Architecting Dependable Systems II

354 Pages·2004·5.47 MB·English

by  Michel Wermelinger

Lecture Notes in Computer Science 3069
CommencedPublicationin1973
FoundingandFormerSeriesEditors:
GerhardGoos,JurisHartmanis,andJanvanLeeuwen
EditorialBoard
DavidHutchison
LancasterUniversity,UK
TakeoKanade
CarnegieMellonUniversity,Pittsburgh,PA,USA
JosefKittler
UniversityofSurrey,Guildford,UK
JonM.Kleinberg
CornellUniversity,Ithaca,NY,USA
FriedemannMattern
ETHZurich,Switzerland
JohnC.Mitchell
StanfordUniversity,CA,USA
MoniNaor
WeizmannInstituteofScience,Rehovot,Israel
OscarNierstrasz
UniversityofBern,Switzerland
C.PanduRangan
IndianInstituteofTechnology,Madras,India
BernhardSteffen
UniversityofDortmund,Germany
MadhuSudan
MassachusettsInstituteofTechnology,MA,USA
DemetriTerzopoulos
NewYorkUniversity,NY,USA
DougTygar
UniversityofCalifornia,Berkeley,CA,USA
MosheY.Vardi
RiceUniversity,Houston,TX,USA
GerhardWeikum
Max-PlanckInstituteofComputerScience,Saarbruecken,Germany

Rogério de Lemos
Cristina Gacek
Alexander Romanovsky (Eds.)
Architecting
Dependable
Systems II
1 3
VolumeEditors
RogériodeLemos
UniversityofKent,ComputingLaboratory
Canterbury,KentCT27NF,UK
E-mail:[email protected]
CristinaGacek
AlexanderRomanovsky
UniversityofNewcastleuponTyne,SchoolofComputingScience
NewcastleuponTyne,NE17RU,UK
E-mail:{Cristina.Gacek,Alexander.Romanovsky}@ncl.ac.uk
LibraryofCongressControlNumber:2004113649
CRSubjectClassification(1998):D.2,D.4
ISSN0302-9743
ISBN3-540-23168-4SpringerBerlinHeidelbergNewYork
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting,
reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965,
initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer.Violationsareliable
toprosecutionundertheGermanCopyrightLaw.
SpringerisapartofSpringerScience+BusinessMedia
springeronline.com
©Springer-VerlagBerlinHeidelberg2004
PrintedinGermany
Typesetting:Camera-readybyauthor,dataconversionbyOlgunComputergrafik
Printedonacid-freepaper SPIN:11314646 06/3142 543210
Foreword
Enforcing the dependability of software systems has been a very active and produc-
tive area of research for over 30 years, addressing support for fault prevention, fault
tolerance,faultremovalandfaultforecasting.Suchanefforthasinparticularledtoin-
troducinganumberofdependabilityconcepts,andrelatedprincipledmethodsandtools
guidingthestructuringofdependablesystems,andfurtherallowingreasoningaboutthe
systems’dependability.Assuch,researchresultsinthedependabilityareaimpactupon
the overall software development process. However, dependability has for long been
consideredasanasidepropertyinthedevelopmentofsoftwaresystems,exceptforspe-
cificclassesofsystemssuchassafety-criticalsystemsthatcannottolerateunexpected
behaviorfollowingtheoccurrenceoffailures.
The increasing reliance on software systems that are now surroundingour every-
day’s life, being embedded in most devices, and providing us with access to a huge
amountofcontentandservicesviatheInternet,makesdependabilityaprimerequire-
mentfortoday’ssystems.Inparticular,dependabilityrequirementsshouldbeaccounted
for in the early phase of the developmentprocess, since dependabilitymeans signifi-
cantlyimpactdesignchoices.Inthiscontext,architecturalmodellingofsoftwaresys-
temsoffersmuchbenefittowardsassistingthedesignofdependablesystemsandassess-
ingtheirdependability.Byabstractingthelow-leveldetailsofthesystem,architectural
modellingallowseffectiveexploitationofformalmethodsforreasoningaboutthesys-
tems’behavior,whichconstitutesakeydependabilitymeans.Architecturalmodelling
furtherallowsdeveloperstocomprehensivelydealwithdependabilityrequirementsin
thestructuringoftheirsystems.
Bringing together researchers from the dependability and software architecture
communities, via dedicated workshopsand bookson improvementto the state of the
artonarchitectingdependablesystems,canonlybeacknowledgedasavaluableeffort
towardselicitingarchitecturemodellinglanguages,methodsandtoolsthatsupportthe
thorough development of dependable software systems. This book, the second of an
undoubtedlypromising series, introduces research results that show how dependabil-
ityandsoftwarearchitectureresearchconvenientlycomplementandbenefitfromeach
other,addressingspecificsystemarchitectingfordependability,integrationoffaulttol-
erancemeanswithsoftwarearchitecture,andarchitecturemodellingfordependability
analysis.Lastbutnotleast,reportsonindustrialexperiencehighlighthowsuchaneffort
meetsindustrialpracticesindependablesoftwaresystemdevelopment.Asaresult,the
breadthand depth of the coveragethatis providedby this bookon recentresearchin
architectingdependablesystemsisparticularlyimpressive,andtheeditorsandauthors
aretobecongratulated.
June2004 Vale´rieIssarny
INRIA
ResearchUnitofRocquencourt

Preface
Systemdependabilityisdefinedasreliancethatcanbejustifiablyplacedontheservice
deliveredbythesystem.Ithasbecomeanessentialaspectofcomputersystemsasev-
erydaylife increasinglydependson software. It is thereforea matter for concernthat
dependabilityissuesareusuallyleftuntiltoolateintheprocessofsystemdevelopment.
This is why, even though there is a large body of research on dependability, reason-
ingaboutdependabilityatthearchitecturallevelisonlyjustemergingasanimportant
theme.Itisathemethatneedstobeactivelypursuedsincearchitecturalrepresentations
havebeenshowntobeeffectiveinhelpingtounderstandbroadersystemcharacteristics
by abstractingawayfromdetails. Apartfromthis, thereare otherfactorsthatmake it
urgent to consider dependability at the architectural level, such as the complexity of
emergingapplicationsandtheneedforbuildingtrustworthysystemsfromtheexisting
untrustworthycomponents.
This book comes as a result of an effort to bring together the research commu-
nities of software architectures and dependability. It was inspired by the ICSE 2003
Workshop on Software Architectures for Dependable Systems (WADS 2003), where
many interesting papers were presented and lively discussions took place. The book
addressesissuesthatarecurrentlyrelevanttoimprovingthestateoftheartinarchitect-
ingdependablesystems.Itpresentsaselectionofpeer-reviewedpapersstemmingfrom
some originalWADS 2003 contributionsand several invited ones. The book consists
offourparts:architecturesfordependability,faulttolerancein softwarearchitectures,
dependabilityanalysisinsoftwarearchitecture,andindustrialexperience.
The first part of this book focuses on software architecturesfor dependability.Its
first paper, by Koutsoukos, Loureno, Avillez, Gouveia, Andrade, Fiadeiro, and Wer-
melinger,isentitled“EnhancingDependabilityThroughFlexibleAdaptationtoChang-
ing Requirements”. This paper describes an architectural approach that relies on co-
ordination contracts to facilitate the dynamic adaptation of systems to changing do-
main rules. The approach is illustrated through a case study in the financial systems
area, where agreed policies and conditions are negotiated on a case-by-case basis.
The paper concludes by reporting on an information system that ATX Software de-
velopedfor a companyspecialized in recoveringbad credit. The second paperin this
part is “A Self-optimizing Run-Time Architecture for Configurable Dependability of
Services” by Tichy and Giese. In this paper, Tichy and Giese identify a set of ar-
chitectural principles that can be used to improve the dependability of service-based
architectures. These architectural principles have been instantiated by extending Jini,
andhavebeenevaluatedqualitativelyandquantitativelyforaconfigurationofmultiple
identical services, showing how the different parameters affect the resulting depend-
ability. The paper by Knight and Strunk on “Achieving Critical System Survivability
Through Software Architectures” addresses the idea of making a system survivable
rather than highly reliable or highly available by exploringthe motivationfor surviv-
ability,howitmightbe used,whattheconceptmeansin a preciseand testablesense,
andhowitisbeingimplementedintwoverydifferentapplicationareas.Thesubsequent
VIII Preface
paper is authoredby Rodrigues, Roberts and Emmerich.It is on “Reliability Support
forthe ModelDrivenArchitecture”andelaboratesonhowtheprovisionofreliability
can be suitablyrealizedthroughModelDrivenArchitectures(MDA).Itis based ona
platform-independentreference model that can be mapped to specific platforms. The
UMLmetamodelinglanguageisextendedtoshowhowdesignprofileelementsreflect
on the deployment of the components when transformation rules are applied to the
model. The last paper in this part, “Supporting Dependable Distributed Applications
Through a Component-Oriented Middleware-Based Group Service” by Saikoski and
Coulson,presentsagroup-basedmiddlewareplatformthataimsatsupportingflexibility
forcontrolledredundancy,replication,andrecoveryofcomponentsandservices.This
flexibilityisprovidedatdesigntime,deploymenttimeandrun-time.Theirapproachis
basedonconceptsofsoftwarecomponenttechnologyandcomputationalreflection.
Thesecondpartofthisbookisrelatedtofaulttoleranceinsoftwarearchitectures.
Inthefirstpaper,“ArchitectingDistributedControlApplicationsBasedon(Re-)Con-
figurable Middleware”, Deconinck, De Florio and Belmans introduce the DepAuDE
architecturedevelopedforindustrialdistributedautomationapplications.Thisarchitec-
ture provides a fault tolerance middleware, a library for error detection and recovery
andfaulttreatments,andaspecializedlanguagecalledARIELforspecifyingfaulttol-
eranceandconfigurationactions.Thepaperconcludeswithathoroughdiscussionofa
case study: a demonstratorof a Primary Substation Automation System controllinga
substationfor electricity distribution.The secondpaperof thispartis entitled “A De-
pendableArchitectureforCOTS-BasedSoftwareSystemsUsingProtectiveWrappers”.
Theauthors,Guerra,Rubira,RomanovskyanddeLemos,combinetheconceptsofan
idealizedarchitecturalcomponentandprotectivewrappersto developan architectural
solution that provides an effective and systematic way for building dependable soft-
waresystemsfromCOTSsoftwarecomponents.TheapproachisevaluatedusingaPID
controllercasestudy.Thenextpaperentitled“AFrameworkforReconfiguration-Based
Fault-ToleranceinDistributedSystems”isco-authoredbyPorcarelli,Castaldi,DiGian-
domenico,BondavalliandInverardi.Inthisframeworkfaulttoleranceofcomponents-
based applications is providedby detecting failures using system monitoring, and by
recoveryemployingsystemreconfiguration.TheframeworkisbasedonLira,anagent
distributedinfrastructureemployedforcomponentandapplicationlevelmonitoringand
reconfiguration,anda decisionmakerused forselectingnewconfigurationsusing the
feedbacksprovidedbytheevaluationofstochasticPetrinetmodels.Inthenextpaper,
“OnDesigningDependableServiceswithDiverseOff-The-ShelfSQLServers”,Gashi,
Popov,StankovicandStriginiargue,basedonempiricalresultsfromtheirongoingre-
searchwithdiverseSQLservers,infavorofdiverseredundancyasawayofimproving
dependabilityandperformanceofaSQLserver.Thepaperprovidesevidencethatcur-
rentdatareplicationsolutionsareinsufficienttoprotectagainsttherangeoffaultsdocu-
mentedfordatabaseservers,outlinespossiblefault-tolerantarchitecturesusingdiverse
servers, discusses the design problems involved, and offers evidence of performance
improvementthroughdiverseredundancy.The last paper of parttwo, “A New Model
andaDesignApproachtoBuildingQualityofService(QoS)AdaptiveSystems”,isco-
authored by Ezhilchelvan and Shrivastava. The focusis on developingInternet-based
servicesprovisioningsystems.Theauthorsproposeasystemarchitectureandidentify
Preface IX
a model appropriate for developing distributed programs that would implement such
systems.Theprobabilisticasynchronousmodelproposedabstractsthenetworkperfor-
manceanddependabilityguaranteestypicallyofferedbytheInternetserviceproviders.
ThesystemarchitectureprescribestheroleofQoSmanagementalgorithmstobe:eval-
uatingthefeasibilityofQoSrequestsfromtheendusersandadaptingsystemprotocols
inresponsetochangesintheenvironment.
Partthreeofthisbookdealswithdependabilityanalysisinsoftwarearchitectures.
Inthefirstpaper,whichisentitled“Multi-viewSoftwareComponentModelingforDe-
pendability”,the authorsRoshandeland Medvidovicfocus on a more comprehensive
approach for modelling components. Instead of relying just on the description of the
componentsinterfaces,and their respectivepre- and post-conditions,the authorspro-
pose an approach to modelling components using four primary functional aspects of
a software component(knownas the Quartet):interface, static behavior,dynamicbe-
havior,andinteractionprotocol.Inadditiontodescribingindividuallythefouraspects,
thepaperalsodiscussestherelationshipsbetweenthemforensuringtheircompatibil-
ity.Thegoaloftheworkistoobtainsupportforthearchitectural-levelmodellingand
analysisofsystemdependability,inparticular,reliability.Thesecondpaper,“Quantifi-
able Software Architecturefor DependableSystems of Systems” by Liang, Puett and
Luqipresentsanapproachforthe developmentandevolutionofdependablesystems-
of-systems. Based on the architectural description of these systems, the approach in-
volvesestablishingconsensusbetweenthedifferentdependabilityattributesassociated
with component systems, and translating them into quantifiable constraints. The ap-
proachillustratesthatwithreusablearchitecturalfacilitiesandassociatedtoolssupport,
the quantifiable architecturewith multiple perspectivescan be effective in supporting
theengineeringofdependablesystems-of-systems.Inthelastpaperofthispart,which
is entitled “Dependability Modeling of Self-healing Client-Server Applications”, the
authors Das and Woodside present an analytical model for evaluating the combined
performanceanddependabilityattributesoffault-tolerantdistributedapplications.The
authorsconsideralayeredsoftwarearchitectureinwhichtheapplicationandmanage-
mentcomponentscanfailandberepaired.Italsoconsidersthemanagementofconnec-
tions,andtheapplication’slayeredfailuredependencies,togetherwiththeapplication
performance.Inordertoshowthecapabilityoftheapproachinevaluatinglarge-scale
systems,theauthorsapplytheiranalyticalmodeltoanairtrafficcontrolsystem.
Thefinalpartofthebookcontainstwopapersthatreportonexistingindustrialex-
periencesinvolving dependabilityin the contextof software architectures. In the first
paper, entitled “A Dependable Platform for IndustrialRobots”, the authorsMustapic,
Andersson,Norstro¨mandWalldiscussthedesignofanopensoftwareplatformforan
ABBRoboticSystem.Forthema softwareplatformisthebasisforaproduct-linear-
chitecturethataimstoincreasethenumberofvariationsbetweenthedifferentsoftware
systems,whilemaintainingtheintegrityofthewholeroboticsystem.Aninitialstepin
theirapproachis tomodelatthearchitecturallevelthequalityconstraintsofthe plat-
form,whichincludeseveraldependabilityattributes.Thesecondpaperofthisfinalpart,
“ModelDrivenArchitecture anIndustryPerspective”byRaistrickandBloomfield,dis-
cussessomeoftheresearchworkthatiscurrentlybeingundertakenwithintheavionics
industryontheusageofModelDrivenArchitectures(MDA),aninitiativeoftheObject
X Preface
ManagementGroup(OMG).IthasbeenrecognizedthattheMDAapproachmightbe-
comefundamentalinreducingcostsinthedevelopmentandmaintenanceofsoftware.
TheauthorsofthispaperidentifyseveralfrontsinwhichtheusageoftheMDAmightbe
effective.Theseare:theautomationofsoftwaredevelopmentwiththesupportoftools,
themanagementoflegacysystems, themappingofavionicapplicationsintostandard
modularcomputersystems,andtheincrementalcertificationofavionicssystems.
We believe that the introduction of the topic of architecting dependable systems
is very timely and that work should continue in this area. The first book of the same
title, published in the summer of 2003, included expanded papers based on selected
contributionstotheWADSICSE2002workshopandanumberofinvitedpapers.The
forthcomingICSE/DSN2004TwinWorkshopsonArchitectingDependableSystemsis
anotherambitiousproject,whichaimstopromotecross-fertilizationbetweenthecom-
munitiesofsoftwarearchitecturesanddependability.
Aseditorsofthisbook,we arecertainthatitscontentswillprovevaluableforre-
searchersintheareaandaregenuinelygratefultothemanypeoplewhomadeitpossi-
ble.Ourthanksgototheauthorsofthecontributionsfortheirexcellentwork,theWADS
2003participantsfortheir activesupportandlivelydiscussions, andAlfredHofmann
fromSpringer-Verlagforbelievingintheideaofthisbookandhelpingustogetitpub-
lished. Last but not least, we appreciate the time and effort our reviewers devoted to
guaranteeing the high quality of the contributions. They are D. Akehurst, T. Bloom-
field,A. Bondavalli,F.V. Brasileiro,M. Castaldi,G. Deconinck,F. DiGiandomenico,
M.Correia,G.Coulson,I.Crnkovic,S.Crook-Dawkins,W. Emmerich,J.L.Fiadeiro,
G. Fohler, P. Inverardi, V. Issarny, J. Knight, N. Levy, N. Medvidovic, C. Norstrom,
A. Pataricza, P. Popov, S. Riddle, G. Roberts, C.M.F. Rubira, S. Shrivastava, F. van
der Linden, P. Ver´ıssimo, M. Wermelinger, C.M. Woodside, and several anonymous
reviewers.
June2004 Roge´riodeLemos
CristinaGacek
AlexanderRomanovsky