Processor A
Processor B
Processor C
1
Cache
Cache
Cache
2
bus
3
2
Secondary
Memory
Principles of Computer System Design © Saltzer & Kaashoek 2009
The durability mantra
Multiple copies, widely separated and independently administered…
Multiple copies, widely separated and independently administered…
Principles of Computer System Design © Saltzer & Kaashoek 2009
update
request #1
2 1
State
machine
Site 1
new state
prior state
2 1
Site 2
State
machine
new state
prior state
2 1
update
request #2
Site 3
State
machine
prior state
new state
Principles of Computer System Design © Saltzer & Kaashoek 2009
procedure RECONCILE (reference left, reference right,
reference last_reconcile_time)
quiesce all activity on left and right // Shut down all file-using applications
ALL_OR _NOTHING_GET (last_reconcile_time, reconcile_time_sector)
left_list ← enumerate(left)
right_list ← enumerate(right)
common_list ← intersect(left_list, right_list)
left_only_list ← remove members of common_list from left_list
right_only_list ← remove members of common_list from right_list
conflict_list ← nil
Principles of Computer System Design © Saltzer & Kaashoek 2009
for each named_file in common_list do // Reconcile files found both sides
left_new ← ( MODIFICATION_TIME (left.named_file) > last_reconcile_time)
right_new ← (MODIFICATION _TIME (right.named_file) > last_reconcile_time)
if left_new and right_new then
add named_file to conflict_list
else if left_new then
copy named_file from left to right
else if right_new then
copy named_file from right to left
else if MODIFICATION_ TIME (left.named_file) ≠
( MODIFICATION _TIME (right.named_file)
then TERMINATE (“Something awful has happened.”)
Principles of Computer System Design © Saltzer & Kaashoek 2009
for each named_file in left_only_list do // Reconcile files found one side
if MODIFICATION _TIME (left.named_file) > last_reconcile_time then
copy named_file from left to right
else
delete left.named_file
for each named_file in right_only_list do
if MODIFICATION _TIME (right.named_file) > last_reconcile_time then
copy named_file from right to left
else
delete right.named_file
for each named_file in conflict_list do
// Handle conflicts
MANUALLY _RESOLVE (right.named_file, left.named_file)
last_reconcile_time ← NOW ()
ALL_OR _NOTHING_PUT (last_reconcile_time, reconcile_time_sector)
Allow activity to resume on left and right
Principles of Computer System Design © Saltzer & Kaashoek 2009
high
Limit of
correctness
for this much
complexity
subjective
complexity of
coordination
scheme
limit of
correctness despite
unlimited complexity
correct
coordination
miscoordination and
wrong answers
low
none
unconstrained
Amount of concurrent activity permitted
Principles of Computer System Design © Saltzer & Kaashoek 2009