Performability analysis of guarded-operation duration: a translation approach for reward model solutions

Abstract

Performability measures are often defined for analyzing the worth of fault-tolerant systems whose performance is gracefully degradable. Accordingly, performability evaluation is inherently well suited for application of reward model solution techniques. On the other hand, the complexity of performability evaluation for solving engineering problems may prevent us from utilizing those techniques directly, suggesting the need for approaches that would enable us to exploit reward model solution techniques through problem transformation. In this paper, we present a performability modeling effort that analyzes the guarded-operation duration for onboard software upgrading. More specifically, we define a “performability index” Y that quantifies the extent to which the guarded operation with a duration φ reduces the expected total performance degradation. In order to solve for Y, we progressively translate its formulation until it becomes an aggregate of constituent measures conducive to efficient reward model solutions. Based on the reward-mapping-enabled intermediate model, we specify reward structures in the composite base model which is built on three stochastic activity network reward models. We describe the model-translation approach and show its feasibility for design-oriented performability modeling.

Introduction

In order to protect an evolvable, distributed embedded system for long-life missions against the adverse effects of design faults introduced by an onboard software upgrade, a methodology called guarded software upgrading (GSU) has been developed [1], [2], [3]. The GSU methodology is supported by a message-driven confidence-driven (MDCD) protocol that enables effective and efficient use of checkpointing and acceptance test techniques for error containment and recovery. More specifically, the MDCD protocol is responsible for ensuring that the system functions properly after a software component is replaced by an updated version during a mission, while allowing the updated component to interact freely with other components in the system. The period during which the system is under the escort of the MDCD protocol is called “guarded operation”.

Guarded operation thus permits an upgraded software component to start its service to the mission in a seamless fashion, and, if the escorting process determines that the upgraded component is not sufficiently reliable and thus imposes an unacceptable risk to the mission, ensures that the system will be safely downgraded back by replacing the upgraded software component with an earlier version. It is anticipated that sensible use of this escorting process will minimize the expected total performance degradation, which comprises: (1) the performance penalty due to design-fault-caused failure, and (2) the performance reduction due to the overhead of the safeguard activities. Accordingly, an important design parameter is the duration of the guarded operation φ, as the total performance degradation is directly influenced by the length of the escorting process. In turn, this suggests that a performability analysis [4] is pertinent to the engineering decision-making.

Performability modeling often implies the need to consider a broad spectrum of system attributes simultaneously and assess their collective effect on the benefit from the system or the worth of a mission the system intends to accomplish. Accordingly, performability evaluation is inherently well suited for the applications of: (1) reward model solution techniques (see [5], [6], [7], [8] for example), (2) methods for hierarchical or hybrid composition (see [9], [10] for example), and behavioral decomposition (see [11], [12] for example), and (3) tools that implement those modeling techniques (see [13], [14] for example). On the other hand, the complexity of performability measures for analyzing engineering problems and the dependencies among the system attributes or subsystems that are subject to a joint consideration may prevent us from exploiting those techniques in a straightforward fashion. Hence, performability analysis with the motivation described in the preceding paragraph presents us with greater challenges than the separate dependability and performance studies for GSU we conducted earlier [2], [3].

To address the challenges, we propose a model-translation approach that enables us to exploit reward model solution techniques which we would otherwise be unable to utilize. Rather than attempt to map the performability measure directly to a single reward structure in a monolithic model, we transform the problem of solving a complex performability measure into that of evaluating several constituent reward variables, each of which can be easily mapped to a reward structure and thereby evaluated efficiently using any software tool that supports reward model solutions.

In particular, we first define a “performability index” Y, that quantifies the extent to which the guarded operation with a duration φ reduces the expected total performance degradation, relative to the case in which guarded operation is completely absent. For clarity and simplicity of the design-oriented model, we allow Y to be formulated at a high level of abstraction. In order to solve for Y efficiently, we choose not to elaborate its formulation directly or expand the design-oriented model into a monolithic, state-space based model. Instead, we translate the model progressively, through analytic manipulation, into an evaluation-oriented form that is an aggregate of constituent measures conducive to reward model solutions. Based on this intermediate, reward-mapping-enabled model, we take the final step to specify reward structures in the composite base model, which is built on three measure-adaptive stochastic activity network (SAN) [15] reward models.

As with behavioral decomposition methods and hierarchical composition techniques, our model-translation approach permits us to avoid dealing with a model that is too complex to allow direct derivation of a closed-form solution. Whereas the most important relationship between those previously developed techniques and our approach is that successive model translation is intended to enable the application of techniques for reward model solutions, behavioral decomposition, and hierarchical/hybrid composition to performability modeling problems in which: (1) clear boundaries among “subsystems” or system properties could not be perceived from the viewpoint of the original problem formulation, or (2) the mathematical implications (to the performability measure) of system behavior may not become apparent until we elaborate the formulation of the problem to a certain degree. More generally, the process of transforming the problem of solving a complex performability measure into that of evaluating constituent reward variables naturally enables us to utilize those existing, efficient modeling techniques and tools that we would be unable to exploit without model translation, widening the scope of their applicability.

The next section provides an overview of the GSU methodology and a description of guarded operation. Section 3 defines and formulates the performability measure. Section 4 explains the translation process in detail, followed by Section 5, which shows how the reward structures are specified in the SAN models. Section 6 presents an analysis of optimal guarded-operation duration. The paper is concluded in Section 7, which summaries what we have accomplished.