1295439
Analysis of Timeliness Requirements in Safety-Critical Systems
Requirements analysis plays a vital role in the development of safetycritical systems since any faults in the requirements specification will corrupt the subsequent stages of system development. Experience in safetycritical systems has shown that faults in the requirements can and do cause accidents. This paper presents a general framework for the analysis of timeliness requirements in safetycritical systems. The analysis is performed in two distinct phases; for each phase we propose different formalisms and time structures. The specification of the timing constraints is based on an event/action model. To illustrate the proposed approach an example based on a train set crossing is presented.
64595679
Efficient LR(1) Parsers
26441223
A Train Set as a Case Study for the Requirements Analysis of Safety-Critical Systems
298943
Error recovery for a boiler system with OTS PID controller
We have previously presented initial results of a case study which illustrated an approach to engineering protective wrappers as a means of detecting errors or unwanted behaviour in systems employing an OTS (off-the-shelf) item. The case study used a Simulink model of a steam boiler system together with an OTS PID (proportional, integral and derivative) controller. The protective wrappers are developed for the model of the system in such a way that they allow detection and tolerance of typical errors caused by unavailability of signals, violations of range limitations, and oscillations. In this paper, we extend the case study to demonstrate how forward error recovery based on exception handling can be systematically incorporated at the level of the protective wrappers.
21069
Analyzing Safety Requirements for Process-Control Systems
Safety-requirements analysis is typically conducted either ad hoc or with the unbridled use of formal methods. The approach presented in this paper offers the freedom to mix formal and traditional engineering methods and apply them at different abstraction levels to give a higher assurance that the software's contribution to system risk is acceptable. >
21451715
Reliable Software: A Selective Annotated Bibliography
A total of 64 references to papers, books and conference proceedings on the subject of software reliability have been selected. Each of these references is provided with an annotation consisting of a paragraph of commentary. Sections of the bibliography are devoted to requirements definition, programming methodology, certification, fault-tolerance and reliability modelling.
7514471
Network support for IP traceback
This paper describes a technique for tracing anonymous packet flooding attacks in the Internet back toward their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or “spoofed,” source addresses. In this paper, we describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our approach allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs). Moreover, this traceback can be performed “post mortem”—after an attack has completed. We present an implementation of this technology that is incrementally deployable, (mostly) backward compatible, and can be efficiently implemented using conventional technology.
5449095
Experience with a Language for Writing Coherence Protocols
In this paper we describe our experience with Teapot [7], a domain-specific language for writing cache coherence protocols. Cache coherence is of concern when parallel and distributed computing systems make local replicas of shared data to improve scalability and performance. In both distributed shared memory systems and distributed file systems, a coherence protocol maintains agreement among the replicated copies as the underlying data are modified by programs running on the system. 
 
Cache coherence protocols are notoriously difficult to implement, debug, and maintain. Unfortunately, protocols are not off-the-shelf items, as their details depend on the requirements of the system under consideration. This paper presents case studies detailing the successes and shortcomings of using Teapot for writing coherence protocols in two systems. The first system, loosely coherent memory (LCM) [16], implements a particular type of distributed shared memory suitable for data-parallel programming. The second system, the xFS distributed file system [9], implements a high-performance, serverless file system. 
 
Our overall experience with Teapot has been very positive. In particular, Teapot's language features resulted in considerable simplifications in the protocol source code for both systems. Furthermore, Teapot's close coupling between implementation and formal verification helped to achieve much higher confidence in our protocol implementations than previously possible and reduced the time to build the protocols. By using Teapot to solve real problems in complex systems, we also discovered several shortcomings of the Teapot design. Most noticeably, we found Teapot lacking in support for multithreaded environments, for expressing actions that transcend several cache blocks, and for handling blocking system calls. We believe that domain-specific languages are valuable tools for writing cache coherence protocols.
376140
Virtual log based file systems for a programmable disk
In this paper, we study how to minimize the latency of small transactional writes to disk. The basic approach is to write to free sectors that are near the current disk head location by leveraging the embedded processor core inside the disk. We develop a number of analytical models to demonstrate the performance potential of this approach. We then present the design of a variation of a log-structured file system based on the concept of a virtual log, which supports fast small transactional writes without extra hardware support. We compare our approach against traditional update-in-place and logging systems by modifying the Solaris kernel to serve as a simulation engine. Our evaluations show that random synchronous updates on an unmodified UFS execute up to an order of magnitude faster on a virtual log than on a conventional disk. The virtual log can also significantly improve LFS in cases where delaying small writes is not an option or on-line cleaning would degrade performance. If the current trends of disk technology continue, we expect the performance advantage of this approach to become even more pronounced in the future.
1537776
Execution characteristics of desktop applications on Windows NT
This paper examines the performance of desktop applications running on the Microsoft Windows NT operating system on Intel x86 processors, and contrasts these applications to the programs in the integer SPEC95 benchmark suite. We present measurements of basic instruction set and program characteristics, and detailed simulation results of the way these programs use the memory system and processor branch architecture. We show that the desktop applications have similar characteristics to the integer SPEC95 benchmarks for many of these metrics. However, compared to the integer SPEC95 applications, desktop applications have larger instruction working sets, execute instructions in a greater number of unique functions, cross DLL boundaries frequently, and execute a greater number of indirect calls.
1591428
User-level interprocess communication for shared memory multiprocessors
Interprocess communication (IPC), in particular IPC oriented towards local cornmzmzcation (between address spaces on the same machine), has become central to the design of contemporary operating systems. IPC has traditionally been the responsibility of the kernel, but kernel-based IPC has two inherent problems First, its performance is architecturally limited by the cost of invoking the kernel and reallocating a processor from one address space to another. Second, applications that need inexpensive threads and must provide their own thread management encounter functional and performance problems stemming from the interaction between kernellevel communication and user-level thread management. On a shared memory multiprocessor, these problems can be solved by moving the communication facilities out of the kernel and supporting them at the user level within each address space. Communication performance is improved since kernel invocation and processor reallocation can be avoided when communicating between address spaces on the same machine. These observations motivated User-Level Remote Procedure Call (URPC) URPC combines a fast cross-address space communication protocol using shared memory with lightweight threads managed at the user level, This structure allows the kernel to be bypassed during cross-address space communication. The programmer sees threads and RPC through a conventional interface, though with unconventional performance,