Summary form only given. ReSIST is a network of excellence that integrates leading researchers active in the multidisciplinary domains of dependability, security, and human factors, in order that Europe will have a well-focused coherent set of research activities aimed at ensuring that future ubiquitous computing systems (the immense systems of ever-evolving networks of computers and mobile devices which are needed to support and provide ambient intelligence), have the necessary resilience and survivability, despite any residual development and physical faults, interaction mistakes, or malicious attacks and disruptions

The current state-of-knowledge and state-of-the-art reasonably enable the construction and operation of critical systems, be they safety-critical or availability-critical. The situation drastically worsens when considering large, networked, evolving, systems either fixed or mobile, with demanding requirements driven by their domain of application. There is statistical evidence that these emerging systems suffer from a significant drop in dependability and security in comparison with the former systems. The cost of failures in service is growing rapidly, as a consequence of the degree of dependence placed on computing systems, up to several million euros per hour of downtime for some businesses

Summary form only given. Our society is faced with an ever increasing dependence on computing systems, which lead to question ourselves about the limits of their dependability, and about the challenges raised by those limits. In order to respond these questions, a global conceptual and terminological framework is needed, which is first given. The limits and challenges in dependability are then addressed, from technical and economics viewpoints. Directions are finally given in order to respond to the challenges

This paper gives the main definitions relating to dependability, a generic concept including a special case of such attributes as reliability, availability, safety, integrity, maintainability, etc. Security brings in concerns for confidentiality, in addition to availability and integrity. Basic definitions are given first. They are then commented upon, and supplemented by additional definitions, which address the threats to dependability and security (faults, errors, failures), their attributes, and the means for their achievement (fault prevention, fault tolerance, fault removal, fault forecasting). The aim is to explicate a set of general concepts, of relevance across a wide range of situations and, therefore, helping communication and cooperation among a number of scientific and technical communities, including ones that are concentrating on particular types of system, of system failures, or of causes of system failures.

The paper presents a development model focused on the production of dependable systems. Three classes of processes are distinguished: 1) the system creation process which builds on the classical development steps (requirements, design, realization, integration); 2) dependability processes (i.e., fault prevention, fault tolerance, fault removal and fault forecasting); and 3) other supporting processes such as quality assurance and certification. The proposed approach relies on the identification of basic activities for the system creation process and for the dependability processes, and then on the analysis of the interactions among the activities of each process and with the other processes. Finally, to support the development of dependable systems, we define for each system creation activity, a checklist that specifies the key issues related to fault prevention, fault tolerance, fault removal, and fault forecasting, that need to be addressed.

This study addresses the use of fault injection for explicitly removing design/implementation faults in complex fault-tolerance algorithms and mechanisms (FTAM), viz, fault-tolerance deficiency faults. A formalism is introduced to represent the FTAM by a set of assertions. This formalism enables an execution tree to be generated, where each path from the root to a leaf of the tree is a well-defined formula. The set of well-defined formulas constitutes a useful framework that fully characterizes the test sequence. The input patterns of the test sequence (fault and activation domains) then are determined to fewer specific structural criteria over the execution tree (activation of proper sets of paths). This provides a framework for generating a functional deterministic test for programs that implement complex FTAM. This methodology has been used to extend a debugging tool aimed at testing fault tolerance protocols developed by BULL France. It has been applied successfully to the injection of faults in the inter-replica protocol that supports the application-level fault-tolerance features of the architecture of the ESPRIT-funded Delta-4 project. The results of these experiments are analyzed in detail. In particular, even though the target protocol had been independently verified formally, the application of the proposed testing strategy revealed two fault-tolerance deficiency faults.

Our society is faced with an ever increasing dependence on computing systems, which lead to questions about the limits of their dependability, and to attempt to identify avenues for improving the situation. In order to respond to these questions, a global conceptual and terminological framework is needed, which is first given. The limits in dependability are then addressed from technical and financial viewpoints. The identification of design faults as the current major bottleneck for dependability leads to: a) address the limits in software reliability and in fault tolerance effectiveness, and to b) suggest a dependability explicit development model.

This paper addresses the problem of reliability growth characterization and analysis. It is intended to show how reliability trend analyses can help the project manager in controlling the progress of the development activities and in appreciating the efficiency of the test programs. Reliability trend change may result from various reasons, some of them are desirable and expected (such as reliability growth due to fault removal) and some of them are undesirable (such as slowing down Of the testing effectiveness). Identification in time of the latter allows the project manager to take the appropriate decisions very quickly in order to avoid problems which may manifest later. The notions of reliability growth over a given interval and local reliability trend change are introduced through the subadditive property, allowing: better definition and understanding of the reliability growth phenomena; the already existing trend tests are then revisited using these concepts. Emphasis is put on the way trend tests can be used to help the management of the testing and validation process and on practical results that can be derived from their use; it is shown that, for several circumstances, trend analyses give information of prime importance to the developer.>

This paper describes the different steps in software failure data processing in order to monitor the software development and to quantify the operational reliability. Processing consists in (a) filtering the raw data in order to keep only those corresponding to software failures without duplicate, (b) partitioning of data into sub-sets according for instance to failure severity or fault location, (c) performing descriptive analyses, (d) analyzing the trend and (e) when possible and needed, applying reliability growth models. These steps are part of an overall method experienced at LAAS on several real-life software systems. The goals of the paper are twofold: first, present the method and, second, show its benefits through its application to data collected on a switching system.

The authors describe a dependability evaluation method based on fault injection that establishes the link between the experimental evaluation of the fault tolerance process and the fault occurrence process. The main characteristics of a fault injection test sequence aimed at evaluating the coverage of the fault tolerance process are presented. Emphasis is given to the derivation of experimental measures. The various steps by which the fault occurrence and fault tolerance processes are combined to evaluate dependability measures are identified and their interactions are analyzed. The method is illustrated by an application to the dependability evaluation of the distributed fault-tolerant architecture of the Esprit Delta-4 Project.>

Current techniques for reliability are based purely upon the single software product itself, and their capability falls beneath most reliability requirements. It is proposed to augment these techniques by explicitly taking account of the process in the quantitative assessment. The application of this approach to safety-critical software is discussed.>

The problem of modeling a system's reliability and availability with respect to the various classes of faults (physical and design, internal and external) which may affect the service delivered to its users is addressed. Hardware and software models are currently exceptions in spite of the user's requirements; these requirements are expressed in terms of failures independently of their sources, i.e., the various classes of faults. The causes of this situation are analyzed; it is shown that there is no theoretical impediment to deriving such models, and that the classical reliability theory can be generalized in order to cover both hardware and software viewpoints that are X-Ware.>

An approach for the modeling and evaluation of reliability and availability of systems using the knowledge of the reliability growth of their components is presented. Detailed models of reliability and availability for single-component systems are derived under much weaker assumption than usually considered. These models, termed knowledge models, enable phenomena to be precisely characterized, and a number of properties to be deduced. Since the knowledge models are too complex to be applied in real life for performing predictions, simplified models for practical purposes (action models) are discussed. The hyperexponential model is presented and applied to field data of software and hardware failures. This model is shown to be comparable to other models as far as reliability of single-component systems is concerned: in addition, it enables estimating and predicting the reliability of multicomponent systems, as well as their availability. The transformation approach enables classical Markov models to be transformed into other Markov models which account for reliability growth. The application of the transformation to multicomponent systems is described.>

Dependability modeling and evaluation (encompassing reliability and safety issues) of the two major fault tolerance software approaches-recovery blocks (RBs) and N version programming (NVP)-are presented. The study is based on the detailed analysis of software fault-tolerance architectures able to tolerate a single fault (RB: two alternates and an acceptance test; NVP: three versions and a decider). For each approach a detailed model based on the software production process is established and then simplified by assuming that only a single fault type may manifest during execution of the fault-tolerant software and that no error compensation may take place within the software. The analytical results obtained make it possible to identify the improvement, compared to a non-fault-tolerant software, that could result from the use of RB (the acceptance test has to be more reliable from the alternates) and NVP (related faults among the versions and the decider have to be minimized) and to determine the most critical types of related faults. Nested RBs are studied, showing that the proposed analysis approach can be applied to such realistic software structures and that when an alternate is itself an RB, the results are analogous to the case of the addition of a third alternate. The reliability analysis shows that only a small improvement can be expected.>

The authors address the problem of validating the dependability of fault-tolerant computing systems, in particular, the validation of the fault-tolerance mechanisms. The proposed approach is based on the use of fault injection at the physical level on a hardware/software prototype of the system considered. The place of this approach in a validation-directed design process and with respect to related work on fault injection is clearly identified. The major requirements and problems related to the development and application of a validation methodology based on fault injection are presented and discussed. Emphasis is put on the definition, analysis, and use of the experimental dependability measures that can be obtained. The proposed methodology has been implemented through the realization of a general pin-level fault injection tool (MESSALINE), and its usefulness is demonstrated by the application of MESSALINE to the experimental validation of two systems: a subsystem of a centralized computerized interlocking system for railway control applications and a distributed system corresponding to the current implementation of the dependable communication system of the ESPRIT Delta-4 Project.>

This paper is composed of two sections. The first provides a conceptual framework for expressing the attributes of what constitutes dependable and reliable computing: a) the impairments to dependability (faults, errors, and failures), b) the means for dependability (fault avoidance, tolerance, removal, and forecasting), and c) the measures of dependability (reliability, availability, safety). The second section focuses on one of the most challenging problems for dependable computing: coping with design faults.

This paper deals with evaluation of the dependability (considered as a generic term, whose main measures are reliability, availability, and maintainability) of software systems during their operational life, in contrast to most of the work performed up to now, devoted mainly to development and validation phases. The failure process due to design faults, and the behavior of a software system up to the first failure and during its life cycle are successively examined. An approximate model is derived which enables one to account for the failures due to the design faults in a simple way when evaluating a system's dependability. This model is then used for evaluating the dependability of 1) a software system tolerating design faults, and 2) a computing system with respect to physical and design faults.

Modeling of systems featuring hardware and software faults is studied as a means of evaluating the availability and reliability characteristics. The case of a nonredundant computer is studied and it is shown that the unavailability presents an overshoot with respect to its asymptotic value whose height and length are functions of the failure rates associated with the different design errors. Fault-tolerant systems are studied that include protective redundancies both at the hardware level and at the software level; the importance of homogeneous solutions on both levels is shown.