Resilience is one of those "general systems attributes" that appear to play a central role in several disciplines - including ecology, business, psychology, industrial safety, microeconomics, computer networks, security, management science, cybernetics, control theory, crisis and disaster management. Resilience thus seems to be "needed" everywhere; and yet, even in the framework of a same discipline, it is not easy to define it precisely and consensually. To add to the confusion, other terms such as elasticity, change tolerance, and antifragility, although clearly related to resilience, cannot be easily differentiated. In this talk I tackle this problem by introducing a behavioural model of resilience. I interpret resilience as the property emerging from the interaction of the behaviours produced by two "players": a system and a hosting environment. The outcome of said interaction depends on both intrinsic and extrinsic factors, including the systemic "traits" of the system but also how the system's endowment matches the requirements expressed by the behaviours of the environment. I show how the behavioural approach provides a unifying framework within which it is possible to express coherent definitions for elasticity, change tolerance, and antifragility.

1. A behavioural model for the
discussion of resilience,
elasticity, and antifragility
Vincenzo De Florio
MOSAIC / Universiteit Antwerpen
& MOSAIC / iMinds
vincenzo.deflorio@uantwerpen.be
16 June, 2015

2. Structure
- What is resilience? Why so many answers?
- Model
- Conjectures
(- Application)
- Conclusions
Main reference: "On Resilient Behaviors
in Computational Systems and
Environments", J. of Rel. Int. Envs, 1(1)

3. Defining Resilience
• From resilire (Latin):
“to spring back, start back, rebound,
recoil, retreat.”
Often intended as the ability to cope with
or recover from change.
• Persist system identity: a system's
definition
• If you try and ask the experts of the
various disciplines what resilience is,
you’re going to have different answers:

4. Definitions of Resilience
• Material science: a material’s property to
“stay unaffected by an applied stress” up to
some threshold (the “point of yielding”) and to
“return to its original shape upon unloading”
• Beyond the mentioned threshold,
deformation is irreversible:
• “some residual strain will persist even after
unloading”
• Action: property rather than a process
• System identity: shape / characteristics of the
material

5. Definitions of Resilience
• Civil engineering: a construction’s ability to
absorb or avoid damage in the face of a
natural or man-induced abnormal condition
(flooding, hurricanes, or firepower.)
• Action/identity: as in material science

6. Definitions of Resilience
• Computer science: “ability to sustain
dependability when facing changes”
→Ability to avoid failure and sustain the
delivery of trustworthy services.
• Action: process. It ranges from masking to
tolerating change
• System identity: "compliance to system
specifications and functional and non-
functional QoS and QoE requirements.”

7. Definitions of Resilience
• Ecology: "an ecosystem’s ability to
respond to and recover from an ecological
threat"
• Action: “recover” (process)
• System identity: ability to return to a state
of equilibrium

8. Definitions of Resilience
• Psychology: “the process of adapting well in
the face of adversity, trauma, tragedy, threats
or significant sources of stress [...] It means
‘bouncing back’ from difficult experiences”
• Action: process: “Resilience should be
considered a process, rather than a trait to
be had”. Undefined complexity
• System identity: "collection of beliefs about
oneself"

9. Definitions of Resilience
• Organization science: “the capacity to
anticipate disruptions, adapt to events, and
create lasting value”.
• Action: Process. Complex proactive
adaptation rather than simple “springing back”
to past state / function.
• System identity includes a specific trait:
ability to create value.

10. Definitions of Resilience
• Complex socio-ecological systems: "ability
to absorb stress and maintain function in the
face of climate change"; ability to improve
systematically sustainability.
• Action: “Absorbing stress” + learning
(= complex processes)
• System identity lies in the function rather
than in a state.
• Learning

11. Lessons learned
• From traits to processes: a range of
behaviours, from simple purposeful
behaviours to complex teleologic /
extrapolatory ones
• From absorption/masking to
reaction/tolerance to proactivity/anticipation
• With or without learning
• What do I mean by "a range of behaviours"?

12. Behavioural categories (Wiener et al.)
PASSIVE
ACTIVE
RANDOM
PURPOSEFUL
TELEOLOGIC
PREDICTIVE
System only
receives energy
from external
source
System is
the source of the
output energy
behavior is not
interpreted as
directed to a goal
A goal can
be identified
Distance from
the goal steers
the behavior
Distance from
predicted position
of goal steers
the behavior

13. Structure
- What is resilience? Why so many answers?
- Model
- Conjectures
(- Application)
- Conclusions

14. Model
• We can distinguish at least three classes of
resilient systems:
• Elastic objects and systems
• Entelechies
• Antifragile systems
• In what follows I define and discuss them

15. Model, case 1: elasticity
• When the system is only capable of
purposeful, non-teleological behavior, then
resilience shall be called elasticity.
• Elasticity: the domain of ataraxies —
systems that work in "autistic mode"
• They “do not care too much” about other
systems and deployment environments
• Non-open systems. They work under the
assumption that “changes will not break ‘em"

16. Elasticity
• Elastic systems are "blind" to change:
• Have a predefined and static point of yielding.
A breaking point. This introduces two
syndromes:

17. Elastic system
Safe
zone
Unsafe
zone
yielding point Y
Unreliability
y(t)
y(t)
y(t) - Y =
Undershooting
Elastic Undershooting
Redundancy

18. Elastic Undershooting
• You may make your house
• of straw; of wood; of bricks.
• You just get an elastic system with a better
and better yielding point:
Y1 < Y2 < Y3
• Regrettably the "blow", y(t), is an unbound
dynamic system

19. Elastic Undershooting
• Sooner or later, your construction Y is bound
to be hit by some y(t) > Y
• Given enough time, the Black Swan will
show up. [cf. N. N. Taleb]
• Elastic undershooting tells you how badly
you're going to be hit: y(t) - Y.

20. Elastic Undershooting

21. Elastic system
Safe
zone
Unsafe
zone
yielding point Y
Unreliability
y(t)
Y - y(t) =
Overshooting
Redundancy
t
overshooting
now
Cumulative overshooting
Elastic Overshooting

22. Elastic Overshooting: Dual case!
• You may make your house
• of bricks; of wood; of straw.
• You just get an elastic system with a cheaper
and cheaper yielding point:
Y3 > Y2 > Y1
• Each time Yi > y(t), you’re overprotecting
your construction!

23. Elastic Overshooting
• If so, you’re paying a price higher than what
necessary to let your construction withstand
the "blow".
• Elastic overshooting tells you how much you
"overpaid": Y - y(t)
• If you consider the elastic overshooting
across an interval of time T, you end up with
an overall waste of
∫T Y - y(t) dt

24. Elastic Overshooting

25. Model, case 2: entelechies
• In elastic systems, resilience is a trait — a
property, which can be ascertained by
observing the system.
• Not so when the system is capable of more
advanced behaviors — the ability to react
and adapt to change; or even to react with
respect to a hypothesized future change.
• In this case the system is “in motion” to
actively pursue the persistence of its
system identity — its concept; its definition.

26. Entelechies
• This corresponds to what Aristotle calls as
entelechy: a system that
“is at work to stay the same”
[Joe Sachs, Aristotle’s Physics]
• This is the domain of open systems:
systems that perceive and analyze the
behaviours of other systems and of their
deployment environments.

27. Entelechies
• Entelechies have a dynamic and adaptive
point of yielding. They still have a breaking
point. Only, this breaking point is a
dynamic system: it’s a Y(t) instead of a Y.
• Undershooting and overshooting are still
possible, but now they are resp. equal to
y(t) - Y(t) and Y(t) - y(t).

28. Entelechies
• Entelechies respond to change by adjusting
their action.
• A feed-back loop (FBL) is used for this.
• How is the adjustment done?
• Several cases:

29. Entelechies
a)FBL is purely exogenous: the system action
is simply steered towards the goal (in its
current or hypothesized future position.)
b)FBL is both exogenous and endogenous.
Internal changes only concern “knobs”,
(=parameters of the system).
• This case corresponds to parametric
adaptation

30. Entelechies
c)FBL is both exogenous and
endogenous; the internal changes adapt
the structure of the system.
• This corresponds to system
reconfigurations (=structural
adaptation).
• Adaptations are phenotypical and do
not affect the identity of the system.
• The experience leaves no trace on the
identity of the system.

31. Entelechies
d)FBL is both exogenous and
endogenous; the internal changes also
adapt the function; the structure; the
architecture; and the organization of the
system.
• Changes are genotypical: they are
persisted and permanently modify
the nature of the system.
?

32. Model, case 3: antifragility
• In cases a), b), c) the identity is preserved.
• Not so in case d). There, the system is active
but does not stay the same.
• Antifragile systems: systems that are
“at work to get better”

33. Antifragile systems
• In entelechies, the experience changes the
“movement” — the route — towards the goal;
but the experience does not reflect onto the
identity of the system.
• The system is free to adapt, though it can’t
evolve.
• In antifragile systems, the system can adapt
and evolve.

34. “Antifragility is beyond resilience or robustness.
The resilient resists shocks and stays the same;
the antifragile gets better” [Nicholas Taleb]

35. Common misconceptions
→“I don't think anti-fragile systems exist
because every system has a breaking
point”.
←Antifragile does not mean unbreakable.
Antifragile systems do have a point of
yielding. They still have a breaking point.

36. Common misconceptions
→ "Antifragile systems will solve all our
problems".
← Ours?
←Antifragile computer-based systems may
drift outside of what prescribed in their
specifications
←Hawking-scenarios are possible; more
likely than with entelechies.

37. Common misconceptions
→ "Resilience is an absolute figure. Either
you have it or you don’t"
← Nope. Resilience is a dynamic property
that depends on:
• The intrinsic characteristics of the system
• How those characteristics match the
environment the system is deployed in
(cf. G. W. von Leibniz)

38. Structure
- What is resilience? Why so many answers?
- Model
- Conjectures
(- Application)
- Conclusions

39. Conjectures
1.Resilience is the product of an interplay
between a system and its environment
2.Resilience: One of the possible outcomes
of a complex interplay of behaviors.
• If and only if
ip(system behaviours, env. behaviors)
preserves the system identity then the
system shall be called resilient

40. Conjectures
3.Evolutionary Game Theory may be an
effective theory for reasoning about
ip(system, environment)
• Behaviour not as a system class; rather,
as a manifested move.

41. Resilience interplay: an example
RESPONSE:
> PURPOSEFUL
BEHAVIORS
INPUT:
PURPOSEFUL
NON-TELEOLOGIC
BEHAVIORS
SYSTEM
ENVIRONMENT

42. Resilience interplay: an example
RESPONSE:
> TELEOLOGIC/
PREDICTIVE
BEHAVIORS
INPUT:
TELEOLOGIC /
PREDICTIVE
BEHAVIORS
SYSTEM
ENVIRONMENT

43. Resilience interplay: an example
RESPONSE:
PURPOSEFUL,
NON-TELEO-
LOGIC BEHA-
VIORS
INPUT:
RANDOM
BEHAVIORS
SYSTEM
ENVIRONMENT
Choice of the resilience strategy in
function of the manifested behaviours

44. Conjectures
4.Antifragile systems are aware of their own
system-environment fit and use
mechanisms to assess the risk of
loosing their own system identity
• In what follows, an application, based on
overshooting

45. Structure
- What is resilience? Why so many answers?
- Model
- Conjectures
- Application
- Conclusions

46. Application: Adaptive NVP
• A-NVP: adaptive reformulation of
N-version programming.
o Buys & De Florio, "Towards Context-
Aware Adaptive Fault Tolerance in
SOA Applications",
https://dl.dropboxusercontent.com/u/67
040428/p63-buys.pdf
• A-NVP is based on a voting mechanism
• “Votes”: outputs produced by a number of
software programs, called versions

47. • A-NVP employs N(t) versions out of M
available versions (web services)
• Yielding point: floor(N(t)/2)
• Overshooting: tunes N(t)
• The smaller the overshooting, the greater
the risk of losing one's identity
Adaptive NVP (A-NVP)

48. Indirect deduction of risk
OS = 6 OS = 4
OS = 2
OS =0 US!

49. Evolvability scheme
• N (adopted redundancy at t = now):
in function of deduced risk
• Under normal conditions, N = 3
– Up to one failure / dissent is tolerated
• Under more critical situations, risk goes up
⇒ amount of redundancy is automatically
adjusted
• Adjustment logic: select the ideal degree of
redundancy matching the current
disturbances

50. Evolution of N(t) while injecting faults
t
Redundancy

52. • Learning: selects the "best" N(t) versions
o A-NVP keeps track of the performance of all
active versions available
o Mechanism of gradual penalisation and reward
"ranks" all available versions by comparing their
output with the one obtained through majority
voting.
o At any time t, the top ranked N(t) versions are
selected.
Adaptive NVP (A-NVP)

53. Structure
- What is resilience? Why so many answers?
- Model
- Conjectures
- Application
- Conclusions

54. Conclusions and future steps
• Characterisation of resilience in terms of
behaviors
• More coherent definitions of Elasticity;
entelechism; antifragility
• Interplay with the environment
• Oversupply and undersupply
• Estimation of risk of identity loss /
drifting

55. Conclusions and future steps
• Distinction between "systemic behaviour"
and manifested behaviour
• A move
• Evolutionary Game Theory:
system vs environment
• Manifested behaviour as a response to
an input behaviour

56. Future steps:
"Behavioral" Game Theory
Passive Random Purposeful Teleologic Predictive Antifragile
Passive ?,? -1,1 -1,1 -1,1 -1,1 -1,1
Random 1,-1 ?,? -1,1 -1,1 -1,1 -1,1 (*)
Purposeful 1,-1 1,-1 ?,? -1,1 -1,1 -1,1
Teleologic 1,-1 -1,1 1,-1 ?,? -1,1 -1,1
Predictive 1,-1 -1,1 1,-1 1,-1 ?,? -1,1
Antifragile 1,-1 1,-1 (*) 1,-1 1,-1 1,-1 ?,?
(*): if a player can learn that the other one is behaving randomly
ENVIRONMENT
SYSTEM

57. Thank you for your attention!
Questions?