Formalizing the Resilience of Open Dynamic Systems

1. Formalizing the Resilience of Open Dynamic Systems Kazuhiro Minami (ISM), TendaOkimoto (NII), TomoyaTanjo (NII), Nicolas Schwind (NII), Hei Chan (NII), Katsumi Inoue (NII), and Hiroshi Maruyama (ISM) October 26, 2012 JAWS 2012 Kazuhiro Minami

2. Many disastrous incidents show that we cannot build systems that fully resist to unexpected events Lehman financial shock 3.11 nuclear disasters 9.11 2003 Northeast blackout

3. We should aim to build a resilient system Recovery Resistance + Taoi-cho, Miyagi Pref. http://www.bousaihaku.com/cgi-bin/hp/index2.cgi?ac1=B742&ac2=&ac3=1574&Page=hpd2_view http://fullload.jp/blog/2011/04/post-265.php Kazuhiro Minami

4. We formalize Bruneau’s ``Resilience Triangle’’based on Dynamic Constraint Satisfaction Problems (DCSPs) 100 Degree of damage Service Level 50 Time for recovery 0 Time

5. Why DCSP? • Model open systems • Members join or go away dynamically • Model changing conditions f(X1) Land height Sea level Ct X1 Ecological environment

6. DCSP – A time series of CSPs Variables Constraint Domains #Variables, domains, and a constraint all change over time!

7. Configuration and fitness • Each variable takes a value from domain • I.e., • A set of value assignment is a configuration of the system at time t • A configuration is fit iff

8. K-Recoverable • A configuration sequence in dynamic system is k-recoverable if there is no subsequence where all the configurations are unfit Event 1 Event 2 fit fit fit Unfit Unfit

9. Example: Resilient Spacecraft RS-1 Components: Value Domain: {Green, Red} Fitness: Every component is Green • Conditions on external Events: • Each event affects at most k components • Next event is at least kdays apart • Adaptation Strategy: • The engineer fixes one component a day RS-1 is k-Recoverable

10. We actually need formal ways to represent accidental failures and adaptation strategies Capture laws causality, and non-deterministic events Transitional Constraint (TC) Adaptation Strategy (AS) configuration v Represent actions taken by the system itself

11. Spacecraft Example again Transitional Constraint Component failures Adaptation Strategy Transitional Constraint Nothing happened Adaptation Strategy

12. We can easily integrate the notion of l-Resistance to get our resilience definition • Express a constraint Ct as the intersection of multiple Cti for i =1 to Mt • Define the service level as a weighted sum of satisfied constraint Cti • l-Resistance ensures the upper bound of the service degradation

13. What’s Next? • Proactive resilience verification algorithm • Find stable solutions by utilizing knowledge of transitional constraints • Another formalization based on Distributed Constraint Optimization Problems (DCOPs) • Defining multiple utility functions might be more practical • Study common resilience strategies: • Diversity, Adaptability, Redundancy and Altruism

14. Adaptability Example:Ant Colony on the Shore f(X1) X1: Location of the colony Fitness: fit if f(X1)>Ct Sea level Ct goes up every l days Land height Sea level Ct X1 Adaptation Strategy: if (unfit) Otherwise This ant colony is 1-resilient if

15. Diversity Example: Space Colony • Each robot has ten binary features (e.g., 2-leg/4-leg, flying/non-flying, …) • E.g., <0110111011> Colony of n robots • Resource Reserve R • Fit robots contribute to build up R • A robot consumes one unit for reconfiguring its one feature • The colony is resilient if robots can survive a series of changing constraints C1, C2, …, Ct, … Resource • Constraint C • A Subset of 2(set of all 1,024 configurations) • A robot is fit if its configuration is in C C: “fit” configurations

16. Notes on Adaptation Strategies • Local vs Global • Local: Each robot makes its own decision independently from others • Global: There is a global coordination. Every robot must follow the order • Mixed • Complete vs Incomplete knowledge on C • Complete knowledge: max 10 steps to become fit again • Incomplete knowledge: probabilistic (max 1023 steps if the landscape is stable)

17. Notes on Constraints • Topological continuity • If x, y ∈ C, there is x1 (=x), x2, …, xk (=y) s.t. xi ∈ C and the humming_distance(xi, xi+1) = 1 • Semi continuity • There are only a small number of isolated regions • Small change vs disruptive change • Small: only neighbors are added/deleted • Disruptive: non-small

18. Conclusions • Formal definition of resilience based on DCSPs • Integrate the notions of Resistance and Recoverability • Represent open systems in a changing environment • Need to develop additional formalism to define various classes of transitional constraints and adaptation strategies • Plan to apply our model to systems in different domains Kazuhiro Minami

19. Any Questions? For more information, please visit our project web site at systemsresilience.org Hiroshi Maruyama