Larry D. Lee

A Theoretical Basis for the Analysis of Multiversion Software Subject to Coincident Errors

Fundamental to the development of redundant software techniques (known as fault-tolerant software) is an understanding of the impact of multiple joint occurrences of errors, referred to here as coincident errors. A theoretical basis for the study of redundant software is developed which 1) provides a probabilistic framework for empirically evaluating the effectiveness of a general multiversion strategy when component versions are subject to coincident errors, and 2) permits an analytical study of the effects of these errors. An intensity function, called the intensity of coincident errors, has a central role in this analysis. This function describes the propensity of programmers to introduce design faults in such a way that software components fail together when executing in the application environment. We give a condition under which a multiversion system is a better strategy than relying on a single version and we study some differences between the coincident errors model developed here and the model that assumes independent failures of component verions.

An experimental evaluation of software redundancy as a strategy for improving reliability

The strategy of using multiple versions of independently developed software as a means to tolerate residual software design faults is discussed. The effectiveness of multiversion software is studied by comparing estimates of the failure probabilities of these systems with the failure probabilities of single versions. The estimates are obtained under a model of dependent failures and compared with estimates obtained when failures are assumed to be independent. The experimental results are based on 20 versions of an aerospace application developed and independently validated by 60 programmers from 4 universities. Descriptions of the application and development process are given, together with an analysis of the 20 versions. >

Fundamental differences in the reliability of n-modular redundancy and redundancy and N-version programming

Abstract N-Modular redundancy is an approach to increasing the reliability of hardware systems constructed from component devices that are subject to failure. The analogous approach in software is known as N-version programming. There are a number of well-known reliability implications of the hardware approach that result from assuming independent failures of the hardware components. This paper reviews these and examines the analogous results of N-version programming where an equivalent assumption of independent failures of the component versions may not be valid. It is shown that the results are not equivalent although both approaches can improve system reliability.

New Results for Quantification of Lightning/Aircraft Electrodynamics

ABSTRACT The NASA F-106 has acquired considerable data on the rates-of-change of electromagnetic parameters on the aircraft surface during over 700 direct lightning strikes while penetrating thunderstorms at altitudes ranging from 15,000 to 40,000 feet. These in-situ measurements have provided the basis for the first statistical quantification of the lightning electromagnetic threat to aircraft appropriate for determining lightning indirect effects on aircraft. The data are presently being used in updating previous lightning criteria and standards developed over the years from ground-based measurements. The new lightning standards will be the first which reflect actual aircraft responses measured at flight altitudes. Nonparametric maximum likelihood estimates of the distribution of the peak electromagnetic rates of change for consideration in the new standards are obtained based on peak recorder data for flights which have multiple strikes. The linear and nonlinear modeling techniques developed provide a ...

Estimating fault hitting rates by recapture sampling

For the recapture debugging design introduced by Nayak (1988) we consider the problem of estimating the hitting rates of the faults remaining in a system. In the context of a conditional likelihood, moment estimators are derived and are shown to be asymptotically normal and fully efficient. Fixed sample properties of the moment estimators are compared, through simulation, with those of the conditional maximum likelihood estimators. Also considered is a procedure for testing the assumption that faults have identical hitting rates; this provides a test of fit of the Jelinski-Moranda (1972) model. It is assumed that the residual hitting rates follow a log linear rate model and that the testing process is truncated when the gaps between the detection of new errors exceed a fixed amount of time.

Estimating the discovery rate in a continuous time recapture model

We consider a family of marked Poisson process models for the discovery of distinct errors in a computer program and also for sampling, in continu-ous time, a population containing an unknown number of distinct biological species. Captures (selections or discoveries) are assumed to occur at a con-stant rate, each event consisting of the discovery of a distinct process (error or species) or the recurrence of a previously discovered process. Using a generalization of Nayak’s (1988) model we derive confidence limits for the discovery rate. The limits are based on the asymptotic distribution of a scaled logarithmic function of the maximum likelihood estimator.