26776900
The role of formal methods in the requirements analysis of safety-critical systems: a train set example
A general framework for the formal specification and verification of the critical requirements in the development of safety-critical systems is presented. The framework is based on a clear separation of the mission and critical issues during requirements analysis. Analysis of the critical issues is performed in two phases. The first phase identifies those real world properties relevant to the critical requirements: the physical laws or rules of operation, and the system hazards. In the second phase, the interface between the system and its environment is identified, and the behavior required at this interface is specified. The utilization of different formal models, namely, a logical formalism (timed history logic) and a net formalism (predicate-transition nets), respectively, is proposed for the two phases. To illustrate the framework, an example based on a train set crossing is presented.<<ETX>>
15737185
Software Fault Tolerance: An Evaluation
In order to assess the effectiveness of software fault tolerance techniques for enhancing the reliability of practical systems, a major experimental project has been conducted at the University of Newcastle upon Tyne. Techniques were developed for, and applied to, a realistic implementation of a real-time system (a naval command and control system). Reliability data were collected by operating this system in a simulated tactical environment for a variety of action scenarios. This paper provides an overview of the project and presents the results of three phases of experimentation. An analysis of these results shows that use of the software fault tolerance approach yielded a substantial improvement in the reliability of the command and control system.
9257653
Can design faults be tolerated?
The short answer to the question posed by the title is “Yes”. A more cautious, and less simplistic, response would be that in certain circumstances, with appropriate provision of redundancy and allied supporting mechanisms, it is certainly possible to provide a measure of tolerance to faults of design. However, although this question may serve as an appropriate title, and starting point for discussion, it does not adequately address the significant issues concerning the application of fault tolerance techniques to deficiencies of design. As is usually the case, the first, and perhaps most important, step is to ask the right questions. In this paper, I propose to substitute five further questions in place of my title and, in answering those questions, will argue the case for the use of design fault tolerance in the development of reliable computing systems. In so doing I hope to justify the short and cautious answers already given above.
26441223
A Train Set as a Case Study for the Requirements Analysis of Safety-Critical Systems
21451715
Reliable Software: A Selective Annotated Bibliography
A total of 64 references to papers, books and conference proceedings on the subject of software reliability have been selected. Each of these references is provided with an annotation consisting of a paragraph of commentary. Sections of the bibliography are devoted to requirements definition, programming methodology, certification, fault-tolerance and reliability modelling.
298943
Error recovery for a boiler system with OTS PID controller
We have previously presented initial results of a case study which illustrated an approach to engineering protective wrappers as a means of detecting errors or unwanted behaviour in systems employing an OTS (off-the-shelf) item. The case study used a Simulink model of a steam boiler system together with an OTS PID (proportional, integral and derivative) controller. The protective wrappers are developed for the model of the system in such a way that they allow detection and tolerance of typical errors caused by unavailability of signals, violations of range limitations, and oscillations. In this paper, we extend the case study to demonstrate how forward error recovery based on exception handling can be systematically incorporated at the level of the protective wrappers.
376140
Virtual log based file systems for a programmable disk
In this paper, we study how to minimize the latency of small transactional writes to disk. The basic approach is to write to free sectors that are near the current disk head location by leveraging the embedded processor core inside the disk. We develop a number of analytical models to demonstrate the performance potential of this approach. We then present the design of a variation of a log-structured file system based on the concept of a virtual log, which supports fast small transactional writes without extra hardware support. We compare our approach against traditional update-in-place and logging systems by modifying the Solaris kernel to serve as a simulation engine. Our evaluations show that random synchronous updates on an unmodified UFS execute up to an order of magnitude faster on a virtual log than on a conventional disk. The virtual log can also significantly improve LFS in cases where delaying small writes is not an option or on-line cleaning would degrade performance. If the current trends of disk technology continue, we expect the performance advantage of this approach to become even more pronounced in the future.
2427769
The Nachos Instructional Operating System
In teaching operating systems at an undergraduate level, we belive that it is important to provide a project that is realistic enought to show how real operating systems work, yet is simple enough that the students can understand and modify it in significant ways. A number of these instructional saystems have been created over the last two decades, but recent advances in hardware and software design, along with the increasing power of available computational resources, have changed the basis for many of the tradeoffs made by these systems. 
 
we have implemented an instructional operating system, called Nachos, and designed a series of assignments to go with it. Our system includes CPU and device simulatiors, and it runs as a regulat UNIX process. Nachos illustrates and takes advantage of modern operating systems technology, such as threads and remote procedure calls, recent harware advances, such as RISC'S and the prevalence of memory hierarchies, and modern software design techniques, such as protocol layering and object-oriented programming. Nachos has been used to teach undergraduate operating systems classes at several universities with positive results.
14646129
The interaction of parallel and sequential workloads on a network of workstations
This paper examines the plausibility of using a network of workstations (NOW) for a mixture of parallel and sequential jobs. Through simulations, our study examines issues that arise when combining these two workloads on a single platform. Starting from a dedicated NOW just for parallel programs, we incrementally relax uniprogramming restrictions until we have a multi-programmed, multi-user NOW for both interactive sequential users and parallel programs. We show that a number of issues associated with the distributed NOW environment (e.g., daemon activity, coscheduling skew) can have a small but noticeable effect on parallel program performance. We also find that efficient migration to idle workstations is necessary to maintain acceptable parallel application performance. Furthermore, we present a methodology for deriving an optimal delay time for recruiting idle machines for use by parallel programs; this recruitment threshold was just 3 minutes for the research cluster we measured. Finally, we quantify the effects of the additional parallel load upon interactive users by keeping track of the potential number of user delays in our simulations. When we limit the maximum number of delays per user, we can still maintain acceptable parallel program performance. In summary, we find that for our workloads a 2:1 rule applies: a NOW cluster of approximately 60 machines can sustain a 32-node parallel workload in addition to the sequential load placed upon it by interactive users.
8792310
xFS: a wide area mass storage file system
The current generation of file systems are inadequate in facing the new technological challenges of wide area networks and massive storage. xFS is a prototype file system we are developing to explore the issues brought about by these technological advances. xFS adapts many of the techniques used in the field of high performance multiprocessor design. It organizes hosts into a hierarchical structure so locality within clusters of workstations can be better exploited. By using an invalidation-based write back cache coherence protocol, xFS minimizes network usage. It exploits the file system naming structure to reduce cache coherence state. xFS also integrates different storage technologies in a uniform manner. Due to its intelligent use of local hosts and local storage, we expect xFS to achieve better performance and availability than current generation network file systems run in the wide area.<<ETX>>
1591428
User-level interprocess communication for shared memory multiprocessors
Interprocess communication (IPC), in particular IPC oriented towards local cornmzmzcation (between address spaces on the same machine), has become central to the design of contemporary operating systems. IPC has traditionally been the responsibility of the kernel, but kernel-based IPC has two inherent problems First, its performance is architecturally limited by the cost of invoking the kernel and reallocating a processor from one address space to another. Second, applications that need inexpensive threads and must provide their own thread management encounter functional and performance problems stemming from the interaction between kernellevel communication and user-level thread management. On a shared memory multiprocessor, these problems can be solved by moving the communication facilities out of the kernel and supporting them at the user level within each address space. Communication performance is improved since kernel invocation and processor reallocation can be avoided when communicating between address spaces on the same machine. These observations motivated User-Level Remote Procedure Call (URPC) URPC combines a fast cross-address space communication protocol using shared memory with lightweight threads managed at the user level, This structure allows the kernel to be bypassed during cross-address space communication. The programmer sees threads and RPC through a conventional interface, though with unconventional performance,