Modern computing systems typically utilize a large number of computing nodes to perform coordinated computations in parallel or simultaneously. They can exhibit multiple performance states or levels due to statuses or failures of their consistent nodes. Performability analysis is concerned with assessing the probability that the computing system performs at a particular performance level. In the context of performability analysis, these computing systems can be modeled using k-to-l-out-of-n structures. This paper proposes new analytical methods based on binary decision diagrams (BDD) for the performability analysis of large computing systems with unrepairable computing nodes. A new and efficient BDD algorithm that makes full uses of the special k -to-l-out-of-n structure is first proposed for systems with computing node having identical computing powers. New simplification rules are further proposed to generate compact and canonical BDD models for systems with heterogeneous computing nodes characterized by different computing powers. Ordering heuristic is also explored to further reduce the size of BDD models. Examples are provided to illustrate the proposed BDD-based performability analysis methodology as well as its efficiency in analyzing large-scale computing systems.

Functional dependence occurs when the failure of one component causes other components within the same system to become inaccessible or unusable. It is one of the dynamic behaviors that have been recognized in the dynamic fault tree analysis, where a dynamic gate called FDEP was designed to model such behavior. Traditional approaches to handling functional dependence in the reliability analysis of fault-tolerant systems with imperfect fault coverage are mainly based on Markov models, which are often computationally intensive, and even intractable due to the well-known state space explosion problem. In addition, the Markov-based approaches are typically restricted to exponential time-to-failure distributions for system components. In this paper, a combinatorial, separable method based on the divide-and-conquer paradigm and total probability theorem is proposed for addressing the above problems. The proposed method obviates the use of inefficient Markov models, offering exact, computationally-efficient solutions to the reliability analysis of imperfect coverage systems subject to functional dependencies. The proposed method is applicable to the analysis of large systems with any arbitrary time-to-failure distributions. Several case studies are given to illustrate the application and advantages of the proposed method.

Many practical systems are phased-mission systems with multimode failures (MFPMSs) where the mission consists of multiple nonoverlapping phases of operation, and the system components may assume more than one failure mode. In MFPMSs, dependence arises among different phases and among different failure modes of the same component, which makes the reliability analysis of MFPMSs difficult. This paper proposes a new analytical method based on multivalued decision diagrams (MDDs) for the reliability analysis of nonrepairable MFPMSs. MDDs have recently been applied to the reliability analysis of single-phase systems with multiple component states. In this paper, we make the new contribution by proposing a novel way to adapt MDDs for the reliability analysis of systems with multiple phases and multimode failures. Examples show how the MDD models are generated and evaluated to obtain the mission reliability measures. Performance of the MDD-based method is compared with an existing binary decision diagram (BDD)-based method for MFPMS analysis through several examples and a comprehensive benchmark study. Empirical results show that the proposed MDD-based method can offer lower computational complexity and simpler model construction and evaluation algorithms than the BDD-based method, and it can be effectively applied to large practical cases.

Many real-world systems, particularly those with limited power resources, are designed with cold-standby redundancy for achieving fault tolerance and high reliability. Cold-standby units are unpowered and, thus, do not consume any power until needed to replace a faulty online component. Cold-standby redundancy creates sequential dependence between the online component and standby components; in particular, a standby component can start to work and then fail only after the online component has failed. Traditional approaches to handling the cold-standby redundancy are typically state-space-based or simulation-based or inclusion/exclusion-based methods. Those methods, however, have the state-space explosion problem and/or require long computation time particularly when results with a high degree of accuracy are desired. In this paper, we propose an analytical method based on sequential binary decision diagrams (SBDD) for combinatorial reliability analysis of nonrepairable cold-standby systems. Different from the simulation-based methods, the proposed approach can generate exact system reliability results. In addition, the system SBDD model and reliability evaluation expression, once generated, are reusable for the reliability analysis with different component failure parameters. The approach has no limitation on the type of time-to-failure distributions for the system components or on the system structure. Application and advantages of the proposed approach are illustrated through several case studies.

The GOAL (Guided On-Demand Adaptive Learning) project produced three computer-based instruction modules for use in a course on Digital Logic Design. GOAL modules teach concepts interactively, provide exploratory interactive activities, and present material in a style that best matches the student's preferences. In addition, GOAL allows the student to set the pace, providing more detail and explanation when needed, moving quickly when possible. GOAL also can evaluate knowledge through assessment activities, allowing a student to earn validated credits for demonstrated mastery of material. Evaluation of the data collected during three semesters of student trials suggest that students using GOAL can achieve comparable learning in significantly less time. than traditional classroom lectures.

In the above titled paper (ibid., vol 55, no. 1, pp. 86-97, Mar 06), a few errors and typos occurred. The corrections are presented here.

We present a methodology for Bayesian analysis of software quality. We cast our research in the broader context of constructing a causal framework that can include process, product, and other diverse sources of information regarding fault introduction during the software development process. In this paper, we discuss the aspect of relating internal product metrics to external quality metrics. Specifically, we build a Bayesian network (BN) model to relate object-oriented software metrics to software fault content and fault proneness. Assuming that the relationship can be described as a generalized linear model, we derive parametric functional forms for the target node conditional distributions in the BN. These functional forms are shown to be able to represent linear, Poisson, and binomial logistic regression. The models are empirically evaluated using a public domain data set from a software subsystem. The results show that our approach produces statistically significant estimations and that our overall modeling method performs no worse than existing techniques.

We present a continuous-time Bayesian network (CTBN) framework for dynamic systems reliability modeling and analysis. Dynamic systems exhibit complex behaviors and interactions between their components; where not only the combination of failure events matters, but so does the sequence ordering of the failures. Similar to dynamic fault trees, the CTBN framework defines a set of 'basic' BN constructs that capture well-defined system components' behaviors and interactions. Combining, in a structured way, the various 'basic' Bayesian network constructs enables the user to construct, in a modular and hierarchical fashion, the system model. Within the CTBN framework, one can perform various analyses, including reliability, sensitivity, and uncertainty analyses. All the analyses allow the user to obtain closed-form solutions.

This paper proposes a new algorithm (DEP-BDD) based on binary decision diagram (BDD) for reliability analysis of phased-mission systems (PMS) with multimode failures. DEP-BDD is a BDD-based combinatorial model which can be used to deal with more than one kind of dependences by applying dependence algebra, which is a generalization of phase algebra that handles more complex dependences. The nature of the BDD contributes the efficiency and low computational complexity of this algorithm. Two examples are analysed to illustrate the applications and advantages of our approach.

We present the basics of a probabilistic methodology to assess the overall quality of software preparatory to its release through the evaluation of process and product evidence, the ‘Good Enough’ to Release" (GETR) Methodology, in this paper. GETR Methodology has three main elements: a model whose elements represent activities and artifacts identified in the literature as being effective assessors of software quality, a process for populating certain parts of the model, and methods for analyzing the importance of contributions made by individual evidence to the determination of overall system quality. First, the methodology’s components are briefly introduced. A demonstration of how the methodology can be applied is then given through two case studies reviewing release assessments for inhouse developed analytical tools. The robustness of the model is also illustrated by the results of the case studies.

In this paper, we describe how Bayesian networks can be used to merge quantitative and qualitative information to support IV&V of use cases. Essentially, simple metrics from the use cases are computed, which are then input to a Bayesian network. This network models the relationships between the observable parameters of an IV&V process for use cases, and the desired features of the requirements specifications. The output of the network is an assessment of the maturity of the requirements, in terms of the probability that they exhibit the desired properties. We apply our proposed approach to a real system: a software simulator built to test attitude control for an aerospace system, to illustrate how IV&V can be quantitatively supported

The design of quality digital systems depends on models that accurately evaluate various options in the design space against a set of prioritized metrics. While individual models for evaluating area, performance, reliability, power, etc. are well established, models combining multiple metrics are less mature. This paper introduces a formal methodology for comprehensively analyzing performance, area and reliability in the design of synchronous dataflow systems using a novel Markov Reward Model. A Markov chain system reliability model is constructed for various design options in the presence of possible component failures, and high-level synthesis techniques are used to associate performance and area rewards with each state in the chain. The cumulative reward for a chain is then used to evaluate the corresponding design option with respect to the metrics of interest. Application of the model to a benchmark DSP circuit provides insights into reliable synchronous dataflow system design.

Binary Decision Diagram (BDD)-based solution approaches and Markov chain based approaches are commonly used for the reliability analysis of multi-phase systems. These approaches either assume that every phase is static, and thus can be solved with combinatorial methods, or assume that every phase must be modeled via Markov methods. If every phase is indeed static, then the combinatorial approach is much more efficient than the Markov chain approach. But in a multi-phased system, using currently available techniques, if the failure criteria in even one phase is dynamic, then a Markov approach must be used for every phase. The problem with Markov chain based approaches is that the size of the Markov model can expand exponentially with an increase in the size of the system, and therefore becomes computationally intensive to solve. Two new concepts, phase module and module joint probability, are introduced in this paper to deal with the s-dependency among phases. We also present a new modular solution to nonrepairable dynamic multi-phase systems, which provides a combination of BDD solution techniques for static modules, and Markov chain solution techniques for dynamic modules. Our modular approach divides the multi-phase system into its static and dynamic subsystems, and solves them independently; and then combines the results for the solution of the entire system using the module joint probability method. A hypothetical example multi-phase system is given to demonstrate the modular approach.

This paper discusses some of the difficulties in the paper: "A BDD-based algorithm for reliability analysis of phased-mission systems" by X. Zang, H. Sun, and K. S. Trivedi.

This paper considers the reliability analysis of a generalized phased-mission system (GPMS) with two-level modular imperfect coverage. Due to the dynamic behavior & the statistical dependencies, generalized phased-mission systems offer big challenges in reliability modeling & analysis. A new family of decision diagrams called ternary decision diagrams (TDD) is proposed for use in the resulting separable approach to the GPMS reliability evaluation. Compared with existing methods, the accuracy of our solution increases due to the consideration of modular imperfect coverage; the computational complexity decreases due to the nature of the TDD, and the separation of mission imperfect coverage from the solution combinatorics. In this paper, the TDD-based separable approach is presented, and compared with existing methods for analyzing the GPMS reliability. An example generalized phased-mission system is analyzed to illustrate the advantages of our approach.

Substantial work has been done in the area of software fault analysis, prediction and evaluation. Some work considers the relationship between failures and cost. Unfortunately, current work does not address the issues of revenues, return on investment, or time-value of money. These shortcomings limit the usefulness and acceptance of software reliability within industry. To address these shortcomings, we have developed an economic reliability analysis (ERA) framework at the University of Virginia, that fuses reliability engineering methods with economic analysis. We introduce the ERA framework to the software reliability community and fuse it with the Musa/Okumoto NHPP software reliability model to estimate the economic impact of operational software faults. This framework defines a set of economic vectors that are calculated using the software reliability model along with a few additional financial elements. This extended software reliability model is then used to evaluate an operational software system with three different proposed software upgrades. All four software systems are analyzed and compared. This analysis provides a more complete method to apply software reliability modeling techniques to existing software systems and proposed design changes.

Acyclic Markov chains are frequently used for reliability analysis of nonmaintained mission-critical computer-based systems. Since traditional sensitivity (or importance) analysis using Markov chains can be computationally expensive, an approximate approach is presented which is easy to compute and which performs quite well in test cases. This approach is presented in terms of a Markov chain which is used for solving a dynamic fault-tree, but the approach applies to any acyclic Markov reliability model.

The reliability of a computer-based system may be as important as its performance and its correctness of computation. It is worthwhile to estimate system reliability at the conceptual design stage, since reliability can influence the subsequent design decisions and may often be pivotal for making trade-offs or in establishing system cost. In this paper we describe a framework for modeling computer-based systems, based on the Unified Modeling Language (UML), that facilitates automated dependability analysis during design. An algorithm to automatically synthesize dynamic fault trees (DFTs) from the UML system model is developed. We succeed both in embedding information needed for reliability analysis within the system model and in generating the DFT Thereafter, we evaluate our approach using examples of real systems. We analytically compute system unreliability from the algorithmically developed DFT and we compare our results with the analytical solution of manually developed DFTs. Our solutions produce the same results as manually generated DFTs.

The existing classes of fault coverage models require an a priori distribution for collected data in their analysis. Using these models, analyses can be performed using various assumed distributions. The assumed distributions may not accurately reflect the behavior of the collected data and, as a result, the coverage values predicted by the models may be inaccurate, especially if testing yields little or no failure data. Since the occurrence of an uncovered fault in an ultra-dependable system is a rare event, then statistics of the extremes can be used to quantify uncoverage estimates in such systems. Statistics of the extremes provides for an analysis of rare event data without requiring any a priori knowledge of its distribution. It classifies most distributions into one of three asymptotic families; that is, in the limit, most distributions converge to one of three forms. Using statistics of the extremes, a coverage model is developed for when testing reveals no failures. From this model, the number of fault injection experiments required to demonstrate that a desired coverage level can be met is derived, as is the probability that this coverage estimate can be met.

Safety systems and protection systems can experience two phases of operation (standby and active); an accurate dependability analysis must combine an analysis of both phases. The standby mode can last for a long time, during which the safety system is periodically tested and maintained. Once a demand occurs, the safety system must operate successfully for the length of demand. The failure characteristics of the system are different in the two phases, and the system can fail in two ways: (1) it can fail to start (fail on-demand), or (2) it can fail while in active mode. Failure on demand requires an availability analysis of components (typically electromechanical components) which are required to start or support the safety system. These support components are usually maintained periodically while not in active use. Active failure refers to the failure while running (once started) of the active components of the safety system. These active components can be fault tolerant and use spares or other forms of redundancy, but are not maintainable while in use. The approach, in this paper, automatically combines the "availability analysis of the system in standby mode" with the "reliability analysis of the system in its active mode." The general approach uses an availability analysis of the standby phase to determine the initial state probabilities for a Markov model of the demand phase. A detailed method is presented in terms of a dynamic fault-tree model. A new "dynamic fault-tree construct" captures the dependency of the demand-components on the support systems, which are required to detect the demand or to start the demand system. The method is discussed using a single example sprinkler system and then applied to a more complete system taken from the off-shore industry.

This paper proposes a generalized phased-mission system (GPMS) analysis methodology called GPMS-CPR that has high computation efficiency and is easy to implement. GPMS-CPR can evaluate a wider range of more practical systems with less restrictive mission requirements, while offering more human-friendly performance indices such as multilevel grading as compared to the previous PMS approaches. GPMS-CPR also accounts for imperfect coverage. This method implements an exciting synthesis of several approaches into a single methodology. Further, it extends the methodology to allow for the analysis of sensitivity of each component for each phase as well as for the entire phased mission, with respect to the multilevel reliability for the GPMS. The conventional phase-OR PMS appear as a special case this GPMS. The advantages of this approach are in the low computational complexity, broad applicability, easy implementation, and high integration (reliability, performance, and sensitivity for GPMS). The methodology is illustrated with examples.

This paper presents a methodology and an example of risk assessment of functional-requirement specifications for complex real-time software systems. A heuristic risk-assessment technique based on CPN (colored Petri-net) models is presented. This technique is used to classify software functional-requirement specification components according to their relative importance in terms of such factors as severity and complexity. A dynamic complexity measure, based on concurrence in the functional requirements, is introduced. This technique is applied on the Earth Operation Commanding Center (EOC COMMANDING), a large component of the NASA Earth Observing System (EOS) project. Two specification models of the system are considered. Results of applying this technique to both CPN models are presented. The risk assessment methodology in this paper suggests the following conclusions: (i) risk assessment at the functional-requirement specification phase can be used to classify functional requirements in terms of their complexity and severity; (ii) dynamic complexity metrics and the concurrence metric can be important in assessing the risk factors based on the complexity of functional specifications; (iii) the concurrence complexity metric is an important aspect of dynamic complexity; and (iv) CPN models can be used to build an executable specification of the system, which helps the analyst not only to acquire deep understanding of the system but also to study the dynamic behavior of the system by simulating the model.

Computational modeling tools are critical to engineering. In the absence of a sufficiently complete, mathematically precise, abstract specification of the semantics of the modeling framework supported by such a tool, rigorous validation of the framework and of models built using it is impossible; there is no sound basis for program implementation, verification or documentation; the scientific foundation of the framework remains weak; and significant conceptual errors in framework definition and implementation are likely. Yet such specifications are rarely defined. We present an approach based on the use of formal specification and denotational semantics techniques from software engineering and programming language design. To illustrate the approach, we present elements of a formal semantics for a dynamic fault tree framework that promises to aid reliability analysis. No such specification of the meaning of dynamic fault trees has been defined previously. The approach revealed important shortcomings in the previous, informal definitions of the framework, and thus led to significant improvements, suggesting that formally specifying framework semantics is critical to effective framework design.

Sophisticated modeling and analysis methods are being developed in academic and industrial research labs for reliability engineering and other domains. The evaluation and evolution of such methods based on use in practice is critical to research progress, but few such methods see widespread use. A critical impediment to disseminating new methods is the inability to produce, at a reasonable cost, supporting software tools that have the: usability and dependability characteristics that industrial users require; and evolvability to accommodate software change as the underlying analysis methods are refined and enhanced. The difficulty of software development thus emerges as a key impediment to advances in engineering modeling and analysis. This paper presents an approach to tool development that attacks these problems. Progress requires synergistic, interdisciplinary collaborations between application-domain and software-engineering researchers. The authors have pursued such an approach in developing Galileo: a fault tree modeling and analysis tool. These innovations are described in two dimensions: (1) the Galileo core reliability modeling and analysis function; and (2) the authors' work on software engineering for high-quality, low-cost modeling and analysis tools.

Sophisticated dependability analysis techniques are being developed in academia and research labs, but few have gained wide acceptance in industry. To be valuable, such techniques must be supported by usable, dependable software tools. We present our approach to addressing these issues in developing a dynamic fault tree analysis tool called Galileo. Galileo is designed to support efficient system-level analysis by automatically decomposing fault trees into modules that are solved separately using appropriate techniques. Usability is addressed by a software architecture based on a component-based design technique that we call package-oriented programming. We integrate multiple, volume-priced mass-market software packages to provide the bulk of the tool superstructure. To address tool dependability, we are developing natural language and partial formal specifications of fault tree elements, and we exploit the inherent redundancy associated with multiple analysis techniques as an aid in testing.

Software reliability models have been successfully applied to many industrial applications, but have the unfortunate drawback of requiring data from which one can formulate a model. The data used for these models frequently comes from pre-release testing and/or field experience, and is of sufficient quantity and quality for most large-scale commercial applications. Software which is developed for safety-critical applications is frequently unable to produce such data, for at least two reasons. First, the software is frequently one-of-a-kind, and second, it rarely fails. Safety-critical software is expected to pass every test, producing precious little failure data. "Statistics of the extremes" is a special branch of statistics developed for analysis of rare events. Where traditional statistical analysis uses the law of large numbers to provide information concerning points which are near the mean of the distribution, statistics of the extremes concentrates on the tails. Analysis of rare event data using statistics of the extremes does not require a-priori assumptions concerning the distributional form of the data, and thus provides an interesting alternative to traditional approaches. In this paper, we develop a software reliability model using statistics of the extremes, which is particularly applicable to safety-critical software systems.

This paper presents an example of risk assessment in complex real-time software systems at the early stages of development. A heuristic risk assessment technique based on colored Petri net (CPN) models is used to classify software according to its relative importance in terms of such factors as severity and complexity. The methodology of this technique is presented in a companion paper (Ammar et al., 1997). This technique is applied on the Earth Operation Commanding Center; a large component of NASA's Earth Observing System (EOS) project. Two specifications of the system are considered: a sequential model and a pipeline model. Results of applying the above technique to both CPN-based models yield different complexity measures. The pipeline model shows clearly a higher risk factor than the sequential model. Whereas using traditional complexity measures, the risk factors were similar in both models.

The authors use the BDD to help derive a closed-form solution for the reliability of a multistage interconnection network with n stages. The BDD reveals repeated structures, the reliability of which can be encoded in a recursive formula. An exact solution of a network with an arbitrary number of stages can be computed in time proportional to the number of stages. They also provide results which include the concept of imperfect coverage, in which two mutually-exclusive failure modes (with different effects) are possible for certain switching elements.

Two different classes of models for correlation in multiversion systems have been proposed in the literature. One considers that the version failures are statistically correlated, and the other defines additional failure types to account for related failures. We investigate these two model types, and apply them to several different sets of experimental data available in the literature. Both models provide a good fit for the available data, and thus both seem appropriate for models of multiversion systems. The models which explicitly consider correlation appear better suited to the analysis of software in isolation from the rest of the system, while those models which propose additional failure types are better suited for system-level models that consider hardware as well as software.>

Computer systems for critical applications must be designed to tolerate software faults as well as hardware faults. A unified approach to tolerating hardware and software faults is characterized by classifying faults in terms of duration (transient or permanent) rather than source (hardware or software). Errors arising from transient faults can be handled through masking or voting, but errors arising from permanent faults require system reconfiguration to bypass the failed component. Most errors which are caused by software faults can be considered transient, in that they are input dependent. Quantitative dependability analysis of systems which exhibit a unified approach to fault tolerance can be performed by a hierarchical combination of fault tree and Markov models. In this paper, a methodology for analyzing hardware and software fault tolerant systems is applied to the analysis of a hypothetical system, loosely based on the fault tolerant parallel processor (FTPP). The models considers both transient and permanent faults, hardware and software faults, unrelated and related software faults, automatic recovery and reconfiguration. The parameter values for the software part of the model are determined from an experimental implementation of an N-version programming application. The parameter values chosen for the hardware part of the model are considered fairly typical.>

This paper presents a quantitative reliability analysis of a system designed to tolerate both hardware and software faults. The system being studied achieves integrated fault tolerance by implementing N-version programming (NVP) on redundant hardware. The analysis of the system considers independent software faults, related software faults, transient hardware faults, permanent hardware faults, and imperfect coverage. The overall model is a Markov reward model in which the states of the Markov chain represent the long-term evolution of the structure of the system. For each operational configuration, a fault tree model captures the effects of software faults and transient hardware faults on the task computation. The fault tree models define the reward structure for the overall model. The software fault model is parameterized using experimental data associated with a recent implementation of an NVP system using the current design paradigm, in which the predictions of software failures are very close to the empirical data. The hardware model is parameterized by considering typical failure rates associated with hardware faults and coverage parameters. Results from our study show that it is important to consider both hardware and software faults in the reliability analysis of an NVP system, since these estimates increase with time. Moreover, the function for error detection and recovery is extremely important to fault-tolerant software.

Design features (e.g. reliability, maintainability, and testability) of systems designed to tolerate faults which could compromise the safe and secure operation of a system are discussed. Design automation issues are discussed with a focus on the future. The reliability of proposed systems is assessed using HARP, the hybrid automated reliability predictor, a software package for reliability prediction.>

A recursive algorithm for computing a lower bound on the all-terminal reliability of an n-dimensional hypercube is presented. The recursive step decomposes an n-dimensional hypercube into lower dimension hypercubes that are linked together. As an illustration of the effectiveness and power of this method, a lower bound is computed on the all-terminal reliability of the 16-dimensional hypercube (Connection Machine architecture) whose links number 2/sup 19/. The notation and assumptions are defined, and background information on bounding the reliability polynomial is provided. Methods for tightening these bounds for the analysis of the hypercube architecture are discussed.>

A study is made of several methods for reducing complex fault tree models of fault-tolerant distributed systems. For each method the authors provide bounds on the estimate of unreliability that is obtained from the reduced model. They discuss methods for truncating the solution of a model expressed as a fault tree and then develop techniques that apply to the construction of the fault tree model. The emphasis is on producing approximate (but bounded) results applicable to realistic systems. The authors also discuss methods for incorporating dynamic system behavior (error handling and redundancy management) into fault tree models, and the corresponding truncated solution. The methods are presented as they are used in modeling two distributed systems, the Cm* system and AIPS (the Advanced Information Processing System).>

Several different models for predicting coverage in a fault-tolerant system, including models for permanent, intermittent, and transient errors, are discussed. Markov, semi-Markov, nonhomogeneous Markov, and extended stochastic Petri net models for computing coverage are developed. Two types of events that interfere with recovery are examined; and methods for modeling such events, whether they are deterministic or random, are given. The sensitivity of system reliability/availability to the coverage parameter and the sensitivity of the coverage parameter to various error-handling strategies are investigated. It is found that a policy of attempting transient recovery upon detection of an error (as opposed to automatically reconfiguring the affected component out of the system) can actually increase the unreliability of the system.>

The authors present a stochastic Petri net model of a replicated file system in a distributed environment where replicated files reside on different hosts and a voting algorithm is used to maintain consistency. Witnesses, which simply record the status of the file but contain no data, can be used in addition to or in place of files to reduce overhead. A model sufficiently detailed to include file status (current or out-of-date) as well as failure and repair of hosts where copies or witnesses reside, is presented. The number of copies and witnesses is not fixed, but is a parameter of the model. Two different majority protocols are examined.>