Search

Today's wireless networks and devices support the dynamic composition of mobile distributed systems according to networked services and resources. This has in particular led to the introduction of a number of computing paradigms, among which the Service-Oriented Architecture (SOA) seems to best serve these objectives. However, common SOA solutions restrict considerably the openness of dynamic mobile systems in that they assume a specific middleware infrastructure, over which composed system components have been pre-developed to integrate. On the other hand, the Semantic Web introduces a promising approach towards the integration of heterogeneous components; current semantics-based approaches are, however, restricted to application-level interoperability. Combining the elegant properties of software architecture modeling with the semantic reasoning power of the Semantic Web paradigm, this paper introduces abstract semantic modeling of mobile services that allows both machine reasoning about service composability and enhanced interoperability at both middleware and application level. [ABSTRACT FROM AUTHOR]

System abstractions such as virtual memory simplify the construction of software by hiding details of the underlying system and by providing higher-level functionality on which to build. While the value of building systems as layers or hierarchies of abstractions has long been known, the application of this principle has been uneven when it comes to using it as the basis for architecting dependable distributed systems. This paper gives an overview of issues that arise when using abstractions in this area and proposes some approaches to addressing these issues. The latter include the use of translucent abstractions that expose some of the internal workings of the abstraction implementation, customizable abstractions that allow attributes to be matched to the application requirements and execution scenario, and an intrusion-stop process abstraction that potentially provides a basis for architecting survivable systems. [ABSTRACT FROM AUTHOR]

An approach to software development is sketched in which problem structuring is separated from software architecture. The problem is decomposed into subproblems of familiar classes that can be considered in isolation; then the interactions among the subproblems are considered. The architectural task is seen as the task of composing the software machines associated with each subproblem and with the more complex interactions among them. It is suggested that such an approach embodies a good separation of concerns that can contribute to achieving system dependability. [ABSTRACT FROM AUTHOR]

In a previous paper we described a fault injection strategy that applies risk-based analysis to select the system's riskiest components for testing. Among other criteria, this analysis considers the number of upstream and downstream dependencies of a component in a system. In order to obtain this number, we propose the use of architectural-level dependency analysis. One advantage of an analysis at architectural level is that systems may often contain COTS components from which no source code is available. The approach is illustrated with a case study, and the preliminary experimental results are also discussed. [ABSTRACT FROM AUTHOR]

In service-oriented computing, services are dynamically built as an assembly of pre-existing, independently developed, network accessible services. Hence, predicting as much as possible automatically their dependability is important to appropriately drive the selection and assembly of services, in order to get some required dependability level. We present an approach to the reliability prediction of such services, based on the partial information published with each service, and that lends itself to automatization. The proposed methodology exploits ideas from the Software Architecture- and Component-based approaches to software design. [ABSTRACT FROM AUTHOR]

One of the main objectives of developing component-based software systems is to enable efficient building of systems through the integration of components. All component models define some form of component interface standard that facilitates the programmatic integration of components, but they do not facilitate or provide theories for the prediction of the quality attributes of the component compositions. This decreases significantly the value of the component-based approach to building dependable systems. If it is not possible to predict the value of a particular attribute of a system prior to integration and deployment to the target environment the system must be subjected to other procedures, often costly, to determine this value empirically. For this reason one of the challenges of the component-based approach is to obtain means for the "composition" of quality attributes. This challenge poses a very difficult task because the diverse types of quality attributes do not have the same underlying conceptual characteristics, since many factors, in addition to component properties, influence the system properties. This paper analyses the relation between the quality attributes of components and those of their compositions. The types of relations are classified according to the possibility of predicting properties of compositions from the properties of the components and according to the influences of other factors such as software architecture or system environment. The classification is exemplified with particular cases of compositions of quality attributes, and its relation to dependability is discussed. Such a classification can indicate the efforts that would be required to predict the system attributes which are essential for system dependability and in this way, the feasibility of the component-based approach in developing dependable systems. [ABSTRACT FROM AUTHOR]

Connectors and connector wrappers explicitly specify the protocol of interaction among components and afford the reusable application of extra-functional behaviors, such as reliability policies. Ideally, these specifications can be used for more than just modeling and analysis. We are investigating how to use them in the design and implementation of the middleware substrate of a distributed system. This paper reports our experience elaborating connectors and connector wrappers as instantiations of a feature-oriented middleware framework called Theseus, which supports the design of asynchronous distributed applications. The results of this case study indicate that the relationship between specification features and implementation-level features is not one-to-one and that some specification features have complex, often subtle, manifestations in Theseus' design. This work reports the lessons learned designing these strategies and suggests techniques for designing middleware frameworks and composition tools that more explicitly reify and expose the features specified by connectors and connector wrappers. [ABSTRACT FROM AUTHOR]

Distributed applications must often consider and select the appropriate trade-offs among three important aspects - fault-tolerance, performance and resources. We introduce a novel concept, called versatile dependability, that provides a framework for analyzing and reasoning about these trade-offs in dependable software architectures. We present the architecture of a middleware framework that implements versatile dependability by providing the appropriate "knobs" to tune and re-calibrate the trade-offs. Our framework can adjust the properties and the behavior of the system at development-time, at deployment-time, and throughout the application's life-cycle. This renders the versatile dependability approach useful both to applications that require static fault-tolerance configurations supporting the loss/addition of resources and changing workloads, as well as to applications that evolve in terms of their dependability requirements. Through a couple of specific examples, one on adapting the replication style at runtime and the other on tuning the system scalability under given constraints, we demonstrate concretely how versatile dependability can provide an extended coverage of the design space of dependable distributed systems. [ABSTRACT FROM AUTHOR]

Recomposable software enables a system to change its structure and behavior during execution, in response to a dynamic execution environment. This paper proposes an approach to ensure that such adaptations are safe with respect to system consistency. The proposed method takes into consideration dependency analysis for target components, specifically determining viable sequences of adaptive actions and those states in which an adaptive action may be applied safely. We demonstrate that the technique ensures safe adaptation (insertion, removal, and replacement of components) in response to changing external conditions in a wireless multicast video application. [ABSTRACT FROM AUTHOR]

A distributed software system's deployment architecture can have a significant impact on the system's dependability. Dependability is a function of various system parameters, such as network bandwidth, frequencies of software component interactions, power usage, and so on. Recent studies have shown that the quality of deployment architectures can be improved significantly via active system monitoring, efficient estimation of the improved deployment architecture, and system redeployment. However, the lack of the appropriate tools for monitoring, analyzing, and effecting redeployment at the architectural level makes improving a system's deployment architecture a very challenging problem. To cope with these challenges, developers typically resort to ad hoc solutions that decrease the potential for reuse and understandability. In this paper, we first present an extensible framework that guides the design and development of solutions for this type of problem, enables the extension and reuse of the solutions, and facilitates autonomic analysis and redeployment of a system's deployment architecture. We then discuss a suite of extensible and integrated tools that help developers in realizing the framework. [ABSTRACT FROM AUTHOR]

Our paper introduces a runtime verification framework for concurrent monitoring of applications specified by UML statecharts. The approach offers a considerable degree of granularity by (i) enabling the modeler to focus on specific key dependability criteria by defining temporal logic formulae over a behavioral model that is available even in early phases of the development and (ii) by supporting the verification of the final implementation against the fully elaborated UML statechart model. The paper presents an extension of the propositional linear temporal logic that fits to the advanced constructs of UML statecharts and an advanced watchdog scheme for concurrent supervision of program execution based on the statechart specification. Keywords: Runtime verification, temporal logic, UML statecharts. [ABSTRACT FROM AUTHOR]

Every day, our society becomes more dependent on complex software systems with high availability requirements, such as those present in telecommunications, air traffic control, power plants and distribution lines, among others. In order to facilitate the task of maintaining and evolving such systems, dynamic software architecture infrastructures have recently been in the research agenda. However, complexity and dynamic evolution of dependable systems bring some challenges for verification. Some of these challenges are associated to modifications in the set of properties being verified and also in the types of analysis being performed during system operation. In this work, we present a multiple specification and architectural-based approach for software monitoring that allows the adaptation of analysis tasks in order to properly handle the challenges mentioned above. [ABSTRACT FROM AUTHOR]

Achieving high dependability of Web Services (WSs) dynamically composed from component WSs is an open problem. One of the main difficulties here is due to the fact that the component WSs can and will be upgraded online, which will affect the dependability of the composite WS. The paper introduces the problem of component WS upgrade and proposes solutions for dependable upgrading in which natural redundancy, formed by the latest and the previous releases of a WS being kept operational, is used. The paper describes how ‘confidence in correctness' can be systematically used as a measure of dependability of both the component and the composite WSs. We discuss architectures for a composite WS in which the upgrade of the component WS is managed by switching the composite WS from using the old release of the component WS to using its newer release only when the confidence is high enough, so that the composite service dependability will not deteriorate as a result of the switch. The effectiveness of the proposed solutions is assessed by simulation. We discuss the implications of the proposed architectures, including ways of ‘publishing' the confidence in WSs, in the context of relevant standard technologies, such as WSDL, UDDI and SOAP. [ABSTRACT FROM AUTHOR]

In this paper, we address the problem of improving the availability and correctness of Web Services. An architectural approach is proposed that incorporates fault-tolerant techniques, such as, self-checking, comparison, and dynamic reconfiguration. The first two techniques are associated with the detection and handling of faults at the component level, while the latter is associated with the system. To demonstrate its applicability, a distributed application was designed and implemented that addresses the problem of obtaining dependable stock quotes from the Web. The system was implemented using Web Services core technologies, and preliminary measurements confirmed the improved availability of the whole application. [ABSTRACT FROM AUTHOR]

Cancelling or reversing the effect of a former action is a necessity in most interactive systems. The simplest and most frequent form of this facility is the "undo" command that is available in usual, individual, text or graphic editors. As soon as collaborative work is considered, undoing is more intricate since the notion of a last action is not always meaningful. Within this framework, the so-called "selective undo", which allows selecting and cancelling any (or rather some...) former action, has received lot of attention. There are some similarities between cooperative work and composite web services: Component web services are concurrently accessed; they may be treated as shared documents for undoing former actions. Among the latest results on undoing in group editors, the transformational model seems suitable for generalization to other kinds of distributed systems. It completely avoids backward state recovery and allows the selection and cancellation of any former operation. We present some relevant aspects of this model, and then some hints on how to transpose it into the framework of composite web services. [ABSTRACT FROM AUTHOR]

Various forms of agreements naturally arise in the service provider model as well as in multi-party computing models such as business-to-business, utility and grid computing. The role of these agreements is twofold: they stipulate obligations and expectations of the involved parties, and they represent the goals to be met by the infrastructure. As a consequence of this latter point, in order to automate run-time adaptation and management of systems and services, agreements should be encoded and integrated in management software platforms. In this paper, we review the state of the art in software support for various forms of agreements, for all stages of their life-cycle. We also review emerging platforms and technologies in standard bodies, industries and academia. [ABSTRACT FROM AUTHOR]

This paper gives an overview of dependability issues of the 12 years in several business units of Philips. Main experiences stem from the development of systems in the telecommunications, consumer electronics and medical imaging domain. Several ways of dealing with these dependability issues and the best practices encountered are reported. The main focus is on architectural concepts and patterns that help to solve dependability issues in systems. Both the solution and the problem sides of dependability are explained by means of examples. [ABSTRACT FROM AUTHOR]

System-wide graceful degradation may be a viable approach to improving dependability in computer systems. In order to evaluate and improve system-wide graceful degradation we present a system model that will explicitly define graceful degradation as a system property, and measure how well a system gracefully degrades in the presence of multiple combinations of component failures. The system's software architecture plays a major role in this model, because the interface and component specifications embody the architecture's abstraction principle. We use the architecture to group components into subsystems that enable reasoning about overall system utility. We apply this model to an extensive example of a distributed embedded control system architecture to specify the relative utility of all valid system configurations. We then simulate working system configurations and compare their ability to provide functionality to the utility measures predicted by our model. [ABSTRACT FROM AUTHOR]

Software architectural choices have a profound influence on the quality attributes supported by a system. Architecture analysis can be used to evaluate the influence of design decisions on important quality attributes such as maintainability, performance and dependability. As software architecture gains appreciation as a critical design level for software systems, techniques and tools to support testing, understanding, debugging and maintaining these architectures are expected to become readily available. In addition to providing the desired support, data collected from these tools also provides a rich source of information from the point of view of performance and dependability analysis of the architecture. This paper presents a performance and dependability analysis methodology which illustrates the use of such data. The methodology thus seeks a three way integration of distinct and important areas, namely, formal specification, specification simulation/testing and performance and dependability analysis. We illustrate the key steps in the methodology with the help of a case study. [ABSTRACT FROM AUTHOR]

The work in this paper1 is devoted to the definition of a dependability modeling and model based evaluation approach based on UML models. It is to be used in the early phases of the system design to capture system dependability attributes like reliability and availability, thus providing guidelines for the choice among different architectural and design solutions. We show how structural UML diagrams can be processed to filter out the dependability related information and how a system-wide dependability model is constructed. Due to the modular construction, this model can be refined later as more detailed information becomes available. We discuss the model refinement based on the General Resource Model, an extension of UML. We show that the dependability model can be constructed automatically by using graph transformation techniques. [ABSTRACT FROM AUTHOR]

The quality of dependable systems (DS) is characterized by a number of non-functional properties (e.g., performance, reliability, availability, etc.). Assessing the DS quality against these properties imposes the application of quality analysis and evaluation. Quality analysis consists of checking, analytically solving, or simulating models of the system, which are specified using formalisms like CSP, CCS, Markov-chains, Petri-nets, Queuing-nets, etc. However, developers are usually not keen on using such formalisms for modeling and evaluating DS quality. On the other hand, they are familiar with using architecture description languages and object-oriented notations for building DS models. Based on the previous and to render the use of traditional quality analysis techniques more tractable, this paper proposes an architecture-based environment that facilitates the specification and quality analysis of DS at the architectural level. [ABSTRACT FROM AUTHOR]

The integrity of complex software systems built from existing components is becoming more dependent on the integrity of the mechanisms used to interconnect these components and, in particular, on the ability of these mechanisms to cope with architectural mismatches that might exist between components. There is a need to detect and handle (i.e. to tolerate) architectural mismatches during runtime because in the majority of practical situations it is impossible to localize and correct all such mismatches during development time. When developing complex software systems, the problem is not only to identify the appropriate components, but also to make sure that these components are interconnected in a way that allows mismatches to be tolerated. The resulting architectural solution should be a system based on the existing components, which are independent in their nature, but are able to interact in well-understood ways. To find such a solution we apply general principles of fault tolerance to dealing with arch itectural mismatches [ABSTRACT FROM AUTHOR]

Software monitoring is a technique that is well-suited to supporting the development of dependable system. It has been widely applied not only for this purpose but also for other purposes such as debugging, security, performance evaluation and enhancement, etc. However, there is an inherent gap between the levels of abstraction of the information that is collected during software monitoring (the implementation level) and that of the software architecture level where many design decisions are made. Unless an immediate structural one-to-one architecture-to-implementation mapping takes place, we need a specification language to describe how low-level events are related to higher-level ones. Although some specification languages for monitoring have been proposed in the literature, they do not provide support up to the software architecture level. In addition, these languages make it harder to link to (and reuse) information from other event-based models often employed for reliability analysis. In this paper, we discuss the importance of event description as an integration element for architecting dependable systems. [ABSTRACT FROM AUTHOR]

Component-based software built from reusable software components is being used in a wide range of applications that have high dependability requirements. In order to achieve the required levels of dependability, it is necessary to incorporate into these complex systems means for coping with software faults. However, the problem is exacerbated if we consider the current trend of integrating off-the-shelf software components, from independent sources, which allow neither code inspection nor changes. To leverage the dependability properties of these systems, we need solutions at the architectural level that are able to guide the structuring of unreliable components into a fault-tolerant architecture. In this paper, we present an approach for structuring fault-tolerant component-based systems based on the C2 architectural style. [ABSTRACT FROM AUTHOR]

Functionality for various services of scheduling algorithms is typically provided as extensions to a basic paradigm, intertwined in the kernel architecture. Thus, scheduling services come in packages around single paradigms, fixed to a certain methodology and kernel architecture. Temporal constraints of applications are addressed by a combination of scheduler and system architecture. Consequently, changing system architecture results in a complete rescheduling of all tasks, calling for a new cycle of analysis and testing from scratch, although a schedule meeting all temporal constraints already existed. We propose a component based architecture for schedule reuse. Instead of tying temporal constraints, scheduler, and system architecture together, we provide methods which allow for the reuse of existing schedules on various system architectures. In particular, we show how a schedule developed for table driven, dynamic or static priority paradigm can be reused in the other schemes. We address an architecture to disentangle actual scheduling from dispatching and other kernel routines with a small interface, suited for a variety of scheduling schemes as components. ... [ABSTRACT FROM AUTHOR]

The Web services architecture is expected to play a prominent role in developing next generation distributed systems. This chapter discusses how to build dependable systems based on the Web services architecture. More specifically, it surveys base fault tolerance mechanisms, considering both backward and forward error recovery mechanisms, and shows how they are adapted to deal with the specifics of the Web in the light of ongoing work in the area. Existing solutions, targeting the development of dependable composite Web services, may be subdivided into two categories that are respectively related to the specification of Web services composition and to the design of dedicated distributed protocols. [ABSTRACT FROM AUTHOR]

One increasingly important technique for improving system dependability is to provide mechanisms for a system to adapt at run time in order to accommodate varying resources, system errors, and changing requirements. For such "self-repairing" systems one of the hard problems is determining when a change is needed, and knowing what kind of adaptation is required. In this paper we describe a partial solution in which stylized architectural design models are maintained at run time as a vehicle for automatically monitoring system behavior, for detecting when that behavior falls outside of acceptable ranges, and for deciding on a high-level repair strategy. The main innovative feature of the approach is the ability to specialize a generic run time adaptation framework to support particular architectural styles and properties of interest. Specifically, a formal description of an architectural style defines for a family of related systems the conditions under which adaptation should be considered, provides an analytic basis for detecting anomalies, and serves as a basis for developing sound repair strategies. [ABSTRACT FROM AUTHOR]

The promise of architecture-based software development is that complex systems can be built and evolved reasonably quickly and reliably using coarse-grained components. However, practice has shown that many problems of traditional software development still persist in a component-based setting, and even that new problems are introduced. A class of such problems steins from the opportunity to perform system upgrade at the component level. The problems include errors in the functionality introduced by a new version of a component, decreased reliability of a new component version, inefficiency of components designed for reuse, component interaction mismatches, and so on. This paper presents an approach intended to alleviate the problems caused by component upgrades. Our approach focuses on software architectures both at system design and implementation levels. Specifically, our approach leverages explicit software connectors, called multi-versioning connectors (M-V-Cs), in ensuring dependable system composition and evolution, possibly during runtime. M-V-Cs unintrusively collect and analyze the execution statistics of one or more running components versions, and address three aspects of dependability: correctness, reliability, and efficiency. Our approach has been implemented and evaluated in the context of a family of architectural implementation platforms. We illustrate our approach with the help of an example application developed in coordination with a third-party organization. [ABSTRACT FROM AUTHOR]

There is a significant body of research on distributed computing architectures, methodologies and algorithms, both in the fields of fault tolerance and security. Whilst they have taken separate paths until recently, the problems to be solved are of similar nature. In classical dependability, fault tolerance has been the workhorse of many solutions. Classical security-related work has on the other hand privileged, with few exceptions, intrusion prevention. Intrusion tolerance (IT) is a new approach that has slowly emerged during the past decade, and gained impressive momentum recently. Instead of trying to prevent every single intrusion, these are allowed, but tolerated: the system triggers mechanisms that prevent the intrusion from generating a system security failure. The paper describes the fundamental concepts behind IT, tracing their connection with classical fault tolerance and security. We discuss the main strategies and mechanisms for architecting IT systems, and report on recent advances on distributed IT system architectures. [ABSTRACT FROM AUTHOR]