Study with the several resources on Docsity
Earn points by helping other students or get them with a premium plan
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
An overview of critical systems, their dependability properties, and development methods. It covers topics such as system dependability, safety-critical and mission-critical systems, availability and reliability, and development methods for critical systems. The document also discusses the importance of formal methods, static analysis, external quality assurance, and independent verification and validation.
Typology: Study notes
1 / 23
This page cannot be seen from the preview
Don't miss anything!
cmsc435 - 1
cmsc435 - 3
Topics covered
l System dependability
l Availability and reliability
l Safety
l Security
Critical Systems
Failure results in loss of life, injury or damage to the environment; Chemical plant protection system;
Failure results in failure of some goal-directed activity; Spacecraft navigation system;
Failure results in high economic losses; Customer accounting system in a bank;
cmsc435 - 7
Achieving dependability
l Redundancy
Keep more than 1 version of a critical component available so that if one fails then a backup is available.
l Diversity
Provide the same functionality in different ways so that they will not fail in the same way.
l But adding diversity and redundancy adds complexity and this can increase the chances of error.
l Some engineers advocate simplicity and extensive V & V as a more effective route to software dependability.
Diversity and redundancy examples
cmsc435 - 9
N-version programming as a model
N-version programming
cmsc435 - 13
Socio-technical critical systems
Hardware fails because of design and manufacturing errors or because components have reached the end of their natural life.
Software fails due to errors in its specification, design or implementation.
Human operators make mistakes. Now perhaps the largest single cause of system failures.
Dependability
Availability; Reliability; Safety; Security Others …
cmsc435 - 15
Dimensions of dependability
Dependability
Availability Reliability Security
The ability of the system to deliver services when requested
The ability of the system to deliver services as specified
The ability of the system to operate without catastrophic failure
The ability of the system to protect itelf against accidental or deliberate intrusion
Safety
Other dependability properties
Reflects the extent to which the system can be repaired in the event of a failure
Reflects the extent to which the system can be adapted to new requirements;
Reflects the extent to which the system can deliver services whilst under hostile attack;
Reflects the extent to which user input errors can be avoided and tolerated.
cmsc435 - 19
Dependability vs performance
l Untrustworthy systems may be rejected by their users
l System failure costs may be very high
l It is very difficult to tune systems to make them more dependable
l It may be possible to compensate for poor
performance
l Untrustworthy systems may cause loss of valuable information
Dependability costs
The use of more expensive development techniques and hardware that are required to achieve the higher levels of dependability The increased testing and system validation that is required to convince the system client that the required levels of dependability have been achieved
cmsc435 - 21
Costs of increasing dependability
Cost
Low Medium High Very high
Ultra-high
Dependability
Dependability economics
cmsc435 - 25
Reliability terminology
Term Description System failure An event that occurs at some point in time when the system does not deliver a service as expected by its users System error An erroneous system state that can lead to system behavior that is unexpected by system users. System fault A characteristic of a software system that can lead to a system error. For example, failure to initialize a variable could lead to that variable having the wrong value when it is used. Human error or mistake
Human behavior that results in the introduction of faults into a system.
Observation
Event
Cause
Testing consists of observing failures. Debugging consists of finding the event that causes the failure. Finding the ultimate cause (i.e., the fault) of the error is extremely difficult.
Faults and failures
l Failures are a usually a result of system errors that are derived from faults in the system l However, faults do not necessarily result in system errors The faulty system state may be transient and ‘corrected’ before an error arises l Errors do not necessarily lead to system failures The error can be corrected by built-in error detection and recovery The failure can be protected against by built-in protection facilities. These may, for example, protect system resources from system errors
cmsc435 - 27
Perceptions of reliability
l The formal definition of reliability does not always reflect the user’s perception of a system’s reliability The assumptions that are made about the environment where a system will be used may be incorrect
Reliability achievement
l Fault avoidance
The system is developed in such a way that human error is avoided and thus system faults are minimized. The development process is organized so that faults in the system are detected and repaired before delivery to the customer.
l Fault detection
Verification and validation techniques are used to discover and remove faults in a system before it is deployed.
l Fault tolerance
The system is designed so that faults in the delivered software do not result in system failure.
cmsc435 - 31
Embedded software systems whose failure can cause the associated hardware to fail and directly threaten people.
Systems whose failure results in faults in other systems which can threaten people
Safety criticality
In general, reliability and availability are necessary but not sufficient conditions for system safety
Safety and reliability
cmsc435 - 33
If the system specification is incorrect then the system can behave as specified but still cause an accident
Hard to anticipate in the specification
Often the result of operator error
Unsafe reliable systems
Safety terminology
Term Definition Accident (or mishap)
An unplanned event or sequence of events which results in human death or injury, damage to property or to the environment. A computer-controlled machine injuring its operator is an example of an accident. Hazard A condition with the potential for causing or contributing to an accident. A failure of the sensor that detects an obstacle in front of a machine is an example of a hazard. Damage A measure of the loss resulting from a mishap. Damage can range from many people killed as a result of an acc ident to minor injury or property damage. Hazard severity
An assessment of the worst possible damage that could result from a particular hazard. Hazard severity can range from catastrophic where many peop le are killed to minor where only minor damage results. Hazard probability
The probability of the events occurring which create a hazard. Probability values tend to be arbitrary bu t range from probable (say 1/100 chance of a hazard occu rring) to implausible (no conceivable situations are likely wh ere the hazard could occur). Risk This is a measure of the probability that the system will cause an acc ident. The risk is assessed by considering the hazard probability, the hazard severity and the probability that a hazard will result in an accident.
cmsc435 - 37
Security
Fundamental security
cmsc435 - 39
The CIA of security
Security terminology
Term Definition
Exposure Possible loss or ha rm in a computing system. This can be loss or damage to data or can be a loss of time and effort if recovery is necessary after a security breach.
Vulnerability A weakness in a computer-based system that may be exploited to cause loss or ha rm.
Attack An exploitation of a system vulnerability. Generally, this is from outside the system and is a deliberate attempt to cause some damage.
Threats Circumstances that have potential to cause loss or harm. You can think of these as a sys tem vulnerability that is subjected to an attack.
Control A protective measure that reduces a system vulnerability. Encryption would be an example of a control that reduced a vulnerability of a weak access control system.
