Antifragility = Elasticity + Resilience + Machine Learning

Models and Algorithms for Open System Fidelity

Vincenzo De Florio PATS research group, University of Antwerp & iMinds Research Institute Middelheimlaan 1, 2020 Antwerpen, Belgium Email: vincenzo.defl[email protected]

Abstract—We introduce a model of the fidelity of open In what follows we consider the more general case of systems—fidelity being interpreted here as the compliance be- n-open systems—systems that is that interact with environ- tween corresponding figures of interest in two separate but ments represented through n context figures. This means communicating domains. A special case of fidelity is given by real-timeliness and synchrony, in which the figure of interest is that, through some sensory system and some sampling and the physical and the system’s notion of time. Our model covers conversion algorithms, each of these n context figures is two orthogonal aspects of fidelity, the first one focusing on a reified in the form of an internal variable reflecting the state system’s steady state and the second one capturing that system’s of the corresponding figure. These “reflective variables” [10] dynamic and behavioural characteristics. We discuss how the two are the computational equivalent of the biological concept aspects correspond respectively to elasticity and resilience and we highlight each aspect’s qualities and limitations. Finally we sketch of qualia (pl. quale)[11] and represent an open system’s the elements of a new model coupling both of the first model’s primary interface to their domains of intervention (typically, aspects and complementing them with machine learning. Finally, the physical world.) a conjecture is put forward that the new model may represent a This work introduces two models for the fidelity of n-open first step towards compositional criteria for antifragile systems. systems. Each of those models provides a different view to an n-open system’s nature and characteristics. I.INTRODUCTION The first model is presented in Sect.II and mainly focuses As well-known, open systems are those that continuously on elasticity support to fidelity. Quality is reached through communicate and “interact with other systems outside of simple schemes with as limited as possible an overhead and themselves” [1]. Modern electronic devices [2] and cyber- as low as possible an impact on functional design goals. physical systems [3] are typical examples of open systems Resource scheduling, redundancy, and diversity are mostly that more and more are being deployed in different shapes applied through worst-case analyses and at design-time, pos- and “things” around us. Advanced communication capabilities sibly with simple switching among Pareto-optimal strategies pave the way towards collective organisation of open systems during the run-time [2]. As mentioned above, the key strategy able to enact complex collective strategies [4] and self-organise in this case is elasticity: unfavourable changes and faults are into societies [5], communities [6], [7], networks [8], and meant to be masked out and counterbalanced by provisions organisations [9]. that do not require intensive system reconfigurations. This One of the most salient aspects of open systems—as well model considers the system and its intended deployment as a key factor in the emergence of their quality—is given by environments as known and stable entities (cf. synchronous arXiv:1401.4862v1 [cs.OH] 20 Jan 2014 the compliance between physical figures of interest and their system model [12]) and identifies a snapshot of the system in internal representations. We call this property as fidelity. A its intended (viz., “normal”) operational conditions. high fidelity makes it possible to build “internal” models of Conversely, our second model—introduced in Sect. III— “external” conditions, which in turn can be used to improve is behavioural and focuses on resilience support to fidelity. important design goals—including performance and resilience. Systems and their environments are regarded as dynamic Conversely, low fidelity results in unsatisfactory models of the systems whose features are naturally drifting in time (as it is “world” and the “self”—an argument already put forward in the case, e.g., in the timed-asynchronous system model [13]). Plato’s Cave. Corresponding variations in the operational conditions within As an example, real-time systems are open systems that and without the system boundaries may be tolerated through mainly focus on a single figure—physical time. Such fig- different strategies, and this model focuses on the quality of ure is “reified” as cybertime—an internal representation of the behaviours that a system may employ, during the run-time, physical time. Intuitively, the more accurately the internal in order to guarantee its fidelity despite those variations. representation reflects the property of a corresponding physical A discussion is then elaborated in Sect.IV. Positive and neg- dimension, the higher will be the quality exhibited by such ative aspects of both models are highlighted. Then it is shown class of open systems. how the two models may co-exist by distinguishing between normal and critical conditions. A general scheme for context- the relative positions of the light-bulbs and the perceiver conscious switching between elasticity and resilience strategies as well as on the presence of obstructing objects in the is proposed. Said scheme also incorporates a machine learning room, and other factors.) step such that the system may acquire some form of “wisdom” • In C, as in the expression on the right of the equal as a by-product of past history. A conjecture is put forward sign, operator “+” is the algorithm that produces a valid that the general scheme may represent a first preliminary step operational representation of some property by adding towards the engineering of antifragile systems [14], namely any two other valid representations of the same property. systems not merely able to tolerate adverse conditions, but In the above example, the operator computes the qualia rather able to strengthen in the process their ability to do so. corresponding to the sum of the quale representing the SectionV finally concludes with a view to our future work. light emitted by l1 with that of l2. Let ∆ be a variable representing any ∆ , 0 < i ≤ n, in II.ALGEBRAIC MODEL i turn defined as the “preservation distance” of reflective map Here we introduce our first model of fidelity. First the main qi, meaning that qi would preserve operation “+” were it not objects of our treatise are presented in Sect. II-A. Section II-B for the extra ∆i. Quantity ∆ thus represents an error value that follows and introduces our Algebraic model based on those depends on the nature of the involved properties; their opera- objects. tional representations; and “the environment”, the latter being A. Formal entities modelled as a set of context figures representing the hardware and software platforms; the operational conditions; the user As mentioned in Sect.I, open systems are those computer behaviours; and other factors. Environmental conditions shall systems that interact with a domain they are immersed in. be cumulatively represented in what follows as vector ~e. A prerequisite to the quality of this interaction is the per- ception [15] of a domain- and application-specific number of B. Model figures, say 0 < n ∈ N. The quality of the perception services Function (1) and Condition (2) may be used to characterise is the cornerstone to fidelity [16], the latter taking the shape of, concisely the fidelity of an n-open system, namely how e.g., optimal performance, strong guarantees of real-timeliness coherent, consistent, and robust is the reflection in Ci of the and safety, high quality of experience, and so forth. physical properties of U i, 0 < i ≤ n. Our exemplary focus in Perception in n-open systems is modelled in what follows the rest of this section will be that of real-time systems (namely as a set of functions qi, 0 < i ≤ n, defined between pairs 1-open systems whose domains of interests are cybertime1 and of Algebraic structures, U i and Ci, 0 < i ≤ n, respectively physical time) though this will not affect the generality of our representing sets of physical properties of interest (called in treatise. In the rest of this section C will refer to cybertime what follows as “raw facts”) and sets of their corresponding and U to physical time. The corresponding reflective map shall computer-based operational representations—their “reflective be simply referred to as q while ∆ shall be q’s preservation variables”, or “quale”. “Reflective maps” is the term we shall distance. use to refer to the above functions. The formal cornerstone of our model is given by the concept Let us refer as U and C respectively as to any of the U i of isomorphism—a bijective map between two Algebraic and Ci, and as q to any of the reflective maps. Thus, if u ∈ U structures characterised by a property of operation preserva- is, e.g., the amount of light emitted by a light-bulb, then q(u) tion. As well-known, a function such as reflective map q is a may for instance be a floating point number stored in some isomorphism if it is bijective and if the preservation distance ∆ memory cells and quantifying the light currently emitted by is equal to zero. In this case the two domains, C and U, are in the bulb as perceived by some sensor and as represented by perfect correspondence: any action (or composition thereof) some sampling and conversion algorithm. A reflective map occurring in either of the two structures can be associated takes the following general form: with an equivalent action (resp. composition) in the other one. q : U → C (1) In the domain of time, this translates in perfect equivalence between the physical and artificial concept of time—between and obeys the following Condition: cybertime and physical time that is. Different interpretations ∀u , u ∈ U : q(u + u ) = q(u ) + q(u ) + ∆. (2) depend on the domain of reference. As an example, in the 1 2 1 2 1 2 domain of safety, the above correspondence may mean that Here overloaded operator “+” represents two different op- the consequence of C-actions in terms of events taking place erations: in U be always measurable and controllable—and vice-versa. • In U, as in the expression on the left of the equal Obviously the above flawless correspondence only charac- sign, operator “+” is the property resulting from the terises a hypothetically perfect computer system able to sustain composition of two congruent physical properties. As an its operation in perfect synchrony with the physical entities example, this may be the amount of light produced by it interacts with—whatever the environmental conditions may turning on two light-bulbs in a room, say light-bulb l1 1We shall refer in what follows to any artificial concept of time, as and light-bulb l2. (Note that the amount of light actually manifested for instance by the amount of clock ticks elapsed between any perceived by some entity in that room will depend on two computer-related events, as to “cybertime”. be. The practical purpose of considering such a system is is required to verify that the system’s deployment and run- that, like Boulding’s transcendental systems [17] or Leibniz’s time hypotheses will stay valid over time. Sect. III specifically Monads and their perfect power-of-representation [18], it is covers this aspect. Assumption failure tolerance [19] may be a reference point. By identifying specific differences with used to detect and treat deployment and run-time assumption respect to said reference point we can categorise and parti- mismatches. tion existing families of systems and behaviours as per the Definition 2.4 (Non-real-time system): A non real-time following definitions. system is one that is employed, deployed, and executed, with Definition 2.1 (Hard real-time system): A hard real-time no concern and no awareness of the drifting of function ∆. system is the best real-life approximation of a perfect real- With respect to time, the system is context-agnostic and is time system. Though different from zero, its preservation meant to be used “as is”—without any operational or quality distance (the ∆ function, representing in this case the system’s guarantee. “tardiness”) has a bound range (limited by an upper threshold) Definitions 2.1–2.4 can be used to partition systems into equal to a “small” interval (drifts and threshold are, e.g., one disjoint blocks (or equivalence classes). Said classes may be order of magnitude smaller than the reference time unit for regarded as “contracts” that the systems need to fulfil in order the exercised service). A hard real-time system is typically to comply to their (real-timeliness) specifications. guarded, meaning that the system self-checks its preservation Definition 2.5 (System identity): We define as system real- distance. time identity (in general, its system identity) the equivalence In what follows we shall call as “t-hard real-time system” class a (real-time) system belongs to. a system that matches the conditions in Definition 2.1 with We now discuss a second and complementary aspect— threshold t. system behaviour and its effect on the correspondence between Definition 2.2 (Soft real-time system): A system is said to C and U. be “soft real-time” if its preservation distance ∆ is statistically III.BEHAVIOURAL MODEL bound. As in hard real-time systems, a threshold characterises the ∆ error function, but that threshold is an average value, As already hinted in Sect.I, our Algebraic model and its namely there is no hard guarantee, as it was the case for Definitions 2.1–2.4 do not cover an important aspect of open hard real-time systems, that the error will never be overcome. systems [1], namely the fact that, in real-life, the extent and Both threshold and its standard deviation are “small”. As hard the rate of the environmental changes may (as a matter of real-time systems, also soft real-time systems are typically fact, shall) produce a sensible effect on ~e (and thus, on ∆) guarded—viz., they self-check their tardiness (preservation even when the system has been designed with the utmost care. distance.) In this case the system may experience an “identity failure”, In what follows we shall call a “(t, σ)-soft real-time system” namely a drift4 that produces a loss of the system identity (cf. a system that matches the conditions in Definition 2.2 with Def. 2.5). average threshold t and standard deviation σ. In order to capture a system’s ability to detect, mask, Definition 2.3 (Best-effort real-time system): A system is tolerate, or anticipate identity failures, that system needs to said to be “best-effort” if care and experience have been enact a number of resilient behaviours [15], [21]. In what put to use, up to a certain degree2, in order to design and follows we first briefly introduce the concepts of resilience craft that system; said care and experience, to the best of the and behaviours (respectively in Sect. III-A and Sect. III-B) and current knowledge and practise, should allow the ∆ values then discuss in Sect. III-C how resilient behaviours constitute experienced by the users to be considered as “acceptable”, a second “parameter” with which one may characterise salient meaning that deviations from the expected behaviours are aspects of the fidelity of open systems. such that the largest possible user audience shall not be A. Resilience discouraged from making use of the system. Internet-based teleconferencing systems are examples of systems in this Resilience is a system’s ability to retain certain character- category. Unlike hard and soft real-time systems, best effort istics of interest throughout changes affecting itself and its systems do not monitor the drifting of their ∆3. environments. By referring to Sect. II-B and in particular to It is important to highlight once more how function ∆ is also Def. 2.5, resilience may be defined as robust system identity a function of ~e—the environmental conditions. As mentioned persistence, namely a system’s “ability to pursue completion already, the above conditions include those pertaining to (that is, one’s optimal behaviour) by continuously re-adjusting the characteristics and the current state of the deployment oneself” [15]. Resilience closely corresponds to the Aris- platform. As a consequence of this dependency, special care totelian concept of entelechy [22], [23], namely “exercising activity in order to guarantee one’s identity”, or to “comply to 2A trade-off between design quality, usability, time-to-market, costs and one’s ‘definition’.” other factors typically affects and limits the employed care. 3In some cases monitoring data are gathered from the users. As an example, 4The problem of system identity drift going undetected is one that may pro- the users of the Skype teleconferencing system are typically asked to provide duce serious consequences—especially in the case of safety-critical computer an assessment of the the quality of their experience after using the service. systems. This is efficaciously expressed by quoting Bill Strauss: “A plane is This provides the Skype administrators with statistical data regarding the ∆’s designed to the right specs, but nobody goes back and checks if it is still experienced by their users. robust” [20]. As suggested in [21], resilience calls for (at least) the tracking the speed of another system to anticipate its following three abilities: future position exhibits first-order predictive behaviours, • Perception, namely the ability to become timely aware of while one that considers, e.g., speed and flightpath, some portion of the raw facts in the environment (both is second-order predictive. Systems constructing their within and without the system boundaries). models through the correlation of two or more “raw • Awareness, which “defines how the reflected [raw facts] fact” dimensions, possibly of different nature, are called are accrued, put in relation with past perception, and higher-order predictive systems. used to create dynamic models of the self and of the The above model of individual behaviour may be naturally world” [15], [24]. extended by considering collective behaviours—namely the • Planning, namely the ability to make use of the Aware- conjoint behaviours of multiple individual systems. We dis- ness models to compose a response to the changes being tinguish three major classes of collective behaviour: experienced. 1) Neutral social behaviour. This is the behaviour resultant A general scheme for robust system identity persistence is from the collective action of individual, purposeful, then given by the following three phases: non teleological behaviours. Each participant operates 1) Monitor the drifting of the ∆ functions. through simple reflexes, e.g., “in case of danger get 2) Build models to understand how the drifting is impacting closer to the flock”. Lacking a “signal from the goal”, the on one’s system identity. rationale of this class of collective behaviours lies in the 3) Plan and enact corrective actions such that the system benefits deriving by the sheer number of replicas avail- identity is not jeopardised. able. Examples include defencive behaviour of a group Phases 2. and 3. refer to the concept of behaviour—which is of individuals from a predator and group predation. the subject of next subsection. 2) Individualistic social behaviour. This is the social be- haviour of systems trying to benefit opportunistically in B. Behaviour a regime of competition with other systems. Here partic- Behaviour is defined in [25] as “any change of an entity ipants make use of more complex behaviours that take 5 with respect to its surroundings ”. In the context of this paper into account the social context, namely the behaviours behaviour is to be meant as any change an entity enacts exercises by the other participants. It is worth noting how in order to sustain their system identity. In other words, even simple “systems” such as bacteria may exercise this behaviour is the response a system enacts in order to be class of behaviour [26], [27]. resilient. In the cited paper the authors discuss how the above 3) Cooperative or coopetitive social behaviours. These are mentioned response may range from simple and predefined social behaviours of systems able to establish mutualistic reflexes up to complex context-aware strategies. The following relationships (mutually satisfactory behaviours) and to classes are identified: consider proactively the future returns deriving from a 1) Passive behaviour: the system is inert, namely unable to loss in the present. Examples of behaviours in this class produce any “output energy”. are, e.g., the symbiotic relationships described in [6], 2) Active, non-purposeful behaviour. Systems in this class, [28]. albeit “active”, do not have a “specific final condition As a final remark we deem worth noting how resilience toward which they strive”. and change tolerance are not absolute properties: in fact they 3) Purposeful, non-teleological (i.e., feedback-free) be- emerge from the match with the particular conditions being haviour. A typical example of systems exercising this exerted by the current environment. This means that it is not type of behaviour is given by servo-mechanisms. possible to come up with an “all perfect” solution able to 4) Teleological, non-extrapolative behaviours are those typ- withstand whatever such condition. Nature’s answer to this ical of reactive systems. A feedback channel provides dilemma is given by redundancy and diversity. Redundancy those systems with “signals from the goal”. Behaviour and diversity are in fact key defence frontlines against tur- is then adjusted in order to get “closer” to the goal as bulent and chaotic events affecting catastrophically an (either it was perceived through the channel. Reactive systems digital or natural) ecosystem. Multiple and diverse “designs” function under the implicit hypothesis that the adjusted are confronted with events that determine their fit. Collective behaviours bring indeed the system closer to the goals. behaviours increase the chance that not all the designs will be 5) Predictive behaviours are typical of proactive systems, negatively affected. In this sense we could say that “resilience namely systems that base their action upon a hypothe- abhors a vacuum”, for empty spaces—namely unemployed sised future state computed through some model. In [25] designs and missed diversity—may potentially correspond to predictive behaviours are further classified according the very solutions that would be able to respond optimally to to their “order”, namely the amount of context vari- a catastrophic event. ables their models take into account. Thus a system A treatise of collective behaviours is outside the scope of 5Here and in what follows, when not explicitly mentioned otherwise, quotes this paper. Interested readers may refer to, e.g., [4], [26], [29], are from [25]. [30]. C. Fragility as a measure of assumptions dependence Though orthogonal in their assumptions, the overheads The type of behaviour exercised by a system constitutes— associated with the design approaches corresponding to the we deem—a second important characteristic of that system above two models are not side-effect free (suffice it to consider with reference to its ability to improve dynamically its system- the effect of complex behaviours on the worst-case analyses environment fit. This “second coordinate” of a system’s fidelity called for, e.g., by hard real-time systems). Our tentative to systemic, operational, and environmental assumptions is answer to this problem is given by a new general scheme meant to bring to the foreground how dependant an open revising the one presented in Sect. III-A. In the new scheme system actually is on its system model—namely, on its the systems perform as follows: prescribed assumptions and working conditions [12], [31]. 1) Monitor the drifting of their ∆ functions and possibly Classes of resilient behaviours allow us to assess qualita- other context figures providing insight on the current tively a system’s “fragility” (conversely, robustness) to the environmental conditions. variability of its environmental and systemic conditions. As 2) Build simple, low-overhead models of the turbulence an example, let us consider the case of traditional electronic and chaotic nature of their environments. systems such as, e.g., the flight control system that was in use 3) While the current conditions and trend are deemed as in the maiden flight of the Ariane 5 rocket. A common trait “unsafe”, repeat: in such systems is that enacted behaviours are mostly very a) Build and maintain more complex reactive and simple (typically purposeful but non-teleological). While this proactive models to understand how the drifting enhances efficiency and results in a lean and cost-effective is impacting on one’s system identity. design, one may observe that it also produces a strong b) Plan and enact corrective behaviours choosing be- dependence on prescribed environmental conditions. It was tween the following two options: indeed a mismatch between the prescribed and the experienced i) Self-reconfiguration: the system reshapes itself conditions that triggered the chain of events that resulted in by choosing new system structures and new the Ariane 5 failure [19]. designs best matching the new environmen- tal conditions. Examples of self-reconfiguration IV. BEYONDBOTH ELASTICITYAND RESILIENCE strategies may be found, e.g., in [19]. We have introduced two complementary models to reason ii) Establish social relationships with neighbour- about the fidelity of open systems. The two models are ing systems. This may include for instance orthogonal, in the sense that they represent two independent simple actions such as “join collective sys- “snapshots” of the system under consideration: tem” or “leave collective system”, opportunistic 1) The Algebraic model regards the system as a predefined, strategies such as “improve one’s ∆’s to the immutable entity. The system conditions may drift but detriment of those of neighbouring systems”, the system exhibits no complex “motion”—no sophisti- or complex mutualistic relationships involving cated active behaviours are foreseen in order to reduce association, symbiosis, or mutual assistance. the drift. An example of said mutualistic relationships is 2) The behavioural model captures instead the dynamicity described in [15]. of the system. Also in this case the system measures c) Measure the effectiveness of the attempted solu- the system-environment fit, but the system may actively tions, rank them with respect to past solutions, use this measure in order to optimise its quality and derive and persist conclusions, and update the execution. reactive and proactive models accordingly. Intuitively, the first model is backed by redundant resources As can be clearly seen from its structure, the above scheme dimensioned through worst-case analyses; events potentially distinguishes two conditions: one in which system identity is able to jeopardise quality are masked out. The minimal non- not at stake, and correspondingly complexity and overhead functional activity translates in low overhead and simple are kept to a minimum, and one when new conditions are design. Embedded systems typically focus on this approach. emerging that may result in identity failures—in which case Conversely, the second model calls for complex abilities— the system switches to more complex behaviours. A self- among others awareness; reactive and proactive planning; managed, dynamic trade-off between these two approach, we quorum sensing [26]; collective strategy planning [4], etc. conjecture, may provide designers with a solution reconciliat- Events jeopardising quality are tolerated rather than masked; ing the benefits and costs of both options. We refer to future moreover, complex analyses and strategies are mandated by systems able to exercise said dynamic trade-offs as to “auto- the overhead typically associated with non-functional be- resilient”—a concept first sketched in [15]. haviours. This notwithstanding, said behaviours may be the As a final remark, the machine learning step 3c in the above only effective line of defence against the highly dynamic scheme implies that the more a system is subjected to threats environments characterising open embedded systems (such as and challenging conditions, the more insight will be acquired cyber-physical things [3]) and, a fortiori, future collective on how to respond to new and possibly more threatening situ- cyber-physical societies [5] and fractal social organisations [9]. ations. We conjecture that insight in this process may provide the designers with guidelines for engineering antifragile cyber- [13] F. Cristian and C. Fetzer, “The timed asynchronous distributed system physical systems [14]. model,” IEEE Trans. on Parallel and Distributed Systems, vol. 10, no. 6, pp. 642–657, June 1999.I [14] N. N. Taleb, Antifragile: Things That Gain from Disorder. Random V. CONCLUSIONS House Publishing Group, 2012.I,IV [15] V. De Florio, “Preliminary contributions towards auto-resilience,” in We presented two orthogonal models for the synchrony Proceedings of the 5th International Workshop on Software Engineering and real-timeliness of open computer systems such as modern for Resilient Systems (SERENE 2013), Lecture Notes in Computer electronic systems [2], cyber-physical systems, and collective Science 8166. Kiev, Ukraine: Springer, October 2013, pp. 141–155. II-A, III, III-A, 3(b)ii,IV organisations thereof. We discussed how each of the two [16] V. De Florio, “On the role of perception and apperception in ubiquitous models best-match certain operational conditions—the former, and pervasive environments,” in Proceedings of the 3rd Workshop stability; the latter, dynamicity and turbulence. Finally, we on Service Discovery and Composition in Ubiquitous and Pervasive proposed a scheme able to self-optimise system processing Environments (SUPE’12), August 2012. II-A [17] K. Boulding, “General systems theory—the skeleton of science,” Man- depending on the experienced environmental conditions. As agement Science, vol. 2, no. 3, April 1956. II-B the scheme also includes a machine learning step potentially [18] G. Leibniz and L. Strickland, The shorter Leibniz texts: a collection of able to enhance the ability of the system to adjust to adverse new translations, ser. Continuum impacts. Continuum, 2006. [Online]. Available: http://books.google.be/books?id=oFoCY3xJ8nkC II-B environmental conditions we put forward the conjecture that [19] V. De Florio, “Software assumptions failure tolerance: Role, strategies, antifragile systems may correspond to systems able to learn and visions,” in Architecting Dependable Systems VII, ser. Lecture while enacting elastic and resilient strategies. Future work will Notes in Computer Science, A. Casimiro, R. de Lemos, and C. Gacek, Eds. Springer Berlin / Heidelberg, 2010, vol. 6420, be devoted to simulating compliant systems with the support pp. 249–272, 10.1007/978-3-642-17245-8 11. [Online]. Available: of self-adaptation frameworks such as ACCADA [32], [33] http://dx.doi.org/10.1007/978-3-642-17245-8 11 II-B, III-C, 3(b)i and Transformer [34], [35]. [20] R. Charette, “Electronic devices, airplanes and inter- ference: Significant danger or not?” January 2011, iEEE Spectrum blog “Risk Factor”, available online REFERENCES through http://spectrum.ieee.org/riskfactor/aerospace/aviation/ electronic-devices-airplanes-and-interference-significant-danger-or-not. [1] F. Heylighen, “Basic concepts of the systems approach,” in Principia 4 Cybernetica Web, F. Heylighen, C. Joslyn, and V. Turchin, Eds. [21] V. De Florio, “On the constituent attributes of software and Principia Cybernetica, Brussels, 1998. [Online]. Available: http: organisational resilience,” Interdisciplinary Science Reviews, vol. 38, //pespmc1.vub.ac.be/SYSAPPR.htmlI, III no. 2, June 2013. [Online]. Available: http://www.ingentaconnect.com/ [2] S. Munaga and F. Catthoor, “Systematic design principles for cost- content/maney/isr/2013/00000038/00000002/art00005 III, III-A effective hard constraint management in dynamic nonlinear systems,” [22] J. Sachs, Aristotle’s Physics: A Guided Study, ser. Masterworks of International Journal of Adaptive, Resilient and Autonomic Systems, Discovery. Rutgers University Press, 1995. III-A vol. 2, no. 1, 2011.I,V [3] E. A. Lee, “Cyber physical systems: Design challenges,” EECS [23] Aristotle and H. Lawson-Tancred, De Anima (On the Soul), Department, University of California, Berkeley, Tech. Rep. UCB/EECS- ser. Penguin classics. Penguin Books, 1986. [Online]. Available: 2008-8, Jan 2008. [Online]. Available: http://www.eecs.berkeley.edu/ http://books.google.be/books?id=KsoFvv8vdM8C III-A Pubs/TechRpts/2008/EECS-2008-8.htmlI,IV [24] D. D. Runes, Ed., Dictionary of Philosophy. Philosophical Library, [4] W. Astley and C. J. Fombrun, “Collective strategy: Social ecology of 1962. III-A organizational environments,” The Academy of Management Review, [25] A. Rosenblueth, N. Wiener, and J. Bigelow, “Behavior, purpose and vol. 8, pp. 576–587, October 1983.I, III-B,IV teleology,” Philosophy of Science, vol. 10, no. 1, pp. 18–24, 1943. [5] H. Zhuge, “Cyber physical society,” in Semantics Knowledge and Grid [Online]. Available: http://www.journals.uchicago.edu/doi/abs/10.1086/ (SKG), 2010 Sixth International Conference on, Nov. 2010, pp. 1–8.I, 286788 III-B,5,5 IV [26] D. Schultz, P. G. Wolynes, E. Ben Jacob, and J. N. Onuchic, “Deciding [6] H. Sun, V. De Florio, N. Gui, and C. Blondia, “The missing ones: Key fate in adverse times: Sporulation and competence in bacillus subtilis,” ingredients towards effective ambient assisted living systems,” Journal Proc. Nat.l Acad. Sci., vol. 106, pp. 21 027–21 034, 2009.2, III-B,IV of Ambient Intelligence and Smart Environments, vol. 2, no. 2, April [27] B. McCallum and S. Lam, “Bacteria use ‘chemical twitter’ and 2010.I,3 ‘prisoner’s dilemma’ to make decisions,” Epoch Times, March [7] V. De Florio and C. Blondia, “Service-oriented communities: Visions 2012. [Online]. Available: http://www.theepochtimes.com/n2/science/ and contributions towards social organizations,” in On the Move to bacteria-use-chemical-twitter-and-prisoner-s-dilemma-to-make-decisions-211625. Meaningful Internet Systems: OTM 2010 Workshops, ser. Lecture Notes html2 in Computer Science, R. Meersman, T. Dillon, and P. Herrero, Eds. [28] H. Sun, V. De Florio, N. Gui, and C. Blondia, “Participant: A new Springer Berlin / Heidelberg, 2010, vol. 6428, pp. 319–328.I concept for optimally assisting the elder people,” in Computer-Based [8] B. Latour, “On actor-network theory. a few clarifications plus more than Medical Systems, 2007. CBMS ’07. Twentieth IEEE International Sym- a few complications,” Soziale Welt, vol. 47, pp. 369–381, 1996.I posium on, june 2007, pp. 295 –300.3 [9] V. De Florio, M. Bakhouya, A. Coronato, and G. Di Marzo Serugendo, [29] P. Sousa, N. Silva, T. Heikkila, M. Kallingbaum, and P. Valcknears, “Models and concepts for socio-technical complex systems: Towards “Aspects of co-operation in distributed manufacturing systems,” Studies fractal social organizations,” Systems Research and Behavioral Science, in Informatics and Control Journal, vol. 9, no. 2, pp. 89–110, 2000. vol. 30, no. 6, 2013.I,IV III-B [10] V. De Florio and C. Blondia, “Reflective and refractive variables: A [30] K. Guseva, “Formation and cooperative behavior of protein complexes model for effective and maintainable adaptive-and-dependable software,” on the cell membrane,” Ph.D. dissertation, Institute of Complex Systems in Proc. of the 33rd EUROMICRO Conference on Software Engineering and Mathematical Biology of the University of Aberdeen, 2012. III-B and Advanced Applications (SEAA 2007),Lubeck,¨ Germany, August [31] V. De Florio and G. Deconinck, “On some key requirements of mobile 2007.I application software,” in Proc. of the 9th Annual IEEE International [11] R. Kanai and N. Tsuchiya, “Qualia,” Current Biology, vol. 22, Conference and Workshop on the Engineering of Computer Based no. 10, pp. R392–R396, 2012. [Online]. Available: http: Systems (ECBS). Lund, Sweden: IEEE Comp. Soc. Press, April 2002. //www.emotion.caltech.edu/∼naotsu/Naotsugu Tsuchiyas homepage/ III-C papers for download files/Kanai2012Current%20Biology.pdfI [32] N. Gui, V. De Florio, H. Sun, and C. Blondia, “Toward [12] V. De Florio, Application-layer Fault-Tolerance Protocols. IGI Global, architecture-based context-aware deployment and adaptation,” Journal Hershey, PA, 2009.I, III-C of Systems and Software, vol. 84, no. 2, pp. 185–197, 2011. [Online]. Available: http://www.sciencedirect.com/science/article/ B6V0N-512K1M8-2/2/2aa895c4f0dfbb40505396cfed5f1ba3V [33] ——, “ACCADA: A framework for continuous context-aware deploy- ment and adaptation,” in Proceedings of the 11th International Sym- posium on Stabilization, Safety, and Security of Distributed Systems, (SSS 2009), ser. Lecture Notes in Computer Science, R. Guerraoui and F. Petit, Eds., vol. 5873. Lyon, France: Springer, November 2009, pp. 325–340.V [34] N. Gui and V. De Florio, “Towards meta-adaptation support with reusable and composable adaptation components,” in Proceedings of the sixth IEEE International Conference on Self-Adaptive and Self-Organizing Systems (SASO 2012). IEEE, 2012.V [35] N. Gui, V. De Florio, and T. Holvoet, “Transformer: an adaptation framework with contextual adaptation behavior composition support,” Software: Practice & Experience, 2012.V