Three-Layer Reference Model

A reference architecture for self-managed systems proposed in Self-Managed Systems - an Architectural Challenge (Kramer & Magee 2007), adapting Gat’s three-layer architecture from autonomous robotics to self-adaptive software. It separates adaptation concerns by the timescale and abstraction at which they operate:

Component control — the running application; components self-tune and report status, with mechanisms to add, remove, and reconnect components at runtime.
Change management — a set of pre-computed plans that react to status reports and execute reconfigurations; escalates to the layer above when no applicable plan exists.
Goal management — produces new plans from high-level goals (typically slow, deliberative planning) in response to requests from change management or changes in goals.

The model is a widely-cited way to structure the Plan/Execute portions of a MAPE-K loop across abstraction layers, and frames the open research challenges (requirements, assurance, decentralised control) of the field.

In this vault

Backlinks

Linked Pages

A Robust Layered Control System

A Robust Layered Control System for a Mobile Robot

Reference: Brooks, R. A. (1986). A Robust Layered Control System for a Mobile Robot. IEEE Journal of Robotics and Automation, 2(1), pp. 14–23. (Originally MIT AI Lab Memo 864, September 1985.) IEEE DOI · Open access PDF (MIT AI Memo 864)

Summary

Brooks introduces the subsumption architecture — a radical alternative to the sense-plan-act paradigm that dominated robotics through the 1980s. Where the prevailing approach decomposed robot control into functional modules (perception, world modelling, planning, motor control) operating on a single shared symbolic representation, Brooks’s architecture decomposes by behaviour: each layer of the system is a complete sense-act loop implementing one behavioural competence (avoid obstacles, wander, explore, build maps, identify objects, plan, …). Layers run concurrently and are connected by suppression and inhibition wires that allow higher (later-built) layers to subsume the outputs of lower layers. The lowest layer alone produces a useful (if minimal) robot — an obstacle-avoiding wanderer; each additional layer adds more sophisticated competence on top of an already-functional system. There is no central representation, no shared world model, no symbolic planner driving low-level action. Brooks demonstrated the architecture on a real mobile robot (Allen, the AI Lab’s first subsumption-architecture robot) navigating a cluttered office environment in real time — performance unattainable by the symbolic-AI robots of the era. The 1986 paper is the formal architecture description; the underlying philosophical thesis — that intelligent behaviour does not require explicit representation, that the world is its own best model — is developed in the 1991 follow-ups Intelligence Without Representation and Elephants Don’t Play Chess. The subsumption architecture inaugurated behaviour-based robotics as a research programme, influenced multi-agent systems through the reactive vs deliberative agents distinction, and supplied a substantial counter-tradition to BDI-style symbolic agency.

Key Ideas

Decomposition by behaviour, not function: each layer is a complete sense-act loop implementing one behavioural competence; functional decomposition (perception / planning / control) is rejected as the wrong organising principle.
Layered competence: layer 0 is a working (minimal) robot; each subsequent layer adds capability on top of an already-running system. The N-layer system always behaves at least as well as the (N-1)-layer system.
Suppression and inhibition wires: inter-layer communication is by suppression (a higher layer’s output replaces a lower layer’s signal at the suppression node for a fixed time) and inhibition (a higher layer’s signal blocks a lower layer’s output without substituting). No higher-bandwidth representation passes between layers.
No central representation: there is no shared world model. Each layer maintains its own state as needed; cross-layer communication is restricted to the suppression/inhibition primitive.
The world is its own best model: rather than maintain symbolic representations of the world, the robot perceives the world directly when it needs to act on it. Eliminates the symbol-grounding problem and the cost of keeping a world model synchronised with reality.
Real-time, real-environment demonstration: the architecture was demonstrated on Allen, then Herbert, then later the Cog humanoid project — operating in real environments in real time, with performance that the dominant symbolic-AI robotics could not match.
Modular evolution-friendly architecture: layers can be added or removed without modifying others; the architecture is robust to layer failure (the next-lower layer continues to operate). Brooks frames this as an evolutionary architecture in which more sophisticated competences accrete on top of basic survival competences.

Connections

Conceptual Contribution

Claim: Intelligent robot behaviour can be built by decomposing along behavioural competence rather than functional modules: each layer is a complete sense-act loop, layers run concurrently, higher layers subsume lower ones via suppression/inhibition, and there is no central symbolic representation. The architecture is incremental, evolution-friendly, and demonstrably outperforms symbolic-AI robotics in real-time real-world tasks.
Mechanism: Concurrent finite-state-machine layers each implementing one behavioural competence; suppression nodes (replace) and inhibition nodes (block) for inter-layer interaction; no shared world model; demonstration on real mobile robots (Allen, Herbert) in real environments.
Concepts introduced/used: Subsumption Architecture, Behaviour-Based Robotics, Reactive vs Deliberative Agents (the dichotomy this paper inaugurated), Suppression / Inhibition Networks, Layered Competence, Embodiment.
Stance: systems-engineering paper / programmatic break with symbolic-AI orthodoxy.
Relates to: Inaugurates the reactive (or behaviour-based) tradition in agent architectures, opposed at the time to the deliberative / symbolic tradition that produced BDI agents (Rao & Georgeff 1991, Cohen & Levesque 1990) and Agent-Oriented Programming (Shoham 1993). The dichotomy is now mostly resolved as a layered hybrid (3T architecture, BDI with reactive lower layers), but the historical break drove the conceptual repertoire of MAS for two decades. Conceptually adjacent to The Society of Mind (Minsky 1986) — both treat intelligence as the cooperation of many simple specialised agents, though Minsky’s society of agents are still symbolic where Brooks’s subsumption layers are not. The 1991 follow-ups Intelligence Without Representation (already in vault as Intelligence Without Representation) and Elephants Don’t Play Chess extend the philosophical critique. In modern multi-agent systems, the reactive vs deliberative distinction underwrites the design of LLM-agent architectures: the contemporary debate over chain-of-thought / planner-decoupling / tool-use vs end-to-end-trained reactive agents recapitulates Brooks’s polemic with new vocabulary.

In this vault

Autonomic Computing

A software-engineering tradition, launched by IBM’s 2001 manifesto and crystallised in The Vision of Autonomic Computing (Kephart & Chess 2003), that responds to spiralling system complexity by building systems that manage themselves given high-level objectives. The biological metaphor is the autonomic nervous system: low-level regulation happens without conscious control so the administrator specifies what is wanted, not how to achieve it.

Autonomic systems are organised as MAPE-K loops — autonomic managers regulating managed elements — and are judged by the self- properties*: self-configuration, self-healing, self-optimisation, and self-protection (collectively “self-CHOP”). The tradition is the engineering counterpart to the biology-inspired Self-Adaptive Systems line already in this vault: where the latter asks why systems adapt, autonomic computing asks how you build and assure the adaptation.

In this vault

Rainbow - Architecture-Based Self-Adaptation with Reusable Infrastructure

Rainbow: Architecture-Based Self-Adaptation with Reusable Infrastructure

Reference: Garlan, D., Cheng, S.-W., Huang, A.-C., Schmerl, B. & Steenkiste, P. (2004). Rainbow: Architecture-Based Self-Adaptation with Reusable Infrastructure. IEEE Computer 37(10): 46–54. DOI: 10.1109/MC.2004.175. URL

Summary

Rainbow is a framework for adding self-adaptation to existing systems by using an architectural model of the target system as the basis for monitoring, problem detection, and repair. Its core claim is that a software architecture — components, connectors, and properties — is the right level of abstraction for reasoning about system-wide adaptation: it is abstract enough to be tractable and to express global constraints (latency, cost, availability), yet concrete enough to map to real system elements. This is a concrete realisation of the MAPE-K loop where the architecture is the runtime model (see Models@run.time).

The framework provides a reusable infrastructure with clearly separated, customisable parts. Probes instrument the running system; gauges aggregate probe readings into updates on the architectural model; a model manager maintains the architecture; a constraint evaluator checks the model against invariants and triggers adaptation when they are violated; and an adaptation engine selects and carries out repairs through system-level effectors. Rainbow separates this generic machinery from a system-specific adaptation knowledge layer — the architectural style, constraints, and repair strategies — so the same infrastructure can be retargeted to different systems at much lower cost than bespoke, code-level adaptation.

Rainbow’s key engineering contribution is thus reuse: rather than weaving adaptation logic into application code, developers supply an architectural model, a set of constraints, and a library of repair strategies, and the shared infrastructure supplies the control loop. The approach is later extended with utility-based strategy selection and the Stitch adaptation language, and exercised on canonical exemplars such as the Znn.com news-service testbed, which together made Rainbow the reference example of architecture-based self-adaptation.

Key Ideas

Architecture as the locus of adaptation: reason about the system through its component-and-connector model, not its source.
Reusable control-loop infrastructure: probes, gauges, model manager, constraint evaluator, adaptation engine, effectors.
Separation of generic mechanism from system-specific adaptation knowledge (style, constraints, strategies) — the source of reuse and low retargeting cost.
Constraint-triggered repair: violated architectural invariants drive selection of a repair strategy.
Externalised adaptation: the adaptation logic lives outside the target system, keeping the application unchanged.
Later refinements: utility-based strategy selection and the Stitch strategy language; Znn.com as the standard testbed.

Connections

Conceptual Contribution

Claim: Self-adaptation should be engineered at the architectural level using a reusable framework: a runtime model of the system’s architecture, plus system-specific constraints and repair strategies, lets the same adaptation infrastructure be retargeted across systems instead of hand-coded each time.
Mechanism: Probes instrument the system; gauges update an architectural model; a constraint evaluator detects invariant violations; an adaptation engine selects repair strategies and enacts them via effectors — a MAPE-K loop over an architectural runtime model, with generic infrastructure cleanly separated from a customisable adaptation-knowledge layer.
Concepts introduced/used: Architecture-Based Adaptation, MAPE-K, Models@run.time, Software Architecture, Constraint Evaluation, Utility Function
Stance: engineering / framework
Relates to: The canonical architecture-based exemplar of The Vision of Autonomic Computing; complements the layered separation of concerns in Self-Managed Systems - an Architectural Challenge and sits inside the taxonomy of Self-Adaptive Software - Landscape and Research Challenges. Its “architecture as formal artefact” stance rhymes with pattern-based dependability in Architectural Patterns for Dependable Software Systems - SOL.

Self-Managed Systems - an Architectural Challenge

Self-Managed Systems: an Architectural Challenge

Reference: Kramer, J. & Magee, J. (2007). Self-Managed Systems: an Architectural Challenge. In Future of Software Engineering (FOSE ’07), at ICSE 2007, pp. 259–268. DOI: 10.1109/FOSE.2007.19. URL

Summary

Kramer and Magee frame self-management as fundamentally an architectural problem and offer a reference model for structuring it. Building on their work on dynamic software architecture — systems whose components and connectors can be added, removed, and rewired at runtime — they argue that self-configuration, self-healing, and self-optimisation are best organised around explicit architectural change rather than ad-hoc code.

Their central proposal is a three-layer reference model (see Three-Layer Reference Model), adapted from Gat’s three-layer architecture in autonomous robotics. The bottom component-control layer is the running application, instrumented to report status and to reconfigure itself. The middle change-management layer holds a repertoire of pre-computed plans that respond to status reports and effect reconfigurations, escalating upward when it has no plan for the situation. The top goal-management layer synthesises new plans from high-level goals via (slower) deliberative planning. Separating layers by timescale and abstraction lets fast reactive adaptation and slow deliberative planning coexist cleanly.

The paper is as much an agenda as an architecture. Kramer and Magee catalogue the hard open problems this structure exposes — deriving correct plans from goals, guaranteeing consistency and safety during runtime reconfiguration, managing decentralised control across many self-managed components, and eliciting and evolving the goals themselves — positioning assurance of self-adaptive behaviour as a first-order software-engineering challenge.

Key Ideas

Self-management is an architectural problem, grounded in dynamic (runtime-reconfigurable) software architecture.
Three-layer reference model: component control → change management → goal management, borrowed from robotics.
Separation by timescale/abstraction: fast reactive plan execution below, slow deliberative planning above; escalation when no plan applies.
Runtime reconfiguration must preserve consistency and safety of the executing system.
A research agenda: plan synthesis from goals, assurance, decentralised control, goal elicitation and evolution.

Connections

Conceptual Contribution

Claim: Self-managed systems should be structured as a three-layer architecture that separates component control, change management, and goal management — matching each adaptation concern to the timescale and abstraction at which it operates.
Mechanism: A dynamically reconfigurable component layer reports status upward; a change-management layer applies pre-computed plans and escalates when none fit; a goal-management layer generates new plans from high-level goals through deliberative planning — a layered decomposition of the Plan/Execute half of a MAPE-K loop.
Concepts introduced/used: Three-Layer Reference Model, Dynamic Software Architecture, MAPE-K, Runtime Reconfiguration, Goal Management
Stance: architecture / research agenda
Relates to: Gives The Vision of Autonomic Computing a concrete reference architecture and complements the reusable-infrastructure stance of Rainbow - Architecture-Based Self-Adaptation with Reusable Infrastructure; the robotics lineage connects to layered control in A Robust Layered Control System; its open problems are surveyed in Self-Adaptive Software - Landscape and Research Challenges.

Three-Layer Reference Model

In this vault

Related

Backlinks