1. MDDPro: Model-Driven Dependability Provisioning in Enterprise Distributed Real-time and Embedded Systems Sumant Tambe* Jaiganesh Balasubramanian Aniruddha Gokhale Thomas Damiano Vanderbilt University, Nashville, TN, USA Contact : *sutambe@dre.vanderbilt.edu*sutambe@dre.vanderbilt.edu This work is supported by subcontracts from LMCO & BBN International Service Availability Symposium (ISAS) 2007 May 21-22, 2007, University of New Hampshire, Durham, New Hampshire, USA

2. 2 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Component-based Enterprise DRE Systems  Characteristics of component-based enterprise DRE systems  Applications composed of one or more “operational string” of services or systems of systems  Simultaneous QoS (Availability, Time Critical) requirements  Dynamic (re)-deployment of components into operational strings  Examples of Enterprise DRE systems  Advanced air-traffic control systems  Continuous patient monitoring systems Goal: Simplify and automate Fault- Tolerance provisioning in the DRE systems

3. 3 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Fault-Tolerance Design Considerations in DRE Systems  Per-component concern – choice of implementation  Depends of resources, compatibility with other components in assembly  Availability concern – what is the degree of redundancy? What replication styles to use? Does it apply to whole assembly?  Failure recovery concern – what is the unit of failover?  State synchronization concerns – What is data-sync rate?  Deployment concern – how to place components? Minimize failure risk to the system

4. 4 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Tangled Fault-Tolerance Concerns Separation of Concerns using higher level abstractions is the key  Implementation determines replication style and vice-versa  Replication degree affects resources and deployment  Replication style determines state synchronization style  Availability of domain artifacts determines deployment  Significant sources of variability that affect end-to-end QoS (performance + availability) Design-timeDeployment-timeRun-time

5. 5 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Model-Driven Engineering – A Promising Approach  Higher level of abstraction than third generation programming languages  Modeling each concern separately alleviates system complexity  Deployment model  Component assembly model  System structural model  Different QoS models  e.g., Fault-tolerance  Generative and model transformation techniques to weave in appropriate glue code ComplexSystem

6. 6 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Fault-tolerance Modeling Abstractions in MDDPro  Fail-over Unit (FOU): Abstracts away details of granularity of protection (e.g., Component, Assembly, App-string)  Replica Group (RPG): Abstracts away fault- tolerance policy details (e.g., Active/passive replication, rate and topology of state- synchronization)  Shared Risk Group (SRG): Captures associations related to failure risk. (e.g., shared power supply among processors, shared LAN) Protection granularity concerns State-synchronization concerns Component Placement constraints Replica Distance Metric Interpreter (component placement constraint solver): Encapsulates an algorithm for component- node assignment based on replica distance metric CQML (Component QoS Modeling Language) A DSML in the CoSMIC tool suite

7. 7 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Fault-Tolerance Model in CQML CQML (Component QoS Modeling Language)  A graphical QoS modeling language on top of a system composition language (e.g., PICML)  Enhances system structure with QoS annotations (e.g., FOUs for granularity of protection)  A FOU itself is a model and captures heartbeat frequency and replication groups  A Replication group captures per component replication style, data synchronization rate

8. 8 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 container/component server “Client” primary IOR Primary FOU A BC Fail-over Unit Example container/component server Replica FOU A’ B’ C’ secondary IOR container/component server Primary Component Replica Component

9. 9 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007DataCenter1_SRG DataCenter2_SRG Rack1_SRGRack2_SRG Node1(blade31) Node2(blade32) Shelf1_SRG Shelf2_SRG Blade30 Ship_SRG Blade34Blade29 Shelf1_SRG Blade36Blade33 Shared Risk Group Example

10. 10 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 R1 P R2 R3 Define N orthogonal vectors, one for each of the distance values computed for the N components (with respect to a primary) and vector- sum these to obtain a resultant. Compute the magnitude of the resultant as a representation of the composite distance captured by the placement. Formulation of Replica Placement Problem 1.Compute the distance from each of the replicas to the primary for a placement. 2.Record each distance as a vector, where all vectors are orthogonal. 3.Add the vectors to obtain a resultant. 4.Compute the magnitude of the resultant. 5.Use the resultant in all comparisons (either among placements or against a threshold) 6.Apply a penalty function to the composite distance (e.g. pair wise replica distance or uniformity)

11. 11 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007Node2(blade32) Shelf1_SRG Ship_SRG Blade34Blade36 Composite Distance Blade30 Node1(blade31) DataCenter2_SRG DataCenter1_SRG Rack1_SRGRack2_SRG Shelf1_SRG Shelf2_SRG Blade29Blade33 Component Placement Example using SRGs Replica 1 Replica 2 Replica 3 Primary

12. 12 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 5. Distance-based constraint algorithm determines replica placement in deployment descriptors. GME/PICML 1.Model components and application strings in PICML 2.Model Fail Over Units (FOUs) and Shared Risk Groups (SRGs) 3.Determine deployment of primary components 4.Interpreter automatically injects replicas and associated CCM IOGRs FT Modeling & Generative Steps Model Information Domain, Deployment, SRG, and FOU injection Replica Placement Algorithm model FT Interpreter Augmented Deployment Plan

13. 13 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Fault-Tolerance Model in CQML (1/2) Replica = 3 Min Distance = 4

14. 14 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Shared Risk Group Model in CQML Shared Risk Group 1

15. 15 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Generative Capabilities for Provisioning FT  Automatic Injection of replicas  Augmentation of deployment plan based on number of replicas  Automatic Injection of FT infrastructure components  E.g. Collocated “heartbeat” (HB) component with every protected component.  Automatic Injection of connection meta-data  Specialized connection setup for protected components (e.g. Interoperable Group References IOGR) HB Container M x N

16. 16 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 container/component server FPC “client” periodic FPC heartbeat primary IOR Primary FOU A HB container/component server B C Replica FOU A’ container/component server B’ container/component server C’ secondary IOR IOGR FPC HB intra-FOU heartbeat HB Example of Automated Heartbeat Component Injection Primary Component Replica Component Collocated heartbeat component Connection Injection

17. 17 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Future Work  Developing advanced constraint solver algorithms to incorporate multiple dimensions of constraints in component placement decision (e.g. resources, communication latency)  Optimizing the number of generated heartbeat components for collocated, protected application components.  Enhancing the DSL and the tools to capture the configurability required by the new Lightweight RT/FT CORBA specification.  e.g. Enhancing the model interpreter to support a wide spectrum of established fault-tolerance mechanisms  Enhancing working prototypes and evaluating them in representative DRE systems HB Container Configurable FT Infrastructure

18. 18 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Concluding Remarks  Model-Driven Engineering separates dependability concerns from other system development concerns  Separation of concerns helps alleviate system complexity  Model-based generative capabilities “compile” FT infrastructure (e.g. heartbeat components and connections) during model interpretation time and synthesize meta-data Tools available for download from www.dre.vanderbilt.edu/cosmic www.dre.vanderbilt.edu/CIAO

19. 19 Sumant Tambe, et. al MDDPro: MDE-based DependabilityISAS 2007 Questions?