@article {19485,
	title = {A study of unpredictability in fault-tolerant middleware},
	journal = {Computer Networks},
	volume = {57},
	year = {2013},
	month = {2013/02/26/},
	pages = {682 - 698},
	abstract = {In enterprise applications relying on fault-tolerant middleware, it is a common engineering practice to establish service-level agreements (SLAs) based on the 95th or the 99th percentiles of the latency, to allow a margin for unexpected variability. However, the extent of this unpredictability has not been studied systematically. We present an extensive empirical study of unpredictability in 16 distributed systems, ranging from simple transport protocols to fault-tolerant, middleware-based enterprise applications, and we show that the inherent unpredictability in the systems examined arises from at most 1\% of the remote invocations. In the normal, fault-free operating mode most remote invocations have a predictable end-to-end latency, but the maximum latency follows unpredictable trends and is comparable with the time needed to recover from a fault. The maximum latency is not influenced by the system{\textquoteright}s workload, cannot be regulated through configuration parameters and is not correlated with the system{\textquoteright}s resource consumption. The high-latency outliers (up to three orders of magnitude higher than the average latency) have multiple causes and may originate in any component of the system. However, after filtering out 1\% of the invocations with the highest recorded response-times, the latency becomes bounded with high statistical confidence (p \&lt; 0.01). We have verified this result on different operating systems (Linux 2.4, Linux 2.6, Linux-rt, TimeSys), middleware platforms (CORBA and EJB), programming languages (C, C++ and Java), replication styles (active and warm passive) and applications (e-commerce and online gaming). Moreover, this phenomenon occurs at all the layers of middleware-based systems, from the communication protocols to the business logic.},
	keywords = {Fault tolerance, latency, Middleware, Remote procedure call, Unpredictability},
	isbn = {1389-1286},
	url = {http://www.sciencedirect.com/science/article/pii/S1389128612003696},
	author = {Tudor Dumitras and Narasimhan, Priya}
}
@article {18670,
	title = {Experiences with building an intrusion-tolerant group communication system},
	journal = {Software: Practice and Experience},
	volume = {38},
	year = {2008},
	month = {2008///},
	pages = {639 - 666},
	abstract = {There are many group communication systems (GCSs) that provide consistent group membership and reliable, ordered multicast properties in the presence of crash faults. However, relatively few GCS implementations are able to provide these properties in the presence of malicious faults resulting from intrusions. We describe the systematic transformation of a crash-tolerant GCS, namely C-Ensemble, into an intrusion-tolerant GCS, the ITUA GCS. To perform the transformation, we devised intrusion-tolerant versions of key group communication protocols. We then inserted implementations of the protocols into C-Ensemble and made significant changes to the rest of the C-Ensemble protocol stack to make the stack intrusion tolerant. We quantify the cost of providing intrusion-tolerant group communication in two ways. First, we quantify the implementation effort by presenting a detailed analysis of the amount of change required to the original C-Ensemble system. In doing so, we provide insight into the choice of building an intrusion-tolerant GCS from scratch versus building one by leveraging a crash-tolerant implementation. Second, we quantify the run-time performance cost of tolerating intrusions by presenting results from an experimental evaluation of the main intrusion-tolerant microprotocols. The results are analyzed to identify the parts that contribute the most overhead while providing intrusion tolerance during both normal operation and recovery from intrusions. Copyright {\textcopyright} 2007 John Wiley \& Sons, Ltd.},
	keywords = {distributed protocols, experimental evaluation, Fault tolerance, Group communication, intrusion tolerance},
	isbn = {1097-024X},
	doi = {10.1002/spe.848},
	url = {http://onlinelibrary.wiley.com/doi/10.1002/spe.848/abstract},
	author = {Ramasamy,HariGovind V. and Pandey,Prashant and Michel Cukier and Sanders,William H.}
}
@conference {15150,
	title = {Reliable broadcast in radio networks: the bounded collision case},
	booktitle = {Proceedings of the twenty-fifth annual ACM symposium on Principles of distributed computing},
	series = {PODC {\textquoteright}06},
	year = {2006},
	month = {2006///},
	pages = {258 - 264},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {We study the problem of achieving global broadcast in a radio network where a node can multicast messages to all of its neighbors (that is, nodes within some given distance r), and up to t nodes in any single neighborhood may be corrupted. Previous work assumes that corrupted nodes can neither cause collisions nor spoof addresses of honest nodes. In this work, we eliminate these assumptions and allow each faulty node to cause a (known) bounded number of collisions and spoof the addresses of arbitrary other nodes. We show that the maximum tolerable t in this case is identical to the maximum tolerable t when collisions and address spoofing are not allowed. Thus, by causing collisions and spoofing addresses an adversary may be able to degrade the efficiency of achieving broadcast, but it cannot affect the feasibility of this task.},
	keywords = {broadcast, byzantine failure, Fault tolerance, radio networks},
	isbn = {1-59593-384-0},
	doi = {10.1145/1146381.1146420},
	url = {http://doi.acm.org/10.1145/1146381.1146420},
	author = {Koo,Chiu-Yuen and Bhandari,Vartika and Katz, Jonathan and Vaidya,Nitin H.}
}
@article {19499,
	title = {MEAD: support for Real-Time Fault-Tolerant CORBA},
	journal = {Concurrency and Computation: Practice and Experience},
	volume = {17},
	year = {2005},
	month = {2005///},
	pages = {1527 - 1545},
	abstract = {The OMG{\textquoteright}s Real-Time CORBA (RT-CORBA) and Fault-Tolerant CORBA (FT-CORBA) specifications make it possible for today{\textquoteright}s CORBA implementations to exhibit either real-time or fault tolerance in isolation. While real-time requires a priori knowledge of the system{\textquoteright}s temporal operation, fault tolerance necessarily deals with faults that occur unexpectedly, and with possibly unpredictable fault recovery times. The MEAD (Middleware for Embedded Adaptive Dependability) system attempts to identify and to reconcile the conflicts between real-time and fault tolerance, in a resource-aware manner, for distributed CORBA applications. MEAD supports transparent yet tunable fault tolerance in real-time, proactive dependability, resource-aware system adaptation to crash, communication and timing faults with bounded fault detection and fault recovery. Copyright {\textcopyright} 2005 John Wiley \& Sons, Ltd.},
	keywords = {CORBA, Fault tolerance, non-determinism, predictability, real-time, recovery, trade-offs},
	isbn = {1532-0634},
	url = {http://onlinelibrary.wiley.com/doi/10.1002/cpe.882/abstract},
	author = {Narasimhan, P. and Tudor Dumitras and Paulos, A. M. and Pertet, S. M. and Reverte, C. F. and Slember, J. G. and Srivastava, D.}
}
@conference {19501,
	title = {On-chip stochastic communication [SoC applications]},
	booktitle = {Design, Automation and Test in Europe Conference and Exhibition, 2003},
	year = {2003},
	month = {2003///},
	pages = {790 - 795},
	abstract = {As CMOS technology scales down into the deep-submicron (DSM) domain, the costs of design and verification for systems-on-chip (SoCs) are rapidly increasing due to the inefficiency of traditional CAD tools. Relaxing the requirement of 100\% correctness for devices and interconnects drastically reduces the costs of design but, at the same time, requires that SoCs be designed with some system-level fault-tolerance. In this paper, we introduce a new communication paradigm for SoCs, namely stochastic communication. The newly proposed scheme not only separates communication from computation, but also provides the required built-in fault-tolerance to DSM failures, is scalable and cheap to implement. For a generic tile-based architecture, we show how a ubiquitous multimedia application (an MP3 encoder) can be implemented using stochastic communication in an efficient and robust manner. More precisely, up to 70\% data upsets, 80\% packet drops because of buffer overflow, and severe levels of synchronization failures can be tolerated while maintaining a low latency.},
	keywords = {buffer overflow, CMOS technology, CMOS technology scaling, Costs, data upsets, Design automation, Digital audio players, Fault tolerance, Fault tolerant systems, generic tile-based architecture, integrated circuit design, integrated circuit interconnections, interconnect correctness requirements, Logic Design, logic simulation, MP3 encoder, Multiprocessor interconnection networks, on-chip fault-tolerance, on-chip stochastic communication, packet drops, Pervasive computing, Robustness, SoC design, SoC verification, Stochastic processes, Synchronisation, synchronization failures, system latency, system-level fault-tolerance, system-on-chip, systems-on-chip, video coding},
	author = {Tudor Dumitras and Marculescu, R.}
}
@conference {18683,
	title = {Passive replication schemes in AQuA},
	year = {2002},
	month = {2002/12//},
	pages = {125 - 130},
	abstract = {Building large-scale distributed object-oriented systems that provide multidimensional quality of service (QoS) in terms of fault tolerance, scalability, and performance is challenging. In order to meet this challenge, we need an architecture that can ensure that applications{\textquoteright} requirements can be met while providing reusable technologies and software solutions. This paper describes techniques, based on the AQuA architecture, that enhance the applications{\textquoteright} dependability and scalability by introducing two types of group members and a novel passive replication scheme. In addition, we describe how to make the management structure itself dependable by using the passive replication scheme. Finally, we provide performance measurements for the passive replication scheme.},
	keywords = {AQuA architecture, distributed object management, Fault tolerance, group members, large-scale distributed object-oriented systems, management structure, multidimensional quality of service, passive replication scheme, performance measurements, reusable technologies, scalability, software fault tolerance, software performance evaluation, software reusability, software solutions},
	doi = {10.1109/PRDC.2002.1185628},
	author = {Ren,Yansong and Rubel,P. and Seri,M. and Michel Cukier and Sanders,W. H. and Courtney,T.}
}
@conference {18666,
	title = {Building dependable distributed applications using AQUA},
	year = {1999},
	month = {1999///},
	pages = {189 - 196},
	abstract = {Building dependable distributed systems using ad hoc methods is a challenging task. Without proper support, an application programmer must face the daunting requirement of having to provide fault tolerance at the application level, in addition to dealing with the complexities of the distributed application itself. This approach requires a deep knowledge of fault tolerance on the part of the application designer, and has a high implementation cost. What is needed is a systematic approach to providing dependability to distributed applications. Proteus, part of the AQuA architecture, fills this need and provides facilities to make a standard distributed CORBA application dependable, with minimal changes to an application. Furthermore, it permits applications to specify, either directly or via the Quality Objects (QuO) infrastructure, the level of dependability they expect of a remote object, and will attempt to configure the system to achieve the requested dependability level. Our previous papers have focused on the architecture and implementation of Proteus. This paper describes how to construct dependable applications using the AQuA architecture, by describing the interface that a programmer is presented with and the graphical monitoring facilities that it provides},
	keywords = {ad hoc methods, application programmer, AQuA, complexities, computational complexity, dependable distributed applications, distributed CORBA application, distributed object management, Fault tolerance, fault tolerant computing, proteus},
	doi = {10.1109/HASE.1999.809494},
	author = {Ren,J. and Michel Cukier and Rubel,P. and Sanders,W. H. and Bakken,D. E. and Karr,D. A.}
}
@conference {18662,
	title = {AQuA: an adaptive architecture that provides dependable distributed objects},
	booktitle = {Seventeenth IEEE Symposium on Reliable Distributed Systems},
	year = {1998},
	month = {1998/10//},
	pages = {245 - 253},
	abstract = {Dependable distributed systems are difficult to build. This is particularly true if they have dependability requirements that change during the execution of an application, and are built with commercial off-the-shelf hardware. In that case, fault tolerance must be achieved using middleware software, and mechanisms must be provided to communicate the dependability requirements of a distributed application to the system and to adapt the system{\textquoteright}s configuration to try to achieve the desired dependability. The AQuA architecture allows distributed applications to request a desired level of availability using the Quality Objects (QuO) framework and includes a dependability manager that attempts to meet requested availability levels by configuring the system in response to outside requests and changes in system resources due to faults. The AQuA architecture uses the QuO runtime to process and invoke availability requests, the Proteus dependability manager to configure the system in response to faults and availability requests, and the Ensemble protocol stack to provide group communication services. Furthermore, a CORBA interface is provided to application objects using the AQuA gateway. The gateway provides a mechanism to translate between process-level communication, as supported by Ensemble, and IIOP messages, understood by Object Request Brokers. Both active and passive replication are supported, and the replication type to use is chosen based on the performance and dependability requirements of particular distributed applications},
	keywords = {adaptive architecture, AQuA, availability requests, client-server systems, commercial off-the-shelf hardware, CORBA, dependability manager, dependability requirements, dependable distributed objects, distributed object management, Ensemble protocol stack, Fault tolerance, group communication services, middleware software, Object Request Brokers, process-level communication, proteus, Quality Objects, replication, software fault tolerance, Software quality},
	doi = {10.1109/RELDIS.1998.740506},
	author = {Cukier, Michel and Ren,J. and Sabnis,C. and Henke,D. and Pistole,J. and Sanders,W. H. and Bakken,D. E. and Berman,M.E. and Karr,D. A. and Schantz,R.E.}
}
