This paper explores domain arguments-arguments about why techniques, processes, and designs possess properties as believed by their domain experts. An elicitation technique for their recovery from domain documents is presented. This is followed by demonstrated application of the technique to several domain artifacts from aviation engineering. The elicited arguments are presented and analyzed for their properties. The inherent importance of such arguments is discussed as well as their potential contribution to system assurance arguments such as the safety case.

Software plays a key role in high-risk systems, i.e., safety and security-critical systems. Several certification standards and guidelines, e.g., in the defense, transportation (aviation, automotive, rail), and healthcare domains, now recommend and/or mandate the development of assurance cases for software-intensive systems. As such, there is a need to understand and evaluate (a) the application of assurance cases to software, and (b) the relationship between the development and assessment of assurance cases, and software engineering concepts, processes and techniques. The ICSE 2013 Workshop on Assurance Cases for Software-intensive Systems (ASSURE) aims to provide an international forum for high-quality contributions (research, practice, and position papers) on the application of assurance case principles and techniques for software assurance, and on the treatment of assurance cases as artifacts to which the full range of software engineering techniques can be applied.

In previous work, we introduced Echo, a new approach to the formal verification of the functional correctness of software. Part of what makes Echo practical is a technique called verification refactoring. The program to be verified is mechanically refactored specifically to facilitate verification. After refactoring, the program is documented with low-level annotations, and a specification is extracted mechanically. Proofs that the semantics of the refactored program are equivalent to those of the original program, that the code conforms to the annotations, and that the extracted specification implies the program's original specification constitute the verification argument. In this paper, we discuss verification refactoring and illustrate it with a case study of the verification of an optimized implementation of the advanced encryption standard (AES) against its official specification. We compare the practicality of verification using refactoring with traditional correctness proofs and refinement, and we assess its efficacy using seeded defects.

Unlike other diversity-based approaches, N-variant systems thwart attacks without requiring secrets. Instead, they use redundancy (to require an attacker to simultaneously compromise multiple variants with the same input) and tailored diversity (to make it impossible to compromise all the variants with the same input for given attack classes). In this work, we develop a method for using data diversity in N-variant systems to provide high-assurance arguments against a class of data corruption attacks. Data is transformed in the variants so identical concrete data values have different interpretations. In order to corrupt the data without detection, an attacker would need to alter the corresponding data in each variant in a different way while sending the same inputs to all variants. We demonstrate our approach with a case study using that thwarts attacks that corrupt UID values.

Abstract: Problem frames and assurance cases are two current research areas that can improve – and have improved – system dependability, in critical and noncritical systems alike. While these two techniques are effective separately, their synthesis is much more powerful. This paper describes the synthesis of these two techniques and the rationale behind the synthesis, the particular pieces that influence each other, and the beginning of a process to integrate the two in software system development. A detailed example of the application of the synthesis is also provided.

Assurance based development (ABD) is the synergistic construction of a critical computing system and an assurance case that sets out the dependability claims for the system and argues that the available evidence justifies those claims. Co-developing the system and its assurance case helps software developers to make technology choices that address the specific dependability goal of each component. This approach gives developers: (1) confidence that the technologies selected will support the system's dependability goal and (2) flexibility to deploy expensive technology, such as formal verification, only on components whose assurance needs demand it. ABD simplifies the detection - and thereby avoidance - of potential assurance difficulties as they arise, rather than after development is complete. In this paper, we present ABD together with a case study of its use.

The productivity and dependability challenges we face in software engineering remain significant. Software has become the pacing item and an unexpectedly large expense in the development of many engineered systems. Dealing with this situation will require a radical change in the way we build software, and one candidate to form the basis of that change is model-based development. Model-based development relies on the creation by application experts of models of the required systems and synthesis of the software from the model. This approach brings many benefits but also a surprising number of challenges. Success to date with model-based development has been considerable

One of the most common forms of security attacks involves exploiting a vulnerability to inject malicious code into an executing application and then cause the injected code to be executed. A theoretically strong approach to defending against any type of code-injection attack is to create and use a process-specific instruction set that is created by a randomization algorithm. Code injected by an attacker who does not know the randomization key will be invalid for the randomized processor effectively thwarting the attack. This paper describes a secure and efficient implementation of instruction-set randomization (ISR) using software dynamic translation. The paper makes three contributions beyond previous work on ISR. First, we describe an implementation that uses a strong cipher algorithm--the Advanced Encryption Standard (AES), to perform randomization. AES is generally believed to be impervious to known attack methodologies. Second, we demonstrate that ISR using AES can be implemented practically and efficiently (considering both execution time and code size overheads) without requiring special hardware support. The third contribution is that our approach detects malicious code before it is executed. Previous approaches relied on probabilistic arguments that execution of non-randomized foreign code would eventually cause a fault or runtime exception.

In many software systems, properties necessary for dependable operation are only a small subset of all desirable system properties. Assuring properties over the simpler subset can provide assurance of critical properties over the entire system. This work provides a method for constructing systems to be dependably reconfigurable. A system's primary function can have less demanding dependability requirements than the overall system because the system can reconfigure to some simpler function. Reconfiguration thus controls the effective complexity of the system without forcing that system to sacrifice desired, but unassurable, capabilities. Focusing a system's dependability argument on reconfiguration means that reconfiguration must proceed correctly with very high assurance. The system construction approach in this work also provides a method through which system dependability properties can be shown. To illustrate the ideas in this work, we have built part of a hypothetical avionics system that is typical of what might be found on an unmanned aerial vehicle

Hardware dependability improvements have led to a situation in which it is sometimes unnecessary to employ extensive hardware replication to mask hardware faults. Expanding upon our previous work on assured reconfiguration for single processes and building upon the fail-stop model of processor behavior, we define a framework that provides assured reconfiguration for concurrent software. This framework can provide high dependability with lower space, power, and weight requirements than systems that replicate hardware to mask all anticipated faults. We base our assurance argument on a proof structure that extends the proofs for the single-application case and includes the fail-stop model of processor behavior. To assess the feasibility of instantiating our framework, we have implemented a hypothetical avionics system that is representative of what might be found on an unmanned aerial vehicle.

Safe operation is crucial to safety-critical systems, and formal verification of implementations is a desirable means to increase confidence in safety. Traditional formal verification approaches follow the Floyd-Hoare style, setting up a direct compliance argument between an abstract formal specification and a concrete implementation. Such approaches require proofs of large numbers of verification conditions. Creation of both the conditions and their proofs can be difficult and time-consuming.In this paper, we introduce a general formal verification approach that closely models the Floyd-Hoare pattern, yet avoids the tedious direct compliance proof between the formal specification and the implementation. The approach moves the major proof step to a point between two abstract specifications.Our preliminary approach verifies SPARK Ada implementations against PVS specifications. We first use a human-guided refinement to manually generate Ada code along with appropriate SPARK annotations from a PVS specification. We then verify the annotations' compliance with the specification by (1) mechanically extracting a PVS specification from them, and (2) proving that properties of the generated specification imply all of the properties of the original. We rely on the existing SPARK toolset to verify the Ada code against the SPARK annotations. The process is largely automatic or computer-aided. We present an example of the approach using a hypothetical avionics system.

Defect reports generated for faults found during testing provide a rich source of information regarding problematic phrases used in requirements documents. These reports indicate that faults often derive from instances of ambiguous, incorrect or otherwise deficient language. In this paper, we report on a method combining elements of linguistic theory and information retrieval to guide the discovery of problematic phrases throughout a requirements specification, using defect reports and correction requests generated during testing to seed our detection process. We found that phrases known from these materials to be problematic have occurrence properties in requirements documents that both allow the direction of resources to prioritize their correction, and generate insights characterizing more general locations of difficulty within the requirements. Our findings lead to some recommendations for more efficiently and effectively managing certain natural language issues in the creation and maintenance of requirements specifications.

There is ample evidence from a variety of applications that the development of large software systems remains a challenge for the majority of practitioners. The problem of poor software quality lies not in poor techniques but in the lack of classical engineering approaches in the software industry. The best way to correct this is to rethink and revise the education process that we offer in computer science and computer engineering degrees. The focus of our educational activities must switch to an emphasis on engineering software.

The management of modern distributed systems is complicated by scale and dynamics. Scalable, decoupled communication establishes flexible, loosely coupled component relationships, and these relationships help meet the present demands on management. However, traditional decoupled addressing mechanisms tend to focus the addressing on only one of the parties involved in communication while, in general, a communication relationship involves a sender, communicated content, and receivers. The state of all three are simultaneously relevant to correctness of a management relationship and its communications. We introduce selective notification, a scalable, decoupled event dissemination architecture supporting simultaneous and combined addressing of senders, receivers, and events. We demonstrate its application to programming dynamic, scalable management relationships. We then discuss its implementation, and present measurements of its effective capabilities.

It is often the case that safety-critical systems have to be reconfigured during operation because of issues such as changes in the systems operating environment or the failure of software or hardware components. Operational systems exist that are capable of reconfiguration, but previous research and the techniques employed in operational systems for the most part either have not addressed the issue of assurance or have been developed in an ad hoc manner. In this paper we present a comprehensive approach to assured reconfiguration, providing a framework for formal verification that allows the developer of a reconfigurable system to use a set of application-level properties to show general reconfiguration properties. The properties and design are illustrated through an example from NASA's runway incursion prevention system.

It is important that computer engineers, software engineers, project managers, and users understand the major elements of current technology in the field of dependability, yet this material tends to be unfamiliar to researchers and practitioners alike. Researchers are often concerned in one way or another with some aspect of what is mistakenly called software "reliability". All practitioners are concerned with the "reliability" of the software that they produce but researchers and practitioners tend not to understand fully the broader impact of their work. A lot of research, such as that on testing, is concerned directly with software dependability. Understanding dependability more fully allows researchers to be more effective. Similarly, practitioners can direct their efforts during development more effectively if they have a better understanding of dependability.

Many areas of society have become heavily dependent on services such as transportation facilities, utilities and so on that are implemented in part by large numbers of computers and communications links. Both past incidents and research studies show that a well-engineered Internet worm can disable such systems in a fairly simple way and, most notably, in a matter of a few minutes. This indicates the need for defenses against worms but their speed rules out the possibility of manually countering worm outbreaks. We present a platform that emulates the epidemic behavior of Internet active worms in very large networks. A reactive control system operates on top of the platform and provides a monitor/analyze/respond approach to deal with infections automatically. Details of our highly configurable platform and various experimental performance results are presented.

I am pleased to report several changes at the IEEE Transactions on Software Engineering that will make the processing of papers more timely and more effective. First, we have removed the length restriction on submitted manuscripts. This should allow authors to document results in appropriate length papers. Despite the change, authors are encouraged to keep papers as short as possible. Second, we have moved TSE manuscript management to the Webbased Manuscript Central system. This system makes all aspects of manuscript processing much more efficient, and it allows everybody involved in processing papers, including authors, to obtain details of the state of manuscripts as they are processed. Third, preprints in the future will be available online two months before the issue cover date. This will allow readers to access the material in the TSE sooner and author’s materials will be accessible sooner. In addition, we are able to publish online supplemental material (e.g., appendices, multimedia) as part of the permanent archive in our digital library. Finally, we have made numerous changes to reduce the submission-topublication time, and it has improved considerably recently. The peer review process has improved as well thanks to the move to Manuscript Central. We are planning additional changes that will provide further improvements in the near future. Publication of the TSE is the result of tremendous amounts of effort by a large number of people. We are very grateful for the anonymous efforts of our reviewers and the work undertaken by the editorial board. The dayto-day operations of the TSE are handled by the following dedicated staff at the IEEE Publications Office in Los Alamitos, CA: Selina Norman, Transactions Assistant, YuTzu Tsai and Steve Wareham, Electronic Media Assistants, Spencer Roper, Production Editor, Suzanne Werner, Peer Review Supervisor, and Alicia Stickley, Transactions Production Manager. It is my pleasure to take this opportunity to thank them for all of their work. Software remains a critical industry to the world. The impact of software is tremendous, both when it works and when it doesn’t. There remain major challenges ahead if we are to reach a point where large software systems can be developed in a timely manner with the required dependability and at reasonable cost. These challenges must be tackled, at least in part, by the TSE community. In responding to these challenges, I am anxious for the TSE to publish papers that help document developers’ experience as well as those that report traditional research results. I hope to see the elements of the solutions to the challenges in the TSE in the future and look forward to receiving those submissions. John Knight Editor-in-Chief IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 30, NO. 2, FEBRUARY 2004 81

Computer systems provide us with a wide range of services upon which we have come to depend. Many computers are embedded in more complex devices that we use such as automobiles, aircraft, appliances, and medical devices. Others are part of sophisticated systems that provide us with a variety of important facilities such as financial services, telecommunications, transportation systems, and energy production and distribution networks. Engineering systems to be as dependable as we require them to be is a significant challenge and requires a variety of analysis and development techniques. It is important that computer engineers, software engineers, project managers, and users understand the major elements of current technology in the field of dependability, yet this material tends to be unfamiliar to researchers and practitioners alike. Researchers are often concerned in one way or another with some aspect of what is mistakenly called software "reliability". All practitioners are concerned with the "reliability" of the software that they produce but researchers and practitioners tend not to understand fully the broader impact of their work. A lot of research, such as that on testing, is concerned directly with software dependability. Understanding dependability more fully allows researchers to be more effective. Similarly, practitioners can direct their efforts during development more effectively if they have a better understanding of dependability.

Safety-critical systems are those systems whose failure could result in loss of life, significant property damage, or damage to the environment. There are many well known examples in application areas such as medical devices, aircraft flight control, weapons, and nuclear systems. Many modern information systems are becoming safety-critical in a general sense because financial loss and even loss of life can result from their failure. Future safety-critical systems will be more common and more powerful. From a software perspective, developing safety critical systems in the numbers required and with adequate dependability is going to require significant advances in areas such as specification, architecture, verification, and process. The very visible problems that have arisen in the area of information-system security suggests that security is a major challenge also.

No abstract available.

Many existing survivability mechanisms rely on software-based system monitoring and control. Some of the software resides on application hosts that are not necessarily trustworthy. The integrity of these software components is therefore essential to the reliability and trustworthiness of the survivability scheme. We address the problem of protecting trusted software on untrustworthy hosts by software transformations. Our techniques include a systematic introduction of aliases in combination with a "break-down" of the program control-flow; transforming high-level control transfers to indirect addressing through aliased pointers. In so doing, we transform programs to a form that yields data flow information very slowly and/or with little precision. We present a theoretical result which shows that a precise analysis of the transformed program, in the general case, is NP-hard and demonstrate the applicability of our techniques with empirical results.

Critical infrastructures provide services upon which society depends heavily; these applications are themselves dependent on distributed information systems for all aspects of their operation and so survivability of the information systems is an important issue. Fault tolerance is a mechanism by which survivability can be achieved in these information systems. We outline a specification-based approach to fault tolerance, called RAPTOR, that enables structuring of fault-tolerance specifications and an implementation partially, synthesized from the formal specification. The RAPTOR approach uses three specifications describing the fault-tolerant system, the errors to be detected, and the actions to take to recover from those errors. System specification utilizes an object-oriented database to store the descriptions associated with these large, complex systems. The error detection and recovery specifications are defined using the formal specification notation Z. We also describe an implementation architecture and explore our solution with a case study.

The relatively scant use of formal techniques in software development is the result, in part, of a lack of suitable support tools. Many tools have been developed that provide novel analysis capabilities but lack basic yet commonplace facilities which are essential in production software development. More importantly, many existing tools for the development of formal specifications fail to provide mechanisms for the manipulation of natural language despite the fact that natural language is essential to give meaning to the terms in the formal specification. In this paper, we describe a toolset that has been developed with the specific intent of providing comprehensive facilities for creating formal specifications in production software development. The toolset supports a powerful formal notation, Z but also provides comprehensive and fully integrated support for natural language. As well as describing the toolset we present a preliminary evaluation of its use on a commercial specification.

Viruses remain a significant threat to modern networked computer systems. Despite the best efforts of those who develop anti-virus systems, new viruses and new types of virus that are not dealt with by existing protection schemes appear regularly. In addition, the rate at which a virus can spread has risen dramatically with the increase in connectivity. Defenses against infections by known viruses rely at present on immunization yet, for a variety of reasons, immunization is often only effective on a subset of the nodes in a network and many nodes remain unprotected. Little is known about either the way in which a viral infection proceeds in general or the way that immunization affects the infection process. We present the results of a simulation study of the way in which virus infections propagate through certain types of network and of the effect that partial immunization has on the infection. The key result is that relatively low levels of immunization can slow an infection significantly.

We address the dependence of critical infrastructures-including electric power, telecommunications, finance and transportation-on vulnerable information systems. Our approach is based on the notion of control systems. We envision hierarchical, adaptive, multiple model, discrete-state distributed control systems to monitor infrastructure information systems and respond to disruptions (e.g., security attacks) by changing operating modes and design configurations to minimize loss of utility. To explore and evaluate our approach, we have developed a toolkit for building distributed dynamic models of infrastructure information systems. We used this toolkit to build a model of a simple subset of the United States payment system and a control system for this model information system.

No abstract available.

article Free Access Share on Undergraduate computer science education: a new curriculum philosophy & overview Authors: John C. Knight Department of Computer Science, University of Virginia, Charlottesville, VA Department of Computer Science, University of Virginia, Charlottesville, VAView Profile , Jane C. Prey Department of Computer Science, University of Virginia, Charlottesville, VA Department of Computer Science, University of Virginia, Charlottesville, VAView Profile , Wm. A. Wulf Department of Computer Science, University of Virginia, Charlottesville, VA Department of Computer Science, University of Virginia, Charlottesville, VAView Profile Authors Info & Claims ACM SIGCSE BulletinVolume 26Issue 1March 1994 pp 155–159https://doi.org/10.1145/191033.191093Online:12 March 1994Publication History 17citation305DownloadsMetricsTotal Citations17Total Downloads305Last 12 Months10Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

Measurement of software reliability by life testing involves executing the software on large numbers of test cases and recording the results. The number of failures observed is used to bound the failure probability even if the number of failures observed is zero. Typical analyses assume that all failures that occur are observed, but, in practice, failures occur without being observed. In this paper, we examine the effect of imperfect error detection, i.e. the situation in which a failure of the software may not be observed. If a conventional analysis associated with life testing is used, the confidence in the bound on the failure probability is optimistic. Our results show that imperfect error detection does not necessarily limit the ability of life testing to bound the probability of failure to the very low values required in critical systems. However, we show that the confidence level associated with a bound on failure probability cannot necessarily be made as high as desired, unless very strong assumptions are made about the error detection mechanism. Such assumptions are unlikely to be met in practice, and so life testing is likely to be useful only for situations in which very high confidence levels are not required.>

The strategy of using multiple versions of independently developed software as a means to tolerate residual software design faults is discussed. The effectiveness of multiversion software is studied by comparing estimates of the failure probabilities of these systems with the failure probabilities of single versions. The estimates are obtained under a model of dependent failures and compared with estimates obtained when failures are assumed to be independent. The experimental results are based on 20 versions of an aerospace application developed and independently validated by 60 programmers from 4 universities. Descriptions of the application and development process are given, together with an analysis of the 20 versions.>

It is shown that the traditional methods of ensuring quality (i.e. those that focus on testing) do not necessarily yield software of prescribed quality. Similarly, more advanced methods, such as those that advocate mathematical verification during development and the use of fault-tolerant structures at execution time, are also not able to assure dependable performance. It is shown that, for safety-critical medical systems that are required to achieve very high quality levels, post-development assurance of a specific level of quality is infeasible. It is concluded that safety-critical systems that depend on computers should be deployed only with the greatest of care.>

The authors have conducted a large-scale experiment in N-version programming. A total of 27 versions of a program were prepared independently from the same specification at two universities. The results of executing the versions revealed that the versions were individually extremely reliable but that the number of input cases in which more than one failed was substantially more than would be expected if they were statistically independent. After the versions had been executed, the failures of each version were examined and the associated faults located. It appears that minor differences in the software development environment would not have a major impact in reducing the incidence of faults that cause correlated failures.>

The results of an empirical study of software error detection using self checks and N-version voting are presented. Working independently, each of 24 programmers first prepared a set of self checks using just the requirements specification of an aerospace application, and then each added self checks to an existing implementation of that specification. The modified programs were executed to measure the error-detection performance of the checks and to compare this with error detection using simple voting among multiple versions. The analysis of the checks revealed that there are great differences in the ability of individual programmers to design effective checks. It was found that some checks that might have been effective failed to detect an error because they were badly placed, and there were numerous instances of checks signaling nonexistent errors. In general, specification-based checks alone were not as effective as specification-based checks combined with code-based checks. Self checks made it possible to identify faults that had not been detected previously by voting 28 versions of the program over a million randomly generated inputs. This appeared to result from the fact that the self checks could examine the internal state of the executing program, whereas voting examines only final results of computations. If internal states had to be identical in N-version voting systems, then there would be no reason to write multiple versions.>

The authors have identified a difficulty in the implementation of N-version programming. The problem, called the consistent comparison problem, arises for applications in which decisions are based on the results of comparing finite-precision numbers. It is shown that when versions make comparisons involving the results of finite-precision calculations, it is impossible to guarantee the consistency of their results. It is therefore possible that correct versions may arrive at completely different outputs for an application that does not apparently have multiple correct solutions. If this problem is not dealt with explicitly, an N-version system may be unable to reach consensus even when none of its component versions falls.>

Data diversity is described, and the results of a pilot study are presented. The regions of the input space that cause failure for certain experimental programs are discussed, and data reexpression, the way in which alternate input data sets can be obtained, is examined. A description is given of the retry block which is the data-diverse equivalent of the recovery block, and a model of the retry block, together with some empirical results is presented. N-copy programming which is the data-diverse equivalent of N-version programming is considered, and a simple model and some empirical results are also given.>

In this paper, we discuss the use of Ada® on distributed systems in which failure of processors has to be tolerated. We assume that tasks are the primary object of distribution, and that communication between tasks on separate processors will take place using the facilities of the Ada language. It would be possible to build a separate set of facilities for communication between processors, and to treat the software on each machine as a separate program. This is unnecessary and undesirable. In addition, the Ada language Reference Manual states specifically that a system consisting of communicating processors with private memories is suitable for executing an Ada program.

N-version programming has been proposed as a method of incorporating fault tolerance into software. Multiple versions of a program (i.e. `N') are prepared and executed in parallel. Their outputs are collected and examined by a voter, and, if they are not identical, it is assumed that the majority is correct. This method depends for its reliability improvement on the assumption that programs that have been developed independently will fail independently. An experiment is described in which the fundamental axiom is tested. In all, 27 versions of a program were prepared independently from the same specification at two universities and then subjected to one million tests. The results of the tests revealed that the programs were individually extremely reliable but that the number of tests in which more than one program failed was substantially more than expected. The results of these tests are presented along with an analysis of some of the faults that were found in the programs. Background information on the programmers used is also summarized.

Abstract Two software tools are described that are designed to facilitate software development for microcontrollers. One is a mid‐level programming language called Pascal/48 and the other is a circuit simulation system. Pascal/48 is designed to give the programmer many of the advantages of a high‐level language, but also provide access to all of the hardware of the Intel MCS‐48 series of microcontrollers. The circuit simulation system combines many of the advantages of simulation and emulation. It provides a software testing environment in which many more software functions can be tested than with conventional simulators. The system integrates an instruction‐set simulator with simulators for other devices. They operate in parallel and are synchronized by a clock that records simulated time. I/O lines of the microcontroller can be linked to other components so that complete circuits can be simulated. Displays are provided of the internal and external state of the simulated circuit, and of the Pascal/48 program being executed. They are updated as simulated execution proceeds using the screen updating facilities of ASCII terminals. Simulation can be continuous, single step, or execution can be reversed (i.e. instructions are ‘unexecuted’).

Abstract The Mystro Assembler Construction System (MACS) is a tool kit for assembler writers, based upon a parser‐generator for ambiguous attribute grammars, automatic text manipulation, and a skeletal assembler. Attention has been paid in MACS to aiding the assembler writer in employing the software methodology of iterative enhancement and in avoiding the more tedious aspects of assembler construction.

Abstract Observations on the design of the special‐purpose scientific programming language SL/1 are presented. SL/1 is intended for applications programming of the Control Data Corporation Cyber 203, a very high‐performance vector processor, which is mainly used for scientific computation. The language design has been heavily influenced by the hardware characteristics of this machine and the needs of the Cyber 203 user community. Various aspects of the design of SL/1 are discussed and measurements of their use are presented. In addition, unexpected similarities between the resulting design of SL/1 and the design of FORTRAN are examined and several reasons for the continued widespread use of FORTRAN are suggested.

Real-time systems often have very high reliability requirements and are therefore prime candidates for the inclusion of fault tolerance techniques. In order to provide tolerance to software faults, some form of state restoration is usually advocated as a means of recovery. State restoration can be expensive and the cost is exacerbated for systems which utilize concurrent processes. The concurrency present in most real-time systems and the further difficulties introduced by timing constraints suggest that providing tolerance for software faults may be inordinately expensive or complex. We believe that this need not be the case, and propose a straightforward pragmatic approach to software fault tolerance'which is believed to be applicable to many real-time systems. The approach takes advantage of the structure of real-time systems to simplify error recovery, and a classification scheme for errors is introduced. Responses to each type of error are proposed which allow service to be maintained.