软件体系结构之质量属性.ppt

Ch 5DesigningtheArchitecture Instructor TanLiwei 软件设计与体系结构 reference Softwarearchitectureinpractice ch1 ch5 ch7 contents DesigningArchitecture AchievingQualities ArchitectureBusinessCycle ABC Creatingthearchitecture Howdoesthearchitectcreateanarchitecture Multiplechoice Byre usingapproachesfromotherarchitectures通过重用来自于其他体系结构的方法Byinventingnewapproachesoutofthinair无中生有地发明新方法Bymagic耍魔术 变一个 Creatingthearchitecture Architectsprimarilyworkbyusingpreviously triedsolutionsLargescale PatternsandstylesSmallscale TacticsStyles patterns andtacticsrepresentconceptualtoolsinthearchitect s toolbag Professionalarchitectsalwayskeeptheirtoolbaguptodate 风格 模式和策略是体系架构师的工具箱中的概念工具 专业的体系架构师会不断更新自己的工具箱 Patternsandstyles Themoderntermis patterns butearlypapersonsoftwarearchitecturewroteabout softwarearchitecturestyles Stylesinarchitecturewereanalogoustostylesinhouses Victorian multi story lotsoffrilly 镶褶边的 wooddecorations tallwindows basicallysquarefootprint Colonial brickfront pillarsorcolumns usuallysymmetricalfront Ranch single story sprawling notverydecorated 大农场 Patternsandstyles IndependentcomponentpatternsCommunication processesEventsystemsImplicitinvocationExplicitinvocationDataflowpatternsBatchsequentialPipe and filterLayersData centeredpatternsBlackboardrepository VirtualmachinepatternsInterpretersRule basedsystemsCall returnpatternsMainprogramandsubroutineObjectoriented Styles Patterns Then thedesignpatternscommunityarrived Architecturalstyleswereclearlyjustpatterns whosescopeofdesignwasthewholesystem thatis whosescopewasthearchitecture Now architecturalpatternsistheterminuse Therearebooksofarchitecturalpatterns e g Buschmann F R Meunier H Rohnert P Sommerlad andM Stal 1996 Pattern OrientedSoftwareArchitecture Volume1 ASystemofPatterns Wiley 现在到了设计模式时代 体系结构风格显然就是模式 其设计范围是整个系统 现在使用的术语是体系结构模式 关于体系结构模式的经典图书 Architecturalpatterns Thesearebroadly scopedsolutionstopreviouslyencounteredproblems Anarchitecturalpatternisfoundrepeatedlyinpracticeisapackageofdesigndecisionshasknownpropertiesthatpermitreusedescribesaclassofarchitectures 模式会在实际应用中被不断地重复 它是一个设计决策包 具有众所周知的可重用的属性 模式描述了一类体系结构 Architecturalpatterns Apatternisdeterminedanddescribedbyasetofelementtypesforexample datarepositories processes andobjectsasetofinteractionmechanismsorconnectorsforexample subroutinecalls events andpipesatopologicallayoutofthecomponentsasetofsemanticconstraintscoveringtopology elementbehavior andinteractionmechanismsInaddition apatternisdescribedbywhenandwhytouseit 模式的描述 组成元素的类型 交互机制或连接器 组件的拓扑规划 语义约束以及何时为什么使用该模式 Architecturalpatterns Thesearewidelyknownandincludemanyfamiliardesignapproaches LayeredPipe andfilterClient serverThinclientThickclientAsynchronousSynchronousN tierclient serverEtc Peer topeerAgent basedsystemsService orientedarchitecturesEtc Observe No universal listPatternscanbecombined e g layeredclient serverPatternscanbespecializedChoiceofpatternstouseisnotrandom 注意 不可能列出所有的模式 多个模式可以组合 模式可能是专门化的 模式的选择不是随机的 Tactics Anarchitecturaltacticisafine graineddesignapproachusedtoachieveaqualityattributeresponse Tacticsarethe buildingblocks ofdesignfromwhicharchitecturalpatternsarecreated 体系结构策略是一种可获得质量属性响应的细腻的设计方法 策略可看作用来搭建体系结构模式的积木块 Tactics Whatisitthatimpartsportabilitytoonedesign highperformancetoanother andintegrabilitytoathird Theachievementofthesequalitiesreliesonfundamentaldesigndecisions Atacticisadesigndecisionthatinfluencesthecontrolofaqualityattributeresponse Wecallacollectionoftacticsanarchitecturalstrategy 是什么向外界传达一个设计的灵便性 高性能和可集成性 依赖于基本的设计决策 策略是指影响质量属性响应控制的设计决策 策略的集合叫做体系结构战略 AvailabilityTactics可用性策略 keepfaultsfrombecomingfailuresoratleastboundtheeffectsofthefaultandmakerepairpossible 使缺陷不要成为失败 或者至少限制缺陷的影响并使修复成为可能 AvailabilityTactics faultdetection 故障检测Ping echo Heartbeat Exceptionsfaultrecovery故障恢复Faultrecoveryconsistsofpreparingforrecoveryandmakingthesystemrepair Voting Activeredundancy Passiveredundancy Spare Shadowoperation Stateresynchronization Checkpoint rollbackfaultprevention故障预防Removalfromservice Transactions Processmonitor Faultdetection Ping echoOnecomponentissuesapingandexpectstoreceivebackanecho withinapredefinedtime fromthecomponentunderscrutiny usedwithinagroupofcomponentsmutuallyresponsibleforonetask usedbyclientstoensurethataserverobjectandthecommunicationpathtotheserverareoperatingwithintheexpectedperformancebounds Ping echo faultdetectorscanbeorganizedinahierarchy inwhichalowest leveldetectorpingsthesoftwareprocesseswithwhichitsharesaprocessor andthehigher levelfaultdetectorspinglower levelones Thisuseslesscommunicationsbandwidththanaremotefaultdetectorthatpingsallprocesses 一个组件发出ping信号 期待在预计的时间内从要监视的组件收到响应 它用于一组共同负责一个任务的组件 可以被客户端用来测试服务器及通信信道能在预计的性能约束内操作 Faultdetection Heartbeat deadmantimer Inthiscaseonecomponentemitsaheartbeatmessageperiodicallyandanothercomponentlistensforit Iftheheartbeatfails theoriginatingcomponentisassumedtohavefailedandafaultcorrectioncomponentisnotified Theheartbeatcanalsocarrydata Forexample anautomatedtellermachinecanperiodicallysendthelogofthelasttransactiontoaserver Thismessagenotonlyactsasaheartbeatbutalsocarriesdatatobeprocessed 一个组件周期性地发出心跳 heartbeat 消息 其它组件监听之 如果没听到心跳 说明前者已经失效 通知纠错组件 心跳也可携带数据 例如自动出纳机周期性地向服务器发送最新交易日志 Faultdetection Exceptions 例外Onemethodforrecognizingfaultsistoencounteranexception whichisraisedwhenoneofthefaultclassesisrecognized Theexceptionhandlertypicallyexecutesinthesameprocessthatintroducedtheexception 发现错误的另一种方法是使用例外 它在错误发生时抛出 例外处理器通常位于抛出例外的进程中 Faultrecovery VotingProcessesrunningonredundantprocessorseachtakeequivalentinputandcomputeasimpleoutputvaluethatissenttoavoter Ifthevoterdetectsdeviantbehaviorfromasingleprocessor itfailsit Thismethodisusedtocorrectfaultyoperationofalgorithmsorfailureofaprocessorandisoftenusedincontrolsystems Ifalloftheprocessorsutilizethesamealgorithms theredundancydetectsonlyaprocessorfaultandnotanalgorithmfault 在冗余的处理器上运行的进程获得相同的输入并计算出一个输出值 将之送到投票器 若投票器从一个处理器检测到异常行为 放弃之 此方法被用于纠正有缺陷的算法运算或处理器的失效 常用于控制系统中 若所有的处理器使用同样的算法 则该冗余只能检测处理器失效 不能检测算法失效 Faultrecovery Activeredundancy hotrestart 主动冗余Allredundantcomponentsrespondtoeventsinparallel Consequently theyareallinthesamestate Whenafaultoccurs thedowntimeofsystemsusingthistacticisusuallymillisecondssincethebackupiscurrentandtheonlytimetorecoveristheswitchingtime Synchronizationisperformedbyensuringthatallmessagestoanyredundantcomponentaresenttoallredundantcomponents 所有的冗余组件同时响应事件 结果 他们处于同样的状态 错误发生的停机时间通常是微秒级 需要进行同步 做法是把送往任一个组件的消息同时送其他冗余组件 Faultrecovery Passiveredundancy warmrestart dualredundancy tripleredundancy 被动冗余Onecomponent theprimary respondstoeventsandinformstheothercomponents thestandbys ofstateupdatestheymustmake Whenafaultoccurs thesystemmustfirstensurethatthebackupstateissufficientlyfreshbeforeresumingservices Synchronizationistheresponsibilityoftheprimarycomponent whichmayuseatomicbroadcaststothesecondarytoguaranteesynchronizationThedowntimecanusuallybelimitedtoseconds 一个组件 主组件 对事件响应 同时通知其他组件 备份 更新状态 当错误发生 恢复服务前系统必须保证备份状态足够新 同步是主组件的职责 它使用自动广播来保证同步 停机时间通常是秒级 Faultrecovery Spare 备用的Astandbysparecomputingplatformisconfiguredtoreplacemanydifferentfailedcomponents Itmustberebootedtotheappropriatesoftwareconfigurationandhaveitsstateinitializedwhenafailureoccurs Makingacheckpointofthesystemstatetoapersistentdeviceperiodicallyandloggingallstatechangestoapersistentdeviceallowsforthesparetobesettotheappropriatestate Thedowntimeforthistacticisusuallyminutes 使用一备用的计算平台来替换许多不同的失败组件 当失败发生时 必须重启到适当的软件配置下 并初始化状态 做法是周期性地向持久化设备保存系统状态的检查点 并把所有的状态变化记录到持久化设备下 以便备用设备恢复 停工期通常以分钟计 Faultrecovery Shadowoperation 镜像操作Apreviouslyfailedcomponentmayberunin shadowmode forashorttimetomakesurethatitmimicsthebehavioroftheworkingcomponentsbeforerestoringittoservice 失败的组件可以运行于镜像模式一段时间以保证它在恢复服务前仿真正常组件的行为 Faultrecovery Stateresynchronization 状态再同步Thepassiveandactiveredundancytacticsrequirethecomponentbeingrestoredtohaveitsstateupgradedbeforeitsreturntoservice Theupdatingapproachwilldependonthedowntimethatcanbesustained thesizeoftheupdate andthenumberofmessagesrequiredfortheupdate Asinglemessagecontainingthestateispreferable ifpossible Incrementalstateupgrades withperiodsofservicebetweenincrements leadtocomplicatedsoftware 被动与主动冗余策略要求被恢复的组件在回到服务前使其状态升级 升级步骤依赖于可忍受的停工期 更新的大小和更新要求的消息数量 如果可能的话 包含状态的简单消息是首选的 Faultrecovery Checkpoint rollback 检查点 回滚Acheckpointisarecordingofaconsistentstatecreatedeitherperiodicallyorinresponsetospecificevents Sometimesasystemfailsinanunusualmanner withadetectablyinconsistentstate Inthiscase thesystemshouldberestoredusingapreviouscheckpointofaconsistentstateandalogofthetransactionsthatoccurredsincethesnapshotwastaken 检查点是周期性或在发生特定事件时创建的一致性状态的记录 有时系统以不寻常的方式失败于可检测的不一致状态 此时 系统应该用以前的一个一致状态的检查点和检查点之后发生的事务记录来恢复 Faultprevention Removalfromservice 移除服务Thistacticremovesacomponentofthesystemfromoperationtoundergosomeactivitiestopreventanticipatedfailures Transactions 事务Atransactionisthebundlingofseveralsequentialstepssuchthattheentirebundlecanbeundoneatonce Processmonitor 进程监视器Onceafaultinaprocesshasbeendetected amonitoringprocesscandeletethenonperformingprocessandcreateanewinstanceofit initializedtosomeappropriatestateasinthesparetactic Summaryofavailabilitytactics ModifiabilityTactics Tacticstocontrolmodifiabilityhaveastheirgoalcontrollingthetimeandcosttoimplement test anddeploychanges 控制可修改性的策略致力于控制软件实现 测试 和配置改变的时间和成本 可根据目标把修改策略分组 1 localizemodifications 减少直接被修改影响的模块数量 2 Preventtherippleeffect 把修改限制到局部模块 3 Deferbindingtime 控制部署时间和成本 LocalizeModifications局部修改 受影响的模块数与修改的成本没有精确的关系 但把修改限制到少量的模块通常可以减少成本 这里给出5种限制范围的策略 Maintainsemanticcoherence 保持语义一致性Semanticcoherencereferstotherelationshipsamongresponsibilitiesinamodule Thegoalistoensurethatalloftheseresponsibilitiesworktogetherwithoutexcessiverelianceonothermodules 语义一致性指一个模块中各职责间的关系 目的是保证模块内各职责一起工作而没有对其它模块的额外依赖 LocalizeModifications局部修改 Anticipateexpectedchanges预见期望的修改Consideringthesetofenvisionedchangesprovidesawaytoevaluateaparticularassignmentofresponsibilities Thetacticofanticipatingexpectedchangesdoesnotconcernitselfwiththecoherenceofamodule sresponsibilitiesbutratherwithminimizingtheeffectsofthechanges Inrealitythistacticisdifficulttousebyitselfsinceitisnotpossibletoanticipateallchanges Forthatreason itisusuallyusedinconjunctionwithsemanticcoherence 预先考虑将来的修改提供了一种评估职责分派的方法 这种方法并不关心模块职责的一致性本身 而是要把修改带来的影响降到最低 现实中这种策略很难单独使用 因为预期所有的修改是不可能的 因此 常常与语义一致性联合使用 LocalizeModifications局部修改 Generalizethemodule 使模块一般化Makingamodulemoregeneralallowsittocomputeabroaderrangeoffunctionsbasedoninput Theinputcanbethoughtofasdefiningalanguageforthemodule Themoregeneralamodule themorelikelythatrequestedchangescanbemadebyadjustingtheinputlanguageratherthanbymodifyingthemodule 使模块更一般化允许计算更多的基于输入的功能 该输入可看着为模块定义了一种语言 模块越一般化 要求的修改就越能通过调整输入语言来实现 而不用修改模块 LocalizeModifications局部修改 Limitpossibleoptions 限制可能的选项Modifications especiallywithinaproductline maybefarrangingandhenceaffectmanymodules Restrictingthepossibleoptionswillreducetheeffectofthesemodifications 修改 特别是生产线上的修改 范围非常广泛 因此会影响许多模块 限制可能的选项可以减少修改带来的影响 PreventRippleEffects防止涟漪效应 Arippleeffectfromamodificationisthenecessityofmakingchangestomodulesnotdirectlyaffectedbyit 修改的涟漪效应指当修改一个模块时 必须修改另一个受到间接影响的模块的必要性 IfmoduleAischangedtoaccomplishaparticularmodification thenmoduleBischangedonlybecauseofthechangetomoduleA Bhastobemodifiedbecauseitdepends insomesense onA 比如 由于模块B因为某种原因依赖于模块A 当模块A被修改时 那么都有哪些依赖呢 PreventRippleEffects typesofdependencies Syntaxof语法data ForBtocompile orexecute correctly thetype orformat ofthedatathatisproducedbyAandconsumedbyBmustbeconsistentwiththetype orformat ofdataassumedbyB B要使用A产生的数据 要求A提供的数据与B所要求的在类型 或格式 上一致Service ForBtocompileandexecutecorrectly thesignatureofservicesprovidedbyAandinvokedbyBmustbeconsistentwiththeassumptionsofB B使用A提供的服务 服务的签名必须一致 PreventRippleEffects typesofdependencies Semanticsof语义data ForBtoexecutecorrectly thesemanticsofthedataproducedbyAandconsumedbyBmustbeconsistentwiththeassumptionsofB 生产者提供的数据的语义必须与消费者所需要的一致 service ForBtoexecutecorrectly thesemanticsoftheservicesproducedbyAandusedbyBmustbeconsistentwiththeassumptionsofB 服务的语义也要一致 PreventRippleEffects typesofdependencies Sequenceof顺序data ForBtoexecutecorrectly itmustreceivethedataproducedbyAinafixedsequence Forexample adatapacket sheadermustprecedeitsbodyinorderofreception asopposedtoprotocolsthathavethesequencenumberbuiltintothedata B的正确执行依赖于从A收到的数据的顺序control ForBtoexecutecorrectly Amusthaveexecutedpreviouslywithincertaintimingconstraints Forexample Amusthaveexecutednolongerthan5msbeforeBexecutes B的正确执行依赖于A在之前的某个时间约束下执行完 PreventRippleEffects typesofdependencies IdentityofaninterfaceofA 接口的标识Amayhavemultipleinterfaces ForBtocompileandexecutecorrectly theidentity nameorhandle oftheinterfacemustbeconsistentwiththeassumptionsofB A可能有多个接口 B的正确执行要求接口的标识 名称或操作 与B所假定的一致LocationofA runtime 运行时的位置ForBtoexecutecorrectly theruntimelocationofAmustbeconsistentwiththeassumptionsofB Forexample BmayassumethatAislocatedinadifferentprocessonthesameprocessor B的正确执行要求A运行的位置与B的假定一致 如B可能要求B处于同一处理器的不同进程中 PreventRippleEffects typesofdependencies Qualityofservice dataprovidedbyA 质量ForBtoexecutecorrectly somepropertyinvolvingthequalityofthedataorserviceprovidedbyAmustbeconsistentwithB sassumptions B的正确执行依赖于A提供的数据或服务的质量Forexample dataprovidedbyaparticularsensormusthaveacertainaccuracyinorderforthealgorithmsofBtoworkcorrectly 比如要求传感器提供的数据达到一定的精度 PreventRippleEffects typesofdependencies ExistenceofA B的正确执行要求A必须存在ForBtoexecutecorrectly Amustexist Forexample ifBisrequestingaservicefromanobjectA andAdoesnotexistandcannotbedynamicallycreated thenBwillnotexecutecorrectly ResourcebehaviorofA ForBtoexecutecorrectly theresourcebehaviorofAmustbeconsistentwithB sassumptions ThiscanbeeitherresourceusageofA AusesthesamememoryasB orresourceownership BreservesaresourcethatAbelievesitowns B对A的资源行为有要求 比如要求A使用某资源或拥有某资源 PreventRippleEffects tactics Noticethatnoneofourtacticsnecessarilypreventtherippleofsemanticchanges Hideinformation 隐藏信息Informationhidingisthedecompositionoftheresponsibilitiesforanentity asystemorsomedecompositionofasystem intosmallerpiecesandchoosingwhichinformationtomakeprivateandwhichtomakepublic 把实体的职责分解为若干较小的部分 并选择哪些应该是private 哪些public 即把易变的部分分拆出去 PreventRippleEffects tactics Maintainexistinginterfaces 保持现有接口IfBdependsonthenameandsignatureofaninterfaceofA maintainingthisinterfaceanditssyntaxallowsBtoremainunchanged 若B依赖于A的接口名称和基调 保持接口及其语义允许B保持不变 PatternsthatimplementthistacticincludeAddinginterfaceAddingadapterProvidingastubA PreventRippleEffects tactics Restrictcommunicationpaths 限制通信路径Restrictthemoduleswithwhichagivenmodulesharesdata Thatis reducethenumberofmodulesthatconsumedataproducedbythegivenmoduleandthenumberofmodulesthatproducedataconsumedbyit 限制共享数据的模块 即限制为同一模块提供数据的生产者的数量 或限制消费者的数量 Thiswillreducetherippleeffectsincedataproduction consumptionintroducesdependenciesthatcauseripples PreventRippleEffects tactics Useanintermediary 使用中间物IfBhasanytypeofdependencyonAotherthansemantic itispossibletoinsertanintermediarybetweenBandAthatmanagesactivitiesassociatedwiththedependency Theintermediaryare data syntax Repositories bothblackboardandpassive actasintermediariesbetweentheproducerandconsumerofdata service syntax Thefacade bridge mediator strategy proxy andfactorypatternsallprovideintermediariesthatconvertthesyntaxofaservicefromoneformintoanother 若B对A有任何非语义的依赖 在B和A之间插入一个中间物来管理与依赖相关的活动是可能的 中间物可以是 数据 语法 仓储是数据的生产者和消费者之间的中间物 服务 把服务从一种形式转换为另一种形式的语法 PreventRippleEffects tactics identityofaninterfaceofA Abrokerpatterncanbeusedtomaskchangesintheidentityofaninterface IfBdependsontheidentityofaninterfaceofAandthatidentitychanges byaddingthatidentitytothebrokerandhavingthebrokermaketheconnectiontothenewidentityofA Bcanremainunchanged locationofA runtime AnameserverenablesthelocationofAtobechangedwithoutaffectingB Aisresponsibleforregisteringitscurrentlocationwiththenameserver andBretrievesthatlocationfromthenameserver 中间物可以是 A的接口身份 使用broker 中间人 来屏蔽接口的改变A的位置 运行时 使用一个名字服务器使得A的位置的改变不会影响到B PreventRippleEffects tactics resourcebehaviorofAorresourcecontrolledbyA Aresourcemanagerisanintermediarythatisresponsibleforresourceallocation Certainresourcemanagers e g thosebasedonRateMonotonicAnalysisinreal timesystems canguaranteethesatisfactionofallrequestswithincertainconstraints A ofcourse mustgiveupcontroloftheresourcetotheresourcemanager existenceofA Thefactorypatternhastheabilitytocreateinstancesasneeded andthusthedependenceofBontheexistenceofAissatisfiedbyactionsofthefactory 中间物可以是 A的资源行为 使用资源管理器来负责资源分配 A的存在 工厂模式有在需要时创建实例的能力 故B在A的存在上的依赖可通过工厂的动作来解决 DeferBindingTime延迟绑定时间 Thetwotacticcategorieswehavediscussedaredesignedtominimizethenumberofmodulesthatrequirechangingtoimplementmodification Ourmodificationscenariosincludetwoelementsthatarenotsatisfiedbyreducingthenumberofmodulestobechanged timetodeployandallowingnondeveloperstomakechanges Deferringbindingtimesupportsbothofthosescenariosatthecostofrequiringadditionalinfrastructuretosupportthelatebinding 前边讨论的两类策略用来最小化在实现修改时要求改变的模块数量 我们的修改场景中包括不通过减少改变的模块数量来满足的两个元素 配置时间和允许非开发人员进行改变 延迟绑定时间支持这两个元素 但需要额外的基础构造来支持延迟绑定 DeferBindingTime延迟绑定时间 Manytacticsareintendedtohaveimpactatloadtimeorruntime suchasthefollowingRuntimeregistrationsupportsplug and playoperationatthecostofadditionaloverheadtomanagetheregistration Publish subscriberegistration forexample canbeimplementedateitherruntimeorloadtime Configurationfilesareintendedtosetparametersatstartup Polymorphismallowslatebindingofmethodcalls Componentreplacementallowsloadtimebinding Adherencetodefinedprotocolsallowsruntimebindingofindependentprocesses 许多策略试图影响装载时间或运行时间 例如 运行时注册配置文件试图在启动时设置参数 多态性允许推迟方法调用的绑定 组件替换允许装载时绑定 Summaryofmodifiabilitytactics PerformanceTactics performancetacticsistogeneratearesponsetoaneventarrivingatthesystemwithinsometimeconstraint 性能上的策略就是在某个时间约束内对到达系统的事件产生响应 PerformanceTactics TwobasiccontributorstotheresponsetimeResourceconsumption ResourcesincludeCPU datastores networkcommunicationbandwidth andmemory butitcanalsoincludeentitiesdefinedbytheparticularsystemunderdesign Blockedtime AcomputationcanbeblockedfromusingaresourcebecauseofContentionforresourcesAvailabilityofresourcesDependencyonothercomputation 对响应时间有两个基本的贡献者 资源消费 资源包括CPU 数据存储 网络通信带宽和内存 也可包括由特定的系统定义的实体 阻塞时间 一个计算可能被阻塞到要使用的资源上 因为争夺资源 资源的可用