text: US20040193388A1 - Design time validation of systems - Google PatentsDesign time validation of systems Download PDF
  Info
  - Publication number
  - US20040193388A1US20040193388A1 US10791222 US79122204A US2004193388A1 US 20040193388 A1 US20040193388 A1 US 20040193388A1 US 10791222 US10791222 US 10791222 US 79122204 A US79122204 A US 79122204A US 2004193388 A1 US2004193388 A1 US 2004193388A1
  - Authority
  - US
  - Grant status
  - Application
  - Patent type
  -
  - Prior art keywords
  - definition
  - lt
  - gt
  - instance
  -
  - G—PHYSICS
  - G06—COMPUTING; CALCULATING; COUNTING
  - G06F—ELECTRIC DIGITAL DATA PROCESSING
  - G06F8/00—Arrangements for software engineering
  - G06F8/60—Software deployment
  - G06F8/65.
  Description
  - This.[0001]
  - The invention relates to the design of systems, and more particularly to design time validation of systems. [0002]
  -. [0003]
  -. [0004]
  -). [0005]
  -. [0006]
  - The design time validation of systems described herein solves these and other problems. [0007]
  - Design time validation of systems is described herein. [0008]
  -.[0009]
  - The same numbers are used throughout the drawings to reference like features. [0010]
  - FIG. 1 illustrates an example network setting. [0011]
  - FIG. 2 is a block diagram illustrating an example architecture using system definition model. [0012]
  - FIG. 3 illustrates an example layered setting. [0013]
  - FIG. 4 is a flowchart illustrating an example process for design time validation. [0014]
  - FIGS. 5A and 5B are a flowchart illustrating an example recursive expansion process that creates an instance space. [0015]
  - FIGS. 6A and 6B are a flowchart illustrating an example process for evaluating flows. [0016]
  - FIGS. 7A, 7B, [0017] 7C, 7D, and 7E are a flowchart illustrating an example process for evaluating constraints.
  - FIG. 8 illustrates an example SDM document. [0018]
  - FIG. 9 illustrates an example SDM definition. [0019]
  - FIG. 10 illustrates an example SDM member. [0020]
  - FIG. 11 illustrates an example setting member. [0021]
  - FIG. 12 illustrates an example constraint definition. [0022]
  - FIG. 13 illustrates an example description object. [0023]
  - FIG. 14 illustrates an example mapping of a web application in one layer to a web server host in another layer. [0024]
  - FIG. 15 illustrates an example built-in datatype hierarchy. [0025]
  - FIG. 16 illustrates an example of upcasting and downcasting. [0026]
  - FIG. 17 illustrates an example of type conversion. [0027]
  - FIG. 18 illustrates an example relationship tree. [0028]
  - FIG. 19 illustrates an example of using delegation to expose a host's implementation to a guest. [0029]
  - FIG. 20 illustrates an example of using delegation to expose a member's implementation to a parent. [0030]
  - FIGS. 21 and 22 illustrate examples of communication connectivity validation. [0031]
  - FIG. 23 illustrates an example of zone boundaries. [0032]
  - FIG. 24 illustrates an example instance space. [0033]
  - FIG. 25 illustrates an example general computer environment, which can be used to implement the techniques described herein. [0034]
  -. [0035]
  -”. [0036]
  - FIG. 1 illustrates an example network setting [0037] [0038] [0039] is a block diagram illustrating an example architecture [0040] 200 using the SDM. The SDM is designed to be used during the design process of systems, and may also be used for deployment and/or management of a system after the design process is complete. on top of one another.
  -. [0041]
  - The architecture [0042] component [0043]. [0044]
  - A system definition captures the basic structure of a dynamic system. It can be viewed as the skeleton on which all other information is added. This structure is typically specified during the development process, by designers. [0045]
  - SDM document [0046] [0047] 206 can be single computing devices, or alternatively collections of computing devices (e.g., data centers), application hosts, etc. Different systems, or even the same system,.). A single system as described in SDM document 204 can be validated against multiple different environments as described in different LIMs 206.
  -). [0048]
  - During the design phase of the system, SDM document [0049] validation component 208 can inform the designer or developer LIM document [0050] [0051]. [0052]
  - FIG. 3 illustrates an example layered setting. Four layers are illustrated in FIG. 3: layer [0053]).
  - Different systems and subsystems within a layer can interact with one another, and also can interact with systems and subsystems of different layers. For example, a subsystem [0054] [0055] financial analysis, and so forth).
  - Returning to FIG. 2, an application developer is able to design and develop an application using development component [0056] 202. As the developer defines various parts of his or her system and how these parts relate to one another, an SDM file 204 that captures these parts and relationships is generated. The developer is able to use validation component 208 to validate the system description against the environment described in LIM file 206. This validation during the design phase is also referred to as “design time validation”.
  -. [0057]
  -. [0058]
  -. [0059]
  - The LIM file [0060] 206 and SDM file 204 are input to interface and processing layer 210 of validation component 208. Interface and processing layer 210 controls validation of SDM file 204. Validation component 208 may also be referred to as a compiler.
  - Interface and processing layer [0061] [0062] [0063] [0064] [0065] [0066] [0067]. [0068]
  - The listener (e.g., simulator [0069].
  - FIG. 4 is a flowchart illustrating an example process [0070] 400 for design time validation. Process 400 is implemented by validation component 208 of FIG. 2, and may be performed in software, firmware, hardware, or combinations thereof.
  - In response to a request to create, delete, or modify a system, the SDM document and any references associated with the SDM document are loaded (act [0071] [0072] FIG. 2 as, for example, results 226.
  - However, if there are no errors, then a top-level definition in the SDM document loaded in act [0073] FIG. 4. The instance space is expanded by analyzing the top-level definition and creating an instance of each member of the root instance, then analyzing each of those created instances and creating instance(s) for each of their members, and so on. This process is discussed in more detail below under the heading “Expansion Engine”.
  - When the expansion based on the top-level definition is completed, the flows defined on the instances in the expanded instance space are identified, and the values in the flow are set to the appropriate values (act [0074] 414). This process is discussed in more detail below under the heading “Flow Engine”.
  - After the values from evaluating the flows are set, constraints are checked (act [0075] [0076] [0077] FIG. 2 as, for example, results 226.
  - However, if there are no errors, then the design time validation process of FIG. 4 was successful and an indication of success is returned (act [0078] 424). The indication of success can be returned to development component 202 of FIG. 2 as, for example, results 226.
  - By returning errors and/or warnings to development component [0079] [0080]
  - As discussed above, interface and processing layer [0081] 210 of FIG. 2 simulates an environment as defined in LIM document 206. This allows the system described by SDM document 204 to be validated against an expected environment during design of the system, allowing errors to be identified prior to deployment of the system to the environment.
  - Many instances within the instance space can be created by the expansion engine, as discussed in more detail below. However, some of the instances are created by simulator [0082] 218 rather than the expansion engine. In certain embodiments, the instances created by simulator 218 are top-level definitions and by reference members. In certain implementations, each top-level definition is simulated in its own instance space.
  - Simulator [0083] [0084] [0085] 222 is then invoked to instantiate the members and nested members of the special root instance.
  - Expansion engine [0086] [0087]
  - Expansion engine [0088] [0089] [0090]. [0091]
  - In certain embodiments, when instances of a member already exist when expansion engine [0092] 220 is called, the instances will not be created again. However, expansion engine 220 continues recursively on each instance to verify that the instance space is fully created (and will create any nested members from this recursive calling that have not been created yet).
  - FIGS. 5A and 5B are a flowchart illustrating an example recursive expansion process [0093] 500 that creates an instance space. The instance space is defined by an SDM document, such as SDM document 204 of FIG. 2. Process 500 is implemented by expansion engine 220 of FIG. 2, and may be performed in software, firmware, hardware, or combinations thereof.
  - Initially, an instance definition is accessed (act [0094] [0095] [0096] [0097] FIG. 2) to create an instance of the by reference member (act 514).
  - After the instance(s) of the object member is created, whether in act [0098] [0099] [0100] 506, if the selected member is a relationship member, process 500 identifies the number of relationship instances to create based on the number of source instances and the number of target instances involved in the relationship (act 522 of FIG. 5B). The number of relationship instances to create is determined by multiplying the number of source instances by the number of target instances, with the result being the number of relationship instances that are to be created. The identified number of instances of the relationships are then created (act 524).
  - Alternatively, multiplying the number of source instances by the number of target instances may result in a maximum number of relationship instances, and only a subset of that maximum number may be created in act [0101]). [0102]
  - For each instance of the relationship, the source and target instances are associated with the instance of the relationship (act [0103] 526). Process 500 then returns to act 518 of FIG. 5A, where a check is made as to whether there are additional members in the instance definition to be selected.
  - Process [0104] [0105] 222 and constraint engine 224 of FIG. 2. The instance space thus created can be viewed as an instance tree, with each node of the tree representing a member instance. Additionally, each node of the tree (except for the top-level node) is linked to a parent node that represents the member instance that invoked the expansion process to create that node of the tree. Furthermore, each node of the tree is linked to zero or more children nodes that are members of the member instance of that node of the tree. The recursive expansion process knows that it has completed creating an instance graph when the leaf members do not have any nested members (e.g., all leaf members have zero children nodes). Additionally, in order to avoid situations where the expansion process may end up infinite due to a definition having a member that is of its type, in certain embodiments the expansion process will only choose to create instances if the definition is not already instantiated as an ancestor instance. For example, if there is a definition of a directory and it has a directory in it, then the expansion engine will stop expanding this once there is a single directory.
  - Flow Engine [0106]
  - After expansion engine [0107] [0108] [0109]. [0110]
  -. [0111]
  -. [0112]
  - Flow engine [0113]). [0114]
  - Any of a wide variety of flow functions can be used. Flow functions may be defined by the developer of the system and/or by other parties. For example, the same designer as is creating SDM file [0115] [0116]). [0117]
  - FIGS. 6A and 6B are a flowchart illustrating an example process [0118] 600 for evaluating flows. Process 600 is implemented by flow engine 222 of FIG. 2, and may be performed in software, firmware, hardware, or combinations thereof.
  - Initially, all settings on the instances in the instance space are found (act [0119] [0120] [0121] [0122] 614). Each flow instance has a parameter identifying the source (e.g., a particular setting value of another instance) for each of its inputs. A check is then made as to whether the identified inputs have been assigned values yet (act 616 of FIG. 6B). Inputs that are non-calculated setting values will have been assigned values, as will inputs that are calculated setting values calculated by flow instances that have already been evaluated. However, calculated setting values calculated by flow instances that have not yet been evaluated will not have values assigned yet (e.g., they may have a null value).
  - If one or more of the identified inputs do not have values assigned, then evaluation of this flow instance (selected in act [0123] FIG. 6a to begin evaluation of that flow instance (act 622). Evaluation of the flow instance that was paused in act 618 is then resumed when all of the inputs have values (act 624). Evaluation can be resumed, for example, at act 616 or act 626 discussed below. It should be noted that evaluation of one or more of the flow instances identified in act 620 may itself be paused due to identified inputs not yet having values.
  - Returning to act [0124] [0125] [0126] 634). If there are any such additional flow instances, then process 600 returns to act 610 of FIG. 6A, where one of such additional flow instances is selected. When all flow instances have been evaluated (e.g., none of the flow instances identified in act 604 are marked as “dirty” or “not visited”), then the flow evaluation process 600 is complete (act 636). When flow is complete, simulator 218 has a complete instance space with values for settings.
  - Process [0127] 600 is described in FIGS. 6A and 6B as pausing evaluation of a flow instance having inputs that do not yet have values and evaluating the flow instance(s) that set those values. However, process 600 may be implemented in alternate manners. For example, rather than evaluating the flow instance(s) that set those values, process 600 could return to act 610 of FIG. 6A where one of the flow instances is selected (without regard for whether it sets an input value for the paused flow). Evaluating flow instances in this alternate manner could result in the situation where evaluation of some flow instances is complete but evaluation of all other flow instances is paused. When this situation arises, act 616 can be repeated for each paused flow instance to determine whether the identified inputs have values. The inputs for at least one of the paused flow instances should have values, and this process of repeated act 616 can continue until all flow instances have been evaluated.
  - Flow engine [0128] 222 also detects circular references during the flow evaluation process of FIGS. 6A and 6B. Circular references refer to situations where one or more flow instances each rely (either directly or indirectly) on the output of the other for at least one of their inputs. For example, flow instance A has an output value that is also an input value to flow instance A. By way of another example, flow instance A has an input value that is the output from flow instance B, while flow instance B has an input value that is the output from flow instance A. By way of yet another example, flow instance A has an input value that is the output from flow instance B, flow instance B has an input value that is the output from flow instance C, and flow instance C has an input value that is the output from flow instance A. Such circular references are not evaluated, but rather are detected by flow engine 222 and the setting values in the circular references are set to an error state.
  - Circular references can be detected using the “dirty” and “visited” markings. When evaluation of a flow is paused in act [0129] [0130]. [0131]
  -). [0132]
  - [0133] [0134] 222 to development component 202 (e.g., as results 226 of FIG. 2). Alternatively, the event that causes the original error may be returned by flow engine 222 to development component 202 (e.g., as results 226 of FIG. 2), rather than returning the propagation of error states through the flow.
  -. [0135]
  -. [0136]
  -. [0137]
  - Such inherited settings can be accommodated in different manners. In certain embodiments, such inherited settings can be accommodated during the creation of SDM file [01. [0139]
  -. [0140]
  - Constraint Engine [0141]
  - Simulator [0142] [0143]. [01. [0145]
  - FIGS. 7A-7E are a flowchart illustrating an example process [0146] 700 for evaluating constraints. Process 700 is implemented by constraint engine 224 of FIG. 2, and may be performed in software, firmware, hardware, or combinations thereof.
  - Initially, all constraints in the instance space are identified (act [0147] [0148] [0149] [0150] 712). The result can be returned to development component 202 of FIG. 2 as part of results 226. The constraint can optionally include a name or other information describing the constraint that can be returned as part of the results in act 712, allowing additional information describing any errors to be presented to the designer at development component 202.
  - A check is then made as to whether there are any additional constraints in the instance space that have not been selected yet (act [0151] [0152] 704, if the selected constraint is an object constraint, then a primary role and primary object definition for the target instance of the constraint are identified (act 718 of FIG. 7B). For an object constraint, the target instance of the constraint is a relationship instance. The primary object definition of the target instance refers to the name of an object(s) that the selected constraint targets. The primary role of the target instance identifies the relationship role that must match the definition identified by the primary object definition. A check is then made as to whether there is a secondary role and secondary object definition targeted by the constraint (act 720). In certain embodiments, a constraint may target multiple object(s) and/or role(s), and the secondary role and secondary object definition can be used to identify a second role and/or object definition targeted by the constraint.
  - If there is a secondary role and secondary object definition targeted by the constraint, then a check is made as to whether both primary and secondary roles and both primary and secondary object definitions of the constraint match the target instance (act [0153] 722). If one or more of the roles or one or more of the object definitions does not match the target instance, then a match count variable is set to zero (act 724), and process 700 continues to act 726 of FIG. 7C, discussed in more detail below.
  - However, if both primary and secondary roles and both primary and secondary object definitions of the constraint match the target instance, then all nested constraints for the primary object instance are evaluated (act [0154] FIG. 7A.
  - Once all nested constraints are evaluated, a check is made as to whether all of the nested constraints evaluate to true (act [0155] FIG. 7C, discussed in more detail below.
  - Alternatively, since act [0156] [0157] [0158] 736), and process 700 continues to act 726 of FIG. 7C, discussed in more detail below. However, if the primary role and the primary object definition of the constraint match an object instance, then process 700 continues to act 728, where all nested constraints for the primary object instance are evaluated.
  - Turning now to act [0159] 726 of FIG. 7C, a check is made as to whether the value of the match count is at least a minimum number and not greater than a maximum number (act 726). These minimum and maximum numbers are identified by the constraint, and can be any values. If the match count is at least the minimum number but not greater than the maximum number, then a value of true is returned for this constraint (act 738). The return value of true may also be returned to processes evaluating other instances. For example, when a nested constraint is being evaluated in act 728 of FIG. 7B, if act 738 determines that that nested constraint evaluates to true, then the true value can be returned to the process evaluating the parent node to make the determination in act 730.
  - The return value of true can also optionally be returned to development component [0160] 202 of FIG. 2 as part of results 226. Additionally, a name or other identifying information of the constraint that was satisfied (evaluated to true) may optionally be returned to development component 202.
  - However, if the match count is not at least the minimum number or is greater than the maximum number, then a check is made as to whether an error message should be generated for this constraint (act [0161] [0162] FIG. 2 as part of results 226. Analogous to the return value of true in act 738, the return value of false and/or the error message can also be returned to processes evaluating other instances.
  - After the value of true is returned in act [0163] 738, or the value of false is returned in act 744, process 700 returns to act 714 of FIG. 7A to check whether there are any additional constraints that have not yet been selected.
  - Returning to act [0164] 704 of FIG. 7A, if the selected constraint is a relationship constraint, then a match count variable is initialized (act 746 of FIG. 7D). The match count variable can be initialized, for example, by setting the value of the match count variable to zero. The relationship instance(s) that the target object instance of the constraint participates in is then identified (act 748), and one of the identified relationship instances is identified (act 750).
  - A check is then made as to whether the relationship definition and direction of the constraint match the selected relationship instance (act [0165] [0166] FIG. 7E, discussed in more detail below.
  - Returning to act [0167] [0168] [0169] 700 proceeds to evaluate all nested constraints for the relationship instance (act 762 of FIG. 7E). Process 700 then proceeds based on whether all of the nested constraints evaluate to true (act 764). The evaluation and checking of acts 762 and 764 are analogous to the evaluation and checking of acts 728 and 730 of FIG. 7B.
  - If all of the nested constraints do not evaluate to true, then process [0170] 700 returns to act 754 of FIG. 7D to check whether there are any additional identified relationships that have not been selected yet. However, if all of the nested constraints evaluate to true, then the match count variable is incremented (act 766). The match count variable can be incremented by different amounts, such as by a value of one. Process 700 then returns to act 754 of FIG. 7D to check whether there are any additional identified relationships that have not been selected yet.
  - A check is then made as to whether the value of the match count is at least a minimum number and not greater than a maximum number (act [0171] 756), analogous to act 726 of FIG. 7C. If the value of the match count is at least a minimum number and not greater than a maximum number, then a value of true is returned (act 768), analogous to act 738 of FIG. 7C. However, if the value of the match count not is at least a minimum number and not greater than a maximum number, then a check is made as to whether to generated an error for the constraint (act 770), analogous to act 740 of FIG. 7C. If an error is to be generated, then an error message is generated (act 772), analogous to act 742 of FIG. 7C. When the error message is generated, or if no error message is to be generated, then a value of false is returned (act 774), analogous to act 744 of FIG. 7C.
  - Additionally, it should be noted that the constraint check process can be carried out on groups of constraints as well. In order to evaluate a group of constraints, each constraint is individually evaluated using process [0172] [0173] [0174]
  - This section illustrates an example implementation of how errors and warnings can be reported by validation component [0175] 208 of FIG. 2. Errors and warnings can be in any of a variety of formats, such as the example XML format discussed in this section. If the validation component 208 is used through the CLR (Common Language Runtime), then classes with equivalent information to the XML formats discussed in this section may be returned.
  - This section identifies values that will be common to a class of errors. It does not preclude additional values. [0176]
  - Errors that occur during the validation of the type space (parse and resolution errors) will block the compiled SDM document from being written out. However, errors that occur during instance space validation (flow and constraint errors) will not block the compiled SDM document from being written out. [0177]
  - Base Error Format [0178]
  - The base error contains the error information common to all errors. An example XML format for the base error format is: [0179]
  - The attributes or elements of the base error format are described in the following table. [0180]
  - Parse Error [0181]
  - A parse error will result from a failure when trying to load the SDM document. This error will include a line and column number. An example XML format for the parse error format is: [0182]
  - The attributes or elements of the parse error format are described in the following table. [0183]
  - Resolution Error [0184]
  -: [0185]
  - The attributes or elements of the resolution error format are described in the following table. [0186]
  - Flow Error [0187]
  -: [0188]
  - The attributes or elements of the flow error format are described in the following table. [0189]
  - An example XML format for a description of a flow input format is: [0190]
  - The attributes or elements of the description of a flow input format are described in the following table. [0191]
  - An example XML format for a description of a flow output format is: [0192]
  - The attributes or elements of the description of a flow output format are described in the following table. [0193]
  - Constraint Error [0194]
  - A constraint error occurs when a setting constraint is evaluated and returns an error, when a guard fails its cardinality constraint or when at least one member of a constraint group fails to evaluate to true. [0195]
  -: [0196]
  - The attributes or elements of such a constraint error format are described in the following table. [0197]
  - An example XML format for a description of a constraint input format is: [0198]
  - The attributes or elements of the description of a flow input format are described in the following table. [0199]
  -: [0200]
  - The attributes or elements of such a constraint error format are described in the following table. [0201]
  - Document Path [0202]
  - This is a path to a particular SDM element within an SDM document. An example XML format for the a document path format is: [0203]
  - The path will generally have the form: [0204]
  - namespace/root_type (/nested_type)*/member (/nested_member)* [0205]
  - Well known settings for relationships and constraints are treated as nested members. [0206]
  - Containment Path [0207]
  -: [0208]
  - The path will generally have the form: [0209]
  - Namespace/rootType (/nested_type) * member (/nested_member)* [0210]
  - Examples of Errors [0211]
  -. [0212]
  - Error: Errors in this category are fatal and have the following implications: [0213]
  - An output sdm file (.sdmDocument) cannot be created from the compilation [0214]
  - Errors will cause the compiler to complete the current stage of compilation and then terminate. For example, if an XML parse error occurs the document will not be loaded. If a load error occurs, more load errors may be found, but will not continue with flow and constraint checking. [0215]
  - Warning [0216]. [0217]
  - Errors during instance space simulation. [0218]
  - Warning [0219] 2 (W2): Warning 2 is the lowest severity error. For example, an extra attribute is found in the XML file. Guidelines for Warning 2 are:
  - Warning [0220] 2 is safe to ignore
  - Recommended to fix in order to clean up the SDM. [0221]
  - Warning [0222] 3 (W3): Warning 3 is an informational message.
  - Warning [0223] 3 is informational.
  - By default, these warnings are not reported. [0224]
  - The following table lists examples of errors that may be reported by validation component [0225] 208 of FIG. 2. Separate tables are used to show examples of general compiler errors, document load errors, definition space verification errors, flow errors, and constraint errors. A description of the errors and their level are included in the following tables. A format for each of the errors is also identified (e.g., the error (base error) format, the parse format, the resolution format, the flow format, and the constraint format).
  - [0226]
  - [0227]
  - [0228]
  - [0229]
  - The following is an example implementation of the SDM. This example SDM implementation includes a Definitions section (section [0230] 1), an Architectural Overview section (section 2), and an Implementation Details section (section 3). It is to be appreciated that various specific values and requirements are described in this example implementation, and that not all implementations are limited to these specific values and requirements.
  - 1 Definitions [0231]
  - 2 Architectural Overview [0232]
  - The System Definition Model (SDM) supports description of the configuration of and interaction between the elements of a connected system that we will refer to as the modeled system. [0233]
  -. [0234]
  -. [0235]
  -. [0236]
  -. [0237]
  - In order to effect change on the target system, a declarative description of the required changes called a change request can be used. SDM defines the process that is used to expand, validate and execute a change request as part of the SDM execution model. [0238]
  - The instance space captures both the desired and current state of the managed application. We can track changes in the instance space and associate them with the change request that initiated the change. [0239]
  - Managers are used to both provide customized behavior to the runtime and to support interaction between the runtime and the modeled system. [0240]
  - 2.1 Objects [0241]
  - Objects are used to represent both logical and physical aspects of the modeled system. For example, they can be used to represent files, directories and the configuration within IIS. They can also be used to represent an application or distributed system boundary. [0242]
  - We separate objects into three categories. Each represents aspects of the modeled system that we believe should be exposed and understood as part of the SDM model itself rather than through attribution or an imposed inheritance structure over particular models instances. [0243]
  - 2.1.1 Resources [0244]
  -. [0245]
  - Examples of resources include files, directories and registry keys and values as part of operating system, web directories and web files as part of IIS and tables, rows and stored procedures as part of a database. [0246]
  - 2.1.2 Systems [0247]
  -. [0248]
  - This means that interaction between systems must be explicitly modeled using communication relationships. It also means that in general a system is the smallest unit of deployment. Since resources may have undocumented interactions with other resources, we cannot guarantee that they will work if they are deployed independently. [0249]
  - Examples of systems include the operating system, web applications hosted in IIS and databases hosted by SQL. [0250]
  - 2.13 Endpoints [0251]
  -. [0252]
  - Examples of endpoints include Http, Tcpip and Soap endpoints. [0253]
  - 2.2 Relationships [0254]
  - We use relationship to capture aspects of the interactions that occur between objects. All relationships are binary and directed. As well as capturing the interaction between objects, relationship can place constraints on the objects that participate in the relationship and can flow configuration information between the participants. [0255]
  - Once again, we identify a set of relationships that are understood by the SDM model in order to attach particular semantics to those relationships. This allows us to reason about the runtime behavior of the model system. [0256]
  - In particular the aspects that we need to describe about a particular object instance are: [0257]
  - a) its lifetime [0258]
  - b) who can interact with it [0259]
  - c) where it appears in the structure of a system [0260]
  - d) who it communicates with [0261]
  - e) who it depends on to do its work [0262]
  - f) what environment it should execute in [0263]
  - g) whether it is operating correctly and is available [0264]
  - We also use relationships to define the allowable structure of an application. These aspects include: [0265]
  - a) What objects another object can contain [0266]
  - b) Which endpoints can be connected together [0267]
  - c) What environments can host a particular object [0268]
  - Each of the following relationships captures part of one or more of the above aspects. [0269]
  - 2.2.1 Containment [0270]
  -. [0271]
  -. [0272]
  -. [0273]
  -. [0274]
  - 2.2.2 Hosting [0275]
  - Hosting relationships are used to model the containment structure of the environment that is being modeled. These relationships capture the functional restrictions on the environment. For example, the restriction that files must be contained in a directory or that web directories must be contained in a website. [0276]
  -. [0277]
  -. [0278]
  -. [0279]
  - 2.2.3 Communication [0280]
  -. [0281]
  - If a communication relationship does not exist between a set of endpoints then a connection cannot be established between those endpoints. [0282]
  - If a system is marked as offline, then all the clients of that system are updated to reflect the fact that the system is unavailable. This is done by propagating the change through the communication relationships that reference the system. [0283]
  - 2.2.4 Reference [0284]
  - Reference relationships are used to capture dependencies between resources or systems that are required in order to achieve correct operation but are not considered part of the execution environment of the dependent object. [0285]
  -. [0286]
  - 2.2.5 Delegation [0287]
  - A delegation relationship is used to forward interaction with a proxy to an object instance that implements the behavior exposed by the proxy. A commonly used example of delegation is forwarding a communication relationship from an endpoint on a parent system to an endpoint on a contained system. [0288]
  - 2.3 Definitions [0289]
  - Object and relationship definitions are used to create reusable configurations that can be instantiated to create instances of that configuration. These instances then share the common characteristics identified by the definition. [0290]
  - An abstract definition cannot be instantiated directly as it is incomplete. To complete it, another definition extends it to add the missing elements. [0291]
  -. [0292]
  -). [0293]
  - Setting definitions are used to create simple value elements. These values elements can then be used to store configuration information. [0294]
  - 2.4 Members [0295]
  - A definition can contain members that reference other definitions. Members allow one definition to reuse another definition in a way that is customized to its particular application. [0296]
  - Setting members are used to identify configuration information that is associated with the definition. Setting members are based on setting definitions [0297]
  -). [0298]
  -. [0299]
  -. [0300]
  - Flow members are used to define the flow of configuration between members. They collect input values from settings on members, perform some processing on that information and then distribute the results to settings on members. [0301]
  - 2.5 Instances [0302]
  - The instance space reflects the current state of the modeled system. A complete record of the instances that have been created and the relationships between these instances may also be maintained. Each instance has an associated version history where each version is linked to a change request. [0303]
  - The process of creating new instances is initiated by a change request. The change request defines a set of create, update and delete requests for types and relationships associated with specific members of an existing instance; the root is a special case. [0304]
  -. [0305]
  - 2.6 The Object Model [0306]
  - The following uml diagrams capture the broad interactions between the objects in the SDM model. For simplicity, some of these interactions have been defined between base types where the actual interactions exist between derived types and as a result are more specialized. [0307]
  -. [0308]
  - FIG. 8 illustrates an example SDM document. [0309]
  - All SDM definitions derive from a common base definition as shown in FIG. 9. Definitions may contain a description, a set of members, a set of setting values and design data. We specialize definitions into object, relationship, constraint, flow and setting definitions. Object definitions are then further specialized into System, Resource and Endpoint definitions. Relationship definitions are further specialized into Hosting, Communication, Delegation, Reference and Containment definitions. [0310]
  - Members are used to associate a name with a particular instance or array of instances as shown in FIG. 10. All members refer to a definition. Each member may contain a set of setting values, a description and design data. Members are then specialized based on the kind of definition that they reference. Flow and constraint members add the ability to define inputs that source setting values from setting members within the containing definition. Flow members also add outputs that allow the processed flow values to be forwarded to setting members within the containing definition. [0311]
  - An example setting member is shown in FIG. 11. Setting members reference a setting definition that can either represent a complex or a simple setting definition. A complex setting definition can contain nested setting members. A simple definition defines a single value field. Input and output objects are used to define a transfer of a setting value between setting members. [0312]
  - An example constraint definition is shown in FIG. 12. Constraints are used place restrictions on setting values and on the structure of an SDM model. A constrain definition targets a particular object or relationship definition. The constraint definition may place structural constraints on the relationships that the object participates in or the objects that participate in a relationship. These structural definitions may also be added directly to the object or relationship definition. [0313]
  - Description objects are used to provide human readable descriptions of SDM elements, as shown in FIG. 13. These elements should be localizable which is the responsibility of a manager. Design data elements contain structured data that is defined by the design surface that edits the SDM document. [0314]
  - 2.7 Layering [0315]
  - A goal of the SDM model is to allow a separation of concerns between the developers of applications, the designers of the software infrastructure and the architects of the datacenter. Each of these groups focuses on particular services and has a differing set of dependencies. [0316]
  -. [0317]
  -, [0318]
  - A layer boundary can occur wherever a hosting relationship exists. In order to simplify the choice of where to place layer boundaries we define four basic layers as part of the SDM model. We then associate systems with one of these layers. The four layers are: [0319]
  - The application layer. [0320]
  - The application layer supports the construction of applications in a constrained context. The context is defined by the configuration of the hosts identified in the host layer [0321]
  - Examples of system definitions in the application layer include web services, databases and biztalk schedules. [0322]
  - The host layer [0323]
  - Build datacenters out of software components. Configure the connections between components. Some of these components act as hosts for the application layer. [0324]
  - Examples of system definitions in this layer—IIS, SQL, AD, EXCHANGE, DNS and Biztalk. [0325]
  - The Network/OS/Storage layer [0326]
  - Build data center networks and platforms. Configure the network security model and the operating system platform configuration. Add storage to operating system configurations. [0327]
  - Examples of system definitions in this layer—VLAN, Windows, Filter, Storage. [0328]
  - The Hardware layer [0329]
  - The hardware layer identifies the types of machines that exist in the datacenter and the physical connections that exist between these machines. [0330]
  - FIG. 14 shows an example mapping of a layer [0331] 4 web application to a layer 3 web server host. The outer box at each layer represents a system, the boxes on the boundary represent endpoints and the boxes on the inside represent resources. We map each of these elements via a hosting relationship to a host at the layer below.
  - 3 Implementation Details [0332]
  - 3.1 Naming [0333]
  -. [0334]
  - The following header is an example of an identifier for an SDM document: [0335]
  - To reference a type in another namespace you import the namespace:[0336]
  - <Import Alias=“FileSystem” Name=“System.OperatingSystem.FileSystem” Version=“0.1.0.0”/>
  - Then you can use the alias to refer to definitions within the namespace:[0337]
  - FileSystem:File
  - 3.1.1 Identity [0338]
  - SDM names are scoped by the namespace in which they are defined. A namespace is identified by a name, version, language and a public key token and is contained within a single file. [0339]
  - The base form of identity includes name, version, culture, platform and a public key token. [0340]
  - [0341]
  -. [0342]
  - A public key token is a 16 character hex string that identifies the public part of a public/private key pair. This is not the public key; it is simply a 64 bit hash of the public key. [0343]
  - The document language is specified using a culture identifier that consists of two lower case letters defining the language and then two or three uppercase letters defining the country or region. [0344]
  - 3.1.2 Version [03. [0346]
  - 3.1.3 Simple Names [0347]
  - Simple names are made up of alpha-numeric characters and limited punctuation. The name starts with a non-numeric character. [0348]
  - We plan to conform to the C# definition for identifiers; the appropriate section has been inserted below in the following table. Note we will not support “@” prefixed names in the SDM model. [0349]
  - 3.1.4 Reserved Names [0350]
  - The following is a list of reserved names that we will prevent users from using when creating names for members in an SDM definition. Within certain contexts, certain names will be reserved. The compiler will detect uses of these names and return an error to the user. [0351]
  - 3.1.5 References to Other Namespaces [0352]
  - We allow namespaces to reference other namespaces by importing them into the current namespace and then associating an alias with the namespace. The imported namespace is referenced by name, version and public key token. [0353]
  - [0354]
  - 3.1.6 Qualified Names [0355]
  -. [0356]
  - Any path that includes a “dot separator” should be fully qualified and will be resolved from the document root. This means a user cannot create a partially qualified name that contains a more than one type name but can only be resolved from the declaration context. [0357]
  - [<alias>:]<simpleName>(.<simpleName>)* [0358]
  - The alias is defined in an import statement. [0359]
  - 3.1.7 Name Scoping [0360]
  -. [0361]
  - 3.1.8 Member Paths [0362]
  - A member path is a sequence of names that correspond to members of the definitions that are crossed. A path should begin with a member name that is defined in the context in which the path is declared. [0363]
  -. [0364]
  - Member names are dot separated. [0365]
  - 3.1.9 Instance Paths [0366]
  - Paths in the instance space are based on xpaths where the element names in the xpath correspond to member names and attributes in the xpath correspond to settings. [0367]
  - 3.1.10 Signature [0368]
  - A compiled SDM document is signed using a key in order to provide a mechanism to validate the document's contents and to associate a strong name with the document. The signature mechanism uses the DSIG standard () to sign the document. [0369]
  - A signature node similar to the following is embedded in a signed document. [0370]
  - The node is a root node in the document that should occur before any other contents in the document. We declare this element using the ‘any’ tag but we will only recognize and process a “Signature” node at this location.[0371]
  - <xs:any namespace=“” processContents=“skip” minOccurs=“0”/>
  - 3.1.11 Defining, Referencing and Resolving Namespace Names [0372]
  - In this section, we describe the process that we use to match a namespace reference to a particular namespace. As defined in section 3.1.1, a namespace identity consists of five attributes: [0373]
  - Simple name [0374]
  - Public key token [0375]
  - Version [0376]
  - Language [0377]
  - Platform [0378]
  -. [0379]
  - 3.1.11.1 Namespace Definition [0380]
  - When a developer wishes to create and publish a new namespace the developer: [0381]
  - provides a simple name for the namespace [0382]
  - provides a version for the namespace [0383]
  - The developer can optionally: [0384]
  - sign the namespace with a cryptographic key [0385]
  - identify a specific culture for the namespace (defaults to culture neutral) [0386]
  - Identify a specific platform for the namespace (defaults to platform neutral) [0387]
  -. [0388]
  - 3.1.11.2 Namespace Reference [0389]
  - When a consumer references (imports) a namespace in an SDM file, they: [0390]
  - provide the name of the referenced namespace [0391]
  - They can optionally provide additional information including: [0392]
  - the public key token of the referenced namespace [0393]
  - the minimum version of the referenced namespace [0394]
  - the culture of the referenced namespace or a wildcard (*) [0395]
  - the platform of the referenced namespace or a wildcard (*) [0396]
  - All the attributes that are not provided default to a wildcard that will match any value for the attribute. [0397]
  - 3.1.11.3 Matching a Reference to a Definition [0398]
  - The following algorithm is used to match a namespace reference to namespace definition. This algorithm is used both when compiling a namespace and when resolving references between compiled namespaces. [0399]
  -. [0400]
  - Logically, the resolution algorithm works as follows: [0401]
  - 1. Find all namespaces with names that matches the name in the reference. [0402]
  - 2. If the reference provides a public key token then select only the namespaces that also match the provided public key token. [0403]
  - 3. If a specific language has been provided by the reference, then remove all namespaces that don't match the language. If the language attribute was set to wildcard not provided, then keep all namespaces [0404]
  - 4. If a specific platform has been provided then remove all namespaces that don't match the platform. If platform attribute was set to wildcard or not provided, then keep all namespaces [0405]
  - 5. Then use versioning policy to select a particular namespace from the set of possible namespaces. [0406]
  - The following sections define these steps in more detail. [0407]
  - 3.1.11.3.1 Matching Namespace Name [0408]
  - The name match is an exact string match. The name is case sensitive. [0409]
  - 3.1.11.3.2 Matching Public Key Token [0410]
  - The token is an exact match. [0411]
  - 3.1.11.3.3 Matching Language [0412]
  - There are three scenarios for language matching: [0413]
  - 1. Reference=*, Definition=specific language. [0414]
  - 2. Reference=specific language, Definition=*. [0415]
  - 3. Reference=specific language, Definition=specific language. [0416]
  - For the first and second cases, the definition is a match for the reference. In the third case, the definition is only a match for the reference if the language is an exact match. [0417]
  - 3.1.11.3.4 Matching Platform [0418]
  - There are three scenarios for platform matching. [0419]
  - 1. Reference=*, Definition=specific platform. [0420]
  - 2. Reference=specific platform, Definition=*. [0421]
  - 3. Reference=specific platform, Definition=specific platform. [0422]
  - For the first and second cases, the definition is a match for the reference. In the third case, the definition is only a match for the reference if the platform is an exact match. [0423]
  - 3.1.11.3.5 Matching Version [0424]
  - The version match is dependent on the versioning policy that is being used by the compiler or runtime. [0425]
  - 3.2 Settings [0426]
  - All definitions can expose settings members, called setting declarations within the XML schema. These members are used to describe the configuration values that are associated with the definition. Values are provided using SettingValue statements. These can be used by: [0427]
  - a) The definition that declares the setting member to define the default values for the setting. [0428]
  - b) By a definition that extends another definition to provide default or fixed values for the base definition. [0429]
  - c) By members that reference a definition and through member paths that terminate in the member that references the definition. [0430]
  - d) Through flow along relationships. [0431]
  - To define a setting you first need to define the definition of the setting using xsd. [0432]
  - You can then declare a setting that uses the definition and includes a set of attributes to define the behavior of the setting.[0433]
  - <SettingDeclaration Name=“Definition” Definition=“RegistryValueType” Access=“Readwrite”Required=“true”/>
  - Once you have a setting declaration you can provide a value for the setting.[0434]
  - <SettingValue Name=“Definition” Fixed=“true”>long</SettingValue>
  - 3.2.1 Setting Definitions [0435]
  - We use XSD schemas to define the setting definitions used by setting members. We only support the use of simple and complex types from a schema though other schema elements may exist to support the definition of those types. [0436]
  -. [0437]
  -”. [0438]
  - When a setting definition schema references the namespace from another document they will use the full namespace name: xmlns:system=“System/AAAABBBBCCCCDDDD”. [0439]
  - [0440]
  - Settings are resolvable from three separate namespaces: [0441]
  - a) The SDM namespace—when we refer to setting types within system, resource, endpoint, relationship, constraint or flow types. [0442]
  - b) The clr namespace—when we refer to settings using strongly typed classes within the clr and when setting types are built on other setting types. [0443]
  - c) The XSD namespace—when setting types are built using other setting types. [0444]
  - For this to work, we place a number of restrictions on the way we declare settings: [0445]
  - a) All settings must be in the same groupings within each of the clr, SDM and xsd namespaces. That is, if two settings are together in one namespace, they must be together in all three namespaces. [0446]
  - b) Imported namespaces within an xsd schema definition must match the imported namespaces in an SDM file and the imported namespaces in the associated helper assembly. [0447]
  - c) With the exception of the xsd namespace, all imported namespaces in an xsd schema must be defined within an SDM file. [0448]
  - XSD types from imported SDM documents are accessible using QNames:[0449]
  - <alias>:<type-name>
  - The following example uses the type defined in the registry example above. The document imports the registry document that includes the setting definition. [0450]
  - The setting definitions schema can then also reference the System.Operatingsystem.Registry namespace. [0451]
  - 3.2.2 Built in Simple Data Types [0452]
  -. [0453]
  -”. [0454]
  - 3.2.2.1 XSD Built in Types [0455]
  - FIG. 15 illustrates an example built-in datatype hierarchy. In FIG. 15, the all complex types are derived by extension or restriction. The NMTOKENS, IDREFS, and ENTITIES types are derived by list. All other types shown in FIG. 15 are derived by restriction. [0456]
  - 3.2.2.2 C# Data Types [0457]
  - 3.2.2.3 Supported Conversions [0458]
  - These are the conversions that exist between xsd types and cls types. [0459]
  - 3.23 Setting Members [04. [0461]
  - Attributes are used to provide further information about each setting member. [0462]
  - [0463]
  - 3.2.4 List Support [0464]
  -. [0465]
  - A list declaration includes an attribute list set to true:[0466]
  - <SettingDeclaration Name=“roles” Definition=“String” List=“true”/>
  - Values are then provided using a settingValueList. When providing the list, the user can specify whether to replace or append to the previous values. [0467]
  - The SDM supports simple manipulation of lists of values. When a path from a flow member targets a setting declaration, then the resulting behavior is dependent of the definitions at either end of the path. [0468]
  - 3.2.5 Setting Attributes [0469]
  - Setting attributes are used by the runtime to describe the behavior of a particular setting. [0470]
  - [0471]
  - 3.2.6 Setting Values [0472]
  - Depending on whether the setting has been declared as a single value or a list, the value for the setting can be provided using either a setting value element or a setting value list element. [0473]
  - 3.2.6.1 Setting Value [0474]
  -. [0475]
  - [0476]
  - 3.2.6.2 Setting Value List [0477]
  - A setting value list is used to provide one or more values for a setting declared as a list. When declaring the values the user can decide to merge with previous values or to overwrite all previous values. [0478]
  - [0479]
  - 3.2.7 Settings Inheritance [0480]
  - Settings inheritance means that a derived definition implicitly contains all the settings declarations from the base definition. Some important aspects of settings inheritance are: [0481]
  - Settings inheritance is transitive. If C is derived from B, and B is derived from A, then C inherits the settings declared in B as well as the settings declared in A. [0482]
  - A derived definition can add new settings declarations to those it inherits from the base definition it extends, but it cannot remove or change the definition of an inherited setting. [0483]
  - 3.2.8 Setting Instances [0484]
  - The setting instance in the instance space holds the actual value for a setting member. The value for a setting instance is initially assigned through setting value statements in the definition space. Then setting flow is evaluated, updating the values for setting instances that are the targets of flow. [0485]
  - In some scenarios, we need to differentiate between the setting value derived from setting value statements and any values later provided through flow. We call the former the “assigned” value and the latter the “resultant” value. [0486]
  - 3.2.9 Value Transfer [0487]
  - In order to pass setting values into or out of a flow or constraint we use value transfers. An Input transfer is evaluated before the definition associated with the member is evaluated, and an Output transfer is evaluated after the definition associated with the member is evaluated. [0488]
  -. [0489]
  - [0490]
  - 3.2.9.1 Input [0491]
  - An input statement identifies an input value that will be transferred before the flow or constraint is executed. The input can use the ValueSource element to select whether the “assigned” or the “resultant” setting value is used as the input (see section XX for definition of assigned/resultant). [0492]
  - 3.2.9.2 Output [0493]
  - Output is a variation on the value transfer that supports the semantics for fixing and replacing the target values. [0494]
  - [0495]
  - 3.2.10 Casting [0496]
  -. [0497]
  - FIG. 16 illustrates an example of upcasting and downcasting. In FIG. 16, the User definition extends the base definition Any. The ExtendedUser definition in turn extends the base definition User. By constructing this definition hierarchy we are indicating that an ExtendedUser definition can be provided anywhere a User definition is required and that a both an ExtendedUser and a User definition can be provided anywhere an Any definition is required. [0498]
  - The following setting declaration statements use the definitions from FIG. 16, and will be used in the examples in the following sections. [0499]
  - 3.2.10.1 Upcasts [0500]
  - In FIG. 16, an upcast would occur when an instance of the ExtendedUser definition is assigned to a setting declaration that requires a definition of either User or Any. An example of an upcast would be a transfer of a value from the setting declaration First to the setting declaration Second. This might occur as part of a flow input declaration. [0501]
  - Upcasts are supported automatically. Any value can be cast to one of its base definitions without the need for any special interaction on the part of the developer. When a setting instance is upcast, the actual definition of the instance is kept with the setting value. [0502]
  - 3.2.10.2 Downcasts [0503]
  - In FIG. 16, a downcast would occur when a user transfers a setting value from a setting declaration marked as Any to a setting declaration marked as User. In this case, the assignment can only occur if the definition associated with the instance is User or ExtendedUser. This implies that setting instance may have definitions that are different from the setting declaration that they are currently associated with. We track this in the instance space by passing a reference to the actual definition of the instance around with the instance itself. [0504]
  -. [0505]
  -. [0506]
  - 3.2.11 Conversions [0507]
  - Type conversions are required when a user wishes to transfer a setting instance to a setting declaration that has a different definition from the instance and the setting declaration's definition is not a base definition of the instance's definition. [0508]
  - FIG. 17 illustrates an example of type conversion. As illustrated in FIG. 17, type conversion may occur between definitions that are in different branches of the inheritance tree and when the destination definition is below the source definition within a branch of the inheritance tree. [0509]
  - Type conversions are handled by setting managers. Both the source and target managers can expose conversion support. This means that given the definitions in FIG. 17 and an assignment from a User definition to a String definition, the manager for User could expose a conversion to String or the manager for String could expose a conversion from User. [0510]
  - The runtime will first ask the source manager to convert the instance, then the target manager, and finally return an error if there is no available conversion. [0511]
  -. [0512]
  -. [0513]
  - 3.2.12 CLR to SDM Type Mapping [0514]
  - In the SDM model, all setting definitions have corresponding CLR types. These types are defined by the manager associated with the SettingDefinitions element in the SDM model. [0515]
  -. [0516]
  - For example, in an SDM model, a developer may define the following setting definition: [0517]
  - Then the developer may write a manager that processes a value associated with that setting definition that takes an instance of the following CLR type: [0518]
  - There are two parts to this problem: the first is being able to map from definition to type and back, the second is being able to map from SDM instance to clr instance and back. [0519]
  - 3.2.12.1 Mapping Definition to Type [0520]
  -. [0521]
  -. [0522]
  - 3.2.12.2 Converting Instance Values [0523]
  -. [0524]
  -. [0525]
  - The Clr class should support conversion for all setting definitions within the SettingDefinitions element. [0526]
  - 3.3 Attributes [0527]
  - Many of the objects in the SDM can be attributed to capture behavior that is orthogonal to core behavior of the object. We use a general attribution model defined as follows: [0528]
  - 3.4 Definitions [0529]
  - Definitions are used to create reusable configurations of resources and systems. They are analogous to classes in an object oriented language. [0530]
  - 3.4.1 Definition [0531]
  -. [0532]
  - The name of the definition should be unique for all definitions within the scope that contains the definition. The scope may be either an SDM document or another definition. [0533]
  - [0534]
  - 3.4.2 Object Definitions [0535]
  - An abstract object definition exposes a set of setting declarations, can contain constraints on the relationships that it participates in and has an associated manager in the runtime. [0536]
  - The following is an abstract system definition for a web server. The web server has two settings and has a relationship constraint that requires it to contain at least on vsite type. [0537]
  - The vsite is an abstract endpoint definition that contains server binding information. [0538]
  - [0539] 80.
  - 3.4.2.1 Object Definition [0540]
  - Abstract and concrete object extend the following base object definition. In addition to the elements of the base type Definition, they share the ability to constrain the relationships that the objects participate in. [0541]
  - [0542]
  - Abstract object definitions are used to define building blocks that the design surface exposes and from which all concrete objects are derived: a concrete object definition implements an abstract object definition. [0543]
  -. [0544]
  -. [0545]
  - Object definitions can also contain declarations of nested definitions. These definitions can be used for members within the scope of the containing definitions and referenced in constraints outside the scope of the definition. [0546]
  - Concrete object definitions provide an implementation for an abstract object definition. The implementation is constructed from object and relationship members, values for the settings of implemented abstract definition, new settings declarations, flow between members and constraints on members. [0547]
  - 3.4.2.2 Implicit Base Definitions [0548]
  -. [0549]
  - The definitions of these types include base constraints that control their instantiation within the model. [0550]
  - 3.4.2.3 Endpoint Definition [0551]
  - Endpoint definitions extend the base object definition by adding the ability to declare nested resource types, resource members and host, containment and reference relationship members. [0552]
  - [0553]
  - 3.4.2.4 System Definition [0554]
  - A system type extends the base type by adding support for: nested endpoint, system and resource types; endpoint, system, and resource members and host, containment, connection, delegation and reference relationships. [0555]
  - [0556]
  - 3.4.2.5 Resource Definition [0557]
  - A resource type may contain nested resource type definitions, resource members, and host, containment and reference relationship members. [0558]
  - [0559]
  - 3.4.2.6 Relationship Rules [0560]
  - For a particular instance of an object definition the following tables identify the cardinality associated with each of the roles that the instance can play. [0561]
  - 3.4.2.6.1 System Rules [0562]
  - 3.4.2.6.2 Endpoint Rules [0563]
  - 3.4.2.6.3 Resource Rules [0564]
  - 3.4.2.6.4 Notes [0565]
  - Every instance should participate in exactly one containment relationship and at least one hosting relationship. [0566]
  - This means that: [0567]
  - A) non-reference (by-value) members should identify a containment relationship in the same definition [0568]
  - b) in order to be constructed a reference member should identify a containment relationship [0569]
  - 3.4.3 Relationship Definitions [0570]
  -. [0571]
  -. [0572]
  - A relationship is used by declaring a relationship member that identifies the type members that will participate in the relationship. [0573]
  - 3.4.3.1 Relationship Definition [0574]
  -. [0575]
  -. [0576]
  - Concrete relationships are relationships between two concrete object definitions. Each concrete relationship should implement an abstract relationship. The abstract relationship should be between a matching pair of abstract objects definitions that are directly or indirectly (through inheritance) implemented by the concrete object definitions. [0577]
  - The name for the relationship should be unique within the namespace that contains the relationship. [0578]
  - [0579]
  - 3.4.3.2 Communication Relationship [0580]
  - Communication relationships are used to capture possible communication links between endpoint definitions. They are used to describe interaction between independently deployed software elements. The communication relationship schema extends the base relation schema by adding client and server endpoint references. [0581]
  - [0582]
  - The following combinations of abstract type pairs are valid for communication relationships: [0583]
  - 3.4.3.3 Hosting Relationship [0584]
  -. [0585]
  -. [0586]
  -. [0587]
  - [0588] 3 application and systems of the layer 2 host.
  - [0589]
  - The following combinations of abstract definition pairs are valid for hosting relationships: [0590]
  - 3.4.3.4 Containment Relationship [0591]
  - A containment relationship between two abstract objects captures the fact that a concrete type based on the parentType can contain members based on the memberType. Containment implies that the parent instance can control the lifetime of the member instance and can delegate behavior to the member instance. [0592]
  - [0593]
  - The following combinations of abstract definition pairs are valid for containment relationships: [0594]
  - 3.4.3.5 Delegation Relationship [0595]
  -. [0596]
  - A delegation relationship defines pairs of abstract endpoint definitions that can participate in the delegation. Each relationship identifies an abstract endpoint definition that can act as a proxy and an abstract endpoint definition to which it can delegate behavior. [0597]
  - [0598]
  - The following combinations of abstract type pairs are valid for delegation relationships: [0599]
  - We may allow resource and system delegation to support binding between layers. For example, to allow IIS to expose part of the file system without having to deploy it. [0600]
  - 3.4.3.6 Reference Relationship [0601]
  -. [0602]
  - [0603]
  - The following combinations of abstract type pairs are valid for reference relationships: [0604]
  - 3.4.3.7 Implicit Base Relationships [0605]
  - All abstract relationships implicitly extend one of the base relationships definitions. These definitions form a root for each of the relationship trees. FIG. 18 illustrates an example relationship tree. By doing this we can refer to the root definition from within constraint definitions and we can inherit common type constraints from the root type. [0606]
  - 3.5 Members [0607]
  - 3.5.1 Member [0608]
  -. [0609]
  - [0610]
  - 3.5.2 Object Member [0611]
  -. [0612]
  - [0613]
  -. [0614]
  - There are a number of reasons that we do this: [0615]
  - 1. When an operator constructs a system, we only expose the ability to construct isReference members. This greatly simplifies the operator experience. [0616]
  - 2. When we process an SDM document we have clear boundaries at which the instance space of the document can vary from that of the concrete definition space. [0617]
  - 3.5.3 Relationship Member [0618]
  - Relationship members identify the relationships that will exist between object members when they are created. Relationship instances are either explicitly created by the operator or implicitly created by runtime. Examples of the former are hosting relationships between instances, the latter, communication relationships between systems. [0619]
  - 3.5.4 Endpoint Member [0620]
  - 3.5.5 System Member [0621]
  - 3.5.6 Resource Member [0622]
  - 3.5.7 Hosting Member [0623]
  - Host members are used to declare a hosting relationship between two object members. The object members may be direct members of the containing definition or nested members that have a membership relationship with the definition. There should be a membership chain between the referenced member and the containing definition. [0624]
  - [0625]
  - 3.5.8 Communication Member [0626]
  - A communication member is used to declare a communication relationship between endpoint members of immediate system members of the definition. [0627]
  - [0628]
  - 3.5.9 Containment Member [0629]
  - A containment member is used to declare that a type member is contained by the type. Each type member can either be contained or delegated. The containment member automatically sets the parent value of the containment relationship to be the this pointer of the relationship. [0630]
  - [0631]
  - 3.5.10 Delegation Member [0632]
  - A delegation member is used to set up a delegation relationship between an endpoint definition member on the outer type and an endpoint definition member on an immediate system member of the outer type. [0633]
  - [0634]
  - 3.5.11 Reference Member [0635]
  - A reference member is used to set up a reference relationship between two immediate or nested members of the outer definition. [0636]
  - [0637]
  - [0638] 3.6 Flow
  - Settings flow is used to pass parameters between members of an object definition and between participants in relationships. As part of a flow, the user can use transformations to combine or separate setting values and to calculate new setting values. [0639]
  - All settings flow members use a flow definition to implement the transform. The following is a flow definition that parses a url. [0640]
  - A flow member is then declared within an object or relationship. The flow member provides the input for the flow definition and then directs the output from the flow to the target settings. [0641]
  - 3.6.1 Flow Definition [0642]
  -. [0643]
  -. [0644]
  - 3.6.2 Flow Member [0645]
  -. [0646]
  -. [0647]
  - It is an error for the outputs from separate flow members to target the same setting member on an object instance. [0648]
  - [0649]
  - 3.7 Constraints [0650]
  - Constraints are used to identify restrictions on setting values of members of a definition or on the participants in a relationship. These restrictions are evaluated in the instance space at both design time and at deployment time. [0651]
  -. [0652]
  - A constraint member then used to provide the values to the constraint type for evaluation. [0653]
  - 3.7.1 Constraint Definition [0654]
  -. [0655]
  - [0656]
  - 3.7.2 Constraint Member [0657]
  - A constraint member identifies a set of input values for a particular constraint definition. The member can identify static values for settings and can use input statements to bind a constraint setting to a path. [0658]
  - [0659]
  - 3.7.3 Structural Constraints [0660]
  - We use object and relationship constraints to define the topology of the concrete space and to constrain the settings of objects when used in particular relationships. [0661]
  -: [0662]
  -: [0663]
  - In this case, we added a constraint that required the name of the member to equal the string “myPort”. [0664]
  -. [0665]
  -. [0666]
  - In this case, we use a group of object constraints to specify a set of possibilities of which at least one should be true. [0667]
  -. [0668]
  - From the perspective of foo the following two scenarios should be equivalent. In the first foo places a nested constraint on a contained system bar, in the second, the type bar already contains the constraint. [0669]
  - [0670]
  - 3.7.3.1 Constraint Model [0671]
  -. [0672]
  - Predicates are then executed when the requirement of their guards have been met. We have two forms of predicate: setting constraints that validate setting values and group constraints that validate a set of constraints. [0673]
  - We can nest guards within guards, in which case the inner guard is only checked when the outer guard is satisfied. This allows us to build paths that support verification of a relationship structure. [0674]
  - The combination of a guard and its predicates can have a cardinality that indicates the number of times that the guard should match and the predicate evaluate to true. [0675]
  - More formally, [0676]
  -. [0677]
  - Predicate:==settingsconstraint(rule)|group{(guard)*}[0678]
  -. [0679]
  - Examples: [0680]
  - This example shows a guard that evaluates to true whenever there is a containment relationship to a webapp. This guard can evaluate true at most one time. Further matches will result in the return of an error to the user. [0681]
  -. [0682]
  -. [0683]
  -. [0684]
  -. [0685]
  - 3.7.3.2 Base Constraint [0686]
  -. [0687]
  - [0688]
  - 3.7.3.3 Object Constraint [0689]
  -. [0690]
  - The constraint is evaluated as follows: [0691]
  - a) Does the primary role and primary definition match an object instance, and if provided, does the secondary role and secondary definition match an object instance. If these don't match, then set matches=0 and skip to c) [0692]
  - b) Evaluate all nested constraints in the context of the primary object instance. If these all evaluate to true, set matches=1, otherwise set matches=0. [0693]
  - c) If matches>MinOccurs and matches<MaxOccurs set result=true, else set result=false. [0694]
  - d) If required is true and result is false return a message to the user [0695]
  - e) Return result to the parent context [0696]
  - [0697]
  - 3.7.3.4 Object Constraint Group [0698]
  -: [0699]
  - a) Evaluate each nested constraint in turn. If at least one evaluates to true then set result=true otherwise set result=false. [0700]
  - b) If result=false and Required=true, then raise an error [0701]
  - c) Return result to the parent context. [0702]
  - [0703]
  - 3.7.3.5 Relationship Constraint [0704]
  -. [0705]
  -. [0706]
  - A relationship constraint is evaluated as follows: [0707]
  - a) Set matches=0 [0708]
  - b) For each relationship instance that the object instance participates in [0709]
  -. [0710]
  - b. Evaluate all nested constraints in the context of the relationship instance. If these all evaluate to true, set matches=matches+1 [0711]
  - c) If matches>MinOccurs and matches<MaxOccurs set result=true, else set result=false. [0712]
  - d) If required is true and result is false return a message to the user [0713]
  - e) Return result to the parent context [0714]
  - [0715]
  - 3.7.3.6 Relationship Constraint Group [0716]
  - A relationship constraint group allows sets of relationship constraints to be grouped together so that they can be evaluated as a predicate with at-least-one semantics. The constraint group is evaluated as follows: [0717]
  - d) Evaluate each nested constraint in turn. If at least one evaluates to true then set result=true otherwise set result=false. [0718]
  - e) If result=false and Required=true, then raise an error [0719]
  - f) Return result to the parent context. [0720]
  - [0721]
  - 3.7.3.7 Constraint Evaluation [0722]
  - There are three distinct times that a constraint can be evaluated: during the design process, during deployment of an application and then once an application has been deployed at any time that an operator wants to check or update the configuration of an application. [0723]
  -. [0724]
  -. [0725]
  - Constraints can be marked as follows: [0726]
  - a) Design—indicating that it can be run at design time, deployment time or during validation, [0727]
  - b) Deployment—indicating that it can be run at deployment or during validation, [0728]
  - c) Validation—indicating that it can only be run during validation, or [0729]
  - d) Never—indicating that it will never be executed. [0730]
  - The following enumeration is used to capture these options: [0731]
  - The evaluation behavior of a constraint can be set on both structural constraints and on constraint members. In both cases, it applies to all nested constraints with either the structural constraint or the constraint member. [0732]
  - Constraints by default are marked as design time constraints and can be executed at any time. [0733]
  - [0734]. FIG. 19 illustrates an example of using delegation to expose a host's implementation to a guest. [0735]
  - In FIG. 19, the Application Platform component uses a delegation relationship to expose the file system from its host, the operating system component, to its guest, the application. By doing this, the application platform can control what parts of the operating system are available to its guest without having to implement them directly. [0736]
  - FIG. 20 illustrates an example of using delegation to expose a member's implementation to a parent. In FIG. 20, the client application exposes the Booking service's endpoint to the ticketing application. This allows the ticketing application to then connect the endpoint to the Server application, which in turn delegates its endpoint to the UserData application. [0737]
  - 3.8.1 Principles [0738]
  - The following principals guide the design of the delegation model. [0739]
  - The proxy does not exist in the target system. The proxy is a convenience for the model and will not have a physical manifestation. If this were not true, then the use of delegation would have side effects on the target system. [0740]
  -. [0741]
  - From an external user's perspective, the user should not have to know whether a particular instance is a proxy or an actual implementation. If this were not true, then constraint and flow authors would have to cover both cases leading to complex and fragile code. [0742]
  - A user should be able to explicitly target proxies as part of a constraint expression. This is required in order to implement constraints that control the exposure of behavior through a component boundary. [0743]
  - 3.8.2 Scenarios [0744]
  - The following are two scenarios that illustrate the issues associates with using delegates in a system [0745]
  - 3.8.2.1 Communication Connectivity Validation [0746]
  - In order to validate that a client port can connect to a server port, a communication relationship contains a constraint that walks to the server, then to the server's host, then back along a communication relationship at layer [0747] 3, then up the hosting relationship to the layer 4 client and finally back to the communication relationship. This is illustrated in FIG. 21.
  - It is likely that delegation relationships will exist between the clients and servers at both layers due to the existence of containment boundaries. An example of this is illustrated in FIG. 22. In order to write the constraint that follows this path, the user should then be able to cope with an arbitrary number of these relationships, which would complicate the description of the constraint and reduce the usability of the constraint language. [0748]
  - To avoid this we need the user to be able to write the constraint without knowing in advance, whether there will be proxies and how many there might be. [0749]
  - 3.8.2.2 Zone Boundaries [0750]
  -. FIG. 23 illustrates an example of zone boundaries. [0751]
  - In FIG. 23, if the developer may wished to constrain outgoing communication from zone[0752] 1 to zone 2, then they would do they by constraining the endpoints that were delegated to the zone boundary. For example, they may write a constraint that only allows incoming http and outgoing sql communication flows. This constraint would fire for each proxy endpoint exposed by the zone.
  -. [0753]
  - 3.8.3 Interaction with Other Parts of the Model [0754]
  - The rules for delegates are illustrated using an example instance space illustrated in FIG. 24. [0755]
  - 3.8.3.1 Proxy and Delegate [0756]
  - The proxy should be the same or a base class of the delegate. In the example in FIG. 24, b, which acts as a proxy, should be the same or a base definition of c, the delegate. This is required because the proxy b can only expose the behavior of c. If the types were allowed to differ, then the exposed behavior of b could be different from the behavior of c but there would be no physical manifestation of b that could implement the required behavior. [0757]
  -. [0758]
  - 3.8.3.2 Relationships Roles [0759]
  - A proxy can participate in the following relationship roles: [0760]
  - 3.8.3.3 Member Filtering and Path Resolution [0761]
  -. [0762]
  - Given the following definitions for B and C in FIG. 24: [0763]
  - Then the proxy b will only expose the height setting and not the weight setting. [0764]
  - When a setting value is set on a proxy, the action is forwarded through the delegation relationship to the delegate: the new setting value is recorded directly on the delegate and is visible to any other proxies that target that delegate. [0765]
  - When a setting value is retrieved from a proxy, the request is forwarded to the delegate and the setting value is returned directly from the delegate. [0766]
  -. [0767]
  - When a member path references a member on a proxy then the path is automatically resolved to the member on the delegate. This means that the path syntax does not change depending on whether a member is a proxy or a delegate. [0768]
  - 3.8.3.4 Relationship Filtering [0769]
  -. [0770]
  -. [0771]
  -. [0772]
  - 3.8.3.4.1 Proxy Identity and Relationship Filtering [0773]
  -. [0774]
  - 3.8.3.4.1.1 Transparent Proxy [0775]
  - A transparent proxy is used to expose the implementation of the delegate to a client. A typical example would be shown in FIG. 23, where the zones are purely for modeling purposes and should not hide the systems that they contain. In this case, a developer that is communicating with the Sql system in zone [0776] 2 should be aware that the implementation of the delegated endpoint is a Sql server rather than a zone.
  - A transparent proxy returns all identifying information from the delegate rather than the client. This means that the instance ID, definition, version and containment information are all sourced from the delegate rather than the proxy. [0777]
  - When queried, a transparent proxy will also return the set of relationships that the delegate participates in rather than those of the proxy. [0778]
  - 3.8.3.4.1.2 Opaque Proxy [0779]
  - An opaque proxy is used to hide the implementation of the delegate so that the developer is free to change that implementation without breaking the client. For example in FIG. 19, the IIS system may use an opaque proxy to hide the file system implementation so that guests of IIS do not depend on the operating system that implements the file system. [0780]
  - An opaque proxy will return instance ID, definition and version and containment information from the proxy rather than the delegate. [0781]
  - When queried, an opaque proxy will only return relationships that it participates in directly not including its delegation relationship. [0782]
  - 3.8.3.5 Flow [0783]
  -. [0784]
  -. [0785]
  - 3.8.3.6 Constraints [0786]
  - Constraints can either be written to be delegation aware or not. If a constraint is delegation aware then it will be evaluated on each proxy instance without the any rollup of the relationships that the proxy participates in. Delegation relationships will be exposed to the constraint. [0787]
  - For example, a delegation aware communication constraint written from x targeting b in FIG. 24 would see the proxy b and the relationships that it participates with x, c, d, e and i. Then assuming it followed the delegation relationship to c, it would see the relationships from c to b, f, h and g. [0788]
  -. [0789]
  -. [0790]
  - A constraint is marked as delegation aware by setting the DelegationAware attribute to true on a structural constraint (either object or relationship constraint—see section 3.7.3). [0791]
  - Constraints that are declared as part of a proxy's definition will not be evaluated on the proxy. This is because the constraints will also be evaluated against the delegate since they should be common to both the proxy's and the delegate's definitions. [0792]
  - 3.9 Manager [0793]
  -. [0794]
  -. [0795]
  - [0796]
  - 3.9.1 Roles [0797]
  - An object manager can support one or more roles for each type that it supports. These roles include: [0798]
  - a) Evaluating constraints for the type or relationship [0799]
  - b) Evaluating flow for the type or relationship [0800]
  - c) Construction/destruction/update support for a type [0801]
  - d) Exposing an object representation for the settings on the type or relationship [0802]
  - e) Performing discovery for the type or relationship. [0803]
  - f) Supporting design surface specific UI around a type or relationship [0804]
  - 3.9.2 Notes [0805]
  -. [0806]
  - 3.10 Design Data and Descriptions [0807]
  -. [0808]
  - 3.11 SDM Document Structures [0809]
  - An SDM document provides a strong identity, versioning and localization information for a set of relationships, objects and managers. [0810]
  - 3.11.1 Information [0811]
  - The information section of an SDM document contains human readable information to support identification and management of SDM documents. [0812]
  - Example Computer Environment [0813]
  - FIG. 25 illustrates a general computer environment [0814] 800, which can be used to implement the techniques described herein. The computer environment 800 is only one example of a computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the computer and network architectures. Neither should the computer environment 800 be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the exemplary computer environment 800.
  - Computer environment [0815] 800 includes a general-purpose computing device in the form of a computer 802. Computer 802 can be, for example, a computing device 102 of FIG. 1, or implement development system 202 or validation component 208 of FIG. 2. The components of computer 802 can include, but are not limited to, one or more processors or processing units 804, a system memory 806, and a system bus 808 that couples various system components including the processor 804 to the system memory 806.
  - The system bus [0816] 808 [0817] 802 typically includes a variety of computer readable media. Such media can be any available media that is accessible by computer 802 and includes both volatile and non-volatile media, removable and non-removable media.
  - The system memory [0818] 806 includes computer readable media in the form of volatile memory, such as random access memory (RAM) 810, and/or non-volatile memory, such as read only memory (ROM) 812. A basic input/output system (BIOS) 814, containing the basic routines that help to transfer information between elements within computer 802, such as during start-up, is stored in ROM 812. RAM 810 typically contains data and/or program modules that are immediately accessible to and/or presently operated on by the processing unit 804.
  - Computer [0819] 802 may also include other removable/non-removable, volatile/non-volatile computer storage media. By way of example, FIG. 25 [0820] 802. Although the example illustrates a hard disk 816, a removable magnetic disk 820, and a removable optical disk 8 [0821] 816, magnetic disk 820, optical disk 824, ROM 812, and/or RAM 810, including by way of example, an.
  - A user can enter commands and information into computer [0822] structures, such as a parallel port, game port, or a universal serial bus (USB).
  - A monitor [0823] 842 or other type of display device can also be connected to the system bus 808 via an interface, such as a video adapter 844. In addition to the monitor 842, other output peripheral devices can include components such as speakers (not shown) and a printer 846 which can be connected to computer 802 via the input/output interfaces 840.
  - Computer [0824] 802 can operate in a networked environment using logical connections to one or more remote computers, such as a remote computing device 848. By way of example, the remote computing device 848 can be a personal computer, portable computer, [0825] 802 and the remote computer 848 are depicted as a local area network (LAN) 850 and a general wide area network (WAN) 852. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets, and the Internet.
  - When implemented in a LAN networking environment, the computer [0826] 802 is connected to a local network 850 via a network interface or adapter 854. When implemented in a WAN networking environment, the computer 802 typically includes a modem 856 or other means for establishing communications over the wide network 852. The modem 856, which can be internal or external to computer 802, can be connected to the system bus 808 via the input/output interfaces 840 or other appropriate mechanisms. It is to be appreciated that the illustrated network connections are exemplary and that other means of establishing communication link(s) between the computers 802 and 848 can be employed.
  - In a networked environment, such as that illustrated with computing environment [0827] 800, program modules depicted relative to the computer 802, or portions thereof, may be stored in a remote memory storage device. By way of example, remote application programs 858 reside on a memory device of remote computer 848. For purposes of illustration, application programs and other executable program components such as the operating system are illustrated herein as discrete blocks, although it is recognized that such programs and components reside at various times in different storage components of the computing device 802,. [0828]
  -.”[0829]
  - . [0830]
  - . [0831]
  -. [0832]
  - Conclusion [08. [0834]
  Claims (43)
  - 1. A method comprising:receiving a description of a system being designed;receiving a description of an environment; andusing both of the received descriptions to validate the system against the environment while the system is being designed and prior to attempting to deploy the system.
  - 2. A method as recited in
  claim 1, the description of the system comprising an SDM document.
  - 3. A method as recited in
  claim 1, the description of the environment comprising a LIM document.
  - 4. A method as recited in
  claim 1, the system comprising a software application, and the environment comprising a data center.
  - 5. A method as recited in
  claim 1, the environment comprising an environment where the system is expected to be deployed.
  - 6. One or more computer readable media having stored thereon a plurality of instructions that, when executed by one or more processors, causes the one or more processors to:access a system description that describes a system in the process of being designed by a program running on the one or more processors; andvalidate the system, using the system description, against a simulated environment.
  - 7. One or more computer readable media as recited in
  claim 6, the plurality of instructions further causing the processor to:receive, from a requester, a request to validate the system; andreturn, to the requestor, a result of the validation.
  - 8. One or more computer readable media as recited in
  claim 6, wherein the instructions that cause the one or more processors to validate the system against the simulated environment further cause the one or more processors to:select a top-level definition from the system description;generate an appropriate instance, as described by the top-level definition, for an instance space;select an additional definition nested within the top-level definition;generate an appropriate instance, as described by the additional definition, for the instance space based on whether the selected definition defines an object or a relationship; andcontinue the selection of an additional definition and the generation of an appropriate instance, as described by the additional definition, until instances for all of the definitions nested within the top-level definition have been generated for the instance space.
  - 9. One or more computer readable media as recited in
  claim 6, wherein the instructions that cause the one or more processors to validate the system against the simulated environment further cause the one or more processors to:identify one or more flows in an instance space, the instance space describing the system;for each of at least one of the one or more flows:identify one or more input values for the flow, the input values being obtained from other instances of the instance space; andgenerate, based at least in part on the input values, an output value for the flow.
  - 10. One or more computer readable media as recited in
  claim 6, wherei