Guardian Programmer's Guide

Fault-Tolerant Programming in C
Guardian Programmer’s Guide — 421922-014
27 - 21
Example of Updating State Information
...Update account balance
}
An insufficient number of update points is added to the transaction:
/*First update point*/
cnt = 1;
...Update cnt (idle state)...
err = WRITEREAD (terminal,buf1,...); /*returns account_no
and amount*/
/*Second update point. Include control state and terminal
data*/
cnt = 2;
...Update cnt, buf1...
err = POSITION (account_file, buf1.acct_no);
err = READUPDATE (account_file, buf2,...);
x = buf2.current_balance + buf1.amount;
if (x > buf2.credit_limit)
Credit limit exceeded...
else {
buf2.current_balance = x;
err = WRITEUPDATE (account_file, buf2, ...);
err = WRITE (terminal, buf1,...);
}
The first state update identifies the program state as being idle (or waiting for input
from the terminal). The state information consists only of a counter variable set to 1.
The variable is used to select the appropriate continuation point in a switch statement
in the backup process.
The second state update occurs immediately after reading the terminal input. The
state information consists of:
•
The counter variable (to determine where to resume execution in the backup
process)
•
The data read from the terminal
The assumption is that, because the transaction is driven by the data read from the
te
rminal, that data is sufficient for the backup process to perform the identical
operation. This assumption is incorrect, however. A problem arises if a failure occurs
just after the WRITEUPDATE of the account_file. The problem is illustrated in the
following transaction:
err = WRITEREAD (terminal,buf1,...); reads account_no = 12345,
amount = $10
/*Second state information update. Include control state and
terminal data*/
cnt = 2;
...Update cnt, 12345, $10...