Analyzing Adaptation Strategies

1. Analyzing Adaptation Strategies Bradley Schmerl Carnegie Mellon University

2. Joint work with • David Garlan • Shang-Wen Cheng (NASA JPL) • Jung Soo Kim (Graduate student)

3. Challenges • Engineer self-adaptation to support • Cost-effectiveness • Legacy systems • Domain-specific adaptations • Multiple quality dimensions • Ease of changing adaptation policies • Reasoning about the effects of adaptation actions

4. Target System The Rainbow Framework Architecture Layer Adaptation Manager Model Manager Translation Infrastructure System Layer

5. Target System Rainbow Framework Overview Architecture Layer Adaptation Manager Strategy Executor Architecture Evaluator Model Manager Gauges Translation Infrastructure SystemLayer System API Effectors Resource Discovery Probes

6. Target System Rainbow Framework Overview Architecture Layer Decides on the best adaptation Adaptation Manager Strategy Executor Architecture Evaluator Carries out that adaptation Model Manager Detects problem in system Bridges abstraction (aggregate info up, map action down) Manages arch & env’t model Gauges Translation Infrastructure SystemLayer Relates system info to model Customization points System API Effectors Resource Discovery Probes Extracts system information Changes state in target system

7. Applications • Sample N-tiered web-based news system • ZNN.com • Balancing response time, content quality, provisioning cost • Service coalition • Talkshoe video conferencing system • Ensuring availability of episode recordings

8. Stitch: A Language for Specifying Self-Adaptation Strategies • Control-system model:Selection of next action in a strategy depends on observed effects of previous action • Value system: Utility-based selection of best strategy allows context-sensitive adaptation • Asynchrony: Explicit timing delays capture “settling time” • Uncertainty:Effectiveness of a given tactic is known only within some probability

9. Stitch Language Overview • Language requirements • Concepts: concepts to formalize operational aspects of self-adaptation • Value system: way to specify value system for comparing adaptations • Choice: apply value system to select best course of adaptation • Concepts to express adaptation knowledge • Operator – basic system-provided command • Tactic – action with impact on quality dimensions • Strategy – adaptation with intermediate steps of condition-action-delay • A way to specify value system • Quality dimensions – business QoS concerns • Utility preferences – business priorities over dimensions • Adaptation conditions – opportunities for improvement • Choice of best adaptation • Strategy selection – best adaptation for current system conditions

10. Strategy Analysis • Utility-based analysis of Stitch strategies is useful • Takes an abstract view of the effects of actions based on utility • Minimal specification effort because detailed semantics of the system not necessary • Attempts to match “thought process” of system administrators • However, we cannot provide precise guarantees • Does a given strategy leave the system in an inconsistent state? • What are necessary quiescence conditions for an adaptation to be safely performed? • Can we guarantee that a given set of strategies will always fix a given problem?

11. Current Research • Specify an architectural style formally • A set of component, connector, port, and role types • Relevant properties of these element types • Abstract behavior of each type of component and connector – as state machines • A set of initial architectures • Specify a set of operators that can modify the structure of an architecture in that style • Similar to Stitch operators and tactics with preconditions guarding when they can be invoked • Specify a set of desirable properties in LTL • Example: If a component breaks, then eventually it will be replaced by a correctly functioning component. • Example: No message is ever lost as a result of a self-adaptation operation.

12. Current Research (continued) • Use model checkers to determine whether the LTL properties are satisfied by all systems in that style, given the adaptation operations. • A two step process • Step 1: Generate a state machine of possible system snapshots • Step 2: Check the LTL properties against this state machine

13. Generate the state machine • States are architectural snapshots of the system, including values of element properties • Initial states are the initial architectures allowed by the style • Transitions are (a) state transitions in steady-state operation, or (b) repair operations • Each snapshot is annotated with Booleans that represent the satisfaction of relevant properties • We use the AlloyAnalyzer to do this for bounded models • Check the properties • State machine annotated with only the boolean properties is checked using an LTL model checker • We use Spin to do this

14. Implementation Transitions (from operations or behavior) • Architectural style • Element types • - Structure • - Behavior • - Constraints • - Operations Translator Initial State Generator (AlloyAnalyzer) Alloy model for the style Alloy instances of the style LTL Check (Spin) State Machine Generator (AlloyAnalyzer) Result Promela model for the style Properties to check

15. Google File System Example

16. Today’s systems must adapt to meet changing environments, failures, requirements Architecture models and an adaptation language can be combined to self-adapt systems Rainbow integrates architecture model and a language for self-adaptation provides software engineers the ability to add and evolve self-adaptation capabilities Formal extensions support model checking soundness of adaptations Applying to Google File System Conclusion & Ongoing Work