Hinchey, M.G.

Sterritt, R

English

Software has become pervasive. Despite this success and expansion into daily life, there have, of course, been a number of software-related disasters and near-disasters. Software failures have resulted in giving cancer patients excessive (and lethal) doses of radiation, loss of aircraft and spacecraft, and disclosures of private financial information. We continue to push software to the limits, in many cases using it where failure would be catastrophic, and where many organizations are spending as much as 33 to 50 percent of the total cost of ownership of their computing and communication systems to avoid software failure. Many practitioners believe that self-managing software can potentially ensure safer, more reliable, and cost-effective computer systems. Creating software systems that are self-directed, self-governing, and self-adapting has been the focus of development in autonomic computing, autonomic communications, pervasive computing, organic computing, and adaptive computin

Ulster University's Research Portal

February 2006 107S O F T W A R E  T E C H N O L O G I E SThe properties of an autonomic or self-managing system provide the basis for future selfwaredevelopment.S oftware has become perva-sive. It helps entertain uswhen embedded in iPods andMP3 players. In GPS naviga-tion systems, it helps us getto our desired location. It’s present inour home appliances and cell phones.It’s used in defense systems, spaceexploration, and hospitals. Softwareconstantly appears in more devices,with public expectations of greaterfunctionality, reliability, and contin-ued operation.Despite this success and expansioninto daily life, there have, of course,been a number of software-relateddisasters and near-disasters. Softwarefailures have resulted in giving cancerpatients excessive (and lethal) dosesof radiation, loss of aircraft and space-craft, and disclosures of private finan-cial information. We continue to push software to thelimits, in many cases using it wherefailure would be catastrophic, andwhere many organizations are spend-ing as much as 33 to 50 percent of thetotal cost of ownership of their com-puting and communication systems toavoid software failure. Many practitioners believe that self-managing software can potentiallyensure safer, more reliable, and cost-effective computer systems. Creatingsoftware systems that are self-directed,self-governing, and self-adapting hasbeen the focus of development in auto-nomic computing, autonomic commu-nications, pervasive computing, organiccomputing, and adaptive computing.AUTONOMIC SYSTEMSIn 2001, IBM launched its perspec-tive on the state of IT (www.research.ibm.com/autonomic/manifesto), whichfocuses on solving the ever-increasingcomplexity and total cost of ownershipof today’s systems through the devel-opment of self-managing systems, amajor component of which is self-man-aging software, inspired by the humanbody’s autonomic nervous system. TheANS is that part of the nervous systemthat manages body functions noncon-sciously such as blood circulation,intestinal activity, and hormonal secre-tion and production and thus lets usget on with our conscious daily lives.The general properties of an auto-nomic, or self-managing, system can besummarized by four objectives—andfour attributes. Essentially, the objec-tives represent broad system require-ments, while the attributes identifybasic implementation mechanisms. An autonomic system’s objectivesare• Self-configuration. The systemmust be able to readjust itself auto-matically, either to support achange in circumstances or to assistin meeting other system objectives. • Self-healing. In reactive mode, thesystem must effectively recoverwhen a fault occurs, identify thefault, and, when possible, repair it.In proactive mode, the systemmonitors vital signs to predict andavoid health problems, or reachingundesirable levels. • Self-optimization. The system canmeasure its current performanceagainst the known optimum andhas defined policies for attemptingimprovements. It can also react tothe user’s policy changes within thesystem. • Self-protection. The system mustdefend itself from accidental ormalicious external attacks, whichrequires an awareness of potentialthreats and the means to managethem. To achieve these self-managingobjectives, a system must be• self-aware—aware of its internalstate; • self-situated—aware of currentexternal operating conditions; • self-monitoring—able to detectchanging circumstances; and • self-adjusting—able to adaptaccordingly. Self-ManagingSoftwareMichael G. HincheyNASA Software Engineering LaboratoryRoy SterrittUniversity of UlsterEditor’s note: Contributions to this new bimonthly column will examine lead-ing-edge software development trends, including software development toolsand methodologies, languages, formal methods, and software engineering.Readers interested in submitting column-length essays (2,000-2,500 words)should contact Michael G. Hinchey at michael.g.hinchey@nasa.gov. 108 Computerif necessary, and executes it througheffectors. The closed feedback controlloop provides the basic backbone foreach system component. Figure 1illustrates the two conceptual controlloops, self-awareness (managed com-ponent) and self-situation (environ-ment), in an autonomic element. IBM represents this self-monitor-ing/self-adjusting function as the mon-itor, analyze, plan, and execute (MAPE)control loop. The monitor and analyzeaspects process information from thesensors to provide both self-awarenessand environmental awareness. The planand execute aspects control the self-management behavior that the effectorswill execute. The MAPE components use corre-lations, rules, beliefs, expectations,histories, and other information eitherdirectly known to the autonomic ele-ment or otherwise available throughthe knowledge repository within theautonomic manager.Reflex signalsTo ensure its robustness, the auto-nomic environment requires the auto-nomic elements and, in particular,autonomic managers, to communicateThus, a system must be aware of itsavailable resources and components,their ideal performance characteristics,and current status. It must also be awareof interconnection with other systems,as well as rules and policies for adjust-ing as required. A system’s ability tooperate in a heterogeneous environmentrequires relying on open standards tocommunicate with other systems.These mechanisms do not exist inde-pendently. For example, to successfullysurvive an attack, the system mustexhibit self-healing abilities, with amix of self-configuration and self-opti-mization. This not only ensures thesystem’s dependability and continuedoperation but also increases self-pro-tection from similar future attacks.Self-managing mechanisms must alsoensure minimal disruption to users. CONTROL LOOPSensors and effectors are central tothe architecture of any autonomic sys-tem. An autonomic manager creates acontrol loop by first monitoringbehavior through sensors and thencomparing it to historical and currentdata, rules, and beliefs. The auto-nomic manager then plans the action,with each other regarding the variousself-* activities. The communicationbetween autonomic managers in Figure1 also includes a reflex signal, which apulse monitor—with the capability toencode system health and urgency sig-nals as a pulse—can facilitate. The pulse monitor, an extension ofthe embedded system’s heartbeat mon-itor, safeguards vital processes throughthe emission of a regular “I am alive”signal to other processes. Just as ahuman heart has a double beat, thepulse monitor has an encoded doublebeat—a self health/urgency measureand an environment health/urgencymeasure—that corresponds with theautonomic element’s self- and envi-ronmental-awareness control loops.Together with the standard eventmessages on the autonomic commu-nications channel, this informationprovides dynamics within autonomicresponses and multiple control loops,such as reflex reactions among theautonomic managers.This reflex component safeguardsthe autonomic element by communi-cating its health to another autonomicelement. The component can also com-municate environmental health infor-mation. For example, instead of eachindividual PC in a LAN—all equippedwith an autonomic manager—moni-toring the same environment, some cantake on the role of alerting othersthrough a change in pulse to indicatechanging circumstances.Minimizing sent data—essentiallytransmitting only a signal—is animportant aspect of pulse monitoringto facilitate a reflex reaction. In theabsence of bandwidth concerns, theautonomic manager can send moredetailed information, but the addi-tional information must be in a formthat will not compromise the reflexreaction. For example, the autonomicmanager could send detailed healthtelemetry in a form that does not incurprocessing delays and can be acted onimmediately. SELFWAREThe initial set of self-* properties,commonly known as self-CHOP (con-S O F T W A R E  T E C H N O L O G I E SSelf-monitor Self-adjusterManaged componentKnowledge Adapter/plannerEnvironmentmonitorAM      AMcommunicationsAutonomic manager (AM)Autonomic elementAutonomic communications channelEnvironment-aware ReflectionSelf-awareReflexsignalFigure 1.The control loops in an autonomic element.The autonomic manager toautonomic manager communications include a reflex signal.figuring, healing, optimizing, and pro-tecting) represents the general goal ofthe Autonomic Computing Initiative.These properties are neither mutuallyexclusive nor definitive. Practitionershave began to propose and developmore self-* properties, which has ledto coining the term selfware. We cur-rently seek inspiration for new ap-proaches to selfware from existingbiological mechanisms. An example ofone new self-* property is self-destruct.Safety mechanismsTo provide an intrinsic safety mech-anism, for example, against undesir-able emergent selfware behavior or inresponse to security concerns, re-searchers are investigating the need forsoftware agents or component self-destruction. To illustrate, skin cellsfrom a cut are often displaced intomuscle tissue. If these cells survive anddivide, a tumor can result. The body’ssolution to this is cell self-destruction,referred to as apoptosis. The conceptoriginated from Greek word to “falloff,” referring to leaves falling fromtrees in the autumn. In this context,apoptosis is the death of cells in themidst of a living structure. Self-destructionSome researchers believe that cellsknow when to self-destruct becausethey are programmed to do so. Thisintrinsic biological self-destructionproperty—also referred to as death-by-default—is delayed through the con-tinuous receipt of biochemical reprievesignals. Mounting evidence now sug-gests that some forms of cancer are theresult of cells not dying fast enough,rather than multiplying in an out-of-control manner, as commonly thought.When a cell divides, it receives asimultaneous order to self-destruct,and it will do so in the absence of areprieve signal. Self-protection is thereason for this. Cells must divide forthe body to survive, but this is a dan-gerous time because if just one of thebillions of cells locks into division, atumor results. Likewise for computing systems,while a self-managing agent’s binaryimage—which can contain, for exam-ple, passwords, monetary certificates,or confidential information—might beprotected by encryption, it mustdecrypt to execute, providing a win-dow of vulnerability. These self-pro-tection needs are similar to our ownbodies’ during cell division, which isprotected by apoptosis.S elf-managing software, viewedfrom the perspective of auto-nomic computing or other self-ware initiatives, offers a holistic visionfor software’s development and evolu-tion, bringing new levels of automa-tion, autonomy, and dependability tosystems, while simultaneously hidingtheir complexity and reducing costs.We envisage greater interest in, anduptake of, self-managing principles infuture software development, as de-mand increases for systems to exhibitmore autonomic properties. The IEEEComputer Society recently establisheda Task Force on Autonomous andAutonomic Systems (www.computer.org/portal/pages/ieeecs/Communities/tab/tclist/TFAAS.html). Interested read-ers can sign up to join the task force atwww.computer.org/TCSignup. Michael G. Hinchey is director of theNASA Software Engineering Laboratoryat NASA Goddard Space Flight Centerand an affiliate professor at Loyola Col-lege in Maryland. Contact him atmichael.g.hinchey@nasa.gov.Roy Sterritt is an academic in the Schoolof Computing and Mathematics at theUniversity of Ulster, Northern Ireland,and a researcher in the Computer Sci-ence Research Institute and the Centrefor Software Process Technologies. Con-tact him at r.sterritt@ulster.ac.uk.February 2006 109computer.org/e-NewsAvailable for FREE to members.Be alerted to• articles and special issues • conference news• registration deadlinesSign Up Today for the IEEE Computer Society’se-News

Self-managing software

https://pure.ulster.ac.uk/ws/files/11260398/01597102.pdf

Self-managing software

Abstract

Similar works

Full text

Available Versions

Ulster University's Research Portal