1. Committed:Effects are installed to the database. Aborted:Does not execute to completion and any partial effects on database are erased. Consistent state: Derived state from serial execution. Inconsistency caused by: 1.Concurrently executing transaction. 2.Failures causing partial or incorrect execution of a transaction. Commit protocols: Protocols for directing the successful execution of a simple transaction. Termination protocols: Protocols at operational site to commit/abort an unfinished transaction after a failure.

2. Distributed Crash Recovery: Centralized Protocols Hierarchical Protocols Linear Protocols Decentralized Protocols Phase: Consists of a message round where all Sites exchange messages. Two Phase Commit Protocol: ARGUS, LOCUS, INGRES Four Phase Commit Protocol: SSD-1 Quorum: Minimum number of sites needed to proceed with an action

3. Commit/Termination Protocols Two Phase Commit Three Phase Commit Four Phase Commit Linear, Centralized, Hierarchical, Decentralized Protocols Two Phase Commit: Site 1Site 2 1.Trans. arrives. Message to ask for vote is sent to other site(s) Message is recorded. Site votes Y or N (abort) Vote is sent to site 1 2.The vote is received. If vote = Y on both sites, then Commit else Abort Either Commit or Abort based on the decision of site 1

4. The general may themselves be traitors or send inconsistent information. Byzantine Agreement: Problem of a set of processors to agree on a common value for an object. Processors may fail arbitrarily, die and revive randomly, send messages when they are not supposed to etc. Two generals are situated on adjacent hills and enemy is in the valley in between. Enemy can defeat either general, but not both. To succeed, both generals must agree to either attack or retreat. The generals can communicate via messengers who are subject to capture or getting lost. Byzantine General Problem:

5. q1q1 w1w1 a1a1 c1c1 c2c2 xact request start xact yes abort yes commit a2a2 no w2w2 q2q2 start xact yes start xact no abort commit Site 1 (co-ordinator) Site 2 (slave) cici aiai wiwi qiqi Figure. The local protocols for the two-phase commit protocol. Figure. The decentralized two-phase commit protocol. xact no i1 no in xact yes i1 yes in … … no 1i | |no ni … yes 1i | |yes ni … Site i (i = 1,2,…n) send receive

6. cici aiai wiwi qiqi xact i no i xact i yes i … abort i commit i q1q1 a1’a1’c1’c1’ W1’W1’ w1w1 a1a1 C1C1 c2c2 a2a2 q2q2 w2w2 Site 1 (co-ordinator) Site 2 (back-up) request xact 2 act 2 xact 3 xact 4 abort 2 act 2 commit 2 act 2 Site i (i = 3,4) (slave) yes 3 yes 4 commit 2 no 3 |no 4 abort 2 ack 2 commit 3 commit 4 ack 2 abort 3 abort 4 Figure. The SDD-1 four-phase commit protocol.

7. Protocol: Finite set of states Messages addressed to the site Messages sent by the site Initial state Abort states Commit states Properties: Protocols are non-deterministic: Sites make local decisions. Messages can arrive in any order. 1. 2. V V Q Q V Q Q : Q Q

8. Global State 1.Global state vector containing the states of the local protocols. 2.Outstanding messages in the network. A global state transition occurs whenever a local state transition occurs at a participating site. Exactly one global transition occurs for each local transition.

9. Global state graph Global state is inconsistent if its state vector contains both a commit & abort state. q 1 q 2 xact req w 1 q 2 start xact w 1 w 2 yes w 1 a 2 no a 1 w 2 abort c 1 w 2 commit a 1 a 2 c 1 c 2

10. Two states are potentially concurrent if: a reachable global state that contains both local states. Concurrency set of s is set of all local states that are potentially concurrent with it. C(s) C(w 1 ) = { V 2, a 2, w 2 } The sender set for s, S(s) = {t/t sends message m & m  M} where M be the set of messages that are received by s. t is a local state.

11. Global state Inconsistent if it contains both local commit state local abort state Final state if: all local states are final Terminal state if: an immediately reachable successor state  deadlock Committable state (local) if:  all sites have voted yes on committing the transaction otherwise, non-committable

12. Definition: Protocol is synchronous within one state transition if: one site never leads another site by more than one state transition. Theorem: Fundamental non-blocking A protocol is non-blocking iff: 1. no local state s C(s) = A (abort) and C (commit) 2. no non-committable state s C(s) = C (commit) Lemma: A protocol that is synchronous within one state transition is non-blocking iff: 1.No local state adjacent to both a commit & an abort state. 2. No non-committable state adjacent to a commit state.

13. q 1 q 2 xact req w 1 q 2 start xact w 1 w 2 yes w 1 a 2 no a 1 w 2 abort c 1 w 2 commit a 1 a 2 p 1 c 2 (initial state) c 1 c 2 Figure. The reachable global state graph for the protocol of Figure 4.1.

14. q1q1 w1w1 a1a1 c1c1 c2c2 request xact yes abort yes commit a2a2 p2p2 q2q2 xact yes xact no abort/- Site 1 (co-ordinator) Site 2 (slave) commit ack p1p1 no failure time out Figure. The protocol with failure and timeout transitions obeying rules 1 & 2.

15. Theorem: There exists no protocol using independent recovery that is resilient to arbitrary failures by two sites. G 0  abort | G 1 | G k-1  site j recovers to abort (only j makes a transition) other sites recover to abort G k  site j recovers to commit | G m  commit Failure of j  recover to commit Failure of any other site  recover to abort Same state exists for other sites First global state

16. Theorem: There exists no protocol resilient to a network partitioning when messages are lost. Rule 3: Rule 4: Isomorphic to Rule 1: Rule 2: undelivered message ↔ timeout timeout ↔ failure Theorem: Rules 3 & 4 are necessary and sufficient for making protocols resilient to a partition in a two-site protocol. Theorem: There exists no protocol resilient to a multiple partition.

17. Simple Termination Protocol Message sent by an operational site abort – If trans. state is abort (If in abort) committable – If trans. state is committable (If in p or c) non-committable – If trans. state is neither committable nor abort (If in initial or wait)  If at least one committable message is received, then commit the transaction, else abort it. Not robust Site 1 (committable)  site 2 No message Site 3 (non-committable)  site 2 Site 2 fails Conclusion Site 3 confused

18. Issue 1OPn. site fails immediately after making a commit decision Issue 2Site does not know the current operational status (i.e., up or down) of other sites. Site 1 Site 2 Site 3 Crash Commuts Committable Noncommittable Site 3 does not know if site 1 was up at beginning. Does not know it got inconsistent messages Resilient protocols require at least two rounds unless no site fails during the execution of the protocol.

19. Site i (i = 2,3,…n) (slave) cici aiai wiwi qiqi xact i no i xact i yes i … abort i commit i pipi prepare i ack i p1p1 a1a1 q1q1 w1w1 c1c1 ack 2 ack n commit 2 commit n … … … request xact 2 xact 4 … … no 2 | |no n abort 2 abort n … … yes 2 yes n prepare 2 prepare n Site I (co-ordinator) Figure. The central site three-phase commit protocol.

20. MESSAGES RECEIVED SITE 1SITE 2SITE 3SITE 4SITE5 initial state Commit- able non Round 1(1)CNNNN-NNNN Round 2FAILED(1)-CNNN--NNN Round 3FAILED (1)--CNN---NN Round 4FAILED (1)---CN Round 5FAILED ----C NOTE: (1) site fails after sending a single message. Figure. Worst case execution of the resilient transition Protocol.

21. First message round: Type of transaction stateMessage sent Final abort stateabort Committable statecommittable All other statesnon-committable Second and subsequent rounds: Message received from previous roundMessage sent One or more abort messagesabort One or more committable messagescommittable All non-committable messagesnon-committable (a) Summary of rules for sending messages. The transactions is terminated if: ConditionFinal state Receipt of a single abort messageabort Receipt of all committable messagescommit 2 successive rounds of messages where all messages are non-committable abort (b) Summary of commit and termination rules. Figure. Summary of the resilient decentralized termination protocol.

22. First Message round: Trans. stateMessage Sent abort committable othersnon-committable Second and subsequent rounds: Message from previous round: Message sent abort committable all non-committablenon-commitable Trans. is terminated if: abort  abort all committable  commit 2 successive rounds of  abort non-committable (no site failure)

23. Commit Rule: A transaction is committed at a site only after the receipt of a round consisting entirely of committable messages Termination Rule: If a site ever receives two successive rounds of non-committable messages and it detects no site failures between rounds, it can safely abort the transaction. Lemma: N i (r+1)  N i (r) Set of sites sending non-committables to site i during round r. Lemma: If N i (r+1) = N i (r), then all messages received by site i during r + r + 1 were non-committable messages.

24. Recovery Protocols: Protocols at failed site to complete all Transactions outstanding at the time of failure Classes of failures: 1.Site failure 2.Lost messages 3.Network partitioning 4.Byzantine failures Effects of failures: 1.Inconsistent database 2.Transaction processing is blocked. 3.Failed component unavailable.

25. Independent Recovery: A recovering site makes a transition directly to a final state without communicating with other sites. Lemma: For a protocol, if a local state’s concurrency set contains both an abort and commit, it is not resilient to an arbitrary failure of a single site. Rule 1: s: Intermediate state If C(s) contains a commit  failure transition from s to commit otherwise failure transition from s to abort s i  commit because other site may be in abort s i  abort because other site may be in commit cannot

26. Rule 2: For each intermediate state s i : if t j in s(s i ) & t j has a failure transition to a commit (abort), then assign a timeout transition from s i to a commit (abort). Theorem: Rules 1 and 2 are sufficient for designing protocols resilient to a single site failure. p: consistent p’: p + Failure + Timeout Transition s 2 = f 2  f 2  C(s i ) s i in s(s 2 ) f 2 ← inconsistent  s 1 f 1 site 1 fails