Resource Allocation with Immunity to Limited Process Failure (Preliminary Report)

Upper and lower bounds are proved for We find it useful to group a process' !;tates the shared space requirements for solution of sevinto four regions: the ~ or!!'..Yl!!9. ~~ coneral problems involving resource allocation among sists of those states which a process can be in asynchronous processes, Controlling the degradawhile running its entry protocol, and the exit ti on of performance when a limited number of ~ similarly consists of states corresporlding processes fail is of particular interest. to the exit protocol. The states between the! entry and exit protocols comprise the critical~~. All other states belong to the remainder~~. 1. --We make no assumptions about what a process does while in its critical or remainder region except that it does not attempt to communicate with other processes running their protocols. Various solutions in the literature differ with respect to the underlying model of computation, "fairness properties" or relative order in which processes are admitted to their critical regions, time and space complexity of the algorithms, and irllnunity to various types of permitted "failure" of components of the system. Burns et. al.[BFJLPl and Cremers and Hit,bard [CH1,CH2] provide upper and lower bounds on the amount of shared memory needed to insure certain fairness properties such as absence of lockout, bounded waiting, and FIFO service order. The model used in those papers assumes a shared memory with a test-and-set primitive as the basic interprocessor communication mechanism. Rivest and Pratt [RP] and Peterson and Fischer [PF] also analyze the memory requirements for such problems, but their model assumes a much more limited form of access to the shared memory. Moreover, their algorithms ar,e designed to continue to function correctly even under repeated "failure" of any number of processes, provided only that a failed process signal that it is no longer active and that it return to its remainder region when it is later restarted. "Shutdown" is perhaps a more appropriate term for that kind of failure, for it carries no connotation of ma11Function. Introduction -The critical section problem has been widely studied for its illustrative value in problems of synchronization as well as for its practical application to real concurrent systems [BFJLP, CH1, CH2, Dil, EM, Kn, Lam, PF, RP]. The problem is to devise protocols for each of several communicating asynchronous parallel processors to control access to a designated section of code called the critical section. Such code might manipulate a C{mrmDn resource, in which case access to the critical section corresponds to allocation of the resource. In the simple case of a single nonsharable reusable resource such as line printer or a tape drive, the two basic properties desired of the access policy are mutual exclusion and impossibility of deadlock. Mutual exclusion means that two processes can never simultaneously be executing their critical sections. Deadlock is a situation in which one or more processes are attempting to enter or leave their critical sections, but none of them ever succeeds. Finding appropriate protocols to insure these two properties is the critical sectio"problem. Two protocols comprise a solution. The ~ protocol is the section of code that a process executes before being admitted to its critical section, and the ~ protocol is run when the process leaves its critical section. Equivalently, the entry protocol allocates the resource corresponding to the critical section and the exit protocol returns it to the system. In this paper, we generalize the critical section problem to the case where some number l > 1 of processes (but not more) are permitted to be simultaneously in their critical sections. Regarded as a resource-allocation problem, we consider l identical copies of a non-sharable reusable resource, where each process can request at mos1: one copy of that resource. We use the test-and-sE!t model of [BFJlP] and, as in that paper, attem~,t to minimize the amount of shared memory used. tThis research was supported in part by the NSF under grants MCS77-O2474, MCS77-15628, MCS78-O1689 and US Army Research Office Contract Number DAAG29-79-C-O155. 234 CHI471-2/79/0000-0234$00.75 @ 1979 IEEE The exclusion property of the -critical section problem, that at most l proces es are ever simultaneously in their critical re ions, we call l-exclusion. To avoid degenerate s lutions,we must also formalize the notion that "it hould be possible for as many as l processes to e simultaneously in their critical regions." We nterpret this to mean, roughly, that if fewer tha l processes are in their critical regions, then it is possible for another process to enter its critical region, even though no process leaves its critical region in the meantime. We call this property "avoiding l-deadlock." it increments COUNT. releases its exclusive access to COUNT. and enters its critical section. {processes are always permitted to decrement COUNT.) The code for each process is: 1. Perform the entry protocol for the 1-critical section algorithm. 2. {Busy Waiting) Wait until COUNT < l. then set COUNT ~ COUNT + 1. 3. Perform the exit protocol for the 1-critical section algorithm. 4. Execute the critical section. 5. Set COUNT := COUNT -1. If the 1-critical section algorithm has the property that processes return to their remainder regions in the same order as they entered their critical regions, then the l-resource algorithm satisfies fairness conditions corresponding to those of the 1-critical section solution. A trivial generalization of a binary semaphore yields a system exhibiting l-exclusion and no 1deadlock. Assume a shared variable COUNT which at any time contains the correct count of the number of processes currently in their critical sections. A process wanting to enter its critical region performs a test-and-set instruction on COUNT which, in one indivisible step, reads the value of COUNT, increments it if it was less than 1, and stores the result back into COUNT. The process then proceeds to its critical section if it saw the count less than 1, and it loops back and repeats the test otherwise (busy-waiting). A process leaving its critical section simply decrements COUNT. The bank algorithm has a rather subtle defect which becomes apparent when several tellers become simultaneously free. If k > 2 tellers are free, one would like the first k people in line to all move "simultaneously" to a teller, yet the algorithm requires them to file past the head of the queue one at a time. If the person at the front of the line is slow, the k-l people behind him are forced to wait unnecessarily. In fact, if the person at the front of the line "fails", then the people behind him wait forever and the system stops functioning. In this case, one failure can tie up all of the system's resources~ This algorithm imposes no fairness criteria on the order in which processes enter their critical sections, and in fact it is possible that an individual process will always find the critical section "full" (i.e. COUNT = l) whenever it happens to examine COUNT and therefore be "locked out" of its critical section. We are thus led to generalize our deadlocking definition to include controlling the degradation of performance in the event 4hat a limited number of processes fail during the execution of their