Dependable Computing and Fault-Tolerant Systems – serie

This volume contains the papers presented. at the Third IFIP International Working Conference on Dependable Computing for Critical Applications, sponsored by IFIP Working Group 10.4 and held in Mondello (Sicily), Italy on September 14-16, 1992. System developers increasingly apply computers where they can affect the safety and security of people and equipment. The Third IFIP International Working Conference on Dependable Computing for Critical Applications, like its predecessors, addressed various aspects of computer system dependability, a broad term defined as the degree of trust that may justifiably be placed in a system's reliability, availability, safety, security, and performance. Because the scope of the conference was so broad, we hope the presentations and discussions will contribute to the integration of these concepts so that future computer-based systems will indeed be more dependable. The Program Committee selected 18 papers for presentation from a total of 7 4 submissions at a May meeting in Newcastle upon Tyne, UK. The resulting program represented a broad spectrum of interests, with papers from universities, corporations, and government agencies in eight countries. Much diligent work by the Program Committee and the quality of reviews from more than a hundred external referees from around the world, for which we are most grateful, significantly eased the production of this technical program.

For the editors of this book, as well as for many other researchers in the area of fault-tolerant computing, Dr. William Caswell Carter is one of the key figures in the formation and development of this important field. We felt that the IFIP Working Group 10.4 at Baden, Austria, in June 1986, which coincided with an important step in Bill's career, was an appropriate occasion to honor Bill's contributions and achievements by organizing a one­ day "Symposium on the Evolution of Fault-Tolerant Computing" in the honor of William C. Carter. The Symposium, held on June 30, 1986, brought together a group of eminent scientists from all over the world to discuss the evolu­ tion, the state of the art, and the future perspectives of the field of fault-tolerant computing. Historic developments in academia and industry were presented by individuals who themselves have actively been involved in bringing them about. The Symposium proved to be a unique historic event and these Proceedings, which contain the final versions of the papers presented at Baden, are an authentic reference document.

Software Diversity is one of the fault-tolerance means to achieve dependable systems. In this volume, some experimental systems as well as real-life applications of software diversity are presented. The history, the current state-of-the-art and future perspectives are given. Although this technique is used quite successfully in industrial applications, further research is necessary to solve some open questions. We hope to report on new results and applications in another volume of this series within some years. Acknowledgements The idea of the workshop was put forward by the chairpersons of IFIP WG lOA, J. -c. Laprie, J. F. Meyer and Y. Tohma, in January 1986, and the edi­ tor of this volume was asked to organize the workshop. This volume was edited with the assistance of the editors of the series, A. AviZienis, H. Kopetz and J. -C. Laprie, who also had the function of reviewers. Karlsruhe, October 1987 U. Voges, Editor Table of Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1. Introduction U. Voges 2. Railway Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 ERICSSON Safety System for Railway Control . . . . . . . . . . . . . . . . . . 11 G. Hagelin 3. Nuclear Applications . . . . . . . . . . . . . . . . . . . . . . 23 Use of Diversity in Experimental Reactor Safety Systems . 29 U. Voges The PODS Diversity Experiment . 51 P. G. Bishop 4. Flight Applications . . . . . . . . . . . . . . . . . . . . . . . . . 85 AIRBUS and ATR System Architecture and Specification. . 95 P. Traverse 5. University Research . . . . . . . . . . . . . . . . . . . 105 Tolerating Software Design Faults in a Command and Control System . . . . . . . . . . . . . . . . . . . . . . 109 T. Anderson, P. A. Barrett, D. N. Halliwell, M. R. MouldingDEDIX 87 - A Supervisory System for Design Diversity Experiments at UCLA . . . . . . . . . . . . . . . . . .

The production of a new version of any book is a daunting task, as many authors will recognise. In the field of computer science, the task is made even more daunting by the speed with which the subject and its supporting technology move forward. Since the publication of the first edition of this book in 1981 much research has been conducted, and many papers have been written, on the subject of fault tolerance. Our aim then was to present for the first time the principles of fault tolerance together with current practice to illustrate those principles. We believe that the principles have (so far) stood the test of time and are as appropriate today as they were in 1981. Much work on the practical applications of fault tolerance has been undertaken, and techniques have been developed for ever more complex situations, such as those required for distributed systems. Nevertheless, the basic principles remain the same.

The International Working Conference on Dependable Computing for Critical Applications was the first conference organized by IFIP Working Group 10. 4 "Dependable Computing and Fault Tolerance", in cooperation with the Technical Committee on Fault-Tolerant Computing of the IEEE Computer Society, and the Technical Committee 7 on Systems Reliability, Safety and Security of EWlCS. The rationale for the Working Conference is best expressed by the aims of WG 10. 4: " Increasingly, individuals and organizations are developing or procuring sophisticated computing systems on whose services they need to place great reliance. In differing circumstances, the focus will be on differing properties of such services - e. g. continuity, performance, real-time response, ability to avoid catastrophic failures, prevention of deliberate privacy intrusions. The notion of dependability, defined as that property of a computing system which allows reliance to be justifiably placed on the service it delivers, enables these various concerns to be subsumed within a single conceptual framework. Dependability thus includes as special cases such attributes as reliability, availability, safety, security. The Working Group is aimed at identifying and integrating approaches, methods and techniques for specifying, designing, building, assessing, validating, operating and maintaining computer systems which should exhibit some or all of these attributes. " The concept of WG 10. 4 was formulated during the IFIP Working Conference on Reliable Computing and Fault Tolerance on September 27-29, 1979 in London, England, held in conjunction with the Europ-IFIP 79 Conference. Profs A. Avi~ienis (UCLA, Los Angeles, USA) and A.

This volume contains the papers presented at the Second International Work­ ing Conference on Dependable Computing for Critical Applications, sponsored by IFIP Working Group lOA and held in Tucson, Arizona on February 18-20, 1991. In keeping with the first such conference on this topic, which took place at the University of California, Santa Barbara in 1989, this meeting was like­ wise concerned with an important basic question: Can we rely on Computers? In more precise terms, it addressed various aspects of computer system de­ pendability, a broad concept defined as th'e trustworthiness of computer service such that reliance can justifiably be placed on this service. Given that this term includes attributes such as reliability, availability, safety, and security, it is our hope that these papers will contribute to further integration of these ideas in the context of critical applications. The program consisted of 20 papers and three panel sessions. The papers were selected from a total of 61 submissions at a November 1990 meeting of the Program Committee in Ann Arbor, Michigan. We were very fortunate to have a broad spectrum of interests represented, with papers in the final program coming from seven different countries, representing work at universities, corporations, and government agencies. The process was greatly facilitated by the diligent work of the Program Committee and the quality of reviews provided by outside referees. In addition to the paper presentations, there were three panel sessions or­ ganized to examine particular topics in detail.

For the second time the International Workshop on Responsive Com­ puter Systems has brought together a group of international experts from the fields of real-time computing, distributed computing, and fault­ tolerant systems. The two day workshop met at the splendid facilities at the KDD Research and Development Laboratories at Kamifukuoka, Saitama, in Japan on October 1 and 2, 1992. The program included a keynote address, a panel discussion and, in addition to the opening and closing session, six sessions of submitted presentations. The keynote address "The Concepts and Technologies of Depend­ able and Real-time Computer Systems for Shinkansen Train Control" covered the architecture of the computer control system behind a very responsive, i. e. , timely and reliable, transport system-the Shinkansen Train. It has been fascinating to listen to the operational experience with a large fault-tolerant computer application. "What are the Key Paradigms in the Integration of Timeliness and Reliability?" was the topic of the lively panel discussion. Once again the pro's and con's of the time-triggered versus the event-triggered paradigm in the design of a real-time systems were discussed. The eighteen submitted presentations covered diverse topics about important issues in the design of responsive systems and a session on progress reports about leading edge research projects. Lively discussions characterized both days of the meeting. This volume contains the revised presentations that incorporate some of the discussions that occurred during the meeting.