A survey of our joint research work with Maria Serna on uncertain systems is presented in this paper. The study was originally motivated by a wish to understand the behaviour of a large web application when some of its component parts were subject to external attack (resulting in component degradation or even failure). In the absence of a priori failure information it is possible to constrain system behaviour between the best and worst possible outcomes.

Uncertain, multi-component systems can be modelled by orchestrations; an orchestration is a computation which operates in a globally-accessible, multi-user environment. When executed it calls a number of web-services and co-ordinates their responses. The behaviour of computations in web-environments can be highly uncertain: external web-services may be subject to periodic denial of service attacks and network failures, resulting in delayed, or even null, responses.

The reliability of an orchestration can be measured by assessing either the completeness of its behaviour (the number of computed results) or its response time (execution time). The behaviour of a system is assessed prior to execution (ex-ante) by modelling an unreliable web-environment as a parameterised uncertainty profile $\mathcal{U}$. The parameters of $\mathcal{U}$ bound the extent of behavioural damage that can occur to an orchestration in a faulty environment. Informally speaking $\mathcal{U}$ provides a blurred snapshot of operating conditions. An uncertainty profile $\mathcal{U}$ can be assessed using a two player angel/daemon ($\mathfrak{a}∕\mathfrak{d}$) zero-sum game $\Gamma \left(\mathcal{U}\right)$: player $\mathfrak{a}$ is motivated to maximise the behaviour of the orchestration whereas player $\mathfrak{d}$ has the opposite intent. Uncertainty profiles have been applied to design a resilient matrix-product cloud application. The approach has also been applied to situations in social sciences, such as short-time macroeconomics (the IS-LM model) and voting games.

本文介绍了我们与玛丽亚·塞纳（Maria Serna）关于不确定系统的联合研究工作的概况。这项研究的最初动机是希望了解大型Web应用程序的某些组成部分受到外部攻击（导致组件降级甚至失效）时的行为。在没有先验故障信息的情况下，可以将系统行为限制在最佳结果和最坏结果之间。

不确定的多组件系统可以通过业务流程建模；业务流程是在全局可访问的多用户环境中运行的计算。执行时，它会调用许多Web服务并协调其响应。Web环境中的计算行为可能非常不确定：外部Web服务可能会定期遭到服务攻击和网络故障的拒绝，从而导致响应延迟甚至无效。

编排的可靠性可以通过评估其行为的完整性（计算结果的数量）或其响应时间（执行时间）来衡量。在执行之前（事前），通过将不可靠的网络环境建模为参数化的不确定性概况来评估系统的行为 $\mathcal{ü}$。参数$\mathcal{ü}$限制了在错误环境中业务流程可能发生的行为损坏程度。非正式地讲$\mathcal{ü}$提供操作条件的模糊快照。不确定性$\mathcal{ü}$ 可以使用两个玩家的天使/守护进程进行评估（$\mathfrak{一种}∕\mathfrak{d}$） 零和博弈 $\Gamma （\mathcal{ü}）$：玩家 $\mathfrak{一种}$ 有动机去最大化编排的行为，而玩家 $\mathfrak{d}$有相反的意图。不确定性配置文件已用于设计弹性矩阵产品云应用程序。该方法还已应用于社会科学中的情况，例如短期宏观经济学（IS-LM模型）和投票游戏。