Much progress has been accomplished in 2008 in the study of higher-order calculi as models of component-based programs. During Alan Schmitt's sabbatical leave at University of Bologna, the collaboration with Davide Sangiorgi and several of his students resulted in the design of a core higher-order calculus that is rich enough to be Turing complete, yet fundamental enough to have a decidable notion of program equivalence. This work was presented at the LICS international conference .

In parallel, we have continued to investigate the impact of the addition of a passivation operator, required to faithfully model live-cycle properties of components, to the proof of program equivalence. We have showed that the interaction of passivation and restriction prevents the efficient testing of program equivalence , and very recently discovered a proof technique, called complementary bisimulation, to characterize program equivalence for higher-order process calculi with passivation and restriction. Both of these results are currently submitted for publication.

We have also developed a formal specification of the Fractal component model using the Alloy specification language . The specification covers all the elements of the informal Fractal specification, it lifts all the ambiguities of the informal specification, and it provides a truly programming-language independent specification of the Fractal model in first-order relational logic. This work constitute a basis for ongoing developments towards a formalization of the Fractal architecture description language.

Gossip-based information dissemination protocols are considered easy to deploy, scalable and resilient to network dynamics. Load-balancing is inherent in these protocols as the dissemination work is evenly spread among all nodes. Yet, large-scale distributed systems are usually heterogeneous with respect to network capabilities such as bandwidth. In practice, a blind load-balancing strategy might significantly hamper the performance of the gossip dissemination. In collaboration with Rachid Guerraoui's group at EPFL and the INRIA ASAP team, we have proposed a new protocol, called HEAP (HEterogeneity-Aware gossip Protocol), where nodes dynamically adapt their contribution to the gossip dissemination according to their bandwidth capabilities. Using a continuous, itself gossip-based, approximation of relative bandwidth capabilities, HEAP dynamically leverages the most capable nodes by increasing their fanout, while decreasing by the same proportion those of less capable nodes. HEAP preserves the simplicity and proactive (churn adaptation) nature of gossip, while significantly improving its effectiveness. HEAP has been extensively evaluated in the context of a video streaming application. HEAP significantly improves the perceived quality of the streaming over standard gossip protocols.

Gossip peer sampling protocols now represent a solid basis to build and maintain peer to peer (p2p) overlay networks. They typically provide peers with a random sample of the network and maintain connectivity in highly dynamic settings. They rely on the assumption that, at any time, each peer is able to establish a communication with any of the peers of the sample provided by the protocol. Yet, this ignores the fact that there is a significant proportion of peers that now sit behind NAT devices, preventing direct communication without specific mechanisms. This has been largely ignored so far in the community. Our experiments demonstrate that the presence of NATs, introducing some restrictions on the communication between peers, significantly hurts both the randomness of the provided samples and the connectivity of the p2p overlay network, in particular in the presence of high rate of peers arrivals, departures and failures. In collaboration with the INRIA ASAP team, we have proposed a NAT-resilient gossip peer sampling protocol, called Nylon, that accounts for the presence of NATs. Nylon is fully decentralized and spreads evenly the extra load caused by the presence of NATs, between peers. Nylon ensures that a peer can always establish a communication, and therefore initiates a gossip, with any peer in its sample. This is achieved through a simple, yet efficient mechanism, establishing a path of relays between peers. Our results show that the randomness of the generated samples is preserved, that the connectivity is not impacted even in the presence of high churn and a high ratio of peers sitting behind NAT devices.

State machine replication (SMR) is a software technique for tolerating failures using commodity hardware. The critical service to be made fault-tolerant is modeled by a state machine. Several, possibly different, copies of the state machine are then placed on different nodes. Clients of the service access the replicas through a SMR protocol which ensures that, despite concurrency and failures, replicas perform client requests in the same order. Two objectives underly the design and implementation of a SMR protocol: robustness and performance. Robustness conveys the ability to ensure availability (liveness) and one-copy semantics (safety) despite failures and asynchrony. Performance measures the time it takes to respond to a request (latency) and the number of requests that can be treated per time unit (throughput). The most robust protocols are those that tolerate (a) arbitrarily large periods of asynchrony, and (b) arbitrary (Byzantine) failures of any client as well as up to one-third of the replicas. The development of Byzantine fault-tolerant SMR protocols is notoriously difficult. In collaboration with Rachid Guerraoui's group at EPFL, we have proposed a generic abstraction to simplify this task. We view a BFT protocol as a, possibly dynamic, composition of instances of our abstraction, each instance developed and analyzed independently. To illustrate our approach, we have developed two new BFT protocols. Among all protocols we know of, the first has the lowest latency in synchronous periods that are free from contention and failures; the second has the highest peak throughput in failure-free and synchronous periods.

Event-driven programming is a popular approach for the development of robust applications such as network servers and clients. The strength of this model mainly lies in its expressivity (fine-grain management of concurrency including asynchronous network and disk I/O), portability, support for dynamic reconfiguration, and, in some cases, lower memory and better performance than other design strategies. However, a genuine event-based library cannot take advantage of multiprocessor platforms since it relies on a single thread executing the main processing loop. The main approach proposed to date for supporting multiprocessor execution within an event-based library consists in: (i) enforcing correctness by allowing programmers to incrementally inject support for safe parallel execution through annotations specifying events that can run concurrently and (ii) dynamically balancing the load on the multiple cores via workstealing. Our ongoing research work strives to improve both the programming interface and the performance of event-based libraries for multicore platforms. Most of our work so far has focused on the latter aspect. We propose novel event dispatching heuristics and design choices to improve the behavior of workstealing, taking into account parameters such as cache affinities of tasks and inherent synchronization costs. The first evaluations of our runtime on high performance network servers show that it achieves better throughput than existing solutions. Part of this work is reported in the Master thesis of Ludovic Demontes and Sylvain GenevŽs.

We have continued the development of facilities for the automated deployment and configuration of distributed software architectures. Two main results have been obtained this year: the development of new deployment and reconfiguration support in Jade, and the development of the DepOzframework for the construction of self-deployable and self-configurable components.

The new deployment and reconfiguration support in Jade introduces a new module and package system for Fractal components in Java, that overcomes limitations of the OSGI framework, previously used in Jade. The new module and package system allows a uniform and system-wide management of component executables, and supports dynamic component code updates. The system is described in detail in Jakub Kornaś' PhD thesis .

The DepOzframework supports the construction of complex distributed software architectures, the programming of complex deployment processes, and the construction of self-configurable components. It complements the previous work with the ability to program highly parameterized deployment workflows and to construct self-deployable and self-configurable distributed components. It is described in detail in Chrstophe Taton's PhD thesis .

The goal of self-optimization is to maintain optimal (or near-optimal) system performance and quality-of-service (QoS) in spite of wide variations of the load or of the amount of available resources. Performance may be measured by various criteria, such as average response time or average throughput for an Internet service, or bounded jitter for a video server, etc. QoS may reflect several service characteristics such as service availability which may be measured as service abandon rate in an Internet service.

We have proposed simple heuristics-based approaches to self-optimization of cluster-based Internet services through dynamic resource provisioning. These approaches were successfully applied to replicated database systems through dynamic resource (un-)provisioning upon database load variation. Dynamic resource provisioning was applied in conjunction with replication protocols and group communication protocols as part of the GORDA European project  , , . The proposed approaches were also applied to messaging systems in the context of the JORAM open-source Java message-oriented middleware hosted by the OW2 consortium. We have used the Jade framework to build autonomic capabilities on top of the JORAM middleware, and described how to (i) dynamically adapt the load distribution among the servers (load-balancing aspect) and (ii) dynamically adapt the replication level (provisioning aspect)  , , . Finally, cluster-based multi-tier enterprise applications were also used as a testbed of the proposed dynamic resource provisioning policies of self-optimization. Among the reasearch issues tackled in this work, we can cite system oscillation due to potential concurrent reconfigurations on the distributed multi-tier system. We proposed system oscillation prevention techniques that follows a software architecture-based approach  , .

The above-mentioned work mainly proposes heuristics-based techniques that provide a best-effort behavior and aims at keeping the managed system near-optimal. We have also proposed new techniques that guarantee system optimality with strict guarantees on service level objectives (SLOs) such as maximum latency and maximum abandon rate for Internet services. The proposed solutions make use of queuing theory to modeling and capacity planning of cluster-based multi-tier enterprise systems  . We also cooperate with the NeCS INRIA research group to apply control theory to modeling and capacity planning of database and server systems  . In the context of this cooperation, the PhD thesis of L. Malrait is co-advised by Nicolas Marchand (NeCS) and Sara Bouchenak. A patent proposal on this work is ongoing.