EndtoEnd Arguments in System Design在系统设计中结束参数.pptVIP

End-to-End Arguments in System Design J.H. Salter, D.P. Reed, and D.D. Clark MIT-LCS Motivation1 “Choosing the proper boundaries between functions is perhaps the primary activity of the computer system designer.” “Design principles that provide guidance in this choice of function placement are among the most important tools of a system designer” What is this paper about? “…discusses one class of function placement that has been used for many years with neither explicit recognition nor much conviction” Comment: to some extend still true today Example: A system includes communication Usually we draw a modular boundary around the communication subsystem and the rest of the system. There is a list of functions to be implemented in any of several ways: by the communication subsystem? by its client? as a joint venture? both doing it, redundantly? Function example: File Transfer Threats to the “careful FT” transaction Disk faults Software faults: file system, file transfer, communication software (buffering, copying mistakes…) Processor, memory transient errors. Packet dropping, mutation Crash in the middle of transaction … How to cope with the threat? Reinforce each step along the way using duplicate copies, time-out and retry, carefully located redundancy for error detection, crash recovery, t=etc. Reduce the probability of each of the individual threats to an acceptable small value. Yet, other observations Countering threat (2) requires writing correct programs, which is quite difficult. Few nontrivial large programs can claim correctness. Doing everything many times, also appear uneconomical (especially in real-time systems, and resource constrained systems). Alternate approach End-to-end check and retry. How will a reliable communication subsystem help? Does it reduce the frequency of retries of the file transfer system? (thus improves performance) YES! Does it effect the correctness of the outcome? NO! End-to-End Argument The function in question can complet