Modelling Contextual Dependability

Modelling and Analysing Contextual Failures for
Dependability Requirements
Danilo F. Mendona
Raian Ali
Genana N. Rodrigues
The 9th International Symposium on Software Engineering for Adaptive and
Self-Managing Systems (SEAMS 2014)
Hyderabad, India. June 2014
CiC/UnB - Modelling and Analysing Contextual Failures for Dependability Requirements 1

Presentation Outline
Motivation
Contextual Dependability
Baseline
Dependability
Goal-oriented requirements engineering
Proposal
Dependable Contextual Goal Model
Reasoning with DCGM
Feasibility
Mobile Personal Emergency Response System
Drawbacks
Scalability
Conclusions and Following Steps
Conclusions
Next steps

Motivation
Contextual Dependability

Motivation
The context in which systems operate may not be static, but
dynamic.
Some failures will be activated only in speciﬁc contexts of
operation.
Context: heavy traﬃc

Baseline
Contexts can aﬀect the likelihood of a failure to occur.
Contextually decreased
availability
Active
Wi-Fi, GPS & Bluetooth
⇓
Battery life decreased
⇓
Increased likelihood of failure

Baseline
They can also aﬀect the consequence of failures to users and
environment.
Contextually increased failure
consequence
User is unfamiliar with the city
(travelling)
⇓
Erroneous data used by the
collaborative bus adviser system
⇓
User drops oﬀ in an unsafe city zone

Motivation
Non-functional requirements such as reliability, availability
and safety are paramount for many daily used services.
Systems specified for a static context of operation may not be
dependable.
Systems may have to adapt to contexts changes to remain
dependable.
Systems need alternative configurations and proper
dependability specification.

Motivation
Goal: Reach location
Context: Low
temperature. Reliable?
Context: Heavy traﬃc.
Reliable?
Context: Tube strike.
Reliable?

Research Question 1
How to specify contextual dependability requirements?
Research Question 2
How to estimate contextual dependability requirements?

Baseline
Dependability deﬁnition

Baseline
Dependability is ‘the ability to avoid service failures that are
more frequent and more severe than is acceptable’. It
encompasses the following attributes [Avizienis, 2004]:
Reliability
Availability
Integrity
Maintainability
Safety

Baseline
Contexts deﬁnition

Baseline
Contexts are ‘monitorable pieces of information about the
environment in which systems operate’ [Ali et al., 2010].
Environment consists of ‘whatever over which the system
has no control’ [Finkelstein et al., 2001]. Ex:
Environment conditions
User characteristics
Availability of resources

Baseline
Goal oriented requirements engineering

Baseline
Goal-oriented analysis is meant to capture the intentionality
behind software requirements [Mylopoulos et al., 1998].
Goals are a useful abstraction that represent stakeholders’
expectations and needs at early phases of RE.
GORE1 is a mature methodology for RE that has been
validated by diﬀerent goal oriented frameworks such as i*,
KAOS, and TROPOS.
1
Goal Oriented Requirements Engineering

Baseline
TROPOS [Mylopoulos et al., 2010]

Baseline
TROPOS methodology

Contextual goal model (CGM) [Ali et al., 2010]

Baseline
Contextual goal model (CGM) [Ali et al., 2010]
CGM extends TROPOS methodology.

Baseline
By the time system requirements are being analysed, a
dependability analysis can be performed.
It should analyse the context eﬀects over the consequence
level of failures.
It should guide the speciﬁcation of contextual dependability
requirements (CDR).

Baseline
Some proposals have added quality constraints (QC) to goal
models. E.g.: Souza et al., SEAMS 2011.
Dependability requirements could also be modelled as QCs
for diﬀerent system goals (Research question 1).
However, TBMK the causal relation between contexts and
failures have not been modelled in previous (static)
estimation approaches (Research question 2).

Proposal

Contextual Failure Implication
The Contextual Failure Implication (CFI) is conceptually modelled
as the eﬀect of a context on a speciﬁc dependability attribute of
system tasks in a CGM.
It provides contextual dependability estimations.

Proposal
How to estimate dependability?

Proposal
Probabilistic model checking (PMC) technique provides
formal verification. It is suitable for critical features of the
system (a myth?).
Dependability of less critical features may be analysed without
formal verification, for instance:
Fuzzy logic can be used to express estimations based on
domain knowledge.
Other languages can be used to express dependability
estimations based on domain knowledge.
The framework architecture should leave this decision to the
analysts and provide an easy integration with different
techniques.

Proposal
Fuzzy logic approach [SEAMS 2014]
IF-THEN rules syntax;
IF context THEN availability/reliability/safety/etc
Inference mechanism that produces a crispy output given
some fuzzy inputs.
Enables the use of qualitative fuzzy words to express
contexts and dependability attribute levels.

Proposal
Strong, average and weak are fuzzy GPS levels.
They are associated to a membership function.

Proposal
A small set of rules can produce a large number of outputs.
If GPS signal is weak then reliability is average.
If GPS signal is not weak then reliability is high.
If battery is not strong then availability is low.
If battery is strong then availability is average.
If power source is connected then availability is high.

Proposal
PMC approach [Work in progress]
Behavioural diagrams generated by TROPOS methodology
Parametric models with PRISM/PARAM language
PCTL properties
Estimation of dependability attributes such as reliability

PMC must consider context effects on failures.
Different components, different dependability estimation for the same
goal.

Proposal
What about dependability requirements?

Proposal
Contexts may also aﬀect the consequence level of failures:
Minor consequences, lower dependability requirements
Major consequences, higher dependability requirements
Thus, the dependability requirements are also context dependent.

Contextual Dependability Requirement
The Contextual Dependability Requirement (CDR) is modelled as
the accepted level of one or more dependability attributes for any
system goal in a CGM given some context condition.
It provides contextual dependability requirements.

Proposal
Dependable Contextual Goal Model (DCGM)

Baseline
Reasoning with DCGM

Reasoning with DCGM
A Goal will be valid if one of its Means-end tasks are valid for
that context.
Stakeholders should be aware of contextual violations of
dependability requirements.

Reasoning with DCGM
Static validation of CDRs

Reasoning with DCGM
What about runtime reasoning?

Reasoning with DCGM
Given the existence of the following information:
A goal reached by alternative tasks;
A context condition that can be evaluated through
monitoring or prediction techniques;
A set of CFIs for the alternative tasks and a CDR for the
[goal, context] tuple;
A decision can be made about which task to use at runtime.

Reasoning with DCGM
DCGM at runtime

Drawbacks

Drawbacks
Scalability concerns (declarative rules):
Eﬀort may increase exponentially with:
Number of contexts
Analysed goals
Dependability attributes
Analysis should be oriented by criticality:
Critical contextual goals
Critical dependability attributes

Drawbacks
Scalability concerns (PMC):
State explosion is a known issue with PMC
Veriﬁcation of contextual models may contribute negatively to
this problem

Conclusions and Next Steps

Conclusions
Dependability requirements can be speciﬁed using a GORE
extended language.
Techniques used for estimations must comply with the
corresponding criticality of analysed system goal.
Scalability is a major concern for both declarative and formal
veriﬁcation approaches considered so far.

Next steps
Validate the framework using a more extensive case study.
Integrate the framework with a DSL as a CDR realization to
provide more complex dependability speciﬁcation.
Integrate the framework with a probabilistic model checking
technique.
Integrate the framework with a proactive self-adaptive
architecture based on dependability criteria.

Questions?
Acknowledgement
The research was supported by an FP7 Marie Curie CIG grant
(SOCIAD project), CNPq grant number 482280/2012-3, under
edital MCT/CNPq 14/2012, and Bournemouth University – Fusion
Investment Fund (BBB and VolaComp projects)

Thank you
dfmendonca@gmail.com

Modelling Contextual Dependability

Recommended

Recommended

More Related Content

What's hot

What's hot (17)

Viewers also liked

Viewers also liked (16)

Similar to Modelling Contextual Dependability

Similar to Modelling Contextual Dependability (20)

More from Engineering and Social Informatics (ESOTICS)

More from Engineering and Social Informatics (ESOTICS) (12)

Recently uploaded

Recently uploaded (20)

Modelling Contextual Dependability