【正文】 ]. Given the many available OTS SQL servers and the growing standardisation of their functionality (SQL 92, SQL 99), it seems reasonable to build a faulttolerant SQL server from available OTS servers. We have developed an experimental testbed which implements a diverseredundant SQL server by wrapping a redundant set of SQL servers, so that multiple users run their transactions concurrently on the wrapped SQL servers. We are running experiments to determine the dependability gains achieved through fault tolerance [4]. In this paper, we report on experience gained about the design aspects of building fault tolerance with these specific OTS ponents: ? regarding diverse modular redundancy, we consider Nversion programming (NVP) and Nversion selfchecking programming (NSCP) – to use the terminology of [5]. In NVP, the system’s output is formed by a vote on the replicated outputs. In NSCP, each diverse “version” is supposed to fail cleanly, so that anyone of the replicated outputs can be used as the system’s output. Both solutions depend on guaranteed consistency between the states of the diverse replicas of the database. This problem of replica consistency, despite having been under scrutiny for a long time, is still far from being solved in general for database servers [6], [7]。請注意，在我們的例子中，如果某些客戶端沒有正確使用將LOCK_TIMEOUT 的防守，他們可以阻止訪問共享資源，另一方面，“忠誠”客戶。被殺害，如果一個(gè)服務(wù)器線程，客戶端和服務(wù)器之間的連接丟失和將要建立一個(gè)新的連接，這是一個(gè)比回滾幾個(gè)交易更昂貴的操作。它采用了 PA 的 MSSQL， LOCK_TIMEOUT，可以明確設(shè)置為每個(gè)查詢的具體。 服務(wù)器故障包裝 容錯(cuò)是一種明確的處理與已知的故障?？蛻舳耸嵌嗑€程的，每一個(gè)服務(wù)器是一個(gè)單獨(dú)的線程談話。第三個(gè)應(yīng)用是在發(fā)展的 TPCC 進(jìn)行基準(zhǔn)測試。 OTS 的 SQL 服務(wù)器的實(shí)驗(yàn)環(huán)境 軟件實(shí)驗(yàn)中心在倫敦城市大學(xué)，理工大學(xué)，保加利亞的普羅夫迪夫已初見成效。這兩種解決方案都依賴于保證數(shù)據(jù)庫的不同副本的狀態(tài)之間的一致性?？梢钥纯葱迯?fù)其產(chǎn)品的每一個(gè)新版本的供應(yīng)商所提供的清單。這種情況很可能在未來改變，如果客戶強(qiáng)烈要求實(shí)現(xiàn)與 OTS 的組件開發(fā)，其交易影響力是可想而知的，但這種可能性并不能幫助當(dāng)下的系統(tǒng)集成商。這也是目前系統(tǒng)集成商所面臨的。首先，我們描述了一個(gè)防護(hù)性包裝來掩蓋錯(cuò)誤的影響，在其中一臺服務(wù)器，而不從供應(yīng)商哪里去等待足夠的修復(fù)。組件廠商很少提供有關(guān)信息的質(zhì)量和使用的 V＆ V 程序。可能會拒絕優(yōu)勢通常采取授予時(shí)的源代碼是可用的系統(tǒng)集成商不能信任的組成部分，充分可靠的系統(tǒng)的需求，往往不 是系統(tǒng)的建設(shè)任務(wù)。眾所周知，使用 OTS的組件系統(tǒng)開發(fā)問題，是有關(guān)的可靠性收益，實(shí)施困難和該特定系統(tǒng)的將給他們帶來額外費(fèi)用。在本文中，我們報(bào)告關(guān)于建設(shè) OTS 的這些具體的組成部分容錯(cuò)設(shè)計(jì)方面取得的經(jīng)驗(yàn)：我們認(rèn)為對于不同的模塊化冗余， N版本編程（ NVP）和 N版本自檢 編程（ NSCP）使用的術(shù)語。對于 OTS SQL 服務(wù)器，保護(hù)包裝保護(hù)客戶端，服務(wù)器對服務(wù)器的故障對故 障的客戶，每個(gè)客戶對故障的間接影響其他客戶。服務(wù)器可運(yùn)行在任何操作系統(tǒng)，其中我們用于實(shí)驗(yàn)的三個(gè)服務(wù)器的 Windows 2020專業(yè)版適用本產(chǎn)品， 我們已經(jīng)嘗試用 1 和 100之間的客戶數(shù)目反映每個(gè)不等的客戶端動作，其中包括查詢或修改數(shù)據(jù)庫（選擇）（ INSERT， UPDATE， DELETE） 觸發(fā)器和存儲過程 。 并發(fā)控制的各種模式之間的客戶 。其只能修改交易開始后的對于以前的修改交易完成（提交或回滾）。然而，由管理員手動除是昂貴的，如果所有的客戶端能正確處理這種情況可能仍然允許前正在開展的大延誤。如果我們在包裝包括為LOCK_TIMEOUTs 異常處理程序，將 LOCK_TIMEOUT 期間將逐步增加，或只是重復(fù)軋后回交易，從而使“壞堵”條件的決議完全透明的，它可以改善客戶端。這個(gè)在包裝實(shí)施的變通方法，用戶組織可以提供容錯(cuò)錯(cuò)誤發(fā)現(xiàn)有損其裝置的可靠性，無需等待供應(yīng)商認(rèn)識到這個(gè)問題，并發(fā)出了一個(gè)補(bǔ)丁，在任何情況下可能無法完全消除不受 歡迎的行為。V procedures used. This creates problems for any integrator with stringent dependability requirements. At least in nonsafety critical industry sectors, vendors often treat queries of the quality of the offtheshelf ponents as unacceptable or even offensive [1]. System integrators are thus faced 1 We use the term “ponents” in the generic engineering meaning of “pieces that are assembled to form a system, and are systems in their own right”. “Components” may be anything ranging from software libraries, used to assemble applications, to plete applications that can be used as standalone systems. We consider together mercialofftheshelf (COTS) and nonmercial offtheshelf, . opensource, ponents: the difference is not significant in our discussion. Even when the source code is available, it may be impossible to make use of it – its size and plexity (and often poor documentation) may deny the system integrator the advantages usually taken for granted when the source code is available. R. Kazman and D. Port (Eds.): ICCBSS 2020, LNCS 2959, pp. 117–126, 2020. 169。 ? various modes of concurrency control between the clients: ? Free mode, . unrestricted access to servers by all clients. The level of isolation between the transactions provided by the servers is set to “serialisable”, but no mechanism (. atomic broadcast) is implemented in the testbed to control the order in which the queries are delivered to the individual servers and hence executed by the servers. The clients are multithreaded, with a separate thread talking to each of the servers. ? Bottleneck mode, which imposes a very restrictive total order of the access by the clie