Willow System Demonstration

Dealing with damage that arises during operation of networked information systems is essential if such systems are to provide the dependability required by modern critical applications. Extensive damage can arise from environmental factors, malicious actions and so on, and in most cases it is impractical to mask the effects of such damage using typical redundancy techniques. Reconfiguration is required of both the application and the underlying computing and communications fabric. Such reconfiguration is difficult to achieve because it requires communication with a significant number of nodes both to determine the problem and to effect a repair. In this demonstration we present an approach to the implementation of such reconfigura-tion. The approach to reactive control includes formal description of the error states, synthesis of the implementation , a novel new communications mechanism for communication between the error detection system and the application, and a system for coordinating the effects of independent actions. As a society, we are becoming increasingly dependent on the continuous, proper functioning of large-scale, heterogeneous , distributed information systems. These systems are formed from large numbers of components, both hardware and software, originating from multiple sources assembled into complex and evolving structures spread across wide geographic areas. In view of their importance, it is desirable to make these systems survivable, i.e., to ensure that these systems can either avoid disruptions or can continue to provide acceptable service, though not necessarily complete levels of service, in the face of serious disruptions to their normal operation [1]. This demonstration will be of an architecture, the Willow architecture, designed to provide these capabilities. The types of disruption with which we are concerned are physical damage from terrorists, widespread environmental damage, coordinated security attacks, hardware failures, operational errors, etc. The Willow architecture is based on the notion that sur-vivability of a distributed application requires a broad approach to dealing with faults in the application, an approach that includes fault avoidance, fault elimination, and fault tolerance. Thus it includes mechanisms: (a) to avoid the introduction of faults into the systems at the time of initial deployment or subsequent enhancement; (b) to eliminate (i.e., remove) faults from a deployed application once they are either identified or merely suspected but before they can cause failure; and (c) to tolerate the effects of faults during operation. These various mechanisms are all based on a general notion of reconfiguration at both the system and the application levels …