1. REPLICATION IN THE HARP FILE SYSTEM B. Liskov, S. Ghemawat, R. Gruber, P. Johnson, L. Shrira, M. Williams MIT

2. Paper highlights HARP is a fault-tolerant file system using –Uninterruptible power supplies and replication to support non-blocking writes – Upgradable witnesses to handle site failures Focus on key ideas –The paper was not covered in detail

3. Overall organization (I) A HARP system consists of three machines –a primary server –a secondary server –a server holding a witness All three servers are on separate Uninterruptible Power Supplies (UPS)

4. Overall organization (II) Primary UPS SecondaryWitness A UPS B C

5. The role of the UPS (I) Most file servers use non-blocking writes –Reply to clients before the data are actually written to disk Not acceptable for a fault-tolerant file server –Must write data in stable storage before replying to the client Major drawback is additional delay

6. The role of the UPS (II) The HARP system reply to clients as soon as the data have written in the main memories of both its primary and secondary server –Replicating data on two servers protect them from a single software or hardware failure –The two UPS protect them from a power failure

7. The role of the UPS (III) HARP uses replication and UPS to implement a stable storage in the main memory of its two servers

8. The role of the witness The witness does not do anything as long as both primary and secondary servers are operational When a failure occurs, the server that can contact the witness becomes the new primary –Ensures the consistency of the data in the presence of both site failures and network partitions

9. After a failure (I) Primary UPS SecondaryWitness A UPS B C

10. After a failure (II) Site B can communicate with the witness –It becomes the new primary HARP cannot operate with a single site –Site C becomes a temporary secondary: witness is said to be promoted In practice C does not get all replicated data from C – Keeps instead a log of all updates

11. After a failure (III) Old Primary UPS New Primary Temporary Secondary A UPS B C

12. After a failure (IV) When A recovers –A is brought up to date by B and C –A and B act again as primary and secondary servers –Temporary secondary server on C is demoted to its previous status of witness