Olivier Gruber

Robust reconfigurations of component assemblies

In this paper, we propose a reconfiguration protocol that can handle any number of failures during a reconfiguration, always producing an architecturally-consistent assembly of components that can be safely introspected and further reconfigured. Our protocol is based on the concept of Incrementally Consistent Sequences (ICS), ensuring that any reconfiguration incrementally respects the reconfiguration contract given to component developers: reconfiguration grammar and architectural invariants. We also propose two recovery policies, one rolls back the failed reconfiguration and the other rolls it forward, both going as far as possible, failure permitting. We specified and proved the reconfiguration contract, the protocol, and recovery policies in Coq.

Ownership-Based isolation for concurrent actors on multi-core machines

The deep copy of messages that traditionally ensures the memory isolation of actors severely hinders the performance of actor systems on multi-core machines. Several approaches have been proposed in the state of the art to circumvent this overhead, but they require to choose two properties out of the three desired ones: safety, programmability, and efficiency. In this paper, we introduce a novel runtime ownership model that supports the first memory isolation model of actors with these three properties--it is safe, developer-friendly, and efficient.

Self-adapting service level in Java enterprise edition

Application servers are subject to varying workloads, which suggests an autonomic management to maintain optimal performance. We propose to integrate in the component-based programming model often used in current application servers the concept of service level adaptation, allowing some components to dynamically degrade or upgrade their level of service. Our goal is to be able, under heavy workloads, to trade a lower service level of the most resource-intensive components for a stable performance of the server as a whole. Upgrading or degrading components is autonomously performed through runtime profiling, which is used to estimate the applications hot spots and target adaptations. In addition to finding the best adaptations, this performance profile allows our system to characterize the effects of past adaptations; in particular given the current workload, it is possible to estimate if a service level upgrade might result in an overload. As a result, by stabilizing the server at peak performance via component adaptations, we are able to drastically improve both overall latency and throughput. For instance, on both the RUBiS1 and TPC-W benchmarks2, we are able to maintain peak performance in heavy load scenarios, far exceeding the initial capacity of the system.

From Autonomic to Self-Self Behaviors: The JADE Experience

Autonomic computing enables computing infrastructures to perform administration tasks with minimal human intervention. This wrap-up paper describes the experience we gained with the design and use of Jade---an architecture-based autonomic system. The contributions of this article are, (1) to explain how Jade provides autonomic management of a distributed system through an architecture-based approach, (2) to explain how we extended autonomic management from traditional self behaviors such as repairing or protecting a managed system to self-self behaviors where Jade also fully manages itself as it manages any other distributed system, (3) to report on our experience reaching self-self behaviors for two crucial autonomic properties, repair and protection.

A robust reconfiguration protocol for the dynamic update of component-based software systems

This paper focuses on the dynamic reconfiguration of component‐based software systems. From a structural point of view, such systems are made of components linked together through their provided and required services, the code of components being defined by modules (e.g., jar files). Today, the ability to reconfigure component‐based systems at runtime faces limitations. Some component frameworks allow to dynamically reconfigure components – starting or stopping them, or changing how they are wired together for instance – but forbid any dynamic evolution of the modules defining their code. Other frameworks allow to dynamically update modules but at the cost of loosing control on component wires, preventing software architects or tools alike to decide how components are wired together. In this paper, we propose a component framework that addresses these limitations through a unified approach for the management of components and modules. Our approach uniquely enables to reconfigure both components and modules at runtime, without restrictions. We prototyped the proposed framework in Java and exercised various dynamic reconfigurations of component‐based systems. Furthermore, we formalized this framework and proved the correctness of its reconfiguration protocol with the Coq proof assistant. Copyright

Full autonomic repair for distributed applications

Grid or cloud environments leverage the need for self‐repair solutions that resist and repair their own failures, something not yet ensured by existing solutions. In this paper, we describe the JADE Autonomic Repair System for legacy applications deployed in a grid or cloud environment. JADE is based on three main design principles. First, legacy applications are wrapped with Java objects, obtaining a uniform set of management operations over the heterogeneous legacy management capabilities. Second, to gain full autonomy, we adopt a replicated design combined with a recursive approach that makes JADE appear to JADE as any distributed application it manages and repairs. Finally, to scale, we rely on tiling the distributed environment and structuring our repair system per tile. To our knowledge, our repair system is the only one that is designed to scale and is fully autonomic, repairing not only the failures of the managed system but also its own. Our repair system has been tested in various realistic scenarios. Copyright