An introduction to self-adaptive systems: a contemporary software engineering perspective danny weyn by Education Libraries

https://ebookmass.com/product/an-introduction-to-selfadaptive-systems-a-contemporary-software-engineeringperspective-danny-weyns/

Instant digital products (PDF, ePub, MOBI) ready for you

Download now and discover formats that fit your needs...

Engineering Software Products: An Introduction to Modern Software Engineering Ian Sommerville

https://ebookmass.com/product/engineering-software-products-anintroduction-to-modern-software-engineering-ian-sommerville/

ebookmass.com

Engineering Fundamentals: An Introduction to Engineering, SI Edition Saeed Moaveni

https://ebookmass.com/product/engineering-fundamentals-anintroduction-to-engineering-si-edition-saeed-moaveni/

ebookmass.com

Engineering Fundamentals: An Introduction to Engineering, 6th Edition Moaveni Saeed

https://ebookmass.com/product/engineering-fundamentals-anintroduction-to-engineering-6th-edition-moaveni-saeed/

ebookmass.com

(eTextbook PDF) for Business Analytics 3rd Edition by

James R. Evans

https://ebookmass.com/product/etextbook-pdf-for-businessanalytics-3rd-edition-by-james-r-evans/

ebookmass.com

The Companion and the Earl Rose Pearson

https://ebookmass.com/product/the-companion-and-the-earl-rose-pearson/

ebookmass.com

Theory and Design for Mechanical Measurements, 6th Edition 6th Edition, (Ebook PDF)

https://ebookmass.com/product/theory-and-design-for-mechanicalmeasurements-6th-edition-6th-edition-ebook-pdf/

ebookmass.com

Instructor Manual for Corrections: The Essentials 2nd Second Edition, Mary K. Stohr, Anthony Walsh

https://ebookmass.com/product/instructor-manual-for-corrections-theessentials-2nd-second-edition-mary-k-stohr-anthony-walsh/

ebookmass.com

Extra Witchy Ann Aguirre

https://ebookmass.com/product/extra-witchy-ann-aguirre-3/

ebookmass.com

Counseling and psychotherapy : theories and interventions 7th Edition David Capuzzi

https://ebookmass.com/product/counseling-and-psychotherapy-theoriesand-interventions-7th-edition-david-capuzzi/

ebookmass.com

https://ebookmass.com/product/czech-mate-1st-edition-paulin/

ebookmass.com

AnIntroductiontoSelf-AdaptiveSystems

AContemporarySoftwareEngineeringPerspective

DannyWeyns

KatholiekeUniversiteitLeuven,Belgium

Allrightsreserved.Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,or transmitted,inanyformorbyanymeans,electronic,mechanical,photocopying,recordingorotherwise, exceptaspermittedbylaw.Adviceonhowtoobtainpermissiontoreusematerialfromthistitleisavailable athttp://www.wiley.com/go/permissions.

TherightofDannyWeynstobeidentifiedastheauthorofthisworkhasbeenassertedinaccordance withlaw.

RegisteredOffices

JohnWiley&Sons,Inc.,111RiverStreet,Hoboken,NJ07030,USA

JohnWiley&SonsLtd,TheAtrium,SouthernGate,Chichester,WestSussex,PO198SQ,UK

EditorialOffice

TheAtrium,SouthernGate,Chichester,WestSussex,PO198SQ,UK

Fordetailsofourglobaleditorialoffices,customerservices,andmoreinformationaboutWileyproducts visitusatwww.wiley.com.

Wileyalsopublishesitsbooksinavarietyofelectronicformatsandbyprint-on-demand.Somecontentthat appearsinstandardprintversionsofthisbookmaynotbeavailableinotherformats.

LimitofLiability/DisclaimerofWarranty

Whilethepublisherandauthorshaveusedtheirbesteffortsinpreparingthiswork,theymakeno representationsorwarrantieswithrespecttotheaccuracyorcompletenessofthecontentsofthisworkand specificallydisclaimallwarranties,includingwithoutlimitationanyimpliedwarrantiesofmerchantability orfitnessforaparticularpurpose.Nowarrantymaybecreatedorextendedbysalesrepresentatives,written salesmaterialsorpromotionalstatementsforthiswork.Thefactthatanorganization,website,orproduct isreferredtointhisworkasacitationand/orpotentialsourceoffurtherinformationdoesnotmeanthat thepublisherandauthorsendorsetheinformationorservicestheorganization,website,orproductmay provideorrecommendationsitmaymake.Thisworkissoldwiththeunderstandingthatthepublisheris notengagedinrenderingprofessionalservices.Theadviceandstrategiescontainedhereinmaynotbe suitableforyoursituation.Youshouldconsultwithaspecialistwhereappropriate.Further,readersshould beawarethatwebsiteslistedinthisworkmayhavechangedordisappearedbetweenwhenthisworkwas writtenandwhenitisread.Neitherthepublishernorauthorsshallbeliableforanylossofprofitorany othercommercialdamages,includingbutnotlimitedtospecial,incidental,consequential,orother damages.

LibraryofCongressCataloging-in-PublicationDataappliedfor ,

HardbackISBN:9781119574941

CoverDesign:Wiley

CoverImage:©Takeshi.K/GettyImages

Setin9.5/12.5ptSTIXTwoTextbySPiGlobal,Chennai,India

PrintedandboundbyCPIGroup(UK)Ltd,Croydon,CR04YY 10987654321

ToFrankie

Contents

Foreword xi

Acknowledgments xv

Acronyms xvii

Introduction xix

1BasicPrinciplesofSelf-AdaptationandConceptualModel 1

1.1PrinciplesofSelf-Adaptation 2

1.2OtherAdaptationApproaches 4

1.3ScopeofSelf-Adaptation 5

1.4ConceptualModelofaSelf-AdaptiveSystem 5

1.4.1Environment 5

1.4.2ManagedSystem 7

1.4.3AdaptationGoals 8

1.4.4FeedbackLoop 8

1.4.5ConceptualModelApplied 10

1.5ANoteonModelAbstractions 11

1.6Summary 11

1.7Exercises 12

1.8BibliographicNotes 14

2EngineeringSelf-AdaptiveSystems:AShortTourinSevenWaves 17

2.1OverviewoftheWaves 18

2.2ContributionsEnabledbytheWaves 20

2.3WavesOverTimewithSelectedWork 20

2.4Summary 22

2.5BibliographicNotes 23

3Internet-of-ThingsApplication 25

3.1TechnicalDescription 25

3.2Uncertainties 28

3.3QualityRequirementsandAdaptationProblem 29

3.4Summary 29

3.5Exercises 30

3.6BibliographicNotes 31

4WaveI:AutomatingTasks 33

4.1AutonomicComputing 34

4.2UtilityFunctions 35

4.3EssentialMaintenanceTasksforAutomation 37

4.3.1Self-Optimization 37

4.3.2Self-Healing 38

4.3.3Self-Protection 40

4.3.4Self-Configuration 42

4.4PrimaryFunctionsofSelf-Adaptation 43

4.4.1Knowledge 44

4.4.2Monitor 46

4.4.3Analyzer 47

4.4.4Planner 49

4.4.5Executor 51

4.5SoftwareEvolutionandSelf-Adaptation 52

4.5.1SoftwareEvolutionManagement 53

4.5.2Self-AdaptationManagement 54

4.5.3IntegratingSoftwareEvolutionandSelf-Adaptation 55

4.6Summary 56

4.7Exercises 59

4.8BibliographicNotes 60

5WaveII:Architecture-basedAdaptation 63

5.1RationaleforanArchitecturalPerspective 64

5.2Three-LayerModelforSelf-AdaptiveSystems 66

5.2.1ComponentControl 67

5.2.2ChangeManagement 67

5.2.3GoalManagement 68

5.2.4Three-LayerModelAppliedtoDeltaIoT 68

5.2.5MappingBetweentheThree-LayerModelandtheConceptualModelfor Self-Adaptation 70

5.3ReasoningaboutAdaptationusinganArchitecturalModel 70

5.3.1RuntimeArchitectureofArchitecture-basedAdaptation 71

5.3.2Architecture-basedAdaptationoftheWeb-basedClient-ServerSystem 73

5.4ComprehensiveReferenceModelforSelf-Adaptation 75

5.4.1ReflectionPerspectiveonSelf-Adaptation 76

5.4.2MAPE-KPerspectiveonSelf-Adaptation 78

5.4.3DistributionPerspectiveonSelf-Adaptation 79

5.5Summary 83

5.6Exercises 84

5.7BibliographicNotes 87

6WaveIII:RuntimeModels 89

6.1WhatisaRuntimeModel? 90

6.2CausalityandWeakCausality 90

6.3MotivationsforRuntimeModels 91

6.4DimensionsofRuntimeModels 92

6.4.1StructuralversusBehavioral 93

6.4.2DeclarativeversusProcedural 94

6.4.3FunctionalversusQualitative 95

6.4.3.1FunctionalModels 95

6.4.3.2QualityModels 95

6.4.4FormalversusInformal 98

6.5PrincipalStrategiesforUsingRuntimeModels 101

6.5.1MAPEComponentsShareKModels 101

6.5.2MAPEComponentsExchangeKModels 103

6.5.2.1RuntimeModels 103

6.5.2.2ComponentsoftheManagingSystem 104

6.5.3MAPEModelsShareKModels 105

6.6Summary 108

6.7Exercises 109

6.8BibliographicNotes 114

7WaveIV:Requirements-drivenAdaptation 115

7.1RelaxingRequirementsforSelf-Adaptation 116

7.1.1SpecificationLanguagetoRelaxRequirements 116

7.1.1.1LanguageOperatorsforHandlingUncertainty 116

7.1.1.2SemanticsofLanguagePrimitives 118

7.1.2OperationalizationofRelaxedRequirements 118

7.1.2.1HandingUncertainty 118

7.1.2.2RequirementsReflectionandMitigationMechanisms 119

7.1.2.3ANoteontheRealizationofRequirementsReflection 121

7.2Meta-RequirementsforSelf-Adaptation 122

7.2.1AwarenessRequirements 123

7.2.2EvolutionRequirements 124

7.2.3OperationalizationofMeta-requirements 126

7.3FunctionalRequirementsofFeedbackLoops 127

7.3.1DesignandVerifyFeedbackLoopModel 128

7.3.2DeployandExecuteVerifiedFeedbackLoopModel 130

7.4Summary 131

7.5Exercises 132

7.6BibliographicNotes 134

8WaveV:GuaranteesUnderUncertainties 137

8.1UncertaintiesinSelf-AdaptiveSystems 139

8.2TamingUncertaintywithFormalTechniques 141

8.2.1AnalysisofAdaptationOptions 141

8.2.2SelectionofBestAdaptationOption 143

8.3ExhaustiveVerificationtoProvideGuaranteesforAdaptationGoals 144

8.4StatisticalVerificationtoProvideGuaranteesforAdaptationGoals 149

8.5ProactiveDecision-MakingusingProbabilisticModelChecking 154

8.6ANoteonVerificationandValidation 160

8.7IntegratedProcesstoTameUncertainty 160

8.7.1StageI:ImplementandVerifytheManagingSystem 161

8.7.2StageII:DeploytheManagingSystem 162

8.7.3StageIII:VerifyAdaptationOptions,Decide,andAdapt 163

8.7.4StageIV:EvolveAdaptationGoalsandManagingSystem 163

8.8Summary 164

8.9Exercises 165

8.10BibliographicNotes 168

9WaveVI:Control-basedSoftwareAdaptation 171

9.1ABriefIntroductiontoControlTheory 173

9.1.1ControllerDesign 174

9.1.2ControlProperties 175

9.1.3SISOandMIMOControlSystems 176

9.1.4AdaptiveControl 177

9.2AutomaticConstructionofSISOControllers 177

9.2.1PhasesofControllerConstructionandOperation 178

9.2.2ModelUpdates 179

9.2.3FormalGuarantees 181

9.2.4Example:Geo-LocalizationService 183

9.3AutomaticConstructionofMIMOControllers 184

9.3.1PhasesofControllerConstructionandOperation 184

9.3.2FormalGuarantees 186

9.3.3Example:UnmannedUnderwaterVehicle 186

9.4ModelPredictiveControl 189

9.4.1ControllerConstructionandOperation 189

9.4.2FormalAssessment 191

9.4.3Example:VideoCompression 192

9.5ANoteonControlGuarantees 194

9.6Summary 194

9.7Exercises 196

9.8BibliographicNotes 199

10WaveVII:LearningfromExperience 201

10.1KeepingRuntimeModelsUp-to-DateUsingLearning 203

10.1.1RuntimeQualityModel 204

10.1.2OverviewofBayesianApproach 205

10.2ReducingLargeAdaptationSpacesUsingLearning 208

10.2.1IllustrationoftheProblem 208

10.2.2OverviewoftheLearningApproach 210

10.3LearningandImprovingScalingRulesofaCloudInfrastructure 213

10.3.1OverviewoftheFuzzyLearningApproach 214

10.3.1.1FuzzyLogicController 214

10.3.1.2FuzzyQ-learning 217

10.3.1.3Experiments 221

10.4Summary 223

10.5Exercises 225

10.6BibliographicNotes 226

11MaturityoftheFieldandOpenChallenges 227

11.1AnalysisoftheMaturityoftheField 227

11.1.1BasicResearch 227

11.1.2ConceptFormulation 228

11.1.3DevelopmentandExtension 229

11.1.4InternalEnhancementandExploration 229

11.1.5ExternalEnhancementandExploration 230

11.1.6Popularization 230

11.1.7Conclusion 231

11.2OpenChallenges 231

11.2.1ChallengesWithintheCurrentWaves 231

11.2.1.1EvidencefortheValueofSelf-Adaptation 231

11.2.1.2DecentralizedSettings 232

11.2.1.3Domain-SpecificModelingLanguages 232

11.2.1.4ChangingGoalsatRuntime 233

11.2.1.5ComplexTypesofUncertainties 233

11.2.1.6ControlPropertiesversusQualityProperties 234

11.2.1.7Search-basedTechniques 234

11.2.2ChallengesBeyondtheCurrentWaves 235

11.2.2.1ExploitingArtificialIntelligence 235

11.2.2.2DealingwithUnanticipatedChange 236

11.2.2.3TrustandHumansintheLoop 236

11.2.2.4EthicsforSelf-AdaptiveSystems 237

11.3Epilogue 239

Bibliography 241 Index 263

Foreword

Fromtheearliestdaysofcomputing,theoristsrecognizedthatoneofthemoststriking aspectsofcomputationisitspotentialabilitytochangeitself:ratherthanpresentingusers withafixedsetofcomputationsdeterminedatdeployment,thesystemcouldatruntime modifybothwhatitcomputesandhowitcomputesit.However,while“self-modification” wasperhapsinterestingfromatheoreticalpointofview,fewprogrammingsystemsand engineeringmethodsembracedthiscapability–theadvantagesofdoingsowerenotobviousgiventheadditionalcomplexityofreasoningaboutsystembehaviorandthepotential forinadvertentlymakingareallybigmessofthings.

Overthepastdecade,however,self-adaptivesystemshaveemergedasafundamental elementofmodernsoftwaresystems.Virtuallyallenterprisesystemshavebuilt-inadaptive mechanismstohandlefaults,resourcemanagement,andattacks.Increasinglysystemsare takingovertasksotherwiseperformedbyhumansintransportation(automateddriving), medicine(assisteddiagnosis),environmentalcontrol(smartbuildings),andmanyothers.

Inthebroadfieldofsoftwareengineeringthesechangeshavebeenmirroredinanumber ofseismicshifts.Thefirsthasbeenashiftinfocusfromdevelopmenttimetoruntime.For mostofitshistory,softwareengineeringprimarilyfocusedongettingthings“right”before asystemwasdeployed.Whenproblemswereencountered,systemsweretakenoff-lineand fixedbeforeredeployment.Thismadesensebecausefewsystemsrequirednon-stopavailabilityandhencetheycouldbetakendownfor“scheduledmaintenance.”Buttodayalmost allpublicfacingsystemsmustbecontinuouslyavailable,requiringthatsystemsbemodifiable(eitherautomaticallyorbydevelopers)whiletheycontinuetooperate.

Asecondshifthasbeentheincreasinglevelofuncertaintythataccompaniesmodern systems.Inthepast,softwarewastypicallydevelopedforaknownenvironmentusingcomponentsthatwerelargelyunderthecontrolofthedevelopers.Todaysystemsworkinmuch moreuncertaincontexts:loadscanchangedramatically;resources(suchasnetworkbandwidth)canvarysubstantiallyformobilecomputing;faultscanarisefrominteractionwith othersystemsandresourcesoutsidethecontrolofthedeveloper;andattackscanemerge inunexpectedways.

Athirdshifthasbeenaninterestinautomationtoreducethecostofoperations.Inthe 1980sitwasrecognizedthatwhilethecostofacquiringordevelopingincreasinglycomplex

computingsystemswassteadilydeclining,theoverallcostofownershipwasrising.The reasonforthiswastheneedforsystemadministration,whichwastakingupalargerand largerfractionoftheIToperationalbudget.Byautomatingmanyoftheroutinefunctions performedbyadministrators,systemswouldbecomemoreaffordable.Moreover,arguably, fortoday’scomplexsoftwaresystems,completehumanoversightandcontrolissimplynot possible.

AfourthshifthasbeenthecommoditizationofAI.Whereasformuchofitsexistence AIhadlargelybeenrelegatedtospecialniches(e.g.,robotics),theincreasingavailabilityof planners,machinelearning,geneticalgorithms,andgame-theoreticdecisionsystemshas madeitpossibletoharnesssophisticatedreasoningandlearningmechanismsinsupportof automation.

Alloftheseshiftshaveledtoasetofcriticalchallengesforsoftwareengineers.What arethefundamentalunifyingprinciplesthatunderlieself-adaptivesystems?Howshould onegoaboutengineeringtheminawaythatallowsustoassurethesystemmatchesits requirementsevenasthoserequirementschangeafterdeployment?Howcanweprovide safeguardsagainstadaptation-gone-awry?Howdoweengendertrustinsystemswhere humanoversighthasbeendelegatedtothemachine?Howdowedecomposetheengineeringeffortofself-adaptivesystemsintomanageablesubtasks?Howcanwereuseelements ofoneadaptivesystemwhenconstructinganother?

Thesoftwareengineeringdisciplineofself-adaptivesystemsattemptstoanswerthese questions.Itseekstoprovidetheprinciples,practices,andtoolsthatwillallowengineers toharnessthevastpotentialofadaptationforengineeringtoday’ssystems.

Indoingthis,thefieldofself-adaptivesystemshasmuchtodrawonfromotherdisciplines:fromcontroltheory,techniquesformaintainingasystem’senvelopeofbehavior withindesiredranges;frombiologyandecology,theabilityoforganismsandpopulationsto respondtoenvironmentalchanges;fromimmunology,organicmechanismsofself-healing; fromsoftwarearchitecture,patternsofstructuringsystemstoenablepredictableconstructionofadaptivesystems;fromfaulttolerance,techniquesfordetectingandrespondingto faults;fromAI,mechanismsthatsupportautonomy.Andmanyothers.

Allofthiscanleadtoaratherconfusinglandscapeofconceptsandtechniques,makingitdifficultforasoftwareengineertoapplywhatweknowaboutself-adaptationtothe buildingofsoftwaresystems.ThisbookbyDannyWeynsprovidesexactlytherightintroductionforsoftwareengineerstonavigatethisfascinating,complex,andevolvingarea.It bothidentifiessomefoundationalprinciplesofthediscipline,aswellascoveringthebroad terrainofthefield.Throughits“waves”approach,itnicelyhighlightsthestructureofthe fieldandtheinfluencesandperspectivesfromotherdisciplines,withoutlosingthefundamentalfocusonsoftwareengineeringandapplications.Additionally,thewaveshelpto highlighttheimportantresearchareasthathavecontributedsynergisticallytoourcurrent understandingofthefieldandthatpositionusforfurtheradvancement.

Takenasawhole,thisbookprovidesthefirstcomprehensivetreatmentofself-adaptive systemstargetedatsoftwareengineeringstudents,practitioners,andresearchers,andprovidesessentialreadingforeachofthese.Forsomeonewhoisapproachingthisfieldforthe

firsttimeitwillprovideabroadviewofwhatisnowknownandpracticed.Fortheexperiencedprofessional,itwillprovideconcreteexamplesandtechniquesthatcanbeputinto practice.Fortheresearcher,itwillprovideastructuredviewoftheimportantpriorwork andoftheopenchallengesfacingthefield.

February2020

DavidGarlan Professor,SchoolofComputerScience CarnegieMellonUniversity

Acknowledgments

Thisbookhasbeendevelopedintwostagesoverthepastthreeyears.Thefollowing colleaguesprovidedmewithparticularlyusefulfeedbackthathelpedmetoimprove preliminaryversionsofthisbook:CarloGhezzi(PolitecnicodiMilano),JeffKramer (ImperialCollageLondon),BradleySchmerl(CarnegieMellonUniversityPittsburg), ThomasVogel(HumboldtUniversityBerlin),GabrielA.Moreno(CarnegieMellonUniversity),MartinaMaggio(LundUniversity),AntonioFilieri(ImperialCollageLondon), MarinLitoiu(YorkUniversity),VitorE.SilvaSouza(FederalUniversityofEspíritoSanto), RaduCalinescu(UniversityofYork),JeffKephart(IBMT.J.WatsonResearchCenter), BettyH.C.Cheng(MichiganStateUniversity),NellyBencomo(AstonUniversity),Javier CamaraMoreno(UniversityofYork),JohnMylopoulos(UniversityofToronto),Sebastian Uchitel(UniversityofBuenosAires),PooyanJamshidiDermani(UniversityofSouth Carolina),SimosGerasimou(UniversityofYork),KenjiTei(WasedaUniversity),Dimitri VanLanduyt(KatholiekeUniversiteitLeuven),Panagiotis(Panos)Patros(University ofWaikato),RaffaelaMirandola(PolytechnicUniversityofMilan),andPaolaInverardi (UniversityofL’Aquila).Thesepeoplehavesuggestedimprovementsandpointedout mistakes.Ithankeveryoneforprovidingmewithveryhelpfulcomments.

Ithankthemembersoftheimec-Distrinetresearchgroupfortheirsupport.Iam particularlythankfultomycolleagueDannyHughes,hisformerstudentGowriSankar Ramachandran,andthemembersoftheNetworktaskforceforsharingtheirexpertise ontheInternet-of-Things.Iwanttoexpressmysincereappreciationtomycolleaguesat LinnaeusUniversity,inparticularJesperAndersson,fortheircontinuoussupport.

IthankM.UsmanIftikhar,StepanShevtsov,FedericoQuin,OmidGheibi,SaraMahdavi Hezavehi,AngelikaMusil,JuergenMusil,NadeemAbbas,andtheotherstudentsIworked withatKULeuvenandLinnaeusUniversityfortheirinspirationandcollaboration.

IexpressmysincereappreciationtothemonksoftheabbeysofWest-Vleteren,Westmalle, Tongerlo,andOrvalfortheirhospitalityduringmystayswhenworkingonthisbook.

Finally,IexpressmygratitudetoWileyfortheirsupportwiththepublicationofthis manuscript.

DannyWeyns

Acronyms

24/724hoursaday,sevendaysaweek:allthetime

A-LTLAdaptoperator-extendedLinearTemporalLogic

ActivFORMSActiveFOrmalModelsforSelf-adaptation

AmazonEC2AmazonElasticComputeCloud

AMOCS-MAAutomatedMulti-objectiveControlofSoftwarewithMultipleActuators

APAtomicPropositions

CCoulomb

CD-ROMCompactDiskReadOnlyMemory

CPUCentralProcessingUnit

CTLComputationTreeLogic

dBdeciBel

DCRGDynamicConditionResponseGraph

DeltaIoT.v2AdvancedversionofDeltaIoT

DeltaIoTIoTapplicationforbuildingsecuritymonitoring

DiVADynamicVariabilityincomplexAdaptivesystems

DTMCDiscrete-TimeMarkovChain

ENTRUSTENgineeringofTRUstworthySelf-adaptivesofTware

EUREMAExecUtableRuntimEMegAmodels

F1-scoreScorethatcombinesprecisionandrecalltoevaluateaclassifier

FLAGSFuzzyLiveAdaptiveGoalsforSelf-adaptivesystems

FORMSFOrmalReferenceModelforSelf-adaptation

FQL4KEFuzzyQ-LearningforKnowledgeEvolution

FUSIONFeatUre-orientedSelf-adaptatION

GDPRGeneralDataProtectionRegulation

GOREGoal-OrientedRequirementsEngineering

IBMInternationalBusinessMachinesCorporation

IEEEInstituteofElectricalandElectronicsEngineers

IoTInternet-of-Things

ISOInternationalOrganizationforStandardization

KAMIKeepAliveModelswithImplementation

KAOSKnowledgeAcquisitioninAutomatedSpecification

LTSLabeledTransitionSystem

MAPE-KMonitor-Analyze-Plan-Execute-Knowledge

Acronyms

MARTASModelsAtRuntimeAndStatisticaltechniques

mCmiliCoulomb

MDPMarkovDecisionProcess

MIMOsystemMultiple-InputMultiple-Outputcontrolsystem

MITMassachusettsInstituteofTechnology

MJMegaJoules

MoREModel-BasedReconfigurationEngine

MPCModelPredictiveControl

NATONorthAtlanticTreatyOrganization

OSGiOSGiAlliance,formerlyknownastheOpenServiceGatewayInitiative

PCTLProbabilisticComputationTreeLogic

PIcontrollerProportional-Integralcontroller

PLTSProbabilisticLabeledTransitionSystem

PRISMPRobabIlisticSymbolicModelchecker

Q-learningClassicreinforcementlearningalgorithm

QoSQualityofService

QoSMOSQualityofServiceManagementandOptimizationofService-based systems

RELAXRequirementsspecificationlanguagefordynamicallyadaptivesystems

RFIDRadio-FrequencyIDentification

RUBiSOpensourceauctionsiteprototypemodeledaftereBay.com

SASOStability,Accuracy,Settlingtime,Overshootcontrolproperties

SAVESelf-AdaptiveVideoEncoder

SIMCASimplexControlAdaptation

SISOsystemSingle-InputSingle-Outputcontrolsystem

SNRSignaltoNoiseRatio

SSIMStructuralSimilarityIndexMetric

UMLUnifiedModelingLanguage

UppaalIntegratedmodelcheckingsuitefornetworksofautomata

USUnitedStates

UUVUnmannedUnderwaterVehicle

WiFiWirelessnetworkingtechnologybasedontheIEEE802.11standards

Z-transformTransformationofadiscretetimetoafrequencydomainrepresentation

ZNN.comNewsservicethatservesmultimedianewscontenttocustomers

Introduction

Backin1968,theNorthAtlanticTreatyOrganization(NATO)organizedthefirstconferenceonSoftwareEngineering,inGarmisch,Germany.Atthetime,managersandsoftware engineersperceiveda“softwarecrisis,”referringtothemanageabilityproblemsofsoftware projectsandsoftwarethatwasnotdeliveringitsobjectives.Oneofthekeyidentifiedcauses forthecrisiswasthegrowinggapbetweentherapidlyincreasingpowerofcomputingsystemsandtheabilityofprogrammerstoeffectivelyexploitthecapabilitiesofthesesystems. Thecrisiswasreflectedinprojectsrunningover-budgetandover-time,softwareoflow qualitythatdidnotmeetrequirements,andcodethatwasdifficulttomaintain.Thiscrisistriggeredthedevelopmentofnovelprogrammingparadigms,methodsandprocessesto assuresoftwarequality.Whiletodaylargeandcomplexsoftwareprojectsremainvulnerabletounanticipatedproblems,thecausesthatunderlaythisfirstsoftwarecrisisarenow relativelywellunderthecontrolofprojectmanagersandsoftwareengineers.

About35yearslater,in2001,IBMreleasedamanifestothatreferredtoanother“loomingsoftwarecrisis,”thistimecausedbytheincreasingcomplexityofinstalling,configuring, tuning,andmaintainingcomputingsystems.Newemergingcomputingsystemsatthattime wentbeyondcompanyboundariesintotheInternet,introducingnewlevelsofcomplexity thatcouldhardlybemanaged,evenbythemostskilledsystemadministrators.Thecomplexityresultedfromvariousinternalandexternalfactors,causinguncertaintiesthatwere difficulttoanticipatebeforedeployment.Examplesarethescaleofthesystem;inherent distributionofthesoftwaresystem,whichmayspanadministrativedomains;dynamics intheavailabilityofresourcesandservices;externalthreatstosystems;faultsthatmay bedifficulttopredict;andchangesinusergoalsduringoperation.Aconsensusgrewthat self-managementwastheonlyviableoptiontotackletheproblemsthatcausedthiscomplexitycrisis.Self-managementreferstocomputingsystemsthatcanadaptautonomously toachievetheirgoalsbasedonhigh-levelobjectives.Suchcomputingsystemsareusually called self-adaptivesystems.

Fromtheoutsetintheearly2000s,therewasacommonunderstandingamong researchersandengineersthatrealizingthefullpotentialofself-adaptivesystemswould takealong-termandworldwideeffortacrossadiversityoffields.Overthepasttwo decades,communitiesofdifferentfieldshaveputextensiveeffortsinunderstandingthe foundationalprinciplesofself-adaptationaswellasdevisingtechniquesandmethodsto engineerself-adaptivesystems.Thistextaimsatprovidingacomprehensiveoverviewof thefieldofself-adaptationbyconsolidatingkeyknowledgeobtainedfromtheseefforts.

Introducingself-adaptivesystemsischallenginggiventhediversityofresearchtopics, engineeringmethods,andapplicationdomainsthatarepartofthisfield.Totacklethis challenge,thistextisbasedonsixpillars.

First,welayafoundationfor what constitutesaself-adaptivesystembyintroducingtwo generallyacknowledged,butcomplementarybasicprinciples.Thesetwoprinciplesenable ustocharacterizeself-adaptivesystemsanddistinguishthemfromotherrelatedtypesof systems.Fromthebasicprinciples,aconceptualmodelofaself-adaptivesystemisderived, whichoffersabasicvocabularythatweusethroughoutthetext.

Second,thecoreofthetext,whichfocuseson how self-adaptivesystemsareengineered, ispartitionedintoconvenientchunksdrivenbyresearchandengineeringeffortsovertime. Inparticular,thetextapproachestheengineeringofself-adaptivesystemsinsevenwaves. Thesewavesputcomplementaryaspectsofengineeringself-adaptivesystemsinfocusthat synergisticallyhavecontributedtothecurrentbodyofknowledgeinthefield.Eachwave highlightsatrendofinterestintheresearchcommunity.Someoftheearlierwaveshave stabilizednowandresultedincommonknowledgeinthecommunity.Othermorerecent wavesarestillveryactiveandthesubjectofdebate;theknowledgeofthesewaveshasnot beenfullyconsolidatedyet.

Third,throughoutthetextweuseawell-thought-outsetofapplicationstoillustratethe materialwithconcreteexamples.Weuseasimpleservice-basedapplicationtoillustratethe basicprinciplesandtheconceptionalmodelofself-adaptivesystems.Beforethecorepart ofthetextthatzoomsinonthesevenwavesofresearchonengineeringself-adaptivesystems,weintroduceapracticalInternet-of-Thingsapplicationthatweuseasthemaincase toillustratethecharacteristicsofthedifferentwaves.Inaddition,weuseavarietyofcases fromdifferentcontemporarydomainstoillustratethematerial,includingaclient-server system,amobileservice,ageo-localizationservice,unmannedvehicles,videocompression, differentWebapplications,andaCloudsystem.

Fourth,eachcorechapterofthebookstartswithalistoflearningoutcomesatdifferentordersofthinking(fromunderstandingtosynthesis)andconcludeswithaseriesof exercises.Theexercisesaredefinedatfourdifferentlevelsofcomplexity,characterizedby fourlettersthatrefertotheexpectedaveragetimerequiredforsolvingtheexercises.Level H requiresabasicunderstandingofthematerialofthechapter;theexercisesshouldbesolvableinanumberofperson-hours.Level D requiresindepthunderstandingofthematerial ofthechapter;theseexercisesshouldbesolvablewithinperson-days.Level W requiresthe studyofsomeadditionalmaterialbeyondthematerialinthechapter;theseexercisesshould besolvablewithinperson-weeks.Finally,level M requiresthedevelopmentofnovelsolutionsbasedonthematerialprovidedinthecorrespondingchapter;theseexercisesrequire aneffortofperson-months.Thefinalchapterdiscussesthematurityofthefieldandoutlinesopenchallengesforresearchinself-adaptation,whichcanserveasfurtherinspiration forfutureresearchendeavors,forinstanceasastartpointforPhDprojects.

Fifth,eachchapterconcludeswithbibliographicnotes.Thesenotespointtofoundational researchpapersofthedifferentpartsofthechapter.Inaddition,thenoteshighlightsome characteristicworkandprovidepointerstobackgroundmaterial.Thematerialreferredto inthebibliographicnotesisadvisedforfurtherreading.

Sixth,supplementarymaterialisfreelyavailableforreaders,students,andteachersatthe bookwebsite: https://introsas.cs.kuleuven.be/.Thesupplementarymaterialincludes

slidesforeducationalpurposes,selectedexamplesolutionsofexercises,modelsandcode thatcanbeusedfortheexercises,andcomplementarymaterialthatelaboratesonspecific materialfromthebook.

Assuch,thismanuscriptprovidesastartingpointforstudents,researchers,andengineers thatwanttofamiliarizethemselveswiththefieldofself-adaptation.Thetextaimstooffera solidbasisforthosewhoareinterestedinself-adaptationtoobtaintherequiredskillsetto understandthefundamentalprinciplesandengineeringmethodsofself-adaptivesystems. Theprinciplesofself-adaptationhavetheirrootsinsoftwarearchitecture,model-based engineering,formalspecificationlanguages,andprinciplesofcontroltheoryandmachine learning.Itisexpectedthatreadersarefamiliarwiththebasicsofthesetopicswhenstarting withourbook,althoughsomebasicaspectsareintroducedintherespectivechapters.

BasicPrinciplesofSelf-AdaptationandConceptualModel

Modernsoftware-intensivesystems1 areexpectedtooperateunderuncertainconditions, withoutinterruption.Possiblecausesofuncertaintiesincludechangesintheoperational environment,dynamicsintheavailabilityofresources,andvariationsofusergoals.Traditionally,itisthetaskofsystemoperatorstodealwithsuchuncertainties.However,such managementtaskscanbecomplex,error-prone,andexpensive.Theaimofself-adaptation istoletthesystemcollectadditionaldataabouttheuncertaintiesduringoperationinorder tomanageitselfbasedonhigh-levelgoals.Thesystemusestheadditionaldatatoresolve uncertaintiesandbasedonitsgoalsre-configuresoradjustsitselftosatisfythechanging conditions.

Considerasanexampleasimpleservice-basedhealthassistancesystemasshownin Figure1.1.Thesystemtakessamplesofvitalparametersofpatients;italsoenablespatients toinvokeapanicbuttonincaseofanemergency.Theparametersareanalyzedbyamedical servicethatmayinvokeadditionalservicestotakeactionswhenneeded;forinstance,adrug servicemayneedtonotifyalocalpharmacytodelivernewmedicationtoapatient.Eachservicetypecanberealizedbyoneofmultipleserviceinstancesprovidedbythird-partyservice providers.Theseserviceinstancesarecharacterizedbydifferentqualityproperties,suchas failurerateandcost.Typicalexamplesofuncertaintiesinthissystemarethepatternsthat particularpathsintheworkflowareinvokedby,whicharebasedonthehealthconditions oftheusersandtheirbehavior.Otheruncertaintiesaretheavailableserviceinstances,their actualfailureratesandthecoststousethem.Theseparametersmaychangeovertime,for instanceduetothechangingworkloadsorunexpectednetworkfailures.

Anticipatingsuchuncertaintiesduringsystemdevelopment,orlettingsystemoperators dealwiththemduringoperation,isoftendifficult,inefficient,ortoocostly.Moreover,since manysoftware-intensivesystemstodayneedtobeoperational24/7,theuncertaintiesnecessarilyneedtoberesolvedatruntimewhenthemissingknowledgebecomesavailable. Self-adaptationisabouthowasystemcanmitigatesuchuncertaintiesautonomouslyor withminimumhumanintervention.

Thebasicideaofself-adaptationistoletthesystemcollectnewdata(thatwasmissingbeforedeployment)duringoperationwhenitbecomesavailable.Thesystemusesthe

1Asoftware-intensivesystemisanysystemwheresoftwaredominatestoalargeextentthedesign, construction,deployment,operation,andevolutionofthesystem.Someexamplesincludemobile embeddedsystems,unmannedvehicles,webserviceapplications,wirelessad-hocsystems, telecommunications,andCloudsystems.

2 1BasicPrinciplesofSelf-AdaptationandConceptualModel

Figure1.1 Architectureofasimpleservice-basedhealthassistancesystem

additionaldatatoresolveuncertainties,toreasonaboutitself,andbasedonitsgoalsto reconfigureoradjustitselftomaintainitsqualityrequirementsor,ifnecessary,todegrade gracefully.

Inthischapter,weexplain what aself-adaptivesystemis.Wedefinetwobasicprinciples thatdeterminetheessentialcharacteristicsofself-adaptation.Theseprinciplesallowus todefinetheboundariesofwhatwemeanbyaself-adaptivesysteminthisbook,andto contrastself-adaptationwithotherapproachesthatdealwithchangingconditionsduring operation.Fromthetwoprinciples,wederiveaconceptualmodelofaself-adaptivesystem thatdefinesthebasicelementsofsuchasystem.Theconceptualmodelprovidesabasic vocabularyfortheremainderofthisbook.

LEARNINGOUTCOMES

● Toexplainthebasicprinciplesofself-adaptation.

● Tounderstandhowself-adaptationrelatestootheradaptationapproaches.

● Todescribetheconceptualmodelofaself-adaptivesystem.

● Toexplainandillustratethebasicconceptsofaself-adaptivesystem.

● Toapplytheconceptualmodeltoaconcreteself-adaptiveapplication.

1.1PrinciplesofSelf-Adaptation

Thereisnogeneralagreementonadefinitionofthenotionof self-adaptation.However, therearetwocommoninterpretationsofwhatconstitutesaself-adaptivesystem.

Thefirstinterpretationconsidersaself-adaptivesystemasasystemthatisabletoadjust itsbehaviorinresponsetotheperceptionofchangesintheenvironmentandthesystem itself.The self prefixindicatesthatthesystemdecidesautonomously(i.e.withoutorwith minimalhumanintervention)howtoadapttoaccommodatechangesinitscontextand environment.Furthermore,aprevalentaspectofthisfirstinterpretationisthepresenceof uncertaintyintheenvironmentorthedomaininwhichthesoftwareisdeployed.Todeal withtheseuncertainties,theself-adaptivesystemperformstasksthataretraditionallydone byoperators.Hence,thefirstinterpretationtakesthestanceoftheexternalobserverand looksataself-adaptivesystemasablackbox.Self-adaptationisconsideredasanobservable propertyofasystemthatenablesittohandlechangesinexternalconditions,availabilityof resources,workloads,demands,andfailuresandthreats.

Thesecondinterpretationcontraststraditional“internal”mechanismsthatenableasystemtodealwithunexpectedorunwantedevents,suchasexceptionsinprogramminglanguagesandfault-tolerantprotocols,with“external”mechanismsthatarerealizedbymeans ofaclosedfeedbackloopthatmonitorsandadaptsthesystembehavioratruntime.This interpretationemphasizesa“disciplinedsplit”betweentwodistinctpartsofaself-adaptive system:onepartthatdealswiththedomainconcernsandanotherpartthatdealswiththe adaptationconcerns.Domainconcernsrelatetothegoalsoftheusersforwhichthesystemisbuilt;adaptationconcernsrelatetothesystemitself,i.e.thewaythesystemrealizes theusergoalsunderchangingconditions.Thesecondinterpretationtakesthestanceofthe engineerofthesystemandlooksatself-adaptationfromthepointofviewhowthesystem isconceived.

Hence,weintroduce twocomplementarybasicprinciples thatdeterminewhata self-adaptivesystemis:

1. Externalprinciple: Aself-adaptivesystemisasystemthatcanhandlechangesand uncertaintiesinitsenvironment,thesystemitself,anditsgoalsautonomously(i.e. withoutorwithminimalrequiredhumanintervention).

2. Internalprinciple: Aself-adaptivesystemcomprisestwodistinctparts:theﬁrstpart interactswiththeenvironmentandisresponsibleforthedomainconcerns–i.e. theconcernsofusersforwhichthesystemisbuilt;thesecondpartconsistsofa feedbackloopthatinteractswiththeﬁrstpart(andmonitorsitsenvironment)andis responsiblefortheadaptationconcerns–i.e.concernsaboutthedomainconcerns.

Letusillustratehowthetwoprinciplesofself-adaptationapplytotheservice-based healthassistancesystem.Self-adaptationwouldenablethesystemtodealwithdynamics inthetypesofservicesthatareinvokedbythesystemaswellasvariationsinthefailure ratesandcostsofparticularserviceinstances.Suchuncertaintiesmaybehardtoanticipate beforethesystemisdeployed(externalprinciple).Tothatend,theservice-basedsystem couldbeenhancedwithafeedbackloop.Thisfeedbacklooptracksthepathsofservices thatareinvokedintheworkflow,aswellasthefailureratesofserviceinstancesand thecostsofinvokingserviceinstancesthatareprovidedbytheserviceproviders.Taking thisdataintoaccount,thefeedbackloopadaptstheselectionofserviceinstancesbythe workflowenginesuchthatasetofadaptationconcernsisachieved.Forinstance,services

areselectedthatkeeptheaveragefailureratebelowarequiredthreshold,whilethecostof usingthehealthassistancesystemisminimized(internalprinciple).

1.2OtherAdaptationApproaches

Theabilityofasoftware-intensivesystemtoadaptatruntimeinordertoachieveitsgoals underchangingconditionsisnottheexclusivityofself-adaptation,butcanberealizedin otherways.

Thefieldofautonomoussystemshasalongtraditionofstudyingsystemsthatcanchange theirbehaviorduringoperationinresponsetoeventsthatmaynothavebeenanticipated fully.Acentralideaofautonomoussystemsistomimichuman(oranimal)behavior,which hasbeenasourceofinspirationforaverylongtime.TheareaofcyberneticsfoundedbyNorbertWieneratMITinthemidtwentiethcenturyledtothedevelopmentofvarioustypes ofmachinesthatexposedseemingly“intelligent”behaviorsimilartobiologicalsystems. Wiener’sworkcontributedtothefoundationsofvariousfields,includingfeedbackcontrol, automation,androbotics.Theinterestinautonomoussystemshasexpandedsignificantly inrecentyears,withhigh-profileapplicationdomainssuchasautonomousvehicles.While theseapplicationshaveextremepotential,theirsuccessessofarhavealsobeenaccompaniedbysomedramaticfailures,suchastheaccidentscausedbyfirstgenerationautonomous cars.Theconsequencesofsuchfailuresdemonstratetherealtechnicaldifficultiesassociatedwithrealizingtrulyautonomoussystems.

Animportantsub-fieldofautonomoussystemsismulti-agentsystems,whichstudies thecoordinationofautonomousbehaviorofagentstosolveproblemsthatgobeyondthe capabilitiesofsingleagents.Thisstudyinvolvesarchitecturesofautonomousagents,communicationandcoordinationmechanisms,andsupportinginfrastructure.Animportant aspectistherepresentationofknowledgeanditsusetocoordinateautonomousbehavior ofagents.Self-organizingsystemsemphasizedecentralizedcontrol.Inaself-organizingsystem,simplereactiveagentsapplylocalrulestoadapttheirinteractionswithotheragentsin responsetochangingconditionsinordertocooperativelyrealizethesystemgoals.Insuch systems,theglobalmacroscopicbehavioremergesfromthelocalinteractionsoftheagents. However,emergentbehaviorcanalsoappearasanunwantedsideeffect,forexamplein theformofoscillations.Designingdecentralizedsystemsthatexposetherequiredglobal behaviorwhileavoidingunwantedemergentphenomenaremainsamajorchallenge.

Context-awarenessisanothertraditionalfieldthatisrelatedtoself-adaptation. Context-awarenessputstheemphasisonhandlingrelevantelementsinthephysicalenvironmentasfirst-classcitizensinsystemdesignandoperation.Context-awarecomputing systemsareconcernedwiththeacquisitionofcontext(e.g.throughsensorstoperceivea situation),therepresentationandunderstandingofcontext,andthesteeringofbehavior basedontherecognizedcontext(e.g.triggeringactionsbasedontheactualcontext).

Context-awaresystemstypicallyhavealayeredarchitecture,whereacontextmanager ordedicatedmiddlewareisresponsibleforsensinganddealingwithcontextchanges. Self-awarecomputingsystemscontrastwithcontext-awarecomputingsystemsinthe sensethatthesesystemscaptureandlearnknowledgenotonlyabouttheenvironment butalsoaboutthemselves.Thisknowledgeisencodedintheformofruntimemodels,

1.4ConceptualModelofaSelf-AdaptiveSystem 5

whichaself-awaresystemusestoreasonatruntime,enablingittoactinaccordancewith higher-levelgoals.

1.3ScopeofSelf-Adaptation

Autonomoussystems,multi-agentsystems,self-organizingsystems,andcontext-aware systemsarefamiliesofsystemsthatapplyclassicalapproachestodealwithchangeat runtime.However,theseapproachesdonotalignwiththecombinedbasicprinciplesof self-adaptation.Inparticular,noneoftheseapproachescomplywiththesecondprinciple, whichmakesanexplicitdistinctionbetweenapartofthesystemthathandlesdomain concernsandapartthathandlesadaptationconcerns.However,thesecondprinciple ofself-adaptationcanbeappliedtoeachoftheseapproaches–i.e.thesesystemscanbe enhancedwithafeedbackloopthatdealswithasetofadaptationconcerns.Thisbookis concernedwithself-adaptationasapropertyofacomputingsystemthatiscompliantwith thetwobasicprinciplesofself-adaptation.

Furthermore,self-adaptationcanbeappliedatdifferentlevelsofthesoftwarestackof computingsystems,fromtheunderlyingresourcesandlow-levelcomputinginfrastructure tomiddlewareservicesandapplicationsoftware.Thechallengesofself-adaptationatthese differentlevelsaredifferent.Forinstance,thespaceofadaptationoptionsofhigher-level softwareentitiesisoftenmulti-dimensional,andsoftwarequalitiesandadaptationgoals usuallyhaveacomplexinterplay.Thesecharacteristicsarelessapplicabletotheadaptationoflower-levelresources,wherethereisoftenamorestraightforwardrelationbetween adaptationactionsandsoftwarequalities.Inthisbook,weconsiderself-adaptationapplied atdifferentlevelsofthesoftwarestackofcomputingsystems,fromvirtualizedresourcesup toapplicationsoftware.

1.4ConceptualModelofaSelf-AdaptiveSystem

Startingfromthetwobasicprinciplesofself-adaptation,wedefineaconceptualmodelfor self-adaptivesystemsthatdescribesthebasicelementsofsuchsystemsandtherelationship betweenthem.Thebasicelementsareintentionallykeptabstractandgeneral,buttheyare compliantwiththebasicprinciplesofself-adaptation.Theconceptualmodelintroduces abasicvocabularyforthefieldofself-adaptationthatwewillusethroughoutthisbook. Figure1.2showstheconceptualmodelofaself-adaptivesystem.

Theconceptualmodelcomprises fourbasicelements: environment,managedsystem, feedbackloop,andadaptationgoals.Thefeedbacklooptogetherwiththeadaptationgoals formthemanagingsystem.Wediscusstheelementsonebyoneandillustratethemforthe service-basedhealthassistanceapplication.

1.4.1Environment

Theenvironmentreferstothepartoftheexternalworldwithwhichaself-adaptivesystem interactsandinwhichtheeffectsofthesystemwillbeobservedandevaluated.Theenvironmentcanincludeusersaswellasphysicalandvirtualelements.Thedistinctionbetween

Self-Adaptive System

Stakeholders evolve evolve support

Adaptation Goals

Feedback Loop

Managing System sense

Managed System effect adapt sense read

Environment

KEY Actor Interface Group of elements Component

Figure1.2 Conceptualmodelofaself-adaptivesystem

theenvironmentandtheself-adaptivesystemismadebasedontheextentofcontrol.The environmentcanbesensedandeffectedthroughsensorsandeffectors,respectively.However,astheenvironmentisnotunderthecontrolofthesoftwareengineerofthesystem, theremaybeuncertaintyintermsofwhatissensedbythesensorsorwhattheoutcomes willbeoftheeffectors.

Appliedtotheservice-basedhealthassistancesystemexample,theenvironmentincludes thepatientsthatmakeuseofthesystem;theapplicationdeviceswiththesensorsthat measurevitalparametersofpatientsandthepanicbuttons;theserviceproviderswiththe servicesinstancestheyoffer;andthenetworkconnectionsusedinthesystem,whichmay allaffectthequalitypropertiesofthesystem.

1.4.2ManagedSystem

Themanagedsystemcomprisestheapplicationsoftwarethatrealizesthefunctionsofthe systemtoitsusers.Hence,theconcernsofthemanagedsystemareconcernsoverthe domain,i.e.theenvironmentofthesystem.Differentterminologyhasbeenusedtoreferto themanagedsystem,suchasmanagedelement,systemlayer,corefunction,base-levelsystem,andcontrollableplant.Inthisbook,wesystematicallyusetheterm managedsystem.To realizeitsfunctionstotheusers,themanagedsystemsensesandeffectstheenvironment. Tosupportadaptations,themanagedsystemneedstobeequippedwithsensorstoenable monitoringandeffectors(alsocalledactuators)toexecuteadaptationactions.Safelyexecutingadaptationsrequiresthatactionsappliedtothemanagedsystemsdonotinterferewith theregularsystemactivity.Ingeneral,theymayaffectongoingactivitiesofthesystem–for instance,scalingaCloudsystemmightrequirebringingdownacontainerandrestartingit. Aclassicapproachtorealizingsafeadaptationsistoapplyadaptationactionsonlywhena system(orthepartsthataresubjecttoadaptation)isina quiescentstate.Aquiescentstateis astatewherenoactivityisgoingoninthemanagedsystemorthepartsofitthataresubject toadaptationsothatthesystemcanbesafelyupdated.Supportforquiescencerequiresan infrastructuretodealwithmessagesthatareinvokedduringadaptations;thisinfrastructure alsoneedstohandlethestateoftheadaptedsystemortherelevantpartsofittoensureits consistencybeforeandafteradaptation.Handlingsuchmessagesandensuringconsistency ofstateduringadaptationsareingeneraldifficultproblems.However,numerousinfrastructureshavebeendevelopedtosupportsafeadaptationsforparticularsettings.Awell-known exampleistheOSGi(OpenServiceGatewayInitiative)Javaframework,whichsupports installing,starting,stopping,andupdatingarbitrarycomponents(bundlesinOSGiterminology)dynamically.

Themanagedsystemoftheservice-basedhealthassistancesystemconsistsofaservice workflowthatrealizesthesystemfunctions.Inparticular,amedicalservicereceivesmessagesfrompatientswithvaluesoftheirvitalparameters.Theserviceanalyzesthedataand eitherinvokesadrugservicetonotifyalocalpharmacytodelivernewmedicationtothe patientorchangethedoseofmedication,oritinvokesanalarmserviceincaseofanemergencytonotifymedicalstafftovisitthepatient.Thealarmservicecanalsobeinvoked directlybyapatientviaapanicbutton.Tosupportadaptation,theworkflowinfrastructure offerssensorstotracktherelevantaspectsofthesystemandthecharacteristicsofservice instances(failurerateandcost).Theinfrastructureallowstheselectionanduseofconcreteinstancesofthedifferenttypesofservicesthatarerequiredbythesystem.Finally,the workflowinfrastructureneedstoprovidesupporttochangeserviceinstancesinaconsistentmannerbyensuringthataserviceisonlyremovedandreplacedwhenitisnolonger involvedinanyongoingserviceinvocationofthehealthassistancesystem.

1.4.3AdaptationGoals

Adaptationgoalsrepresentconcernsofthemanagingsystemoverthemanagedsystem; adaptationgoalsrelatetoqualitypropertiesofthemanagedsystem.Ingeneral,fourprincipaltypesofhigh-leveladaptationgoalscanbedistinguished:self-configuration(i.e.systems thatconfigurethemselvesautomatically),self-optimization(systemsthatcontinuallyseek waystoimprovetheirperformanceorreducetheircost),self-healing(systemsthatdetect, diagnose,andrepairproblemsresultingfrombugsorfailures),andself-protection(systems thatdefendthemselvesfrommaliciousattacksorcascadingfailures).

Sincethesystemusestheadaptationgoalstoreasonaboutitselfduringoperation,the goalsneedtoberepresentedinamachine-readableformat.Adaptationgoalsareoften expressedintermsoftheuncertaintytheyhavetodealwith.Exampleapproachesarethe specificationofqualityofservicegoalsusingprobabilistictemporallogicsthatallowfor probabilisticquantificationofproperties,thespecificationoffuzzygoalswhosesatisfaction isrepresentedthroughfuzzyconstraints,andadeclarativespecificationofgoals(incontrast toenumeration)allowingtheintroductionofflexibilityinthespecificationofgoals.Adaptationgoalscanbesubjecttochangethemselves,whichisrepresentedinFigure1.2bymeans ofthe evolve interface.Addingnewgoalsorremovinggoalsduringoperationwillrequire updatesofthemanagingsystem,andoftenalsorequireupdatesofprobesandeffectors.

Inthehealthassistanceapplication,thesystemdynamicallyselectsserviceinstances underchangingconditionstokeepthefailurerateoveragivenperiodbelowarequired threshold(self-healinggoal),whilethecostisminimized(optimizationgoal).Stakeholders maychangethethresholdvalueforthefailurerateduringoperation,whichmayrequire justasimpleupdateofthecorrespondingthresholdvalue.Ontheotherhand,addinga newadaptationgoal,forinstancetokeeptheaverageresponsetimeofinvocationsofthe assistanceservicebelowarequiredthreshold,wouldbemoreinvasiveandwouldrequire anevolutionoftheadaptationgoalsandthemanagingsystem.

1.4.4FeedbackLoop

Theadaptationofthemanagedsystemisrealizedbythemanagingsystem.Differentterms areusedintheliteraturefortheconceptofmanagingsystem,suchasautonomicmanager, adaptationengine,reflectivesystem,andcontroller.Conceptually,themanagingsystem realizesafeedbackloopthatmanagesthemanagedsystem.Thefeedbackloopcomprises theadaptationlogicthatdealswithoneormoreadaptationgoals.Torealizetheadaptation goals,thefeedbackloopmonitorstheenvironmentandthemanagedsystemandadaptsthe latterwhennecessarytorealizetheadaptationgoals.Withareactivepolicy,thefeedback looprespondstoaviolationoftheadaptationgoalsbyadaptingthemanagedsystemtoa newconfigurationthatcomplieswiththeadaptationgoals.Withaproactivepolicy,thefeedbacklooptracksthebehaviorofthemanagedsystemandadaptsthesystemtoanticipatea possibleviolationoftheadaptationgoals.

Animportantrequirementofamanagingsystemisensuringthatfail-safeoperating modesarealwayssatisfied.Whensuchanoperatingmodeisdetected,themanaging systemcanswitchtoafall-backordegradedmodeduringoperation.Anexampleofan operatingmodethatmayrequirethemanagingsystemtoswitchtoafail-safeconfiguration

9 istheinabilitytofindanewconfigurationtoadaptthemanagedsystemtothatachieves theadaptationgoalswithinthetimewindowthatisavailabletomakeanadaptation decision.Notethatinsteadoffallingbacktoafail-safeconfigurationintheeventthatthe goalscannotbeachieved,themanagingsystemmayalsoofferastakeholderthepossibility todecideontheactiontotake.

Themanagingsystemmayconsistofasinglelevelthatconceptuallyconsistsofonefeedbackloopwithasetofadaptationgoals,asshowninFigure1.2.However,themanaging systemmayalsohavealayeredstructure,whereeachlayerconceptuallyconsistsofafeedbackloopwithitsowngoals.Inthiscase,eachlayermanagesthelayerbeneath–i.e.layer n manageslayer n-1,andlayer1managesthemanagedsystem.Inpractice,mostself-adaptive systemshaveamanagingsystemthatconsistsofjustonelayer.Insystemswhereadditional layersareapplied,thenumberofadditionallayersisusuallylimitedtooneortwo.For instance,amanagingsystemmayhavetwolayers:thebottomlayermayreactquicklyto changesandadaptsthemanagedsystemwhenneeded,whilethetoplayermayreasonover longtermstrategiesandadapttheunderlyinglayeraccordingly.

Themanagingsystemcanoperatecompletelyautomaticallywithoutinterventionof stakeholders,orstakeholdersmaybeinvolvedinsupportforcertainfunctionsrealizedby thefeedbackloop;thisisshowninFigure1.2bymeansofthegeneric support interface. Wealreadygaveanexampleabovewhereastakeholdercouldsupportthesystemwith handlingafail-safesituation.Anotherexampleisamanagingsystemthatdetectsapossible threattothesystem.Beforeactivatingapossiblereconfigurationtomitigatethethreat,the managingsystemmaycheckwithastakeholderwhethertheadaptationshouldbeapplied ornot.

Themanagingsystemcanbesubjecttochangeitself,whichisrepresentedinFigure1.2 withthe evolve interface.On-the-flychangesofthemanagingsystemsareimportantfortwo mainreasons:(i)toupdateafeedbacklooptoresolveaproblemorabug(e.g.addorreplace somefunctionality),and(ii)tosupportchangingadaptationgoals,i.e.changeorremovean existinggoaloraddanewgoal.Theneedforevolvingthefeedbackloopmodelistriggered bystakeholderseitherbasedonobservationsobtainedfromtheexecutingsystemorbecause stakeholderswanttochangetheadaptationgoals.

Themanagingsystemoftheservice-basedhealthassistancesystemcomprisesafeedback loopthatisaddedtotheserviceworkflow.Thetaskofthefeedbackloopistoensurethatthe adaptationgoalsarerealized.Tothatend,thefeedbackloopmonitorsthesystembehavior andthequalitypropertiesofserviceinstances,andtracksthatthesystemisnotviolating theadaptationgoals.Forareactivepolicy,thefeedbackloopwillselectalternativeservice instancesthatensuretheadaptationgoalsaremetintheeventthatgoalviolationsare detected.Ifnoconfigurationcanbefoundthatcomplieswiththeadaptationgoalswithin agiventime(fail-safeoperatingmode),themanagingsystemmayinvolveastakeholderto decideontheadaptationactiontotake.Thefeedbackloopthatadaptstheserviceinstances toensurethattheadaptationgoalsarerealizedmaybeextendedwithanextralevelthat adaptstheunderlyingmethodthatmakestheadaptationdecisions.Forinstance,thisextra levelmaytrackthequalitypropertiesofserviceinstancesovertimeandidentifypatterns. Thesecondlayercanthenusethisknowledgetoinstructtheunderlyingfeedbackloopto givepreferencetoselectingparticularserviceinstancesortoavoidtheselectionofcertain instances.Forinstance,servicesthatexposeahighleveloffailuresduringparticularperiods