time / λ ( μ λ ) = μ λ /( λ + λ ) + / λ L μλ + λ ( μλ ) + λ = λ ( + μ λ ) + λ L, where = μ average time or server to deal with a checkpoint request. This ollows rom the law o large numbers, which states that the average o a sequence o random variables, independent and identically distributed, converges to its mean as the size o the sequence goes to ininity. We can now maximize the availability with speciic values or,, and.

17 To avoid that the queue eventually grows to ininity, we have to require that the utilization o the server ρ = μ λ + μλ + μ λ < (treating a ailure as a customer who has to be dealt with beore the system can proceed). By deinition, the utilization o a single server,. Since we have three types o arrivals, the total utilization,,,,,, where is occupation rate or type jobs,, 3,. It s the proportion o time the server is busy and should be less than. This stability condition simply states that the system is stable i the work that is brought to the system per unit o time is strictly smaller than the processing rate, which is since there is only one server. Putting E [ A ]/ λ = 0 should give us λ. We get λ + λλ ( + μlλ) μlλ λ / μ + λ ( + μlλ) = 0, so λ = λ + μ λ ) + λ μ λ ( λ + λ μ λ + / ) ( L L L μ. ( ) The negative root is not used, since λ Optimum checkpoint interval by Gelenbe For the model that Gelenbe analyses in his paper, he shows that the optimum checkpoint interval is a unction o the load o the system. He also proves that the total operating time o the system between successive checkpoints chosen as a deterministic quantity gives the maximum availability. [] He considers a single server system, similar to ours, where the transactions are handled in a irst come irst served order. When the system ails, all o the Not to be conused with the service rate, usually denoted with, and utilization. We call our service times,,,, so our.

18 transactions between two successive checkpoints which are stored in what he calls audit trail (we call it log), are executed again. This is the recovery time under which the customers cannot be served. The service o the customers is then dependent on the state o the server, deined as X t, t 0, i the system is creating a checkpoint, X t = i it is re cov ering rom a ailure, 0 i it is operating normally. So during the state 0 is when the customers can be served. Assumptions: { X t, t 0} is a stochastic process. A stochastic process is a mathematical abstraction o an empirical process whose development is governed by probabilistic laws. It is deined as amily o random variables, { X t, t T} deined over some index set or parameter space T (also called time range). I T is an interval or an algebraic combination o intervals then the stochastic process { X t, t T} is called a continuous-parameter process deined on parameter space T. I T is a countable sequence, then the stochastic process { X t, t T} is said to be a discrete-parameter process deined on the index set T. [4] denotes the state o the process at time t. The random variable Y is the length o time between two successive checkpoints during which the system is available or service, i.e. the total time spent in state 0. It is independent o the past history o the process and it has a general distribution unction F(y), density unction (y) and the expectation E[Y] = y ( y) dy <. 0 The time to create the checkpoint (state ) has a general distribution unction C(y) and the expectation E[Y] = yc ( y) dy <. At the end o 0 this time the process returns to state 0. The system crashes, i.e. goes rom state 0 to state, according to a Poisson process with parameter λ. λ is the ailure rate. The time spent by the server in state, considering time t and letting t be the last time beore t when the system was creating a checkpoint, is deined as = = = = t i X t 0 ' l0 ( τ ) dτ i X 0 or, where l0 ( ) Y ( t) t t τ 0 otherwise 0 otherwise, 3

19 This denotes the total time spent by the server in the state 0 in the interval [t, t]. The server remains in state, recovering, or a time o duration h(y(t)) = τ. Function h(y) is a recovery time. Gelenbe uses h ( y) = α y + β, while in our simulation we have the same unction with β = 0. The stationary (equilibrium) probabilities associated with the stochastic process { X t, t 0} are given by π = lim Pr{ = j}, j = 0,,, 0 j t X t so π is the unique nonnegative solution to π = π P satisying π = j= 0 j. Since the process{ X t, t 0} is Markov, continuous time, with inite number o states, each accessible rom the others, it is ergodic. This means that it returns to 0 and starts all over again (renews itsel). These renewal times are the times when the process enters state, i.e. checkpoints. Since ailures are arriving as a Poisson process conditioned on n occurrences o ailures, the instants o n ailures are independent and each uniormly distributed. Note that it is the times at which the arrivals occurred that are uniormly distributed and not the interarrival times. To prove this, let N(t) be the number o events in a Poisson process by time t and T be the time o event j. We need to ind the conditional distribution o (, ) j T K,T n given that N ( t) = n. Let S j denote j th interarrival time so that T j = S + L + S j, where S j ~ Exp( λ) and S, K, Sn independent random variables. Then s j is the time between event j- and j ( s time to irst event). Event that N( t) n} = { s + L + s t < s + Ls }; s s s, s s + h ) { = n n+ j ( j j j j j. Let A h, K, hn = { S K, S ( s n, s ( s n + h ), S s n, s n ( s s n s, s + h n )} s + h ), K So, provided that 0 < s < K < sn < t 4

20 { Ah, K h N( t) n} n { A, N( t) = n} ( s, K, s ) = lim Pr, h 0, Khn 0 h Kh Pr h, K, hn = lim h 0, Khn 0 h Kh Pr ) = Since s n < t, and n = n = = lim h 0, Khn 0 n λ( t sn ) e h Kh e λ e n ( λt ) e n! λt n s + h s n = n t λ( t sn ) n λsn!. { N( t n} K Pr{ S ( s s, s s + h j j j j j sn sn + hn sn sn )} = n λ e ( λt) n! n λ( r + K+ rn ) e s j s j + h j s j s j λt λr λ e dr. dr Kdr That is identical to the joint density o the order statistics o n random variables uniorm in time interval[ 0,t]. 3 I we now let m be the average time between checkpoints and A i the average time the process spends in state i between two successive checkpoints then π i = A i m i, = 0,,. Consider an interval between two successive checkpoints, and y as the total time that the system is operating normally. The expected length o this interval (or given y) is y E[ C] + y + E[ τ ] = y + λ ( h( x) / y) dx + E[ C] 0 n 3 Deinition (Order Statistics): Let Y, K,Y be n random variables. The order statistics n corresponding to the Y, K,Y are n Y( ), K, Y, where ( n) Y( ) Y() K Y and ( n),,,, or some permutation. Further more, i Y, K,Y independent and identically distributed random variables each n uniormly distributed on [0, t] then the joint density unction or ( Y( ), K, Y( n) ) is given by!,,,,, 0. 0, 5

21 where and E [] τ n= 0 n = ( number o = n= 0 n ( yλ ) n! n Pr ( n e yλ th ailures) ( probability that ailure ) y = λ e yλ = yλ e = yλ e yλ yλ y 0 h n= n= j= 0 () x y n dx = λ n ( n )! The expectation over all values o y is and [] Y + () y h() x dxdy + E[] C y E λ, π = π 0 = λ 0 0 λ () y h() x ( yλ ) ( yλ ) j! n ailure happens in [0, y]) = n ( yλ ) n! y yλ e n= 0 0 n ( n )! () y h() x dxdy + E[] C + E[] Y 0 0 y 0 0 y [] dxdy [] + E[] Y + λ () y h() x E C π = π π 0 E Y y 0 0 j dxdy = yλ e yλ e yλ h( x) dx y = yλ. π 0 can then be seen as the availability o the server since it is the stationary probability that the server is available or service. The more convenient orm is 6

22 The general problem o the optimum checkpoint interval is to ind F(y) which maximizes the availabilityπ 0. The ollowing argument shows that π 0 is optimized by letting Y be deterministic. Denote by Y a the set o all probability distribution unctions o ixed and inite expectation, E [ Y ] = a, a 0. Let H ( y) = y h( x) dx, and E ( H) = E[ H( Y)] be the expectation o H ( y) i Y is 0 distributed according to some F Y a. Jensen s inequality states that E[ H] H( a), i H ( y) is convex. By deinition, a unction (x) is said to be convex over an interval [a, b] i or every x, x rom [a, b], and 0 λ, ( λx + ( λ) x) λ ( x ) + ( λ) ( x). (A unction is strictly convex i equality holds only i λ = 0 or λ =.) Jensen s inequality states that i is convex and X is a random variable then E[ ( X )] ( E[ X ]). Put another way, p ( x) ( x) p( x) x. x x We prove this by induction. - When X takes two values, p and p = ( p ), the inequality is p ( x ) + p ( x) ( px + px). This is true by deinition o convexity. - Suppose it is true or distributions with k values. Let * = pi pi, i =,, K, p k. k Then 7

23 which proves inequality., For ixed a 0, we have then a a π 0 = =. E[ C] + a + λ ( y) H ( y) dy a + E[ C] + λ E[ H ] a 0 Consider now a unction h ( y) = α y + β where α, β > 0 are constants. β can be seen as time it takes to reload inormation stored at checkpoint and α y as time it takes to re-execute transactions in time Y. Then H ( y) = ( α / ) y + βy, with H ( y) = h( y) and H ( y) = α > 0, so H (y) convex, and by Jensen s inequality E[ H ] = ( α / ) E[ Y ] + βe[ Y] H ( E[ Y]) = H ( a) = ( α / ) E[ Y] + βe[ Y] Denote optimum checkpoint interval F * ( y) Y a and = * a y ( y) dy or 0 some a 0. Then * a π 0 ( F ( y)). α a + E[ C] + λ βa + λ a With equality only i E [ Y ] = E[ Y] (so Var( Y) = 0 and thereore, coeicient o variationc ( Y ) = 0 ), which means that Y is deterministic. * To ind parameters α and β, let p (0,0) be the probability that the system is idle, given that is operating normally. Then, in the interval o normal * operation, the system will be busy during average time y( p (0,0)). Since transactions/customers arrive at a rate λ and have service rate μ then * the average number o transactions in that interval is μ y( p (0,0)). Suppose now that k = the number o transactions that have to be reprocessed ater a ailure, then the reprocessing time o the ailure which occurs ater * time units o normal operation takes on average, a time μ kμy( p (0,0)). 8

24 * So α k( p (0,0)) and h ( y) = ky( p(0,0)) + β. According to Gelenbe [, chap. 3], stationary probability that the server is busy given that is in state 0 is * λ p ( 0,0) = π 0, μ so λ α = k π 0, μ which gives E[ C] λ π 0 ( + + λ β ) = kλ a. a μ Thereore the value o a which maximizes π 0 is = E[ C] μ( + βλ ) aˆ + +. βλ λ λke[ C] That is the ormula or the optimum checkpoint interval. [] 4 Results Three measures o the eiciency o the system are considered. Firstly, as in the situation treated by Gelenbe, we consider maximizing the time that the system is available or use by customers. Secondly, we consider a situation where the queue has inite capacity and we ind the checkpointing interval that minimizes the number o customers who are turned away. Finally, we consider the checkpointing interval that minimizes the expected transaction time or a customer. In principle, the simulation procedure is versatile; the optimal checkpointing interval or a wide range o criteria may be computed. 9

25 4.. Maximizing availability In our irst simulation, with dierent checkpointing intervals, we get results collected in table. For each checkpointing interval we run the simulation 0 times so total runtime is 4400 units (minutes). The other parameters (parameter set ) are: - customers arrive on average every 0 min, 0, - customer service time takes about 7 min, 7, - the checkpointing takes min,, - the system ails on average every 900 min, and the recovery time is (The number in the log) 0.5 min, 0.5. Run Total Number o ailures The number o ailures varies rom 0 to 4 over those 0 runs (days). However, the number o checkpoints is the same or each run but it varies, naturally, or dierent checkpointing interval. The shorter interval between two checkpoints the more checkpoints there are. The total downtime is, and 4400 The availability Checkpointing Total downtime Availability intervals (min) (min) ,5 0, , ,5 0, , ,5 0, ,5 0, ,5 0, , ,5 0, No checkpoints 375 0, Table. Availability or dierent checkpointing intervals 0

26 For maximising availability, the optimal checkpointing interval is the one that gives the least downtime. Only point estimates are given; no attempt at estimating the standard error o the estimates has been made. The point estimate suggests that one should checkpoint every 35 minutes. This gave the best availability; the system was available 98,8% o the time or the service o the customers. But or these parameter values, the availability does not change substantially or a wide range o checkpoint interval. Anywhere between 80 to 360, gives availability over 98%. It is important not to checkpoint more requently, since this uses time checkpointing, hence reduces availability. Insuicient data was gathered to see i checkpointing is necessary at all or this choice o parameter values. Since Gelenbe showed that deterministic checkpointing is more eicient. The ollowing igure shows the dierence between downtimes or both deterministic and exponential checkpointing intervals. In both these cases we have averaged over 0 runs or each checkpointing interval to get the total (average) downtime. 500 Total downtime (min) Checkpoint interva l(min) tot downtime D tot downtime Exp Figure 5. Total downtime (Deterministic vs. Exponential checkpoint distributions) or several checkpoint intervals In igure 5 we can see that the results are reasonably close but the deterministic checkpointing gives smaller downtimes than the exponential checkpointing, which in turn yields better availability or the customers and thereore is the optimal distribution o the checkpointing intervals.

27 4.. Minimizing the number o blocked customers In the second simulation we are minimizing the number o customers that are blocked by the system. All the parameters are the same as beore. The only dierence is that the number o customers waiting in line is limited to 5. As previously, we are taking the total o 0 runs or each checkpointing interval. The results are collected in table. Checkpointing interval (min) Number o blocked customers No checkpoints 8 Table. Number o blocked customers or dierent checkpointing intervals Table shows that a couple o dierent intervals, rom 80 to 330, give lowest numbers o the customers that are turned away, and thereore are the optimal checkpointing intervals in this situation. Comparing the total number o blocked customers in two parallel simulations, one with the deterministic checkpointing intervals (both interarrival and service times o checkpoints are distributed deterministically) and the other with the exponential (both interarrival and service times are exponentially distributed), gives, again, similar results (as shown in igure 6). Here it is again clear that the number o blocked customers increases substantially i checkpointing is carried out too oten. The results again suggest that the optimal checkpointing intervals are between 80 and 330 minutes, but without estimates o the standard deviation, there is no evidence that checkpointing improves the situation or these parameter values.

28 0 Number o blocked customers Checkpoint interval (min) # blocked cust.(d) # blocked cust.(exp 3 Figure 6. Total number o blocked customers (Deterministic vs. Exponential checkpoint distributions) averaged over 0 runs or several checkpoint intervals Results rom our theoretical model parameter set Next, we ll see how closely our simulations correspond to theoretical calculations. We calculate, with the values or μ, μl, λ and λ used in our simulations, the arrival rate o checkpoints, λ, and expected value o availability, E [A]. So with μ =, μ L = 0.5, λ = and λ = We get λ = λ + μ λ ) + λ μ λ ( λ + λ μ λ + / μ) ( L L L and the expected time between checkpoints E [ τ ] = This gives the expected availability μλ + λ ( μλ ) + λ E [ A] = = λ ( + μ Lλ ) + λ so, the availability o the server or the customers is 98,%. Our results were consistently slightly higher than this when deterministic checkpointing was used, illustrating the result by Gelenbe.

29 In the ollowing igure we show the relationship between expected checkpoint time ( λ ) and the average time the system ails ( λ ), with the same values or μ, μl and λ. Here we see that, as the time or the system ailure increases, the expected time between checkpoints increases as well. Expected checkpoint time Average time or system to ail expected chp time Figure 7. Relationship between the ailure times and the checkpoint times Results o Gelenbe s model parameter set I we now use the same values in Gelenbe s model, to ind the optimum checkpointing interval μ aˆ = E[ C] + λ λke[ C] using also β = 0, E [ C] =, λ = λ =/ 0, μ = μ = 7, k = E[] N = λ and with a = we get λ + λ λ 90a k = a This leads to an equation a 3 + 4a 800a = 0 with the only positive real solution a 4. The optimum checkpointing interval in this case, according to Gelenbe, is an interval o 4 minutes. This is signiicantly lower than the optimal checkpoint interval computed or exponential checkpointing times, which 4

30 turned out to have expected value 43 minutes, and which agreed with the simulations. It seems to be lower than the minimum reasonable value that the simulations yielded Minimizing the expected transaction time In this model we illustrate the results i dierent measure is important, such as, average transaction time instead o availability. Minimizing expected transaction time parameter set In this case we continue using the same parameters, as thus ar. That is: - customers arrive on average every 0 min, - customer service time takes about 7 min, - the checkpointing takes min, - the system ails on average every 900 min, - the recovery time is (The number in the log) 0.5 min, - total run time is 4400 minutes, - total number o customers is N=4 or each checkpointing interval, averaged over 0 runs. To ind the minimum transaction time we divided the total transactions time (sum o all individual transaction times) with the total number o customers or each o checkpointing interarrival times. All o these are taken over 0 runs or each checkpointing interval. The results are collected in table 3. Checkpoint interarrival time (min) Total transaction time, T (min) Average transaction time, T/N (min) ,60 7, ,96 7, ,58 7, ,70 7, ,60 7, ,7 7, ,0 7,37 No checkpoints 056,4 7,48 Table 3. Average transaction times or dierent checkpointing intervals In table 3 we see that there is not much dierence between average transaction times; the dierences may be attributed to random luctuations and checkpointing makes very little dierence. Checkpointing is unnecessary with this set o parameters. 5

31 There is no evidence that checkpointing improves the situation or any o the measures o eiciency using these parameters. We now consider a set o parameters where checkpointing is necessary. Minimizing expected transaction time - parameter set In this case, the system ails more oten. Both the recovery time and checkpointing time take longer. The customers arrive more oten too, but their service times are shorter. Following are the parameters used in this case: - customers arrive on average every 5 min, 5, - customer service time takes on average 3 min, 3, - the checkpointing takes 7 min, 7, - the system ails on average every 400 min, 400, Run Total Number o ailures the recovery time is (The number in the log) 3 min, 3, - and the total runtime is again 4400 minutes/checkpointing interval. To ind the minimum transaction time we divided the total transactions time with the total number o customers or each o checkpointing interarrival times. All o these are taken over 0 runs or each checkpointing interval. The results are shown in table 4, as well as igure 8. Checkpoint interarrival time (min) Total transaction time, T (min) Total number o customers, N Average transaction time, T/N (min) , , , , , , ,0 79 3, , , , , , ,64 No checkpoints 0803, ,7 Table 4. Average transaction time or dierent checkpointing intervals In this case we ve ound a minimum transaction time or the checkpoint interarrival time somewhere in the interval between 60 and 80 minutes. 6

32 Table 4 also shows that i there are no checkpoints the average transaction time is considerably larger, so checkpointing seems to improve the situation. 7 Average transaction time(min) 4,4 4, 4 3,8 3,6 3,4 3, Checkpoint interarrival times (min) Figure 8. Average transaction times or dierent checkpointing intervals Maximizing availability parameter set Next, we show the results obtained when the same values are used in maximizing availability model. Namely, customers arrive on average every 5 minutes, their service time is 3 minutes on average, checkpointing takes 7 min, and the system ails every 400 minutes. The recovery time is (The number in the log) 3 minutes. Runtime is 440 minutes and there are 0 runs or each checkpointing interval. Results are shown in table 5 and igure 9. Checkpointing Total downtime Availability intervals (min) (min) , , , , , , , , ,856 No checkpointing ,6473 Table 5. Maximizing availability or dierent checkpointing intervals parameter set From table 5, and in igure 9, we see that the optimal checkpoint interval in this model is matching that o minimizing expected transaction time model.

33 For the checkpointing intervals o 60 to 80 minutes, the availability o the server or the customers is over 85%. The highest availability, 89 % in this case, has been attained or the checkpointing interval o 90 minutes and the lowest (o 65%) in the absence o checkpointing. Availability 0,9 0,8 0,7 0,6 0,5 0,4 0,3 0, 0, Checkpointing interval (min) Figure 9. Availability or dierent checkpointing intervals Results o Gelenbe s model parameter set Putting the same parameter values into Gelenbe s model, to ind the optimum checkpointing interval, and using β = 0, E [ C] = 7, λ = λ = / 5, λ = / 400, μ = μ = 3,, where, we get the equation: with one real solution The optimal checkpointing interval, by Gelenbe, under same circumstances, is an interval o 77 minutes. This is inside the interval o optimal interarrivals, between 60 and 80 minutes, which has been obtained in the previous, maximizing availability case, as well as the optimal checkpointing intervals we have ound when minimizing expected transaction times, also 60 to 80 minutes. Results rom our model parameter set Our calculation, with the same values as above, produce the ollowing arrival rate o checkpoints, λ, and expected value o availability, E [A]. λ = λ + μ λ ) + λ μ λ ( λ + λ μ λ + / μ) ( L L L 8

34 and the expected time between checkpoints E [ τ ] = This gives the expected availability μλ + λ ( μλ ) + λ E [ A] = = λ ( + μ Lλ ) + λ So, the optimal checkpointing interval is about 9 minutes, which is inside the already established intervals, and which yields the availability o the server or the customers o 83%. 5 Conclusions and discussion By using the idea behind Gelenbe s model and assuming all three arrival processes as Poisson processes with exponentially distributed random interarrival times we have constructed a method or computing the optimal checkpoint interval. We have also simulated the system using GPSS, with both deterministic and exponential checkpoint intervals so that we could compare the two. This illustrated Gelenbe s result, that deterministic checkpointing is more eicient. Our analysis o the maximum availability also shows that deterministic checkpoint intervals give optimal results, which corresponds to the results o Gelenbe. Simulating the system yielded the optimal checkpoint interval which maximised the amount o time that the server was available or customers, which was the irst aim o the project. The simplest M/M/ model yields an optimal checkpoint interval, via theoretical computations, that is substantially lower than the length o interval obtained rom simulating the system with a deterministic checkpoint interval. Larger numbers o checkpoints reduce availability. The simulation was carried out using various parameter values. In the presentation, two dierent sets o parameter values were chosen that modelled realistic situations and illustrated the important eects. With the irst set o parameters we were able to ind optimal checkpointing intervals, which were similar, or both the maximizing availability case and the minimizing number o blocked customers case, but the results suggested that checkpointing did not improve the situation substantially or these parameter values. With the second set o parameters we ound that both availability problem and the average transaction times produced the same optimal checkpointing 9

35 intervals. This was also conirmed by our theoretical calculations, as well as Gelenbe s, whose result was less than the result rom our model (as it should be since checkpoints in his case were deterministic while in ours they were exponential). In the problem o minimizing the expected service time, the checkpointing turns out to be necessary. This is required to ensure that occasional customers are not blocked or very long periods. Without checkpointing, the system behaves ar rom optimally. The results show that the M/M/ queueing system, which may be considered theoretically, yields results that give good approximation to the optimal interval or the model with deterministic checkpointing. Systems with general arrival or service distributions may be treated quite easily using GPSS simulation, but there are insuicient tools available or theoretical computation o the optimal checkpointing interval. It is straightorward to analyse variations o the model using GPSS. For example, the arrival process may be modelled using a non-homogeneous Poisson process, where the intensity changes over time to model periods during the day when more customers arrive. A real situation has many more eatures than those contained in the simpliied models presented here, but the important parameters have been retained and the models discussed contain some important eatures. Reerences [] Erol Gelenbe, On the Optimum Checkpoint Interval, Journal o ACM 6() (Apr. 979), [] Xinyu Chen and Michael R. Lyu, Perormance and Eectiveness Analysis o Checkpointing in Mobile Environments, Proceedings o the nd International Symposium on Reliable Distributed Systems (SRDS'03) 00, (Oct. 003), 3-40 [3] Simulation tool WebGPSS, developed by Ingol Stahl, Stockholm School o Economics. Available at - October 0, 005, - Februari 0, 007. [4] Donald Gross, Carl M. Harris, Fundamentals o queueing theory 3 rd ed., by John Wiley & Sons, Inc, New York,

36 3

37 A Simulation code and some results A. Simulation code or the availability problem The ollowing is the code or the maximizing availability problem. simulate 0 LET X$log=0 LET X$check=0 LET X$time=0 QTABLE bank,0,0,0 arrvl GENERATE 0*n$xpdis,,,,3 ARRIVE bank LET x$nin=q$bank LET x$clo=cl server SEIZE app,q ADVANCE 7*n$xpdis(3) RELEASE app logout SEIZE log,q ADVANCE 0.5*n$xpdis(4) LET x$log=x$log+ RELEASE log exit DEPART bank LET x$clo=cl LET x$cldi=x$clo-x$clo TERMINATE cpoint GENERATE 35,,,, ARRIVE check SEIZE app,q LET x$ctime= PRINT 'Checkpoint time ADVANCE RELEASE app LET x$check=x$check+ LET x$log=0 DEPART check TERMINATE! entrance time! number in the log! exit time! time to read the log = min ',x$ctime! number o checkpoints! clear the log ail GENERATE 900*n$xpdis(5),,,, LET x$time=x$log*0.5 PRINT 'Recovery time ',x$time crash SEIZE app,q ADVANCE x$time LET x$log=0 LET x$check=0 RELEASE app TERMINATE stop GENERATE 440 TERMINATE start end 3

38 A. An example o Micro-GPSS output This is a part o GPSS output or the maximizing availability problem with the choice o the checkpointing interval we ound to be optimal (according to our speciic values or other parameters). Run Checkpoint time.00 Recovery time 8.50 Checkpoint time.00 Recovery time 5.00 Checkpoint time.00 Recovery time.50 Checkpoint time.00 Clock Block counts Number Adr. Oper. Current Total ARRVL GENERA 46 ARRIVE 46 3 LET 46 4 LET 46 5 SERVER SEIZE 46 6 ADVANC 46 7 RELEAS 45 8 LOGOUT SEIZE 45 9 ADVANC 45 0 LET 45 RELEAS 45 EXIT DEPART 45 3 LET 45 4 LET 45 5 TERMIN 45 6 CPOINT GENERA 4 7 ARRIVE 4 8 SEIZE 4 9 LET 4 0 PRINT 4 ADVANC 4 RELEAS 4 3 LET 4 4 LET 4 5 DEPART 4 6 TERMIN 4 7 FAIL GENERA 3 8 LET 3 9 PRINT 3 30 CRASH SEIZE 3 3 ADVANC 3 3 LET 3 33 LET 3 34 RELEAS 3 35 TERMIN 3 36 STOP GENERA 37 TERMIN 33

39 () () (3) Facility Average Number o Average utilization entries time/trans APP LOG () () (3) (4) (5) Queue or Maximum Average Total Zero Percent AD set contents contents entries entries zeros BANK APP LOG CHECK (6) (7) (8) Queue or Average $Average Current AD set time/trans time/trans contents BANK APP LOG CHECK $Average time/trans=average time/trans excluding zero entries Table () () (3) (4) (5) (6) Entries Mean AD set time St. dev. Total time Minimum Maximum Range Observed Per cent Cumulative Cumulative requency o total percentage remainder Remaining requencies are all zero Run Checkpoint time.00 Checkpoint time.00 Checkpoint time.00 Checkpoint time.00 Clock Block counts Number Adr. Oper. Current Total ARRVL GENERA 58 ARRIVE 58 3 LET 58 4 LET 58 5 SERVER SEIZE 58 6 ADVANC 58 7 RELEAS 57 8 LOGOUT SEIZE 57 9 ADVANC 57 0 LET 57 RELEAS 57 EXIT DEPART 57 3 LET 57 4 LET 57 34

40 35 5 TERMIN 57 6 CPOINT GENERA 4 7 ARRIVE 4 8 SEIZE 4 9 LET 4 0 PRINT 4 ADVANC 4 RELEAS 4 3 LET 4 4 LET 4 5 DEPART 4 6 TERMIN 4 7 FAIL GENERA 0 8 LET 0 9 PRINT 0 30 CRASH SEIZE 0 3 ADVANC 0 3 LET 0 33 LET 0 34 RELEAS 0 35 TERMIN 0 36 STOP GENERA 37 TERMIN () () (3) Facility Average Number o Average utilization entries time/trans APP LOG () () (3) (4) (5) Queue or Maximum Average Total Zero Percent AD set contents contents entries entries zeros BANK APP LOG CHECK (6) (7) (8) Queue or Average $Average Current AD set time/trans time/trans contents BANK APP LOG CHECK $Average time/trans=average time/trans excluding zero entries Table () () (3) (4) (5) (6) Entries Mean AD set time St. dev. Total time Minimum Maximum Range Observed Per cent Cumulative Cumulative requency o total percentage remainder Overlow

41 (7) Average value o overlow Run 3 Checkpoint time.00 Checkpoint time.00 Recovery time 0.50 Recovery time 4.50 Checkpoint time.00 Checkpoint time.00 Clock Block counts Number Adr. Oper. Current Total ARRVL GENERA ARRIVE 3 LET 4 LET 5 SERVER SEIZE 6 ADVANC 7 RELEAS 8 LOGOUT SEIZE 9 ADVANC 0 LET RELEAS EXIT DEPART 3 LET 4 LET 5 TERMIN 6 CPOINT GENERA 4 7 ARRIVE 4 8 SEIZE 4 9 LET 4 0 PRINT 4 ADVANC 4 RELEAS 4 3 LET 4 4 LET 4 5 DEPART 4 6 TERMIN 4 7 FAIL GENERA 8 LET 9 PRINT 30 CRASH SEIZE 3 ADVANC 3 LET 33 LET 34 RELEAS 35 TERMIN 36 STOP GENERA 37 TERMIN () () (3) Facility Average Number o Average utilization entries time/trans APP LOG () () (3) (4) (5) Queue or Maximum Average Total Zero Percent AD set contents contents entries entries zeros BANK APP LOG CHECK

42 (6) (7) (8) Queue or Average $Average Current AD set time/trans time/trans contents BANK APP LOG CHECK $Average time/trans=average time/trans excluding zero entries Table () () (3) (4) (5) (6) Entries Mean AD set time St. dev. Total time Minimum Maximum Range Observed Per cent Cumulative Cumulative requency o total percentage remainder Remaining requencies are all zero Run 4 Recovery time 3.00 Checkpoint time.00 Checkpoint time.00 Checkpoint time.00 Checkpoint time.00 Clock Block counts Number Adr. Oper. Current Total ARRVL GENERA 43 ARRIVE 43 3 LET 43 4 LET 43 5 SERVER SEIZE 43 6 ADVANC 43 7 RELEAS 43 8 LOGOUT SEIZE 43 9 ADVANC 43 0 LET 43 RELEAS 43 EXIT DEPART 43 3 LET 43 4 LET 43 5 TERMIN 43 6 CPOINT GENERA 4 7 ARRIVE 4 8 SEIZE 4 9 LET 4 0 PRINT 4 ADVANC 4 RELEAS 4 3 LET 4 4 LET 4 5 DEPART 4 6 TERMIN 4 7 FAIL GENERA 37