On resilient behaviors in computational systems and environments

14 Pages·2015·0.79 MB·English

by  Vincenzo De Florio

JReliableIntellEnviron(2015)1:33–46
DOI10.1007/s40860-015-0002-6
ORIGINAL ARTICLE
On resilient behaviors in computational systems and environments
VincenzoDeFlorio1
Received:17December2014/Accepted:31March2015/Publishedonline:1May2015
©SpringerInternationalPublishingSwitzerland2015
Abstract Thepresentarticleintroducesareferenceframe- peculiar domain-specific meanings [17]. To exacerbate the
work for discussing resilience of computational systems. problem,eveninthecontextofthesamedisciplineoftenno
Ratherthanapropertythatmayormaynotbeexhibitedbya consensushasbeensofarreachedastowhatarethepeculiar
system,resilienceisinterpretedhereastheemergingresultof aspectsofresilienceandwhatmakesitdifferentfrom,e.g.,
adynamicprocess.Saidprocessrepresentsthedynamicinter- elasticity,dependability,orantifragility.
playbetweenthebehaviorsexercisedbyasystemandthoseof Thepresentarticlecontributestowardsasolutiontothis
theenvironmentitissettooperatein.Asaresultofthisinter- problem in several ways. First, in Sect. 2, we introduce
pretation,coherentdefinitionsofseveralaspectsofresilience resilience, compare various of its domain-specific defini-
can be derived and proposed, including elasticity, change tions,andderiveanumberofancillaryconceptsandworking
tolerance,andantifragility.Definitionsarealsoprovidedfor assumptions. This allows resilience to be interpreted in
measuresoftheriskofunresilienceaswellasfortheoptimal Sect.3asthepropertyemergingfromtheinteractionofthe
matchofagivenresilientdesignwithrespecttothecurrent behaviors exercised by a system and the environment it is
environmentalconditions.Finally,aresiliencestrategybased settooperatein.Theoutcomeofsaidinteractiondependson
onourmodelisexemplifiedthroughasimplescenario. bothintrinsicandextrinsicfactors:the“traits”ofthesystem
together with its endowment—the system’s peculiar char-
Keywords Resilience · Elasticity · Computational acteristics as well as its current state and requirements. At
antifragility·Behavior·Autonomiccomputing stake is the identity of the system, which we identify here
with compliance to system specifications, including func-
tionalandnon-functionalsystemrequirements.
1 Introduction Theresilienceinteractionismodeled byconsidering the
behaviorsproducedbythesystemanditsenvironment.This
Resilience is one of those “general systems attributes” that provides us with a unifying framework within which it is
appeartoplayacentralroleinseveraldisciplines.Examples possibletoexpresscoherentdefinitionsofconceptssuchas
includeecology,business,psychology,industrialsafety[32], elasticity, entelechism (change tolerance), and antifragility.
microeconomics,computernetworks,security,management Bothsystemandenvironmentarefurthermodeledinterms
science,cybernetics,controltheory,aswellascrisisanddis- ofthe“resilienceorgans”managingthefivemajorservices
astermanagementandrecovery[17,22,35,42,50].Although ancillary to resilience [12,13]: perception, apperception,
commontraitsareretained,ineachdisciplineresiliencetakes planning, executive, and knowledge management organs—
correspondingtothefivemodulesofautonomicsystems[30].
B Afterthis,inSect.4,weintroducemeasuresoftheoptimality
VincenzoDeFlorio
vincenzo.defl[email protected]; ofagivenresilientdesignwithrespecttothecurrentenviron-
vincenzo.defl[email protected] mental conditions: system supply and system–environment
fit.OnesuchstrategyisdetailedandexemplifiedinSect.5
1 MOSAICResearchGroup,iMindsResearchInstitute,
through an ambient intelligence scenario. Finally, major
UniversityofAntwerp,Middelheimlaan1,2020Antwerp,
Belgium resultsarerecalledandfinalconclusionsaredrawninSect.6.
123
34 JReliableIntellEnviron(2015)1:33–46
2 Basicconcepts its original shape upon unloading” [38]. Beyond the
mentioned threshold, deformation is irreversible:“some
The term “resilience” comes from Latin resil¯ıre, “to spring residual strain will persist even after unloading” (ibid.)
back, start back, rebound, recoil, retreat”, and is often Here resilience is a property rather than a process, the
intended and defined as the ability to cope with or recover key difference being the type of behavior exercised by
fromchange.AsmentionedinSect.1,thisgeneraldefinition the“systems”.Systemidentityisinthiscaserepresented
hasbeenspecializedindifferentdomains,ineachofwhich bytheshapeorthecharacteristicsofthematerial.
ithastakendomain-specifictraits: – Incivilengineering,resilienceisaconstruction’sability
to absorb or avoid damage in the face of a natural or
– Inecology,resilienceoftenreferstoanecosystem’sability man-induced abnormal condition [29] such as flooding,
torespondtoandrecoverfromanecologicalthreat[27]. hurricanes,orfirepower.Theconsiderationsdoneinthe
“Recovering”meansheretheabilitytoreturntoasteady caseofmaterialscienceapplyalsotothiscase.
statecharacterizingtheecosystembeforethemanifesta- – Finally,incomputerscience,resiliencehasbeendefined,
tionofthethreat.Thementioned“steadystate”represents e.g., as the ability to sustain dependability when facing
thepeculiarcharacteristicsoftheresilientecosystem—its changes[32].Thistranslatesintotheabilitytoavoidfail-
identity. ureandatthesametimetheabilitytosustainthedelivery
– Incomplexsocioecologicalsystems,resilienceistheabil- oftrustworthyservices.Systemidentityisinthiscaseas
ity to absorb stress and maintain function in the face inthefollowingdefinition.
of climate change [23]. “Absorbing stress” clearly cor-
responds to the “recovering” ability found in ecology, Definition1 (Systemidentity)Intheframeworkofartificial,
thoughinthiscontexttheidentityofthesystemliesinits computer-basedsystems,systemidentityisdefinedasasys-
functionratherthaninitsstate.Anadditionalandpeculiar tem’scompliancetoitssystemspecificationsandinparticular
aspectofresilientsystemsinthisdomainisgivenbytheir to its functional and non-functional quality of service and
abilitytoimprovesystematicallytheirsustainability. qualityofexperiencerequirements.
– Inorganizationscience,(organizational)resilienceis“the
capacity to anticipate disruptions, adapt to events, and As already remarked, with the change of the reference
createlastingvalue”[3].Here,theaccentsareonproac- domaintheabovenotionsofresilienceareappliedtoaspec-
tiveness and adaptation rather than on “springing back” trum of entities ranging from simple, passive-behaviored,
toapaststateorfunction.Intuitively,onemaydeductthat individualobjectstocomplex,teleological,collectiveadap-
theformerclassofbehaviorsismoreadvancedthanthe tive systems. By making use of the behavioral approach
latterone.Onemayalsoobservehowinthiscasethedefi- introduced by Wiener et al. in [37], and briefly recalled in
nitionbringstotheforegroundafundamentalcomponent Sect. 3.1, in what follows three major classes in this spec-
ofsystemidentity,namelytheabilitytocreatevalue. trumareidentified.
– In social science and human ecology, resilience is “the
ability of groups or communities to cope with external 2.1 Elasticobjectsandsystems
stresses and disturbances as a result of social, political
andenvironmentalchange”[1].Here,therecoverystrat- Resilience shall be referred to as elasticity when the sys-
egy of resilience is not made explicit. System identity tem under consideration is only capable of simple types
implicitlyreferstotheidentityofgroupsandcommuni- of behaviors: passive behavior and active, purposeful, non-
tiesandrangesfromsocioculturalaspectsuptotheability teleological behaviors. In the former case, the system shall
tosurvive. bereferredtoasanobject.
– Inpsychology,“resilienceistheprocessofadaptingwell The considerations made above with reference to, e.g.,
in the face of adversity, trauma, tragedy, threats or sig- material science, apply also in this case. In particular, for
nificant sources of stress [...] It means ‘bouncing back’ bothobjectsandservo-mechanismsresilience(elasticity)is
fromdifficultexperiences”[4].Animportantaspecthere representedasanintrinsicproperty:atrait.
istheidentificationofresilienceasaprocess:“Resilience Elasticsystemsabletoexerciseactivebehaviorsarewhat
should be considered a process, rather than a trait to be Boulding refers to in [7] as “servo-mechanisms”—systems
had” [39]; see also [24,34]. “System” identity is in the whoseactionispredefinedandisnotmodifiedbytheinter-
case of psychology the collection of beliefs about one- actionwithothersystems.Infact,servo-mechanismsdonot
self. “interact with other systems outside of themselves” [26]—
– In material science, resilience is a material’s property namely,theyarenotopensystems.
to “stay unaffected by an applied stress” up to some Elastic systems and objects operate under the assump-
threshold, called “point of yielding”, and to “return to tionthattheirenvironmentsarenotgoingtoexercisestress
123
JReliableIntellEnviron(2015)1:33–46 35
beyondtheirpointofyielding.QuotingN.N.Taleb,theyare Overshooting reminds of the condition of the shell-snail
systemthat“donotcaretoomuch”abouttheirenvironments. that,“feelingalwaysindangerofbirds,livesconstantlyunder
Another way to characterize elastic objects and systems itsshield”[6,p.147]—thuscarryingitsweightatalltimes
isbyobservingthattheyhaveapredefinedandstaticpoint regardlessoftheactualpresenceorabsenceofbirds.
of yielding. This introduces two syndromes, which we call
“elasticundershooting”and“elasticovershooting.”
2.1.3 Observations
2.1.1 Elasticundershooting Elasticundershootingandovershootingmaybebetterunder-
stood when considering a well-known result by Shan-
Elastic objects or systems are characterized at design time non [45]: given an unreliable communication channel, it is
by a static yielding point beyond which they permanently always possible to transfer information reliably through it
lose their identity—for instance, they deformate; or break providedthatasufficientamountofinformationredundancy
down;orfail;orbecomeuntrustworthy.Theyieldingpointis is foreseen. By means of the above-introduced terminol-
thereforearesiliencethreshold.Whateverthecharacteristics ogy,Shannon’sresultmaybeformulatedasfollows:forany
of an elastic object or system, there is always a non-zero communicationchannelwhoseobservedunreliabilityisy(t)
probabilitythattheyieldingpointwillbeovercome. throughoutagiventimeintervalT,itispossibletodefinean
elasticcommunicationprotocolwithayieldingpoint
Definition2 (Elasticundershooting)Whenattimetanelas-
tic object or system with yielding point Y is insufficiently
Y > y(t) ∀t ∈T.
resilientwithrespecttoanexperiencedconditionforwhich
ayieldingpoint y(t)wouldberequired,weshallcallelastic
Ideally, the choice of Y should be such that Y represents
undershooting(orsimplyundershooting,whenthismaybe
thesupremumofalltheunreliabilitysamples y(t)observed
done without introducing ambiguity) the dynamic quantity
y(t)−Y. duringT.Inthisidealcase,noundershootingisexperienced,
althoughthesystemexhibitsacumulativeovershootingequal
Undershootingisinfactasinawell-knownfairytale[28]: to
onemaymaketheirhouseofstraw,ofwood,orevenofbricks; (cid:2)
althoughmoreandmorerobust,eachhousewill“just”shift Y −y(t)dt.
the yielding point farther away; but that is all: there is no
T
guaranteethat,soonerorlater,somethingstrongerwillshow
upandblowthathousedown,whateverthematerialitismade In more concrete situations in which unreliability drifting
of.Developmentandoperatingcosts,ontheotherhand,will isunbound,undershootingwouldoccureachtimethevalue
growupproportionallytothechosenyieldingpoint—which chosenforY wouldbelessthantheobservedunreliabilityof
bringsustothesecondsyndrome. thechannel.
2.1.2 Elasticovershooting 2.2 Systementelechies
Thechoiceoftheyieldingpointrepresentstheabilitytocope In Sect. 2, we have concisely reviewed a number of defi-
withaworst-casescenarioregardlessofhowfrequentlysaid nitions of resilience emerged in the framework of diverse
condition will actually manifest itself. Unless the environ- disciplinesanddomains.Severalofsuchdefinitionsexplic-
mentalconditionsaredeterministicandimmutable,therewill itly require a resilient system to enact complex forms of
always be a non-zero probability that the yielding point is behaviors: adapt reactively (see, e.g., in ecology and psy-
morepessimisticthanwhattheexperiencedconditionwould chology) and adapt proactively (see, e.g., in organizational
require.Inotherwords,anelasticsystemispreparedforthe science). Such behaviors correspond respectively to simple
worst;butalsoitcostsandexpendsresourcesasiftheworst teleologicalbehaviorsandextrapolativeteleologicalbehav-
wasactuallythereallthetime. iors(asdefinedin[37]andrecalledinSect.3.1):behaviors
that are driven respectively by the current state and by the
Definition3 (Elasticovershooting)Whenattimetanelastic hypothesized future state of an intended objective. Obvi-
objectorsystemwithyieldingpointYisresilientwithrespect ously, in this case, resilience cannot be regarded as a trait
toanexperiencedconditionforwhichayieldingpoint y(t) or attribute; rather, it is the emerging result of a process.
wouldsuffice,weshallcallelasticovershooting(orsimply Resilient systems are in motion to actively pursue the per-
overshooting, when this may be done without introducing sistence of their system identity. The two just mentioned
ambiguity)thequantityY −y(t). aspectscorrespondtothetranslationthatJoeSachsprovides
123
36 JReliableIntellEnviron(2015)1:33–46
of the Aristotelian concept of entelechy1: “being-at-work- 2.3 Antifragilesystems
staying-itself”[40,41].Anentelechyisasystemthatisable
to persist and sustain its completeness through a resilient InthelightofthediscussioninSects.2.1and2.2,onemay
process.“Completeness”hereistobeintendedasthecharac- observethatmostofthereporteddefinitionsofresiliencecor-
teristicsthatmakeofasystemwhatitis:its“definition”—or, respondtoeitherelasticobjects/systemsortoentelechies.
inotherwords,itssystemidentity.Becauseofthis,weshall Anexceptionmaybefoundintheclassofcomplexsocioe-
refertothesystemsinthisresilienceclassastoentelechies. cologicalsystems.Therewehavesystemsthat“areatwork
Theverynatureofentelechiesrequiresthemtobeableto to stay themselves” (thus, they are entelechies), though are
“interactwithothersystemsoutsideofthemselves”,namely endowedwithanadditionalfeature:theability“toimprove
to be open systems [26]. Such systems do not “want tran- systematically their sustainability”. Wiener et al. did not
quility” nor expect their environments to be stable or stay explicitlyconsiderbehaviorsincludingthatability[37].The
thesame.Onthecontrary,theyassumeconditionswillvary, mostcloselyrelatedoftheirbehavioralclasses—onecould
and adjust their function to the observed conditions or to sayitsgenusproximum[9]—isgivenbyteleologicalbehav-
speculatedfutureconditionsoftheirenvironments. iors.
Another way to distinguish entelechies from elastic As discussed in more detail in Sect. 3.1, teleological
objects and systems is by observing that entelechies are systems are those characterized by a feedback loop: their
characterized by dynamic and adaptive points of yielding. behavior
Undershootingsandovershootingsarestillpossible,though
“iscontrolledbythemarginoferroratwhichthe[sys-
withaslightlydifferentformulation:
tem]standsatagiventimewithreferencetoarelatively
Definition4 (Entelechial undershooting) When, at time specificgoal”[37].
t, an entelechy with yielding point Y(t) is insufficiently
Duetoitspurelybehavioralnature,theapproachfollowedin
resilientwithrespecttoanexperiencedconditionforwhich
the cited work does not cover organizational, architectural,
a yielding point y(t) would be required, we shall call ent-
and structural aspects. Because of this, no account is given
elechial undershooting (or simply overshooting, when this
onthemodificationsthatateleologicallybehavioredsystem
may be done without introducing ambiguity) the dynamic
wouldapplytoitselftoachieveitsgoal.
quantity y(t)−Y(t).
Atleastthefollowingfourcasesmayoccur:
Definition5 (Entelechialovershooting)When,attimet,an
entelechy with yielding point Y(t) is resilient with respect 1. Thefeedbackloopispurelyexogenous:thesystemaction
toanexperiencedconditionforwhichayieldingpoint y(t) is simply steered towards the goal (in its current or
wouldsuffice,weshallcallentelechialovershooting(orsim- hypothesizedfutureposition.)
plyovershooting,whenthismaybedonewithoutintroducing 2. The feedback loop is both exogenous and endogenous.
ambiguity)thequantityY(t)−y(t). Internalchangesonlyconcernsthe“knobs”,namelythe
parametersofthesystem.Thiscasecorrespondstopara-
An exemplary entelechy is given by an adaptive com- metricadaptation.
municationprotocolforthereliablecommunicationoveran 3. The feedback loop is both exogenous and endogenous;
unreliablechannelcharacterizedby y(t)unreliability.Such the internal changes adapt the structure of the system.
protocolwouldcontinuously“beatwork”soastoestimate This corresponds to system reconfigurations (namely
pastandcurrentvaluesof y(t)andextrapolatewiththema structuraladaptation).Adaptationsarephenotypicaland
futurestatey(t(cid:4)).Oncethisspeculatedfuturevalueisknown, donotaffecttheidentityofthesystem.Furthermore,the
theprotocolwould“stayitself”bychoosingayieldingpoint experienceleavesnotraceontheidentityofthesystem.
Y(t(cid:4))ascloseaspossiblebutstillgreaterthan y(t(cid:4)). 4. The feedback loop is both exogenous and endogenous;
Moreformally,thechoiceforY(t(cid:4))wouldbesuchthat theinternalchangesadaptanyofthefollowingaspects:
thefunction;thestructure;thearchitecture;andtheorga-
0<Y(t(cid:4))−(cid:2)(y(t(cid:4)))<ε, (1) nization of the system. Changes are genotypical: they
are persisted and modify permanently the nature of the
where (cid:2)(y(t(cid:4))) represents a prediction of y(t(cid:4)) and ε > 0
system.
expresses a safety margin to cover for inaccuracies in the
prediction.
Itisimportanttoremarkthat,whileincases1–3thesystem
is“atworktostayitself”[40,41],incase4thesystemis“at
1 QuotingSachs,“Entelecheiameanscontinuinginastateofcomplete-
worktogetbetter”.Atleastinthecaseofcomplexsocioeco-
ness,orbeingatanendwhichisofsuchanaturethatitisonlypossible
logicalsystems,teleologicalbehaviorsbelongtothisfourth
tobetherebymeansofthecontinualexpenditureoftheeffortrequired
tostaythere.”[40]. category:throughtheirexperience,thosesystemselaboratea
123
JReliableIntellEnviron(2015)1:33–46 37
feedbackthatisalsoendogenousandaffectsthegenotypical reached with a consumption of resources lower than in the
ability“toimprovesystematicallytheirsustainability”.The originalalgorithm.
feedbackthusaffectstheidentityofthesystem.Ratherthan At the same time, it is important to observe how the
adapting,thesystemevolves. introduced interleaving would affect several peculiar char-
In the case of complex socioecological systems, said acteristicsoftheprotocol—forinstance,itwouldintroduce
evolution leads to an improvement in sustainability: those jitter (viz., a drifting in the periodicity of the messages).
systems “enhance the level of congruence or fit between Repercussions on the validity of the specifications become
themselves and their surroundings” [47]. This matches the thenpossible.Forinstance,iftheprotocolwereintendedfor
concept introduced by Taleb in [48]: antifragile systems. ateleconferencingservice,theintroducedjitterwouldaffect
Quoting from the cited reference, “Antifragility is beyond thequalityofexperienceoftheusersofthatservice.Embed-
resilienceorrobustness.Theresilientresistsshocksandstays dingthesameprotocolinaserviceinsensibletoperiodicity
thesame;theantifragilegetsbetter.” drifting(suchasafiletransferringservice)wouldnottrans-
In what follows, we distinguish explicitly this class of lateinalossofsystemidentity.
teleologicalbehaviorsandsystemsbyreferringtothemasto
antifragilesystems,whichwedefineasfollows:
2.4 Afewobservations
Definition6 (Antifragile system) We shall call a system
“antifragile” if it is able to exercise teleological behaviors Asasummaryofthediscussioninthissection,wecanderive
that evolve the system and its identity in such a way as to hereanumberofobservations:
systematicallyimprovethefitwiththeirenvironment.
Byconsideringthejustenunciateddefinition,wecanobserve
2.4.1 Resilienceisarelativefigure
that
Asobservedin[16],resilienceisadynamicpropertywhose
– Antifragilesystemsarenotnecessarilymoreresilientthan
emergenceisinfluencedbyatleastthefollowingtwofactors:
entelechiesorelasticobjectsandsystems.Asitisthecase
forthoseentities,alsoantifragilesystemsarecharacter-
ized by a yielding point—a resilience threshold beyond 1. Theintrinsiccharacteristicsofthesystem:inparticular,
which they would fail; break down; or become untrust- whetherthesystemiselastic,entelechial,orantifragile.
worthy. 2. The extrinsic “level of congruence or fit between [the
– Antifragilesystemsmutatetheirsystemidentity.Byrefer- system]and[its]surroundings”[47].
ring to Definition 1, this means that the behaviors of
antifragilecomputer-based systemsmaydriftoutsideof
Thefirstfactorisabsoluteinnatureandtellshow“evolved”
whatprescribedintheirspecifications.Scenariossuchas
the class of the system is. The second factor is a relative
those that Stephen Hawking [25] and many others [33]
one, and tells how the system’s behavior is able to match
arewarningofbecomemoreconcretewhenconsidering
theconditionscurrentlyexpressedbytheenvironment.This
thisparticularcharacteristicofantifragilesystems.
secondfactormakesofresiliencearelativefigure.Whatever
– Antifragilesystemsmustpossesssomeformofawareness
asystem’sstructure,organization,architecture,capabilities,
oftheircurrentandpastsystem–environmentfit;inpar-
and resources, that system is resilient only so long as its
ticular,theymustbeabletocreateandmaintainamodel
implementation matches the conditions currently exercised
oftheriskoflosingoneormoreaspectsoftheirsystem
bytheenvironment2.
identity.
Going back to the communication protocol presented in 2.4.2 Resilienceistheproductofaninterplaybetween
Sect.2.2,anexemplaryantifragilesystemwouldbeaproto- asystemanditsenvironment
colthat,inadditiontobeingabletoestimatequantity y(t(cid:4)),
also learns how to mutate its own algorithm so as to profit AsacorollarytowhatmentionedinSect.2.4.1,weobserve
from the characteristics of the environment. As an exam- thatresilienceisnotaproperty,butrathertheproductofaa
ple,insteadofsending,say,Y redundantcopiesforeachof process.Suchprocesscorrespondstothedynamicinterplay
the packets of its messages, the protocol could realize that betweentwoentities:asystemanditsenvironment.
abetterstrategy(withrespecttothecurrentbehaviorofthe
channel) would be that of interleaving the transmission of
packets of different messages. This would result in a more 2 Possibly,thefirstScholartohavedistinguishedintrinsicandextrinsic
efficientstrategysuchthatahigheryieldingpointwouldbe factorstowardstheemergenceofresiliencewasvonLeibniz[15].
123
38 JReliableIntellEnviron(2015)1:33–46
2.4.3 Theenvironmentisasystem naturalevents”,namely“theexaminationoftheoutputofthe
objectandoftherelationsofthisoutputtotheinput”3.The
“Environment”isinterpretedhereandinwhatfollowssim- term“object”inthecitedpapercorrespondstothatof“sys-
ply as another system; in particular, as a collective system tem”.Inthatrenownedtext,theauthorspurposely“omitthe
(in other words, a “system-of-systems”) taking different specificstructureandtheintrinsicorganization”ofthesys-
shapes, including for instance any combination of cyber- temsunderscrutinyandclassifythemexclusivelyonthebasis
physical things; biological entities such as human beings; of the quality of the “change produced in the surroundings
servo-mechanisms;andintelligentambientsabletoexercise by the object”, namely the system’s behavior. The authors
complexteleologicalbehaviors. identifyinparticularfourmajorclassesofbehaviors4:
2.4.4 Resilienceisaninterplayofbehaviors βran:Randombehavior.Thisisanactiveformofbehav-
ior that does not appear to serve a specific purpose or
Resilience is one of the possible outcomes of an interplay
reachaspecificstate.Asourceofelectromagneticinter-
of behaviors. If and only if the interplay between the sys-
ferenceexercisesrandombehavior.
tem behaviors and the environmental behaviors is one that βpur: Purposeful, non-teleological behavior. This is
preservesthesystemidentitythenthesystemwillbecalled
behavior that serves a purpose and is directed towards
resilient.AsdiscussedinSect.3.1,behaviorsmayrangefrom
aspecificgoal.Inpurposefulbehavior,a“finalcondition
therandombehaviorstypicalofelectromagneticsourcesup
towardwhichthemovement[oftheobject]strives”can
tothe“intelligent”,cyberneticbehaviorscharacterizing,e.g.,
beidentified.Servo-mechanismsprovideanexampleof
humanbeingsandcomplexambientenvironments.
purposefulbehavior.
βrea:Reactive,teleological,non-evolutivebehavior.This
2.5 Preliminaryconclusions
isbehaviorthat“involve[s]acontinuousfeedbackfrom
the goal that modifies and guides the behaving object”.
Amajorconclusionhere—andastartingpointforthetreatise
Examplesofthisbehaviorincludephototropism,namely
innextsection—isgivenbytheintuitivenotionthatevaluat-
thetendencythatcanbeobserved,e.g.,incertainplants,
ingresiliencemustbedonenotmerelyconsideringasystem’s
to grow towards the light, and gravitropism, viz., the
intrinsiccharacteristics;rather,itshouldbedonebyexpress-
tendencyofplantrootstogrowdownwards.Asalready
ing in some convenient form the dynamic fit between the
mentioned(seeSect.2.2),reactivebehaviorsrequirethe
systemanditsenvironment.Thismaybeobtained,e.g.,by
system to be open [26] (i.e., able to continuously per-
comparingtheresilienceclassofthesystemwiththedynam-
ceive, communicate, and interact with external systems
icallymutatingresilienceclassoftheenvironment.Another,
andtheenvironment)andtoembodysomeformoffeed-
moredetailedmethodcouldbebycomparingthebehaviors backloop.Classβreaisnon-evolutive,meaningthatthe
ofsystemandenvironment.Yetanotherapproachcouldbeto
experiencedchangedoesnotinfluencetheidentityofthe
applythebehavioralcomparisonmethodtospecificorgans
system(cf.Sect.2.3).
ofthesystemanditsenvironment—forinstancethoseorgans βpro: Proactive, teleological, non-evolutive behavior.
thatarelikelytoplayasignificantroleintheemergenceof
Thisisbehaviordirectedtowardstheextrapolatedfuture
resilienceoritsopposite.
state of the goal. The authors in [37] classify proactive
Inwhatfollows,wefocusonthelastmentionedapproach.
behavior according to its “order”, namely the amount
of context variables taken into account in the course of
3 Resilientbehaviors,organs,andmethods the extrapolation. As class βrea, so class βpro is non-
evolutive.
Toproceedwiththepresenttreatise,wefirstrecallinSect.3.1
themajorclassesofbehaviorsaccordingtotheclassicdiscus-
ByconsideringtheargumentsinSect.2.3,afifthclasscan
sionbyRosenblueth,Wiener,andBigelow[37].Afterthis,in
beadded:
Sect.3.2,fivemajorservicesthatplayakeyroletowardsthe
emergence of resilience areidentified. Finally, inSect. 3.3,
weusetheconceptsintroducedsofartoreformulatedefini- βant:teleologicalevolutivebehaviors.Thisisthebehav-
ioremergingfromantifragilesystems(seeSect.2.3for
tionsforelasticity,entelechism,andantifragility.
moredetailedonthisclassofsystems).
3.1 Behavioralclassification
3 If not otherwise specified the quotes in the present section are
As already mentioned, Rosenblueth, Wiener, and Bigelow from[37].
introducedin[37]theconceptofthe“behavioristicstudyof 4 Forthesakeofbrevitypassivebehaviorshallnotbediscussedhere.
123
JReliableIntellEnviron(2015)1:33–46 39
Eachoftheabovefiveclassesmayseetheirsystemsoper- π) and (2) β is based on a set of context figures that
2
ateinisolationorthroughsomeformofsocialinteraction.To extendsβ ’s.
1
differentiatethesetwocases,weaddthefollowingattribute: 2. (π(β )≤π(β ))∧(∃(F,G):β =β|F|∧β =β|G|∧
1 2 1 1 2 2
F (cid:2)G).
σ(b): True when b is a social behaviors. This attribute Thiscaseisequivalenttocase1,theonlydifferencebeing
identifies behaviors based on the social interaction inthenotationothebehavior.
with other systems deployed in the same environment. 3. (π(β1)=π(β2))∧(σ(β1)=false)∧(σ(β2)=true).In
Examples of such behaviors include, among others, otherwords,β1 ≺β2alsowhenbothβ1andβ2belongto
mutualistic,Commensalistic,parasitic,co-evolutive,and thesamebehavioralclass,thoughβ2isasocialbehavior
co-opetitive behaviors [5,8]. For more information, the whileβ1isnot.
readerisreferredtoBoulding’sdiscussioninhisclassic
paper [7] and, for a concise survey of social behaviors, Foranytworesilientsystemsp andp ,respectively,char-
1 2
to[17]. acterized by behavioral classes β and β , if β ≺ β then
1 2 1 2
p is said to exhibit “systemically inferior” resilience with
1
The resilience classes introduced in Sect. 2 can now be respectto p .
2
characterizedintermsoftheabovebehavioralclasses:elas- It is important to observe that ≺ is about the intrinsic
tic systems correspond to βpur; non-evolving entelechies resiliencecharacteristicsofthesystem(seeSect.2.4.1).Par-
exerciseeitherβreaorβprobehaviors;while,asalreadymen- tialorder≺doesnottellwhichsystemis“moreresilient”;it
tioned,βantpertainstoantifragilesystems. highlightsthatforinstancesystem“dog”isabletoexercise
We shall define π as a projection map returning, for behaviorsthatarelesscomplexthanthoseofsystem“man”.
eachoftheabovebehaviorclasses,anintegerin{1,...,5} This tells nothing about the extrinsic “level of congruence
(π(βran) = 1, …, π(βant) = 5). Aim of π is twofold: orfit”[47]thatforinstancea“man”ora“dog”mayexhibit
itassociatesaninteger“identifier”toeachbehavioralclass inagivenenvironment.Asexemplified,e.g.,in[14],when
and it introduces an “order” among classes. Intuitively, the a threat is announced by ultrasonic noise, a “dog” able to
higheristheorderofclass,themorecomplexisthebehavior. perceive the threat and flee could result more resilient than
In what follows, it is assumed that behaviors manifest a“man”.Theuseofsentinelspecies[44]isinfactasocial
themselves by changing the state of measurable properties. behaviorbasedonthisfact.Anapplicationofthisprinciple
Asanexample,behaviormaytranslateintoavariationinthe isgiveninSect.5.
electromagneticspectrumperceivedasachangeinluminos-
ityorcolor.Contextfiguresarethetermthatshallbeusedto
3.2 Resilienceorgans
refertothosemeasurableproperties.
Foranybehaviorβ dependentonasetofcontextfigures
x
Asdonein[16],itisconjecturedherethatreasoningabouta
F,notationβF willbeusedtodenotethatβ isexercisedby
x x system’sresilienceisfacilitatedbyconsideringthebehaviors
considering the context figures in F. Thus if, for instance,
of the system organs that are responsible for the following
F = (speed,luminosity), then βrFea refers to a reactive
abilities:
behaviorthatrespondstochangesinspeedandlight.
Foranybehaviorβ andanyintegern > 0,notationβn
x x
willbeusedtodenotethatβ isexercisedbyconsideringn M:theabilitytoperceivechange;
x
A:theabilitytoascertaintheconsequencesofchange;
contextfigures,withoutspecifyingwhichones.
Asanexample,behaviorβp|Fro|,with F definedasabove, P: the ability to plan a line of defense against threats
identifiesanorder-2proactivebehavior,whileβpFro saysin derivingfromchange;
E:theabilitytoenactthedefenseplanbeingconceived
addition that that behavior considers both speed and lumi-
instepP;
nositytoextrapolatethefuturepositionofthegoal.
K:and,finally,theabilitytotreasureuppastexperience
Now,theconceptofpartialorderamongbehaviorsisintro-
andsystematicallyimprove,tosomeextent,abilitiesM,
duced.
A,P,andE.
Definition7 (Partial order of behaviors) Given any two
behaviors β1 and β2, β1 ≺ β2 if and only if either of the Theseabilitiescorrespondtothecomponentsoftheso-called
followingconditionsholds: MAPE-Kloopofautonomiccomputing[30].Inthecontext
ofthepresentpaper,thesystemcomponentsresponsiblefor
1. (π(β )≤π(β ))∧(∃(F,G):β =βF∧β =βG∧F thoseabilitiesshallbereferredtoas“resilienceorgans”.
1 2 1 1 2 2
(cid:2) G). In other words, β ≺ β if (1) β belongs to a Thefollowingnotationshallbeusedtorefertoorgan O
1 2 1
behavioralclassthatisatmostequaltoβ ’s(viafunction ofsystems:s.O(forO∈{M,...,K}).
2
123
40 JReliableIntellEnviron(2015)1:33–46
Definition8 (Cyberneticclass)Foranysystems,the5-tuple cybernetic class of the system and the dynamically evolv-
corresponding to the behaviors associated to its resilience ing cybernetic class of the environment (see Sect. 2.4.1).
organs, Thiscomparisonrepresentsasystem–environmentfit,inturn
indicatingthepropertyemergingfromtheinterplaybetween
(s.M,s.A,s.P,s.E,s.K), the current state of the system and the current state of the
environment—inotherwords,thesystemislikelytoeither
shallbereferredtoasthecyberneticclassofs. preserveorloseitspeculiarfeaturesbecauseoftheinterac-
tionwiththeenvironment.Intheformercase,thesystemshall
Twoobservationsareimportantforthesakeofourdiscussion. becalledas“resilient;”inthesecondcase,“unresilient.”
3.3 Againonelasticity,entelechism,andantifragility
Observation1 (Intrinsic resilience) A system’s cybernetic
class puts to the foreground how intrinsically resilient that
Themodelandapproachintroducedthusfarprovideuswitha
systemis(seeagainSect.2.4.1)andmakesiteasiertocom-
conceptualframeworkforalternativedefinitionsofelasticity,
parewhethercertainresilienceorgans(orthewholesystem)
entelechism,andantifragility—namelytheresilienceclasses
are(resp.,is)systemicallyinferiorto(thoseof)anothersys-
introducedinSect.2.
tem.
Definition9 (Elasticity) Given a system s and its cyber-
As an example, the adaptively redundant data structures neticclassC ,withs deployedinenvironmente,s shallbe
s
describedin[21]havethefollowingcyberneticclass:
called“elastic”withrespecttoeifsisresilient(inthesense
expressed in Observation 2) and if the behaviors in C are
s
C =(β ,β1 ,β ,β ,∅),
1 pur pro pur pur purposeful(βpur)anddefined,onceandforall,atdesignor
deploymenttime.
while the adaptive N-version programming system intro-
Elasticity corresponds to simple, static behaviors that
ducedin[10,11]is
make use of a system’s predefined internal characteristics
C =(β ,β2 ,β ,β ,β ). and resources so as to mask the action of external forces.
2 pur pro pur pur pur
Those characteristics and resources take the shape of vari-
Bycomparingtheabove5-tuplesC andC onemayeasily ousformsofredundancywhichisusedtomask,ratherthan
1 2
tolerate,change.
realizehowthemajorstrengthofthosetwosystemsliesin
theiranalyticorgans,bothofwhicharecapableofproactive
Definition10 (Entelechism)Givenasystemsanditscyber-
behaviors(βpro)—thoughinasimplerfashioninC1.Another neticclassC ,withs deployedinenvironmente,s shallbe
s
noteworthydifferenceisthepresenceofaknowledgeorganin
referredtoas“entelechy”withrespecttoeifsisresilient(in
C ,whichindicatesthatthesecondsystemisabletoaccrue
2 the sense expressed in Observation 2) and if the behaviors
and make use of the past experience to improve—to some correspondingtotheAandPorgansofC areeitheroftype
s
extent—itsaction5. βreaorβpro.Entelechism,orchangetolerance,isdefinedas
Please note that not all the behaviors introduced in
thepropertyexhibitedbyanentelechy.
Sect. 3.1 may be applied to all of a system’s organs. For
instance,itwouldmakelittlesensetohaveaperceptionorgan As evident from their definition, entelechies are open,
behaverandomly(unlessonewantstomodel,e.g.,theeffect context-aware systems; able to autonomically repair their
ofcertainhallucinogenicsubstancesinchemicalwarfare6.) state in the face of disrupting changes; and able to guar-
anteetheirsystemidentity.Aknowledgeorganmayormay
Observation2 (Extrinsic resilience) A system’s cybernetic notbe present and, depending on that,the feedback organs
classputstotheforegroundalsohowextrinsicallyresilient mayormaynotbestateful—meaningthat“memory”ofthe
thatsystemisiftheabovecomparisonisdonebetweenthe experiencedchangesisorisnotretained.
Definition11 (Computationalantifragility)Givenasystem
5 Thepresenceofaknowledgeorgandoesnotmeanthatitssystemis
s and its cybernetic class C , with s deployed in environ-
antifragile.Inthecaseathand,forinstance,thesystemdoesnotmutate s
itsystemidentity—itstaysanN-versionprogrammingsystem. ment e, we shall say that s is computationally antifragile
6 See for instance the interview with Dr. James S. Ketchum, in the withrespecttoewhenthefollowingconditionsareallmet:
SixtiesaleadingpsychiatristattheArmyChemicalCenteratEdgewood
Arsenal in Maryland, US: “With BZ [3-quinuclidinyl benzilate], the
1. The awareness organ of s, A, is open to the system–
individualbecomesdelirious,andinthatstateisunabletodistinguish
environment fit between s and e. In particular, as sug-
fantasyfromreality,andmaysee,forinstance,stripsofbaconalong
theedgeofthefloor.”[46]. gestedinSect.2.3,thismeansthatAimplementsamodel
123
JReliableIntellEnviron(2015)1:33–46 41
of the risk of losing one or more aspects of the system
identityofs.Onesuchmodelisexemplified,e.g.,bythe
distance-to-failure function introduced in [19] and dis-
cussedin[12].
2. Throughout time intervals in which the behavior of e
isstable,theplanningorgan P isabletomonotonically
improveextrinsicresilience(seeObservation2)andthus
optimizerisk/performancetrade-offs.
Fig. 1 Exemplificationofturbulence,namelythedynamicevolution
3. Organ P evolves through machine learning or other
ofenvironmentalorsystemicbehavior.Abscissasrepresenttime,“now”
machine-orientedexperientiallearning[31],leadingsto
beingthecurrenttime.Ordinatesarethebehaviorclassesexercisedby
evolvetowardsevergreaterintrinsic(systemic)resilience eithertheenvironmentorthesystem
(seeObs.1).
4. OrganKisstatefulandpersistslessonslearnedfromthe
function” would be by encoding the characteristics of each
experienceandits“conceptualization.”
behaviorontothebitsofabinaryword,withthethreemost
significantbitsencodingtheprojectionmapofthebehavior
Computationallyantifragilesystemsaresystem–environment
andthebitsfromthefourthonwardencodingthecardinality
fit-aware systems; able to embody and persist systemic
ofthesetofcontextfiguresortheorderofthebehavior.When
improvements suggested by the match of the current sys-
thebehaviorsbelongtothesameclassalthoughconsidering
temidentitywiththecurrentenvironmentalconditions.The
twodifferentcontextsets,say F andG,thenasimplerfor-
learningactivitypossiblyimpliesa4-stagecyclesimilarto
mulationofadistancewouldbeabs(|F|−|G|).Letuscall
the one suggested by Kolb in [31], executed concurrently
distonesuchmetricfunction.
withtheresiliencebehaviorsoftheM,A,P,andEorgans.
It is now possible to propose a definition of two indica-
torsfortheextrinsicqualityofresilience:Thesystemsupply
relativetoanenvironmentandthesystem–environmentfit.
4 Approach
Definition12 (System supply) Let us consider a system s
As already mentioned, a methodological assumption in the
deployedinanenvironmente,characterizedrespectivelyby
present article is that the evolution of an environment may behaviorsβs(t)andβe(t).Letusassumethatβ andβ are
1 2
be expressed as a behavior. Said behavior may be of any such that either β ≺ β or β ≺ β . Given a behavioral
1 2 2 1
of the types listed in Sects. 3.1 and 3.3 and it may result
metric function dist defined as above, the following value
inthedynamicvariationofanumberof“firingcontextfig- shallbecalledassupplyofs(t)withrespecttoβe(t):
ures”.Infact,thosefigurescharacterizeand,inasense,set
theboundariesofanecoregion,namely“anareadefinedby supply(s,e,t)
⎧
its environmental conditions” [2]. An environment may be
the behavioral result of the action of, e.g., a human being ⎪⎪⎨dist(βs(t),βe(t)) if βe(t)≺βs(t)
−dist(βs(t),βe(t)) if βs(t)≺βe(t)
(a “user”); or the software agents managing an intelligent = (2)
⎪⎪⎩0 if βe(t)andβs(t)
ambient; or for instance it may be the result of purpose-
expressthesamebehaviors.
less(random)behavior—suchasasourceofelectromagnetic
interference. As a consequence, an environment may for
Supplycanbepositive(referredtoas“oversupply”),neg-
instance behave (or appear to behave) randomly, or it may
ative(“undersupply”),orzero(“perfectsupply”).
exhibit a recognizable trend; in the latter case the variation
ofitscontextfiguresmaybesuchthatitallowsfortracking Observation3 Oversupplyandundersupplyprovideaquan-
orspeculation(extrapolationoffuturestates).Moreover,an titative formulation of the notions of overshooting and
environmentmayexhibitthesamebehaviorforarelatively undershootinggiveninSect.2.
longperiodoftimeoritmayvaryfrequentlyitscharacter.
Givenanenvironment(orasystem),thedynamicevolu- Definition13 (System–environmentfit)Giventhesamecon-
tionoftheenvironmental(resp.systemic)behaviorshallbe ditionsasinDefinition12,thefollowingfunction:
referredtoas“turbulence”.DiagramssuchastheoneinFig.1 (cid:7)
maybeusedtorepresentthedynamicbehavioralevolution fit(s,e,t)= 1/(1+supply(s,e,t)) ifsupply(s,e,t)≥0
ofeitherenvironmentsorsystems. −∞ otherwise.
Whenevertwobehaviorsβ andβ aresuchthatβ ≺β ,
1 2 1 2
itispossibletodefinesomenotionofdistancebetweenthe shallbereferredtoas“system–environmentfitofs andeat
two behaviors. One way to define such “behavioral metric timet.”
123
42 JReliableIntellEnviron(2015)1:33–46
ior exercised by the environment is evenly matched by the
featuresofthesystem.Durings ands ,wehaveovershoot-
2 3
ings:thesystemicfeaturesaremorethanenoughtomatchthe
currentenvironmentalconditions.Itisacaseofoversupply.
Correspondingly,fitisratherlow.Ins ,theoppositesituation
5
takes place: the systemic features—for instance, pertaining
to a perception organ—are insufficient to become aware of
allthechangesproducedbytheenvironment.Inparticular,
herechangesassociatedwithcontextfigure5goundetected.
This is a case of undersupply (that is to say, undershoot-
ing),correspondingtoalossofidentity:the“worstpossible”
Fig. 2 Exemplificationofsupplyandsystem–environmentfit system–environmentfit.
Theabovedefinitionexpressessystem–environmentfitas 4.1 Supply-andfit-awarebehaviors
a function returning 1 in the case of best fit; slowly scal-
ing down with oversupply; and returning −∞ in case of Wheneverapartialorder“≺”existsbetweenasystem’sand
undersupply. The reason for the infinite penalty in case of itsenvironment’sbehaviors,itispossibletoconsidersystem
undersupplyisduetothefactthatitsignifiesanundershoot- behaviorsofthefollowingforms:
ingor,inotherwords,alossofsystemidentity.
Thejustenunciatedformulationisofcoursenottheonly
possible one: an alternative one could be, for instance, by 1. Either b = βpFro or b = βaFnt, with σ(b) = false and
with F including figures that provide a measure of the
havingsupply2 insteadofsupplyinthedenominatoroffit
riskofunresilience,expressed,e.g.,throughsupplyand
inDefinition13.Anotherformulationcouldextendoptimal
fit.
fit to a limited region of oversupply as a safety margin to
Such behavior corresponds to condition 11 in Defini-
coverforinaccuraciesinthepredictionofthebehaviorofthe
tion11,namelyoneofthenecessaryconditionstocom-
environment.Thisissimilartotheroleofεin(1).
putationalantifragility.Whenexercisedbysystemorgans
Figure2exemplifiesasystem–environmentfitinthecase
foranalysis,planning,andknowledgemanagement,this
of two behaviors βs and βe with s (cid:2) e. Environment e
behaviortranslatesinthepossibilitytobecomeawareof
affects five context figures identified by integers 1,...,5
andspeculateaboutthepossiblefutureresiliencerequire-
whilesaffectscontextfigures1,...,4.Thesystembehavior
ments. If this is coupled with the possibility to revise
is assumed to be constant, thus for instance if s is a per-
one’s system organs by enabling or disabling, e.g., the
ception organ then it constantly monitors the four context
ability to perceive certain context figures depending on
figures 1,...,4.Onthecontrary,βe varies withtime.Five
theextrapolatedfutureenvironmentalconditions,thena
timesegmentsareexemplified(s ,...,s )duringwhichthe
1 5
system could use this behavior to improve proactively
followingcontextfiguresareaffected:
its own system–environment fit—possibly mutating its
featuresandfunctions.
s :Contextfigures1,...,4.
1 Anexemplarysystembasedonthisfeatureisgivenbythe
s :Contextfigure1andcontextfigure4.
2 already mentioned adaptively redundant data structures
s :Contextfigure4.
3 of[21]andtheadaptiveN-versionprogrammingsystem
s :Contextfigures1,...,4.
4 introduced in [10,11]. Those systems make use of the
s :Contextfigures1,...,5.
5 so-calledreflectivevariables[20]toperceivechangesin
a“distance-to-failure”function.Suchfunctionbasically
Context figures are represented as boxed integers, with an measurestheprobabilityoffailureofavotingschemeat
empty box meaning that the figure is not affected by the thecoreofthereplicationstrategiesadoptedinthemen-
behavior of the environment and a filled box meaning the tionedsystems.Inotherwords,suchfunctionestimates
figure is affected. The behavior of the environment is con- theprobabilityofundersupplyforvoting-basedsoftware
stantwithinatimesegmentandchangesatthenextone.This systems.
is shown through the sets at the bottom of Fig. 2: for each 2. Behaviorbdefinedasincase1,butwithσ(b)=true.
segmentt ∈{s ,...,s }thesupersetise(t )whilethesub- Inthiscase,theanalysis,planningandknowledgeorgans
s 1 5 s
set is s(s ), namely e(s )∩s. The relative supply and the areawareofothersystemsinphysicalorlogicalproxim-
t t
system–environmentfitalsochangewiththetimesegments. ityandmayusethisfacttoartificiallyaugmentorreduce
Durings ands thereisperfectsupplyandbestfit:thebehav- their system features by establishing / disestablishing
1 4
123