Control systems for airliners, military aircraft, automobiles, and for the safety of nuclear power plants are typical of the critical digital systems addressed in this paper. These systems are considered safe by the public: their accident rate is sufficiently low that it does not prevent their widespread acceptance. Nevertheless, developers, regulators and users would like to see further improvements in dependability. Accidents of scheduled air carriers are very rare, but when they do occur they are exhaustively investigated. The public record of these investigations is therefore a good starting point for exploring dependability improvement in critical systems. Examples presented in this paper show how current development practices permitted hazardous situations to exist and a methodology for reducing the frequency of such hazards is presented.

Effective fault-management in emerging complex distributed applications requires the ability to dynamically adapt resource allocation and fault tolerance policies in response to possible changes in environment, application requirements, and available resources. This paper presents an architecture framework of an Adaptive Fault Tolerance Management (AFTM) middleware using a CORBA-compliant object request broker resting on the Solaris open system platform. The paper also discusses approaches which have been tested through an AFTM prototyping effort.

Traditional software testing methods combined with probabilistic models cannot measure and assess dependability for software that requires very high reliability (failure rate0.999999). This paper proposes a novel approach, drawing on findings and methods that have been described individually but have never been combined, applied in the late testing phase or early operational phase, to quantify dependability for a category of critical software with such high requirements. The concepts that are integrated are: operational profile, rare conditions, importance sampling, stress testing, and measurement-based dependability evaluation. In the approach, importance sampling is applied on the operational profile to guide the testing of critical operations of the software, thereby accelerating the occurrence of rare conditions which have been shown to be a leading cause of failure in critical systems. The failure rates measured in the testing are then transformed to those that would occur in the normal operation by the likelihood ratio function of the importance sampling theory, and finally dependability for the tested software system is evaluated by using measurement-based dependability modeling techniques. When the acceleration factor is large (over 100), which is typical for a category of software of interest, it is possible to quantify a very high reliability or availability in a reasonable test duration. Some feasible methods to implement the approach are discussed based on real data.

Conventional dependability measures, such as reliability or availability, assume that the equipment characterized by the measure is either operational or has failed. This dichotomy does not hold for decentralized or distributed systems because these can operate in modes in which partial or degraded service is furnished. Whether a specific degraded mode should be counted as "operational" or "failed" is a subjective decision, but this decision can make a large difference in the dependability assessment. Examples show that this affects not only numerical reporting, but also the selection of reliability improvements. A weighted averaging of the dependability measures obtained under various failure criteria is seen to be a workable method for reliability assessment that provides much more stable measures than can be obtained by selection of a single failure criterion.>

Verification and validation activities in defense projects are compared with those in the nuclear power plant industry. A significant difference is that in most defense projects the V&V effort is funded directly by the sponsor whereas in the nuclear power industry the major responsibility for V&V resides with the developer. This may cause a shift in V&V emphasis from early life cycle stages (in defense) to later phases (in the nuclear power industry). The paper shows that there are sufficient similarities to make development of dual use technologies possible.>

A knowledge-gased approach for query processing during network partitioning is proposed. The approach uses available domain and summary knowledge to infer inaccessible data to answer a given query. A rule induction technique is used to extract correlated knowledge between attributes from the database contents. This knowledge is represented as rules for data inference. On the basis of a set of queries, simulation is used to evaluate the effectiveness of the proposed data inference technique for improving data availability under network partitioning. Object allocation has a significant impact on data availability. Allocating objects that increase remote redundancy and reduce local redundancy increases data Availability during network partitioning. A prototype distributed database system that uses the proposed inference technique with correlated knowledge from a ship database has been implemented. Experience indicates that the proposed inference technique can significantly improve the availability of a distributed database during network partitioning.>

A systems approach to the analysis and control of software reliability is described which is intended to supplement conventional software reliability models which focus on program attributes under the control of the software professionals. A review of software reliability experience during the operations and maintenance (O&M) phase is presented. This is followed by a description of a basic failure model that supports a unified approach to software and hardware reliability and of the implications of that model for conventional software reliability approaches. Next, the effect of management activities on reliability is investigated, and an outline of a combined hardware/software reliability model suitable for the planning phase is presented.

A recovery program is a software component of a fault-tolerant computer system which is responsible for establishing an operational hardware configuration and resurrecting the computation interrupted due to component failures. Development of an effective recovery program is made difficult by the unusual input to the program, i.e., a faulty machine whose behavior is undefined. In this paper we present several program design techniques and system recovery strategies that have been found useful in obtaining an easily understandable recovery program. The strategies are first presented in abstract forms and then illustrated with a model and a recovery program for the Fault-Tolerant Spaceborne Computer (FTSC). Because of the difficulty of obtaining a single perfect recovery procedure, the FTSC recovery program is equipped with both an alternate recovery procedure that is used when the primary procedure is not effective, and an acceptance test that determines the need for invoking the alternate.

To aid the computer designer in addressing the proper reliability goals, an economic model is proposed in which any increase in cost for reliability is evaluated against the expected decrease in cost of failure. These criteria are applied in an example to optimize the memory configuration of a computer that has a five-year lifetime requirement in space. An internal figure of merit is developed that can be used by the computer designer when little specific spacecraft and mission data are available. A more general external figure of merit can be used when mission parameters are defined. This latter is useful both for the computer designer and the spacecraft systems engineer.