IEICE TRANS. COMMUN., VOL.E91–B, NO.2 FEBRUARY 2008

437

PAPER

A Study of Control Plane Stability with Retry Traﬃc:Comparison of Hard- and Soft-State Protocols
Masaki AIDA†a) , Chisa TAKANO†,†† , Members, Masayuki MURATA††† , Fellow, and Makoto IMASE††† , Member

SUMMARY
Recently problems with commercial IP telephony systems
have been reported one after another, in Japan. One of the important causes
is congestion in the control plane. It has been recognized that with thecurrent Internet it is important to control not only congestion caused byoverload of the data plane but also congestion caused by overload of thecontrol plane. In particular, “retry traﬃc,” such as repeated attempts to set
up a connection, tends to cause congestion. In general, users make repeatedattempt to set up connections not only when the data plane is congested but
also when the control plane in the network is overloaded. The latter iscaused by user behavior: an increase in the waiting time for the processing of connection establishment to be completed tends to increase his or her
initiation of reattempts. Thus, it is important to manage both data plane andcontrol-plane resources eﬀectively. In this paper, we focus on RSVP-based
communication services including IP telephony, and introduce a model thattakes account of both data-plane and control-plane systems, and we examine the behavior of retry traﬃc. In addition, we compare the system stability achieved by two diﬀerent resource management methods, the hard-statemethod and the soft-state method.
key words: IP telephony, VoIP, retry traﬃc, control plane, soft-state, stability

1.

Introduction

In the Internet, congestion due to overload of the control
plane has become an important issue in addition to congestion due to overload of the data plane. In particular, “retry
traﬃc,” such as repeated attempts to set up a connection or
reload a file, tends to cause congestion. Therefore, it is important to develop a mechanism to avoid congestion causedby retry traﬃc.
In general, retry traﬃc is generated by factors in both
the data plane and the control plane as described below.
• Retry traﬃc generated due to a shortage of data-plane
resources. A shortage of resources in the data planecauses requests to establish a connection or secure
bandwidth to be discarded. This will induce retries.
• Retry traﬃc generated due to a shortage of controlplane resources. A shortage of processing resources
Manuscript received March 22, 2007.
Manuscript revised July 17, 2007.
†
The authors are with the Graduate School of System Design,
Tokyo Metropolitan University, Hino-shi, 191-0065 Japan.
††
The author is with the Traﬃc Engineering Division, NTT Advanced Technology Corporation (NTT-AT), Musashino-shi, 1800006 Japan.
†††
The authors are with the Graduate School of Information
Science and Technology, Osaka University, Suita-shi, 565-0871
Japan.
a) E-mail: maida@sd.tmu.ac.jp
DOI: 10.1093/ietcom/e91–b.2.437

causes the response time of the processing system to increase. This will induce impatient users to repeat theirrequests.
Since retry traﬃc itself consumes network resources, it is
not appropriate to handle congestion on the data plane andthat on the control plane separately. It is also important tomanage network resources appropriately in order to prevent
retry traﬃc from increasing.
Network resource management methods can bebroadly classified into two categories:• Hard-state methods: A network resource is secured
or released at a user’s explicit request.
• Soft-state methods: A network resource is secured
at a user’s explicit request but is released automaticallyafter the expiry of a timer rather than at the user’s explicit request. If the user wishes to retain a resource fora prolonged period, he or she needs to send a refresh
message periodically to initialize the timer, thereby
preventing the resource from being released.
In general, if requests from users can be relied on toarrive without fail, the hard-state method is more scalable
than the soft-state method when faced with an increase in thenumber of user connections to be managed. This is because
the hard-state method does not require refresh-messages tobe sent. However, if requests from users do not necessarily arrive without fail, and thus the probability of failingto release a resource is not negligible, the balance between
the overhead of sending refresh messages and the failure
to manage resources properly determine which method ismore advantageous, the hard-state method or the soft-statemethod. The soft-state method is widely used in the current
Internet design. The advantages and disadvantages of thetwo methods have been evaluated from a variety of perspectives [1]–[3]. However, it is not a simple task to determine
which is better because the outcome is influenced by thetype of traﬃc and other conditions used in any comparison.
This paper investigates the stability issues in RSVPbased communication services including IP telephony, anddiscusses the properties of retry traﬃc caused by resource
shortage in the data plane or the control plane. In order totake retry traﬃc generation into consideration, it is necessary to consider the interaction between users and the system. First, we introduce a quasi-static retry traﬃc model that
describes the behavior of input traﬃc including retry traﬃc.
Next, we demonstrate that under certain conditions a system

c 2008 The Institute of Electronics, Information and Communication Engineers
Copyright IEICE TRANS. COMMUN., VOL.E91–B, NO.2 FEBRUARY 2008438

can become unstable abruptly. We also indicate that network
resource management is important in protecting the control
plane from the proliferation of retry traﬃc, and that resource
management based on the soft-state method oﬀers eﬀective
and robust protection against changes in the network state.
This paper is organized as follows. In Sect. 2, we
briefly summarize the related studies concerning retry traffic and control-plane models. Section 3 introduces a systemmodel that takes account of retry traﬃc in both control anddata planes. In addition, we propose a quasi-static retry traffic model for analyzing the stability of the model. Using thequasi-static retry traﬃc model, Sect. 4 investigates the stability of the system. Section 5 shows approximations of parameter values that concern the system stability. In Sect. 6,
we compare both hard- and soft-state based resource management protocols, with respect to the stability of the system. Our conclusions are summarized in Sect. 7.
2.

Related Studies

Studies dealing with retry traﬃc on an M/G/s/s retrial queue
model are well known [4]–[6]. The expression, M/G/s/s,
represents a model in which service requests arise in a Poisson manner, enter the system, receive service from one ofs servers, and then leave the system, and in which service
requests are discarded if all s servers are busy. An M/G/s/s
retrial queue model represents an M/G/s/s model in which

discarded service requests are stored in a retrial queue andre-enter the system after a certain elapsed time determinedby an exponential distribution (Fig. 1). It is known that thestability of the M/G/s/s retrial queue model can be derived
if the length of the retrial queue does not diverge [4], and
λ0
< s,
μ

(1)

where λ0 is the arrival rate of service requests, excluding
retry requests, per unit time, and 1/μ is the average service
time.
Although the M/G/s/s retrial queue model incorporates
retry traﬃc that arises due to a resource shortage on the data
plane, it does not incorporate retry traﬃc that arises due to a
resource shortage on the control plane.
Reference [7] points out that an increase in the complexity of call control processing due to the addition of newprocessing requirements, such as the determination of QoS,
causes an increase in the load on the control plane, and discusses the properties of call processing delay. Although [7]addresses both the data and control planes, it does not takeretry traﬃc into consideration.
3.

Model that Takes Account of Retry Traﬃc in Both
the Control Plane and the Data Plane

This section describes a model for examining the properties of retry traﬃc that arises due to resource shortages inthe data and control planes, and the method used to analyze
these properties.
3.1 Basic Model for RSVP-Based Communications

Fig. 1

M/G/s/s retrial queue model.

In order to describe retry traﬃc that arises due to resource
shortages in the data and control planes, we have developed a model that incorporates a serial combination of a data
plane model and a control plane model (Fig. 2).
The data plane model describes the behavior of datatransmission processing, such as securing link bandwidth,and so we use an M/G/s/s retrial queue model for it. If thesystem fails to secure bandwidth due to a resource shortage

Fig. 2 Model incorporating retry traﬃc in both the control plane model (M/M/1) and the data planemodel (M/G/s/s).

AIDA et al.: A STUDY OF CONTROL PLANE STABILITY WITH RETRY TRAFFIC

439

in the data plane, it means that all s servers are busy. In thiscase a service request is kept waiting in the retrial queue fora period of time (exponential), and then is re-entered into
the system as a new request.
The control plane model describes the system behavior
related to routing and processing of protocols, and so M/M/1
has been adopted for it. The expression, M/M/1, represents
a model in which service requests arise in a Poisson manner, enter the system, receive service from one server withexponential service time, and then leave the system, and inwhich service requests are queued if the server is busy. The
reasons why we apply M/M/1 to the control-plane model arethat it allows simple and tractable analysis of the stabilityof the retry system. However, the validity of the M/M/1based model needs justification. If the control-plane model
describes session initiation processes of IP telephony, features of the input process and the use of a single server
are acceptable assumptions. Although the accuracy of the
M/M/1-based model with respect to the service time of thecontrol plane model is unknown, the results obtained fromthis model will give a foundation for analyzing more complex models in future studies.
In addition to the ordinary M/M/1 model, some of theusers who have been kept waiting due to increased processing time may attempt to initiate a new service request.
Therefore, we have modified this model slightly to take account of retry traﬃc that will arise depending on the lengthof the queue in the M/M/1 model. Since such retry traﬃcwill be generated without the original service requests being cancelled, our model assumes that new service requests
arise without any of the service requests waiting in the queuein the M/M/1 model being withdrawn.
Note that we assume the input to the data plane follows
a Poisson process. If there is no retry traﬃc, this assumption
is true because M/M/1 is chosen for the control-plane model.
This is because service requests that leaves the control planeand enter in the data plane follow a Poisson process. As
shown in the subsequent sections, we also model the inputof retry traﬃc as a Poisson process. Thus, the input to thedata plane follows a Poisson process even when there is retry
traﬃc.
3.2 Quasi-Static Retry Traﬃc Model
This subsection considers how retry traﬃc arises from thecontrol-plane system shown in Fig. 2. If retry traﬃc that isdependent on the length of the queue in the control planearises, one possible case is that retry traﬃc volume is proportional to the length of the queue in the control plane. If
we assume that service requests waiting in the queue generate retry traﬃc at a certain rate , a diagram depicting thestate transition rate with respect to the queue length of thecontrol-plane system is as shown in Fig. 3. In this figure, λ0
is the arrival rate of service requests, excluding retry traffic, per unit time, while 1/η is the average service time of
the control plane system. For this system to have a steadystate probability, the infinite sum on the right-hand side of

λ0λ0 + - λ0 + (i −1)λ0 +i λ0+ (i + 1)





0

1

 


η

···

η

i+1

i

i+2

···

 
 
 

η

η

η

Fig. 3 State transition diagram for the case where retry traﬃc is generated in proportion to the queue length of the control-plane system.

the following equation must be finite.
⎡
⎤⎥−1
i 
∞ 

⎢⎢⎢
⎥⎥⎥
λ
+
j
0
⎥⎥⎦ .
p0 = ⎢⎢⎣⎢1 +η
i=1 j=0

Therefore, if  > 0, the system is unstable. Since an increase in retry traﬃc does not result in the divergence of the
waiting time of an actual control plane under normal operating conditions, we can conclude that a model in which retry
traﬃc is generated in proportion to the queue length of thecontrol plane is not realistic.
In general, state transitions of the control-plane systemoccur on a timescale much shorter than humans can perceive. It is natural to assume that the reason that users growimpatient and initiate repeat reattempts to send service requests is not in response to the queue length at the present
time but in response to the average waiting time that occurs
on a longer timescale, a timescale long enough for humans
to perceive. Since the rate of input of retry traﬃc by users
changes very slowly on such a longer timescale, the changeof the mean of system behavior occurs slowly on a timescale
long enough for humans to perceive. Let T be the minimum
timescale perceptible to humans. We assume that the control
plane system is in a steady state on a timescale smaller thanT , and that retry traﬃc aﬀects the system on a timescalelarger than T . In the following, we assume a quasi-static
steady state for the generation of retry traﬃc from the control plane. The key assumptions are as follows:• The system can be assumed to be in a steady state on atimescale shorter than T .
• Changes in the system are observed at discrete times
occurring at an interval of T .
• Retry traﬃc from the system at a certain time, t = k, isdetermined by the steady-state probability of the system at t = k − 1. (More specifically, retry traﬃc fromthe control-plane system is proportional to the averagequeue length at t = k − 1, and that from the data-planesystem is proportional to the loss ratio at t = k − 1.)
3.3 Value of Timescale T
Since this paper deals with retry traﬃc generated as users
respond to an increase in waiting time, we treat the behaviorof the control-plane system occurring on a timescale shorter
than T separately, and consider the system as being in aquasi-static steady state on such a timescale. To do so, it
is necessary to determine the appropriate value of T . The
value of T must satisfy the following requirements:

IEICE TRANS. COMMUN., VOL.E91–B, NO.2 FEBRUARY 2008

440

• T must be within a timescale in which humans can actually perceive an increase in the waiting time for theirrequests to be processed.
• T must be suﬃciently longer than the timescale inwhich state transitions occur in the system so that it
is possible to assume that the system is in a steady state
in a timescale shorter than T .
It is well known that the tolerable waiting time (i.e.,the maximum length of time for which a user’s attention canbe retained) for a webpage to be displayed completely is 8
seconds. To satisfy this so-called 8-second rule, many webpages are so designed that they can be displayed completely
within 8 seconds. Measurement of tolerable waiting time inactual experiments have verified that a user’s interest drifts
away after 10 seconds or so [8]. It is possible that the maximum tolerable waiting time for a user in our case related toretry traﬃc is shorter than in the case of webpage browsing
because our case may involve urgent service requests, suchas attempts to make reservations for popular services. Reference [9] classifies the timescales according to how humans
perceive them as follows:
1. A delay of 0.1 second is perceived as instantaneous access.
2. A delay of 1 second is the limit for the users’ flow ofthought to stay uninterrupted.
3. A delay of 10 seconds is the limit for retaining theusers’ attention/focus on the dialogue.
The last category coincides fairly well with the 8-second
rule for websites in terms of both the timescale and the reason. Since the generation of retry traﬃc seems to correspondto the second category, one second should be a reasonablevalue for T .
4.

Input of Traﬃc (Including Retry Traﬃc) and Stability

The properties of input traﬃc and the system’s stability are
examined here using a quasi-static model of the system, amodel that takes account of retry traﬃc caused by resource
shortages in both the control plane and the data plane in
combination.
Details of the model are as follows. Let λ0 > 0 be
the traﬃc input rate without retry traﬃc. We assume that
λ0 > 0. Changes in the state of the control-plane systemare examined at discrete intervals T . We assume that theretry traﬃc at time t = k is determined by the steady-state
probability of the system at time t = k − 1. We assume
that users whose service requests have not been dealt withby any server of the data-plane system keep sending service
requests until they are finally processed, and that users kept
waiting for their requests to be processed by the controlplane system send service requests at a rate proportional tothe average queue length.
Let λk be the input load, including retry traﬃc, at timek. We assume that the input load at time k + 1 is

λk+1 = λ0 + λk B(ρk , s) + ρk /a,
1 − ρk /a(2)where ρk = λk /μ, 1/μ is the average service time of the dataplane system, a is the ratio of 1/μ to the processing time of
the control-plane server, i.e., the ratio between the relative
processing powers of the two servers (a = η/μ where 1/η
is the average service time of the control-plane system), and is a positive constant indicating the intensity of the retry
traﬃc generated due to a control-plane resource shortage.
B(x, s) is an Erlang B formula, i.e.,xss!

B(x, s) =
1+x+

xs
x2
+ ···+
2!
s!

,

(3)

for x ≥ 0. The structure of Eq. (2) is as follows. The firstterm on the right-hand side is the input rate of original traﬃc(excluding retry traﬃc). The second term corresponds to therate of retries from the data-plane system, and denotes thenumber of losses occurring at M/G/s/s per unit time at timek. The last term corresponds to the rate of retries from thecontrol-plane system. The quantity (ρk /a)/(1 − (ρk /a)) denotes the average number of service requests in the M/M/1
system.
Next, we will consider the stability of the system. We
assume that the requirement for the system to be stable isthat the volume of traﬃc, including retry traﬃc, does notdiverge after a suﬃcient period of elapsed time. Namely,
lim λk < ∞.

(4)

k→∞

This can be verified by defining two functions of λ, f (λ) andg(λ) as follows, and examining whether they intersect.
f (λ) = λ0 + λ B(ρ, s) + 
g(λ) = λ,ρ/a,1 − ρ/a(5)(6)

where ρ = λ/μ. Since λ0 > 0, f (0) > g(0). The relationshipbetween f (λ) and g(λ) in some typical cases is as shown in
Fig. 4. If the input traﬃc at a certain time is λ, the input
traﬃc after one unit time becomes {g−1 ◦ f }(λ), followedby {g−1 ◦ f }2 (λ), etc.. In general, the input traﬃc after anelapse of n units of times becomes {g−1 ◦ f }n (λ). As shownin the left-hand chart in Fig. 4, if f (λ) and g(λ) do not intersect, limn→∞ {g−1 ◦ f }n (λ) = ∞. If, on the other hand, thetwo functions intersect as shown in the middle chart, and if
limλ→∞ f (λ)/g(λ) < 1, then the system is stable. If the twofunctions intersect in the manner shown in the right-handchart of Fig. 4, and if limλ→∞ f (λ)/g(λ) > 1, then the systemis stable for all λ to the left of the right-hand intersection.
If the retry traﬃc from the control-plane system is negligible ( = 0 or a = ∞), f (λ) = λ0 + λ B(ρ, s). Considering that λ0 > 0 and B(ρ, s) < 1, f (λ) and g(λ) intersect at
one point if Eq. (1) is satisfied, and do not intersect at all if
Eq. (1) is not satisfied. If, on the other hand, the retry traffic from the control-plane system is not negligible ( > 0

AIDA et al.: A STUDY OF CONTROL PLANE STABILITY WITH RETRY TRAFFIC

441

Fig. 4

System stability depends on the presence of intersections between f (λ) and g(λ).

Fig. 5

Relationship between f (λ) and g(λ) for diﬀerent number of servers.

and a < ∞), the third term on the right-hand side of Eq. (5)always yields limλ→∞ f (λ)/g(λ) > 1. Therefore, f (λ) andg(λ) may intersect at two points or at one point (a point ofcontact), or may not intersect at all.
Next, let us look at system stability using examples
with specific values. We will consider the case where
λ0 = 15, μ = 1,  = 50, and a = 500. The behavior off (λ) and g(λ) for s = 20, 19, and 18 servers is shown in
Fig. 5. In order to consider the influence of retry traﬃc on
the control plane and the data plane separately, Fig. 5 shows
separately the first and the second terms (original traﬃc andcontribution of the data plane), and the third term (contribution of the control plane) on the right-hand side of Eq. (5), in
addition to the value of f (λ). In these evaluation conditions,
λ0 /μ < s always holds, satisfying Eq. (1). Consequently,
the data-plane system is stable against the presence of retry
traﬃc, i.e. the curve representing the contribution of the data
plane and g(λ) intersect at one point. Therefore, as long as
the influence of the control-plane system is negligible, thesystem is stable even against the influence of retry traﬃcprovided that a suﬃcient number of servers is provided tohandle the demand, λ0 , of the input traﬃc. If, on the other
hand, the contribution of the control plane is not negligible,
the system is stable if the number of servers is 20 but not stable if it is 19 or 18, as can be determined from the presenceor absence of intersections in Fig. 5. Thus, we can conclude
that if the retry traﬃc from the control plane is not negligible, the system may not be stable against retry traﬃc evenwhen the number of servers provided is suﬃcient to satisfy

Fig. 6

Change in λ∗ as λ0 is increased.

Eq. (1) for input traﬃc demand λ0 .
Let λ∗ be the input traﬃc after a suﬃcient time has
elapsed as follows:λ∗ := lim λk .
k→∞

(7)

Let us consider that Fig. 5 shows a case where the number ofservers is reduced from 20 to 19. When s = 20, the systemis stable at λ∗  22. However, when s = 19, the intersection
disappears to make λ∗ = ∞. Thus, the system suddenly becomes unstable. Such a change in stability also occurs whenother parameters, such as λ0 , are gradually increased. Figure 6 shows how the value of λ∗ changes as λ0 is increased,
for the case where s = 20. For comparison, the value of λ∗for the data plane alone is also shown (i.e., the processing

IEICE TRANS. COMMUN., VOL.E91–B, NO.2 FEBRUARY 2008442

the value of the right-hand intersection, the system does
not regain its stability even when an intersection reappears.
Therefore, if the system is to be kept stable in the presenceof retry traﬃc from the control plane, it is important to ensure that the intersection between f (λ) and g(λ) does notdisappear.
From the above discussion we can conclude that ifcontrol-plane resources are not fully usable for one reason or
another, so reducing their availability, the system may suddenly become unstable, and that once this instability occurs,
the system may not regain its stability even after controlplane resources have been fully restored. Therefore, to ensure the stability of the system, it is extremely important tomanage control-plane resources properly.
5.

Design of System Stability

As shown in the previous section, the value of the righthand intersection of the curves f (λ) and g(λ) is importantin ensuring the stability of the system. First, we give anapproximation of the value of the right-hand intersection. If
there are two intersections of f (λ) and g(λ), thenf (λ) = λ0 + λ B(ρ, s) + 

Fig. 7 An intersection is present when retry traﬃc from the control plane
is absent (upper figure), but disappears when it is present (lower figure).

power of the control-plane system is made such that η = ∞).
If we consider the data plane alone, λ∗ increases as λ0 approaches s = 20, and the system is stable within the range
where Eq. (1) is satisfied. On the other hand, if we takethe contribution of the control plane into consideration, theearly warning sign as λ∗ gradually grows and diverges does
not occur, and when the intersection disappears, the systemsuddenly becomes unstable with λ∗ = ∞.
Figure 7 explains why this sudden change occurs. It
shows that in the absence of retry traﬃc from the control
plane, f (λ) and g(λ) intersect at one point at most, and thatwhen the intersection disappears, λ∗ → ∞. In the presenceof retry traﬃc from the control plane, as λ0 is altered from
low to high, f (λ) and g(λ) intersect at two points, and thenat one point, and finally do not intersect at all. When theintersection disappears, any prior signs of the phenomenonof λ∗ → ∞ is not observed.
Conversely, let us consider the case where an intersection between f (λ) and g(λ) reappears after once it disappears. In the absence of retry traﬃc from the control plane,f (λ) and g(λ) intersect at one point. Therefore, even if λincreases while there is no intersection, the system regains
its stability when an intersection reappears. On the other
hand, in the presence of retry traﬃc from the control plane,
the behavior of the system is diﬀerent from the former case.
If λ increases, while there is no intersection, and exceeds

ρ/a=λ
1 − ρ/a(8)

has two solutions. One is λ∗ and let the other be λ̃, which isthe value of the right-hand intersection and λ∗ < λ̃.
The contribution of the data-plane retries in Eq. (5), thesecond term on the right-hand side, increases linearly with
λ for λ 1. Using this property, we have
λ B(ρ, s)  λ − sμ,

(λ

1).

(9)

This approximation means the proportion of input traﬃcwhich exceeds the server capacity, given by (λ − sμ), is all
lost. Then, λ̃ should satisfy
λ0 + λ̃ − sμ + 

λ̃/(aμ) λ̃,1 − λ̃/(aμ)(10)

and we haveλ̃  a μsμ − λ0,sμ − λ0 + (sμ > λ0 ).

(11)

To demonstrate the accuracy of the approximation, we show
numerical examples. Comparisons between the exact value
and the approximation of λ̃ are shown in Figs. 8 and 9, andTables 1 and 2. Figure 8 and Table 1 show an example, comparing the exact and approximate values of λ̃ with respect to
λ0 , and Fig. 9 and Table 2 show a similar comparison forλ̃ with respect to a. These examples illustrate that Eq. (11)gives a good approximation.
Next, we consider a design issue with the condition thatλ̃ ≥ c λ0 , that is,λ̃ = a μsμ − λ0≥ c λ0 ,sμ − λ0 + (12)where c is a positive constant. From this inequality, we have

AIDA et al.: A STUDY OF CONTROL PLANE STABILITY WITH RETRY TRAFFIC

443

Fig. 8

a
5000
5000
5000
5000
5000

a
2000
3000
4000
5000
6000

that takes the retry traﬃc from both data and control planes
into consideration, the system can suddenly become unstable as a result of changes in traﬃc or network resources. A
safeguard that can be taken on the network side to avoid,as far as possible, such a sudden degeneration into instability as far as possible is to manage the control-plane resources properly. This section compares two diﬀerent methods of managing control-plane resources, namely the hardstate and the soft-state methods. It then demonstrates thatthe soft-state method is more robust in withstanding changes
in the network state.
The two methods are described below.

Approximated λ̃ with respect to λ0 .

Fig. 9Approximated λ̃ with respect to a.

Table 1

Approximated λ̃ with respect to λ0 .

s
1000
1000
1000
1000
1000

μ
1
1
1
1
1

λ0
900
800
700
600
500

Table 2

Approximated λ̃ with respect to a.

s
1000
1000
1000
1000
1000

μ
1
1
1
1
1

λ0
700
700
700
700
700


100
100
100
100
100


100
100
100
100
100

Exact λ̃
2491
3331
3749
3999
4165

Exact λ̃
1497
2248
2999
3749
4499

• Hard-state method: In this method, data-plane resources are released at the request of a user. If a resource release request from a user does not arrive due toa problem in the network (e.g., loss of the resource release request packet), the system administrator releases
the resource after a specified time (human recovery). In
our evaluation, we assume that the system administrator releases the resource every 7,200 seconds (2 hours).
• Soft-state method: In this method, a data-plane resource is released automatically after the expiry of atimer. If the user wants to retain the data-plane resource
for a period longer than the timeout period, he or sheneeds to send a refresh message to reset the timer. In
our evaluation, the data-plane resource is automaticallyreleased two seconds after it was seized or after the arrival of the last refresh message (automatic recovery).

Approx. λ̃
2500
3333
3750
4000
4166

In addition to the above, we will also evaluate the following methods:• Ideal type: The operation of this method is the same asthat of the hard-state method except that it is assumed
that release requests from users will always arrive without any problem — an ideal situation, as the name of
the method implies.
• Compound type: The operation of this method is thesame as that of the soft-state method except that a resource can be released by explicit resource release requests from users in addition to timeouts.

Approx. λ̃
1500
2250
3000
3750
4500

two conditions
cλ0 sμ − λ0 + ·, (if sμ > λ0 ),a≥μsμ − λ0
λ0 aμ − cλ0 + c·
, (if aμ > cλ0 ).
s≥
μaμ − cλ0

(13)
(14)

Inequality (13) is a condition for the design of the controlplane system and sμ > λ0 is the stability condition for thedata-plane system. Similarly, inequality (14) is a condition
for the design of the data-plane system and aμ > cλ0 is thestability condition for the control-plane system.
6.

Comparison of Soft-State and Hard-State Methods
for Managing Control-Plane Resources

As we have confirmed in the previous sections, in a model

We derive the concrete expression of f (λ) for eachmethod. Let p be the probability of loss of resource release
request packets. f x (λ) represents f (λ) for each method x,that is, fh (λ), fs (λ), fi (λ), and fc (λ) represent f (λ) for the
hard-state, soft-state, ideal, and compound methods, respectively. Since all the methods are ways of managing dataplane resources, the diﬀerences between the various functions f x (λ) with respect to method x, relate only to the holding time of the data-plane resources, and we havef x (λ) = λ0 + λ B(ρ x , s) + 

ρ/a,
1 − ρ/a(15)

where ρ x denotes ρ for a method x (x ∈ {h, s, i, c}).
For the hard-state method, if a resource release request
is lost, the system administrator releases the resource at theIEICE TRANS. COMMUN., VOL.E91–B, NO.2 FEBRUARY 2008

444

Fig. 10 Comparison of system stability for diﬀerent data-plane resource management methods (softstate method, hard-state method and ideal/compound methods).

next instance of the periodic manual (human) recovery operation. If the interval of the manual recovery operations isd, the average waiting time until the next manual recovery
is d/2. So, the average holding time (1/μh ) of data-plane resources increases by d/2 if a resource release request is lost.
That is,


1
1 d
1
= (1 − p) + p
+
,
μh
μ
μ 2
and we obtain fh (λ) by using ρh = λ/μh and Eq. (15).
For the soft-state method, data-plane resources are always released by timeout. If the interval of automatic recovery operations by timeout is τ, the average waiting time until
the next automatic recovery is τ/2. So, the average holding
time (1/μs ) of data-plane resources is always increased by
τ/2. That is,
1 τ
1
= + ,
μs μ 2and we obtain fs (λ) by using ρs = λ/μs and Eq. (15).
For the ideal type, since the probability of loss of resource release request is p = 0, we have
1
1
= ,
μi μ
and we obtain fi (λ) = f (λ) and ρi = ρ. Similarly, for thecompound type, we have


1 τ
1
1
+
= (1 − p) + p
,
μc
μ
μ 2
and we obtain fc (λ) by using ρc = λ/μc .
Figure 10 shows the calculated results for f (λ) andg(λ) for cases where the number of servers is 1000 (i.e.,s = 1000). We assumed that λ0 = 700, μ = 1,  = 1, anda = 5000. In this specific example, the average connection
holding time was 10 s, and the average time it took to set up
a connection was 2 ms. The three charts in Fig. 10 are forthree values (0.003%, 0.01%, and 0.03%) of the probabilityof failing to release the data-plane resource as a result of resource release requests not being delivered correctly. Since

the results for the ideal type and the compound type coincide almost completely, the figure shows only the result for
the ideal type.
The hard-state method keeps the system stable when
the probability of failing to release the data-plane resource islow, but leaves the system less stable when the probability ishigher, so the system stability is sensitive to changes in thisprobability. On the other hand, with the soft-state method
and the ideal type, the system is stable and not sensitive tochanges in the release failure probability. Therefore, we canconclude that it is advisable for resources to be managed using the soft-state method in order to avoid the occurrence of
undesirable situations where the system becomes unstable
due to a shortage in eﬀective data-plane resources resulting
from failure to release resources.
We also find that, by adding an explicit resourcereleasing process to the mechanism of the soft-state method,
it is possible to achieve a high stability, comparable to thatof the ideal type irrespective of the network state.
7.

Conclusions

This paper has considered congestion caused by overloads
not only in the data plane but also in the control plane. In
particular, we have evaluated methods of managing dataplane resources in order to avoid congestion caused byretry traﬃc resulting from a shortage of both data-plane andcontrol-plane resources.
In order to describe retry traﬃc resulting from a shortage of both data-plane and control-plane resources, we havedeveloped a model that combines the M/M/1 and M/G/s/s
models. We have examined the stability of the system bychecking whether retry traﬃc diverges. In order to describe
users’ tendency to generate retry traﬃc when their waiting time increases due to control-plane system issues, wehave adopted a quasi-static traﬃc model in which the system
state is considered to be steady below a certain appropriate
timescale, and begins to change gradually on a timescale
perceptible to humans.
Examination using the above approach has revealed
that when retry traﬃc resulting from a shortage of control-

AIDA et al.: A STUDY OF CONTROL PLANE STABILITY WITH RETRY TRAFFIC

445

plane resources is considered, the system state can change
more abruptly than when only retry traﬃc resulting from ashortage in data-plane resources is considered. In fact, thesystem can suddenly become unstable if the system conditions change only slightly, without any prior signs of warning, such as an increase in retry traﬃc.
To avoid having the system become unstable in thismanner, it is important to manage data-plane resources appropriately. We have examined how two diﬀerent methodsof data-plane resource management, the hard-state method
and the soft-state method, aﬀect system stability. It has beenshown that use of the soft-state method makes the systemstable and robust against changes in the network state.
Since our primary goal so far has been to examine thebasic characteristics of retry traﬃc, we have evaluated models using a relatively small number of servers. We plan
to continue the evaluation with a more realistic number ofservers and with the detailed specification of parameters andother conditions. We will also study system design methods
that will strike a good balance between the data-plane andthe control-plane systems.

Masaki Aida
received his B.S. and M.S.
in Theoretical Physics from St. Paul’s University, Tokyo, Japan, in 1987 and 1989, respectively, and received the Ph.D. in Telecommunications Engineering from the University ofTokyo, Japan, in 1999. In April 1989, he joined
NTT Laboratories. From April 2005 to March
2007, he was an Associate Professor at the Faculty of System Design, Tokyo Metropolitan University. He has been a Professor of the Graduate
School of System Design, Tokyo Metropolitan
University since April 2007. His current interests include traﬃc issues incomputer communication networks. He received the Young Researchers’Award of the IEICE in 1996. He is a member of the IEEE and the Operations Research Society of Japan.

Chisa Takano
received the B.E. degree in Telecommunication Engineering from
Osaka University, Japan, in 2000. In 2000 she
joined the Traﬃc Research Center, NTT Advanced Technology Corporation (NTT-AT). She
has been engaged in research and developmentof computer networks. She received the IEICE’s
Young Researchers’ Award in 2003.

Acknowledgements
A part of this research was made possible by the Grant-inAid for Scientific Research (A) No. 16200003 (2004–2007)
from the Japan Society for the Promotion of Science.
References[1] P. Ji, Z. Ge, J. Kurose, and D. Towsley, “A comparison of hard-stateand soft-state signaling protocols,” IEEE/ACM Trans. Netw., vol.15,
pp.281–294, April 2007.
[2] J.C.S. Lui, V. Misra, and D. Rubenstein, “On the robustness of soft
state protocols,” ICNP 2004, pp.50–60, 2004.
[3] T. Yamada, T. Tada, and M. Imase, “Evaluation of the robustness ofsoft-state for data management in a distributed environment,” IEICE
Technical Report, IN2005-111, pp.7–12, 2005.
[4] G.I. Falin and J.G.C. Templeton, Retrial Queues, Chapman & Hall,
London, 1997.
[5] H. Alshaer and E. Horlait, “The joint distribution of server state andqueue length of M/M/1/1 retrial queue with abandonment and feedback,” 8th International Symposium on DSP and Communication System, Australia, Oct. 2005.
[6] W. Shang, L. Liu, and Q.-L. Li, “Tail asymptotics for the queue length
in an M/G/1 retrial queue,” Queueing Systems, vol.52, pp.193–198,
2006.
[7] R.-H. Hwang, C.-Yi, J.F. Kurose, and D. Towsley, “On-call processing
delay in high speed networks,” IEEE/ACM Trans. Netw., vol.3, no.6,
pp.628–639, Dec. 1995.
[8] F.F.-H. Nah, “A study on tolerable waiting time: How long are Web
users willing to wait?,” Behaviour & Information Technology, vol.23,
no.3, pp.153–163, May 2004.
[9] J. Nielsen, “Response times: The three important limits,” Excerpt
from Chapter 5 of Usability Engineering by J. Nielsen, Academic
Press, 1993. Available at http://www.useit.com/papers/responsetime.
html

Masayuki Murata
received the M.E. and
D.E. degrees in Information and Computer Sciences from Osaka University, Japan, in 1984 and1988, respectively. In April 1984, he joined
IBM Japan’s Tokyo Research Laboratory, asa Researcher. From September 1987 to January 1989, he was an Assistant Professor with
the Computation Center, Osaka University. In
February 1989, he moved to the Department ofInformation and Computer Sciences, Faculty ofEngineering Science, Osaka University. In April
1999, he became a Professor of Osaka University, and since April 2004, hehas been with the Graduate School of Information Science and Technology, Osaka University. He has contributed more than four hundred andfifty papers to international and domestic journals and conferences. His
research interests include computer communication networks and performance modeling and evaluation. He is a member of the IEEE, ACM, theInternet Society, and IPSJ.

Makoto Imasereceived his B.E. and M.E.
degrees in Information Engineering from Osaka
University in 1975 and 1977, respectively. He
received his D.E. degree from Osaka University in 1986. From 1977 to 2001, he worked
for Nippon Telegraph and Telephone Corporation (NTT). Since 2002 he has been a Professor of the Graduate School of Information Science and Technology at Osaka University. His
research interests are in the area of information
networks, distributed systems and graph theory.
He is a member of IPSJ and JSIAM.