N-version Programming Research Articles

The Methodology of N-Version Programming

Software Fault Tolerance is evolved as a technique to increase the dependability of computing systems. Because of limitations with producing of error free software, Majority of software errors are design faults. The root cause for software design errors is the complexity of the problem domain. Software Fault Tolerance (SFT) has become an important concern A number of Fault Tolerance techniques designed at minimizing the effect of software faults are being investigated. An N-version software (NVS) unit is a fault tolerant software unit that depends on a generic decision algorithm to determine a consensus result from the results delivered by two or more member versions of the NVS unit. Results of five consecutive experimental investigations are summarized, and a design paradigm for NVS is presented. In this paper, a critical review of NVP is presented. The advantages, current challenges, and further research areas of NVP are discussed.

NHPP-Based Software Reliability Growth Modeling and Optimal Release Policy for N-Version Programming System with Increasing Fault Detection Rate under Imperfect Debugging

Attempts have been made to propose a software reliability growth model (SRGM) based on non-homogeneous Poisson process for NVP system. The proposed model concerns the combined effect of increasing fault detection rate and fault removal efficiency under imperfect debugging. Moreover, a cost model has been developed. Also, an optimal release policy based on the proposed cost model and the number of remaining faults has been discussed. The performance of the proposed model has been compared with existing SRGMs for NVP system. Toward the end, the proposed model has been validated using some real data.

Application of majority voting and consensus voting algorithms in N-version software

N-version programming is one of the most common techniques which is used to improve the reliability of software by building in fault tolerance, redundancy and decreasing common cause failures. N different equivalent software versions are developed by N different and isolated workgroups by considering the same software specifications. The versions solve the same task and return results that have to be compared to determine the correct result. Decisions of N different versions are evaluated by a voting algorithm or the so-called voter. In this paper, two of the most commonly used software voting algorithms such as the majority voting algorithm and the consensus voting algorithm are studied. The distinctive features of Nversion programming with majority voting and N-version programming with consensus voting are described. These two algorithms make a decision about the correct result on the base of the agreement matrix. However, if the equivalence relation on the agreement matrix is not satisfied it is impossible to make a decision. It is shown that the agreement matrix can be transformed into an appropriate form by using the Boolean compositions when the equivalence relation is satisfied.

Making Multivariant Programming Practical and Inexpensive

Since it was first proposed in 1978, n-version programming (NVP) has been a mainstay technique for obtaining fault tolerance in high-reliability software. Although subsequent research on NVP has indicated that coincident failures across different versions can be more common than initially expected, NVP remains the “gold standard” for application domains in which high reliability is of critical importance, such as fly-by-wire avionics control software.

English

This paper introduces a novel method of continuous verification of simulation software used in decision-support systems for nuclear emergency management (DSNE). The proposed approach builds on methods from the field of software reliability engineering, such as N-Version Programming, Recovery Blocks, and Consensus Recovery Blocks. We introduce a new acceptance test for dispersion simulation results and a new voting scheme based on taxonomies of simulation results rather than individual simulation results. The acceptance test and the voter are used in a new scheme, which extends the Consensus Recovery Block method by a database of result taxonomies to support machine-learning. This enables the system to learn how to distinguish correct from incorrect results, with respect to the implemented numerical schemes. Considering that decision-support systems for nuclear emergency management are used in a safety-critical application context, the methods introduced in this paper help improve the reliability of the system and the trustworthiness of the simulation results used by emergency managers in the decision making process. The effectiveness of the approach has been assessed using the atmospheric dispersion forecasts of two test versions of the widely used RODOS DSNE system. ACM CCS (2012) Classification : Information systems→Information systems applications→Decision support systems→Expert systems *To cite this article: T. B. Ionescu and W. Scheuermann, Improving the Reliability of Decision-Support Systems for Nuclear Emergency Management by Leveraging Software Design Diversity, CIT. Journal of Computing and Information Technology , vol. 24, no. 1, pp. 45-63, 2016.

A Proposed System for Real Time Adaptive N Version Programming

N-version programming is a fault tolerance technique that depends on a generic decision algorithm to determine a consensus result from the results delivered by two or more member versions of the software. In N-version programming, N teams of developers work independently on N unique but equivalent implementations of the same program. The major objectives of the NVP process are to maximize the independence of version development and to employ design diversity in order to minimize the probability that two or more member versions will produce similar erroneous results that coincide in time for a decision (consensus) action. But this fault-tolerance technique has been criticized for its statistical assumptions and high cost. A solution is proposed in which there are N versions of the software out of which t versions implement only a subset of the entire functionality which is highly critical while (N – t) versions implement the entire functionality. One of the biggest hurdles in using N version programming for fault tolerance is its high implementation cost. This proposed technique minimizes the cost of implementation while improving the efficiency and reliability of the system.

Diversity and adjudication

This paper takes an axiomatic and calculational view of diversity (or “N-version programming”), where multiple implementations of the same specification are executed in parallel to increase dependability. The central notion is “adjudication”: once we have multiple, potential different, outcomes, how do we come to a single result? Adjudication operators are explicitly defined and some general properties for these explored.

The Multiple Facets of Software Diversity

Early experiments with software diversity in the mid 1970s investigated N-version programming and recovery blocks to increase the reliability of embedded systems. Four decades later, the literature about software diversity has expanded in multiple directions: goals (fault tolerance, security, software engineering), means (managed or automated diversity), and analytical studies (quantification of diversity and its impact). Our article contributes to the field of software diversity as the first work that adopts an inclusive vision of the area, with an emphasis on the most recent advances in the field. This survey includes classical work about design and data diversity for fault tolerance, as well as the cybersecurity literature that investigates randomization at different system levels. It broadens this standard scope of diversity to include the study and exploitation of natural diversity and the management of diverse software products. Our survey includes the most recent works, with an emphasis from 2000 to the present. The targeted audience is researchers and practitioners in one of the surveyed fields who miss the big picture of software diversity. Assembling the multiple facets of this fascinating topic sheds a new light on the field.

The mathematical statement for the solving of the problem of N-version software system design

The N-version programming, as a methodology of the fault-tolerant software systems design, allows successful solving of the mentioned tasks. The use of N-version programming approach turns out to be effective, since the system is constructed out of several parallel executed versions of some software module. Those versions are written to meet the same specification but by different programmers. The problem of developing an optimal structure of N-version software system presents a kind of very complex optimization problem. This causes the use of deterministic optimization methods inappropriate for solving the stated problem. In this view, exploiting heuristic strategies looks more rational. In the field of pseudo-Boolean optimization theory, the so called method of varied probabilities (MVP) has been developed to solve problems with a large dimensionality.

Availability analysis for embedded system with N-version programming using fuzzy approach

This present study deals with the conventional as well as fuzzy availability analysis of an embedded system considering both the software and hardware reliability. In this model, we have considered a specified number of subsystems composed of software and hardware components arranged in series. In N-version programming for the execution of the same task, N-versions of software are running at same time. Further, the assumption of rebooting is also taken in to consideration. Markov analysis has been done in which all the rates are exponentially distributed. To validate the proposed model, a numerical illustration is also carried out for conventional and fuzzy approaches for analysing the system performance by assuming the triangular membership function of the system descriptors.

A new bitwise voting strategy for safety-critical systems with binary decisions

The main issue in controlling safety-critical systems such as nuclear power reactors or railway interlocking systems is to provide high safety and reliability where the risk ratio is at the highest level because small errors might result in hazardous accidents (e.g., death or injury of many people). The N-version programming technique, where N-different modules run in parallel, can be used to improve the reliability and safety of such systems at the desired safety level. Decisions of N-different modules are then evaluated by another component, usually known as the voter, using different voting strategies. In the current study a bitwise voting strategy to evaluate module decisions that are based on safe-states of variables is proposed and possible synchronization problems between the modules are determined. Sequence diagrams and solutions for synchronization problems are also explained.

Cooperative mode: Comparative storage metadata verification applied to the Xbox 360

This work addresses the question of determining the correctness of forensic file system analysis software. Current storage systems are built on theory that is robust but not invincible to faults, from software, hardware, or adversaries. Given a parsing of a storage system of unknown provenance, the lack of a sound and complete analytic theory means the parsing's correctness cannot be proven. However, with recent advances in digital forensic theory, a measure of its incorrectness can be taken.We present FSNView, an N-Version programming utility. FSNView reports exhaustively the metadata of a single disk image, using multiple storage system parsers. Each parser reports its perspective of the metadata in Digital Forensics XML, a storage language used recently in a study on differential analysis. We repurpose the tools used for studying the changes in file systems from time to the changes in file systems from perspective. The differences in metadata summaries immediately note bugs in at least one of the tools employed. Diversity in tools and their analysis algorithms strengthens the analysis of a storage subject.We apply file system differencing to study the external storage of the Microsoft Xbox 360 game console. The console's storage serves as an exemplar analysis subject; the described strategy is general to storage system analysis. The custom volume management and new-though-familiar file system are features typical to an embedded system analysis. Two open-source utilities developed solely for analyzing this game console, and a third developed for general file system forensics, are extended to compare storage system metadata perspectives. We present a new file system and revisions to the DFXML language, library, and differencing process, which were necessary to enable a principled, automatic evaluation of storage analysis tools.

Designing Fault Tolerance Strategy by Iterative Redundancy for Component-Based Distributed Computing Systems

Reliability is a critical issue for component-based distributed computing systems, some distributed software allows the existence of large numbers of potentially faulty components on an open network. Faults are inevitable in this large-scale, complex, distributed components setting, which may include a lot of untrustworthy parts. How to provide highly reliable component-based distributed systems is a challenging problem and a critical research. Generally, redundancy and replication are utilized to realize the goal of fault tolerance. In this paper, we propose a CFI (critical fault iterative) redundancy technique, by which the efficiency can be guaranteed to make use of resources (e.g., computation and storage) and to create fault-tolerance applications. When operating in an environment with unknown components’ reliability, CFI redundancy is more efficient and adaptive than other techniques (e.g., K-Modular Redundancy and N-Version Programming). In the CFI strategy of redundancy, the function invocation relationships and invocation frequencies are employed to rank the functions’ importance and identify the most vulnerable function implemented via functionally equivalent components. A tradeoff has to be made between efficiency and reliability. In this paper, a formal theoretical analysis and an experimental analysis are presented. Compared with the existing methods, the reliability of components-based distributed system can be greatly improved by tolerating a small part of significant components.

A study of N-version programming and its impact on software availability

N-version programming is a useful approach to improve the quality of software, especially for safety-critical systems. Positive performance in enhancing software availability is an expected result. In this paper, a software availability model for the study of the impact of N-version programming technique is proposed and investigated. The characteristics of the N-version software system and its operation and failure process are analysed. Based on this analysis, the time-dependent behaviour of the software system, which alternates between online and offline states, is described using a Markov chain. This model derives quantitative measures of software availability. Numerical examples and comparisons are also presented in this paper to directly illustrate N-version programming's positive impact on software availability measures. N-version programming generally provides a positive impact on the system. However, it does not always guarantee a higher availability performance. General recommendations are provided on N-version software structure design based on cost-effective criteria.

Comparison of the Parallel and Serial Architectures for N-Version Programming as Applied to Railway Interlocking Systems

The concept of functional safety gains importance with the increasing number of hazardous accidents in the railway industry. In literature, some hardware and software architectures are proposed for the functional safety. As N-version programming is getting popular as preferred software architecture in railway industry, the effect of various hardware implementations of N-version programming on the functional safety remains unclear. In this study, two different hardware setups will be evaluated for N-version programming. After the effect of these hardware setups on the functional safety is analyzed, the effects on the hardware usage and overall response time will be tested on a sample train station.

N-version Programming for Railway Interlocking Systems: Synchronization and Voting Strategy

The main issue in controlling safety-critical systems such as nuclear power reactors or railway signalization systems where risk ratio is at the highest level because small errors might result in hazardous accidents (e.g. death or injury of several people) is to satisfy safety-related standards and provide high-safety with high-reliability. In order to improve reliability and safety of such systems to the required level by decreasing common-cause failures at the same time, diverse programming (or N-version programming) technique where N-different independently designed modules run in parallel on the same input output specifications can be used. In this study, a new bitwise voting strategy based on safe-states of variables is proposed and possible critical races between modules those run in a parallel manner are determined. Solutions for critical races are also explained.

A Dependent Model for Fault Tolerant Software Systems During Debugging

This paper proposes a special redundant model for describing the s-dependency of multi-version programming software during testing and debugging. N-version programming (NVP) is one of the most important software fault tolerance techniques. Many papers have studied the issue of fault correlation among versions. However, only a few of them consider this issue during the testing and debugging part of the software development life cycle. During testing and debugging, faults may not be successfully removed. Imperfect debugging may result in unsuccessful removal, and the introduction of new faults. Different from existing NVP models, the model proposed in this paper allows an assessment of s-dependency when correlated failures may not necessarily occur at the same execution time point. The model focuses on 2 VP systems. It is developed to be a bivariate counting process by assuming positive s-dependency among versions. Considering imperfect debugging, this bivariate process characterizes dynamic changes of fault contents for each version during testing and debugging. The system reliability, expected number of faults, probability of perfect debugging, and parameter estimation of model parameters are presented. An application example is given to illustrate the proposed model. The paper provides an alternative approach for evaluating the reliability of 2 VP software systems when there is positive s -dependency between versions.

Diversity Through N-Version Programming: Current State, Challenges and Recommendations

N-version programming is a software development paradigm that draws upon the concept of diversity to increase the reliability of software. The central idea is to independently produce multiple functionally equivalent versions of a program, and execute them in parallel. If the versions fail independently, then the probability of multiple versions producing a faulty output on any given input is very small; much lower than the failure probability of any single version. In this paper, we examine and contrast various experiments that have been performed to evaluate the benefits of this approach and draw some conclusions. We find that for diversity to be effective, it must be introduced in a targeted and informed manner and encompass several phases of the software’s development.

XFTRTS - A XtratuM Based Fault-Tolerant Real-Time Control System

Nowadays there are a few works which are concerned with the virtualization technology and the fault-tolerance technology, because virtualization system can provide an environment allowing multiple operating systems running in concurrent way. In this paper, we based on a real-time hypervisor-XtratuM, propose the architecture of a fault-tolerant real-time control system (XFTRTS), which provide local backup execution and to support different level diversity including N-version programming on a single host. Furthermore, we implement a prototype of XFTRTS and test its important performance metric–latency, which is within two microseconds.

Dependability and Rollback Recovery for Composite Web Services

In this paper, we propose a service-oriented reliability model that dynamically calculates the reliability of composite web services with rollback recovery based on the real-time reliabilities of the atomic web services of the composition. Our model is a hybrid reliability model based on both path-based and state-based models. Many reliability models assume that failure or error arrival times are exponentially distributed. This is inappropriate for web services as error arrival times are dependent on the operating state including workload of servers where the web service resides. In this manuscript, we modify our previous model (for software based on the Doubly Stochastic Model and Renewal Processes) to evaluate the reliability of atomic web services. In order to fix our idea, we developed the case of one simple web service which contains two states, i.e., idle and active states. In real-world applications, where web services could contain quite a large number of atomic services, the calculus as well as the computing complexity increases greatly. To limit our computing efforts and calculus, we chose the bounded set techniques that we apply using the previously developed stochastic model. As a first type of system combination, we proposed to study a scheme based on combining web services into parallel and serial configurations with centralized coordination. In this case, the broker has an acceptance testing mechanism that examines the results returned from a particular web service. If it was acceptable, then the computation continues to the next web service. Otherwise, it involves rollback and invokes another web service already specified by a checkpoint algorithm. Finally, the acceptance test is conducted using the broker. The broker can be considered as a single point of failure. To increase the reliability of the broker introduced in our systems and mask out errors at the broker level, we suggest a modified general scheme based on Triple modular redundancy and N-version programming. To imitate a real scenario where errors could happen at any stage of our application and improve the quality of Service QoS of the proposed model, we introduce fault-tolerance techniques using an adaption of the recovery block technique.