SAVE ORCA Formal Modeling, Safety Analysis, and Verification of - PowerPoint PPT Presentation

SAVE ORCA Formal Modeling, Safety Analysis, and Verification of Organic Computing Applications Hella Seebach , Florian Nafz and Wolfgang Reif

What has happend in the last months? • Software Engineering Guideline for Resource-Flow Systems • Decentral Reconfiguration Mechanism • Verified result checker • Formal model of the agents behavior • New System class: Data-Flow Systems [ATC-2010] 08.10.2010 SAVE ORCA 2

Software Engineering Approach • Why a software engineering guideline? – Clearly defined steps to build a self-organizing system – Reproducible results • Organic Design Pattern for self-organising resource-flow systems – Static aspects and components – Models for the components behavior – Constraints for „good“ system configurations • Restore Invariant Approach • Formal model – Correctness guarantees – Quantitative analysis – Formalization of self-x properties 08.10.2010 SAVE ORCA 3

Software Engineering Guideline (SPEM) • http://guideline.saveorca.isse.de/ [SASO2010] • http://openup.saveorca.isse.de/ 08.10.2010 SAVE ORCA 4

DECENTRAL RECONFIGURATION 08.10.2010 SAVE ORCA 5

Coalition formation • Uses system structure (role structure) • Agents have only local knowledge • Agent who detects a local constraint violation starts a coalition formation • Coalition reconfigures just a small part of the system (task fragment) 08.10.2010 SAVE ORCA 6

Example: Adaptive Production Cell 1 2 3 4 5 Task: Agents: 1-4 1 2 3 4 5 Capabilities: 08.10.2010 SAVE ORCA 7

Capability breaks 3 5 1 3 4 2 1 2 4 Capability to insert engine is broken 08.10.2010 SAVE ORCA 8 8

Coalition formation 3 5 1 3 4 2 1 2 4 Task fragment of coalition: 08.10.2010 SAVE ORCA 9 9

Coalition formation 3 5 1 3 4 2 1 2 4 Agents are now able to reconfigure this part of the system 08.10.2010 SAVE ORCA 10 10

Coalition formation 3 5 1 3 4 2 1 2 4 Edge Agents are needed to establish a correct resource flow 08.10.2010 SAVE ORCA 11 11

Role allocation 1 2 3 Task fragment: Every agent in the coalition changes the role if necessary: 3 4 5    08.10.2010 SAVE ORCA 12 12

Reconfigured system 3 3 5 1 4 1 2 4 2 08.10.2010 SAVE ORCA 13 13

Agent breaks 3 3 4 2 4 1 5 2 7 1 5 I/O-Graph 6 6 RF-Graph Coalition request 08.10.2010 SAVE ORCA 14

Agent breaks 3 3 4 2 4 1 5 2 7 1 5 I/O-Graph 6 6 RF-Graph Coalition request 08.10.2010 SAVE ORCA 15

Running Example 08.10.2010 SAVE ORCA 16

Formal Analysis and Verification • Systematic identification of possible failures that lead to a hazard – Safety Analysis • No collision between agents – Quantitative properties for self-x systems • MTTF, MTBF • Provide a technique to be able to verify properties of systems despite self-x properties – Functional correctness • Correct processing of resources – Behavioral guarantees • Resources eventually will be finished • Reconfiguration is done correctly 08.10.2010 SAVE ORCA 17

Formal Verification • Challenges: – No fixed behavior. Result of a self-x phase unknown – Algorithms/Mechanisms for self-organization are hard to verify – Systems have unknown amount of agents 08.10.2010 SAVE ORCA 18

Formal Verification • Challenges : – No fixed behavior. Result of a self-x phase unknown – Algorithms/Mechanisms for self-organization are hard to verify – Systems have unknown amount of agents Seperation of concerns – Functional system Observer / Controller – Self-x system → RIA - Approach Functional System 08.10.2010 SAVE ORCA 19

Formal Verification • Challenges : – No fixed behavior. Result of a self-x phase unknown – Algorithms/Mechanisms for self-organization are hard to verify – Systems have unknown amount of agents Result Checking − monitors configurations Observer / Controller propagated back to system RC  res  Inv true  Functional System C Inv (res)  else false 08.10.2010 SAVE ORCA 20

Formal Verification • Challenges : – No fixed behavior. Result of a self-x phase unknown – Algorithms/Mechanisms for self-organization are hard to verify – Systems have unknown amount of agents Compositonal Verification − Verification on agent level leads to a global system property − Rely/Gurantee formalism 08.10.2010 SAVE ORCA 21

Rely/Guarantee Formalism • Each agent gives guarantees to its environment about the individual behavior (Guarantee), if it can rely on some properties of the environment (Rely) • Typical Relies: “environment doesn’t change the agents local variables” • “incoming resources have “valid” state” • • Guarantees: • “incoming requests are finally fulfilled” • “resource is produced correctly” “outgoing resources have “valid” state” • G i := ( ￢ isEmpty ( locST [ allocR . prec . port ]) ∧ isEmpty ( locST [ allocR . postc . port ]) → locST = locST ′ ∨ ( locST [ allocR . prec . port ]. state = allocR . prec . state ∧ locST [ allocR . prec . port ]. task = allocR . prec . task ∧ locST ′[ allocR . prec . port ]. state := locST ′[ allocR . prec . port ]. state + allocR . capToApp ) ∨ ( locST [ allocR . prec . port ]. state = allocR . postc . state ∧ locST [ allocR . prec . port ]. task = allocR . postc . task ∧ locST ′[ allocR . postc . port ] := locST [ allocR . prec . port ] ∧ locST ′[ allocR . prec . port ] := ⊥ ) 08.10.2010 SAVE ORCA 22

Rely/Guarantee Formalism • Each agent gives guarantees to its environment about the individual behavior (Guarantee), if it can rely on some properties of the environment (Rely) • Typical Relies: “environment doesn’t change the agents local variables” • “incoming resources have “valid” state” • • Guarantees: • “incoming requests are finally fulfilled” • “resource is produced correctly” “outgoing resources have “valid” state” • Compositionality theorem for reasoning about global properties. 08.10.2010 SAVE ORCA 23

Formal Model Parameterized formal model Software Engineering Models 08.10.2010 SAVE ORCA 24

Formal Verification • Verification of system class properties – „Resource-flow is correct“ – „ Leaving resources have been processed according to their task“ □ ( ∀ ag ∈ Agents, ∀ r ∈ Resources (ag.outport = Ø ∧ r.location = ag → isFinished(r)) ) – „ Agents behave according to their roles“ • Application specific properties – Need to be verified once per application – Using instantiated parameterized model 08.10.2010 SAVE ORCA 25

Outlook • Further work on self-optimization • Implementation of wave-like reconfiguration mechanism • Deeper investigation of the system class: Data-Flow systems • Extending RIA-Theorem to liveness properties • Extending theory for continously self-organisation 08.10.2010 SAVE ORCA 26

Publications – Phase III [ATC10] A Formal Framework for Compositional Verification of Organic Computing Systems • Florian Nafz, Hella Seebach, Jan-Philipp Steghöfer, Simon Bäumler, and Wolfgang Reif accepted for: Proceedings of the 7th International Conference on Autonomic and Trusted Computing (ATC 2010), Springer • [ATC10] Designing Self-Healing in Automotive Systems Hella Seebach, Florian Nafz, Jörg Holtmann, Jan Meyer, Matthias Tichy, Wolfgang Reif, and Wilhelm Schäfer accepted for: Proceedings of the 7th International Conference on Autonomic and Trusted Computing (ATC 2010), Springer • [SASO10] A Software Engineering Guideline for Self-organizing Resource-Flow Systems Hella Seebach, Florian Nafz, Jan-Philipp Steghöfer, and Wolfgang Reif Proceedings of the Fourth IEEE International Conference on Self-Adaptive and Self-Organizing Systems (SASO 2010) [ICRA10]Developing Self-Organizing Robotic Cells using Organic Computing Principles • Alwin Hoffmann, Florian Nafz, Hella Seebach, Andreas Schierl, and Wolfgang Reif Workshop on Bio-Inspired Self-Organizing Robotic Systems, 2010 IEEE International Conference on Robotics and Automation (ICRA 2010), Anchorage, Alaska, USA, May 3-8, 2 • [ARCS10]On Deadlocks and Fairness in Self-organizing Resource-Flow Systems Jan-Philipp Steghöfer, Pratik Mandrekar, Florian Nafz, Hella Seebach, Wolfgang Reif Proceedings of ARCS 2010 - Architecture of Computing Systems, Springer • [MAS&S10]Design and Simulation of a Wave-like Self-Organization Strategy for Resource-Flow Systems Jan Sudeikat, Jan-Philipp Steghöfer, Hella Seebach, Wolfgang Reif, Wolfgang Renz, Thomas Preisler, and Peter Salchow accepted for: Proceedings of the 4th International Workshop on Multi-Agent Systems and Simulation [ICSE09]A generic software framework for role-based Organic Computing systems • Florian Nafz, Frank Ortmeier, Hella Seebach, Jan-Philipp Steghöfer and Wolfgang Reif SEAMS 2009: ICSE 2009 Workshop Software Engineering for Adaptive and Self-Managing Systems [ATC09] A universal self-organization mechanism for role-based Organic Computing systems • Florian Nafz, Frank Ortmeier, Hella Seebach, Jan-Philipp Steghöfer and Wolfgang Reif Proceedings of the Sixth International Conference on Autonomic and Trusted Computing (ATC-09) 08.10.2010 SAVE ORCA 27