Rewind, repair, replay: three R's to dependability

ABSTRACT

Motivated by the growth of web and infrastructure services and their susceptibility to human operator-related failures, we introduce system-level undo as a recovery mechanism designed to improve service dependability. Undo enables system operators to recover from their inevitable mistakes and furthermore enables retroactive repair of problems that were not fixed quickly enough to prevent detrimental effects. We present the "three R's", a model of undo that matches the needs of human error recovery and retroactive repair; discuss several of the issues raised by this undo model; and introduce an initial architectural framework for undoable systems using the example of an undoable e-mail service system.

REFERENCES

• 1: Anita Borg , Wolfgang Blau , Wolfgang Graetsch , Ferdinand Herrmann , Wolfgang Oberle, Fault tolerance under UNIX, ACM Transactions on Computer Systems (TOCS), v.7 n.1, p.1-24, Feb. 1989 [doi>10.1145/58564.58565]
• 2: A. Brown and D. A. Patterson. To Err is Human. Proc. 2001 Workshop on Evaluating and Architecting System dependabilitY, Göteborg, Sweden, July 2001.
• 3: W. Keith Edwards, Flexible conflict detection and management in collaborative applications, Proceedings of the 10th annual ACM symposium on User interface software and technology, p.139-148, October 14-17, 1997, Banff, Alberta, Canada [doi>10.1145/263407.263533]
• 4: W. Keith Edwards , Elizabeth D. Mynatt, Timewarp: techniques for autonomous collaboration, Proceedings of the SIGCHI conference on Human factors in computing systems, p.218-225, March 22-27, 1997, Atlanta, Georgia, United States [doi>10.1145/258549.258710]
• 5: W. Keith Edwards , Takeo Igarashi , Anthony LaMarca , Elizabeth D. Mynatt, A temporal model for multi-level undo and redo, Proceedings of the 13th annual ACM symposium on User interface software and technology, p.31-40, November 06-08, 2000, San Diego, California, United States [doi>10.1145/354401.354409]
• 6: E. N. Elnozahy, D. B. Johnson, and Y. M. Wang. A Survey of Rollback-Recovery Protocols in Message-Passing Systems. CMU TR 96--181, Carnegie Mellon, 1996.
• 7: P. Enriquez, A. Brown, and D. A. Patterson. Lessons from the PSTN for Dependable Computing. Proc. 2002 Workshop on Self-Healing, Adaptive and self-MANaged Systems (SHAMAN), New York, June 2001.
• 8: Eric Freeman , David Gelernter, Lifestreams: a storage model for personal data, ACM SIGMOD Record, v.25 n.1, p.80-86, March 1996 [doi>10.1145/381854.381893]
• 9: Erich Gamma , Richard Helm , Ralph Johnson , John Vlissides, Design patterns: elements of reusable object-oriented software, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1995
• 10: Henry F. Korth , Eliezer levy , Abraham Silberschatz, A formal approach to recovery by compensating transactions, Proceedings of the sixteenth international conference on Very large databases, p.95-106, September 1990, Brisbane, Australia
• 11: D. Kurlander and S. Feiner. Editable Graphical Histories. Proc 1988 IEEE Workshop on Visual Languages, Pittsburgh, PA, October 1988.
• 12: D. E. Lowell, S. Chandra, and P. Chen. Exploring Failure Transparency and the Limits of Generic Recovery. Proc. 4th OSDI. San Diego, CA, October 2000.
• 13: C. Mohan , Don Haderle , Bruce Lindsay , Hamid Pirahesh , Peter Schwarz, ARIES: a transaction recovery method supporting fine-granularity locking and partial rollbacks using write-ahead logging, ACM Transactions on Database Systems (TODS), v.17 n.1, p.94-162, March 1992 [doi>10.1145/128765.128770]
• 14: D. Oppenheimer and D. A. Patterson. Why do Internet services fail, and what can be done about it? Proc. 10th ACM SIGOPS European Workshop. Saint-Emilion, France, September 2002.
• 15: J. Reason. Human Error. Cambridge University Press, 1990.
• 16: Jun Rekimoto, Time-machine computing: a time-centric approach for the information environment, Proceedings of the 12th annual ACM symposium on User interface software and technology, p.45-54, November 07-10, 1999, Asheville, North Carolina, United States [doi>10.1145/320719.322582]
• 17: Roxio, Inc. GoBack3. http://www.roxio.com/en/products/goback/index.jhtml.