A behavioural model for the discussion of resilience, elasticity, and antifragility

A behavioural model for the discussion of resilience,

elasticity, and antifragilityVincenzo De Florio

MOSAIC / Universiteit Antwerpen& MOSAIC / iMinds

[email protected]

16 June, 2015

Structure- What is resilience? Why so many answers?

- Model

- Conjectures

(- Application)

- Conclusions

Main reference: "On Resilient Behaviors in Computational Systems and

Environments", J. of Rel. Int. Envs, 1(1)

Defining Resilience

• From resilire (Latin):

“to spring back, start back, rebound, recoil, retreat.”

Often intended as the ability to cope with or recover from change.

• Persist system identity: a system's definition

• If you try and ask the experts of the various disciplines what resilience is, you’re going to have different answers:

Definitions of Resilience• Material science: a material’s property to “stay unaffected by an applied stress” up to some threshold (the “point of yielding”) and to “return to its original shape upon unloading”

• Beyond the mentioned threshold, deformation is irreversible:• “some residual strain will persist even after

unloading”• Action: property rather than a process• System identity: shape / characteristics of the

material

Definitions of Resilience• Civil engineering: a construction’s ability to

absorb or avoid damage in the face of a natural or man-induced abnormal condition (flooding, hurricanes, or firepower.)

• Action/identity: as in material science

Definitions of Resilience• Computer science: “ability to sustain

dependability when facing changes”→Ability to avoid failure and sustain the

delivery of trustworthy services.

• Action: process. It ranges from masking to tolerating change

• System identity: "compliance to system specifications and functional and non-functional QoS and QoE requirements.”

Definitions of Resilience• Ecology: "an ecosystem’s ability to

respond to and recover from an ecological threat"

• Action: “recover ” (process)

• System identity: ability to return to a state of equilibrium

Definitions of Resilience• Psychology: “the process of adapting well in

the face of adversity, trauma, tragedy, threats or significant sources of stress [...] It means ‘bouncing back’ from difficult experiences”

• Action: process: “Resilience should be considered a process, rather than a trait to be had”. Undefined complexity

• System identity: "collection of beliefs about oneself"

Definitions of Resilience• Organization science: “the capacity to

anticipate disruptions, adapt to events, and create lasting value”.

• Action: Process. Complex proactive adaptation rather than simple “springing back” to past state / function.

• System identity includes a specific trait: ability to create value.

Definitions of Resilience

• Complex socio-ecological systems: "ability to absorb stress and maintain function in the face of climate change"; ability to improve systematically sustainability.

• Action: “Absorbing stress” + learning (= complex processes)

• System identity lies in the function rather than in a state.

• Learning

Lessons learned

• From traits to processes: a range of behaviours, from simple purposeful behaviours to complex teleologic / extrapolatory ones

• From absorption/masking to reaction/tolerance to proactivity/anticipation

• With or without learning

• What do I mean by "a range of behaviours"?

Behavioural categories (Wiener et al.)

PASS

IVE

AC

TIVE

RA

ND

OM

PUR

POSE

FUL

TELE

OLO

GIC

PREDICTIVE

System onlyreceives energy

from externalsource

System isthe source of the

output energy

behavior is not interpreted as

directed to a goal

A goal canbe identified

Distance fromthe goal steersthe behavior

Distance frompredicted position

of goal steersthe behavior


- Model

- Conjectures

(- Application)

- Conclusions

Model

• We can distinguish at least three classes of resilient systems:• Elastic objects and systems• Entelechies• Antifragile systems

• In what follows I define and discuss them

Model, case 1: elasticity

• When the system is only capable of purposeful, non-teleological behavior, then resilience shall be called elasticity.

• Elasticity: the domain of ataraxies — systems that work in "autistic mode"• They “do not care too much” about other

systems and deployment environments

• Non-open systems. They work under the assumption that “changes will not break ‘em"

Elasticity

• Elastic systems are "blind" to change:

• Have a predefined and static point of yielding. A breaking point. This introduces two syndromes:

Elastic system

Safezone

Unsafezone

yielding point Y

Unreliability

y(t)

y(t)

y(t) - Y =Undershooting

Elastic Undershooting

Redundancy

Elastic Undershooting• You may make your house

• of straw; of wood; of bricks.• You just get an elastic system with a better

and better yielding point: Y1 < Y2 < Y3

• Regrettably the "blow", y(t), is an unbound dynamic system

Elastic Undershooting• Sooner or later, your construction Y is bound

to be hit by some y(t) > Y

• Given enough time, the Black Swan will show up. [cf. N. N. Taleb]

• Elastic undershooting tells you how badly you're going to be hit: y(t) - Y.

Elastic Undershooting

Elastic system

Safezone

Unsafezone

yielding point Y

Unreliability

y(t) Y - y(t) =

Overshooting

Redundancy

tover

shoo

ting

now

Cumulative overshooting

Elastic Overshooting

Elastic Overshooting: Dual case!• You may make your house

• of bricks; of wood; of straw.• You just get an elastic system with a cheaper

and cheaper yielding point: Y3 > Y2 > Y1

• Each time Yi > y(t), you’re overprotecting your construction!

Elastic Overshooting• If so, you’re paying a price higher than what

necessary to let your construction withstand the "blow".

• Elastic overshooting tells you how much you "overpaid": Y - y(t)

• If you consider the elastic overshooting across an interval of time T, you end up with an overall waste of ∫T Y - y(t) dt

Elastic Overshooting

Model, case 2: entelechies

• In elastic systems, resilience is a trait — a property, which can be ascertained by observing the system.

• Not so when the system is capable of more advanced behaviors — the ability to react and adapt to change; or even to react with respect to a hypothesized future change.

• In this case the system is “in motion” to actively pursue the persistence of its system identity — its concept; its definition.

Entelechies• This corresponds to what Aristotle calls as

entelechy: a system that “is at work to stay the same” [Joe Sachs, Aristotle’s Physics]

• This is the domain of open systems: systems that perceive and analyze the behaviours of other systems and of their deployment environments.

Entelechies• Entelechies have a dynamic and adaptive

point of yielding. They still have a breaking point. Only, this breaking point is a dynamic system: it’s a Y(t) instead of a Y.

• Undershooting and overshooting are still possible, but now they are resp. equal to y(t) - Y(t) and Y(t) - y(t).

Entelechies

• Entelechies respond to change by adjusting their action.

• A feed-back loop (FBL) is used for this.

• How is the adjustment done?

• Several cases:

Entelechies

a)FBL is purely exogenous: the system action is simply steered towards the goal (in its current or hypothesized future position.)

b)FBL is both exogenous and endogenous. Internal changes only concern “knobs”, (=parameters of the system). • This case corresponds to parametric

adaptation

Entelechies

c)FBL is both exogenous and endogenous; the internal changes adapt the structure of the system.• This corresponds to system

reconfigurations (=structural adaptation).

• Adaptations are phenotypical and do not affect the identity of the system.

• The experience leaves no trace on the identity of the system.

Entelechies

d)FBL is both exogenous and endogenous; the internal changes also adapt the function; the structure; the architecture; and the organization of the system.

• Changes are genotypical: they are persisted and permanently modify the nature of the system.

?

Model, case 3: antifragility

• In cases a), b), c) the identity is preserved. • Not so in case d). There, the system is active

but does not stay the same. • Antifragile systems: systems that are

“at work to get better”

Antifragile systems

• In entelechies, the experience changes the “movement” — the route — towards the goal; but the experience does not reflect onto the identity of the system.

• The system is free to adapt, though it can’t evolve.

• In antifragile systems, the system can adapt and evolve.

“Antifragility is beyond resilience or robustness. The resilient resists shocks and stays the same; the antifragile gets better” [Nicholas Taleb]

Common misconceptions→“I don't think anti-fragile systems exist

because every system has a breaking point”.

←Antifragile does not mean unbreakable. Antifragile systems do have a point of yielding. They still have a breaking point.

Common misconceptions→ "Antifragile systems will solve all our

problems".

← Ours?←Antifragile computer-based systems may

drift outside of what prescribed in their specifications

←Hawking-scenarios are possible; more likely than with entelechies.

Common misconceptions→ "Resilience is an absolute figure. Either

you have it or you don’t"

← Nope. Resilience is a dynamic property that depends on:

• The intrinsic characteristics of the system• How those characteristics match the

environment the system is deployed in (cf. G. W. von Leibniz)


- Model

- Conjectures

(- Application)

- Conclusions

Conjectures1.Resilience is the product of an interplay

between a system and its environment2.Resilience: One of the possible outcomes

of a complex interplay of behaviors. • If and only if

ip(system behaviours, env. behaviors) preserves the system identity then the system shall be called resilient

Conjectures3.Evolutionary Game Theory may be an

effective theory for reasoning about ip(system, environment)• Behaviour not as a system class; rather,

as a manifested move.

Resilience interplay: an example

RESPONSE:> PURPOSEFUL

BEHAVIORS

INPUT:PURPOSEFUL

NON-TELEOLOGICBEHAVIORS

SYSTEMENVIRONMENT


RESPONSE:> TELEOLOGIC/

PREDICTIVE BEHAVIORS

INPUT:TELEOLOGIC /PREDICTIVEBEHAVIORS

SYSTEMENVIRONMENT


RESPONSE:PURPOSEFUL,NON-TELEO-LOGIC BEHA-

VIORS

INPUT:RANDOM

BEHAVIORS

SYSTEMENVIRONMENT

Choice of the resilience strategy in function of the manifested behaviours

Conjectures4.Antifragile systems are aware of their own

system-environment fit and use mechanisms to assess the risk of loosing their own system identity

• In what follows, an application, based on overshooting


- Model

- Conjectures

- Application

- Conclusions

Application: Adaptive NVP• A-NVP: adaptive reformulation of

N-version programming. o Buys & De Florio, "Towards Context-

Aware Adaptive Fault Tolerance in SOA Applications", https://dl.dropboxusercontent.com/u/67040428/p63-buys.pdf

• A-NVP is based on a voting mechanism• “Votes”: outputs produced by a number of

software programs, called versions

• A-NVP employs N(t) versions out of M available versions (web services)• Yielding point: floor(N(t)/2)• Overshooting: tunes N(t) • The smaller the overshooting, the greater

the risk of losing one's identity

Adaptive NVP (A-NVP)

Indirect deduction of risk

OS = 6 OS = 4

OS = 2OS =0 US!

Evolvability scheme• N (adopted redundancy at t = now):

in function of deduced risk• Under normal conditions, N = 3–Up to one failure / dissent is tolerated

• Under more critical situations, risk goes up⇒ amount of redundancy is automatically adjusted

• Adjustment logic: select the ideal degree of redundancy matching the current disturbances

Evolution of N(t) while injecting faults

t

Red

unda

ncy

• Learning: selects the "best" N(t) versionso A-NVP keeps track of the performance of all

active versions availableo Mechanism of gradual penalisation and reward

"ranks" all available versions by comparing their output with the one obtained through majority voting.

o At any time t, the top ranked N(t) versions are selected.

Adaptive NVP (A-NVP)


- Model

- Conjectures

- Application

- Conclusions

Conclusions and future steps• Characterisation of resilience in terms of

behaviors• More coherent definitions of Elasticity;

entelechism; antifragility• Interplay with the environment• Oversupply and undersupply• Estimation of risk of identity loss /

drifting

Conclusions and future steps• Distinction between "systemic behaviour"

and manifested behaviour• A move• Evolutionary Game Theory:

system vs environment• Manifested behaviour as a response to

an input behaviour

Future steps: "Behavioral" Game Theory

Passive Random Purposeful Teleologic Predictive Antifragile

Passive ?,? -1,1 -1,1 -1,1 -1,1 -1,1

Random 1,-1 ?,? -1,1 -1,1 -1,1 -1,1 (*)

Purposeful 1,-1 1,-1 ?,? -1,1 -1,1 -1,1

Teleologic 1,-1 -1,1 1,-1 ?,? -1,1 -1,1

Predictive 1,-1 -1,1 1,-1 1,-1 ?,? -1,1

Antifragile 1,-1 1,-1 (*) 1,-1 1,-1 1,-1 ?,?

(*): if a player can learn that the other one is behaving randomly

ENVIRONMENT

SYST

EM

Thank you for your attention!

Questions?

Science

A behavioural model for the discussion of resilience, elasticity, and antifragility