A Hierarchical Navigation Map for A Fault-Tolerant Mobile Agent Model

全文

(1)A Hierarchical Navigation Map for A Fault-Tolerant Mobile Agent Model Youhei Tanaka1, Naohiro Hayashibara1, Tomoya Enokido2, and Makoto Takizawa1 1 Tokyo Denki University, Japan, and 2Rissho University, Japan 1 {youhei, haya, taki}@takilab.k.dendai.ac.jp, [email protected] ABSTRACT An application program on a faulty computer can be performed on another operational computer by moving the program in the mobile agent model. In this paper, we discuss a transactional agent (TA) model where a reliable and efficient application for manipulating objects in multiple computers is realized in the mobile agent model. Here, only a small part of the application program named routing (R) subagent moves around computers. A routing subagent autonomously finds a destination computer. We discuss a hierarchical navigation (HN) map which computer should be visited. A manipulating (M) subagent programs manipulating objects in a computer are loaded to the computer on arrival of R subagent in order to reduce the communication overhead. There are kinds of faulty computers for a transactional agent; current, destination, and sibling computers where a transactional agent now exists, will move, and has visited, respectively. The types of faults are detected by neighboring M subagents by communicating with each other. If some of the M subagents are faulty, the R subagent has to be aborted. However, the R subagent is still moving. We discuss how to efficiently deliver the abort message to the moving R subagent. We evaluate the TA model in terms of how long it takes to abort the R subagent if some computer is faulty.. 1: INTRODUCTIONS Various types of objects like databases [11, 13] are distributed on multiple servers in networks. A transaction [3] of an application program is an atomic sequence of methods issued to objects. In the client-server model [6], a transaction is performed on a client and issues access requests like SQL [1] to servers. Servers can be made more reliable and available by using multiple server replicas [14] and taking checkpoints [9] in the servers. However, application programs cannot be performed on clients if the clients are faulty. For example, multiple servers might block if a client is faulty in the two-phase commitment protocol [11]. A process of an application program can be actively, passively, semi-actively, and semi-passively replicated [14]. However, it is not easy to actively and semi-actively perform multiple replicas of an application program on databases since multiple replicas issue update requests to each of the databases [2]. On the other hand, mobile agents [4] are programs which. move in networks. Here, an application program on a faulty computer can move to another operational computer. We discuss how to reliably realize an application program manipulating distributed objects in a mobile agent in presence of computer faults. A transactional agent (TA) is a mobile agent which manipulates objects with some commitment condition. In order to reduce the communication overhead, a transactional agent is decomposed into a routing (R) subagent and a collection of manipulation (M) subagents. The R subagent autonomously moves in the network. We introduce a hierarchical navigation (HN) map in this paper. Here, computers with replicas of an object are collected into a group and the precedent relations among components in the group are specified based on the output-input relation [14]. A commitment condition of a transactional agent is specified for each group, e.g. atomic and majority ones. An M subagent is only a part of an application program to locally manipulate objects in each computer. On arrival of an R subagent, classes of the M subagent are loaded to the computer. In the TA model, there are types of computers which might be faulty, i.e. destination, sibling, and current computers where a transactional agent moves, has passed and a manipulation (M) subagent exists, and currently exists, respectively. Sibling M subagents are linearly chained to show a sequence of computers which the transactional agent has visited. An M subagent periodically exchanges messages with its neighboring ones. An M subagent is detected to be faulty by the neighboring M subagents with the time-out mechanism. We evaluate the TA model in terms of how long it takes to abort the R subagent since the R subagent is still moving. In section 2, we discuss the TA model. In section 3, we present the HN map. In section 4, we discuss how a transactional agent can be tolerant of computer faults. In section 5, we evaluate the TA model.. 2: A TRANSACTIONAL AGENT MODEL A class c is stored in a home computer Home(c). If a method of a class c is invoked by a mobile agent on a computer D, c is searched in the local cache. If found, c in the cache is invoked. Otherwise, c is loaded to D from Home(c). A mobile agent A is initiated on a base computer Base(A) by loading classes from Home(A). A transactional agent is a mobile agent which autonomously makes a decision on what computer to visit in presence of computer faults, moves in networks. - 440 -.

(2) and locally manipulates objects in each computer, negotiates with other transactional agents with respect to which one takes conflicting objects, and commits only if a commitment condition is satisfied, otherwise aborts. Target objects are objects to be manipulated by a transactional agent. In order to reduce the communication overhead, a transactional agent A is decomposed into a routing (R) subagent RA(A) and manipulation (M) subagents MA(A, D1), ..., MA(A, Dn) (n ≥ 1), where Di stands for a target computer. Each MA(A, Di) is a part of an application program to locally manipulate objects in Di. Only RA(A) moves around computers while autonomously making a schedule to visit target computers. On arrival of RA(A) at a computer Di, classes of MA(A, Di) are loaded to Di from the home computer Home(A) as shown in Figure 2.. manipulation (M) subagent MA(A, Di) derives some object x from a computer Di and MA(A, Dj ) uses x in another Dj [Figure 3]. Here, there is an output-input relation “Di → Dj .” The output-input relation → shows a sequence of computers in which the R subagent RA(A) visits. If Di → Dj , RA(A) has to visit Di prior to Dj. Di and Dj are independent (Di || Dj ) iff neither Di → Dj nor Dj → Di.. Figure 2. Input-output relation.. Figure 1. Movement of a transactional agent. A transactional agent A is initiated on a base computer D1 (= Base(A)) by loading the classes from Home(A). RA(A) makes a schedule Sch(A) to visit target computers. Then, RA(A) moves to another computer D2 from D1 according to the schedule Sch(A). Thus, RA(A) moves to a computer Di from Di−1. Here, Di is current. Then, the M subagent MA(A, Di) is initiated in Di. Objects are locally manipulated in the current computer Di through MA(A, Di). Then, MA(A, Di) may output intermediate objects from Di. In turn, MA(A, Di) may use the intermediate objects output by another MA(A, Dh) (h < i). Even if RA(A) leaves a computer Di, MA(A, Di) still holds objects manipulated in Di. MA(A, Di) commits only according to the indication of RA(A). Here, suppose RA(A) is now on a current computer Di after visiting D1, ..., Di−1. Here, MA(A, D1), ..., MA(A,Di−1) are sibling M subagents. Suppose MA(A, Di) holds objects and RA(B) of another transactional agent B would like to manipulate the objects in a conflicting way. Here, RA(B) negotiates with MA(A, Di) to decide which one A or B holds the objects based on the commitment conditions [10].. A hierarchical navigation (HN) map HMap(A) is composed of nodes interconnected with output-input relations for each transactional agent A. A node Gi is composed of nodes. A node shows a computer or a group. A group is a collection of nodes. A node showing a computer is primitive. Thus, HMap(A) is a group of nodes. Let us consider a group Gi = {Di1, ..., Dili} (li ≥ 1) of an object oili . Each Dij is primitive of Gi. Suppose each Dij has a replica oij. A transactional agent A is specified with the following commitment condition CC(A, Gi) for a group Gi: 1. 2. 3. 4.. Atomic (A) commitment condition: All the nodes should be successfully visited in a group Gi. Majority (M) commitment condition: More than half of the nodes should be successfully visited. At-least-one (AO) commitment condition: At least one of the nodes should be successfully visited. (n, r) commitment condition: More than (r/n)li nodes out of li nodes should be successfully visited.. 3: A HIERARCHICAL NAVIGATION MAP Objects are distributed to computers in networks. Suppose an object oi is replicated in multiple computers Di1, ..., Dili (li ≥ 1). Let oij be a replica of an object oi in Dij. If a transactional agent A derives some values of the object oi, A can visit any computer Dik with a replica oij . On the other hand, A has to visit every computer Dih to update the object oi,. Here, a collection of computers Di1, ..., Dili is a group Gi of oi. Here, suppose a. Figure 3. Input-output relation among groups. If all the objects in Gi have to be successfully manipulated in a transactional agent A, the atomic commitment is taken for Gi, i.e. CC(A, Gi) = A. For example, if A just derives values from the object oi, A can visit one computer in Gi. Here, CC(A, Gi) = AO. In. - 441 -.

(3) another example, an object oi is decomposed into subagents, i.e. subobjects oi1, ..., oili. Each subobject oij is a part of oi. Here, a group Gi is composed of nodes {Gi1, ..., Gili} where each Gij is related with a subobject oij . Then, each oij is replicated in replicas oij1, ..., oijlij , where each replica oijk is in Dijk. Here, Gi is a collection of primitire nodes {Gij1, ..., Gijlij } where each Gijk shows a computer Dijk with a replica oijk. If a transactional agent A navigates data in the object oi, CC(A, Gi) = A and CC(A, Gij) = AO. Let Gk be {Dk1, ..., Dklh } for object ok. If a transactional agent A manipulates the object oj after oi, Gi precedes Gj (Gi → Gj ) in A as shown on Figure 4. Thus, A decides on in which order A would visit node in each Gi. We discuss how to make a schedule Sch(A) from HMap(A) composed of nodes G1, ..., Gl. A node Gij is initial in Gi if there is no node Gik such that Gik → Gij. Furthermore, each group Gi is furthermore composed of nodes Gi1, ..., Gili (li ≥ 1). Here, ``<b1, …, bm> + a” = <b1, …, bm, a>. A schedule is obtained from Gi by the following procedure. [Schedule(A, Gi)] 1. Gi := φ . return (Sch); 2. Ii := subset of initial nodes which have no incoming edge in Gi; Ri:= φ ; Sch := φ ; 3. Otherwise, take one initial node Gij in Iij; Gi := Gi – {Gij}; Rj := Rj ∪ {Gij}; If Gij is an aggregate node, Sch := Sch + Schdule(A, Gij ), else Sch := Sch + Gij ; 4. If CC(A, Gi) = A, go to 1; if CC(A, Gij) = AO, return (Sch) if |Ri| ≠ o, if CC(A, Gij) = M, return (Sch) if |Ri| > li / 2, if CC(A, Gij) = (n, r), return (Sch) if |Ri| ≥ (r / n)li; go to 1. In Figure 5, a group G is composed of three nodes G1, G2, and G3 where G1 → G3 and G2 → G3. Suppose the atomic commitment is taken for G in a transactional agent A, CC(A, G) = A(atomic). Here, the initial set I is {G1, G2}. One of the initial nodes G1 and G2 is taken, say G1. Then, G2 is taken. Here, G1 precedes G2 (G1 ⇒ G2). Lastly, G3 is taken. G1 ⇒ G2 ⇒ G3. G1 includes computers D1, D2, and D3. Here, suppose CC(A, G1) = AO. Suppose D11 → D12 in G1. Here, I1 = {D11, D13}. Suppose D11 is taken. Since D11 → D12, D12 is next taken. Here, D11 ⇒ D12. Since CC(A, G1) = AO, D13 is not taken. Then, D12 and D13 are taken. Next, D2 in G2 is taken. Finally, the nodes in G3 are taken. Suppose that CC(A, G3) = A. For example, D31 is first taken because D31 is less loaded than D32. D31 ⇒ D32. Finally, a schedule D11 ⇒ D12 ⇒ D2 ⇒ D31 ⇒ D32 is obtained by Schedule(A, G).. 4: A FAULT-TOLERANT MODEL 4.1: TYPES OF FAULTS A routing (R) subagent RA(A) of a transactional agent A is initiated on a base computer D1 (= Base(A)). Then,. Figure 4. Hierarchical navigation map. RA(A) moves to D2 from D1 and a manipulation (M) subagent MA(A, D2) locally manipulates objects in D2. Thus, RA(A) visits computers D1, D2, ..., Di. The sequence D1, D2, ..., Di is the history of A. Then, RA(A) moves to Di+1 from Di. Here, Di−1 and Di+1 are the direct predecessor and direct successor of Di, respectively. Di−h and Di+h (h > 0) are the predecessor and successor of Di, respectively. We assume networks are reliable but a computer may stop by fault. Suppose RA(A) is on a current computer Di. There are the following types of faulty computers in a history D1, ..., Di:. 1. 2. 3.. A destination computer Di+1 is faulty. A sibling computer Dk (k < i) which RA(A) has visited is faulty. A current computer Di is faulty.. Figure 5. Faults of computers.. 4.2: FAULT OF DESTINATION COMPUTER TYPES OF FAULT First, suppose a routing (R) subagent RA(A) finds a destination computer Dj in HMap(A) on the current Di. Here, suppose the destination Dj is faulty and RA(A) first tries to find another operational destination from Di as follows: 1. RA(A) finds a computer Dk independent of the faulty computer Dj. 2. RA(A) finds a replica computer Dk where the same MA(A, Dj ) can be performed. Independent and replica computers of Dj are candidates. If a candidate Dk is found, RA(A) moves to Dk. If another destination from the current Di is not found, RA(A) backs to the direct predecessor Dh. Here, MA(A, Di) is aborted. On backing to the predecessor Dh, RA(A) brings information on the faulty computer. If. - 442 -.

(4) RA(A) on Dh finds another candidate Dk (k ≠ i), RA(A) moves to Dk. Otherwise, RA(A) furthermore backs to the direct predecessor. [Faulty destination computer] 1. RA(A) takes one of the following actions: a. Finds another candidate computer Dk. b. Waits on the current computer Di until the faulty destination Di+1 is recovered. 2. RA(A) takes the action a: If a candidate Dk is found, RA(A) moves to Dk. If not found, go to 4. 3. RA(A) takes the action b: If the destination Di+1 is recovered, RA(A) moves to Di+1. If the timer expires, go to 4. 4. If the current computer Di is D1, RA(A) aborts. Otherwise, RA(A) backs to the direct predecessor Di−1. Then, RA(A) takes the action a.. Each sibling M subagent MA(A, Di) exchanges control messages with the direct predecessor MA(A, Di−1) and the direct successor MA(A, Di+1) as shown in Figure 6. Here, a pair of MA(A, Di−1) and MA(A, Di+1) find Di to be faulty by the time-out mechanism.. a.. 3.. 4.. a State message si to MA(A, Di−1) where si.succ := Succi. b. State-response message ri to MA(A, Di+1) where ri.pred := Predi. On receipt of ri−1 from Di−1, Predi := ri−1.pred + Di−1 in MA(A, Di). MA(A, Di) sends State-responce ri to MA(A,Di+1) where ri.pred := Predi. When RA(A) leaves Di for the direct successor Di+1, Log := Log + Di and RA(A) carries Log. Here, Dsucci := Di+1.. If MA(A, Di) does not receive any message from the direct predecessor MA(A, Di−1) and direct successor MA(A, Di+1) for some time units, MA(A, Di) sends State-responce ri and State si to MA(A, Di−1) and MA(A, Di+1), respectively. If MA(A, Di) does not receive any message after sending some number of State-response and State messages, MA(A, Di) perceives the neighbors MA(A, Di−1) and MA(A, Di+1) to be faulty, respectively. Thus, MA(A, Di) obtains information Predi of the predecessors D1, ..., Di−1 from RA(A). MA(A, Di) obtains configuration on what computers are the successors on receipt of State-response from the direct successor MA(A, Di+1). In addition, MA(A, Di) forwards State from the direct predecessor to the direct successor.. 4.4: FAULT OF CURRENT COMPUTER. Figure 6. Communication among manipulation subagents. Suppose an R subagent RA(A) moves to a computer Di from Di−1. RA(A) carries a log information Log to Di, which shows a history of computers D1, ..., Di−1 which RA(A) has so far visited. Hence, MA(A, Di) knows what computers are its predecessors D1, ..., Di−1. On time RA(A) leaves Di for Di+1, RA(A) gives information of Di+1 to MA(A, Di). Here, a variable Predi denotes a sequence of the predecessors <D1, …, Di-1> and Succi shows a sequence of its successors which MA(A, Di) knows. Variables DSucci and DPredi show the direct successor and predecessor of MA(A, Di), respectively. Dsucci = Di−1 and Dpredi = Di+1. a1 and an are top and last elements of a list <a1, …, an>. An element Dh in Succi = <Di+1, Di+2, …, Dh> is the last successor of Di. Sibling M subagents MA(A, D1), ..., MA(A, Di) communicate with each other as follows [Figure 6]: [Faulty sibling computer] 1. MA(A, Di) is created on Di on arrival of RA(A) with the log Log from the direct predecessor Di−1. Here, Predi := Log, DPredi := Di−1, and Succi := DSucci := φ . MA(A, Di) sends a State message sj to the direct predecessor MA(A, Di−1) where sj.succi = Succi. 2. On receipt of a State si+1 from MA(A, Di+1), MA(A, Di) manipulates a variable Succi as Succi := si+1.succ + Di+1 and sends as follows:. A routing (R) subagent RA(A) is faulty only if a current computer Di is faulty. Suppose that RA(A) comes from a computer Di−1 to Di. Suppose the direct predecessor MA(A, Di−1) detects Di to be faulty, i.e. RA(A) is faulty on Di. Here, the direct predecessor MA(A, Di−1) recreates a new incarnation of RA(A). The new incarnation tries to take another destination Dk in HMap(A). Here, MA(A, Di−1) sends State si−1 to MA(A, Di−2), where si−1.succ = <Di-1>. If another destination Dk is found, RA(A) moves to Dk. If not found, RA(A) further backs to MA(A, Di−2) and MA(A, Di−1) aborts.. Figure 7. Reincarnation of routing subagent. [Faulty current computer] 1. The direct predecessor MA(A, Di−1) detects the current computer Di to be faulty by timeout. 2. MA(A, Di−1) recreates a new incarnation RA(A). 3. RA(A) on Di−1 takes the action of the faulty destination.. 4.5:. FAULT SUBAGENT. - 443 -. OF. MANIPULATION.

(5) A sibling M subagent MA(A, Di) which RA(A) has visited may be faulty. The direct predecessor MA(A, Di−1) and the direct successor MA(A, Di+1) detect MA(A, Di) to be faulty by the time-out mechanism as discussed before. If the commitment condition is not an atomic type, RA(A) can continue the computation even if MA(A, Di) is faulty. MA(A, Di+1) knows every predecessor of the faulty MA(A, Di), i.e. MA(A, D1), ..., MA(A, Di−1) while MA(A, Di−1) knows that MA(A, Di) is its direct successor but may not know every successor MA(A, Dh) (h > i) of MA(A, Di). Hence, MA(A, Di+1) sends State si+1 to MA(A, Di−1). Here, MA(A, Di+1) and MA(A, Di−1) are now neighbors as shown in Figure 8. Secondly, the direct predecessor MA(A, Di−1) of the faulty MA(A, Di) creates a new incarnation of RA(A) on Di−1. The new incarnation finds another operational destination as discussed before. Here, MA(A, Di−1) sends State si−1 where si−1.succ = φ to MA(A, Di−2) to inform the fault of Di. Thus, every predecessor MA(A, Dh) (h < i−1) of MA(A, Di−1) eventually knows that Di is faulty and the successors Di+1, Di+2, ... of the faulty MA(A, Di) are not sibling ones. The direct successor MA(A, Di+1) also detects MA(A, Di) to be faulty. We consider the following three ways to deliver Abort to the old incarnation.. Figure 9. MC way. [Broadcast (BC) way] 1. MA(A, Di) detects the direct predecessor MA(A, Di−1) to be faulty. 2. MA(A, Di) sends Abort with the successors list succi to every successor MA(A, Dh) (h > i) in the log succi. Then, MA(A, Di) aborts. 3. On receipt of an Abort message from a predecessor MA(A, Dh), MA(A, Di) forwards Abort to RA(A) if Di is current. Otherwise MA(A, Di) forwards Abort to every successor MA(A, Dh) (h > i) in the log succi - succh. Then MA(A, Di) aborts.. Figure 10. BC way.. 5: Evaluation. Figure 8. Detection of faulty computer. [Linear chain (LC) way] 1. MA(A, Di+1) sends an Abort message to the direct successor MA(A, Di+1) and then aborts. 2. On receipt of Abort from MA(A, Di−1), MA(A, Di) forwards Abort to MA(A, Di+1) if Di is not current. MA(A, Di) forwards Abort to RA(A) if Di is current. 3. Then, MA(A, Di) aborts. [Modified chain (MC) way] 1. On receipt of Abort from the direct successor MA(A, Di+1), MA(A, Di) finds the last successor MA(A, Dh) in the log Succi = <Di+1, Di+2, ..., Dh>. 2. MA(A, Di) forwards Abort to not only the direct successor MA(A,Di+1) but also the last successor MA(A,Dh). MA(A, Di) aborts. 3. On receipt of Abort from a predecessor MA(A, Dj) (j < i − 1), MA(A, Di) forwards Abort to MA(A, Di+1) and MA(A, Di−1). MA(A, Di) aborts. If Di is current, the old incarnation of RA(A) aborts.. In the transactional agent (TA) model, a routing (R) subagent is moving in a network even after some sibling manipulation (M) subagent is faulty. An Abort message has to be delivered to the old incarnation of the R subagent, which is still moving. We evaluate the TA model in terms of how long it takes to deliver an Abort message to the old incarnation if some sibling computer is faulty. We assume that it takes 16 [msec] to perform a transactional agent on each computer, i.e. an R subagent moves to the current computer from another computer, classes of an M subagent are loaded to the current computer from the base computer, and the M subagent is performed by manipulating objects in the current computer. We assume it takes 3 [msec] to deliver a message from a computer to another. In this evaluation, each subagent is realized as thread. The movement of an R subagent is simulated as creating a thread. Initially, there are a sequence of 100 nodes M0, ..., M99 where each Mi shows MA(A, Di). M99 is current and M0 is a base computer. Every 16 [msec], one M subagent Mi is created (i = 100, 101, ...). We assume one node Mi out of 100 nodes M0, ..., M99 is faulty. In the LC way, Abort is sent from a node to only neighboring nodes. Abort is forwarded to the old incarnation. In the MC way, Abort is sent to not only neighboring nodes but also the last node Mh. Then, the node Mh forwards Abort to its neighboring node and last node if the node is not current. In the BC way, Abort is sent to every successor which Mi knows. The last node is sent to every successor.. - 444 -.

(6) 6: Concluding Remarks. Figure 11. Delivery time of Abort message. Figure 11 shows the delivering time of the Abort message if Mi is faulty (i = 0, ..., 99). For example, if M10 is faulty, it takes 330 [msec], 138 [msec], and 94 [msec] to deliver Abort in the LC, MC, and BC ways, respectively. Figure 12 shows how many computers the old incarnation of the R subagent visits after some sibling computer is faulty until Abort is delivered to the old incarnation. In the LC and BC ways, only one node is created until the old incarnation receives Abort.. Figure 12. Number of computers. In the LC way, the old incarnation of the R subagent visits 13 computers after M40 is detected to be faulty. Figure 13 shows how many Abort messages are transmitted among nodes until the old incarnation is aborted. For example, 20 messages are transmitted in the BC way, 22 in the MC way, and 28 in the LC way if the 80th node M80 is faulty. Following the figures, the BC way implies the best performance.. Figure 13. Number of messages.. We discussed how to realize a fault-tolerant application to manipulate distributed objects with a mobile agent in presence of computer faults. A transactional agent (TA) is a mobile agent which manipulates objects with some commitment condition. There are types of computer faults, home, destination, sibling, and current computers. We discussed how to make the transactional agent tolerant of the types of computer faults through the cooperation of the sibling manipulation subagents. In the traditional client-server model, applications cannot be performed if the clients are faulty. In the TA model, a transactional agent autonomously finds another destination computer even if computers are faulty. Thus, application programs can be reliably realized in the TA model. We evaluated how long it takes to recover from faulty computers.. REFERENCES [1] American National Standards Institute. The Database Language SQL, 1986. [2] T. Enokido, K. Hori, M. Takizawa, and M. Raynal. Quorum-Based Multi-Invocation Model for Replicated Objects. In Concurrent Engineering: Research and Application Journal (CERA), 12:185–194, 2004. [3] J. Gray and A. Reuter. Transaction Processing : Concepts and Techniques. Morgan Kaufmann, 1993. [4] IBM Corporation. Aglets Software Development Kit Home. http://www.trl.ibm.com/aglets/. [5] T. Komiya, T. Enokido, and M. Takizawa. Mobile agent model for transaction processing on distributed objects. In Information Sciences, volume 154, pages 23–38, 2003. [6] N. A. Lynch, M. Merritt, A. F. W. Weihl, and R. R. Yager. Atomic Transactions. Morgan Kaufmann, 1994. [7] Object Management Group Inc. The Common Object Request Broker : Architecture and Specification. Rev. 2.1, 1997. [8] Oracle Corporation. Oracle8i Concepts Vol. 1 Release 8.1.5, 1999. [9] R. S. Pamula and P. K. Srimani. Checkpointing Strategies for Database Systems. In Proc. of the 15th Annual Conf. on Computer Science, IEEE Computer Society, pages 88–97, 1987. [10] M. Shiraishi, T. Enokido, and M. Takizawa. Fault-Tolerant Mobile Agent in Distributed Objects Systems. In Proc. of the 9th IEEE International Workshop on Future Trends of Distributed Computing Systems (FTDCS 2003), pages 145– 151, 2003. [11] D. Skeen. Nonblocking Commitment Protocols. In Proc. of ACM SIGMOD, pages 133–147, 1982. [14] Sun Microsystems Inc. The Source for Java (TM) Technology. http://java.sun.com/. [13] Y. Tanaka, N. Hayashibara, T. Enokido, and M. Takizawa. Design and Implementation of Transactional Agents for Manipulating Distibuted Objects. In Proc. of the IEEE 19th Advanced Information Networking and Applications (AINA2005), pages 368–373, 2005. [14] M. Wiesmann, F. Pedone, A. Schiper, B. Kemme, and G. Alonso. Understanding Replication in Databases and Distributed Systems. In Proc. of IEEE ICDCS-2000, pages 264–274, 2000.. - 445 -.

(7)