A multi-level view of dependable computing

Abstract

This paper serves a dual purpose. It presents a unified framework and terminology for the study of computer system dependability. It also surveys the field of dependable computing in light of the proposed framework. Specifically, impairments to dependability are viewed from six levels, each being more abstract than the previous one. It is argued that all of these levels are useful, in the sense that proven dependability assurance techniques can be applied at each level, and that it is beneficial to have distinct, precisely defined terminology for describing impairments to, and procurement strategies for, computer system dependability at these levels. The six levels are: 1. Defect level or component level, dealing with deviant atomic parts. 2. Fault level or logic level, dealing with deviant signal values or path selections. 3. Error level or information level, dealing with deviant data or internal states. 4. Malfunction level or system level, dealing with deviant functional behavior. 5. Degradation level or service level, dealing with deviant performance. 6. Failure level or result level, dealing with deviant outputs or actions. Briefly, a hardware or software component may be defective (hardware may also become defective due to war and aging). Certain system states will expose the defect, resulting in the development of faults defined as incorrect signal values or decisions within the system. If a fault is actually exercised, it may contaminate the data flowing within the system, causing errors. Erroneous information or states may or may not cause the affected subsystem to malfunction, depending on the subsystem's design and error tolerance. A subsystem malfunction does not necessarily have a catastrophic, unsafe, or even perceivable service-level effect. Finally, degradation of service could eventually lead to system failure. At each of these six levels, the complementary approaches of prevention (avoidance or removal) and tolerance are discussed in relation to inter-level transitions.