performance modeling. He is a subject area editor of the Journal of Parallel and Distributed Computing, an associate editor

Transcription

1 VLR at the last HLR checkpointing). Thus, the expected number of HLR records need to be updated (with respect to the VLR) in the HLR restoration process is X E[N U ] = np n (7) 0n1 Let E[N V ] be the expected number records (for the portables of the HLR) in the VLR. From [3], we have E[N V ] = lim T H!1 E[N U] = (8) full professor of Department and Institute of Computer Science and Information Engineering, National Chiao Tung University. His current research interests include design and analysis of personal communications services network, distributed simulation, and performance modeling. He is a subject area editor of the Journal of Parallel and Distributed Computing, an associate editor of the International Journal in Computer Simulation, an associate editor of SIMULATION magazine, a member of the editorial board of International Journal of Communications, a member of the editorial board of Computer Simulation Modeling and Analysis, Program Chair for the 8th Workshop on Distributed and Parallel Simulation, and General Chair for the 9th Workshop on Distributed and Parallel Simulation. References [1] EIA/TIA. Cellular radio-telecommunications intersystem operations: Automatic roaming. Technical Report IS-41.3-B, EIA/TIA, [2] ETSI/TC. Restoration Procedures, Version Technical Report Recommendation GSM 03.07, ETSI, [3] J. Medhi. Stochastic Models in Queueing Theory. Academic Press, [4] Lin, Y.-B. Database Failure Recovery for Cellular Phone Networks. Submitted for Publication, [5] Lin, Y.-B. and Chen, W. Impact of busy lines and mobility on cell blocking in a PCS network. ICCCN '94, pages 343{347, [6] Noerpel, A.R., Chang, L.F., and Lin, Y.-B. Performance modeling of polling de-registration for unlicensed PCS. Submitted to IEEE JSAC, [7] Ross, S.M. Stochastic Processes. John Wiley & Sons, Yi-Bing Lin received his BSEE degree from National Cheng Kung University in 1983, and his Ph.D. degree in Computer Science from the University of Washington in Between 1990 and 1995, he was with the Applied Research Area at Bell Communications Research (Bellcore), Morristown, NJ. In 1995, he was appointed 9

2 function f m of t m is the same as that of t M. That is f m (t m ) = m e?mtm It can be shown that [6] if the interval between two VLR failures is much longer than T V, then t v (the period between the last checkpointing and the VLR failure) has a uniform distribution in the interval [0; T V ]. That is, the density function f v of t v is f v (t v ) = 1 T V ; 0 t v T V The VLR record is current if the portable does not move out the RA before the VLR failure or t m > t v. Thus, p M = Pr[t m > t v ] Z TV Z 1 = f m (t m )f v (t v )dt m dt v t v=0 t Z m=t v TV Z 1 = t v=0 = Z TV t v=0 t m=t v m e?mtm 1 T V dt m dt v e?mtv T V dt v = 1? e?mtv T V m (5) II. The Derivation of the Probability p U Suppose that no portable is in a VLR at the last HLR checkpointing before the HLR failure. Then p U is dened as the probability that there are portables in the VLR at the HLR failure time. To derive p U, we make the following assumptions. The portable arrivals to the VLR is a Poisson process with the arrival rate. The portable residence time at the VLR has a general distribution R(t) with mean 1=. The checkpointing period at the HLR is a constant T H. The portable population at the VLR can be modeled by an M=G=1 queue [5], and the probability that Table 1. The probability p U for dierent = values (T H = 100=) no portable (of the HLR) is in the VLR at the last HLR checkpointing time before the HLR failure is = e?= Let p n (t) be the probability that there are n portables in the VLR at the HLR failure time under the condition that the the interval between the last HLR checkpointing and the failure is t. Note that t has a uniform distribution in [0; T H ] as pointed out in Appendix A. Then from [7; 3], the number of portables in the VLR at time t is a nonhomogeneous Poisson process where where p n (t) = [ (t)t] n e? (t)t n! Z t (t) = 1? R() d =0 and the probability p U is p n = Z TH t=0 p n (t) dt T H The probability that the data in VLR are not recovered at HLR after the failure is! 1X p U = p n n=1 = (1? p 0 ) = e?= "1? Z TH t=0?r # t e =0 [1?R()]d dt (6) Equation (6) is solved numerically. Table 1 lists the values of p U when R(t) is exponential, uniform, and constant, respectively. The table suggests that p U is insensitive to the portable residence time distribution at the VLR. Note that p n also is the probability that the number of HLR records that need to be updated (with respect to the VLR) at the HLR restoration process (no matter how may number of portables are in the 8

3 At Step 3, Counter [V LR old ] is updated if Counter[V LR old ] is decremented from 1 to 0. This implies that all portables moved in V LR old during [T S; t] have moved out of V LR old before t. Thus, the records (regarding the HLR) of V LR old at time T S are the same as the records at time t. From the actions in Steps 2 and 3, it is apparent that at any time t > T S, Counter [i] > 0 if and only if Counter[i] > 0 (where 1 i I). After a HLR failure, the following steps are executed to restore the HLR. Step 1. The HLR sends a location information request message with the timestamp T S to VLR i for all i such that Counter [i] > 0. Step 2. When a VLR receives the location information request message from the HLR, it collects the information of the portables that moved in the VLR after T S. The information is sent back to the HLR. The HLR then restores the location records based on the information collected from the VLRs. V. Conclusions This paper studied failure restoration for PCS databases (specically, VLRs and HLRs). We modeled the VLR restoration with and without checkpointing. We derived the optimal VLR checkpointing interval to balance the checkpointing cost against the paging cost. Under some specic cost assumptions, our study indicated that VLR should not be checkpointed if the checkpointing frequency is higher than 10 times of the portable moving rate or is lower than 0:1 times of the portable moving rate. We modeled GSM periodic location updating (location conrmation) to quantify the relationship between the location conrmation frequency and the number of lost calls. We showed that periodic con- rmation does not improve the restoration process Fig. 9. The timing diagram for deriving p M if the conrmation frequency is lower than 0.1 times of the portable moving rate. We also proposed a mechanism called location update on demand which eliminates the need of periodic conrmation messages required in GSM. We described the failure restoration procedures for IS-41 and GSM. We modeled the number of lost call deliveries in IS-41 and GSM, respectively. Both the procedures in IS-41 and GSM cannot identify the VLRs that need to be accessed by the HLR after a failure. We proposed an algorithm to identify the VLRs, which can be used to aggressively restore a HLR after its failure. I. The Derivation of the probability p M To derive p M, we make the following assumptions. The interval between two VLR failures is a random variable with a general distribution. The VLR failure is much less frequent than the VLR checkpointing frequency. The VLR checkpointing interval is a constant T V. The portable residence time t M in an RA is exponentially distributed with mean 1= m. Consider the timing diagram in Figure 9. In this gure, t M represents the residence time of the portable in an RA (assume that the portable moves in the RA before the previous checkpointing and move out of the RA after the previous checkpointing), and t m is the interval between the previous checkpointing and when the portable moves out of the RA (for simplicity, we assume that if the portable move out of the RA before the VLR failure, it does not re-enter the RA before the failure occurs). From the memoryless property of the exponential distribution, the density 7

4 Fig. 7. The expected number of records to be sent from a VLR to the HLR after the HLR failure (Dashed line: E[N U ] = =) tion. Fig. 8. The data structures used to identify the VLRs To utilize the aggressive restoration approach, it is important that the number N U of the records to be sent from the VLR to the HLR is small. N U is the number of portables that are not in the VLR at the last HLR checkpointing, but are in the HLR at the HLR failure time. The expected number E[N U ] is given in (7) in Appendix B. Figure 7 plots E[N U ] as a function of = and T H. The gure indicates the intuitive result that E[N U ] increases as T H increases. When T H! 1, E[N U ] = E[N V ] = = (the dashed line). When T H is long, it is likely that all portables in the VLR at the failure time are dierent from the portables in the VLR at the last checkpointing time and E[N U ] = E[N V ]. If T H < 10=, E[N U ] is less than 60% of E[N V ] for E[T V ] > 5. IV. The Algorithm to Identify the Current VLRs at the HLR Failure We propose an algorithm to identify a VLR such that there are portables that move in the VLR between the last HLR checkpointing and the HLR failure but do not move out of the VLR before the failure. Figure 8 illustrates the data structures used in the algorithm. The database HLR is a collection of HLR records. For simplicity, we assume that a HLR record r[p] for portable p consists of two elds: r[p]:ts : the time of the latest VLR crossing (i.e., the time of the last registration) of p. r[p]:v LR: the current VLR of p (p entered this VLR at time r[p]:ts). Two other data structures used in this algorithm are T S: the last HLR checkpointing time. Counter : an array of counters. Suppose that there are I VLRs in the network. At time t, Counter[i] (where 1 i I) represents the number of portables that have moved in VLR i but have not moved out of the VLR during [T S; t]. The backup of HLR, T S, and Counter in the nonvolatile storage are denoted as HLR, T S, and Counter, respectively. HLR and T S are updated once per HLR checkpointing. Counter is only updated for some occasions. The algorithm guarantees that at any time t, Counter [i] = 0 if and only if the portables in VLR i at T S are the same as the portables in VLR i at t. At a HLR checkpointing, two actions are taken: HLR HLR and T S T S. During the normal registration, the algorithm works as follows. When the HLR receives a registration message m = (p; V LR new ) at time t, the following steps are executed. Step 1. Let V LR old = r[p]:v LR and ts old = r[p]:ts. r[p]:ts t, and r[p]:v LR V LR new. Step 2. Counter[V LR new ] Counter[V LR new ] + 1. If Counter[V LR new ] = 1 then Counter [V LR new ] Counter[V LR new ]. Step 3. If ts old > T S then the following steps are executed. Step 3.1 Counter[V LR old ] = Counter[V LR old ]? 1. Step 3.2 If Counter[V LR new ] = 1 then Counter [V LR new ] Counter[V LR new ]. At Step 2, Counter [V LR new ] is updated if Counter[V LR new ] is incremented from 0 to 1. This implies that p's record may not be in V LR new at time T S. 6

5 In IS-41 [1], the HLR recovery procedure is similar to the VLR recovery algorithm A3: 1. After a failure, the HLR initiates recovery procedures by sending a Unreliable Roamer Data Directive message to all of its associated VLRs. The VLRs then remove all records of the portables associated with that HLR from their memory. 2. At some future point in time, the base station detects the presence of a portable within its coverage area and the portable is registered at the VLR. The VLR then sends a registration message to the HLR associated with that portable, allowing the HLR to reconstruct its internal data structures in an incremental fashion. In this approach, the location records are restored purely by the radio contact of the portables. Before a location record is restored, call deliveries to the corresponding portable are lost. Basically, the probability of k lost calls is p L (k) as given in (3) and (4) for k = 1; 2 and is illustrated in Figures 4 and 5. The details of performance analysis for HLR failure can be found in [4]. In GSM [2], the HLR recovery procedure works as follows. The HLR database is periodically checkpointed. After a HLR failure, the database is restored by re-loading the backup. Note that the backup data may be obsolete. If a record is obsolete when a call delivery arrives, the call is lost. The obsolete data will be updated by call origination or location conrmation from the corresponding portable. In this approach, the probability that k call deliveries for a portable are lost can be expressed as p M p L (k) where m in (5) (see Appendix A) is replaced by where 1= represents the mean residence time of a portable in a VLR area. After a failure, the HLR may aggressively restore its data by requesting the known VLRs (based on the backup copy) to provide exact location information Fig. 6. The probability p U of portables. This approach, which is referred to as aggressive restoration, is attractive if not much update information (e.g., less than 10 location records) will be sent from a VLR to the HLR. However, the VLR backup may be obsolete, and the HLR may fail to obtain the portable locations from a VLR not indicated in the backup. Let p U be the probability that no portable (of the HLR) is in a VLR at the last HLR checkpointing time before a HLR failure, and some portables have moved in the VLR before the failure occurs. In other words, p U is the probability that the HLR fails to request update information from the VLR in the restoration process. To derive p U we make the following assumptions. The portable arrivals to the VLR is a Poisson process with the arrival rate. The portable residence time at the VLR has a general distribution R(t) with mean 1=. The checkpointing period at the HLR is a constant T H. The probability p U is given in (6) in Appendix B. Figure 6 plots p U as a function of = with T H = 1= and 10=, respectively. Let E[N V ] be the expected number of records (for the portables of the HLR) in the VLR. From (8) in Appendix B, E[N V ] = =. The gure indicates that p U is an increasing function of T H and =. When the expected number of portables in the VLR is less than 2.5, the probability p U that the HLR fails to identify the VLR can not be ignored (e.g., p U > 20% if E[N V ] = 0:5 and T H = 10=). Thus, if E[N V ] is small for a VLR, some actions in the HLR is required to make sure that the VLR will be identied by the HLR after the failure. We propose an algorithm to identify all VLRs that need to send update information to the HLR after a failure. The details of the algorithm is given in the next sec- 5

6 restoration request message is sent to all portables in the RAs associated with the VLR. The base stations use system broadcast channel to alert all portables in their coverage areas. The broadcasting cost is insignicant and can be ignored. When a portable receives the broadcast message, it informs the network of its existence by sending a location conrmation. Note that if all portables send the location conrmations immediately after the broadcast message, the base stations will be congested, and many collisions will occur. To resolve the problem, a portable will send the location conrmation within a random period. In our paper, we assume that the period has a uniform distribution in the interval [0; T P ]. Periodic location updating (or location update on demand) is analyzed as follows. From the previous description, it is clear that there is no extra cost for call originations, but there is penalty for call deliveries if the current location information is not available. It is important to derive the probability p L (k) that there are k call deliveries between the VLR failure and the arrival of the rst call origination or location conrmation. The costs of the rst call delivery after the VLR failure are p L (0) + [1? p L (0)]C A1 and p L (0) + [1? p L (0)]C A2 for A1 and A2, respectively. The probability that there are k lost calls after a VLR failure is p L (k) in A3. To derive p L (k), we make the following assumptions. The interval between two VLR failures is a random variable with a general distribution. The VLR failure is much less frequent than the call arrivals and the periodic location conrmations. The call originations are a Poisson process with the arrival rate o. The call deliveries are a Poisson process with the arrival rate d. In periodic location updating, the interval between two location conrmations is a constant T P. In location update on demand, T P is the maximum length of the random delay selected Fig. 4. The probability 1?p L(0) that extra paging cost is required for the rst call delivery in A2 (and for A1 if the location record is not current) Fig. 5. The probability p L(k 2) that there are more than 1 lost call (for a portable) in A3 for location conrmation after a portable receives the broadcast message. The probability p L (k) was derived in [4]. We are particularly interested in p L (0) and p L (1) which are expressed as o 1 p L (0) = + o + d T P ( o + d )? o T P ( o + d ) i h1 2? e?(o+d)tp p L (1) = o d ( o + d ) 2 + d T P ( o + d ) 2? i h1? e?(o+d)tp? d o + d? (3) 2 o d T P ( o + d ) 3 o d ( o + d ) 2 e?(o+d)tp (4) Note that 1? p L (0) is the probability that extra paging cost is required for the rst call delivery in A2 (and for A1 if the location record is obsolete). Figure 4 indicates that periodic location updating (or location update on demand) may reduce this probability if T P < 10= m is selected. Let p L (k 2) = 1? p L (0)? p L (1) be the probability that there are more than 1 lost call (for a portable) in A3. Figure 5 indicates that p L (k 2) can be reduced by periodic location updating if T P < 1= m for o = 10 m, and if T P < 10= m for o = m and 0:1 m. III. HLR Failure Recovery To restore the data of a HLR after a failure, the HLR needs the help of all the VLRs where its portables are located. 4

7 Fig. 2. The probability p M that a VLR backup record is current Fig. 3. The comparison of C A1 and C A2 the VLR are paged. as A3 (NON-CKPT-VLR). In A1 and A2, non-existing portables (either the portable is powered o or the HLR record is obsolete due to HLR failures to be described in the next section) may be considered active, and resources are wasted to locate the non-existing portables. In A3, the VLR assumes that the portable is not in any of its RAs. Any call delivery request from the HLR is rejected if the corresponding VLR record does not exist, and the call is lost. An important performance indication of A1 is the probability p M that a VLR record in the backup is current after the VLR failure. If p M is large, then a low paging cost of A1 is expected. Otherwise, the VLR backup does not improve the restoration process, and A2 or A3 should be considered. To derive p M, we make the following assumptions. The interval between two VLR failures is a random variable with a general distribution. The VLR failure is much less frequent than the VLR checkpointing frequency. The VLR checkpointing interval is a constant T V. The portable residence time in an RA is exponentially distributed with mean 1= m. The probability p M is derived in (5) in Appendix A. Figure 2 plots p M as a function of T V. The gure indicates that a large p M can be achieved by a short T V. However, a short T V implies a high checkpointing cost that may balance against the benet of the large p M value (low paging cost). Suppose that there are N RAs in the VLR, and the normalized cost of paging in an RA is 1. Then the cost of A1 (i.e., the call delivery cost assuming that this call delivery is the rst event after the VLR failure) can be expressed C A1 = p M + (1? p M )N + T V (1) The rst term of the right hand side of (1) represents the paging cost if the location record is current. The second term represents the cost if the record is obsolete. In this case, the remaining N? 1 RAs are paged after the rst unsuccessful paging. Since the time to actually locate the portable is longer (two page operations are required), this cost is reected by a penalty factor. The last term represents the VLR checkpointing cost. The constant is a checkpointing factor normalized by the paging cost. For A2, the cost is C A2 = N (2) (i.e., the rst call delivery requires to page all RAs). Figure 3 compares the costs (1) and (2). For a particular PCS system, economic analysis is required to estimate the values for and. This part is out of the scope of this paper. For the demonstration purpose we assume N = 4, = 1:1, and = 0:5; 1; 1:5 and 2. Figure 3 indicates that if the checkpointing factor is no less than 2, then A2 always outperforms A1. For 1:5, A1 may outperform A2 if the checkpointing interval T V is carefully chosen in the range [0:1= m ; 10= m ]. The delay to conrm the location of a portable after a VLR failure depends on the trac from the portable. If a portable is silent for a long time, it would be dicult to know whether the location information stored is correct or not during this period. GSM [2] exercises periodic location updating to reduce this delay. In this approach a portable periodically establishes radio contact with the network to conrm its location. We assume that the interval between two location conrmations is a constant T P. To eliminate the periodic conrmation cost, we propose a simple alternative called location updating on demand as follows. After a VLR failure, a VLR 3

8 ber, prole information, current location, validation period). Since the user may move from one RA to another, the location of the portable or mobile phone carried by the user must be identied before the connection can be established. The current location or Registration Area (RA) of a portable is usually maintained by a two-level hierarchical strategy with HLR and another type of database called the Visitor Location Register (VLR). A VLR is the location register other than the HLR used to retrieve information for handling of calls to or from a visiting mobile user. A VLR may cover of several RAs. Suppose that a portable moves from California (PCS3) to Morristown (RA1) in New Jersey (PCS2), the portable registers its location (RA1) at the VLR of PCS2. The VLR then informs the mobile's HLR (i.e., the HLR at PCS1 in New York City) of the VLR address of the current visited system (PCS2). The HLR may send a deregistration message to the old VLR (at PCS3) to cancel the obsolete record. If the mobile user moves from RA1 to RA2, its location information at the VLR of PCS2 is changed from RA1 to RA2. The HLR record at PCS1 does not need to be modied. To access the portable, the HLR is queried to nd the current VLR of the mobile phone. The VLR identies the portable's current RA, and return the location information back to the HLR. If the HLR or the VLR fail, one may not be able to access a portable. Thus, database recovery is required after the HLR or VLR failures to guarantee the service availability to a portable. This paper describes several PCS database failure restoration procedures and analyzes their performance. II. VLR Failure Recovery This section considers the VLR failure recovery. The VLR may be periodically checkpointed (this is referred to as checkpointed VLR or CKPT-VLR), or the VLR may not be checkpointed (this is referred to as non-checkpointed VLR or NON-CKPT-VLR). In CKPT-VLR, the backup of the VLR is restored after a VLR failure. Note that some records of the backup may be obsolete. In NON-CKPT-VLR, the VLR is considered as empty after a VLR failure. After the VLR failure, if the rst event of a portable is a call origination (a request from the portable), then the VLR notices the radio contact from the portable, and the location record for the portable is recovered (in either CKPT-VLR or NON-CKPT- VLR) or conrmed (in CKPT-VLR). If the rst event of a portable is a call delivery (someone attempts to call the portable), then the event may be aected by the failure. There are three alternatives. A1 (CKPT-VLR). Since the HLR forwards the request to the VLR, the VLR assumes that the portable is in one of its RAs. In CKPT-VLR, the VLR assumes that the location record (if exists) of the portable is current, and the base stations in the RA indicated by the record will page the portable. If the portable has moved to another RA of the VLR 1 then the paging operation fails, and the remainders of the RAs in the VLR will be paged after the rst unsuccessful paging. If the record for the portable does not exist, the action taken in A1 is the same as that in A2 to be described. A2 (NON-CKPT-VLR). Like A1, A2 assumes that the portable is in one of its RAs. Since the location record of the portable does not exist, a location record is created, and all RAs in 1 We do not consider the case that the portable has moved out of the VLR. In such a case, the HLR record will be updated, and the call delivery request will be forwarded to the current VLR of the portable. 2

9 Failure Restoration of Mobility Databases for Personal Communication Networks Yi-Bing Lin Abstract This paper studies failure restoration of mobility databases for personal communication networks (specically, VLRs and HLRs). We model the VLR restoration with and without checkpointing. The optimal VLR checkpointing interval is derived to balance the checkpointing cost against the paging cost. We also model GSM periodic location updating (location conrmation) to quantify the relationship between the location conrmation frequency and the number of lost calls. Fig. 1. PCS systems tion update compared to a penalty of moderately increased call setup times for the infrequent occasions when these users do receive calls. Keywords Fault tolerance, home Location Register, mobility mangement, visitor location register The HLR failure restoration procedures for IS-41 and GSM are described. We show the number of lost calls in a HLR failure. Both the procedures in IS-41 and GSM cannot identify the VLRs that need to be accessed by the HLR after a failure. An algorithm is proposed to identify the VLRs, which can be used to aggressively restore a HLR after its failure. loads in exchange for increased CPU processing and memory costs. The key observation behind forwarding is that if users change PCS registration areas frequently but receive calls relatively infrequently, it should be possible to avoid registrations at the Home Location Register (HLR) database, by simply setting up a forwarding pointer from the previous Visitor Location Register (VLR). Calls to a given user will rst query the user's HLR to determine the rst VLR which the user was registered at, and then follow a chain of forwarding pointers to the user's current VLR. We use a reference PCS architecture and the notion of a user's call-to-mobility ratio (CMR) to quantify the costs and benets of using forwarding and classes of users for whom it would be benecial. We show that under a variety of assumptions forwarding is likely to yield signicant net benets in terms of reduced signalling network trac and database loads for certain classes of users. For instance, under certain cost assumptions, for users with CM R < 0:5 forwarding can result in 20-60% savings over the basic strategy. This net benet is due to the signicant saving in loca- I. Introduction This paper studies failure restoration of mobility databases for personal communication networks (PCN). The PCN systems may be operated by dierent service providers, and every system consists of several registration areas (RAs) as shown in Figure 1. In this gure, there are three PCN systems PCS1, PCS2, and PCS3 that provide services in New York City, New Jersey and California, respectively. Every PCN service area consists of a number of RAs. For examples, the RAs in PCS2 cover Morristown, Piscataway, and Red Bank. Suppose that a user subscribes to the PCS service at the New York City. Then PCS1 is the home system of the mobile user, and other PCS systems such as PCS2 and PCS3 are visited systems of the mobile user. A permanent record of the user is stored at the the Home Location Register (HLR) at PCS1. The HLR is the location register to which a portable (mobile phone) identity is assigned for record purposes such as mobile user information (e.g. directory num- Yi-Bing Lin is Professor of Department of Computer Science and Information Engineering, National Chiao Tung University, Hsinchu, Taiwan, R.O.C. liny@csie.nctu.edu.tw 1