Kenji Tei Associate Professor National Institute of Informatics, Japan

Transcription

1 Kenji Tei Associate Professor National Institute of Informatics, Japan Joint work with Moeka Tanabe, Ezequiel Castellano, Leandro Nahabedian, Nicolas D Ippolito, Shinichi Honiden

2 How does the system adapt to changes? Sytems face changes at runtime Continuous real-time data cloud robots mobile Internet of Things Device failure Sudden increase of user traffic IoT devices Unstable performance Users system IaaS How do we ensure correctness of software system?

3 control Motivation Assurance at Development Time controller (software) monitor environment goal C, = E G Kind of requirements guaranteed depends on model and method adopted

4 Motivation Assurance at Development Time control controller (software) goal monitor environment c4 u4 c1 u2 c2 = c1 c4 c3 u4 u1 u2 c2 [] p1 <> p2 C E G

5 Environment Modeling for Reactive System environment movetow movetoe pickup putdown arriveatw arriveatm arriveate pickupsuccess pickupfail putsuccess putdfail

6 Environment Modeling for Reactive System models movetoe arrivem movetoe arrivee pickup pickupsuccess E = (MAP W_ROBOT). MAP=(arrive[ w] -> MAP[ w]), MAP[ w]=( move[ e] -> arrive[ m] -> MAP[ m] move[ w] -> arrive[ w] -> MAP[ w] putdown -> putsuccess -> MAP[ w] pickup -> pickupfail -> MAP[ w]), MAP[ m]=( move[ e] -> arrive[ e] -> MAP[ e] move[ w] -> arrive[ w] -> MAP[ w] putdown -> putfail -> MAP[ m] pickup -> pickupfail -> MAP[ m]), MAP[ e]=( move[ e] -> arrive[ e] -> MAP[ e] move[ w] -> arrive[ m] -> MAP[ m] putdown -> putfail -> MAP[ e] pickup -> pickupsuccess -> MAP[ e]). W_ROBOT=(arrive[ w] -> ROBOT), ROBOT= (move[direction] -> arrive[locations] -> ROBOT pickup -> (pickupsuccess -> ROBOT pickupfail -> ROBOT) putdown -> (putsuccess -> ROBOT putfail -> ROBOT) ended -> reset -> ROBOT).

7 Motivation Assurance at Development Time control controller (software) goal monitor environment c4 u4 c1 u2 c2 = c1 c4 c3 u4 u1 u2 c2 [] p1 <> p2 C E G

8

9

10 E may become invalid at runtime -> arriveatw -> movetoe -> arriveatw -> unforseen!! Motivation controller (software) control monitor environment goal c4 c1 u2 u4 c2 = c1 c4 u4 u1 System may no longer work, or may continue, but without any assurances c3 u2 c2 [] p1 <> p2

11 Environment is Uncertain Disconnection Mulfunction Sudden increase of user traffic Sensor/Actuator Unstable performance Location change User Machine Cloud / External Service Security attack Obstacles Service down Slippy floor Physical entity

12 Assuming More Realistic Environment... MAP[ w]=( move[ e] -> arrive[ m] -> MAP[ m] move[ w] -> arrive[ w] -> MAP[ w] putdown -> putsuccess -> MAP[ w] pickup -> pickupfail -> MAP[ w]),... []((AT[ w]0&&0x(move[ e]))07>0x(!arrive[ w]0w0pickupsuccess))0 []((AT[ e]0&&0x(move[ w]))07>0x(!arrive[ e]0w0putsuccess))0 [](putdown7>at[ w])0 []!(!<pickupsuccess,putsuccess>0&&0putdown)0 [](pickup7>at[ e])0 []!(<pickupsuccess,putsuccess>0&&0pickup)0 [](<ended,reset>07>0(<pickupsuccess,{reset}>0&&0<putsuccess,{reset}>))0... MAP[ w]=( move[ e] -> (arrive[ m] -> MAP[ m] arrive[ w] -> MAP[ w]) move[ w] -> arrive[ w] -> MAP[ w] putdown -> putsuccess -> MAP[ w] pickup -> pickupfail -> MAP[ w]),... []((AT[ w]0&&0x(move[ e]))07>0x(!arrive[ w]0w0pickupsuccess))0 []((AT[ e]0&&0x(move[ w]))07>0x(!arrive[ e]0w0putsuccess))0 [](putdown7>at[ w])0 []!(!<pickupsuccess,putsuccess>0&&0putdown)0 [](pickup7>at[ e])0 []!(<pickupsuccess,putsuccess>0&&0pickup)0 [](<ended,reset>07>0(<pickupsuccess,{reset}>0&&0<putsuccess,{reset}>))0

13 How Much Should We Assume? high E optimistic G rich rich risk Everything works ideally Everything can go wrong functionality low E pessimistic G poor poor

14

15 Graceful Degradation by Self-adaptation with Models C E G adaptation engine C E G controller (software) control monitor environment goal relaxed goal

16 Context of My Approach c4 u4 c1 u2 c2 c1 c4 c3 u4 u1 u2 c2 [] p1 <> p2 LTS Controller LTS Env. Model LTL Goals

17 Motivation Self-adaptation by G 1 G N Adaptation Engine 2. determine req. level cached controllers Analyzer 1. update env. model E G i knowledge C Planner 3. generate controller Decision Making Monitor Executer execution traces enactment 4. hot-swap controller C control System

18 Discrete Controller Synthesis as a Planner Feedback control for discrete event systems - driven not by time but rather by events - represented as automata, Petri nets, and the like Synthesize C by solving a control problem <E,G> (E C = G) u4 E t+1 c1 u2 c4 c2 u4 c3 c1 Controller c4 Synthesizer u2 c2 M t+1 C t+1 p1 G t+1 p2 Nicolas D'Ippolito, et al., Synthesis of Live Behaviour Models, FSE2010 Nicolas D Ippolito, et al., Synthesis of live behaviour models for fallible domains, ICSE2011

19 - Discrete Controller Synthesis- Synthesis as Two-Player Game

20 - Discrete Controller Synthesis- What s a Game? A game is composed of an arena and a winning condition

21 - Discrete Controller Synthesis- Winning Region The winning region for Player 1 is a set of states of the arena in which Player 1 can always win

22 - Discrete Controller Synthesis- Strategy A (winning) strategy for Player 1 is defined as a finite number of steps that Player 1 will take to ensure reaching the goal from the initial state, no matter what Player 2 does. Strategies for reachability are directed-acyclic graphs

23 Tool Support MTSA (Modal Transition System Analyzer) - Discrete Controller Synthesishttp://mtsa.dc.uba.ar

24 - Discrete Controller Synthesis- Enact Model Enactment framework Interpret controller model Map actions in model to concrete implementation V.Braberman et al., Controller synthesis: From modelling to enactment, ICSE 2013

25 Motivation Self-adaptation by G 1 G N Adaptation Engine 2. determine req. level cached controllers Analyzer 1. update env. model E G i knowledge C Planner 3. generate controller Decision Making Monitor Executer execution traces enactment 4. hot-swap controller C control System

26 Motivation Self-adaptation by G 1 G N Adaptation Engine 2. determine req. level cached controllers Analyzer G i Planner 1. update env. model E knowledge C 3. generate controller Monitor Executer Situation Awareness execution traces enactment C 4. hot-swap controller control System

27 - Environment Model Update - Purpose Updating LTS-based Environment Model at Runtime Situation changes consistent Inconsistent consistent Model Update

28 - Environment Model Update - Purpose Updating LTS-based Environment Model at Runtime u4 c1 E t u2 c4 c2 u4 c3 c1 Model E u2 c4 c2 t+1 execution trace ->u2->c2->-> Updater Learner c3 Online update should be accurate and efficient

29 - Environment Model Update - Proposal Existing LTS-model Update Our online LTS-model update Construct a model with all traces in the window Use gradient descent algorithm - repeat computation until convergence Update the model with the latest trace Use stochastic gradient descent-based algorithm - the latest data is used for update instead of random picking

30 - Environment Model Update - Proposal pre-condition, action, {post-condition α, β, γ, }! " e.g. arrive.w1, move.e, {arrive.m1, arrive.w1}! "

31 - Environment Model Update - Evaluation Accuracy and settling time Computational Overhead () ) ( ) ()

32 Motivation Self-adaptation by G 1 G N Adaptation Engine 2. determine req. level cached controllers Analyzer G i Planner 1. update env. model E knowledge C 3. generate controller Monitor Executer execution traces enactment 4. hot-swap controller C control System

33 Other Key Techniques 1. Environment model learning make E neither optimistic nor pessimistic 2. Goal relaxation avoid unnecessary degradation Ongoing work G 1 current level E t+1 u4 E t c1 u2 c4 c2 u4 c1 u2 c4 c2 c3 E t+1 c1 G i c4 c3 u4 execution trace ->u2->c2->-> G N u2 c2 Model Learner Relaxer G j [SAC2017] c3 3. Controller synthesis generate an assured controller u4 E t+1 c1 u2 c4 c2 u4 c3 c1 Controller c4 Synthesizer u2 c2 MC t+1 G t+1 p1 p2 4. Controller update swap controller to new one C t+1 [SEAMS2016] u4 c1 c4 u1 c2 u2

34 Context Summary Environment will change at runtime How do we ensure correctness of software? => approach enables decision making when more information is available Tech. Topics How does the system generate a correct controller for unforeseen situation? => Update the environment model and synthesize a correct controller at runtime!