SUMMARY A software development organization's process trustworthiness can be enhanced through development project retrospectives or postmortems, which seek to produce lessons from mistakes and successes in the project performance. Tool support for such retrospectives is usually limited to qualitative analysis. A new model, Dynamic COQUALMO, offers quantitative support through a defectivity profile that can be calibrated to a project's actual profile of defects found over time. The model inputs can then be varied to represent alternative project decisions and conditions, providing a basis for estimating the effects of project improvements on product quality. This paper describes Dynamic COQUALMO and demonstrates its use in a project retrospective. Copyright © 2010 John Wiley & Sons, Ltd.

Cyberphysical (embedded) computer system availability and reliability can be modeled and assessed using the Architecture Analysis and Design Language (AADL) and its Error Model Annex. AADL can represent systems at multiple levels of abstraction. Therefore, analyses can be performed early and often throughout the development process thereby minimizing the cost and schedule impact of changes. We discuss how the AADL and its Error Model Annex can be used for automated generation of a reliability/dependability model. We then describe a tool set to graphically create AADL system architecture and error behavior files that are then transformed into Stochastic Petri Nets (SPN) and Stochastic Activity Network (SAN) representations and demonstrate its use using a generic satellite as an example.

We describe a specific application of assurance cases to the problem of ensuring that a transition from a legacy system to its replacement will not compromise mission assurance objectives. The application in question was the transition of the Global Positioning System (GPS) to a new ground-control system. The transition, which took place over five days, required uninterrupted control of the GPS satellite constellation while control was transferred from a 1970s-era mainframe to a distributed architecture. We created an assurance case so that the procedural documentation we had could be restructured into a form amenable to analysis. The analysis concluded that there were no major hazards; this conclusion was validated by a successful transition.

Describes OFTT (OLE Fault Tolerance Technology), a fault tolerance middleware toolkit running on the Microsoft Windows NT operating system that provides the required fault tolerance for networked PCs in the context of industrial process monitoring and control applications. It is based on the Microsoft Component Object Model (COM) and consists of components that perform checkpoint-saving, failure detection, recovery and other fault tolerance functions. The ease with which this technology can be incorporated into an application represents the primary innovation. It is hoped that, by making fault tolerance more compatible with standard software architectures, more reliable PC-based monitoring and control systems can be built conveniently.

Conventional dependability measures, such as reliability or availability, assume that the equipment characterized by the measure is either operational or has failed. This dichotomy does not hold for decentralized or distributed systems because these can operate in modes in which partial or degraded service is furnished. Whether a specific degraded mode should be counted as "operational" or "failed" is a subjective decision, but this decision can make a large difference in the dependability assessment. Examples show that this affects not only numerical reporting, but also the selection of reliability improvements. A weighted averaging of the dependability measures obtained under various failure criteria is seen to be a workable method for reliability assessment that provides much more stable measures than can be obtained by selection of a single failure criterion.>

Verification and validation activities in defense projects are compared with those in the nuclear power plant industry. A significant difference is that in most defense projects the V&V effort is funded directly by the sponsor whereas in the nuclear power industry the major responsibility for V&V resides with the developer. This may cause a shift in V&V emphasis from early life cycle stages (in defense) to later phases (in the nuclear power industry). The paper shows that there are sufficient similarities to make development of dual use technologies possible.>

A fault-tolerant architecture that provides tolerance to a broad scope of hardware, software, and communications faults is being developed. This architecture relies on widely available commercial operating systems, local area networks, and software standards. Thus development time is significantly shortened, and modularity allows for continuous and inexpensive system enhancement throughout the expected 20-year life. The fault-containment and parallel-processing capabilities of computers are exploited to provide a high-performance, high-availability network capable of tolerating a broad scope of hardware, software, and operating system faults. The system can tolerate all but one known (and avoidable) single fault, two known and avoidable dual faults, and it will detect all higher-order fault sequences and provide diagnostics to allow for rapid manual recovery.>

A systems approach to the analysis and control of software reliability is described which is intended to supplement conventional software reliability models which focus on program attributes under the control of the software professionals. A review of software reliability experience during the operations and maintenance (O&M) phase is presented. This is followed by a description of a basic failure model that supports a unified approach to software and hardware reliability and of the implications of that model for conventional software reliability approaches. Next, the effect of management activities on reliability is investigated, and an outline of a combined hardware/software reliability model suitable for the planning phase is presented.