Toward dependable safety-critical software

IEEE Trans. Knowl. Data Eng.

1999

Large-scale information systems emerging in challenging application fields must meet the high standards of reliability, maintainability, and service interruption bound requirements. Their operations are entirely, or partially, of the distributed real-time data object manipulation type. A new architecture for such systems is presented in this paper. The original aspects of the architecture are mainly in two parts: 1) the time-triggered message-triggered object (TMO) structuring of the middleware and the application software of distributed real-time information systems; and 2) the dynamic configuration management subsystem (DCMS), based on the supervisor-based network surveillance (SNS) scheme. The positive impacts of this TMO structuring on maintainability and service interruption bounds are first discussed, with distributed replicated information service systems and other systems as examples. Then, the main discussion dwells on the DCMS architecture¦in particular, formal presentation of its key component: the SNS scheme. As a component of DCMS, the network surveillance (NS) subsystem enables fast learning by each interested fault-free node in the system of the faults or repair completion events occurring in other parts of the system. Currently, concrete real-time NS schemes effective in distributed systems based on point-to-point network architectures are scarce. The SNS scheme presented in this paper is a semicentralized real-time NS scheme effective in a variety of point-to-point networks. This scheme is highly scalable. An efficient implementation model for the SNS scheme is presented that can be easily adapted to various commercial operating system kernels. This paper also presents a formal analysis of the SNS scheme, on the basis of the implementation model, to obtain its strongly competitive tight bounds on the fault detection latency. Finally, some DCMS implementation issues are discussed that remain to be addressed in future research.

Section: Fundamental Types Of Rt Data Server Objects and Tmo Network mentioning

confidence: 99%

“…Faults in the processor represent faults in the executing software that could cause the node to crash, faults in the processor hardware, faults in memory modules, etc. [2]. Faults in the I-unit represent the faults in various components of a node (both hardware and software) that are involved in receiving a message from the network.…”

Section: Fault Sourcesmentioning

confidence: 99%

Dynamic configuration management in reliable distributed real-time information systems

IEEE Trans. Knowl. Data Eng.

1999

“…The complexity of large-scale real-time systems used in safety-critical applications has been growing rapidly in recent years [Bas96,Yen97]. Such applications impose stringent reliability requirements on the computing systems, including the requirements that recovery from both hardware and software faults be tightly bounded in time.…”

Section: Introductionmentioning

confidence: 99%

High-coverage fault tolerance in real-time systems based on point-to-point communication

Proceedings 1997 High-Assurance Engineering Workshop

The distributed recovery block (DRB) scheme is a widely applicable approach for realizing both hardware and software fault tolerance in real-time distributed and parallel computer systems. One of the most important extensions of the DRB scheme which were outlined in recent years but not developed fully is the integration of the DRB scheme and a network surveillance (NS) scheme. We recently developed an NS scheme effective in a variety of point-to-point networks and it is called the supervisor-based NS (SNS) scheme. In this paper, we present an integration of the DRB scheme with the SNS scheme, called the DRB/SNS scheme. This scheme is a significant improvement over the previous versions of the DRB scheme with respect to the fault coverage and recovery time bound achieved in the systems that are based on point-to-point networks. The execution support for the integrated scheme has been implemented as a part of the DREAM kernel prototype, a timeliness-guaranteed operating system kernel developed at the University of California, Irvine. The recovery time bound of the DRB/SNS scheme is analyzed on the basis of the prototype implementation.

The PSTR/SNS scheme for real-time fault tolerance via active object replication and network surveillance

IEEE Trans. Knowl. Data Eng.

2000

ÐThe time-triggered message-triggered object (TMO) scheme was formulated a few years ago as a major extension of the conventional object structuring schemes with the idealistic goal of facilitating general-form design and timeliness-guaranteed design of complex real-time application systems. Recently, as a new scheme for realizing TMO-structured distributed and parallel computer systems capable of both hardware and software fault tolerance, we have formulated and demonstrated the primary-shadow TMO replication (PSTR) scheme. An important new extension of the PSTR scheme discussed in this paper is an integration of the PSTR scheme and a network surveillance (NS) scheme. This extension results in a significant improvement in the fault coverage and recovery time bound achieved. The NS scheme adopted is a recently developed scheme effective in a wide range of point-to-point networks and it is called the supervisor-based NS (SNS) scheme. The integration of the PSTR scheme and the SNS scheme is called the PSTR/SNS scheme. The recovery time bound of the PSTR/SNS scheme is analyzed on the basis of an implementation model that can be easily adapted to various commercial operating system kernels.