Search

A growing number of safety-critical systems is controlled by computer systems. Currently these systems are often built from scratch. The Zerberus System assists the developer in the design and implementation process. Main features of the Zerberus System are generality, dependability, real-time predictability, the ability to be certified and cost-efficiency. The main concept of the Zerberus System is the platform independent specification of the functional model by the developer. The functional model specifies the functional elements (tasks), the relation between these elements, the interaction of the system with the environment and the temporal constraints. On the base of the functional model the Zerberus System automatically generates the fault-tolerance mechanisms. Thus the task of the developer is restricted to the implementation of the application-dependent code. In this paper we present one major part of the Zerberus System: the Zerberus Language that is used to specify the functional model of the control applications. [ABSTRACT FROM AUTHOR]

Several techniques for database replication using group communication have recently been proposed, namely, the Database State Machine, Postgres-R, and the NODO protocol. Although all rely on a totally ordered multicast for consistency, they differ substantially on how multicast is used. This results in different performance trade-offs which are hard to compare as each protocol is presented using a different load scenario and evaluation method. In this paper we evaluate the suitability of such protocols for replication of On-Line Transaction Processing (OLTP) applications in clusters of servers and over wide area networks. This is achieved by implementing them using a common infra-structure and by using a standard workload. The results allows us to select the best protocol regarding performance and scalability in a demanding but realistic usage scenario. [ABSTRACT FROM AUTHOR]

This work introduces a highly modular derivation of fast non-blocking atomic commit protocols. Modularity is achieved by the use of consensus protocols as completely independent services. Fast decision is obtained by the use of consensus protocols that decide in one communication step in good scenarios. Two original non-blocking atomic commit protocols are presented. One of the presented protocols outperforms existing equivalent solutions that are based on the use of failure detectors. In the presence of a low resiliency rate, f ≤ 1, it behaves as the classical 2PC and 3PC, exhibiting the same message complexities. In the general case, when one considers the number of tolerated crashes as f < n/2, it exhibits a complexity of 2nf + 3n point to point messages. The best known algorithm exhibits a complexity of 4nf + 3n point to point messages. [ABSTRACT FROM AUTHOR]

We propose a resource-efficient way to execute requests in Byzantine-fault-tolerant replication that is particularly well-suited for services in which request processing is resource-intensive. Previous efforts took a failure-masking all-active approach of using all 2t + 1 execution replicas to execute all requests, where t is the maximum number of failures tolerated. We describe an asynchronous execution protocol that combines failure masking with imperfect failure detection and checkpointing. Our protocol is parsimony-based since it uses only t + 1 execution replicas, called the primary committee or pc, to execute the requests normally. Under normal conditions, characterized by a stable network and no misbehavior by pc replicas, our approach enables a trustworthy reply to be obtained with the same latency as in the all-active approach, but with only about half of the overall resource use of the all-active approach. However, a request that exposes faults among the pc replicas will incur a higher latency than the all-active approach mainly due to fault detection latency. Under such conditions, the protocol switches to a recovery mode, in which all 2t + 1 replicas execute the request and send their replies. Then, after selecting a new pc, the request latency returns to the same level as that of all-active execution. Practical observations point to the fact that failures and instability are the exception rather than the norm. That motivated our decision to optimize resource efficiency for the common case, even if it means paying a slightly higher performance cost during periods of instability. [ABSTRACT FROM AUTHOR]

A failure detector is an important building block for fault-tolerant distributed computing: mechanisms such as distributed consensus and group communication rely on the information provided by failure detectors in order to make progress and terminate. As such, erroneous information provided by the failure detector (or the absence of it) may delay decision-making or lead the upper-layer fault-tolerant mechanism to take incorrect decisions (e.g., the exclution of a correct process from a group membership). On the other hand, the implementation of failure detectors that can precisely identify failures is restricted by the actual behaviour of a system, especially in settings where message transmission delays and system loads can vary over time. In this paper we explore the use of artificial neural networks in order to implement failure detectors that are dynamically adapted to the current communication load conditions. The training patterns used to feed the neural network were obtained by using Simple Network Management Protocol (SNMP) agents over MIB - Management Information Base variables. The output of such neural network is an estimation for the arrival time for the failure detector to receive the next heartbeat message from a remote process. The suggested approach was fully implemented and tested over a set of GNU/Linux networked workstations. In order to analyze the efficiency of our approach, we have run a series of experiments where network loads were varied randomly, and we measured several QoS parameters, comparing our detector against known implementations. The performance data collected indicate that neural networks and MIB variables can indeed be combined to improve the QoS of failure detectors. [ABSTRACT FROM AUTHOR]

Connectivity of a sensor network depends critically on tolerance to node failures. Nodes may fail due to several reasons, including energy exhaustion, material fatigue, environmental hazards or deliberate attacks. Although most routing algorithms for sensor networks have the ability to circumvent zones where nodes have crashed, if too many nodes fail the network may become disconnected. A sensible strategy for increasing the dependability of a sensor network consists in deploying more nodes than strictly necessary, to replace crashed nodes. Spare nodes that are not fundamental for routing or sensing may go to sleep. To ensure proper operation of the sensor network, sleeping nodes should monitor active nodes frequently. If crashed nodes are not replaced, messages follow sub-optimal routes (which are energy inefficient) and, furthermore, the network may eventually become partitioned due to the effect of accumulated crashes. On the other hand, to save the energy, nodes should remain sleeping as much as possible. In fact, if the energy consumed with the monitoring process is too high, spare nodes may exhaust their batteries (and the batteries of active nodes) before they are needed. This paper studies the optimal monitoring period in fault-tolerant sensor networks to ensure that: i) the network remains connected (i.e., crashed nodes are detected and substituted fast enough to avoid the network partition) and, ii) the lifetime of the network is maximized (i.e., inactive nodes save as much battery as possible). [ABSTRACT FROM AUTHOR]

We describe an approach to scheduling hard real-time tasks taking into account fault scenarios. All tasks are scheduled at run-time according to their fixed priorities, which are determined off-line. Upon error-detection, special tasks are released to perform error-recovery actions. We allow error-recovery actions to be executed at higher priority levels so that the fault resilience of the task set can be increased. To do so, we extend the well known response time analysis technique and describe a non-standard priority assignment policy. Results from simulation indicate that the fault resilience of the task sets can be significantly increased by using the proposed approach. [ABSTRACT FROM AUTHOR]

The ODYSSEY design methodology has been recently introduced as a viable solution to the increasing design complexity problem in the ASICs. It is an object-oriented design methodology which models a system in terms of its constituting objects and their corresponding method calls. Some of these methods are implemented in hardware; others are simply executed by a general purpose processor. One fundamental element of this methodology is a network on chip that implements method invocation for hardware-based method calls. However this network is prone to faults, thus errors on it may result into system failure. In this paper an architectural fault-tolerance enhancement to the ODYSSEY design methodology is proposed which covers this problem. It detects and corrects all single event upset errors on the network, and detects all permanent ones. The proposed enhancement is modeled analytically and then simulated. The simulation results, while validating the analytical model, show very low network performance overhead.This work is supported by a research grant from the Department of High-Tech. Industries, Ministry of Industries and Mines of the Islamic Republic of Iran. [ABSTRACT FROM AUTHOR]

We present the results of injecting errors during the boot phase of an embedded real-time system based on the ERC32 space processor. In this phase the hardware is initialized, and the processor executes the boot loader followed by kernel initialization. For this reason most system support is not yet available and traditional fault-injection techniques such as swifi cannot be used. Thus our study was based in the processor's IEEE 1149.1 (boundary-scan) infrastructure through which we injected about 5000 double bit-flip errors. The observations show that such system will either crash(25%) or execute correctly(75%), since only 2 errors eventually lead to the output of wrong results. However about 10% of faults originated latent errors dormant in memory. We also provide some suggestions on what can be done to increase robustness during this system state, in which most fault-tolerance techniques are not yet setup. Keywords: dependability evaluation, embedded systems, fault-tolerance, fault-injection, boundary-scan. [ABSTRACT FROM AUTHOR]

The size and speed of SRAM caches of embedded systems are increasing in response to demands for higher performance. However, the SRAM caches are vulnerable to soft errors originated from energetic nuclear particles or electrical sources. This paper proposes a new protected cache scheme, which provides high performance as well as high fault detection coverage. In this scheme, the cache space is divided into sets of different sizes. Here, the length of tag fields associated to each set is unique and is different from the other sets. The other remained bits of tags are used for protecting the tag using a fault detection scheme e.g., generalized parity. This leads to protect the cache without compromising performance and area with respect to the similar one, fully associative cache. The results obtained from simulating some standard trace files reveal that the proposed scheme exhibits a performance near to fully associative cache but achieves a considerable fault detection coverage which is suitable to be used in the dependable computing. [ABSTRACT FROM AUTHOR]

Assuring the correctness of fault-tolerant distributed systems can be an overwhelming task. Besides dealing with complex problems of distributed systems, it is also necessary to design the system in such a way that a well-defined failure behaviour, or the masking of failure components, is presented by the system when components fail. To help reasoning about such systems, the use of formal methods becomes desirable. In previous work we introduced a graphical formal specification language, called Object-Based Graph Grammars (OBGG), for modelling asynchronous distributed systems. We also defined a method for automatically inserting classical fault behaviours into OBGG models. The obtained models could be analysed using simulation. In this paper a new method for automatically inserting fault behaviours into OBGG models, which is suitable for using verification as the analysis method, is proposed. Moreover, we show how to formally verify OBGG models in the presence of such faults. A two phase commit protocol is used to illustrate the contributions. Keywords: Object-based graph grammars, distributed systems, fault-tolerance, model transformation, model checking. [ABSTRACT FROM AUTHOR]

The design, implementation and testing of the exceptional activity of a software system are complex tasks that usually do not receive the necessary attention from existing development methodologies. This work presents a systematic way to deal with exception handling, from the requirement specification phase to the implementation and testing phases, in component-based software development. Testing activities are performed since the early stages of development, promoting an increase in the quality of the produced system. Our solution refines the Methodology for the Definition of Exception Behavior, MDCE, in the architectural design, implementation, and testing phases. Moreover, the proposed method was adapted to the UML Components process. [ABSTRACT FROM AUTHOR]

In the civil aviation certification the software has an unlike treatment due to its peculiarities and also for being a relatively new item. There is no specific software certification requirement in the FARThe United States Federal Aviation Regulation. - FAR 33.28 is the only section that mentions the word software. The FAAThe United States Federal Aviation Administration. recognizes the considerations presented in RTCA/DO-178BThe Radio Technical Commission for Aeronautics document called "Software Considerations in Airborne Systems and Equipment Certification". as an acceptable means for approval of software used in airborne systems for civil aviation. The CTA/IFI/CAvCAerospace Technical Center, Industrial Fostering and Coordination Institute, Civil Aviation Certification Division., responsible for the type certification in Brazil, has been applying RTCA/DO-178B since it was issued. The purpose of this paper is to present the experience of CTA in applying DO-178B, focusing on those technical issues that were source of controversy among certification authorities and industries. This paper is relevant at present time as RTCA and EUROCAEEuropean Organization for Civil Aviation Equipment. have recently organized a Special CommitteeRTCA Special Committee SC-205 and EUROCAE Working Group WG-71. intending to issue DO-178C by the end of 2008. [ABSTRACT FROM AUTHOR]

In this paper we present NekoStat, an extension of the Neko tool. Neko is a Java framework and a communication platform that permits rapid prototyping of distributed applications; it provides tools to organize the applications using a layered architecture, with the network(s) at the bottom of the architecture. Neko is also a communication platform that allows sending and receiving of generic Java objects. Distributed systems realized within the Neko framework can be exercised both on real networks and on simulated ones, without changes in the application code. We constructed an extension to plain Neko, called NekoStat; it permits attainment of quantitative evaluations of distributed systems. In the paper we describe this extension; we motivate the development of NekoStat, we describe the design and finally we illustrate its usage through a case study, which highlights the usefulness of NekoStat. [ABSTRACT FROM AUTHOR]

This paper presents a methodology for the automated detection of buffer overflow vulnerabilities in executable software. Buffer overflow exploitation has been used by hackers to breach security or simply to crash computer systems. The mere presence inside the software code of a vulnerability that allows for buffer overflow exploitations presents a serious risk. So far, all methodologies devised to mitigate this problem assume source code availability or prior knowledge on vulnerable functions. Our methodology removes this dependency and allows the analysis of executable code without any knowledge about its internal structure. This independence is fundamental for relevant scenarios such as COTS selection during system integration (for which source code is usually not available), and the definition of attackloads for dependability benchmarking. [ABSTRACT FROM AUTHOR]

In a previous work we validated an ODBMS component injecting errors in the application's interface. The aim was to observe the robustness of the component when the application that interacted with it failed. In this work we tackle the injection of errors directly into the interfaces among the target component's classes. As the component under test has several classes, we use stratified sampling to reduce the amount of injections without losing the ability to detect faults. Strata are defined based on a complexity metric, Weighted Methods in a Class - WMC. Experiments show that this metric alone is not sufficient to select strata for testing purposes. [ABSTRACT FROM AUTHOR]

Nowadays information technology (IT) is increasingly determining growth in the world of automation. After it changed hierarchies, structures and flows in the entire office world, it now covers all the sectors from the process and manufacturing industries to logistics and building automation. The communications capability of devices and continuous, transparent information routes are indispensable components of future-oriented automation concepts. [ABSTRACT FROM AUTHOR]

Although there is a large body of research in dependability, architectural level reasoning about dependability is only just emerging as an important theme in software development. This is due to the fact that dependability concerns are often left until too late in the process of development. In addition, the complexity of emerging applications and the trend of building trustworthy systems from existing untrustworthy components are urging dependability concerns to be considered at the architectural level. [ABSTRACT FROM AUTHOR]

The development of dependable distributed systems needs to be based on a proper foundation. This foundation is generally given in form of a system and failure model. The system model defines the semantics of basic services like process and message services of a distributed system. More advanced system services will be based on these basic services. The failure model specifies the likely failures of the basic services, i.e., these are the failures that the advanced system services need to cope with. The objective of the system and failure model is the following. As long as the assumptions of the failure and system model are valid, a system has to guarantee its specification. However, if these assumptions are violated during run-time, the system specification might be violated. The probability that a dependable system violates its specification must be negligible. Therefore, the probability of the occurrence of failures which are not specified by the failure model must also be negligible. [ABSTRACT FROM AUTHOR]

Agreement protocols are fundamental for the design of dependable systems. They ensure consistent cooperation among distributed entities, helping both to keep the continuity of services in spite of failures and to enhance performance. Consensus is the greatest common denominator among all agreement problems. It allows a set of processes to agree on a common output value. Theoretical advances have been reached, thanks to the consensus problem solutions through the use of unreliable failure detectors, which have been proved to be essential in solving many other agreement problems in environments with temporal uncertainties. Such advances have been exploited in order to (i) find efficient solutions to agreement problems, (ii) identify minimal synchronous conditions for their solution and (iii) characterize more precisely their behavior (blocking or progression) in presence of network disturbs. From a software engineering view point, consensus-based protocols give rise to simple and modular solutions. Basic components (consensus, reliable broadcast, atomic broadcast, failure detector, etc.) are identified in order to construct richer ones (group membership, view synchrony, atomic commit, etc.). These components are in turn the fundamental pieces of middleware for reliable distributed programming. [ABSTRACT FROM AUTHOR]

Devising wait-free resilient implementations of concurrent objects from fault-prone base objects is a fundamental challenge of computer science. Wait-free means that any process that invokes an operation eventually receives a reply after executing a finite number of its own steps, even if other processes are arbitrarily slow or even failed. Resilience means that the implementation of the concurrent object behaves correctly despite the failure of up to t base objects (t being a threshold parameter a priori defined). The tutorial surveys different techniques to build wait-free resilient implementations of concurrent objects. Three complementary classes of techniques are presented: (1) fault-tolerance "by replication", (2) fault-tolerance "by diversity", and (3) fault-tolerance "by oracle", respectively. The first is the well-known redundancy technique and its applicability depends on the kinds of faults that the objects can suffer. The second consists in combining the base objects with objects of other types (type refers here to a programming language notion: the type has to be powerful enough to allow implementing resilient objects). This technique basically relies on the universality of consensus objects. The third technique relies on the information we can obtain about the operational status of the processes. [ABSTRACT FROM AUTHOR]

Automation systems play an important role in the economy of most industrialized countries. One prominent feature of such systems relates to dependability, as unexpected crashes can both put human-life in danger and cause massive money looses. The first Latin-American Workshop on Dependable Automation Systems (WDAS) aims to provide an opportunity for researchers and industrial partners to discuss problems related to the development of safe-critical automation systems. [ABSTRACT FROM AUTHOR]

The Workshop on Theses and Dissertations on Dependable Computing is a student forum for bringing together graduate students that research on topics related to dependable computing. The aim of this meeting is to present and discuss the proposed contribution, preliminary results and possible directions for their research. The previous editions of this Workshop were held in Florianópolis in conjunction with the Brazilian Symposium on Fault Tolerance (SCTF 2001), and in 2003 in São Paulo with the Latin-American Symposium on Dependable Computing (LADC 2003). [ABSTRACT FROM AUTHOR]

There is a growing need for systems whose survivability in a specified use and/or attack environment can be assured with confidence. Many techniques have been proposed to validate individual components (e.g., formal methods) or a system as a whole (e.g., red teaming). However, no single technique can provide the breadth of evidence needed to validate a system with respect to high-level survivability requirements. To accomplish this, we propose an integrated validation procedure (IVP) that begins with the formulation of a specific survivability requirement R and determines whether a system is valid with respect to R. The IVP employs a top-down approach that methodically breaks the task of validation into manageable tasks, and for each task, applies techniques best suited to its accomplishment. These efforts can be largely independent, and the results, which complement and supplement each other, are integrated to provide a convincing assurance argument. We then illustrate the IVP by applying it to an intrusion-tolerant information system being developed by the U.S. Department of Defense. In addition to validating the system against high-level survivability requirements, we demonstrate the use of model-based validation techniques, as a part of the overall validation procedure, to guide the system's design by exploring different configurations and evaluating tradeoffs. [ABSTRACT FROM AUTHOR]