Prianha: A CORBA Tool For High Availability

D istributed systems, such as satellite surveillance systems and real-time feeds for financial data, must be heterogeneous, interoperable, extensi-ble, and available. By available, I mean a kind of fault tolerance: able to provide important services despite the partial failure of the computers or software objects in the system. A widely used distributed system standard is the Object Management Group's Common Object Request Broker Architecture. 1 CORBA, although successful, addresses only the first three characteristics. (The OMG did not establish availability as a CORBA goal because it would have entailed protocol standardization—a difficult task being actively researched.) With respect to heterogeneity, for example, programmers can hide details of the underlying hardware and system software behind a portable interface, using CORBA's Interface Definition Language. IDL is a declarative language that is independent of the target programming language and operating system. It allows CORBA objects to invoke operations on each other even when implemented in different languages and even when running on incompatible operating systems. Wrapper objects and Object Request Broker (ORB) gateways enable interoperability by letting programmers interface new technology to legacy information systems. For example, through a high-level CORBA-IDL interface, a Visual C++ object running on Windows 95 can access a Cobol module running on a mainframe. 2 Finally, CORBA supports the development of highly modular applications, so programmers can more easily achieve extensibility—as well as better maintainability. However, neither CORBA nor the complementary OMG Common Object Services Specification adequately addresses availability and reliability. 3 (Reliability is often used interchangeably with availability and further provides some indication of how an application recovers from a failure.) Specifically, CORBA does not support the dynamic replication of object implementations and cannot consistently detect partial failures in a distributed application. Furthermore, important system services such as a naming service should be resilient to failures—for example, a software error, a hardware fault, a network partition, or a human lapse (a system administrator inadvertently shutting down a computer). One approach to achieving resilience is to provide multiple copies of the naming service on different computers. Our firm is keenly aware of the need for availability. To help meet that need, I developed an experimental CORBA-based restart service and monitor called Piranha, which, like the identically named but unrelated Yale University system, is named after the piranha fish. First, Piranha acts as a network monitor that reports failures through a graphical user interface. Second, Piranha acts as a …