Algirdas Avižienis

Dependability and Its Threats: A Taxonomy

This paper gives the main definitions relating to dependability, a generic concept including as special case such attributes as reliability, availability, safety, confidentiality, integrity, maintainability, etc. Basic definitions are given first. They are then commented upon, and supplemented by additional definitions, which address the threats to dependability (faults, errors, failures), and the attributes of dependability. The discussion on the attributes encompasses the relationship of dependability with security, survivability and trustworthiness.

DEDIX 87 - A supervisory system for design diversity experiments at UCLA

To establish a long-term research facility for further experimental investigations of design diversity as a means of achieving fault-tolerant systems, the DEDIX (DEsign Diversity experiment) system, a distributed supervisor and testbed for multi-version software, was designed and implemented by researchers at the UCLA Dependable Computing and Fault-Tolerant Systems Laboratory. DEDIX is available on the Olympus local network, which utilizes the Locus distributed operating system to operate a set of several VAX 11/750 computers at the UCLA Center for Experimental Computer Science. DEDIX is portable to any machine which runs a Unix operating system. The DEDIX system is described and its applications are discussed in this paper. A review of current research is also presented.

The Evolution of Fault Tolerant Computing at the Jet Propulsion Laboratory and at UCLA: 1955 – 1986

The Jet Propulsion Laboratory (JPL) is a research facility in Pasadena, California, that was founded by Professor Theodore von Karman of the California Institute of Technology as a test site in 1936 and was supported by the U.S. Army until October 1958, when it was transferred to the recently founded NASA, the U.S. National Aeronautics and Space Administration. The primary mission of JPL within the NASA structure is to develop unmanned interplanetary spacecraft and to conduct scientific investigations of the other planets of our solar system. Unmanned investigations of the Moon by Ranger spacecraft were the first step in the series of space exploration missions that have continued with the Mariner, Viking, and Voyager series of interplanetary spacecraft that thus far have reached Mercury, Venus, Mars, Jupiter, Saturn and Uranus.

An immune system paradigm for the assurance of dependability of collaborative self-organizing systems

In collaborative self-organizing computing systems a complex task is performed by relatively simple autonomous agents that act without centralized control. Disruption of a task can be caused by agents that produce harmful outputs due to internal failures or due to maliciously introduced alterations of their functions. The probability of such harmful outputs is minimized by the application of a design principle called “the immune system paradigm” that provides individual agents with an all-hardware fault tolerance infrastructure. The paradigm and its application are described in this paper.

Dependable Systems of the Future: What is Still Needed?

It is concluded that hardware is not being adequately employed to provide ystem fault tolerance. A design principle called the “immune system paradigm” is presented and a hardware-implemented fault tolerance infrastructure is proposed as the means to use hardware more effectively in building dependable systems of the future.

Systematic Design of Fault-Tolerant Computers

The origin of the concept of fault tolerance and the evolution of guidelines for the systematic design of fault-tolerant systems is reviewed. The current formulation of the guidelines, called a design paradigm, is presented. The problem of using off-the-shelf subsystems in a fault-tolerant system is discussed. In conclusion, an analogy of complex fault-tolerant systems and living organisms is suggested as a means to advance the understanding of fault tolerance.

Framework of Software Performability Modeling

When compared with model-based evaluations that concern the effects of operational faults in hardware, the nature and needs of software performability modeling differ in several respects.

Case Study I: Comparative Studies of Fault-Tolerant Software

The types of computational redundancy employed by fault-tolerant software typically result in performance penalties, particularly with regard to computation delays. These, in turn, may have an adverse effect on system dependability, e.g., in real-time applications, an increased probability of failing to meet a deadline. More generally, such interactions and tradeoffs between performance and dependability affect the user-perceived benefits of a particular fault tolerance scheme. Hence, consideration of combined performance-dependability, via the concept of performability, appears to be a promising basis for assessing and improving the effectiveness of fault-tolerant software.

Case Study II: Performability-Management Oriented Adaptive Fault Tolerance

In the presence of faults, timing anomalies, workload fluctuations, synchronization conflicts, etc., a computer or communication system is required to react adaptively to these changes in order to make the service dependable with respect to what the user demands. Accordingly, during the past several years, increased attention has been given to the notion of dynamic optimization with respect to either fault tolerance or performance. Kim and Lawrence proposed that the choice of operational strategies, such as redundant computing resource allocation, should be made adaptive to the operating modes of a fault-tolerant system [109]. Liu et al. introduced the imprecise computation techniques which reduce the adverse effects of real-time constraint violation by providing the user with an approximate result of acceptable quality [110]. More recently, de Meer and Mauser proposed a performability modeling approach for dynamically reconfigurable systems based on extended Markov reward models [111]. Bondavalli, Stankovic and Strigini developed a framework and a specification notation called FERT, for real-time adaptive, software implemented fault tolerance [112].

Viable Techniques for Model Construction and Solution

In keeping with the modeling framework described in the previous chapter, let us now consider some specific modeling techniques that are suited to the purpose of software performability evaluation. This is not to say that a particular method, if used exclusively, will suffice; what will generally be required is some appropriate combination of techniques for model specification, construction, and solution. Also, although certain of these methods apply to simulation models as well as analytic models, we choose to confine our attention to the latter. Specifically, the four types of models we consider in this chapter are 1) series-parallel graphs, 2) Markov chains, 3) queueing models, and 4) stochastic Petri nets (SPNs) and stochastic activity networks (SANs).