Shadow Computing: An Energy-Aware Fault Tolerant Computing Model

Transcription

1 Shadow Comuting: An Energy-Aware Fault Tolerant Comuting Model Bryan Mills, Taieb Znati, Rami Melhem Deartment of Comuter Science University of Pittsburgh (bmills, znati, Index Terms shadow comuting, fault tolerance, scheduling, resiliency Abstract The current resonse to fault tolerance relies uon either time or hardware redundancy in order to mask faults. Time redundancy imlies a re-execution of the failed comutation after the failure has been detected, although this can further be otimized by the use of checkoints these solutions still imose a significant delay. In many mission critical systems hardware redundancy has traditionally deloyed in the form of rocess relication to rovide fault tolerance, avoiding delay and maintaining tight deadlines. Both aroaches have drawbacks, re-execution requiring additional time and relication requiring additional resources, esecially energy. This forces the systems engineer to choose between time or hardware redundancy, cloud comuting environments have largely chosen relication because resonse time is often critical. In this aer we roose a new comutational model called shadow comuting, which rovides goal-based adative resilience through the use of dynamic execution. Using this general model we develo shadow relication which enables a arameterized tradeoff between time and hardware redundancy to rovide fault tolerance. Then we build an analytical model to redict the exected energy savings and rovide an analysis using that model. I. INTRODUCTION Power consumtion is widely recognized as one of the most significant challenges facing data centers in both cloud comuting and high erformance comuting (HPC) [5], [1]. Addressing such a challenge requires building ower and energy awareness into the foundations of future comuting models. New aroaches must be develoed to achieve efficient energy management across all hardware and software comonents of the system. The increase in energy consumtion is a direct result of an increase in the number of comuting nodes, conversely this has an equally negative effect on the overall system reliability. Even if the individual node failure rate is low, the overall system failure rate quickly becomes unaccetable as the number of comonents increases. For examle, a comuting system with 200,000 nodes will exerience a mean time between failure (MTBF) of less than one hour, even when the MTBF of an individual node is 5 years [3]. Future systems will clearly need to be fault tolerant and at the same time be energy-aware. This work is suorted in art by NSF grants CNS and CNS The common resonse to faults is to restart the execution of the alication after a failure, including those comonents of its software environment that have been affected by the occurring fault. Re-execution techniques can occur at different oints of the alication, ossibly involving the comlete reexecution of the task although usually a checkoint is used to reduce the amount of rework necessary. In either case the reexecution will cause a delay. To avoid this delay most cloud environments have chosen rocess relication [6], [8], [4] to mask faults removing the delay of re-execution. It is clear that while relication rovides a method of achieving fault tolerance it is not energy efficient because, by its very nature, it costs twice as much as a single rocess. The main objective of this aer is to exlore a new comutational model called shadow comuting by develoing an energy-aware fault-tolerance method called shadow relication. We show that this method not only rovides fault tolerance but can rovide energy savings of 15-30% in existing systems. A. Shadow Comuting We are roosing a new comutational model, called shadow comuting, which rovides goal-based adative resilience using dynamic execution to meet the requirements of comlex alications in highly arallelized faulty environments. Adative Resilience is the ability of the system to dynamically harness all available resources to achieve the highest level of QoS for a given alication. Dynamic execution is the ability to execute an alication while being able to change the QoS of that alication. For examle, in this aer we exloit the ability to execute rocesses at variable execution seeds using dynamic voltage and frequency scaling (DVFS), changing the QoS of alication resonse time. The challenge is to maintain or exceed the alications QoS while minimizing the system resources in site of systems-level changes, such as failures or the availability of additional system resources. In order to achieve adative resilience, the shadow comuting model associates a set of shadows to the main execution, which are dynamically instantiated and adjusted in order to address the current state of the system and maintain the alication s QoS requirements. The objective of this aer is to balance the system resource of ower with the QoS of alication resonse time in the resence

2 of system faults. To this end, we roose shadow relication which is the ability of the system to adatively execute either entirely or artially the original task to overcome failures, while minimizing system ower. B. Shadow Relication The basic idea of shadow relication is to associate with each rocess a suite of shadow rocesses, whose size deends on the criticality and erformance requirements of the underlying alication. A shadow rocess is an exact relica of the main rocess. In order to overcome failure, the shadow is scheduled to execute concurrently with the main rocess, but at a different comuting node. Furthermore, in order to minimize energy, shadow rocesses initially execute at decreasingly lower rocessor seeds. The successful comletion of the main rocess results in the immediate termination of all shadow rocesses. If the main rocess fails, however, the rimary shadow rocess immediately takes over the role of the main rocess and resumes comutation, ossibly at an increased seed, in order to comlete the task. Moreover, one among the remaining shadow rocesses is then romoted to be the rimary shadow rocess. The main challenge in realizing the otential of the shadow relication stems from the need to comute the seed of execution of the main rocess and the seed of execution of its associated shadows, both before and after a failure occurs, so that the target resonse time is met, while minimizing energy consumtion. Since the failure of an individual comonent is much lower than the aggregate system failure, it is very likely that most of the time the main rocesses comlete their execution successfully. Successful comletion of a main rocess automatically results in the immediate halting of its associated shadow rocesses, roviding a significant savings in energy consumtion. Furthermore, the number of shadow rocesses to be instantiated in order to achieve the desired level of faulttolerance must be determined based on the likelihood that more than one rocess fails within the execution time interval of the main task. The comletion of a main or its shadow results in the successful execution of the underlying task. The main contributions of this aer are threefold. First, we resent an otimization framework to exlore the alicability of the shadow relication to rovide fault-tolerance in an energy efficient manner. Second, using the otimization framework, we roose and study two imlementation methods of the shadow relication model. The first method, referred to as stretched relication, takes the trivial aroach to minimizing energy by reducing the seed of execution of both the main and the relica such that the task deadline is maintained. Although simle to imlement, stretched relication is oblivious to the dynamics of the failure, otentially resulting in sub-otimal energy erformance. The second method, referred to as energy efficient relication, comutes energy efficient execution seeds which maintain the exected resonse time regardless of failure rates. Third, we conduct a erformance evaluation to assess the erformance of shadow relication, comaring the energy consumtion of shadow relication to that of traditional relication. II. ENERGY OPTIMIZATION MODEL In this section, we define a framework for evaluating shadow relication and then use this to derive a model for reresenting the exected energy consumed by the system. A. Shadow Relication Framework We consider a distributed comuting environment executing an alication carried out by a large number of collaborative tasks. The successful execution of the alication deends on the successful comletion of all of these tasks. Therefore the failure of a single rocess delays the entire alication, increasing the need for fault tolerance. In this aer we focus on the execution of one single task knowing that one task imacts the entire system, both in total time of execution and energy consumtion. Each task must comlete a secified amount of work, W, exressed in terms of the number of cycles required to comlete the task. Each task also has a targeted resonse time,t r. Each comuting node has a variable seed, σ, given in cycles er second and bounded such that 0 σ σ max. Therefore the minimum resonse time for a given task is t min = W σ max. In order to achieve our desired fault tolerance a shadow rocess executes in arallel with the main rocess on a different comuting node. Deending on the occurrence of failure during execution, four scenarios are ossible. The first scenario, deicted in Figure 1(a), takes lace when no failure occurs 1. The second scenario, deicted in Figure 1(b), takes lace when failure of the main rocess occurs. Uon failure detection, the shadow rocess increases its rocessor seed and executes until comletion of the task. The third case is if the main rocess comletes successfully and the shadow fails, not deicted due to sace constraints. The last case is both rocesses fail, however this is very unlikely because failure of the nodes are assumed to be indeendent events. The main rocess executes at a single execution seed denoted as σ m. In contrast the shadow rocess executes at two different seeds, a seed before failure detection, σ b, and a seed after failure detection, σ a. This is deicted in Figure 2. Based uon this framework we define some secific time oints signaling system events. The time at which the main rocess comletes a task,t c, is given ast c = W σ m. Additionally, we define the time oint t f as the time at which a failure in the main rocess is detected. B. Power Model In the receding section we have defined shadow relication, now we will derive an analytical model to describe the exected energy consumtion of shadow relication. We begin by defining a ower model used to describe the ower consumed by a single node. It is known that by varying 1 For the urose of this discussion, only a single shadow is considered. The discussion can be easily extended to address multile shadow rocesses

3 Task Work following: Work Comleted main shadow Shadow Stos Executing t2 E(σ,[t 1,t 2 ]) = (σ 3 +ρσmax)dt 3 t=t 1 =(σ 3 +ρσ 3 max)(t 2 t 1 ) (1) Task Start Task Comletion Targeted Resonse Time C. Failure Model Task Work m Work Comleted Task Start Fig. 1. main shadow (a) Case of no failure X Main Fails Shadow Increases Seed (b) Case of failure Targeted Resonse Shadow relication execution model. m X Time t 0 t f t c t r The failure can occur at any oint during the execution of the main or shadow task and the comleted work is unrecoverable. Because the rocesses are executing on different comuting nodes we assume failures are indeendent events. We also assume that only a single failure can occur during the execution of a task. If the main task fails it is therefore imlied that the shadow will comlete without failure. We can make this assumtion because we know the failure of any one node is a rare event thus the failure of any two secific nodes is very unlikely. We assume that two robability density functions, f m (t) and f s (t), exists which exresses the robability of the main or shadow task failing at time t. The model does not assume a secific distribution however in the remainder of this aer we use an exonential robability density function, thus f m (t) = f s (t) = λe λt. % Fig a Overview of Shadow Relication the execution seed of the comuting nodes one can reduce the dynamic CPU ower consumtion at least quadratically by reducing the execution seed linearly. The dynamic CPU ower consumtion of a comuting node executing at seed σ is given by the function (σ), reresented by a olynomial of at least second degree, (σ) = σ n where n 2. In the remainder of this aer we assume that the ower function is the cubic, P(σ) = σ 3. We also consider the amount of static ower which is consumed regardless of the seed of the rocessor. This consumtion of ower is made u of both CPU leakage and all other comonents consuming energy during execution (memory, network, etc.). In this aer we define static ower to be a fixed factor of the ower consumed when the CPU when oerating at full seed, referred to as ρ. The ercentage ρ ρ+1 of static ower in a system is thus defined as. For examle by letting ρ be 4.0, when the CPU is executing at maximum seed it will consume 20% of the total ower, with static ower consuming the remaining 80%. The energy consumed by a comuting node executing at seed σ during an interval [t 1,t 2 ] is given by E(σ,[t 1,t 2 ]) = t2 t=t 1 (σ)dt. Thus the energy function is defined as the D. Energy Model We define the exected system energy for shadow relication given the ower model and the failure distributions. First consider the energy consumed by the main and shadow rocesses if failure does not occur before reaching t c. (1 f m (t)dt) (1 f s (t)dt) (E(σ m,[0,t c ])+E(σ b,[0,t c ])) This first art of this equation is exressing the robabilities that neither rocess fails during the execution interval of the main task, t c. The second art is the energy consumed by both the main and shadow rocesses at their resective rocessor seeds over the same interval, t c. Next, let s consider what haens in the event that the main rocess comletes correctly but the shadow rocess fails before reaching t c. (1 f m (t)dt) [E(σ m,[0,t c ])+ E(σ b,[0,t])f s (t)dt] The first art is the robability that the main rocess doesn t fail. The second art is the amount of energy the main rocess will consume if it comletes the execution. The last art is the amount of energy consumed by the shadow if it fails before the main task is comleted. Because we are assuming only one failure there is one remaining case to consider, that the main rocess fails and (2) (3)

4 the shadow takes over the execution. (1 tr f s (t)dt) [E(σ m,[0,t])+e(σ b,[0,t])+e(σ a,[t,t r ])]f m (t)dt Again the first art of this equation is the robability that the shadow rocess doesn t fail during the resonse time. The second half is the energy consumed by the main and shadow rocess before it fails and then the energy consumed by the shadow taking over the execution. E system is therefore the summation of Equations 2, 3 and 4 which is the total exected system energy consumed by shadow relication assuming only one of the two nodes fails. E. Otimization Problem Using this model we formalize our objective as the following minimization roblem. minimize E system (t r,λ,ρ,w,σ m,σ b,σ a ) subject to t c t r σ m t c W σ b t c +σ a (t r t f ) W It is assumed that node failure model roerties and task roerties are unchangeable system arameters, t r, λ, ρ and W. Therefore the otimization roblem is to find the execution seeds of the rocesses, σ m, σ b and σ a. This results in one formula and three unknowns ad in the next sections we will make use of non-linear otimization techniques to find the energy efficient execution seeds. Recall that t c is the time that the main will comlete the task given no failure, therefore t c = W σ m. The time of failure of the main rocess is defined to be t f and therefore t f t c. III. DETERMINING EXECUTION SPEEDS One of the rimary goals of cloud comuting is to achieve the maximum ossible throughut. Thus, when we aly the shadow relication model we must consider the imact failures will have uon the seed and efficiency of the system. Shadow relication gains its energy conserving roerty by making the assumtion that if a failure occurs there is some degree of laxity as to when the work will be comleted. Similarly, re-execution techniques assume that if a failure occurs one is willing to endure a time delay to the rollback and re-execute. Because of this we defined targeted resonse time,t r, allowing us to bound the laxity. We reresent the targeted resonse time as the laxity factor, α, of the minimum resonse time, t min. For examle if the minimum resonse time is 100 seconds and the targeted resonse time is 125 seconds, the laxity factor is In contrast, a re-execution technique assumes that if a failure occurs the system will have enough time to re-comute, this results in α = This assumes a single failure, if multile failures occur re-execution has the otential to have α > 2.0. (4) (5) Shadow relication and re-execution techniques both exloit time redundancy to rovide fault tolerance, the difference is that shadow relication rovides a model to balance the tradeoff between hardware and time redundancy. If one lets α = 1.0, this imlies there is no laxity, therefore shadow relication will be equivalent to traditional relication. As we increase α shadow relication can begin trading hardware redundancy for time redundancy. We roose two different methods for alying shadow relication. Stretched Relication - Based uon the classic aroach of slowing down to the minimum execution seeds such that the targeted resonse time is still achieved. This results in σ m = σ b = σ a = W/t r. Energy Efficient Relication - Execute at the energy efficient seeds for both the main rocess and the shadow rocess. This requires us to find σ m, σ b and σ a that minimize the exected energy. To solve the otimization roblem we begin with the observation that the seed of the shadow after failure, σ a, is deendent uon the seed before failure, σ b, and the time of failure, t f. In this otimization we then let σ a be the slowest ossible seed to finish by the targeted resonse time, t r. Therefore σ a is no longer constant with resect to the time of failure. From this observation the following value of σ a can be derived. σ a = (W σ b t f )/(t r t f ) (6) This reduces the outut of our otimization to two variables, σ m and σ b. To ensure that the shadow rocess has the ability to comlete all the necessary work and maintain the targeted resonse time we must further constrain σ b. We can derive this constraint from Equation 6 by letting t f = t c and σ a = σ max. This assumes failure occurs at the last ossible time, t c, which would force the seed of the shadow after failure to be the maximum ossible execution seed. We can then derive the following work constraint. t c σ b +(t r t c ) σ max W (7) This constraint imlies that the faster the main rocess executes the more time available to recover from failure but the more energy we consume in the non-failure case. If we execute the main rocess slower, the non-failure case can conserve more energy, however we have less time to recover from a failure. Using this model and the defined constraints we use Mathmatica s non-linear otimization routines to find energy otimal execution seeds, σ m and σ b. Without loss of generality, we assume σ max is normalized such that σ max = 1. IV. ANALYSIS Many cloud roviders are using traditional relication, therefore we begin our comarison by looking at the otential energy savings shadow relication can rovide over this form of relication. In traditional relication each rocess is executed simultaneously with at least one relica rocess and each

5 rocess executes at the maximum seed. One would exect that shadow relication will save energy but the question is how much energy and under what circumstances. All execution seeds in this section will be resented as factors of σ max. 85% 80% 75% 70% 65% 60% 55% 50% 45% 40% 35% 30% 25% 20% 15% 10% 5% Energy Savings α = 2.00 α = 1.75 α = 1.50 α = % 25% 50% 75% Static Power Percent Fig. 3. Energy savings of energy efficient relication when comared to ure relication as we vary static ower. W = 1 hour and MTBF = 5 years. In Figure 3 we show the energy savings for multile values of α, as exected the higher the α value the more energy that can be saved, demonstrating the tradeoff between time and hardware redundancy. We choose to lot α values from 1-2 because the amount of savings lateaus after 2, esecially for high static ower ercentages. We show these results of work size of 1 hour because our sensitivity analysis of the energy model shows work size has very little effect on the energy consumtion when the job sizes are much smaller than the node MTBF, W << MTBF. Given that our node MTBF is 5 years all most reasonable values for work are in this category. The amount of energy savings is also deendent uon the static ower factor, ρ. We therefore vary the ercentage of static ower resent in the system in Figure 3. As we increase the static ower the otential energy savings decreases and eventually matches ure relication. The maximum savings occurs when the static ower is lowest and α is highest, at this oint we can save u to 81% of exected energy for a given task. As static ower aroaches 100% the amount of savings decreases to 0%. There is exerimental data to suort a variety of static ower values, some studies show that the CPU accounts 40-50% [2] of the consumed ower and more recent studies show that number to be 15-30% [7]. Therefore we believe we should be focusing on the acheivable savings when static ower is between 50-85%. In this range energy efficient relication can save between 15-30% of the energy consumed by traditional relication. In Figure 4 we look at the energy savings achievable with stretched relication when comared to that of traditional relication. Similar to energy efficient relication, we observe that as the static ower increases the amount of energy savings decreases. Additionally as static ower increases the higher the α value the less energy one can save with stretched relication. Because while decreasing the execution seeds saves ower at a given oint in time it also increases the execute time thus causing stretched relication to consume more overall energy. Comaring Figures 3 and 4 one can see that energy efficient relication saves more energy for most ercentages of static 81.22% 65.77% 29.79% 15.87% 85% 80% 75% 70% 65% 60% 55% 50% 45% 40% 35% 30% 25% 20% 15% 10% 5% Energy Savings α = 2.00 α = 1.75 α = 1.50 α = % 25% 50% 75% Static Power Percent Fig. 4. Energy savings of stretched relication when comared to ure relication as we vary static ower. W = 1 hour and MTBF = 5 years. ower. However, as static ower reaches 100% the energy savings of both stretched and energy efficient relication converge to zero. This is understandable because both of these energy-aware relication techniques make the assumtion that slowing down the execution seed will be able to reduce energy consumtion. V. CONCLUSION The major contribution of this aer is a new technique, called shadow relication that rovides energy-aware fault tolerance in large-scale distributed comuting environments. We also develo a general framework for evaluating the energy consumtion of relication-based fault tolerant techniques. Using this energy model we then comare shadow relication to current relication techniques. We show that shadow relication has the otential of roviding energy savings of 15-30% of the energy consumed by traditional relication assuming a static ower is 50-85%, which is tyical of most systems today. We further show that a simle imlementation of stretched relication has the ability to also save energy but that energy efficient relication rovides additional energy savings of 5-10%. Most imortantly these results show that shadow relication has the otential to rovide fault tolerance while also roviding energy savings over existing fault tolerant techniques. Motivated by these results we have began work on imlementing shadow relication. This imlementation will then be used to measure the actual energy savings achievable by such a system. REFERENCES [1] L. Barroso and U. Holzle. The case for energy-roortional comuting. Comuter, 40(12):33 37, [2] X. Feng, R. Ge, and K. Cameron. Power and energy rofiling of scientific alications on distributed systems. In Parallel and Distributed Processing Symosium, Proceedings. 19th IEEE International, ages 34 34, [3] K. B. Ferreira. Keeing Checkoint/Restart Viable for Exascale Systems. PhD thesis, University of New Mexico, Albuquerque, New Mexico USA, June [4] B. Li, S. Song, I. Bezakova, and K. Cameron. Energy-aware relica selection for data-intensive services in cloud. In Modeling, Analysis Simulation of Comuter and Telecommunication Systems (MASCOTS), 2012 IEEE 20th International Symosium on, ages , % 60.58% 46.05% 12.06%

6 [5] U. D. of Energy Office of Science. The oortunities and challenges of exascale comuting, [6] W.-T. Tsai, P. Zhong, J. Elston, X. Bai, and Y. Chen. Service relication strategies with mareduce in clouds. In Proceedings of the 2011 Tenth International Symosium on Autonomous Decentralized Systems, ISADS 11, ages , Washington, DC, USA, IEEE Comuter Society. [7] K. Yoshii, K. Iskra, R. Guta, P. Beckman, V. Vishwanath, C. Yu, and S. Coghlan. Evaluating ower-monitoring caabilities on ibm blue gene/ and blue gene/q. In Cluster Comuting (CLUSTER), 2012 IEEE International Conference on, ages 36 44, [8] Q. Zheng. Imroving mareduce fault tolerance in the cloud. In Parallel Distributed Processing, Workshos and Phd Forum (IPDPSW), 2010 IEEE International Symosium on, ages 1 6, 2010.