Steven Nordstrom

Systems integration of large scale autonomic systems using multiple domain specific modeling languages

Software design, development and maintenance for large scale systems has been one of the most difficult and expensive phases of the software development life cycle. Design and maintenance is especially difficult when the system includes autonomic features. As the system size and variety of autonomic behaviors scale up, it increases the chance of many unexpected and unwanted interactions. Separate design tools can hide these potential interactions. To face these challenges, we propose an autonomic system integration platform where holistic design models capture system structure, target system resources, and autonomic behavior. The fault mitigative, autonomic behavior can be explicitly coupled to the components and underlying resources of the system. System generation technology is used to create the software that implements these coupled specifications, including communication between components with custom data type marshalling and demarshalling, system startup and configuration, fault tolerant behavior, and autonomic procedures for self-correction. This modeling schema, along with the tools to generate the various system components are described in this paper.

Modeling and generation tools for large-scale, real-time embedded systems

High energy physics experiments require very large, real-time computation. Furthermore, the computers that implement on-line processing must be very reliable, due to the large cost of operating the facilities and the potential for loss of irreplaceable data. Standard, redundant fault tolerance approaches are not appropriate due to system costs (Fault handling is limited to 10% overhead). Adaptive, fault-mitigation approaches must be used instead. In this paper, we describe a set of tools for specifying and implementing user-defined adaptation algorithms, using model-based representation for specification and software synthesis for implementation.

Autonomic fault mitigation in embedded systems

Autonomy, particularly from a maintenance and fault-management perspective, is an increasingly desirable feature in embedded (and non-embedded) computer systems. The driving factors are several-including increasing pervasiveness of computer systems, cost of failures which could potentially be catastrophic in a wide variety of critical systems, and increasing cost and strain on resources in maintaining systems. A trigger system employed in real-time filtering of particle-collision data is a particularly challenging example of a class of large-scale real-time embedded systems that demand a high degree of fault resilience, due to the large cost of operating the facilities and the potential for loss of irreplaceable data. Traditional redundancy-based approaches are not available due to the limited fault-tolerance budget above the system cost. This paper presents an approach based on model integrated computing that provides a set of tools for the system developer to specify, simulate, and synthesize autonomous fault-mitigative behaviors. A hierarchical, role-based organization of fault managers cleanly delineates the data-processing interactions in the system from the fault-mitigative control interactions. The fault-mitigative behaviors, analogous to autonomous biological systems, are characterized as (1) reflex actions-highly autonomous, localized, and uncoordinated response emanating from a single fault manager at any level of hierarchy, and (2) healing actions-highly coordinated behavior implemented with a sequence of interactions between multiple fault managers. The strength of the approach lies in the specification of these behaviors as coordinated interacting hierarchical concurrent finite-state machines, which makes these behaviors formally analyzable.

Towards a Verifiable Real-Time, Autonomic, Fault Mitigation Framework for Large Scale Real-Time Systems

Designing autonomic fault responses is difficult, particularly in large-scale systems, as there is no single ‘perfect’ fault mitigation response to a given failure. The design of appropriate mitigation actions depend upon the goals and state of the application and environment. Strict time deadlines in real-time systems further exacerbate this problem. Any autonomic behavior in such systems must not only be functionally correct but should also conform to properties of liveness, safety and bounded time responsiveness. This paper details a real-time fault-tolerant framework, which uses a reflex and healing architecture to provide fault mitigation capabilities for large-scale real-time systems. At the heart of this architecture is a real-time reflex engine, which has a state-based failure management logic that can respond to both event- and time-based triggers. We also present a semantic domain for verifying properties of systems, which use this framework of real-time reflex engines. Lastly, a case study, which examines the details of such an approach, is presented.

Replicators: transformations to address model scalability

In Model Integrated Computing, it is desirable to evaluate different design alternatives as they relate to issues of scalability. A typical approach to address scalability is to create a base model that captures the key interactions of various components (i.e., the essential properties and connections among modeling entities). A collection of base models can be adorned with necessary information to characterize their replication. In current practice, replication is accomplished by scaling the base model manually. This is a time-consuming process that represents a source of error, especially when there are deep interactions between model components. As an alternative to the manual process, this paper presents the idea of a replicator, which is a model transformation that expands the number of elements from the base model and makes the correct connections among the generated modeling elements. The paper motivates the need for replicators through case studies taken from models supporting different domains.

Model replication: transformations to address model scalability

This paper presents a variation of the visitor pattern which allows programmers to write visitor-like code in a concise way. The Runabout is a library extension that adds a limited form of multi-dispatch to Java. While the Runabout is not as expressive as a general multiple dispatching facility, the Runabout can be significantly faster than existing implementations of multiple dispatch for Java, such as MultiJava. Unlike MultiJava, the Runabout does not require changes to the syntax and the compiler. This paper illustrates how to use the Runabout, details its implementation and provides benchmarks comparing its performance with other approaches. Furthermore, the effect of an automatic static program transformation tool that translates bytecode using the Runabout to equivalent bytecode is evaluated. The tool uses double dispatch and runtime-type checks to achieve the same semantics that the Runabout has. The performance comparisons on large benchmarks that make extensive use of multiple dispatch show that using the Runabout does not result in a significant loss of performance for realistic applications and that, depending on the application and platform, small performance gains are also possible. Copyright

ANEMIC: automatic interface enabler for model integrated computing

A domain-specific language provides domain experts with a familiar abstraction for creating computer programs. As more and more domains embrace computers, programmers are tapping into this power by creating their own languages fitting the particular needs of the domain. Graphical domain-specific modeling languages are even more appealing for non-programmers, since the modeling language constructs are automatically transformed into applications through a special compiler called a translator. The Generic Modeling Environment (GME) at Vanderbilt University is a meta-programmable modeling environment. Translators written to interface with GME models typically use a domain-independent API. This paper presents a tool called ANEMIC that generates a domain-specific API for GME translators using the same metamodel that generates the language.

Modeling reflex-healing autonomy for large-scale embedded systems

High-energy physics experiments require an extraordinary amount of real-time computation, and the computers implementing the online data processing must be very reliable because of the large cost associated with operating the facilities and the potential for loss of irreplaceable data. Conventional redundancy-based fault tolerance and adaptive approaches are not appropriate because of the tremendous system cost (fault tolerance is limited to a maximum of 10% overhead). In this work, we developed a framework for building robust embedded systems, which utilizes an autonomic reflex-healing approach to achieve fault tolerance. Components of the framework implement user-defined failure adaptation strategies within the context of a large-scale embedded environment. The tools embrace a model-based approach combining design specification and code-generation for both simulation and system implementation. In this paper we present the concepts and entities of the reflex and healing framework

RTES demo system2004

The RTES Demo System 2004 is a prototype for reliable, fault-adaptive infrastructure applicable to commodity-based dedicated application computer farms, such as the Level 2/3 trigger for the proposed BTeV high energy physics project. This paper describes the prototype, and its demonstration at the 11th IEEE Real Time and Embedded Technology Applications Symposium, RTAS 2005.

The action language: refining a behavioral modeling language

When modeling large-scale complex system behavior we believe there is merit in abandoning the once fashionable all-encompassing system modeling approach in favor of developing a set of models created in a variety of loosely coupled modeling languages. Loosely coupled languages are those that are considered to be nearly orthogonal with respect to their intention, but in reality may display a limited degree of trivial dependencies. We apply this approach toward component behavioral modeling to show how core behaviors of software components can be specified using a statecharts-like behavioral modeling language while elements of the behavior associated with implementation- or platform-specific concepts are modeled using a wholly separate language.