Full download text book at textbookfull.

com

Software Engineering for Resilient

Systems 6th International Workshop
SERENE 2014 Budapest Hungary October 15
16 2014 Proceedings 1st Edition István
MajzikHERE
DOWLOAD

https://textbookfull.com/product/software-
engineering-for-resilient-systems-6th-
international-workshop-serene-2014-budapest-
hungary-october-15-16-2014-proceedings-1st-
edition-istvan-majzik/

DOWLOAD NOW

Download more textbook from textbookfull.com

More products digital (pdf, epub, mobi) instant
download maybe you interests ...

Software Engineering for Resilient Systems 11th

International Workshop SERENE 2019 Naples Italy
September 17 2019 Proceedings Radu Calinescu

https://textbookfull.com/product/software-engineering-for-
resilient-systems-11th-international-workshop-serene-2019-naples-
italy-september-17-2019-proceedings-radu-calinescu/

Software Engineering for Resilient Systems 8th

International Workshop SERENE 2016 Gothenburg Sweden
September 5 6 2016 Proceedings 1st Edition Ivica
Crnkovic
https://textbookfull.com/product/software-engineering-for-
resilient-systems-8th-international-workshop-
serene-2016-gothenburg-sweden-september-5-6-2016-proceedings-1st-
edition-ivica-crnkovic/

Engineering Secure Software and Systems 6th

International Symposium ESSoS 2014 Munich Germany
February 26 28 2014 Proceedings 1st Edition Jan Jürjens

https://textbookfull.com/product/engineering-secure-software-and-
systems-6th-international-symposium-essos-2014-munich-germany-
february-26-28-2014-proceedings-1st-edition-jan-jurjens/

Post Quantum Cryptography 6th International Workshop

PQCrypto 2014 Waterloo ON Canada October 1 3 2014
Proceedings 1st Edition Michele Mosca (Eds.)

https://textbookfull.com/product/post-quantum-cryptography-6th-
international-workshop-pqcrypto-2014-waterloo-on-canada-
october-1-3-2014-proceedings-1st-edition-michele-mosca-eds/
Advanced Information Systems Engineering Workshops
CAiSE 2014 International Workshops Thessaloniki Greece
June 16 20 2014 Proceedings 1st Edition Lazaros Iliadis

https://textbookfull.com/product/advanced-information-systems-
engineering-workshops-caise-2014-international-workshops-
thessaloniki-greece-june-16-20-2014-proceedings-1st-edition-
lazaros-iliadis/

Search Based Software Engineering 6th International

Symposium SSBSE 2014 Fortaleza Brazil August 26 29 2014
Proceedings 1st Edition Claire Le Goues

https://textbookfull.com/product/search-based-software-
engineering-6th-international-symposium-ssbse-2014-fortaleza-
brazil-august-26-29-2014-proceedings-1st-edition-claire-le-goues/

Analytical and Stochastic Modeling Techniques and

Applications 21st International Conference ASMTA 2014
Budapest Hungary June 30 July 2 2014 Proceedings 1st
Edition Bruno Sericola
https://textbookfull.com/product/analytical-and-stochastic-
modeling-techniques-and-applications-21st-international-
conference-asmta-2014-budapest-hungary-
june-30-july-2-2014-proceedings-1st-edition-bruno-sericola/

Combinatorial Algorithms 25th International Workshop

IWOCA 2014 Duluth MN USA October 15 17 2014 Revised
Selected Papers 1st Edition Kratochvíl Jan

https://textbookfull.com/product/combinatorial-algorithms-25th-
international-workshop-iwoca-2014-duluth-mn-usa-
october-15-17-2014-revised-selected-papers-1st-edition-
kratochvil-jan/

Information Systems for Crisis Response and Management

in Mediterranean Countries First International
Conference ISCRAM med 2014 Toulouse France October 15
17 2014 Proceedings 1st Edition Chihab Hanachi
https://textbookfull.com/product/information-systems-for-crisis-
response-and-management-in-mediterranean-countries-first-
international-conference-iscram-med-2014-toulouse-france-
 István Majzik
Marco Vieira (Eds.)
LNCS 8785

Software Engineering
for Resilient Systems
6th International Workshop, SERENE 2014
Budapest, Hungary, October 15–16, 2014
Proceedings

123
Lecture Notes in Computer Science 8785
Commenced Publication in 1973
Founding and Former Series Editors:
Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen

Editorial Board
David Hutchison
Lancaster University, UK
Takeo Kanade
Carnegie Mellon University, Pittsburgh, PA, USA
Josef Kittler
University of Surrey, Guildford, UK
Jon M. Kleinberg
Cornell University, Ithaca, NY, USA
Alfred Kobsa
University of California, Irvine, CA, USA
Friedemann Mattern
ETH Zurich, Switzerland
John C. Mitchell
Stanford University, CA, USA
Moni Naor
Weizmann Institute of Science, Rehovot, Israel
Oscar Nierstrasz
University of Bern, Switzerland
C. Pandu Rangan
Indian Institute of Technology, Madras, India
Bernhard Steffen
TU Dortmund University, Germany
Demetri Terzopoulos
University of California, Los Angeles, CA, USA
Doug Tygar
University of California, Berkeley, CA, USA
Gerhard Weikum
Max Planck Institute for Informatics, Saarbruecken, Germany
István Majzik Marco Vieira (Eds.)

Software Engineering
for Resilient Systems
6th International Workshop, SERENE 2014
Budapest, Hungary, October 15-16, 2014
Proceedings

13
Volume Editors
István Majzik
Budapest University of Technology and Economics
Magyar tudósok krt.2
1117 Budapest, Hungary
E-mail: [email protected]
Marco Vieira
University of Coimbra
CISUC, Department of Informatics Engineering
Pólo II, Pinhal de Marrocos
3030-290 Coimbra, Portugal
E-mail: [email protected]

ISSN 0302-9743 e-ISSN 1611-3349

ISBN 978-3-319-12240-3 e-ISBN 978-3-319-12241-0
DOI 10.1007/978-3-319-12241-0
Springer Cham Heidelberg New York Dordrecht London

Library of Congress Control Number: 2014950396

LNCS Sublibrary: SL 2 – Programming and Software Engineering

© Springer International Publishing Switzerland 2014

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of
the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation,
broadcasting, reproduction on microfilms or in any other physical way, and transmission or information
storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology
now known or hereafter developed. Exempted from this legal reservation are brief excerpts in connection
with reviews or scholarly analysis or material supplied specifically for the purpose of being entered and
executed on a computer system, for exclusive use by the purchaser of the work. Duplication of this publication
or parts thereof is permitted only under the provisions of the Copyright Law of the Publisher’s location,
in ist current version, and permission for use must always be obtained from Springer. Permissions for use
may be obtained through RightsLink at the Copyright Clearance Center. Violations are liable to prosecution
under the respective Copyright Law.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication
does not imply, even in the absence of a specific statement, that such names are exempt from the relevant
protective laws and regulations and therefore free for general use.
While the advice and information in this book are believed to be true and accurate at the date of publication,
neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or
omissions that may be made. The publisher makes no warranty, express or implied, with respect to the
material contained herein.
Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India
Printed on acid-free paper
Springer is part of Springer Science+Business Media (www.springer.com)
 Preface

Welcome to the proceedings of the 6th Workshop on Software Engineering for

Resilient Systems (SERENE 2014). The workshop took place in Budapest (Hun-
gary) during October 15-16, 2014.
The SERENE workshop series is supported by the ERCIM (European Re-
search Consortium in Informatics and Mathematics) Working Group on Soft-
ware Engineering for Resilient Systems. The previous workshops were held in
Newcastle upon Tyne (2008), London (2010), Geneva (2011), Pisa (2012), and
Kiev (2013). The aim of the workshop series is to bring together researchers and
practitioners working on developing and applying advanced software engineering
techniques to ensure resilience – an ability of a system to persistently deliver its
services in a dependable way even when facing changes, unforeseen failures, and
intrusions. Ensuring software resilience is motivated by the increasingly perva-
sive use of software in evolvable and critical systems like transportation, health
care, manufacturing, and IT infrastructure management.
The SERENE 2014 workshop provided a forum to disseminate research re-
sults and exchange ideas on advances in all areas of software engineering for
resilient systems, including, but not limited to:

Design of resilient systems

– Requirements engineering and re-engineering for resilience

– Frameworks, patterns and software architectures for resilience
– Engineering of self-healing autonomic systems
– Design of trustworthy and intrusion-safe systems
– Resilience at run-time (mechanisms, reasoning and adaptation)

Verification, validation and evaluation of resilience

– Modelling and model-based analysis of resilience properties

– Formal and semi-formal techniques for verification and validation
– Experimental evaluations of resilient systems
– Quantitative approaches to ensuring resilience
– Resilience prediction

Case studies and applications

– Empirical studies in the domain of resilient systems

– Cloud computing and resilient service provisioning
– Resilient cyber-physical systems and infrastructures
– Global aspects of resilience engineering: education, training and cooperation
VI Preface

The workshop received 22 submissions including technical papers describ-

ing original theoretical or practical work, experience/industry papers describing
practitioner experience or field studies addressing an application domain, and
project papers describing goals and results of ongoing projects related to the
SERENE topics.
After a rigorous review process by the Program Committee members and
external reviewers, 12 papers were selected for presentation. These included 11
technical papers and one project paper. We were pleased with the quality of
the submissions, and we believe that the accepted papers will foster innovative
practical solutions as well as future research.
In addition to the paper sessions, the workshop program also included a
keynote by a prominent researcher working on resilience engineering, Vincenzo
de Florio from the University of Antwerp. The volume also includes the invited
paper describing the research presented by the keynote speaker.
The workshop program was the result of the hard work of many individuals.
First of all, we want to thank all authors who submitted their research work.
We are grateful to the Program Committee members and the external reviewers
for their efforts. We would like to thank the members of the SERENE Steer-
ing Committee and SERENE Working Group for their help in publicizing the
event and contributing to the technical program. Last but not least, we would
like to acknowledge the contribution of the staff at the Budapest University
of Technology and Economics for local arrangements (Web, publicity, finance,
administration, and local organization).

August 2014 István Majzik

Marco Vieira
András Pataricza
 Organization

General Chair
András Pataricza Budapest University of Technology and
Economics, Hungary

Steering Committee
Didier Buchs University of Geneva, Switzerland
Henry Muccini University of L’Aquila, Italy
Patrizio Pelliccione Chalmers University of Technology and
University of Gothenburg, Sweden
Alexander Romanovsky Newcastle University, UK
Elena Troubitsyna Åbo Akademi University, Finland

Program Chairs
István Majzik Budapest University of Technology and
Economics, Hungary
Marco Vieira University of Coimbra, Portugal

Program Committee
Paris Avgeriou University of Groningen, The Netherlands
Didier Buchs University of Geneva, Switzerland
Andrea Ceccarelli University of Florence, Italy
Vincenzo De Florio University of Antwerp, The Netherlands
Nikolaos Georgantas Inria, France
Felicita Di Giandomenico CNR-ISTI, Italy
Giovanna Di Marzo Serugendo University of Geneva, Switzerland
Holger Giese University of Potsdam, Germany
Nicolas Guelfi University of Luxembourg, Luxembourg
Kaustubh Joshi AT&T, USA
Mohamed Kaaniche LAAS-CNRS, France
Vyacheslav Kharchenko National Aerospace University, Ukraine
Zsolt Kocsis IBM, Hungary
Nuno Laranjeiro University of Coimbra, Portugal
Paolo Masci Queen Mary University, UK
Henry Muccini University of L’Aquila, Italy
Sadaf Mustafiz McGill University, Canada
Patrizio Pelliccione Chalmers University of Technology and
University of Gothenburg, Sweden
VIII Organization

Alexander Romanovsky Newcastle University, UK

Juan Carlos Ruiz Technical University of Valencia, Spain
Stefano Russo University of Naples Federico II, Italy
Peter Schneider-Kamp University of Southern Denmark, Denmark
Elena Troubitsyna Åbo Akademi University, Finland
Katinka Wolter Freie University Berlin, Germany
Apostolos Zarras University of Ioannina, Greece

External Reviewers
Rui André Oliveira University of Coimbra, Portugal
Johannes Dyck University of Postdam, Germany
Zoltán Szatmári Budapest University of Technology and
Economics, Hungary
Sebastian Wätzoldt University of Postdam, Germany
Roberto Nardone University of Naples Federico II, Italy
David Lawrence University of Geneva, Switzerland
András Vörös Budapest University of Technology
and Economics, Hungary
Christian Manteuffel University of Groningen, The Netherlands
 Table of Contents

Invited Talk
Community Resilience Engineering: Reflections and Preliminary
Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Vincenzo De Florio, Hong Sun, and Chris Blondia

Design of Resilient Systems

Enhancing Architecture Design Decisions Evolution with Group
Decision Making Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Ivano Malavolta, Henry Muccini, and V. Smrithi Rekha

The Role of Parts in the System Behaviour . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Davide Di Ruscio, Ivano Malavolta, and Patrizio Pelliccione

Automatic Generation of Description Files for Highly Available

Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Maxime Turenne, Ali Kanso, Abdelouahed Gherbi, and
Ronan Barrett

Analysis of Resilience
Modelling Resilience of Data Processing Capabilities of CPS . . . . . . . . . . . 55
Linas Laibinis, Dmitry Klionskiy, Elena Troubitsyna,
Anatoly Dorokhov, Johan Lilius, and Mikhail Kupriyanov

Formal Fault Tolerance Analysis of Algorithms for Redundant Systems

in Early Design Stages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Andrea Höller, Nermin Kajtazovic, Christopher Preschern, and
Christian Kreiner

On Applying FMEA to SOAs: A Proposal and Open Challenges . . . . . . . 86

Cristiana Areias, Nuno Antunes, and João Carlos Cunha

Verification and Validation

Verification and Validation of a Pressure Control Unit for Hydraulic
Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Pontus Boström, Mikko Heikkilä, Mikko Huova,
Marina Waldén, and Matti Linjama
X Table of Contents

Simulation Testing and Model Checking: A Case Study Comparing

these Approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Richard Lipka, Marek Paška, and Tomáš Potužák

Advanced Modelling, Simulation and Verification for Future Traffic

Regulation Optimisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Alexei Iliasov, Roberto Palacin, and Alexander Romanovsky

Monitoring
Using Instrumentation for Quality Assessment of Resilient Software in
Embedded Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
David Lawrence, Didier Buchs, and Armin Wellig

Adaptive Domain-Specific Service Monitoring . . . . . . . . . . . . . . . . . . . . . . . . 154

Arda Ahmet Ünsal, Görkem Sazara, Barış Aktemur, and Hasan Sözer

Combined Error Propagation Analysis and Runtime Event Detection

in Process-Driven Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Gábor Urbanics, László Gönczy, Balázs Urbán, János Hartwig, and
Imre Kocsis

Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

 Community Resilience Engineering:
Reflections and Preliminary Contributions

Vincenzo De Florio1 , Hong Sun2 , and Chris Blondia1

1
MOSAIC/University of Antwerp and MOSAIC/iMinds Research Institute
Middelheimlaan 1, 2020 Antwerp, Belgium
{vincenzo.deflorio,chris.blondia}@uantwerpen.be
2
AGFA Healthcare, 100 Moutstraat, Ghent, Belgium
[email protected]

Abstract. An important challenge for human societies is that of mas-

tering the complexity of Community Resilience, namely “the sustained
ability of a community to utilize available resources to respond to, with-
stand, and recover from adverse situations”. The above concise definition
puts the accent on an important requirement: a community’s ability to
make use in an intelligent way of the available resources, both institu-
tional and spontaneous, in order to match the complex evolution of the
“significant multi-hazard threats characterizing a crisis”. Failing to ad-
dress such requirement exposes a community to extensive failures that
are known to exacerbate the consequences of natural and human-induced
crises. As a consequence, we experience today an urgent need to respond
to the challenges of community resilience engineering. This problem,
some reflections, and preliminary prototypical contributions constitute
the topics of the present article.

1 Introduction
A well-known article by Garrett Hardin states how no exclusively technologi-
cal solution exists to several significant societal problems [1]. The problem of
the optimal response to a crisis both natural and human-induced is likely to be
one such problem. Direct experience accrued during, e.g., the Katrina hurricane
crisis, showed that effective solutions to disastrous events and highly turbulent
conditions call for the involvement of society as a complex and very dense “col-
lective agent” [2]. The emerging attribute advocated by the Authors of the cited
paper is so-called Community Resilience (CR). While the need for CR has been
identified and justified, to the best of our knowledge no organizational solution
has been so far proposed such that the “grand potential” of CR—including, e.g.,
collective intelligence, advance autonomic behaviors, and the ability to tap into
the “wells” of social energy—may be harnessed into methods; architectures; and
solutions, to be deployed in preparation, during, and following critical events.
Our paper is structured as follows: first, in Sect. 2 we introduce CR. In Sect. 3
we enumerate those that we consider as the major requirements of any effective
community-resilient approach. After this we describe in Sect. 4 an organiza-
tion matching the above attributes—the fractal social organizations—and its

I. Majzik and M. Vieira (Eds.): SERENE 2014, LNCS 8785, pp. 1–8, 2014.
c Springer International Publishing Switzerland 2014
2 V. De Florio, H. Sun, and C. Blondia

building block, the service-oriented community. Section 5 briefly introduces a

few elements of a fractally-organized middleware component currently in use
in Flemish project “Little Sister” as well as other ancillary technology that we
deem could provide support towards the design of CR engineering solutions. Our
conclusions are finally stated in Sect. 6.

2 Community Resilience: Definition and Lessons Learned

According to RAND [3], Community Resilience (CR) is defined as

“A measure of the sustained ability of a community to utilize available re-

sources to respond to, withstand, and recover from adverse situations. [. . . ]
Resilient communities withstand and recover from disasters. They also learn
from past disasters to strengthen future recovery efforts.”

A second important asset towards understanding Community Resilience is

paper [2] in which the Authors provide an insightful discussion of several impor-
tant factors that resulted in the resilience behaviors that manifested during the
Hurricane Katrina events. Their definition of resilience is slightly different from
RAND’s: CR is defined as

“A community or region’s capability to prepare for, respond to, and recover

from significant multi-hazard threats with minimum damage to public safety
and health, the economy, and national security.”

A remarkable fact observed by the authors of the cited paper is that the
response to the Katrina disaster was far from ideal:

“Through extensive media coverage, the world saw remarkably inadequate

rescue operations, the failure of complete evacuation, [. . . ] What amazed many
worldwide was that these extensive failures, often attributed to conditions in
developing countries, occurred in the most powerful and wealthiest country in
the world.”

This is particularly surprising in that the severity of the situation was well
known, as it was also well known how the New Orleans area would have had
difficulties in the face of catastrophic events:

“New Orleans was a catastrophe waiting to happen with extensive and repeated
warnings from both scientists and the media that the ‘big one’ would eventually
hit the city.”

The major lesson that we derived from this case is that an event like Katrina
disrupts several concentric “social layers” at the same time, possibly associated
to multiple response organizations, and that one of the major problems following
the event is one of coordination. Multiple concurrent responses are triggered in
each of the social layers, including
 Community Resilience Engineering 3

– the individual, the family, people sharing the same location, citizens, etc.;
– pre-existing organizations of the city, the region, the state, the nation;
– pre-existing organizations for civil protection, defense, order, etc.
A major classification of the above responders distinguishes institutional re-
sponders (namely the social layers corresponding to the above pre-existing or-
ganizations) from informal responders (non-institutional responders, originating
in “households, friends and family, neighborhoods, non-governmental and vol-
untary organizations, businesses, and industry” and corresponding to what is
known in the domain of ambient assisted living as “informal care-givers” [4].)
We observe how coordination failures during the Katrina crisis derived from
a number of reasons, the most important of which are—we deem—the following
ones:
– Conflicting goals and conflicting actions among the triggered responders.
Multiple uncoordinated efforts often resulted in wasting resources and in
some cases they masked each other out.
– As a simplistic way to avoid or recover from this kind of failures, institutional
responders tended to refuse or did not blend their action with that of informal
responders.
– Resources owned by institutional responders were not shared promptly and
dynamically according to the experienced needs.
Report [2] provides us with rich and valuable knowledge, which helps under-
stand how relevant the above reasons were in determining the quality of resilience
and the speed of the recovery after Katrina. It also provides us with a major
challenge, which the authors enunciate as follows:
“[Responders] would have been able to do more if the tri-level system (city,
state, federal) of emergency response was able to effectively use, collaborate
with, and coordinate the combined public and private efforts. How to do so, in
advance of hazard events, is a central task of enhancing community resilience.”

This paper focuses on community resilience engineering, which we define here

as the design and the development of an engineering practice towards the defini-
tion of methods, tools, theories, and applications, such that community-resilient
responses to crises may be orchestrated and conducted. This paper in particular
addresses the following questions: Is it possible to find a satisfactory answer to
the above challenge? Which tools, which form of organizations may serve as an
effective foundation on top of which community resilience may be built? In order
to answer the above questions we first introduce those that we deem to be the
major requirements of community-resilient organizations.

3 Community Resilience: Requirements

When considering the Katrina response and its failures, our major lessons learned
are that engineering solutions towards CR should ideally be characterized by the
following requirements:
4 V. De Florio, H. Sun, and C. Blondia

– Scalability: The building blocks of the response organization should be ap-

plicable at all social layers, ranging from micro scale (individual or small
groups) up to macro level (national or world-wide institutions).
– Fractal organization: The building blocks of the response organizations should
be free from the hard restrictions of pure hierarchical organizations. The ac-
tion and role of each social layer should not be restricted by its hierarchical
level into that of a controller or that of a controlled, but rather dynamically
defined.
– Context-orientation: The above mentioned action and role should be defined
through an assessment of the context and situations at hand, possibly in-
volving multiple collaborating entities and layers.
– Self-servicing: Forms of mutualistic collaboration should be identified so that
common requirements may become mutually satisfactory and enable the
exploitation of the self-serve potential of our societies.
– Service-orientation: Services and assets should be easily and quickly localiz-
able, shareable, and accountable.
– Semantically described: Services, requests, and assets across the social lay-
ers should be semantically described in a uniform way allowing for machine
processing (for instance, to construct a global view of the state of the com-
munity, or for matching services among the members).
– Collaborativeness: Collaboration among entities in different social layers
should be easy to settle and result in the spontaneous emergence of new
temporary inter-layered “social responders”. Said social overlay networks
would combine responders of different scale and different originating social
layers and exist until some originating purpose is being reached.
– Modularity: Self-similar collaborative “patterns”, or modules, should be
reusable at different scales. A dynamic ranking mechanism should allow the
performance of modules in a given context to be tracked.

4 Service-Oriented Communities and Fractal Social

Organizations

In previous sections we have discussed the challenges of Community Resilience,

and especially those pertaining to response / recovery / reduction [2]. As men-
tioned already, through the cited report we learned how one of the major prob-
lems following the Katrina disasters was one of coordination. Coordination among
institutional responders was difficult and inefficient, and even more so it was be-
tween institutional and informal responders. We learned how a major challenge of
Community Resilience is that of being able to solve those coordination problems.
A possible way to reformulate that challenge is that of being able to conquer the
complexity and engineer practical methods to dynamically create a coherent and
effective organization-of-organizations (OoO) as a “smart” response to disasters.
The major goal of such an OoO would be that of enabling mutualistic relation-
ships between all the involved social layers and produce mutually satisfactory,
self-serving, controllable “social behaviors” [5] enhancing the efficiency and the
 Community Resilience Engineering 5

speed of intervention. Fractal Social Organizations (FSO) are one such possible
OoO. In a nutshell, they are an organization-of-organizations whose building
blocks are custom socio-technical systems called Service-oriented Communities
(SoC). In what follows we describe in more detail SoC and FSO.

4.1 Service-Oriented Communities

A SoC [6] is a service-oriented architecture that creates a community of peer-level
entities—for instance human beings, cyber-physical things, and organizations
thereof. These entities are called members. No predefined classification exists
among members. No specific role is defined; for instance there are no predefined
clients or servers, service requesters or service providers, care-givers or care-
takers. Depending on the situation at hand a member may be on the receiving
end or at the providing end of a service. Members (may) react to changes. If
something occurs in a SoC, some of its members may become active. Being
active means being willing to play some role. Service availabilities and service
requests, together with events, are semantically annotated and published into a
service registry. The service registry reacts to publications by checking whether
the active members may play roles that enable some action.
This check is done semantically, by discovering whether the published services
are compatible with the sought roles. Costs may be associated with a member
being enrolled. Enrolments may be done in several ways, each aiming at some
preferred goal—for instance speed of response, safety, or cost-effectiveness. Fur-
thermore, the optimization goals may focus on the individual member, or have
a social dimension, or take both aspects into account.
A noteworthy aspect of the SoC and the above assumptions is that they
enable mutualistic relationships. In [7] we suggested that two elderly persons
requiring assistance could find an adequate and satisfactory response by helping
each other—thus without the intervention of carers.
We are currently experimenting with mutualistic relationship with more than
two members and with different roles—for instance mutualistic relationships
between two service providers (say, e.g., an institutional responder and a shadow
responder in the response phases of some crisis). (Obviously this would call for
agreeing on collaboration protocols, establishing common ontologies to reason
on possible triggering events, discussing policies and modes of intervention, and
several other aspects; we consider this to be outside the scope of the present
contribution).
As mentioned before, no predefined role exists in a SoC, though the creation
of a new SoC calls for appointing a member with the special role of service
coordinator. It is such member that hosts the service registry and performs
the semantic processing. The coordinator may be elected and there could be hot
backups also maintaining copies of the service registry. A SoC may be specialized
for different purposes—for instance crisis management or ambient assistance of
the elderly and the impaired. More information on a SoC devoted to the latter
and called “Mutual Assistance Community” may be found, e.g., in [7].
6 V. De Florio, H. Sun, and C. Blondia

A major aspect of the SoC is given by the assumption of a flat society: a cloud
of social resources are organized and orchestrated under the control of a central
“hub”—the service coordinator. Of course this flat organization introduces sev-
eral shortcomings; for instance, if the size of the community becomes “too big”
the coordinator may be slowed down (scalability failure); and in the presence
of a single and non-redundant coordinator a single failure may bring the whole
community to a halt (resilience failure).

4.2 Fractal Social Organizations

The Fractal Social Organization was created to solve the just highlighted short-
comings. Its definition is as follows: “A Fractal Social Organization is a fractal
organization of Service-oriented Communities.” As can be easily understood, a
Service-oriented Community is a trivial case of a Fractal Social Organization
consisting of a single node. In practice, if a SoC is allowed to include other SoC
as their members, we end up with a distributed hierarchy of SoC, one nested into
the other. This is a little like nested directories in a file system or “matryoshka
dolls” (but such that each doll may contain more than a single smaller doll.)
Society provides many examples of such fractal organizations; “the tri-level
system (city, state, federal) of emergency response” mentioned in [2] is one such
case. The added value of the FSO is that it implements a sort of cybernetic
sociocracy. Sociocracy teaches us that it is possible to lay a secondary organiza-
tional structure over an existing one. The idea is that the elements of a layer (in
sociocracy, a “circle”) may decide that a certain matter deserves system-wide
attention; if so, they appoint a member as representative of the whole circle.
Then the appointed member becomes (temporarily) part of an upper circle and
can discuss the matter with the members of that circle (e.g., propose an alterna-
tive way to organize a process or deal with a threat). This allows information to
flow beyond the boundaries of strict hierarchies; real-life experimentation proved
that this enhances considerably an organization’s resilience. Through the socio-
cratic rules, an organization may tap on the “well” of its social energy and create
collective forms of intelligence as those discussed in [8]. FSO propose a similar
concept. Whenever a condition calls for roles, the coordinator looks for roles by
semantically matching the services in its registry. If all roles can be found within
the community, the corresponding activity is launched. When certain roles are
missing, the coordinator raises an exception to the next upper layer—the next
matryoshka doll up above, we could say. The role shortage event is thus prop-
agated to the next level upward in the hierarchy. This goes on until the first
suitable candidate member for playing the required role is found or until some
threshold is met. The resulting responding team is what we called a social over-
lay network: a network of collaborating members that are not restricted to a
single layer but can span dynamically across multiple layers of the FSO. Such
new responding team is in fact a new ad hoc Service-oriented Community whose
objective and lifespan are determined by the originating event.
 Community Resilience Engineering 7

5 Towards Community Resilience Solutions

A prototypical and limited implementation of an FSO is given by the software
architecture and in particular the middleware of project Little Sister1 . As al-
ready mentioned, Little Sister addresses telemonitoring for home care through a
connectionist approach in which the collective action of an interconnected net-
work of simple units (currently low-fidelity cameras and RFIDs) replaces the
adoption of more powerful, expensive, and power-hungry devices. The Little Sis-
ter software architecture may be described as a multi-tier distributed system in
which the above mentioned simple units are wrapped and exposed as manage-
able web services. In Little Sister a tri-level system consisting of the individual
rooms in a house; the houses in a building; and the building itself; is fractally
organized by having the system maintain dedicated, manageable service groups
representing the members of each level. Members exchange information by a
standard publish-and-subscribe mechanism. Events are triggered by the units
in each level. If actuation logic is available in the originating level, the event
is managed and sinked. Whenever the event calls for resources unavailable in
the current level, it is propagated to the next upper level, if any; otherwise,
an alarm is triggered. This translates into a simple, statically predefined, and
statically structured FSO architecture. A prototypical implementation of a se-
mantic framework for FSO is also reported in [10]. SPARQL endpoints are set
up with Fuseki for each SoC at the bottom layer. SoCs located at upper lay-
ers are composed by aggregating those at lower layers. Such an aggregation is
realized by issuing federated SPARQL queries: a query to a SoC located at up-
per layers are dispatched to those bottom SoCs under the queried upper layer
SoC. With such an approach, data only resides in SPARQL endpoints at bottom
layers. SoCs at upper layer exist virtually thus do not need to hold data, and
they can be ad-hoc organized. By distributing the data to SPARQL endpoints
at bottom layer, this approach also avoids a central point of failure. Future work
will include removing the current limitations, restructuring the system for CR,
and embedding “intelligence” into the architecture by making use of adaptive
software frameworks such as ACCADA [11] and Transformer [12], whose major
added value in the context of CR would be their ability to trade-off dynamically
multiple adaptation plans concurrently proposed by organizations participating
in the crisis management.

6 Conclusions
Our vision about Community Resilience Engineering has been briefly presented.
Obviously much is yet to be done. The FSO protocols have not been formalized
and only a partial and static version of the system is currently available. Among the
1
Little Sister is a Flemish project funded by iMinds as well as by the Flemish Gov-
ernment Agency for Innovation by Science and Technology (IWT). Little Sister is
to design a low-cost autonomous technology to provide protection and assistance to
the elderly population [9, 10].
8 V. De Florio, H. Sun, and C. Blondia

many issues still missing we highlight here the following major ones: defining inter-
faces to reflect the state of an organization as well as the knowledge it has accrued
during a crisis event; expose such knowledge; define crisis management ontologies;
describe organizational services semantically; enable inter-organizational mutual-
istic cooperation; prepare for crises through co-evolutive strategies [13]; instruct
the communities on how to become a “living component” of a hosting organiza-
tion; log the evolution of social overlay networks emerging during a crisis in func-
tion of the evolution of the critical events; create tools for the analysis of the logs
so as to enable the identification of reiterating responses (which could be reused as
CR templates possibly re-occurring at different scales); simulating the operation of
FSO-compliant organizations during a crisis; and of course experimenting our ap-
proach in real-life situations. Despite so dense a research agenda we observe how the
specific traits of the FSO and its building block closely match requirements such as
the one in Sect. 3. This correspondence leads us to conjecture that mature designs
of the FSO and SoC may provide us with an answer to the questions drawn in the
introduction and designers with an effective practical “tool” for the engineering of
community-resilient socio-technical responses to crises.

References
1. Hardin, G.: The tragedy of the commons. Science 162(3859), 1243–1248 (1968)
2. Colten, C.E., Kates, R.W., Laska, S.B.: Community resilience: Lessons from New
Orleans and hurricane Katrina. Technical Report 3, CARRI (2008)
3. RAND: Community resilience (2014),
http://www.rand.org/topics/community-resilience.html
4. Sun, H., et al.: The missing ones: Key ingredients towards effective ambient assisted
living systems. J. Ambient Intell. Smart Environ. 2(2) (2010)
5. De Florio, V.: Behavior, organization, substance: Three gestalts of general systems
theory. In: Proc. of the 2014 Conf. on N. Wiener in the 21st Century. IEEE (2014)
6. De Florio, V., et al.: Models and concepts for socio-technical complex systems:
Towards fractal social organizations. Sys. Res. and Behav. Sci. 30(6) (2013)
7. Sun, H., De Florio, V., Gui, N., Blondia, C.: Participant: A new concept for
optimally assisting the elder people. In: Proc. of the 20th IEEE Int.l Symp. on
Computer-Based Medical Systems (CBMS 2007), Maribor, Slovenia (2007)
8. Pór, G.: Nurturing systemic wisdom through knowledge ecology. The System
Thinker 11(8), 1–5 (2000)
9. Anonymous: LittleSister: Low-cost monitoring for care and retail (2013),
http://www.iminds.be/en/research/overview-projects/
p/detail/littlesister
10. De Florio, V., Sun, H., Buys, J., Blondia, C.: On the impact of fractal organization
on the performance of socio-technical systems. In: Proc. of the 2013 Int.l Workshop
on Intelligent Techniques for Ubiq. Systems (ITUS 2013), Vietri, Italy (2013)
11. Gui, N., De Florio, V., Sun, H., Blondia, C.: ACCADA: A framework for continuous
context-aware deployment and adaptation. In: Guerraoui, R., Petit, F. (eds.) SSS
2009. LNCS, vol. 5873, pp. 325–340. Springer, Heidelberg (2009)
12. Gui, N., et al.: Transformer: an adaptation framework with contextual adaptation
behavior composition support. Software: Practice & Experience (2012)
13. Adner, R., Kapoor, R.: Value creation in innovation ecosystems. Strategic Man-
agement Journal 31, 306–333 (2010)
 Enhancing Architecture Design Decisions Evolution
with Group Decision Making Principles

Ivano Malavolta1 , Henry Muccini2 , and Smrithi Rekha V.3

1
Gran Sasso Science Institute, L’Aquila, Italy
2
Department of Information Engineering, Computer Science and Mathematics,
University of L’Aquila, Italy
3
Amrita School of Business, Amrita Vishwa Vidyapeetham, India
[email protected], [email protected],
v [email protected]

Abstract. In order to build resilient systems, robust architectures are needed.

The software architecture community clearly recognizes that robust architectures
come from a robust decision-making process. The community also acknowledges
that software architecture decision making is not an individual activity but a group
process where architectural design decisions are made by groups of heteroge-
neous and dispersed stakeholders. The decision-making process is not just data
driven, but also people driven, and group decision making methodologies have
been studied from multiple perspectives (e.g., psychology, organizational behav-
ior, economics) with the clear understanding that a poor-quality decision making
process is more likely than a high-quality process leading to undesirable out-
comes (including disastrous fiascoes).
In this work, we propose to explicitly include group decision making strate-
gies into an architecting phase, so to clearly document not only the architectural
decisions that may lead to the success or failure of a system, but also group de-
cision making factors driving the way architecture design decisions are made. In
this regard, this work defines a group design decision metamodel (for represent-
ing group design decisions and their relationships), together with ways to trace
group design decisions towards other system life-cycle artifacts, and a change
impact analysis engine for supporting evolving design decisions.

1 Introduction
Dependability and resilience in software engineering have been analyzed since a long
time from a (purely) technical perspective, by proposing architectures and processes for
realizing dependable1 and resilient systems[1,2], by modeling and analysing properties
of resilience [3,4], by monitoring the system state at run-time [5], and so on.
More recently, human and social aspects are being considered as an important factor
when developing quality systems. The role of the human beings in automated software
testing has been the topic of a Dagstuhl seminar [6]. The role of socio-technical coor-
dination has been remarked by James Herbsleb in his keynote at ICSE 2014 (the 36th
1
Architecting Dependable Systems series of workshop: http://www.cs.kent.ac.uk/
people/staff/rdl/ADSFuture/resources.htm

I. Majzik and M. Vieira (Eds.): SERENE 2014, LNCS 8785, pp. 9–23, 2014.
c Springer International Publishing Switzerland 2014
10 I. Malavolta, H. Muccini, and V. Smrithi Rekha

International Conference on Software Engineering) and through his publications. The

Social Software Engineering workshop is at its sixth edition, this year being co-located
with the Foundations of Software Engineering (FSE 2014) conference. The way people
work together impacts their productivity and the quality of the outcome and hence group
decision making processes and methods have been carefully analyzed in a number of
areas [7,8].
Along these lines, we have been recently analyzing group decision making princi-
ples in the architecture design decision process. Architecture design decisions (ADDs)
are considered first class entities when architecting software systems [9,10,11]. They
capture potential alternative solutions, and the rationale for deciding among compet-
ing solutions. It has been recognised that ADDs have to be explicitly documented and
kept synchronized with (potentially evolving) requirements and the selected architec-
tural solution. Group decision making (GDM), instead, consists of a set of methods
and principles driving the way groups make collaborative decisions. In recent work,
we have been analyzing how group decision making principles and methods have been
implemented in state-of-the-art ADD approaches. More specifically, in [12] we have in-
terviewed a number of architects working in (or collaborating with) industry to identify
how architectural decisions are taken. As expected, most of the architectural decisions
are made in groups, distributed or co-located, decisions involving a number of different
stakeholders.
This work, by building upon our previous work presented at SERENE 2011 [13]
(where an approach to support ADD evolution has been discussed) and by explicitly
taking into account the group decision making principles we had highlighted in our
recent papers [14,12], proposes an approach to incorporate GDM strategies explicitly
into evolving architecture design decisions. It proposes a reference metamodel for group
decision making, that describes the minimal reasoning elements necessary to suitably
realize a group decision making approach as part of an architecture design decision
process. The contribution of this work is mainly in the following lines: a) it provides
a metamodel to include GDM principles explicitly into architecture design decisions
(therefore, enabling the extension of current ADD methods to take into consideration
GDM principles and methods); b) it describes how the relationships among ADDs can
be explicitly represented using the defined metamodel, and c) it defines bidirectional
traceability links between ADDs, requirements and architectural elements which will
help in analyzing the impact of evolution on those artifacts.
In this paper we have extensively extended the ADD metamodel presented [13] in
order to include a number of missing GDM factors. The traceability and change prop-
agation engines had to be highly revised in order to incorporate the new needs dictated
by GDM. We expect this work to provide the baseline to build new approaches and
tools for group-based architecture design decisions.
The main components of this paper are five sections, organized as follows. Section 2
provides background information on architecture design decisions and group decision
making. Section 3 presents the main contribution of this work, in terms of a metamodel
for group decision making in software architecture. Section 4 introduces some examples
to show how this proposal can be used in practical terms. Related works are presented
in Section 5, while conclusions and future work are discussed in Section 6.
Another random document with
no related content on Scribd:
 On the last words his voice dropped to a lower key and shook with
intensity. Rona let him take her hand, and with devotion he raised it to his
lips.

"Felix," she urged, almost in a whisper, for she was profoundly shaken,
"we did keep faith, did we not?"

"Thanks to you, not to me, we did," he replied thankfully.

She laughed a little hysterically. "I have just been explaining to Mr.
Vronsky how impossible it all is," she cried. "Of all the women that I could
not imagine Denzil to be in love with.—I always thought it was you, Felix!"

"It might have been," put in Vronsky. "Felix might have been her
favored suitor, had he so willed."

"That cannot be said, since such a thing was never contemplated by

me," replied Felix, promptly.

"Hush, someone is coming," whispered Rona, suddenly; and Felix rose

with alacrity, as the door was opened, and Miss Forester entered, followed
by two menservants with lamps.

* * * * * *
*

She stopped short as soon as the persons present became apparent to

her. "Miss Rawson?" she began, as if bewildered.

Felix stepped forward, to be greeted by her with kind cordiality. "Miss

Rawson has not come. She had an accident—she was ill," he explained.
"This is Miss Leigh, my fiancée."

He led Rona across the room, and presented her. "By great good fortune
I found Miss Leigh quite unexpectedly at Gretz, and brought her on," he
said. "The journey was one which she should never have attempted alone.
But she thought my brother was dying."
 Rona had recovered her wonted control by now. "Mr. Denzil Vanston
has been like an elder brother to me ever since Felix was obliged to go
away," she explained. "When he telegraphed for us to come to him, it did
not seem to me possible to disregard the message. But I fear that I have
inadvertently given a great deal of trouble, for there is no inn at Savlinsky
where I could stay. Please forgive me. A telegram sounds so peremptory.
When Denzil telegraphed 'Come,' I concluded that he must have made
arrangements for our reception."

"All arrangements are made for your reception, my dear child," said
Miss Forester, warmly. "I tremble to think of your undertaking such a
journey; but what a good thing that Felix met you! And now that you are
safely here, all is well."

She could afford to say, "All is well."

A short week ago it would have been otherwise. The story of the broken
sixpence about the neck of Felix had then been a thorn in her memory, for
she feared that the girl she loved might have to suffer.

But since the coming of Denzil all was changed. She was able to
welcome Rona without reservations, and to feel thankful that the two girls
were not rivals; for, even in her traveling garb, Veronica was beautiful
enough to strike the eye of any unprejudiced person.

"My friend, I congratulate you," said Miss Forester, turning with a

mischievous smile to Felix.

His eyes were upon the face of the woman so incredibly surrendered to
him, and he smiled gravely. He had not yet had time to realize his happiness
—to appreciate what it all meant. The one supreme fact that Rona loved
him was destroying the proportions of everything else.

Vronsky had not spoken since Miss Forester's entrance. He had a

divided heart. He loved Felix, and he was assured of his happiness; but also
he loved Nadia, and wanted to feel secure of hers. At the moment the steps
of the other pair of lovers sounded in the veranda, and the Governor's
daughter, in her white gown, her eyes full of light, pushed open the window
and stepped inside, followed by Denzil.

The Squire's brow was wet with the dews of apprehension. His heart
was in his mouth. What kind of situation was this? He had played the
traitor, and he stood confronted by the two girls—his old love and his new.

Blindly he had followed Nadia to the house, unable to utter a word of

warning, unable even to own to her that he had seen Felix. He had a
confused idea that nothing that might now happen could be worse than the
expression of his brother's eyes when lately they had met his own.

And behold, that same brother stood just within the room with the mien
of a conqueror, his head high, his glance confident, his mouth smiling.

"Ah," said Nadia, drawing a long breath, "I told you that they had
arrived—they must have arrived——" She came slowly forward.

"It is delightful to meet again," said Felix, taking her two hands. "May I
present to you my fiancée, Miss Leigh?"

Denzil started visibly. It was upon his tongue to cry "No!"

Even as the impulse arose it was smothered. In his dazed condition he

yet took in one point, namely, that apparently the dilemma from which he
shrank existed no longer. He was free to avow himself the suitor of the
Russian girl.

Was not this the summit of his desires?

Nadia smiled rapturously. Snatching her hands from Felix, she held
them impulsively to Rona.

"Oh," said she, "I have wanted so long to see an English girl! And you
are—you are—like the girls in story books, just as Mr. Vanston is exactly
like the men!"

"Why," cried Rona in astonishment, "how well you talk English!"

 Over the heads of the two girls the glance of the brothers met. There
was no malice in Felix's steady gaze. He went to Denzil and took his hand.
"It is long since we met," he said, kindly. "Am I to congratulate you,
Denzil?"

The Squire made an effort to speak, but no words came. He licked his
dry lips. Was this some device of his younger brother to torture him?

"Where is Aunt Bee?" he asked, that being the sole non-contentious

remark that occurred to him at the moment.

"Lying up, lame, at St. Petersburg," said Felix. "But you need not be
anxious. I met Veronica at Gretz, and have taken care of her. She has not
felt the journey at all."

Denzil stammered, "That—that was good of you. I—er—feel that I was

inconsiderate to suggest it. Of course, I did not contemplate her coming
alone."

"Naturally," was the calm reply. "If it was an indiscretion on your part, it
was a blessed one for me. I was able to renew my acquaintance with Miss
Leigh, which had been of the briefest, in the favorable circumstances of a
five-hundred-mile tête-à-tête; and now we understand each other perfectly."

As he spoke Nadia and Rona turned to them.

"Look at him," said Nadia, prettily. "He is quite convalescent, don't you
think? Miss Forester and I have done our poor little best for him."

"He will be all right now," said Rona, extending her hand with a smile
that certainly was unmixed with any resentment, "now that he knows that
Felix is safe and well and—and happy—won't you, Denzil?"

He could not speak. He wrung her hand and turned away, crimson. Miss
Forester was a little surprised, but Nadia thought tenderly of the
Englishman's proverbial taciturnity under pressure of emotion. These
people were heroes and heroines of romance to her.
 She flung her arm caressingly about Rona's shoulders and led her from
the room. Miss Forester followed, and the three men were left in a gulf of
silence.

* * * * * *
*

It was as though Felix, like some champion of old entering an enchanted

castle, had cut with his sword clean through the many-hued curtain which
shut out the world. The moment his eye and that of his brother met scales
fell from Denzil's sight—the spell was broken: he emerged, as it were, once
more into a life in which men were responsible for their actions, and
wherein gentlemen did not break faith, however strong the temptation.

What was this magic which had held him chained? Was it love, or
sorcery? He had never asked himself. He only knew that it was too strong
for him. It had blinded him to constancy, to honor, to his plighted word. He
stood aghast at the power of it.

It is one thing to feel; it is quite another to be carried away by the

strength of one's feelings. He still thrilled with the memory of the scene in
the twilight garden; and yet underlying his joy there was a profound
misgiving.

The passion which possessed him was real enough; but he was no boy,
and even as he felt it he knew it could not last. What was worse, he knew
that he did not even wish it to last. He was a steady-going prosaic person,
and he foresaw that he could not dwell continuously upon the heights to
which his infatuation had drawn him.

His present ecstasy was not real life. It was illusion. The moment he
saw Felix he realized this.

What was he to say? And then, in the midst of his confusion, light leapt
to his mind. He had broken plight; but then, so had Rona!

The notion went far to restore his self-respect to him.

 "Well," he said, hurriedly, addressing Felix, who stood regarding him
critically, "so Rona changed her mind upon the journey here?"

"As you did upon your arrival," was the instant retort.

Denzil looked crestfallen.

"Rona discovered," went on Felix, "upon the way here, that she had
done what many a very young girl does—she had mistaken gratitude for
love. But, having made this mistake, she was determined to abide by it, and
at all costs to keep her faith to you. She is, however, absolved from her
allegiance I think, by the scene I witnessed just now in the garden."

There was a pause. "Come, Denzil," said Felix, composedly, "do you
suppose that I want to quarrel with you for a slip which gives me my
happiness? Let us never speak of this again. And let me assure you that
never, in all the future, shall you hear a word from either of us of what has
happened. Nobody but Vronsky, Rona, and I know that any engagement
existed between you; and we shall never speak of it to anybody. I wish you
happiness with all my heart."

* * * * * *
*

The Governor had, as we know, previously received a hint from

Vronsky. But, in his satisfaction at the engagement, he willingly accepted
the Russian's assurance that he had been completely mistaken.

To Aunt Bee, at St. Petersburg, the news came as a shock.

Upon the previous day she had received a letter, forwarded from
Normansgrave, and written by no less a person than Rankin Leigh himself.
He wrote to say that he felt sure, judging by Miss Rawson's action in
removing his great-niece from the vicinity directly she found that he was
there, that his hopes of an old age soothed by her care and affection were
destined to remain unrealized. As it might, however, be important to the
family, in view of the deep interest they seemed to take in the girl, to know
more of her antecedents, he offered to go into the matter thoroughly, if his
expenses were guaranteed, and a certain sum over and above paid to him.

At the time of receiving this letter Aunt Bee was fully persuaded that
Denzil would marry Rona; and it seemed to her most desirable that all that
could be ascertained about her should come to light before things were
irrevocable. She considered that Rankin Leigh had most probably means of
coming at the truth, or sources of information, which they had not; and she
wrote empowering him to make inquiries, and mentioning the sum she was
prepared to pay for his services.

Hardly had she done this, when she received the startling news of
Denzil's faithlessness and the double engagement.

It was an occasion upon which the good lady became vividly sensible of
the mixture of motives which exists in the best of us.

She was really attached to Rona; yet it was impossible to deny that there
was a certain sensation of pleasure or gratified family pride that the new
mistress of Normansgrave would bring a suitable dower, and that she
boasted a noble pedigree, instead of being, however attractive, a Girl from
Nowhere.

It was arranged that the two couples, with Miss Forester as chaperon,
should all come to St. Petersburg together. There Felix and Rona would be
married, and Nadia and Miss Forester accompany Denzil and his aunt to
England, that the Russian girl might have a sight of her new home before
returning to Russia in the winter for her own wedding.

Before they arrived Miss Rawson was in possession of all that could
ever be known of Veronica's origin.

Rankin Leigh succeeded in ascertaining that her mother had been

secretly married to John Mauleverer. The young man had taken this step, as
is frequently done by the weak, hoping against hope that some chance of
avowing his marriage without incurring the displeasure of his parents might
arise. He was a delicate, timid young man. The strain of the position, the
anguish of knowing that the unconscious parents were arranging another
match for their son, was too much for the unacknowledged wife, who
fretted herself ill in her solitude, and died when her baby was six months
old.

The young father, thus released, married almost immediately the lady
chosen by his parents. He placed his daughter in the Convent School,
keeping her existence a secret to the last. He probably intended to provide
for the child, but took no steps to do so. He was still a young man when his
death occurred, very unexpectedly. He left two sons by his second wife.

The discovery of the marriage certificate putting it beyond doubt that

Rona was legally his daughter, Rankin Leigh thought that the Mauleverers,
if approached, must be willing, if not to acknowledge her, at least to make
her some allowance.

Over this information Miss Rawson pondered much in the solitude

which she had to endure before the young people joined her.

The Girl from Nowhere was then, as she had always felt, of good blood.
The race instinct had not deceived Aunt Bee, and she felt a pardonable pride
in realizing this.

She wondered how far Denzil had, unconsciously, been influenced by

the obscurity of origin of the girl he had befriended. His aunt, reflecting as
we have seen upon the mixed nature of human motive, thought it possible
that the fact might have turned the scale for him without his being
conscious of its weight.

She laid side by side the photo of Nadia and the photo of Rona, and
marveled as she reflected that Denzil had chosen the alien type.

She could not tell whether Rona was happy. She was haunted by the
idea that she must have stood aside upon finding that Denzil had changed
his mind, and that it had not been possible for her to evade an engagement
with the younger brother.

Altogether, in her lonely sojourn in the Russian capital the maiden aunt
went through a good deal.
 It was with more agitation than she remembered to have experienced in
her sixty years that she awaited the arrival of the party from Savlinsky.

A very brief survey, however, sufficed to convince her of the happiness

of Felix and Rona. There was no mistaking the light in the girl's eyes, nor
the significance of her added bloom and sweetness.

With regard to Denzil she was not so sure. When she actually saw the
lady upon whom he had fixed his mature affections, she was invaded with a
wonder as to what they would make of a life together in England in the
provinces.

Nadia was lovely, and in her presence he was evidently so moved out of
himself that he could not reason, he could only feel. But his temperament
was wholly unromantic, because unimaginative. As time went on, would he
be able to sustain the standard of feeling which the highly-wrought,
emotional girl demanded?

Aunt Bee fell back upon the comforting thought that such girls, when
touched by marriage and motherhood, often settle down into quite
humdrum persons. Meanwhile, the troubling of his whole being which the
Squire was undergoing was no doubt an excellent thing for him. Had he
married Rona, he would—nay, he must—have remained King Cophetua to
the end of the chapter, horribly pleased with himself. If anything would
ennoble his character, the experience of being Nadia's husband would be
likely to do it. It was better so.

Before their marriage Miss Rawson took an opportunity privately to tell

Felix and Rona all that she had learned from Rankin Leigh.

They listened with interest, and Rona was evidently gratified to

ascertain that she had no need to be ashamed of her mother.

Aunt Bee suggested that it might be well to announce her existence, or

in some way approach her father's family, since there was no doubt at all of
her being the eldest daughter of John Mauleverer.
 Rona turned to Felix, as usual; he to her. Their eyes met, and they
smiled.

"As Rona likes, of course," said Felix, "but I hardly see any reason for
our troubling them. The present Mrs. Mauleverer apparently knows nothing
at all of her late husband's former marriage. Would not the disclosure
wound her, cruelly and unnecessarily? We have nothing to ask from them.
Affection they are not likely to bestow, money we do not want. Were Rona's
father living, it might be her duty to go to him. As it is, there does not seem
to be a question of duty. Moreover, if they are such a high and mighty set of
people, how would they like to know that she was married to a man of my
record?"

Rona turned to him, her face alive with championship.

"I want nothing," said she, "from my father's people. My name is

neither Leigh nor Mauleverer: it is Vanston. But, for all that, one day I shall
go and see them, and let them know who I am, simply in order that they
may have the privilege of knowing—my husband."

THE END
 *** END OF THE PROJECT GUTENBERG EBOOK THE GIRL FROM
NOWHERE ***

Updated editions will replace the previous one—the old editions will
be renamed.

Creating the works from print editions not protected by U.S.

copyright law means that no one owns a United States copyright in
these works, so the Foundation (and you!) can copy and distribute it
in the United States without permission and without paying
copyright royalties. Special rules, set forth in the General Terms of
Use part of this license, apply to copying and distributing Project
Gutenberg™ electronic works to protect the PROJECT GUTENBERG™
concept and trademark. Project Gutenberg is a registered trademark,
and may not be used if you charge for an eBook, except by following
the terms of the trademark license, including paying royalties for use
of the Project Gutenberg trademark. If you do not charge anything
for copies of this eBook, complying with the trademark license is
very easy. You may use this eBook for nearly any purpose such as
creation of derivative works, reports, performances and research.
Project Gutenberg eBooks may be modified and printed and given
away—you may do practically ANYTHING in the United States with
eBooks not protected by U.S. copyright law. Redistribution is subject
to the trademark license, especially commercial redistribution.

START: FULL LICENSE

THE FULL PROJECT GUTENBERG LICENSE
 PLEASE READ THIS BEFORE YOU DISTRIBUTE OR USE THIS WORK

To protect the Project Gutenberg™ mission of promoting the free

distribution of electronic works, by using or distributing this work (or
any other work associated in any way with the phrase “Project
Gutenberg”), you agree to comply with all the terms of the Full
Project Gutenberg™ License available with this file or online at
www.gutenberg.org/license.

Section 1. General Terms of Use and

Redistributing Project Gutenberg™
electronic works
1.A. By reading or using any part of this Project Gutenberg™
electronic work, you indicate that you have read, understand, agree
to and accept all the terms of this license and intellectual property
(trademark/copyright) agreement. If you do not agree to abide by all
the terms of this agreement, you must cease using and return or
destroy all copies of Project Gutenberg™ electronic works in your
possession. If you paid a fee for obtaining a copy of or access to a
Project Gutenberg™ electronic work and you do not agree to be
bound by the terms of this agreement, you may obtain a refund
from the person or entity to whom you paid the fee as set forth in
paragraph 1.E.8.

1.B. “Project Gutenberg” is a registered trademark. It may only be

used on or associated in any way with an electronic work by people
who agree to be bound by the terms of this agreement. There are a
few things that you can do with most Project Gutenberg™ electronic
works even without complying with the full terms of this agreement.
See paragraph 1.C below. There are a lot of things you can do with
Project Gutenberg™ electronic works if you follow the terms of this
agreement and help preserve free future access to Project
Gutenberg™ electronic works. See paragraph 1.E below.
1.C. The Project Gutenberg Literary Archive Foundation (“the
Foundation” or PGLAF), owns a compilation copyright in the
collection of Project Gutenberg™ electronic works. Nearly all the
individual works in the collection are in the public domain in the
United States. If an individual work is unprotected by copyright law
in the United States and you are located in the United States, we do
not claim a right to prevent you from copying, distributing,
performing, displaying or creating derivative works based on the
work as long as all references to Project Gutenberg are removed. Of
course, we hope that you will support the Project Gutenberg™
mission of promoting free access to electronic works by freely
sharing Project Gutenberg™ works in compliance with the terms of
this agreement for keeping the Project Gutenberg™ name associated
with the work. You can easily comply with the terms of this
agreement by keeping this work in the same format with its attached
full Project Gutenberg™ License when you share it without charge
with others.

1.D. The copyright laws of the place where you are located also
govern what you can do with this work. Copyright laws in most
countries are in a constant state of change. If you are outside the
United States, check the laws of your country in addition to the
terms of this agreement before downloading, copying, displaying,
performing, distributing or creating derivative works based on this
work or any other Project Gutenberg™ work. The Foundation makes
no representations concerning the copyright status of any work in
any country other than the United States.

1.E. Unless you have removed all references to Project Gutenberg:

1.E.1. The following sentence, with active links to, or other

immediate access to, the full Project Gutenberg™ License must
appear prominently whenever any copy of a Project Gutenberg™
work (any work on which the phrase “Project Gutenberg” appears,
or with which the phrase “Project Gutenberg” is associated) is
accessed, displayed, performed, viewed, copied or distributed:
 This eBook is for the use of anyone anywhere in the United
States and most other parts of the world at no cost and with
almost no restrictions whatsoever. You may copy it, give it away
or re-use it under the terms of the Project Gutenberg License
included with this eBook or online at www.gutenberg.org. If you
are not located in the United States, you will have to check the
laws of the country where you are located before using this
eBook.

1.E.2. If an individual Project Gutenberg™ electronic work is derived

from texts not protected by U.S. copyright law (does not contain a
notice indicating that it is posted with permission of the copyright
holder), the work can be copied and distributed to anyone in the
United States without paying any fees or charges. If you are
redistributing or providing access to a work with the phrase “Project
Gutenberg” associated with or appearing on the work, you must
comply either with the requirements of paragraphs 1.E.1 through
1.E.7 or obtain permission for the use of the work and the Project
Gutenberg™ trademark as set forth in paragraphs 1.E.8 or 1.E.9.

1.E.3. If an individual Project Gutenberg™ electronic work is posted

with the permission of the copyright holder, your use and distribution
must comply with both paragraphs 1.E.1 through 1.E.7 and any
additional terms imposed by the copyright holder. Additional terms
will be linked to the Project Gutenberg™ License for all works posted
with the permission of the copyright holder found at the beginning
of this work.

1.E.4. Do not unlink or detach or remove the full Project

Gutenberg™ License terms from this work, or any files containing a
part of this work or any other work associated with Project
Gutenberg™.

1.E.5. Do not copy, display, perform, distribute or redistribute this

electronic work, or any part of this electronic work, without
prominently displaying the sentence set forth in paragraph 1.E.1
with active links or immediate access to the full terms of the Project
Gutenberg™ License.

1.E.6. You may convert to and distribute this work in any binary,
compressed, marked up, nonproprietary or proprietary form,
including any word processing or hypertext form. However, if you
provide access to or distribute copies of a Project Gutenberg™ work
in a format other than “Plain Vanilla ASCII” or other format used in
the official version posted on the official Project Gutenberg™ website
(www.gutenberg.org), you must, at no additional cost, fee or
expense to the user, provide a copy, a means of exporting a copy, or
a means of obtaining a copy upon request, of the work in its original
“Plain Vanilla ASCII” or other form. Any alternate format must
include the full Project Gutenberg™ License as specified in
paragraph 1.E.1.

1.E.7. Do not charge a fee for access to, viewing, displaying,

performing, copying or distributing any Project Gutenberg™ works
unless you comply with paragraph 1.E.8 or 1.E.9.

1.E.8. You may charge a reasonable fee for copies of or providing

access to or distributing Project Gutenberg™ electronic works
provided that:

• You pay a royalty fee of 20% of the gross profits you derive
from the use of Project Gutenberg™ works calculated using the
method you already use to calculate your applicable taxes. The
fee is owed to the owner of the Project Gutenberg™ trademark,
but he has agreed to donate royalties under this paragraph to
the Project Gutenberg Literary Archive Foundation. Royalty
payments must be paid within 60 days following each date on
which you prepare (or are legally required to prepare) your
periodic tax returns. Royalty payments should be clearly marked
as such and sent to the Project Gutenberg Literary Archive
Foundation at the address specified in Section 4, “Information
 about donations to the Project Gutenberg Literary Archive
Foundation.”

• You provide a full refund of any money paid by a user who

notifies you in writing (or by e-mail) within 30 days of receipt
that s/he does not agree to the terms of the full Project
Gutenberg™ License. You must require such a user to return or
destroy all copies of the works possessed in a physical medium
and discontinue all use of and all access to other copies of
Project Gutenberg™ works.

• You provide, in accordance with paragraph 1.F.3, a full refund of

any money paid for a work or a replacement copy, if a defect in
the electronic work is discovered and reported to you within 90
days of receipt of the work.

• You comply with all other terms of this agreement for free
distribution of Project Gutenberg™ works.

1.E.9. If you wish to charge a fee or distribute a Project Gutenberg™

electronic work or group of works on different terms than are set
forth in this agreement, you must obtain permission in writing from
the Project Gutenberg Literary Archive Foundation, the manager of
the Project Gutenberg™ trademark. Contact the Foundation as set
forth in Section 3 below.

1.F.

1.F.1. Project Gutenberg volunteers and employees expend

considerable effort to identify, do copyright research on, transcribe
and proofread works not protected by U.S. copyright law in creating
the Project Gutenberg™ collection. Despite these efforts, Project
Gutenberg™ electronic works, and the medium on which they may
be stored, may contain “Defects,” such as, but not limited to,
incomplete, inaccurate or corrupt data, transcription errors, a
copyright or other intellectual property infringement, a defective or
damaged disk or other medium, a computer virus, or computer
codes that damage or cannot be read by your equipment.

1.F.2. LIMITED WARRANTY, DISCLAIMER OF DAMAGES - Except for

the “Right of Replacement or Refund” described in paragraph 1.F.3,
the Project Gutenberg Literary Archive Foundation, the owner of the
Project Gutenberg™ trademark, and any other party distributing a
Project Gutenberg™ electronic work under this agreement, disclaim
all liability to you for damages, costs and expenses, including legal
fees. YOU AGREE THAT YOU HAVE NO REMEDIES FOR
NEGLIGENCE, STRICT LIABILITY, BREACH OF WARRANTY OR
BREACH OF CONTRACT EXCEPT THOSE PROVIDED IN PARAGRAPH
1.F.3. YOU AGREE THAT THE FOUNDATION, THE TRADEMARK
OWNER, AND ANY DISTRIBUTOR UNDER THIS AGREEMENT WILL
NOT BE LIABLE TO YOU FOR ACTUAL, DIRECT, INDIRECT,
CONSEQUENTIAL, PUNITIVE OR INCIDENTAL DAMAGES EVEN IF
YOU GIVE NOTICE OF THE POSSIBILITY OF SUCH DAMAGE.

1.F.3. LIMITED RIGHT OF REPLACEMENT OR REFUND - If you

discover a defect in this electronic work within 90 days of receiving
it, you can receive a refund of the money (if any) you paid for it by
sending a written explanation to the person you received the work
from. If you received the work on a physical medium, you must
return the medium with your written explanation. The person or
entity that provided you with the defective work may elect to provide
a replacement copy in lieu of a refund. If you received the work
electronically, the person or entity providing it to you may choose to
give you a second opportunity to receive the work electronically in
lieu of a refund. If the second copy is also defective, you may
demand a refund in writing without further opportunities to fix the
problem.

1.F.4. Except for the limited right of replacement or refund set forth
in paragraph 1.F.3, this work is provided to you ‘AS-IS’, WITH NO
OTHER WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR ANY PURPOSE.

1.F.5. Some states do not allow disclaimers of certain implied

warranties or the exclusion or limitation of certain types of damages.
If any disclaimer or limitation set forth in this agreement violates the
law of the state applicable to this agreement, the agreement shall be
interpreted to make the maximum disclaimer or limitation permitted
by the applicable state law. The invalidity or unenforceability of any
provision of this agreement shall not void the remaining provisions.

1.F.6. INDEMNITY - You agree to indemnify and hold the Foundation,

the trademark owner, any agent or employee of the Foundation,
anyone providing copies of Project Gutenberg™ electronic works in
accordance with this agreement, and any volunteers associated with
the production, promotion and distribution of Project Gutenberg™
electronic works, harmless from all liability, costs and expenses,
including legal fees, that arise directly or indirectly from any of the
following which you do or cause to occur: (a) distribution of this or
any Project Gutenberg™ work, (b) alteration, modification, or
additions or deletions to any Project Gutenberg™ work, and (c) any
Defect you cause.

Section 2. Information about the Mission

of Project Gutenberg™
Project Gutenberg™ is synonymous with the free distribution of
electronic works in formats readable by the widest variety of
computers including obsolete, old, middle-aged and new computers.
It exists because of the efforts of hundreds of volunteers and
donations from people in all walks of life.

Volunteers and financial support to provide volunteers with the

assistance they need are critical to reaching Project Gutenberg™’s
goals and ensuring that the Project Gutenberg™ collection will
remain freely available for generations to come. In 2001, the Project
Gutenberg Literary Archive Foundation was created to provide a
secure and permanent future for Project Gutenberg™ and future
generations. To learn more about the Project Gutenberg Literary
Archive Foundation and how your efforts and donations can help,
see Sections 3 and 4 and the Foundation information page at
www.gutenberg.org.

Section 3. Information about the Project

Gutenberg Literary Archive Foundation
The Project Gutenberg Literary Archive Foundation is a non-profit
501(c)(3) educational corporation organized under the laws of the
state of Mississippi and granted tax exempt status by the Internal
Revenue Service. The Foundation’s EIN or federal tax identification
number is 64-6221541. Contributions to the Project Gutenberg
Literary Archive Foundation are tax deductible to the full extent
permitted by U.S. federal laws and your state’s laws.

The Foundation’s business office is located at 809 North 1500 West,

Salt Lake City, UT 84116, (801) 596-1887. Email contact links and up
to date contact information can be found at the Foundation’s website
and official page at www.gutenberg.org/contact

Section 4. Information about Donations to

the Project Gutenberg Literary Archive
Foundation
Project Gutenberg™ depends upon and cannot survive without
widespread public support and donations to carry out its mission of
increasing the number of public domain and licensed works that can
be freely distributed in machine-readable form accessible by the
widest array of equipment including outdated equipment. Many
small donations ($1 to $5,000) are particularly important to
maintaining tax exempt status with the IRS.

The Foundation is committed to complying with the laws regulating

charities and charitable donations in all 50 states of the United
States. Compliance requirements are not uniform and it takes a
considerable effort, much paperwork and many fees to meet and
keep up with these requirements. We do not solicit donations in
locations where we have not received written confirmation of
compliance. To SEND DONATIONS or determine the status of
compliance for any particular state visit www.gutenberg.org/donate.

While we cannot and do not solicit contributions from states where

we have not met the solicitation requirements, we know of no
prohibition against accepting unsolicited donations from donors in
such states who approach us with offers to donate.

International donations are gratefully accepted, but we cannot make

any statements concerning tax treatment of donations received from
outside the United States. U.S. laws alone swamp our small staff.

Please check the Project Gutenberg web pages for current donation
methods and addresses. Donations are accepted in a number of
other ways including checks, online payments and credit card
donations. To donate, please visit: www.gutenberg.org/donate.

Section 5. General Information About

Project Gutenberg™ electronic works
Professor Michael S. Hart was the originator of the Project
Gutenberg™ concept of a library of electronic works that could be
freely shared with anyone. For forty years, he produced and
distributed Project Gutenberg™ eBooks with only a loose network of
volunteer support.
Project Gutenberg™ eBooks are often created from several printed
editions, all of which are confirmed as not protected by copyright in
the U.S. unless a copyright notice is included. Thus, we do not
necessarily keep eBooks in compliance with any particular paper
edition.

Most people start at our website which has the main PG search
facility: www.gutenberg.org.

This website includes information about Project Gutenberg™,

including how to make donations to the Project Gutenberg Literary
Archive Foundation, how to help produce our new eBooks, and how
to subscribe to our email newsletter to hear about new eBooks.