Safety-critical Computer Systems Research Articles

An ontology-based fault generation and fault propagation analysis approach for safety-critical computer systems at the design stage

Abstract Fault propagation analysis is a process used to determine the consequences of faults residing in a computer system. A typical computer system consists of diverse components (e.g., electronic and software components), thus, the faults contained in these components tend to possess diverse characteristics. How to describe and model such diverse faults, and further determine fault propagation through different components are challenging problems to be addressed in the fault propagation analysis. This paper proposes an ontology-based approach, which is an integrated method allowing for the generation, injection, and propagation through inference of diverse faults at an early stage of the design of a computer system. The results generated by the proposed framework can verify system robustness and identify safety and reliability risks with limited design level information. In this paper, we propose an ontological framework and its application to analyze an example safety-critical computer system. The analysis result shows that the proposed framework is capable of inferring fault propagation paths through software and hardware components and is effective in predicting the impact of faults.

Realization of Dependable Digital Systems for Safety-Critical Computer Systems using FPGAs

Digital systems built based on field-programmable-gate-arrays (FPGAs) are increasingly being used in safety-critical computer systems. These systems typically require high levels of integrity, reliability, and performance to ensure the correct operation of the critical application in which the digital systems are embedded. To achieve the safety and functional objectives, many hardware architectural scenarios based on fault tolerance techniques were proposed. This research paper presents a new dependable digital system (DDS) that consists of fault tolerant blocks (FTBs), spare functional blocks (SFBs), synchronization units, and input output units. Markov-based chain have been used to model the correct operation of the proposed hardware system that is targeted to be realized on FPGA-based technology. This system was designed to be reliable against transient faults (TF), permanent faults (PF), and hardware common cause failures (CCF). The reliability analysis of the proposed system was accomplished with Markov modeling techniques which could express the regenerative behavior of the digital system. Certain states in the system represent system failure, while others represent fault-free behavior in the presence of faults. Finally, based on the MathWorks Simulink simulation results of modeling the DDS digital system, the system does meet its functionality and reliability requirements.

Reliability Analysis of Safety Critical Computer System Considering Common Cause Failure

The rail transit operation control system and nuclear reactor control system are extremely high for safety and reliability, especially the high speed maglev of more than 600 kilometers per hour. Therefore, the effect of common cause failure on the reliability of safety critical computer must be considered.The safety critical system is the key of the above-mentioned safety demanding system. In this paper, the structure and working principle of a safety critical computer with two-out-of-three and double two-out-of-two are analyzed.Considering the common cause failure and maintenance rate, by using Markov model, the reliability models of safety critical computer system with with two-out-of-three and double two-out-of-two are established. The simulation results show that the existence of common cause failure greatly reduces the reliability of the system. The maintenance rate can improve the reliability of the system. At the same time, considering the common cause failure and the maintenance rate, it is proved that the reliability of the two-out-of-three safety critical computer system is higher than double two-out-of-two safety critical computer system. Therefore, it provides theoretical support for the design of the subsequent differentiated security computer platform.

Investigating the Effect of System Reliability, Risk, and Role on Users' Emotions and Attitudes toward a Safety-Critical Drone System

ABSTRACTIn safety-critical systems, it is essential to communicate relevant information to facilitate decision-making, promote trust, and improve performance without overloading users. To explore the effect of system performance information on rational and emotional processing by users, we performed a between-subject experiment in which participants were asked to imagine themselves as a drone operator or system administrator in a high-, medium-, or low-risk scenario. Then, based on their imagined scenario and role, participants rated the relevance of four aspects of system reliability to decision-making with the system, as well as the expected intensity of the GREAT emotions. Results indicate that system performance information affected participants’ reasoning differently depending on risk level. Moreover, participants had different perspectives depending on their role in the system. Those in administrator roles indicated higher respect ratings for those with a similar role. These findings demonstrate that contextual risk and a user’s role can influence emotions and attitudes toward safety-critical computer systems.

Area, Throughput, and Power Trade-Offs for FPGA- and ASIC-Based Execution Stream Compression

An emerging trend in safety-critical computer system design is the use of compression—for example, using cyclic redundancy check (CRC) or Fletcher checksum (FC)—to reduce the state that must be compared to verify correct redundant execution. We examine the costs and performance of CRC and FC as compression algorithms when implemented in hardware for embedded safety-critical systems. To do so, we have developed parameterizable hardware-generation tools targeting CRC and two novel FC implementations. We evaluate the resulting designs implemented for FPGA and ASIC and analyze their efficiency. While CRC is often best, FC dominates when high throughput is needed.

The Research Framework for Quantitative Safety Assessment for Safety-Critical Computer Systems

Objectives: A safety-critical computer system has to be designed with safety in mind. The purpose of this paper is to identify and assess the safety hazards by using the proposed framework for Safety-Critical Computer Systems (SCCS). Methods/Statistical Analysis: Computer software quality models like McCall’s and Boehm’s were deficient in addressing the basic safety issues of SCCS. This paper proposes another safety model for software safety by adjusting McCall’s product quality model that particularly distinguishes the conditions comparing to software safety in safety-critical applications. The conditions in the proposed software safety model relate to Hazard Analysis distinguishing of Completeness of safety requirements, Safety-critical Design, Coding, and Testing. Findings: The criteria in the proposed software safety model relate to Hazard Analysis (HA) distinguishing of safety requirements, Completeness of safety requirements, Safety-critical Design, Safety-critical Coding, and Safety-critical Testing. The proposed safety model changes the current quality model by presenting different safety criteria’s and metrics in all phases of Software life cycle to assess the software safety. This model was connected to a safety basic Railroad Crossing Control System (RCCS) which is a laboratory prototype and obtained better results in terms of safety. Application/Improvements: This model was connected to a safety basic Railroad Crossing Control System (RCCS) which is a laboratory prototype and obtained better results in terms of safety.

The Quantitative Safety Assessment and Evaluation for Safety-Critical Computer Systems

The rapid increase in computer-related technologies puts greater demands on the software-controlled systems. These demands place the software in total control over safety-critical systems. A fault in such a Safety-Critical Computer Systems (SCCS) can result in catastrophic concerns such as loss of life, harm, or equipment damage. In order to detect and prevent such faults, some safety standards, safety analysis and fault-tolerant techniques have been developed. Still, it requires adequate methodologies and frameworks to complete verification of these SCCS. In this work, the software safety is considered into 3 parts: Safety Modeling, Safety Measurement and Safety Management, with assurance lying down to develop high quality software for SCCS. The proposed methodology is SM-Cube (Safety Modeling, Safety Measurement and Safety Management) which is the Safety-Critical Computer Systems concerned. SM-Cube provides a clarified differentiation for assessing and evaluating the safety embedded into the software. SM-Cube consists of required processes and operations for developing SCCS free of faults. This proposed SM-cube has been applied to safety-critical software based Railroad Crossing Control System (RCCS) which is a laboratory prototype. The outcomes of the prototype confirmed that all critical operations have been safe and risk free. The development of the software based on the proposed SM-cube for RCCS have shown a simplified and improved safety-critical operations of the overall system performance

A GQM Based Approach towards the Development of Metrics for Software Safety

Software sometimes safety-critical if it resides in a safety-critical computer systems and it causes or contributes to hazards. Therefore, Safety-critical software intensive systems require verification and validation to confirm that they function as per the safety requirements. Software Safety is a combination of many factors. Metrics are commonly used in engineering as measures for the performance of a system on a given attribute. This paper presents a methodology for software safety framework based on Goal-Question-Metric (GQM) Approach. The proposed methodology was applied to a safety-critical Railroad Crossing Control System (RCCS) which is a laboratory prototype. The outcomes of the prototype are satisfactory and observed that safety risks are within the acceptable threshold level.

Implementability of requirements in the four-variable model

Many safety-critical computer systems are required to monitor and control physical processes. The four-variable model, which has been used successfully in industry for almost four decades, helps to clarify the behaviors of, and the boundaries between the physical processes, input/output devices, and software. In this model, the acceptable behaviors of the software are constrained by the physical environment, system requirements, and input/output devices. If acceptable software behaviors are possible, then the system requirements are said to be implementable with respect to these constraints. The only acceptability condition proposed in the literature deems as acceptable software behaviors that can lead to undesirable system behaviors, in particular, nondeterministic system behaviors that for the same input sometimes do not produce any results and some other times produce expected results. In this sense, the acceptability condition can be seen as angelic. In this paper we strengthen the acceptability condition using the demonic calculus of relations such that no undesirable system or software behaviors are allowed and prove a necessary and sufficient implementability condition for the system requirements. As a byproduct, we also obtain a mathematical characterization of the least restrictive software specification, which, for all intents and purposes, can play the role of the software requirements.

Safety Critical Computer Systems: Failure Independence and Software Diversity Effects on Reliability of Dual Channel Structures

Abstract The paper examines Safety Critical real-time Systems (SCS), in particular their dual-channel structures. The analytical study on computer-based SCS recognizing failures comparing the results of both channels is based on the theory of reliability. The aim is to establish reliable models that include independence rate between failures of both channels and their diversity. The created formulas are used to calculate the function of reliability, probability of safety failures and hazard failures. The intensity of failures of the system and the intensity of its recovery, the ratio between Common Mode Failures (CMF) and failures of individual channels are explicitly presented in the models. for the independence of hardware and software Faults are introduced. The analytical models obtained allow evaluating the effects of independence of channels and the depth of their diversity. A formula for calculating the improvement of safety thanks to the dual-channel architecture in comparison to a single-channel structure of the same output reliability parameters has been worked out. Analytical models can be used to calculate indicators of systems in order to establish their compliance with safety standards. Analytical models can be used to calculate indicators of specific systems to determine their compliance with safety standards. The results make possible to find out technical solutions with better reliability and safety features.

A Newly Developed Safety-Critical Computer System for China Metro

Applications of advanced electronic technologies have greatly increased the efficiency and performance of safety-critical computer systems. In addition, the architectural flexibility of these systems reduces the types of printed circuit boards they can use, thereby reducing difficulties with maintenance. A newly developed safety-critical computer system is presented in this paper. The system uses some advanced electronic technologies and can be reconfigured to be a triple-modular-redundant system or a dual-modular-duplex-redundant system for different applications. The system's architecture and fail-safe technologies are discussed, and its reliability, availability, maintainability, and safety (RAMS) are evaluated based on the Markov method. Based on these evaluations, the safety-critical computer system developed herein demonstrates great potential for rail use.

A Methodological Framework for Software Safety in Safety Critical Computer Systems

Software safety must deal with the principles of safety management, safety engineering and software engineering for developing safety-critical computer systems, with the target of making the system safe, risk-free and fail-safe in addition to provide a clarified differentaition for assessing and evaluating the risk, with the principles of software risk management. Problem statement: Prevailing software quality models, standards were not subsisting in adequately addressing the software safety issues for real-time safety-critical embedded systems. At present no standard framework does exist addressing the safety management and safety engineering priniciples for the development of software safety in safety-critical computer systems. Approach: In this study we propose a methodological framework involving safety management practices, safety engineering practices and software development life cycle phases for the development of software safety. In this framework we make use of the safety management practices such as planning, defining priniciples, fixing responsibilities, creteria and targets, risk assessment, design for safety, formulating safety requirements and integrating skills and techniques to address safety issues early with a vision for assurance and so on. In this framework we have also analysed integration of applicability of generic industrial heirarchy and software development heirarchy, with derived cyclical review involving safety professionals generating a nodal point for software safety. Results: This framework is applied to safety-critical software based laboratory prototype Railroad Crossing Control System (RCCS) with a limited complexity. The results have shown that all critical operations were safe and risk free. Conclusion: The development of software based on the proposed framework for RCCS have shown a clarified and improved safety-critical operations of the overall system peformance.

A Hardware Virtualization Based Component Sandboxing Architecture

Modern applications comprise multiple components, such as browser plug-ins, often of unknown provenance and quality. Statistics show that failure of such components accounts for a high percentage of software faults. Enabling isolation of such fine-grained components is therefore necessary to increase the robustness and resilience of security-critical and safety-critical computer systems. In this paper, we evaluate whether such fine-grained components can be sandboxed through the use of the hardware virtualization support available in modern Intel and AMD processors. We compare the performance and functionality of such an approach to two previous software based approaches. The results demonstrate that hardware isolation minimizes the difficulties encountered with software based approaches, while also reducing the size of the trusted computing base, thus increasing confidence in the solution's correctness. We also show that our relatively simple implementation has equivalent run-time performance, with overheads of less than 34%, does not require custom tool chains and provides enhanced functionality over software-only approaches, confirming that hardware virtualization technology is a viable mechanism for fine-grained component isolation.

Named memory pool for Ada

This paper proposes a new paradigm in Ada to access different types of memory in single or multi-partitions real-time, safety-critical computer systems. The approach recognizes that simple allocation and assignment statements are often insufficient. The named memory pool model compliments the storage pools in Ada.

Scalable diversity-oriented decisions and technologies for dependable SoPC-based safety-critical computer systems and infrastructures

An approach to development and implementation of multi-version technologies (MVT) for creating dependable system-on-programmable chip (SoPC)-based systems and infrastructures is described. It is based on a set of scalable diversity-oriented decisions selected using the proposed MVT-graph. This technique is applied for development of nuclear power plants (NPP) instrumentation and control (I&C) platform. The diverse I&C platform RADIY, which is designed, produced and supplied by the Radiy Company in Ukraine is described and analysed. The results of implementation of the suggested decisions and technologies in safety-critical dependable systems and infrastructures in Ukrainian NPPs are analysed.

Certification of software for real-time safety-critical systems: state of the art

This paper presents an overview and discusses the role of certification in safety-critical computer systems focusing on software, and partially hardware, used in the civil aviation domain. It discusses certification activities according to RTCA DO-178B “Software Considerations in Airborne Systems and Equipment Certification” and touches on tool qualification according to RTCA DO-254 “Design Assurance Guidance for Airborne Electronic Hardware.” Specifically, certification issues as related to real-time operating systems and programming languages are reviewed, as well as software development tools and complex electronic hardware tool qualification processes are discussed. Results of an independent industry survey done by the authors are also presented.

Formalization and assessment of regulatory requirements for safety-critical software

Regulatory requirements, as opposed to requirements for a particular system, have a generic nature, are applicable to a wide range of systems and are the basis for certification or licensing process. The important tasks in requirement engineering are resolving requirements inconsistencies between regulators and developers of safety-critical computer systems and the validation of regulatory requirements. This paper proposes a new approach to the regulatory process, including the use of formal regulatory requirements as a basis for the development of software assessment methods. We address the differences between prescriptive and nonprescriptive regulation, and suggest a middle approach. The notion of a normative package is introduced as the collection of documents to be used by a regulator and provided to a developer. It is argued that the normative package should include not only regulatory requirements, but also methods of their assessment. This approach is illustrated with examples of requirements for protecting computer control systems against unauthorized access and against common-mode software failures, using the Z notation for the formalization.

Cover feature - Designing safety-critical computer systems

The ubiquitous computer is the electronic component of choice for system developers, who increasingly exploit computing's power in safety-critical applications such as steer-by-wire automotive systems and powered prosthetics. However, these computer-based systems raise the ongoing concern that they might fail and cause harm. Exploring the systematic design of safety-critical computer systems helps to show how engineers can verify that these designs will be safe. Achieving risk reduction requires dealing with all the system's components: hardware and software, sensors, effectors, the operator, and the primary source of harmful energy or toxicity: the application.

Guest Editorial: A Review of Worst-Case Execution-TimeAnalysis

A development process for safety-critical real-time computer systems has to emphasize the importance of time. On the one hand, such a development process has to be based on hardware and software technology that supports predictability in the time domain. On the other hand, the development process has to provide tools for assessing and verifying the correctness of the timing of both the hardware and the software components of the real-time systems being developed. Together with schedulability analysis, Worst-case execution time analysis (WCET analysis) forms the basis for establishing confidence into the timely operation of a real-time system. WCET analysis does so by computing (upper) bounds for the execution times of the tasks in the system. These bounds are needed for allocating the correct CPU time to the tasks of an application. They form the inputs for schedulability tools, which test whether a given task set is schedulable (and will thus meet the timing requirements of the application) on a given target system. While schedulability analysis is one of the traditional fields of investigation in real-time systems research, WCET analysis caught the attention of the research community only about ten years ago (Kligerman and Stoyenko, 1986; Mok et al., 1989; Puschner and Koza, 1989; Shaw, 1989). In the last decade, however, more and more research groups started to put a focus on WCET analysis. As a result, substantial progress has been made in this area in a relatively short time. After ten years of research in the field, it is appropriate to have a special issue on WCET analysis. It is the goal of this special issue to review the achievements in WCET analysis and to report about the recent advances in this field. In the following section we will define the problem area of WCET analysis and thus clarify the issue WCET analysis is dealing with— still many people mix up execution-time analysis and response-time analysis. We will then summarize the subproblems of WCET analysis and provide an overview of previous contributions to the state of the art in this field. At the end of the introduction we will give an overview to the research papers that have been selected for this special issue.

Software Requirements Specification and System Safety

Computer software is playing an increasingly important role in safety-critical embedded computer systems, where incorrect operation of the software could lead to loss of life, substantial material or environmental damage, or large monetary losses. Such diverse technologies as avionics, automobile drive trains, power plants, and medical equipment are relying more and more on the computer to control system parameters. Although software is a powerful and flexible tool for industry, these very advantages have contributed to a corresponding increase in system complexity. Traditional approaches to system development have not successfully handled the problems of increased system complexity. The fatal accidents caused by software in the Therac-25 radiation therapy machine, as well as other incidents, have brought public attention to these problems. Ironically, it is becoming clear that the powerful control logic that software can bring to a system can also impair the ability of the systems analyst to study and understand, and hence safely control, the system’s behavior. sion avoidance System II). Furthermore, using a formal requirements specification language, for example, RSML, enables several types of automated or semi automated analysis techniques that can be used to detect and eliminate potential safety problems from the specification. In this tutorial, we will discuss techniques for automatically detecting incomplete, inconsistent, and nondeterministic requirements, show how fault tree analysis can be used in the RSML framework, and demonstrate how a new analysis technique called deviation analysis can be used to evaluate the effects on the system if the inputs to the system deviates from expected value.