1. 1 Software Fault Protection Allen Goldberg Kestrel Technology

2. Workshop on Aviation Software, Oct. 2006 System Engineering System engineers build reliable systems from less reliable components. Redundancy is a primary means of achieving reliability. Systems are monitored for anomalies. Fault containment mechanisms (e.g. firewalls) limit damage

3. Workshop on Aviation Software, Oct. 2006 Assume perfection, little accommodation for failure even though perfection is rarely achievable Can we make reliable software systems from less reliable software components? What About software?

4. Workshop on Aviation Software, Oct. 2006 IVHM Fault Protection Systems System under control Fault Protection System model monitoring fault response

5. Workshop on Aviation Software, Oct. 2006 Software Fault Protection (SFP) SUT is software Software Fault Protection System Model of software monitoring fault response

6. Workshop on Aviation Software, Oct. 2006 Software Redundancy redundancy: different representations of software behavior code test case model … Redundancy is expensive How should you invest your “redundancy” dollars?

7. Workshop on Aviation Software, Oct. 2006 Effective Redundancy at Runtime software “model” “1.2” version programming 1 full-featured, efficient, complex version 0.2 backup version performs essential functions software Software Fault Protection System Model of software monitoring fault response

8. Workshop on Aviation Software, Oct. 2006 Software Model When software fails it is usually “obviously” wrong Simple models can detect errors interface behavior data reasonableness resource usage Our model extends ARINC 653 configuration file software Software Fault Protection System Model of software monitoring fault response

9. Workshop on Aviation Software, Oct. 2006 Failure responses safe modes: terminate non-essential activities component reset (supported by 653) transient errors lead to bad state component replacement (supported by 653) “1.2” version programming

10. Workshop on Aviation Software, Oct. 2006 Fault Containment Eliminate “non-logical” software dependencies error propagation (crash) resource contention ARINC 653 Fault containment is essential to fault isolation

11. Workshop on Aviation Software, Oct. 2006 Future Work relate SFP with multi-string flight computers, and system fault protection relate SFP to treatment of radiation induced SEU’s generate SFP models from software design artifacts generate SFP implementations from SFP models