Cs347 Chunk 1

Front 1

System Model

Back 1

How we view our system.

Front 2

Fault model.

Back 2

What are the potential problems?

Front 3

Specification

Back 3

Oracle for system behavior.

Front 4

System

Back 4

A set of elements that work together to provide a service.

Front 5

Element

Back 5

An entity that provides a predefined service and is able to communicate with other elements.

Front 6

Service and Trustworthy Service

Back 6

A behavior that a user perceives as their system interface. Trustworthy - correct and timely.

Front 7

Failure

Back 7

Occurs when the services provided by a system observably deviate from specification.

Front 8

Error

Back 8

An error is an erroneous system state that can lead to a failure. May be detectable and may not necessarily lead to a failure.

Front 9

Fault

Back 9

An undesirable event, hypothesized cause of error. Can be permanent, transient or intermittent.

Front 10

Fault Prevention

Back 10

Focus on eliminating the conditions for faults to be activated. e.g. Modular Software Design, Software Development Methods

Front 11

Fault Removal

Back 11

Three stage process: validation, diagnosis, correction. e.g. debugging, code reviews.

Front 12

Fault Forecasting

Back 12

Concerned with estimating the number, likelihood of activation and wider consequences. A quantitative estimate of how good software is. e.g fault injection

Front 13

Fault Tolerance

Back 13

Actively handling the occurrence of faults/errors such that a system is able to still meet it's specification.

Front 14

Reliability

Back 14

Probability of a service to provide correct services over a specified time period.

Front 15

Fail-safe

Back 15

System becomes safe when it cannot operate. Ensures safety.

Front 16

Fail-operational

Back 16

System continues to operate when it fails. Ensures liveness, sometimes violates safety.

Front 17

Fail-secure

Back 17

Fail-secure systems maintain maximum security when they cannot operate. Potentially large safety violations.

Front 18

Fail-silent

Back 18

System either functions correctly or stops functioning after an internal failure is detected.

Front 19

Fault-tolerant

Back 19

System continues to operate correctly when subsystems operate incorrectly.

Front 20

Availability

Back 20

The probability a service provided by a system is operating correctly at a given time.

Front 21

Safety

Back 21

The extent to which a system can operate without damaging or endangering it's environment.

Front 22

Confidentiality

Back 22

Concerned with the non-disclosure of undue information to unauthorized entities.

Front 23

Integrity

Back 23

The capacity of a computer system to ensure the absence of improper system alterations, with regard to the withholding, modification and deletion of information.

Front 24

Maintainability

Back 24

The probability that a failed computer system will be repaired in t time or less.

Front 25

Fail-Safe Fault Tolerance

Back 25

Program satisfies safety only.

Front 26

Non-masking Fault Tolerance

Back 26

Program satisfies liveness only.

Front 27

Fault Intolerant

Back 27

Program satisfies neither safety nor liveness.

Front 28

Masking Fault Tolerance

Back 28

Program satisfies both safety and liveness.

Front 29

Detector

Back 29

A class of program components that asserts the validity of a predicate in a running program. Necessary and sufficient for fail-safe fault tolerance.

Front 30

Corrector

Back 30

A class of program components that imposes a given predicate on a running program. Necessary and sufficient to design non-masking fault tolerance.

Front 31

Phases of Fault Tolerance

Back 31

Front 32

Run-time Checks

Back 32

Replication Checks, Timing Checks, Reversal Checks, Coding Checks, Reasonable Checks, Structural Checks, Validity Checks

Front 33

Exception Handlers

Back 33

Interface exception, local/internal exception, failure exception

Front 34

Forward error recovery

Back 34

Upon detection of error, program attempts to get into a state which is no longer erroneous. e.g. recovery blocks

Front 35

Backward error recovery

Back 35

Upon detection of error, program rolls back to a previously “recorded” good point from which it can restart execution. e.g. checkpoints

Front 36

Dependability Analysis

Back 36

Tries to identify acceptable levels of safety and reliability.

Front 37

Hazard

Back 37

A hazard is a state or set of conditions of a system, that, together with environmental conditions, will lead to an accident. Important to know the severity and potential frequency.

Front 38

Hazard level

Back 38

Combination of hazard severity and likelihood of occurence

Front 39

Risk

Back 39

The hazard level combined with the likelihood of the hazard leading to accidents and the hazard exposure or duration.

Front 40

Safety Case

Back 40

Needed as part of certification. Should communicate a clear, comprehensive argument that a system is acceptably safe to operate in a particular context.

Front 41

Failure Modes and Effects Analysis

Back 41

Considers the failure of a component with the effect of this failure being assessed at system-level to detect hazardous situations.

+ Can detect hazard situations arising as a result of single failures.

- Does not consider multiple failures.

- Expensive to perform exhaustively.

Front 42

Failure Modes, Effects and Criticality Analysis

Back 42

Similar to FMEA, except the important of each failure is ranked by accounting for the consequences and likely frequency of occurrence.

+ FMECA permits meaningful cost-benefit analysis.

Front 43

Hazard and Operability Studies

Back 43

+ Effective for situations where "What if ...?" questions are constrained.

- Time consuming, especially for the experts used in question generation.

Front 44

Event Trees

Back 44

Starting from events that can affect system, tracking forward to determine their effects.

+ Allows outcomes of events to be determined.

- Exponential Complexity

Front 45

Fault Trees

Back 45

Fault trees track backwards. Commonly used for safety-critical systems.

+ Resultant trees are simplified, compared to event trees.

- Identification of high-level hazards is challenging.

Front 46

Cut Set

Back 46

Combinations of elements in which simultaneous failures would lead to a system failure. Minimal cut sets provide lower bound on reliability.

Front 47

Tie Set

Back 47

Combinations of elements in which simultaneous operations would lead to a correctly working system. Minimal tie sets provide upper bound on reliability

Front 48

Recovery Line and Consistency

Back 48

A set of checkpoints across all processes to which the programs can be rolled back, in the event of failure, to ensure consistent error-free state of the system.

Said to be consistent if there are no messages that originate after the line and terminate before it.

Front 49

Recovery Blocks

Back 49

One hardware channel and N software components.

Secondary components perform similar function but in a different way.

Acceptance testing decides whether results are acceptable.

If primary component fail acceptance test:, we reload a checkpoint, and execute a secondary from a “clean” state.

Represent redundancy in space and time.

Front 50

N-Version Programming

Back 50

N hardware channels and N software channels.

Front 51

NVP Axiom

Back 51

NVP is the most efficient when version failures occur independently.

Front 52

Fault Injection Analysis

Back 52

Fault injection analysis involves subjecting a system to abnormal conditions, i.e., introducing faults / errors, so that behaviour can assessed

Front 53

Coverage

Back 53

The coverage of dependability mechanisms is the ratio of number of test cases successfully passed to the number of test cases subjected to.