An I dealized Fault-Tolerant Architectural Component Paulo Asterio - PowerPoint PPT Presentation

Workshop on Architecting Dependable Systems Orlando, FL – May, 25th 2002 An I dealized Fault-Tolerant Architectural Component Paulo Asterio de C. Guerra Cecília Mary F. Rubira Insituto de Computação Universidade Estadual de Campinas, Brazil Rogério de Lemos Computing Laboratory University of Kent at Canterbury, UK 1

Motivation � Reliable Component-Based Systems Reliable System Unreliable Components Fault Tolerant Architecture 2

Objectives � To apply the concept of “idealized fault tolerant component” for describing fault-tolerant component-based systems, at the architectural level. � C2 architectural style � Heterogeneous COTS � Broadcasting of asynchronous messages 3

The Idealized Fault-Tolerant Component Request Normal Interface Failure Internal Response Exception Exception Exception Normal Behaviour iFTC Abnormal Behaviour Request Normal Interface Failure Return to Response Exception Exception Normal 4

The C2 Architectural Style Component Notification Connector Request 5

Proposed Architecture � An idealized C2 component (iC2C) � Structure and behaviour as defined by the idealized fault-tolerant component (iFTC). � Fully compliant with the C2 style rules. 6

Overall Structure iC2C_top Normal Normal NormalActivity behaviour & behaviour & Error detection Error detection iC2C_internal Error diagnosis Error diagnosis & recovery & recovery AbnormalActivity iC2C_bottom 7

Overall Structure iC2C_top State based State based NormalActivity message message routing routing iC2C_internal AbnormalActivity Serializes Serializes requests requests iC2C_bottom 8

Request Service Normal Message Flow NormalActivity iC2C_internal iC2C_bottom iC2C_top AbnormalActivity 9

Response Normal Normal Message Flow NormalActivity iC2C_internal iC2C_bottom iC2C_top AbnormalActivity 10

Normal Message Flow NormalActivity iC2C_internal iC2C_bottom iC2C_top AbnormalActivity 11

Abnormal Message Flow iC2C_top External Exception Internal NormalActivity Exception iC2C_internal iC2C_internal AbnormalActivity iC2C_bottom 12

Abnormal Message Flow iC2C_top NormalActivity Return to iC2C_internal iC2C_internal Normal normal Response AbnormalActivity Failure Exception iC2C_bottom 13

The NormalActivity Component normal_top iC2C_top NormalActivity Collaborating iC2C_internal BasicNormal Component AbnormalActivity iC2C_bottom Implements normal_bottom operations Coordinates Coordinates Pre- and post-conditions error detection error detection checking 14

The NormalActivity Component normal_top Collaborating BasicNormal Component normal_bottom Evaluates pre- Evaluates pre- Stores Stores condition condition request request 15

The NormalActivity Component normal_top Collaborating BasicNormal Component normal_bottom Accepts the Interface Accepts the Interface request Exception request Exception (or) 16

C2 Integration iC2C_top NormalActivity iC2C_internal C2 Comp AbnormalActivity iC2C_bottom iC2C_top NormalActivity C2 Comp iC2C_internal AbnormalActivity iC2C_bottom 17

C2 Integration iC2C_top iC2C_top NormalActivity NormalActivity iC2C_internal AbnormalActivity iC2C_bottom iC2C_internal AbnormalActivity iC2C_bottom 18

Example – Mine Pump Control System � Fault Model � Transient faults affecting pump � Error Detection � Test water flow sensor (reliable) � Error Recovery � Retry operation 19

Subsystem Configuration LowWater Sensor PumpControl Station conn2 conn1 conn3 Pump Ideal as an iC2C Structured 20

Ideal Pump Structure iP_top PumpNormal Pump_Normal_top WaterFlow Pump Sensor Pump_Normal_bottom iP_internal Test Water Flow Sensor after pump Recover by PumpAbnormal on / off operation. retry. iP_bottom 21

Normal pumpOn iP_top Pump_Normal_top WaterFlow Pump Sensor pumpOn notification Pump_Normal_bottom iP_internal PumpAbnormal pumpOn iP_bottom request 22

Normal pumpOn iP_top Pump_Normal_top test sensor WaterFlow Pump status Sensor Pump_Normal_bottom iP_internal send PumpAbnormal notification iP_bottom 23

Error Detection iP_top test sensor status Pump_Normal_top WaterFlow raises internal Pump Sensor exception Pump_Normal_bottom iP_internal iP_internal PumpAbnormal iP_bottom 24

Error Recovery iP_top Pump_Normal_top WaterFlow successfull Pump Sensor pumpOn notification Pump_Normal_bottom retry iP_internal iP_internal pumpOn return to normal PumpAbnormal send notification iP_bottom 25

Main Results � Idealized fault-tolerant component concept applied at the architectural level of C2 style systems � Results may be adapted for other styles of the “interacting processes style category” 26

Work in Progress � Idealized C2 connector � FTC2 java framework 27

Contact Information Paulo Asterio de Castro Guerra asterio@ic.unicamp.br Cecília Mary F. Rubira cmrubira@ic.unicamp.br Rogério de Lemos r.delemos@ukc.ac.uk 28

Implementation Issues Asynchronicity Implicit Invocation Multiple notifications 29

Asynchronicity iC2C_top NormalActivity Synchronous Synchronous channels with channels with iC2C_internal higher priority higher priority AbnormalActivity Service iC2C_bottom Request 30

Implicit Invocation Notification iC2C_top with i.i. NormalActivity iC2C_internal Mutual Mutual AbnormalActivity exclusion exclusion protocol protocol Service iC2C_bottom Request 31

Multiple Notifications normal_top Collaborating BasicNormal Component normal_bottom Stores Stores Stores Stores Evaluates Evaluates notifications notification notifications notification post-condition post-condition 32