A methodology for cost-effective software fault tolerance for mission-critical systems

Abstract

As computing capabilities continue to advance, there will be a concurrent rise in the number of both hardware and software faults. These will be caused by the greater volume of more complex software, by the increased number of untested software states, and by more incidents of hardware/software interaction faults as a result of increased hardware speed and density.The traditional software implemented fault tolerance approaches have been successfully utilized in life-critical systems, such as digital flight controls, where their additional costs can be easily justified. Examples include N-Version Programming and Recovery Block approaches. However, there is still a need for dependable computing for mission-critical applications as well. Often, these traditional techniques are avoided for mission-critical systems due to the difficulty in justifying their extra upfront development cost.We provide an alternative for the high "sunk cost" of traditional software fault tolerance techniques. The methodology, called Data Fusion Integrity Processes (DFIPs), is a simple, yet effective technique for missioncritical systems. In addition, the approach establishes a framework from which other costlier, more extensive traditional techniques can be added. We present details of the DFIP methodology and a DFIP framework for Ada programs. We also briefly discuss development of a DFIP code generation system which exploits Java that will enable users to quickly build a DFIP framework in Ada, and select reusable DFIP component methods.

Software Design For a Fault-Tolerant Communications Satellite

“…However their application in conjunction provides integrated comprehensive coverage, which dramatically increases the reliability of PANSAT. As mentioned at the beginning, most faulttolerance research has been working with distributed systems, working with a large pool of hardware resources [Kreutzfeld, 1997]. Unfortunately, the particulars of space, especially in this project, preclude the use of most of those features.…”

“…If the same state is required to be restored multiple times, an alternate error handling routine is executed. The alternate method may be anything from running a substitute method, ignoring the process that generated the error, if possible, or requesting human intervention to correct a procedure [Kreutzfeld, 1997]. While there is enough slack in the system to perform the acceptance tests, there is neither enough memory nor extra processing time to keep track of multiple program states.…”

“…Voting not only can be used to compare N-versions, but also the exact same software run on different hardware. For instance, running the same program on multiple processors simultaneously could provide different results if one processor was faulty [Kreutzfeld, 1997]. PANSAT cannot use N-version or voting because one processor is running at a time.…”

A model driven framework for N-version programming

“…Developing highly reliable software is often an expensive undertaking due to the prolonged development time, attributable to increased design, review and testing activities [1]. Other trade-offs usually associated with the production of reliable software are functionality, performance, complexity, and safety [2].…”

Enhanced fault management for future IMA systems

“…For example, avionic applications may use techniques such as error or reasonability checks accompanied by simple recovery mechanisms such as replacement by last valid data [5]. More critical functions such as the system executive or common operating system functions should use techniques such as recovery blocks or N-version programming.…”