This paper describes the implementation history of the INGRES database system. It focuses on mistakes that were made in progress rather than on eventual corrections. Some attention is also given to the role of structured design in a database system implementation and to the problem of supporting nontrivial users. Lastly, miscellaneous impressions of UNIX, the PDP-11, and data models are given.

developed at the IBM Almaden Research Center, which uses atomic tran.sactions as a unified failure recovery mechanism for a client-server structured distributed system. Transactions allow failure atomicity for related activities at a single server or at a number of independent servers. Rather than bundling transaction management into a dedicated language or recoverable object manager, Quicksilver exposes the basic commit protocol and log recovery primi-tives, allowing clients and servers to tailor their recovery techniques to their specific needs. Servers can implement their own log recovery protocols rather than being required to use a system-defined protocol. These decisions allow servers to make their own choices to balance simplicity, efficiency, and recoverability. Categories and Subject Descriptors: D.4.3 [Operating Systems]: File System Management-distrib-uted file systems; file organization; maintenance; D.4.5 [Operating Systems]: Reliability-FauZt-tolerance; checkpoint/restart; H.2.4 [Database Management]: Systems--distributed systems; trun.s-action processing

We present an implementation of a faulttolerant TCP (FT-TCP) that allows a faulty server to keep its TCP connections open until it either recovers or it is failed over to a backup. The failure and recovery of the server process are completely transparent to client processes connected with it via TCP. FT-TCP does not affect the software running on a client, does not require to change the server's TCP implementation, and does not use a proxy.

Abstract — Periodic checkpointing of the entire system state and rolling back to the last checkpoint when an error is detected is proposed as a basis for error recovery on a VLSI multicomputer executing non-interactive applications. Detailed algorithms for saving the checkpoints, distributing diagnostic information, and restoring a valid system state are presented. This approach places no restrictions on the actions of the application tasks, and, during normal computation, does not require the complex communication protocols that are part of most other schemes. Estimates of the overhead of the proposed scheme are presented and extensions for efficient handling of transient faults, input/output operations, and disk failures are discussed.

Interactive systems, such as editors and program development environments, should explicitly support facilities that permit a user to reverse the effects of past actions and to restore an object to a prior state. A model for interactive systems that allows such recovery facilities to be defined precisely and user and system responsibilities to be delineated is presented. Various techniques for implementing recovery are described. Application of a general recovery facility to support reverse execution is discussed. A program development system (called COPE} with extensive recovery facilities, including reverse execution, is described.

We describe a novel general-purpose mechanism for enforcing separation of duties in computerized information systems. This mechanism of transaction control expressions has close similarities to traditional controls in manual paper-based systems. It has the great benefit of intuitive simplicity, in both concept and implementation.

Database replication protocols have historically been built on top of distributed database systems, and have consequently been designed and implemented using distributed transactional mechanisms, such as atomic commitment. We argue in this paper that this approach is not always adequate to efficiently support database replication and that more suitable alternatives, such as atomic broadcast primitives, should be employed instead. More precisely, we show in this paper that fully replicated database systems, based on the deferred update replication model, have better throughput and response time if implemented with an atomic broadcast termination protocol than if implemented with atomic commitment. 1 Introduction Replication is considered a cheap software based way to increase data availability when compared to hardware based specialised techniques [16]. However, designing a replication scheme that provides reasonable performance and maintains data consistency is still an active area of...

This article introduces volume leases as a mechanism for providing server-driven cache consistency for large-scale, geographically distributed networks. Volume leases retain the good performance, fault tolerance, and server scalability of the semantically weaker client-driven protocols that are now used on the web. Volume leases are a variation of object leases, which were originally designed for distributed file systems. However, whereas traditional object leases amortize overheads over long lease periods, volume leases exploit spatial locality to amortize overheads across multiple objects in a volume. This approach allows systems to maintain good write performance even in the presence of failures. Using trace-driven simulation, we compare three volume lease algorithms against four existing cache consistency algorithms and show that our new algorithms provide strong consistency while maintaining scalability and faulttolerance. For a trace-based workload of web accesses, we find that volumes can reduce message traffic at servers by 40% compared to a standard lease algorithm, and that volumes can considerably reduce the peak load at servers when popular objects are modified.

Data replication is a technique for increasing the availability of data. Two popular algorithms for maintaining consistency among the replicas are Weighted Voting [1] and Available Copies [2] In recent papers [3] it has been shown that under common circumstances Available Copies (AC) performs better than Weighted Voting (WV). However, the issue of network partitioning due to gateway crashes is ignored in AC. We present an improvement of WV that, if configured accordingly, performs as well as AC, but, unlike AC, also works correctly in the face of network partitioning. 1. INTRODUCTION Data replication in distributed operating systems is a technique for increasing the availability of data. It can also increase the performance of the system, since an application can use nearby copies of the data instead of distant ones. A serious problem, however, is to make the collection of replicated data look like a single object, even under concurrent access. Users should always see the most...

This paper explains the rule subsystem that is being implemented in the POSTGRES DBMS. It is novel in sev eral ways. First, it gives to users the capability of defining rules as well as data to a DBMS. Moreover, depending on the scope of each rule defined, optimization is handled differently. This leads to good performance both in the case that there are many rules each of small scope and a few rules each of large scope. In addition, rules provide either a forward chaining control flow or a backward chaining one, and the system will choose the control mechanism that optimizes performance in the cases where it is possible. Furthermore, priority rules can be defined, thereby allowing a user to specify rule systems that have conflicts. This use of exceptions seems necessary in many applications. Lastly, our rule system can provide database services such as views, protection, integrity constraints, and referential integrity simply by applying the rules system in particular ways. Consequently, no special purpose code need be included in POSTGRES to handle these tasks. 1.