The Chinese University of Hong Kong Department of Computer Science and Engineering. Ph.D. Term Paper. Program Execution Time, Reliability and Queueing

Transcription

1 The Chinese University of Hong Kong epartment of Computer Science and Engineering Ph.. Term Paper Title: Program Execution Time, Reliability and Queueing Analysis in Mobile Environments Name: CHEN, Xinyu Student I..: Contact Tel. No.: A/C: xychencse.cuhk.edu.hk Supervisor: Markers: Mode of Study: Prof. Michael R. Lyu Prof. Jerome Yen (SEEM) & Prof. John C.S. Lui Full-time Submission ate: November 25, 2003 Term: 4 Fields: Presentation ate: Time: Venue: ecember 8, 2003(Monday) 9:45 10:15 am Rm. 1027, Ho Sin-Hang Engineering Building

2 Program Execution Time, Reliability and Queueing Analysis in Mobile Environments Abstract This term paper contains three main chapters. The first one is the analysis for program execution times with various checkpointing strategies; the second one is the expected-reliability analysis; and the last one is queueing analysis for message sojourn time in Access Bridge. All these analysis are conducted in mobile environments which is demonstrated by Wireless CORBA. We employ the number of received computational messages instead of time to indicate the completion of program execution on a mobile host. Handoff is another distinct factor that should be taken into consideration in mobile environments. Two checkpointing strategies, deterministic and random checkpointing, are investigated. In our approach, failures may occur during checkpointing and recovery periods. We derive the Laplace-Stieltjes Transform of the cumulative distribution function of the program execution time and its expectation. We propose a new term, two-terminal expected-reliability, to integrate different communication structures, which is introduced by handoff and therefore is unique in mobile environments, into one metric. The two-terminal expected-reliability includes not only the failure parameters but also the service parameters. Nevertheless, it is still a monotonically decreasing function of time. We study five message dispatch models in Access Bridges, which are basic queueing model, static and dynamic processor-sharing models, round-robin model, and feedback model. We derive the expected message sojourn time under steady state. I

3 Contents 1 Introduction Mobile Architecture Program Execution Time with Various Checkpointing Strategies Expected-Reliability Analysis Queueing Analysis for Access Bridges Program Execution Time Analysis Assumptions and Notations Program Execution Time without Checkpointing eterministic Checkpointing Strategy Random Checkpointing Strategy Comparisons and iscussions Conclusion Expected-Reliability Analysis efinitions and Assumptions MS Scheme SM Scheme MM Scheme General Two-Terminal MTTF Conclusion Queueing Analysis for Access Bridges State Assumptions Message Sojourn Time Basic ispatch Model II

4 4.2.2 Static Processor-Sharing ispatch Model ynamic Processor-Sharing ispatch Model Round-Robin ispatch Model Feedback ispatch Model Comparisons and iscussions Conclusion Conclusions and Future Work 43 III

5 Chapter 1 Introduction According to advances of wireless networking technologies, many portable information appliances are widely available, bringing about a computing paradigm shift in the direction of nomadic computing [6]. Nomadic computing enables users to access and exchange information while they roam around in mobile environments. Mobile environments introduce some unique characteristics which have not been analyzed in traditional fault tolerance areas. This term paper is to explore how some concepts evolves and to conduct some analysises. 1.1 Mobile Architecture istributed mobile computing environments have been addressed in hardware entities by many papers in the literature [1, 23]. In mobile distributed computing, much of the action takes place in the middleware level. Therefore, we regard that describing the mobile architecture using middleware entities would be more suitable. We borrow a mobile architecture from Telecom Wireless CORBA (Common Object Request Broker Architecture) [25], which is standardized by Object Management Group (OMG). This architecture is shown in Figure 1.1. As Figure 1.1 shows, a wireless CORBA environment consists of four main components excluding links: A Mobile Host (MH) is a terminal which is equipped with a wireless interface and keeps connections while roaming in wireless networks; A Static Host (SH) is a normal and fixed node in wired networks; An Access Bridge (AB) sits between MHs and SHs or other ABs to relay messages for its associated MHs, which is deployed in wired networks but contains a wireless interface; A Home Location Agent (HLA) keeps track of the current location of its registered MHs and provides operations to query MH location. 1

6 AB Wired Network AB SH SH SH HLA SH AB AB AB MH MH MH MH MH MH AB Acces Bridge HLA Home Locatin Agent MH Mobile Host SH Static Host Figure 1.1. Wireless CORBA environments and components In wireless CORBA, an AB connects to the wired network from a fixed location using standard cabling. It receives, buffers and transmits messages between the wireless network and the wired network infrastructure. A single AB supports a group of MHs and functions within a range, providing a single cell of wireless coverage. Multiple ABs provide multiple cells, allowing MHs to roam from one cell to another in maintaining connections to the network. This process is called handoff, which is a mechanism to seamless change a connection from one AB to another AB. All hosts communicate with each other by messages only. The GIOP (General Inter-ORB Protocol) tunnel is the communication channel, through which the GTP (GIOP Tunnel Protocol) messages are transmitted between an AB and an MH. The GTP messages can be classified into two categories: control message and computational message. No messages can be exchanged among MHs directly, even if they stay in the same cell of an AB. All messages to and from an MH are relayed by its currently associated ABs. uring the handoff, no computational messages can be transmitted between the ABs and the MH. 1.2 Program Execution Time with Various Checkpointing Strategies The program execution time with and without checkpointing in the presence of failures on SHs has been analyzed by many researchers. Those derived execution time expressions are based on the given time requirement for program execution without failures. In Chapter 2, we extend the analysis to mobile environments [8]. ue to the underlying message-passing communication mechanism, we employ the number of received computational messages instead of time to indicate the completion of program execution on a mobile host. Handoff is another distinct factor that should be taken into consideration in mobile environments. We assume that the events of message arrivals, failures, and handoffs occur independently and follow the Poisson distribution. Two checkpointing strategies, deterministic and random checkpointing, are investigated. In our approach, failures may occur during 2

7 checkpointing and recovery periods. We derive the Laplace-Stieltjes Transform (LST) of the cumulative distribution function (c.d.f) of the program execution time and its expectation. Some critical parameters are identified after a number of assessments and sensitivity analysises on the program execution time results. 1.3 Expected-Reliability Analysis Reliability analysis has long been an important area of research for wired networks. However, little reliability analysis has been conducted on wireless networks. Wireless networks, such as wireless CORBA, inherit the unique handoff characteristic which leads to different communication structures with various types of components and links. Therefore the traditional definition of two-terminal reliability is not suitable anymore. In Chapter 3, we propose a new term, two-terminal expected-reliability [9], to integrate those different communication structures into one metric, which includes not only the failure parameters but also the service parameters. Nevertheless, the two-terminal expected-reliability is still a monotonically decreasing function of time. The expected-reliability and the corresponding MTTF are evaluated quantitatively in different communication schemes. To observe the gains in reliability improvement, reliability importance of imperfect components are also evaluated. The results show that the failure parameters of different components take different effects on the MTTF and on the reliability importance. With different expected working times of a system, the focus of reliability improvement should be transferred to different components. 1.4 Queueing Analysis for Access Bridges ABs play an essential role in the fault tolerant architectures in mobile computing environments engaging wireless networks. They are the performance bottleneck in the presence of failures and handoffs of MHs. ifferent message dispatch policies in wireless networks impose different effects on message sojourn time in the ABs. In Chapter 4, we study five dispatch models which are basic queueing model, static and dynamic processor-sharing models, round-robin model, and feedback model [10]. We derive the expected message sojourn time in the ABs under steady state. We observe that the basic model and the static processor-sharing model demonstrate the worst performance. The other three models cut down the sojourn time by dynamically reducing the probability of message blocking which is introduced by failures and handoffs of MHs; however, which one is the best dispatch strategy depends on specific environments. These analysis results can help designers of wireless networks explore better fault tolerant features of mobile systems for their reliability and performance. 3

8 Chapter 2 Program Execution Time Analysis Analysises for the program execution time with and without checkpointing in the presence of failures on static hosts have been conducted by many researchers [15, 20, 24, 32]. In all the work they assume that the required program execution time is given under which the total program execution time is derived. Utilizing the time to indicate the completion of program execution is feasible for static hosts which do not be engaged in distributed computing. If the information exchange between hosts is introduced, the program execution time is not only controlled by the host itself, but also affected by the network conditions and other hosts. ue to the unpredicted essences of these conditions, the time requirement is no longer suitable to be utilized as the given parameter. And mobile environments introduce some other factors, such as handoff, which also interrupt the program execution on MHs. We know that the underlying communication mechanism in mobile computing is the message-passing system; therefore, an intuitive assumption is that we can employ the message number to indicate the completion of program execution. Another reason to utilize the message number is that the computation in an MH may not be continuous because the program needs to wait its expected informative messages to arrive. The computation is actually controlled by the messages. In mobile environments, messages exchanged between hosts can be classified as control messages and computational messages. Control messages are the messages which contain the control commands and instructions, but they do not proceed the computation. Computational messages are the messages that a program on an MH should receive in order to accomplish its dedicated task. If the program has received all the requested computational messages, it can successfully complete its task and terminate its execution. Therefore, we assume here that if a program on an MH continuously receives computational messages, it will terminate successfully. Afterwards, messages will refer to the computational messages for simplification. Failures to an MH cause the current computational state to be corrupted. To recover the state, the MH should rereceive some or all messages that have been received before failures, which prolongs the total program execution time. Without checkpointing, the program needs to recover its state from its initial start point; with checkpointing, 4

9 the program may restart from the last checkpoint and only needs to re-receive messages after that checkpoints. However, checkpointing itself introduces overhead as no computational message can be received during checkpointing. So there exists a trade-off between with and without checkpointing. In this chapter, we will analyze the program execution time with various checkpointing strategies: deterministic checkpointing and random checkpointing. The program execution time without checkpointing will also be derived. A checkpointing strategy is a rule that determines when to save the program s state [12]. We will derive the Laplace-Stieltjes Transform (LST) of the cumulative distribution function (c.d.f.) of the program execution time and its expectation for both strategies. ifferent checkpointing strategies may demonstrate different performance behaviors under different conditions; therefore, variations of the program execution time with different parameters will be demonstrated through a number of assessments and sensitivity analysises. 2.1 Assumptions and Notations We have assumed that a program on an MH determines its termination according to the number of computational messages that it should receive. Let be the required message number. The AB disseminates computational messages to an MH with exponentially distributed time intervals. The expected inter-message arrival time is. uring an execution of a program, three events may occur: failures, handoffs and checkpointings, denoted as, and, respectively. The instants of the occurrences of failures and handoffs form homogeneous Poisson processes with parameter and, respectively. After a failure, the MH will undergo repair and rollback processes. The repair process brings the failed MH back to normal operation, and the rollback process reloads the program status from the local or remote storage. The required repair time is denoted as, and the required rollback times as. Let be the handoff time and be the checkpoint creation time. All these four time requirements, and, are regarded as random variables with general distributions. If the MH is not in the computational state, which is to say that the MH is in the repair, rollback, handoff or checkpointing state, no computational messages will be forwarded to the MH. Failures will occur despite the MH s state. Handoffs cannot occur when the MH is in the repair state because the MH is not ready to exchange any information with ABs. Failures will be detected instantly when they occur. After failures, the AB will automatically redistribute messages since the last checkpoint. Let be the total program execution time with message number in the absence of failures, handoffs and checkpointings. We define that represents the total program execution time in the presence of event, " # $%, with the time requirement. Multiple events type may occur during program execution. As an example, &(') * denotes the program execution time if failures and handoffs both occur during program execution. The general cumulative distribution function (c.d.f.) of the random variable Stieltjes Transform (LST) of the c.d.f. of as /%, :9 ; =<?> 8A +B,C 5 which has the same probability distribution with, then /GF, 21 /, 21. is +-,.. We denote the Laplace- =<?>,. Let E be a random variable 5

10 E 2.2 Program Execution Time without Checkpointing Without checkpointing, a program should be restarted from its beginning after a failure, as all the computation from the beginning to the failure instant is lost. The program can recover its initial state from the local storage and this period is normally short; therefore, no rollback time will be taken into consideration. The program has three states during its execution, denoted as State 0, 1, and 2 shown in Figure 2.1 1, respectively. State 0 is the normal (operational) state, in which messages can be received. If a handoff occurs, the program transits to State 2. The program will enter State 1 if a failure occurs when the program is in State 0 or 2. A repair process will be conducted instantly when entering State 1. The restarting time is assumed to be much smaller than, so we ignore it here. uring State 1, failures may still occur, after which the repair is repeated [20], but handoffs cannot be made as the MH does not work in this state. Eventually the program returns to State 0. λ 0 ρ γ γ 2 1 γ Figure 2.1. State transition in program execution without checkpointing Lemma 1: The LST of the c.d.f. of, i.e., the sojourn time in State 1, is given by ('3, the repair time in the presence of failures with the time requirement / % / 21 % 1 %/ 21 % (2.1) and the expectation of ' is ' / :% %/ :% Proof: 2 Let be the time to the first failure after starting repair, then we have If " ' G('3 1, then a repair will be successful completed without failures, so the repair time is. If $#, a failure occurs after which another repair is simply repeated, denoted as E ('3. Thus the repair time is E 1 In state transition diagrams, we only show the transition rates which have been given explicitly in our assumption. 2 The proof follows similar approaches in [16, 24]. (2.2) ' in this 6

11 > case. Taking conditional expectation of as < > ', we get <?> $ <?> <?> F 1 should be independent of G('3 E. Unconditioning on, we have < > Removing the condition on, the result is / $213 < 6 9#; / 1 % < > < > < > F < > 1 / $21 1 / 1 % Rearranging the above equation yields Equation (2.1). After engaging the moment generating property of the Laplace transform [14], ' Equation (2.2). and Theorem 1: Let then the LST of the c.d.f. of and the expectation of ' ) * is 213 > (2.3) > 9#;, the expected repair time in the presence of failures is given by > 9#; /B21 % /B:% (2.4) (2.5) (' ) *, the program execution time without checkpointing, contains the form / (') * #" 213 %/ 21 2 ' %$ < 213 (2.6) (2.7) Proof: Under the assumptions stated above, the random variable inherits an -stage Erlang distribution with parameter [34]. Let &, & ' )(?, be the number of transitions from State 0 to State 2, i.e., the number of handoffs during a normal execution. So the total time requirement is +*-,. 90/.. Let be the time to the first failure event after starting program execution. Then we have (') * 1*-,. 90/. " 1*2,. 90/. G' E (' ) * 1 If 5 3*-,. 90/., the program will make & handoffs before it receives messages without failures. In this case, the total handoff time is *., 90/. and the total program execution time is *., 90/

12 )&, are independent and identically distributed (i.i.d.) random variables. If "# *., 90/., a failure occurs before the program receives messages and makes & handoffs. In this case, there is a repair time ('3 after which the program execution is restarted from its beginning, which means that the program is required to receive theorem is proofed. messages without failure interruptions again [24]. Following similar steps in the proof of Lemma 1, the From Equation (2.7), we know that the expectation of program execution time is an exponential function of the required message number. Remark 1: With no failures during program execution, i.e., tends to ', then ; ' ) * (2.8) Next we will investigate the total program execution time after engaging various checkpointing strategies. 2.3 eterministic Checkpointing Strategy Both checkpointing strategies in this chapter, deterministic and random checkpointing, place checkpoints according to the number of received computational messages. The difference is that how the number of messages in each checkpointing interval is distributed. By deterministic we mean that the number of messages in a checkpointing interval is fixed, and we denote this number as. With chosen beforehand, the program execution is broken into intervals. Each of the first intervals receives messages and takes a checkpoint, and the last interval should receive the residual messages; however, no checkpoints will be taken. The number of messages in the last interval is and ' #. γ λ /a 4 γ λ 0 γ ρ ρ γ γ (b) γ 2 3 (a) ρ γ γ (c) Figure 2.2. State transition in program execution with deterministic checkpointing 8

13 $ 8 Figure 2.2(a) shows the state transition during execution with equi-number checkpointing in the )( interval. There are two composite states 3 and 4, whose detailed representations are showed in Figure 2.2(b) and 2.2(c). State 3 corresponds to the composite repair and rollback state, in which State 5, 6, and 7 denote repair, rollback, and handoff, respectively. After undergoing a successful repair process in State 5, the program enters rollback state instantly. State 4 is the composite checkpoint creation state, in which State 8 denotes the checkpoint creation state and State 9 denotes the handoff state during checkpointing. In mobile environments, the MH itself cannot be treated as stable storage [27], therefore checkpoints are saved remotely on ABs. With wireless link communications engaged, the rollback time after a repair process cannot be omitted any more. So the total time between a failure and the instant that the program is ready to receive computational messages is * ', for simplicity it will be denoted as. The dashed rectangle with State 3 in Fig. 2.2 denotes that a program must complete a repair and rollback task before it enters State 0. We first calculate the sojourn time in State 3. * Lemma 2: Let 213 / 1 /B 1 % (2.9) then the LST of the c.d.f. of, the sojourn time is State 3, is given by and the expectation is / % / 21 % 1 %/ (2.10) 21 / :% / / 2 %/ :% (2.11) / /B:% Proof: The time requirement of repair and rollback in the presence of failures and handoffs is *2,. 9 /., where &, & ' )(, is the number of occurrences of handoffs during rollback. Following similar steps in Lemma 1 we can obtain (2.10) and (2.11). To simplify the analysis for the deterministic checkpointing, we assume that even after the first failure the program needs time to take it back to the normal state. Theorem 2: The LST of the c.d.f. of ) ') *, the program execution time with deterministic checkpointing, with the checkpointing parameter, is given by / 21 " 21 % %/ < / 1 21 % %/ (2.12) and its expectation is given by ) ') * " 2 $ / < /B:% 5 < (2.13) 9

14 , 8 8 Proof: With deterministic checkpointing, the execution time for the first * intervals,, are independent and identically distributed (i.i.d.) random variables and each of these intervals contains a checkpoint creation period; therefore, let us analyze the execution time for these intervals first. & denotes the number of handoffs and denotes the time to the first failure in the ) ') * * interval. Then we get *., 90/. *., 9 /. E ) ' ) * 1 If 1*., 90/., then the program will successfully complete this interval by taking a checkpoint without undergoing any failures. If # *., 9 /., a failure occurs before the program successfully takes a checkpoint. Then the MH will undergo repairs and the program should be restarted from the state saved on the last checkpoint, after which the program should receive computational messages without failure interruption again. This time is another random variable E with ) ' ) *. Taking conditional expectation of ) ') *, we get ": <?> &. $ ) ' ) * ; however, it engages the same probability distribution < > < >. 90/ < > < > *., 90/. < > < > F 1 in which. # 4 # & are i.i.d random variables and inherits an -stage Erlang distribution with parameter. Removing the conditions backwards one by one and solving the resulted equation, we get / % %/ After engaging the moment generating property of the Laplace transform, its expectation is given by ) ' ) * " 2 $ / : < 21 / :% The last interval is different from other intervals as no checkpoint will be taken and its required message number is instead of. Actually it is the execution time without checkpointing with message requirement. Therefore it engages the same expressions as the program execution time without checkpointing. The difference is that now the repair and rollback time is instead of G('3. As ) ' ) * < / 90/ ) ') * ) ') * which states that the total execution time is the sum of the execution times of separate parts, then we have < / / #" / 1 $ 10 / )(

15 and ) ' ) * Finally, we obtain Equation (2.12) and (2.13). ) ') * ) ' ) * Equation (2.13) shows that after taking deterministic checkpointing, the execution time demonstrates the exponential relationship with parameter instead of. Remark 2: With no failures during program execution, i.e., ; ) ') * 2.4 Random Checkpointing Strategy 2 " tends to ', then : $ (2.14) The deterministic checkpointing strategy takes checkpoints with the fixed computational message number. It is too rigid to adapt to different conditions. Extending the message number in each checkpointing interval from a constant to a random variable may gain some performance advantages. Following this extension, we step into the field of random checkpointing. The random checkpointing strategy takes checkpoints when the program have received messages since the last checkpoint, in which is a random variable. If is generally distributed, it is difficult to get an analytical solution. Here we assume that is a random variable with a geometric distribution whose parameter is, and its probability mass function (p.m.f.) is < /, in which (. The total execution time for a program to take a checkpoint during which handoffs may occur, denoted as (*, is given by the following lemma. Lemma 3: The LST of the c.d.f. of (* is given by / 13 / 21 /B21 (2.15) Proof: (* can be expressed by * 1*., 90/., in which & denotes the number of handoffs during the checkpoint. With & <, it is easy to derive the result in this lemma. and Theorem 3: Let 13 #/ > 9#; / :% (2.16) (2.17) then the LST of the c.d.f of ) ') *, the program execution time with random checkpointing, with the checkpointing parameter, contains the form / % / %/ 13 / 1 %/ < / (2.18) 213

16 $ and its expectation is given by Proof: < / / :% ) ' ) * # " $ < / 9 < / (2.19) With random checkpointing, the received computational messages number in each checkpointing interval is no longer a constant, and the number of checkpoints taken during an execution is also a random variable. So we cannot follow the method used in the proof of Theorem 2. We will utilize the difference equation to solve this problem. Let & be the number of handoffs during the normal execution without checkpointing, & be the number of handoffs before taking the first checkpoint, and be the time to the first failure. The execution time can be expressed by ) ') * If *., 90/. 1*2,. 9 /. " *., 90/. E ) ') * # "# *., 90/. "# 3*., 90/. (* 1*-,. 90/. (* ) ' ) * # " 1*., 90/. (*, before taking any checkpoints the program will terminate successfully. 90/., a failure without failures, so the total time is *., 90/.. If # *, occurs before the program receives messages and at the same time no checkpoints have been taken; if # *., 90/. *, a failure occurs before the program successfully takes the first checkpoint. Under both conditions, the MH needs repair and rollback, after which the program should receive messages over again. If *., 90/. (*, a checkpoint will be taken after receiving messages and no failures have occurred during this stage, after which there is still time is 2*, and one by one, we get in which and / /. (* ) ' ) * # #/ < / / messages should be received. So the total #. Taking LST and unconditioning on (* $. &, 21 / 1 # < / < / 90/ %/ 21 1 / < / 213 / 321 " / 1 % # " / 321 % 12 # 13 1 # 213 $ / 321 (2.20)

17 / " Taking the -transform with respect to, #; / / #/ / 21 / After some manipulations and taking the reverse -transform, we have / 1 # / 21 ; / % / in which ; is the irac delta function. As, ; '. Substituting / 21 # 21 / $ / / 321 (2.21) to Equation (2.20), we get Thus, Equation (2.21) can be solved and with some simplification, we get Equation (2.18). The expectation can also be derived using the moment generating property. Equation (2.19) shows the relationship between the execution time and Remark 3: With no failures during program execution, i.e., ; ) ') * tends to ', then 2 " 21 now is linear. Remark 4: When +', which means that no checkpoints will be taken, the program execution time is ; ) ) #" 2 $ < which contains the same form as that without checkpointing. :B%$ (2.22) (2.23) 2.5 Comparisons and iscussions In this section, we will compare the deterministic and random checkpointing from different aspects. We introduce the average effectiveness, denoted as, to evaluate the resulted program execution time. The average effectiveness is the ratio between the execution time without and with failures, handoffs and checkpoints. It can be expressed by (2.24) ) ' ) * From the average effectiveness, we can easily observe how much time is wasted due to events that interrupt the program execution. In all these comparisons, we will let :B A. As we know, the checkpoint creation time 13

18 is composed of two parts: one is the time to take a checkpoint and the other is the time to save the checkpoint on stable storage. In mobile environments, the MH itself cannot be treated as stable storage [7]; therefore, checkpoints should be transmitted through wireless links. However, wireless links may suffer low bandwidth and long transfer delay, which results the saving time is more significant. The rollback stage also contains two parts: reloading the last checkpoint from the remote stable storage and recovering the program s state from the checkpoint. Again the reloading process occupies the most time. Therefore it is reasonable to let : 5. Average Effectiveness a=1/p=2 a=1/p=10 a=1/p= Message Number n γ=10 3 λ=10 2 ρ=10 3 E(C)=20 E(H)=10 E(R)=20 E(U)=20 Without Checkpointing eterministic Checkpointing Random Checkpointing Figure 2.3. Average effectiveness vs. message number Figure shows how the average effectiveness varies with the required number of computational messages. The expectation of a random variable which contains a geometric distribution with parameter is. For the comparative purpose, we choose as a pair. When or tends to, more checkpoints will be taken. The effectiveness without checkpointing and with random checkpointing decreases monotonically with the message number ; however, the effectiveness with deterministic checkpointing demonstrates a fluctuant behavior. For the deterministic checkpointing strategy, before reaches, its behavior is the same as that without checkpointing. The difference between them is introduced by the assumption that the rollback time after the first failure cannot be omitted in the analysis of the execution time with deterministic checkpointing. After taking a checkpoint, the effectiveness tends to increase; however, when approaches to, the effectiveness decreases, which indicates that a checkpoint should be introduced. From the figure, we also can observe that the random checkpointing will achieve higher effectiveness than the deterministic checkpointing when 3 increases. The variation of effectiveness with the failure rate is shown in Figure 2.4. espite of different values of checkpointing parameters for both strategies, the effectiveness decreases with the failure rate. When is small, higher checkpointing frequency (smaller or 3 ) may decrease the effectiveness; however, when is higher enough, higher frequent checkpointing always gains higher effectiveness. Another phenomenon is that the deterministic 3 The average effectiveness is a discrete function of the message number, but for clarity we plot the figures in continuous curves. 14

19 Average Effectiveness a=1/p=20 a=1/p=10 a=1/p=2 λ=10 2 ρ=10 3 n=30 E(C)=20 E(H)=10 E(R)=20 E(U)=20 Without checkpointing eterministic checkpointing Random checkpointing Failure Rate γ Figure 2.4. Average effectiveness vs. failure rate checkpointing achieves higher effectiveness when is small; as increases, the random checkpointing wins. Average Effectiveness a=1/p=2 a=1/p=10 a=1/p= Checkpoint Creatin Time E(C) Sensitivity of Average Effctiveness x 10 4 a=1/p=20 a=1/p=10 a=1/p= Checkpoint Creatin Time E(C) eterministic checkpointing Random checkpointing γ=10 3 λ=10 2 ρ=10 3 n=30 E(H)=20 E(R)=10 Figure 2.5. Average effectiveness vs. checkpoint creation time Figure 2.5 shows the relation that the effectiveness decreases as the checkpointing creation time increases with different checkpointing frequencies in both checkpointing strategies. When is small, the effectiveness takes advantages on checkpointing; however, as becomes larger and larger, the overhead will surpass the gained benefit, which results in less effectiveness. The right side figure shows that the higher the checkpointing frequency is, the faster the decrease is, which indicates that when it takes more time to make a checkpoint, the program may reach less effectiveness under higher checkpointing frequency. 15

20 Average Effectiveness a Sensitivity of Average Effectiveness a λ=10 2 ρ=10 3 n=30 E(C)=20 E(H)=10 E(R)=20 E(U)=20 γ=10 2 γ=10 3 γ=10 4 Figure 2.6. Optimal deterministic checkpointing Average Effectiveness p Sensitivity of Average Effectiveness p λ=10 2 ρ=10 3 n=30 E(C)=20 E(H)=10 E(R)=20 E(U)=20 γ=10 2 γ=10 3 γ=10 4 Figure 2.7. Optimal random checkpointing Figure 2.6 and 2.7 show how to achieve the highest effectiveness by adjusting the optical checkpointing frequencies. When the failure rate is higher enough, taking a checkpoint after receiving each message, i.e., is a good approach to assure high effectiveness, shown as the dotted curves. When is small, too higher or too smaller checkpointing frequency will result in low effectiveness, under which there exists an optimal checkpointing frequency that maximizes the effectiveness. Figure 2.8 exhibits the variations of effectiveness with the message arrival rate and the handoff rate. The effectiveness decreases as increases, despite engaging checkpointing or not. Without checkpointing the effectiveness increases with. But for both checkpointing, the effectiveness increases first and then decreases. When the message arrival rate is low, checkpointing increases the effectiveness. But when the message arrival rate is high, the program will be completed by experiencing less failures, and most checkpoints do not contribute to the effec- 16

21 Without checkpointing γ=10 3 Average Effectiveness Handoff Rate ρ eterministic checkpointing Random checkpointing a=10 p=0.1 n=30 E(C)=20 E(H)=10 E(R)=20 E(U)= Message Arrival Rate λ Figure 2.8. Average effectiveness vs. message arrival rate and handoff rate tiveness. Consequently, checkpointing incurs more overheads. Under this condition, we should take checkpoints less frequently to reduce these overheads. Another observation is that random checkpointing achieves higher effectiveness when is small; however, as increases the deterministic checkpointing exceeds. The effectiveness with the random checkpointing is more stable against the variation of parameters. 2.6 Conclusion In this chapter, we carry out the analysis of the program execution time with various checkpointing strategies. At the same time, the execution without checkpointing is also analyzed. The execution requirement for a program on an MH is the number of computational messages. We assume that the failure interval, message arrival interval, and handoff interval are random variables with exponential distributions. Two checkpointing strategies: deterministic and random checkpointing are considered. We derive the LST of c.d.f. of the total program execution time and its expectation. We point out that the random checkpointing is more stable against the variation of parameters. Some trade-offs with different parameters are also demonstrated. It shows that under different conditions, different checkpointing strategies, even without checkpointing, should be engaged to achieve higher performance. 17

22 Chapter 3 Expected-Reliability Analysis Reliability analysis has long been an important area of research for wired networks [2, 18, 19, 29, 30] but not for wireless networks. As the mobile technology matures, however, wireless networks [13, 22] are being used in more applications in providing significant benefits to mobile users. Wireless networks are more prone to failures and loss of access; therefore, the reliability requirements of wireless networks should be rigorously assessed. The reliability issue for wireless networks is quite different from that for wired networks as the terminal mobility feature is unique in wireless networks. For the wireless CORBA to be functional, its components must be fit for service. Unfortunately, this is not always the case, because these components may not be reliable [18]. We need a mechanism to assess the reliability of wireless networks. However, as the wireless CORBA provides the handoff operation which is a new feature, the traditional two-terminal reliability [31] is not suitable anymore. The handoff operation causes existing communication structure to change with the MH s movement. At different time periods, different components are employed. This chapter seeks a new approach to define the reliability metric in wireless networks, which not only keeps the monotonically decreasing characteristic of reliability but includes the mobility nature in the system. ifferent effects imposed by component failure parameters and mobile service parameters will be given through numerical examples. To observe the gains in reliability improvement, reliability sensitivity analysis of imperfect components are also evaluated. Although our analysis is conducted on wireless CORBA platforms, it is extensible to generic wireless network systems. 3.1 efinitions and Assumptions In general, reliability is defined as the probability that a system performs its intended functions successfully for a given period of time under specified environmental conditions, and we call the probability of successful communication between the source node and the target node as two-terminal reliability [31]. For two nodes 18

23 8 > > * > to communicate with each other, there should be at least one operating path between them. An operating path indicates that all the intermediate nodes and links of the path should be in operation states. A node is operational if and only if it functions as intended, and a link is operational if and only if it allows communication from its source node to its terminal node [33]. Because the two-terminal reliability problem in wired networks has been studied thoroughly in the literature, we assume that the intermediate nodes and wired links are always reliable, i.e., there will always be a reliable path between an AB and an SH or between an AB and another AB. For the wireless part, an MH has only one wireless link with one AB and it associates with only one AB at a time except during handoff. Therefore, the communication path built on the top of wireless links is simple, and we assume that the wireless link failures are negligible. However, all the four components of wireless CORBA are failure-prone and they can fail independently. Based on the assumptions made before, a successful communication between two nodes is defined as all the engaged nodes, including the source node and the target node, are in operation states. As a result, the two-sh reliability is the multiplication between the two individual SHs reliabilities. If one or both of the two terminals are MHs, the traditional two-terminal reliability metric cannot correctly describe the characteristic introduced by the handoff. As MHs move and perform handoff operations, the communication structures will be different. Each communication structure can be regarded as a serial system composed of different types and numbers of engaged components. Additionally, the handoff operation induces that the MH s published address will be outdated and a mechanism is needed to resolve the current location of the MH. Therefore we propose a new term, two-terminal expected-reliability, to address these cases unique to wireless environments. We define the system state, 1, as the communication structure; therefore, 1 changes with time. Let > denote the probability that the system is in state 1 at time. The two-terminal expected-reliability at time,, is given by in which > denotes the reliability of the system in state 1 at time. > 9 / > > (3.1) > can be expressed by (3.2) in whichc21,c213 )(, is the number of engaged components in system state 1, is the reliability of the * component, is the type of a component, which may take value,, 13, or, and 21, 213 ' (, is the number of component employed in state 1. is a function composed not only of failure parameters but also of service parameters introduced by state probability >. From the above definitions, we note that the two-terminal expected-reliability can be simply extended to include the reliability metrics of wired and wireless links. The two-sh reliability can be treated as a special case in which the system contains only one communication structure, i.e., >, and > " >. Under the adopted assumptions, we can say that the expected-reliability is a generalization of the traditional two-terminal reliability. Accordingly, we 19

24 * 6 ; define two-terminal MTTF as There exist four communication schemes if random communications occur between MHs and SHs, which are SS scheme, MS scheme, SM scheme, and MM scheme. In these notations the former capital letter denotes the type of the source node and the latter letter denotes the type of the target node, where stands for MH and stands for SH. uring communications, an MH associates with an AB and exchanges messages with other nodes. As the MH moves, it will make handoffs and associate with new ABs. The sojourn time with an AB and the handoff completion time are assumed as random variables which are exponentially distributed with parameters and, respectively. We also assume that the component hazard rates are constant, i.e., we model component failures as homogeneous Poisson processes, resulting in independent, exponential component failure arrival process [35]. The constant failure parameters for the four components of wireless CORBA, MH, AB, SH, and HLA, are,,, and, respectively. Utilizing the exponential distribution as the service distribution and the failure distribution is for simplicity; however, what the failure distribution really is should not affect the conclusions we derived. ifferent communication schemes engage various types and numbers of components which result in different two-terminal expected-reliabilities and MTTFs. The SS scheme is trivial and its expected-reliability has been derived above, > > >. Therefore, we will discuss the remaining MS, SM, and MM schemes in the following three subsections separately. (3.3) SH SH AB AB1 AB2 ρ a b MH MH η (a) (b) (I) Figure 3.1. System states and Markov model in MS scheme 3.2 MS Scheme The MS scheme is a communication scheme in which an MH initiates the communication with an SH. Initially, the MH sends requests over a wireless link, then the associated AB relays the request messages to the target SH through wired links. After a random sojourn time in the current AB, the MH may perform a handoff during which 20

25 8 8 the new AB and the old AB both should work. The system states are thus shown in Figure 3.1, in which the solid arrow lines denote the request paths and the dashed arrow lines denote the reply paths. The detailed communication paths among the MH, AB/, and AB in state are omitted for simplicity, which are different between the network initiated handoff and the terminal initiated handoff [25]; however, the engaged nodes are the same. Furthermore, the detailed communication paths in handoff do not influence the expected-reliability. In addition, the HLA of this MH is also excluded from state. As we know, during the handoff the new AB sends a location update message to the HLA to inform it that the MH has changed its associated AB. Normally, the HLA should be in work during a handoff. However, if we employ a simple message retry strategy, the HLA will eventually receive the location update message no matter whether it works or not during the handoff. This is a simple approach to improve the system reliability. After the handoff, the system returns to state for normal communications. Figure 3.1(I) shows the Markov model of the system state transition, where is the handoff rate and is the handoff completion rate. Expected Reliability Q a (t)r a (t) Q b (t)r b (t) ER(t) α=10 3 β=10 3 γ=10 4 ρ=10 2 η= Time Figure 3.2. Expected-reliability of MS scheme and The probabilities of the system in state and at time can be solved analytically, which are given by [21] < < (3.4) One realization of the two-terminal expected-reliability of the MS scheme, >, is shown in Figure 3.2. ifferent classes of components experience different levels of failures. The SHs are generally more reliable than the MHs and the ABs. Therefore we let ' < and ' <. Actually, the specific values of the parameters do not change the shapes of the curves. As expected, the probability of the system in state is much greater than that in state as the handoff procedure is completed very quickly, resulting in the case that the reliability of state contributes more to the expected-reliability than that of state. 21 (3.5) is a monotone decreasing

26 < 8 < 8 function of time ; however, increases first and then approaches an upper limit. All these lead to increase first and then decrease. Nevertheless, the expected-reliability is still a monotone decreasing function of time. Figure 3.3 shows the two-terminal MTTF as a function of failure parameters and state transition MTTF β 10 5 γ=10 4 ρ=10 2 η=10 1 MTTF α η ρ ( a ) ( b ) α=10 3 β=10 3 γ= Figure 3.3. Two-terminal MTTF of MS scheme parameters. The more reliable the components are, the longer the MTTF is. However, the improvement gains (in terms of the MTTF) reduce with the increase in the failure parameters, and, beyond a certain threshold, which can be observed from Figure 3.3(a). Such diminishing gains should be carefully considered against the cost of increasing components reliability beyond a limit [35]. This result is also applied to parameter. From the following equation > (3.6) we see that and have the same effects on the > and little difference exists between and when is much smaller than. As the result, Figure 3.3(a) is almost symmetric. This means that each component is critical to successful system communications. Figure 3.3(b) shows that when is high, the MTTF increases with ; however, when is low, the MTTF varies little with. This indicates that when the handoff happens frequently, the time spent in the handoff period is very critical to the MTTF, because the reliability is clearly lower in the handoff state than in the normal state. When is low, however, the contribution of the second term in Equation (3.6) is small, leading to little change of the MTTF with. To achieve higher expected-reliability, then, MHs experiencing high handoff rates should complete the handoff operation as fast as they can. 3.3 SM Scheme In the SM scheme, an SH initiates communications with an MH. The difference with the MS scheme is that the SM scheme introduces a mechanism to locate the AB with which the MH is currently associated. The location 22

27 SH HLA SH SH SH SH HLA AB AB AB1 AB2 AB1 AB2 AB1 AB2 MH MH MH MH MH (c) (d) (e) (f) (g) c ν d β ν ρ f η e (II) Figure 3.4. System states and Markov model in SM scheme mechanism complicates the system states, as shown in Figure 3.4. An object on an MH publishes its Mobile Interoperable Object Reference (MIOR) with the address of the MH s HLA. When an SH first invokes an object on an MH with a published MIOR, the request message will be sent to the indicated HLA and the HLA will reply with a GIOP (General Inter-ORB Protocol) LOCATION FORWAR message returning another MIOR indicating the AB that the HLA believes the MH is currently associated with [25]. This is the system state. The time spent in this state is also assumed as an exponentially distributed random variable with parameter. If the SH gets the LOCATION FORWAR message from the HLA, the system enters state, a normal communication state. Then, the MH resends the request to the AB and the AB forwards the message to the MH. State is the handoff state. As the SH does not know whether its target MH has experienced a handoff or not, it still sends requests to the known AB as normal despite of the movement of the MH. However, the contacted AB knows that the MH has been associated with another AB, and replies to the requests with LOCATION FORWAR messages returning new MIORs indicating the AB that the MH is now associated with, which is state. Because / functions as an HLA when the system is in state, the HLA could be treated as a hot standby component to replace / when / is failed, even though the failure rates may be different between these two components. If / fails to reply to a request, the SH may resend the request to the HLA to get the up-to-date MIOR. This is the system state, in which the dashed oval implies that the component is failed. The Markov model of the system state transition is shown in Figure 3.4(II) in which state is treated as state as their communication structures are the same. As state is also a location-forwarding state, we assume that the time spent in this state follows the same distribution 23