Except for formatting, this report is identical to the paper published in IEEE Journal on Selected Areas in Communications, Volume 23, Number 12, December 2005. It was retroactively submitted as a Columbia Computer Science technical report on May 10, 2007 and is assigned a technical report number and date reflecting its original publication date. A Control Theory Foundation for Self-Managing Computing Systems Yixin Diao, Member, IEEE, Joseph L. Hellerstein, Senior Member, IEEE, Sujay Parekh, Student Member, IEEE, Rean Griffith, Gail E. Kaiser, Senior Member, IEEE, and Dan Phung Abstract—The high cost of operating large computing instal- lations has motivated a broad interest in reducing the need for human intervention by making systems self-managing. This paper explores the extent to which control theory can provide an architectural and analytic foundation for building self-managing systems. Control theory provides a rich set of methodologies for building automated self-diagnosis and self-repairing systems with properties such as stability, short settling times, and accurate regulation. However, there are challenges in applying control theory to computing systems, such as developing effective resource models, handling sensor delays, and addressing lead times in effector actions. We propose a deployable testbed for autonomic computing (DTAC) that we believe will reduce the barriers to addressing research problems in applying control theory to com- puting systems. The initial DTAC architecture is described along with several problems that it can be used to investigate. Index Terms—Actuator, closed loop control, dynamics, resource management, sensor, testbed. I. INTRODUCTION Fig. 1. Architecture for autonomic computing. HE HIGH COST of ownership of computing systems T has resulted in a number of industry initiatives to reduce The IBM autonomic computing architecture [3] provides a the burden of operations and management. Examples include framework in which to build self-managing systems. We use this IBM’s Autonomic Computing, HP’s Adaptive Infrastructure, architecture since it is broadly consistent with other approaches and Microsoft’s Dynamic Systems Initiative. All of these ef- that have been developed (e.g., [4]). Fig. 1 depicts the compo- forts seek to reduce operations costs by increased automation, nents and key interactions for a single autonomic manager and a ideally to have systems be self-managing without any human single resource. The resource (sometimes called a managed re- intervention (since operator error has been identified as a major source) is what is being made more self-managing. This could source of system failures [1]). While the concept of automated be a single system (or even an application within a system), or it operations has existed for two decades (e.g., [2]) as a way to may be a collection of many logically related systems. Sensors adapt to changing workloads, failures, and (more recently) provide a way to obtain measurement data from resources, and attacks, the scope of automation remains limited. We believe effectors provide a means to change the behavior of the resource. this is in part due to the absence of a fundamental understanding Autonomic managers read sensor data and manipulate effectors of how automated actions affect system behavior, especially, to make resources more self-managing. The autonomic manager system stability. Other disciplines such as mechanical, elec- contains components for monitoring, analysis, planning, and ex- trical, and aeronautical engineering make use of control theory ecution. Common to all of these is knowledge of the computing to design feedback systems. This paper uses control theory as a environment, service level agreements, and other related consid- way to identify a number of requirements for and challenges in erations. The monitoring component filters and correlates sensor building self-managing systems. data. The analysis component processes these refined data to do forecasting and problem determination, among other activities. Planning constructs workflows that specify a partial order of ac- Manuscript received June 30, 2005; revised July 20, 2005. The work of the Programming Systems Laboratory is supported in part by the National Science tions to accomplish a goal specified by the analysis component. Foundation under Grant CNS-0426623, Grant CCR-0203876, and Grant EIA- The execute component controls the execution of such work- 0202063, and in part by Microsoft Research. flows and provides coordination if there are multiple concurrent Y. Diao, J. L. Hellerstein, and S. Parekh are with the IBM Thomas J. Watson Research Center, Hawthorne, NY 10532 USA (e-mail: [email protected]; workflows. (The term “execute” may be broadened to “enact- [email protected]; [email protected]). ment” to include manual actions as well.) R. Griffith, G. E. Kaiser, and D. Phung are with the Computer Science In essence, the autonomic computing architecture provides a Department, Columbia University, New York, NY 10027-7003 USA (e-mail: [email protected]; [email protected]; [email protected]). blue print for developing feedback control loops for self-man- aging systems. This observation suggests that control theory might provide guidance as to the structure of and requirements for autonomic managers. Many researchers have applied control theory to computing systems. In data networks, there has been considerable interest in applying control theory to problems of flow control, such as [5] who develops the concept of a rate allocating server that regulates the flow of packets through queues. Others have ap- plied control theory to short-term rate variations in transmission control protocol (TCP) (e.g., [6]) and some have considered stochastic control [7]. More recently, there have been detailed models of TCP developed in continuous time (using fluid flow approximations) that have produced interesting insights into Fig. 2. Block diagram of a feedback control system. The reference input is the the operation of buffer management schemes in routers (see [8] desired value of the system’s measured output. The controller adjusts the setting and [9]). Control theory has also been applied to middleware of control input to the target system so that its measured output is equal to the reference input. The transducer represents effects such as units conversions and to provide service differentiation and regulation of resource delays. utilizations, as well as optimization of service level objectives. Examples of service differentiation include enforcing relative delays [10], preferential caching of data [11], and limiting • Target system, which is the computing system to be the impact of administrative utilities on production work [12]. controlled. Examples of regulating resource utilizations include a mixture • Control input, which is a parameter that affects the be- of queueing and control theory used to regulate Apache HTTP havior of the target system and can be adjusted dynam- Server [13], regulation of the IBM Lotus Domino Server ically (such as the MaxClients parameter in Apache [14], and multiple-input–multiple-output (MIMO) control of HTTP Server). Apache HTTP Server (e.g., simultaneous regulation of CPU • Measured output, which is a measurable characteristic of and memory resources) [15]. Examples of optimizing service the target system such as CPU utilization and response level objectives include minimizing response times of the time. Apache Web Server [16] and balancing the load to optimize • Disturbance input, which is any change that affects the database memory management [17]. way in which the control input influences the measured The foregoing illustrates the value of using control theory to output of the target system (e.g., running a virus scan or a construct self-managing systems as first described in [18]. Here, backup). we go beyond our earlier work by including a case study of ap- • Noise input, which is any effect that changes the measured plying control theory to an IBM software product, and we in- output produced by the target system. This is also called clude more details on a deployable testbed for research in the sensor noise or measurement noise. application of control theory to autonomic computing. Specif- • Reference input, which is the desired value of the mea- ically, Section II seeks to educate systems oriented computer sured output (or transformations of them), such as CPU science researchers and practitioners on the concepts and tech- utilization should be 66%. Sometimes, the reference input niques needed to apply control theory to computing systems. is referred to as desired output or the setpoint. Section III presents a case study of applying control theory to • Transducer, which transforms the measured output so an IBM database management product. Section IV proposes a that it can be compared with the reference input (e.g., deployable testbed for autonomic computing (DTAC) that is in- smoothing stochastics of the output). tended to foster research that addresses the challenges identified. • Control error, which is the difference between the refer- Our conclusions are contained in Section V. ence input and the measured output (which may include noise and/or may pass through a transducer). • Controller, which determines the setting of the control II. CONTROL THEORETIC FRAMEWORK input needed to achieve the reference input. The controller computes values of the control input based on current and This section relates control theory to self-managing systems. past values of control error. The foregoing is best understood in the context of a specific A. Components of a Control System system. Consider a cluster of Apache Web Servers. The admin- Over the last 60 years, control theory has developed a fairly istrator may want these systems to run at no greater than 66% simple reference architecture. This architecture is about manip- utilization so that if any one of them fails, the other two can ulating a target system to achieve a desired objective. The com- immediately absorb the entire load. Here, the measured output ponent that manipulates the target system is the controller. In is CPU utilization. The control input is the maximum number terms of Fig.