Are we thinking broadly enough about dependable systems? Just what are the most influential factors that contribute to dependability? Is it the manufacturing process? Is it circuit design? Or software design? Or network capacity? Or perhaps implementation? The answer could be none of these and most certainly it's changed dramatically from even five years ago. Technology and best practices around its use have evolved to the point where dependable systems are gated by factors that go far beyond one's normal purview. Today, political, cultural and societal issues may well have an equal if not greater impact. We must challenge ourselves to consider all the dimensions of today's world and think about non-obvious relationships. This keynote will challenge the audience to think outside the box and consider the realities of today's world and its impact on dependable systems.

In this paper, we describe the architecture and features of DB2 Parallel Edition (PE). DB2 PE belongs to the IBM family of open DB2 client/server database products including DB2/6000, DB2/2, DB2 for HP-UX, and DB2 for the Solaris Operating Environment. DB2 PE employs a shared nothing architecture in which the database system consists of a set of independent logical database nodes. Each logical node represents a collection of system resources including, processes, main memory, disk storage, and communications, managed by an independent database manager. The logical nodes use message passing to exchange data with each other. Tables are partitioned across nodes using a hash partitioning strategy. The cost-based parallel query optimizer takes table partitioning information into account when generating parallel plans for execution by the runtime system. A DB2 PE system can be configured to contain one or more logical nodes per physical processor. For example, the system can be configured to implement one node per processor in a shared-nothing, MPP system or multiple nodes in a symmetric multiprocessor (SMP) system. This paper provides an overview of the storage model, query optimization, runtime system, utilities, and performance of DB2 Parallel Edition.

An approach for simulating models of highly dependable systems with general failure and repair time distribution is described. The approach combines importance sampling with event rescheduling in order to obtain variance reductions in such rare event simulations. The approach is general in nature and allows a variety of features commonly arising in dependability modeling to be simulated effectively. It is shown how the technique can be applied to systems with redundant components and/or periodic maintenance. For different failure time distributions, the effect of the maintenance period on the steady-state availability is explored. The amount of component redundancy needed to achieve a certain reliability level is determined.>

Replication at the partition level is a promising approach for increasing availability in a Shared Nothing architecture. We propose an algorithm for maintaining replicas with little overhead during normal failure-free processing. Our mechanism updates the secondary replica in an asynchronous manner: entire dirty pages are sent to the secondary at some time before they are discarded from primary's buffer. A log server node (hardened against failures) maintains the log for each node. If a primary node fails, the secondary fetches the log from the log server, applied it to its replica, and brings itself to the primary's last transaction-consistent state. We study the performance of various policies for sending pages to secondary and the corresponding trade-offs between recovery time and overhead during failure-free processing.

The authors present a unified framework for simulating Markovian models of highly dependable systems. It is shown that a variance reduction technique called importance sampling can be used to speed up the simulation by many orders of magnitude over standard simulation. This technique can be combined very effectively with regenerative simulation to estimate measures such as steady-state availability and mean time to failure. Moveover, it can be combined with conditional Monte Carlo methods to quickly estimate transient measures such as reliability, expected interval availability, and the distribution of interval availability. The authors show the effectiveness of these methods by using them to simulate large dependability models. They discuss how these methods can be implemented in a software package to compute both transient and steady-state measures simultaneously from the same sample run.>

Three aspects of the modeling of multiversion software are considered. First, the beta-binomial distribution is proposed for modeling correlated failures in multiversion software. Second, a combinatorial model for predicting the reliability of a multiversion software configuration is presented. This model can take as inputs failure distributions either from measurements or from a selected distribution (e.g. beta-binomial). Various recovery methods can be incorporated in this model. Third, the effectiveness of the community error recovery method based on checkpointing is investigated. This method appears to be effective only when the failure behaviors of program versions are lightly correlated. Two different types of checkpoint failure are also considered: an omission failure where the correct output is recognized at a checkpoint but the checkpoint fails to correct the wrong outputs and a destructive failure where the good versions get corrupted at a checkpoint.>

Markov models are widely used for the analysis of availability of computer/communication systems. Realistic models often involve state space cardinalities that are so large that it is impractical to generate the transition rate matrix let alone solve for availability measures. Various state space reduction methods have been developed, particularly for transient analysis. In this paper we present an approximation technique for determining steady state availability. Of particular interest is that the method also provides bounds on the error. Examples are given to illustrate the method.

Markov models are widely used for the analysis of availability of computer/communication systems. Realistic models often involve state-space cardinalities that are so large that it is impractical to generate the transition-rate matrix let alone solve for availability measures. An approximation technique is presented for determining steady-state availability. Of particular interest is that the method also provides bounds on the error. Examples are given to illustrate the method.>

A success (risk) measure of guaranteed availability is proposed. Using a genetic system model, the authors describe the measure and study the effects of the guaranteed level and the observation period on it. Furthermore, they introduce a numerical approach for continuous-time Markov chain models which allows component-level modeling, Coxian failure and repair distributions, time-dependent failure and repair rates and deferred repair and nondeferred repair strategies to be handled. An example of a fault-tolerant database computer system is considered and the measure of guaranteed availability is evaluated for various guaranteed levels and observation periods.>

The performability of degradable heterogeneous computer systems containing k > 1 types of components is considered. Previous analyses of such systems have been numerical in nature and yielded algorithms with either exponential complexity in the number of system states n, or polynomial in n with approximate truncations of infinite series. In this paper, a closed form expression for the performability of degradable heterogeneous systems is derived. Furthermore, an algorithm with polynomial complexity, O(kn3), is presented and applied to study the performability of a multiprocessor computer system.

This paper formalizes and extends a tree-based local area network, called the lookahead network, proposed by Lipovski, Goyal, and Malek. The leaf nodes in the network are workstations, and the nonleaf nodes consist of pure combinational logic used in carry lookahead circuits of binary adders. Any of the ring or bus access protocols (token passing, contention, etc.) can be used on this network. The first objective of this paper is to give a formal definition of the lookahead logic and show that it can be operated in either a bus or a ring mode. The advantage of using the lookahead logic is that it makes the network operation fail-soft, and since this logic is recursively defined, it simplifies network installation, expansion, and partitioning procedures. The second objective of this paper is to define a new round-robin access protocol on the lookahead network, which has much better throughputdelay characteristics than that of a token ring when the number of active nodes on the network is increased and/or the transmission speed is increased, and/or the average packet size is decreased. Moreover, this new protocol can implement a message-based priority scheme, which makes it useful in integrated voice and data networks.