Tải bản đầy đủ
9 Agarwal–El Abbadi quorum-based algorithm

# 9 Agarwal–El Abbadi quorum-based algorithm

Tải bản đầy đủ

332

Distributed mutual exclusion algorithms

level “k,” we have 2k+1 − 1 sites with its root at level k and leaves at level 0.
The number of sites in a path from the root to a leaf is equal to the level of
the tree k + 1, which is equal to O(log n). There will be 2k leaves in the tree.
A path in a binary tree is the sequence a1 , a2 , … , ai , ai+1 , … , ak such that
ai is the parent of ai+1 .
The algorithm for constructing structured quorums from the tree is given
in Algorithm 9.6. For the purpose of presentation, we assume that the tree is
complete, however, the algorithm works for any arbitrary binary tree.

(1) FUNCTION GetQuorum(Tree: NetworkHierarchy): QuorumSet;
(2)
VAR left, right: QuorumSet;
(3)
BEGIN
(4)
IF Empty (Tree) THEN
(5)
RETURN ({});
(6)
ELSE IF GrantsPermission(Tree↑.Node) THEN
(7)
RETURN((Tree↑.Node) ∪ GetQuorum (Tree↑.LeftChild));
(8)
OR
(9)
RETURN((Tree↑.Node) ∪ GetQuorum (Tree↑.RightChild));
(10)
ELSE
(11)
left ← GetQuorum(Tree↑.left);
(12)
right ← GetQuorum(Tree↑.right);
(13)
IF (left = ∅ ∨ right = ∅) THEN
(14)
(* Unsuccessful in establishing a quorum *)
(15)
EXIT(-1);
(16)
ELSE
(17)
RETURN(left ∪ right);
(18)
END; (* IF *)
(19)
END; (* IF *)
(20)
END; (* IF *)
(21) END GetQuorum
Algorithm 9.6 Algorithm for constructing a tree-structured quorum [1].

The algorithm for constructing tree-structured quorums uses two functions
called GetQuorum(Tree) and GrantsPermission(site) and assumes that there
is a well-defined root for the tree. GetQuorum is a recursive function that
takes a tree node “x” as the parameter and calls GetQuorum for its child node
provided that the GrantsPermission(x) is true. The GrantsPermission(x) is
true only when the node “x” agrees to be in the quorum. If the node “x” is
down due to a failure, then it may not agree to be in the quorum and the
value of GrantsPermission(x) will be false. The algorithm tries to construct
quorums in a way that each quorum represents any path from the root to
a leaf, i.e., in this case the (no failures) quorum is any set a1 , a2 , … , ai ,
ai+1 , … , ak , where a1 is the root and ak is a leaf, and for all i < k, ai is the
parent of ai+1 . If it fails to find such a path (say, because node “x” has failed),
the control goes to the ELSE block which specifies that the failed node “x”

333

9.9 Agarwal–El Abbadi quorum-based algorithm

is substituted by two paths both of which start with the left and right children
of “x” and end at leaf nodes. Note that each path must terminate in a leaf site.
If the leaf site is down or inaccessible due to any reason, then the quorum
cannot be formed and the algorithm terminates with an error condition. The
sets that are constructed using this algorithm are termed as tree quorums.

9.9.2 Analysis of the algorithm for constructing tree-structured quorums
The best case scenario of the algorithm takes O(log n) sites to form a tree
quorum. There are certain cases where even in the event of a failure, O(log n)
sites are sufficient to form a tree quorum. For example, if the site that is parent
of a leaf node fails, then the number of sites that are necessary for a quorum
will be still O(log n). Thus, the algorithm requires very few messages in a
relatively fault-free environment. It can tolerate the failure up to n − O(log n)
sites and still form a tree quorum. In the worst case, the algorithm requires
the majority of sites to construct a tree quorum and the number of sites is
same for all cases (faults or no faults). The worst case tree quorum size is
determined as O((n + 1)/2) by induction.

9.9.3 Validation
The tree quorums constructed by the above algorithm are valid, i.e., they
conform to the coterie properties such as Intersection property and Minimality
property. To prove the correctness of the algorithm, consider a binary tree
with level k + 1. Assume that root of the tree is a1 . The tree can be viewed
as consisting of a root, a left subtree, and a right subtree. According to
Algorithm 9.6, the constructed quorums contain one of the following:
1. {a1 } ∪ { sites from the left subtree};
2. {a1 } ∪ {sites from the right subtree};
3. {sites from the quorum set of left subtree} ∪ {sites from the quorum set
of right subtree}.
Clearly, the quorum of type 1 has non-empty intersection with those quorums formed using types 2 or 3, which shows that the Intersection property
holds true. Also, the members in the quorum of type 1 are not contained in
quorums of types 2 and 3. Thus, the Minimality property holds true. Similar
conditions exist for quorums of types 2 and 3. This forms as the basis for
proving correctness of the algorithm based on induction.

9.9.4 Examples of tree-structured quorums
Now we present examples of tree-structured quorums for a better understanding of the algorithm. In the simplest case, when there is no node failure, the
number of quorums formed is equal to the number of leaf sites.

334

Distributed mutual exclusion algorithms

Figure 9.16 A tree of 15 sites.

1

2

4

8

3

5

9

10

6

11

12

7

13

14

15

Consider the tree of height 3 shown in Figure 9.16 constructed from
15 (23+1 − 1) sites. Now, a quorum has all sites along any path from root to
leaf. In this case eight quorums are formed from eight possible root-leaf paths:
1–2–4–8, 1–2–4–9, 1–2–5–10, 1–2–5–11, 1–3–6–12, 1–3–6–13, 1–3–7–14
and 1–3–7–15. If any site fails, the algorithm substitutes for that site two
possible paths starting from the site’s two children and ending in leaf nodes.
For example, when node 3 fails, we consider the possible paths starting from
children 6 and 7 and ending at the leaf nodes. The possible paths starting from
child 6 are 6–12 and 6–13, while the possible paths starting from child 7 are
7–14 and 7–15. So, when node 3 fails, the following eight quorums can be
formed: 1,6,12,7,14 , 1,6,12,7,15 , 1,6,13,7,14 , 1,6,13,7,15 , 1,2,4,8 ,
1,2,4,9 , 1,2,5,10 , 1,2,5,11 .
If a failed site is a leaf node, the operation has to be aborted and a treestructured quorum cannot be formed (see lines 13–15 of the algorithm above).
However, quorum formation can continue with other working nodes. Since
the number of nodes from root to leaf in an “n” node complete tree is log
n, the best case for quorum formation, i.e, the least number of nodes needed
for a quorum is log n. In the worst case, a majority of sites are needed for
mutual exclusion. For example, if sites 1 and 2 are down in Figure 9.16, the
quorums that are formed must include either 4,8 or 4,9 and either 5,10
or 5,11 and one of the four paths 3,6,12 , 3,6,13 3,7,14 or 3,7,15 .
In this case, the following are the candidates for quorums: 4,5,3,6,8,10,12 ,
4,5,3,6,8,10,13 , 4,5,3,6,8,11,12 , 4,5,3,6,8,11,13 , 4,5,3,6,9,10,12 ,
4,5,3,6,9,10,13 , 4,5,3,6,9,11,12 , 4,5,3,6,9,11,13 , 4,5,3,7,8,10,14 ,
4,5,3,7,8,10,15 , 4,5,3,7,8,11,14 , 4,5,3,7,8,11,15 , 4,5,3,7,9,10,14 ,
4,5,3,7,9,10,15 , 4,5,3,7,9,11,14 , and 4,5,3,7,9,11,15 .
When the number of node failures is greater than or equal to log n, the algorithm may not be able to form tree-structured quorum. For example when sites
1, 2, 4, and 8 are inaccessible, the set of sites 3,5,6,7,8,9,10,11,12,13,14,15
form a majority of sites but not a structured quorum. So, as long as the

335

9.9 Agarwal–El Abbadi quorum-based algorithm

number of site failures is less than log n, the tree quorum algorithm gurantees
the formation of a quorum and it exhibits the property of “graceful degradation,” which is useful in distributed fault tolerance. As failures occur and
increase, the probability of forming quorums decreases and mutual exclusion
is achieved at increasing costs because when a node fails, instead of one
path from node, the quorum must include two paths starting from the node’s
children. For example, in a tree of level k, the size of quorum is (k + 1). If
a node failure occurs at level i > 0, then the quorum size increases to (k − i)
+2i. The penalty is severe when the failed node is near the root. Thus, the
tree quorum algorithm may still allow quorums to be formed even after the
failures of n− | log n | sites.

9.9.5 The algorithm for distributed mutual exclusion
We now describe the algorithm for achieving distributed mutual exclusion
using tree-structured quorums. Suppose a site s wants to enter the critical
section (CS). The following events should occur in the order given:
1. Site s sends a “Request” message to all other sites in the structured quorum
it belongs to.
2. Each site in the quorum stores incoming requests in a request queue,
ordered by their timestamps.
3. A site sends a “Reply” message, indicating its consent to enter CS, only to
the request at the head of its request queue, having the lowest timestamp.
4. If the site s gets a “Reply” message from all sites in the structured quorum
it belongs to, it enters the CS.
5. After exiting the CS, s sends a “Relinquish” message to all sites in the
structured quorum. On the receipt of the “Relinquish” message, each site
removes s’s request from the head of its request queue.
6. If a new request arrives with a timestamp smaller than the request at the
head of the queue, an “Inquire” message is sent to the process whose
request is at the head of the queue and waits for a “Yield” or “Relinquish”
message.
7. When a site s receives an “Inquire” message, it acts as follows:
• If s has acquired all of its necessary replies to access the CS, then it
simply ignores the “Inquire” message and proceeds normally and sends
a “Relinquish” message after exiting the CS.
• If s has not yet collected enough replies from its quorum, then it sends
a “Yield” message to the inquiring site.
8. When a site gets the “Yield” message, it puts the pending request (on
behalf of which the “Inquire” message was sent) at the head of the queue
and sends a “Reply” message to the requestor.

336

Distributed mutual exclusion algorithms

9.9.6 Correctness proof
Mutual exclusion is guaranteed because the set of quorums satisfy the Intersection property. Proof for freedom from deadlock is similar to that of Maekawa’s
algorithm. The readers are referred to the original source [14].
Example Consider a coterie C which consists of quorums 1,2,3 , 2,4,5 ,
and 4,1,6 . Suppose nodes 3, 5, and 6 want to enter CS, and they send
requests to sites (1, 2), (2, 4), and (1, 4), respectively. Suppose site 3’s
request arrives at site 2 before site 5’s request. In this case, site 2 will grant
permission to site 3’s request and reject site 5’s request. Similarly, suppose
site 3’s request arrives at site 1 before site 6’s request. So site 1 will grant
permission to site 3’s request and reject site 6’s request. Since sites 5 and 6
did not get consent from all sites in their quorums, they do not enter the CS.
Since site 3 alone gets consent from all sites in its quorum, it enters the CS
and mutual exclusion is achieved.

9.10 Token-based algorithms
In token-based algorithms, a unique token is shared among the sites. A site is
allowed to enter its CS if it possesses the token. A site holding the token can
enter its CS repeatedly until it sends the token to some other site. Depending
upon the way a site carries out the search for the token, there are numerous
token-based algorithms. Next, we discuss two token-based mutual exclusion
algorithms.
Before we start with the discussion of token-based algorithms, two comments are in order. First, token-based algorithms use sequence numbers
instead of timestamps. Every request for the token contains a sequence number
and the sequence numbers of sites advance independently. A site increments
its sequence number counter every time it makes a request for the token.
(A primary function of the sequence numbers is to distinguish between old and
current requests.) Second, the correctness proof of token-based algorithms,
that they enforce mutual exclusion, is trivial because an algorithm guarantees
mutual exclusion so long as a site holds the token during the execution of the
CS. Instead, the issues of freedom from starvation, freedom from deadlock,
and detection of the token loss and its regeneration become more prominent.

9.11 Suzuki–Kasami’s broadcast algorithm
In Suzuki–Kasami’s algorithm [29] (Algorithm 9.7), if a site that wants to
enter the CS does not have the token, it broadcasts a REQUEST message
for the token to all other sites. A site that possesses the token sends it to the
requesting site upon the receipt of its REQUEST message. If a site receives

337

9.11 Suzuki–Kasami’s broadcast algorithm

a REQUEST message when it is executing the CS, it sends the token only
after it has completed the execution of the CS.
Although the basic idea underlying this algorithm may sound rather simple,
there are two design issues that must be efficiently addressed:
1. How to distinguishing an outdated REQUEST message from a current
REQUEST message Due to variable message delays, a site may receive
a token request message after the corresponding request has been satisfied.
If a site cannot determined if the request corresponding to a token request
has been satisfied, it may dispatch the token to a site that does not need
it. This will not violate the correctness, however, but it may seriously
degrade the performance by wasting messages and increasing the delay
at sites that are genuinely requesting the token. Therefore, appropriate
mechanisms should implemented to determine if a token request message
is outdateded.
2. How to determine which site has an outstanding request for the CS
After a site has finished the execution of the CS, it must determine what
sites have an outstanding request for the CS so that the token can be
dispatched to one of them. The problem is complicated because when a
site Si receives a token request message from a site Sj , site Sj may have an
outstanding request for the CS. However, after the corresponding request
for the CS has been satisfied at Sj , an issue is how to inform site Si (and
all other sites) efficiently about it.
Outdated REQUEST messages are distinguished from current REQUEST
messages in the following manner: a REQUEST message of site Sj has the
form REQUEST(j, n) where n (n = 1 2
) is a sequence number that
indicates that site Sj is requesting its nth CS execution. A site Si keeps an
array of integers RNi [1, … ,N ] where RNi [j] denotes the largest sequence
number received in a REQUEST message so far from site Sj . When site Si
receives a REQUEST(j, n) message, it sets RNi [j] = max(RNi [j], n). Thus,
when a site Si receives a REQUEST(j, n) message, the request is outdated if
RNi [j]> n.
Sites with outstanding requests for the CS are determined in the following
manner: the token consists of a queue of requesting sites, Q, and an array of
integers LN [1, … ,N ], where LN [j] is the sequence number of the request
which site Sj executed most recently. After executing its CS, a site Si updates
LN [i] : = RNi [i] to indicate that its request corresponding to sequence number RNi [i] has been executed. Token array LN [1, … ,N ] permits a site to
determine if a site has an outstanding request for the CS. Note that at site
Si if RNi [j] = LN [j]+1, then site Sj is currently requesting a token. After
executing the CS, a site checks this condition for all the j’s to determine all
the sites that are requesting the token and places their i.d.’s in queue Q if
these i.d.’s are not already present in Q. Finally, the site sends the token to
the site whose i.d. is at the head of Q.

338

Distributed mutual exclusion algorithms

Requesting the critical section:
(a) If requesting site Si does not have the token, then it increments its
sequence number, RNi [i], and sends a REQUEST(i, sn) message to all
other sites. (“sn” is the updated value of RNi [i].)
(b) When a site Sj receives this message, it sets RNj [i] to max(RNj [i], sn).
If Sj has the idle token, then it sends the token to Si if RNj [i] = LN [i] + 1.
Executing the critical section:
(c) Site Si executes the CS after it has received the token.
Releasing the critical section: Having finished the execution of the CS, site
Si takes the following actions:
(d) It sets LN [i] element of the token array equal to RNi [i].
(e) For every site Sj whose i.d. is not in the token queue, it appends its i.d.
to the token queue if RNi [j] = LN [j] + 1.
(f) If the token queue is nonempty after the above update, Si deletes the top
site i.d. from the token queue and sends the token to the site indicated
by the i.d.
Algorithm 9.7 Suzuki–Kasami’s broadcast algorithm.

Thus, as shown in Algorithm 9.7, after executing the CS, a site gives
priority to other sites with outstanding requests for the CS (over its pending
requests for the CS). Note that Suzuki–Kasami’s algorithm is not symmetric
because a site retains the token even if it does not have a request for the
CS, which is contrary to the spirit of Ricart and Agrawala’s definition of
symmetric algorithm: “no site possesses the right to access its CS when it has
not been requested.”

Correctness
Mutual exclusion is guaranteed because there is only one token in the system
and a site holds the token during the CS execution.
Theorem 9.3 A requesting site enters the CS in finite time.
Proof Token request messages of a site Si reach other sites in finite time.
Since one of these sites will have token in finite time, site Si ’s request will
be placed in the token queue in finite time. Since there can be at most N − 1
requests in front of this request in the token queue, site Si will get the token
and execute the CS in finite time.

Performance
The beauty of the Suzuki–Kasami algorithm lies in its simplicity and efficiency. No message is needed and the synchronization delay is zero if a site

339

9.12 Raymond’s tree-based algorithm

holds the idle token at the time of its request. If a site does not hold the token
when it makes a request, the algorithm requires N messages to obtain the
token. The synchronization delay in this algorithm is 0 or T .

9.12 Raymond’s tree-based algorithm
Raymond’s tree-based mutual exclusion algorithm [19] uses a spanning tree
of the computer network to reduce the number of messages exchanged per
critical section execution. The algorithm exchanges only O(log N ) messages
under light load, and approximately four messages under heavy load to execute
the CS, where N is the number of nodes in the network.
The algorithm assumes that the underlying network guarantees message
delivery. The time or order of message arrival cannot be predicted. All nodes
of the network are completely reliable. (Only for the initial part of the discussion, i.e., until node failure is discussed.) If the network is viewed as a graph,
where the nodes in the network are the vertices of the graph, and the links
between nodes are the edges of the graph, a spanning tree of a network of N
nodes will be a tree that contains all N nodes. A minimal spanning tree is one
such tree with minimum cost. Typically, this cost function is based on the
network link characteristics. The algorithm operates on a minimal spanning
tree of the network topology or logical structure imposed on the network.
The algorithm considers the network nodes to be arranged in an unrooted
tree structure as shown in Figure 9.17. Messages between nodes traverse
along the undirected edges of the tree in the Figure 9.17. The tree is also
a spanning tree of the seven nodes A, B, C, D, E, F, and G. It also turns
out to be a minimal spanning tree because it is the only spanning tree of
these seven nodes. A node needs to hold information about and communicate
only to its immediate-neighboring nodes. In Figure 9.17, for example, node
C holds information about and communicates only to nodes B, D, and G; it
does not need to know about the other nodes A, E, and F for the operation of
the algorithm.
Similar to the concept of tokens used in token-based algorithms, this algorithm uses a concept of privilege to signify which node has the privilege to
enter the critical section. Only one node can be in possession of the privilege
(called the privileged node) at any time, except when the privilege is in transit

Figure 9.17 Nodes with an
unrooted tree structure.

A

B

C

E

F

G

D

340

Distributed mutual exclusion algorithms

from one node to another in the form of a PRIVILEGE message. When there
are no nodes requesting for the privilege, it remains in possession of the node
that last used it.

9.12.1 The HOLDER variables
Each node maintains a HOLDER variable that provides information about
the placement of the privilege in relation to the node itself. A node stores in
its HOLDER variable the identity of a node that it thinks has the privilege
or leads to the node having the privilege. The HOLDER variables of all the
nodes maintain directed paths from each node to the node in the possession
of the privilege.
For two nodes X and Y, if HOLDERX = Y, we could redraw the undirected
edge between the nodes X and Y as a directed edge from X to Y. Thus,
for instance, if node G holds the privilege, Figure 9.17 can be redrawn with
logically directed edges as shown in Figure 9.18. The shaded node represents the privileged node. The following will be the values of the HOLDER
variables of various nodes:
HOLDERA = B Since the privilege is located in a sub-tree of A denoted by B.
Proceeding with similar reasoning, we have
HOLDERB = C
HOLDERC = G
HOLDERD = C
HOLDERE = A
HOLDERF = B
HOLDERG = self
Now suppose that node B, which does not hold the privilege, wants to
execute the critical section. Then B sends a REQUEST message to HOLDERB ,
i.e., C, which in turn forwards the REQUEST message to HOLDERC , i.e.,
G. So a series of REQUEST messages flow between the node making the
request for the privilege and the node having the privilege.

Figure 9.18 Tree with logically
directed edges, all pointing in
a direction towards node G –
the privileged node.

A

B

E

F

C

G

D

341

9.12 Raymond’s tree-based algorithm

Table 9.1 Variables used in the algorithm.

Figure 9.19 Tree with logically
directed edges, all pointing in
a direction towards node G –
the privileged node.

Variable name

Possible values

HOLDER

“self ” or the identity of
one of the immediate
neighbors.

Indicates the location of the
privileged node in relation to
the current node.

USING

True or false.

Indicates if the current node is
executing the critical section.

REQUEST_Q

A FIFO queue that
could contain “self ” or
the identities of
immediate neighbors as
elements.

The REQUEST_Q of a node
consists of the identities of
those immediate neighbors that
have requested for privilege but
have not yet been sent the
privilege.

True or false.

Indicates if node has sent a
request for the privilege.

A

B

E

F

C

D

G

The privileged node G, if it no longer needs the privilege, sends the
PRIVILEGE message to its neighbor C, which made a request for the
privilege, and resets HOLDERG to C. Node C, in turn, forwards the
PRIVILEGE to node B, since it had requested the privilege on behalf of B.
Node C also resets HOLDERC to B. The tree in Figure 9.18 will now look
as shown in Figure 9.19.
Thus, at any stage, except when the PRIVILEGE message is in transit, the
HOLDER variables collectively make sure that directed paths are maintained
from each of the N – 1 nodes to the privileged node in the network.

9.12.2 The operation of the algorithm
Data structures
Each node maintains variables that are defined in Table 9.1. The value “self”
is placed in REQUEST_Q if the node makes a request for the privilege for
its own use. The maximum size of REQUEST_Q of a node is the number
of immediate neighbors + 1 (for “self ”). ASKED prevents the sending of
duplicate requests for privilege, and also makes sure that the REQUEST_Qs
of the various nodes do not contain any duplicate elements.

342

Distributed mutual exclusion algorithms

9.12.3 Description of the algorithm
The algorithm consists of the following parts:

ASSIGN_PRIVILEGE;
MAKE_REQUEST;
events;
message overtaking.

ASSIGN_PRIVILEGE
This is a routine to effect the sending of a PRIVILEGE message. A privileged
node will send a PRIVILEGE message if:
• it holds the privilege but is not using it;
• its REQUEST_Q is not empty; and
• the element at the head of its REQUEST_Q is not “self.” That is, the
oldest request for privilege must have come from another node.
A situation where “self” is at the head of REQUEST_Q may occur immediately after a node receives a PRIVILEGE message. The node will enter into
the critical section after removing “self” from the head of REQUEST_Q. If
the i.d. of another node is at the head of REQUEST_Q, then it is removed
from the queue and a PRIVILEGE message is sent to that node. Also, the
variable ASKED is set to false since the currently privileged node will not
have sent a request to the node (called HOLDER-to-be) that is about to receive
the PRIVILEGE message.

MAKE_REQUEST
This is a routine to effect the sending of a REQUEST message. An unprivileged node will send a REQUEST message if:
• it does not hold the privilege;
• its REQUEST_Q is not empty, i.e., it requires the privilege for itself, or
on behalf of one of its immediate neighboring nodes; and
• it has not sent a REQUEST message already.
The variable ASKED is set to true to reflect the sending of the REQUEST
message. The MAKE_REQUEST routine makes no change to any other variables. The variable ASKED will be true at a node when it has sent REQUEST
message to an immediate neighbor and has not received a response. The variable will be false otherwise. A node does not send any REQUEST messages,
if ASKED is true at that node. Thus the variable ASKED makes sure that
unnecessary REQUEST messages are not sent from the unprivileged node,
and consequently ensures that the REQUEST_Q of an immediate neighbor
does not contain duplicate entries of a neighboring node. This makes the
REQUEST_Q of any node bounded, even when operating under heavy load.