| |
| |
| Preface | |
| |
| |
| |
| Introductory Elements: Dependability Issues | |
| |
| |
| |
| Quality | |
| |
| |
| |
| Quality Needs of Computer Systems | |
| |
| |
| |
| Quality Attributes | |
| |
| |
| |
| Dependability | |
| |
| |
| |
| Product Failures and their Consequences | |
| |
| |
| |
| Failure Causes | |
| |
| |
| |
| Taking Faults into Account | |
| |
| |
| |
| Definitions of Dependability | |
| |
| |
| |
| Means of Dependability | |
| |
| |
| |
| Evolution | |
| |
| |
| |
| Means | |
| |
| |
| |
| Summary | |
| |
| |
| |
| Destructive Mechanisms | |
| |
| |
| |
| General Context | |
| |
| |
| |
| Application Context | |
| |
| |
| |
| Life Cycle | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Specification | |
| |
| |
| |
| Design | |
| |
| |
| |
| Production | |
| |
| |
| |
| Operation | |
| |
| |
| |
| Product Model | |
| |
| |
| |
| Product Structure and Functioning | |
| |
| |
| |
| Hierarchy | |
| |
| |
| |
| Examples | |
| |
| |
| |
| Refinement Process and Primitive Components | |
| |
| |
| |
| Logical Part of a Drinks Distributor | |
| |
| |
| |
| Specifications | |
| |
| |
| |
| Design | |
| |
| |
| |
| Production | |
| |
| |
| |
| Operation | |
| |
| |
| |
| Failures and Faults | |
| |
| |
| |
| Failures | |
| |
| |
| |
| Definition | |
| |
| |
| |
| Characterization of Failures | |
| |
| |
| |
| Faults | |
| |
| |
| |
| Difficulties in Identifying the Causes of a Failure | |
| |
| |
| |
| Fault Characterization | |
| |
| |
| |
| Fault Origin | |
| |
| |
| |
| Nature of the Fault | |
| |
| |
| |
| Faults Occurring in the Life Cycle | |
| |
| |
| |
| Specification and Design Faults | |
| |
| |
| |
| Production Faults | |
| |
| |
| |
| Operational Faults | |
| |
| |
| |
| Examples of Functional Faults Altering a Drinks Distributor | |
| |
| |
| |
| Description of the Product | |
| |
| |
| |
| Faults Due to Functional Specifications | |
| |
| |
| |
| Faults Due to Technological Constraints | |
| |
| |
| |
| Design Faults | |
| |
| |
| |
| Interests and Limits of Fault Classes | |
| |
| |
| |
| Simplified Classification | |
| |
| |
| |
| Limitations of the Classification | |
| |
| |
| |
| Protection Against Faults and their Effects | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Faults and their Effects | |
| |
| |
| |
| Internal Effects | |
| |
| |
| |
| Fault | |
| |
| |
| |
| Error | |
| |
| |
| |
| Error Propagation | |
| |
| |
| |
| Latency | |
| |
| |
| |
| External Effects: Consequences | |
| |
| |
| |
| External Consequences of Faults | |
| |
| |
| |
| Inertia of the Functional Environment | |
| |
| |
| |
| Completeness and Compatibility | |
| |
| |
| |
| Influence of the Functional Environment: Emergence | |
| |
| |
| |
| Conclusion on the Effects of Faults | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Fault and Error Models | |
| |
| |
| |
| Definitions | |
| |
| |
| |
| Structural and Behavioral Properties | |
| |
| |
| |
| Structural Properties | |
| |
| |
| |
| Behavioral Properties | |
| |
| |
| |
| Significant Fault and Error Models | |
| |
| |
| |
| Faults and Errors at Different Representation Levels | |
| |
| |
| |
| Hardware Fault/Error Models | |
| |
| |
| |
| Software Fault and Error Models | |
| |
| |
| |
| Fault and Error Model Assessment | |
| |
| |
| |
| Assessment Criteria | |
| |
| |
| |
| Relations Between Fault/Error Models and Failures | |
| |
| |
| |
| Analysis of Two Simple Examples | |
| |
| |
| |
| First example: an Hardware Full Adder | |
| |
| |
| |
| Second Example: a Software Average Function | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Protective Mechanisms | |
| |
| |
| |
| Towards the Mastering of Faults and their Effects | |
| |
| |
| |
| Three Approaches | |
| |
| |
| |
| Fault Prevention | |
| |
| |
| |
| During the Specification | |
| |
| |
| |
| During the Design | |
| |
| |
| |
| During the Production | |
| |
| |
| |
| During the Operation | |
| |
| |
| |
| Fault Removal | |
| |
| |
| |
| General Notions | |
| |
| |
| |
| During Specification and Design | |
| |
| |
| |
| During the Production | |
| |
| |
| |
| During the Operation | |
| |
| |
| |
| Fault Tolerance | |
| |
| |
| |
| Failure Prevention by Masking | |
| |
| |
| |
| Error Detection and Correction | |
| |
| |
| |
| Fail-Safe Techniques | |
| |
| |
| |
| Resulting Fault Tolerance Classes | |
| |
| |
| |
| Dependability Means and Assessment | |
| |
| |
| |
| Conclusion | |
| |
| |
| |
| Dependability Assessment | |
| |
| |
| |
| Quantitative and Qualitative Assessment | |
| |
| |
| |
| Quantitative Assessment | |
| |
| |
| |
| Qualitative Assessment | |
| |
| |
| |
| Synthesis | |
| |
| |
| |
| Reliability | |
| |
| |
| |
| General Characteristics of the Reliability of Electronic Systems | |
| |
| |
| |
| Reliability Models | |
| |
| |
| |
| Failure Rate Estimation | |
| |
| |
| |
| Reliability Evolution | |
| |
| |
| |
| Testability | |
| |
| |
| |
| Maintainability | |
| |
| |
| |
| Maintenance | |
| |
| |
| |
| Maintainability | |
| |
| |
| |
| Reliability and Maintainability | |
| |
| |
| |
| Availability | |
| |
| |
| |
| Safety | |
| |
| |
| |
| Security | |
| |
| |
| |
| Synthesis of the Main Criteria | |
| |
| |
| |
| Quantitative Analysis Tools at System Level | |
| |
| |
| |
| Fault Simulation | |
| |
| |
| |
| Reliability Block Diagrams | |
| |
| |
| |
| Non-Deterministic State Graph Models | |
| |
| |
| |
| Inductive Qualitative Assessment: Failure Mode and Effect Analysis | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Means | |
| |
| |
| |
| FMECA | |
| |
| |
| |
| Deductive Qualitative Assessment: Fault Tree Method | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Software Example | |
| |
| |
| |
| Use of the FTM | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Redundancy | |
| |
| |
| |
| Functional and Structural Redundancy | |
| |
| |
| |
| Linguistic Redundancy | |
| |
| |
| |
| Redundancy of Computer Systems | |
| |
| |
| |
| Functional Redundancy | |
| |
| |
| |
| Static Functional Domains | |
| |
| |
| |
| Dynamic Functional Domains | |
| |
| |
| |
| Generalization of Functional Redundancy | |
| |
| |
| |
| Redundancy and Module Composition | |
| |
| |
| |
| Structural Redundancy | |
| |
| |
| |
| Definition and Illustration | |
| |
| |
| |
| Active and Passive Redundancy | |
| |
| |
| |
| Separable Redundancy | |
| |
| |
| |
| Summary of the Various Redundancy Forms | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Fault Avoidance Means | |
| |
| |
| |
| Avoidance of Functional Faults During Specification | |
| |
| |
| |
| Introduction | |
| |
| |
| |
| Specification Phase | |
| |
| |
| |
| Validation and Verification | |
| |
| |
| |
| Fault Prevention During the Requirement Expression | |
| |
| |
| |
| Introduction | |
| |
| |
| |
| Help in the Capturing of Needs | |
| |
| |
| |
| Expression Aid | |
| |
| |
| |
| Evaluation of a Method | |
| |
| |
| |
| Fault Avoidance During the Specification Phase | |
| |
| |
| |
| Fault Prevention: Valid Method | |
| |
| |
| |
| Fault Removal: Verification of the Specifications | |
| |
| |
| |
| Review Techniques | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Walkthrough | |
| |
| |
| |
| Inspection | |
| |
| |
| |
| Exercise | |
| |
| |
| |
| Avoidance of Functional Faults During Design | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Prevention by Design Model Choice | |
| |
| |
| |
| Prevention by Design Process Choice | |
| |
| |
| |
| General Considerations | |
| |
| |
| |
| Design Guide | |
| |
| |
| |
| Expression Guide | |
| |
| |
| |
| Fault Removal | |
| |
| |
| |
| Verification with the Specifications | |
| |
| |
| |
| Fault Removal without Specifications | |
| |
| |
| |
| Functional Test | |
| |
| |
| |
| Input Sequence | |
| |
| |
| |
| Output Sequence | |
| |
| |
| |
| Functional Diagnosis | |
| |
| |
| |
| Analysis of an Arithmetic Unit | |
| |
| |
| |
| Formal Proof Methods | |
| |
| |
| |
| Inductive Approach and Symbolic Execution | |
| |
| |
| |
| Deductive Approach and FTM | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Prevention of Technological Faults | |
| |
| |
| |
| Parameters of the Prevention of Technological Faults | |
| |
| |
| |
| Hardware Technology | |
| |
| |
| |
| Software Technology | |
| |
| |
| |
| Prevention of Technological Faults | |
| |
| |
| |
| Action on the Product | |
| |
| |
| |
| Hardware Technology | |
| |
| |
| |
| Software Technology | |
| |
| |
| |
| Action on the Environment | |
| |
| |
| |
| Hardware Technology | |
| |
| |
| |
| Software Technology | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Removal of Technological Faults | |
| |
| |
| |
| Off-Line Testing | |
| |
| |
| |
| Context of Off-Line Testing | |
| |
| |
| |
| Different Kinds of Tests and Testers | |
| |
| |
| |
| Logical Testing | |
| |
| |
| |
| Logical Testers | |
| |
| |
| |
| Test Parameters | |
| |
| |
| |
| Production Testing | |
| |
| |
| |
| Maintenance Testing | |
| |
| |
| |
| Principles of Logical Test Generation | |
| |
| |
| |
| Logical Testing | |
| |
| |
| |
| Determination of Input Vectors Testing a Fault | |
| |
| |
| |
| Fault Grading | |
| |
| |
| |
| Test Pattern Generation of Combinational Systems | |
| |
| |
| |
| Test of Sequential Systems | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Structural Testing Methods | |
| |
| |
| |
| Generation of Logical Test by a Gate Level Structural Approach | |
| |
| |
| |
| Test Generation for a Given Error | |
| |
| |
| |
| Principles of the Method | |
| |
| |
| |
| Activation and Backward Propagation | |
| |
| |
| |
| Forward Propagation | |
| |
| |
| |
| Justification | |
| |
| |
| |
| Complete Study of a Small Circuit | |
| |
| |
| |
| Test of Structured Circuits | |
| |
| |
| |
| Determination of the Faults/Errors Detected by a Given Test Vector | |
| |
| |
| |
| Principles of the Method | |
| |
| |
| |
| Study of a Small Circuit | |
| |
| |
| |
| Diagnosis of a Test Sequence | |
| |
| |
| |
| General Problem of the Diagnosis | |
| |
| |
| |
| Study of a Small Circuit | |
| |
| |
| |
| Influence of Passive Redundancy on Detection and Diagnosis | |
| |
| |
| |
| Detection Test without Error Model. Application to Software | |
| |
| |
| |
| The Problem of Structural Test without Error Model | |
| |
| |
| |
| Statement Test | |
| |
| |
| |
| Branch & Path Test | |
| |
| |
| |
| Condition & Decision Test | |
| |
| |
| |
| Finite State Machine Identification | |
| |
| |
| |
| Diagnosis without Fault Models | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Highlight the Erroneous Situations | |
| |
| |
| |
| Elaborate the Hypotheses | |
| |
| |
| |
| Confirm the Hypotheses | |
| |
| |
| |
| Verify the Hypotheses | |
| |
| |
| |
| Mutation Test Methods | |
| |
| |
| |
| Principles and Pertinence of Mutation Methods | |
| |
| |
| |
| Mutation Testing Technique | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Design For Testability | |
| |
| |
| |
| Introduction | |
| |
| |
| |
| Test Complexity | |
| |
| |
| |
| General Principles of Design For Testability | |
| |
| |
| |
| Ad Hoc Approach to DFT | |
| |
| |
| |
| Guidelines | |
| |
| |
| |
| Instrumentation: Data Recording | |
| |
| |
| |
| Exception Mechanisms: Error Propagation | |
| |
| |
| |
| Design of Systems Having Short Test Sequences | |
| |
| |
| |
| Illustration on Electronic Products | |
| |
| |
| |
| Illustration on Software Applications | |
| |
| |
| |
| Built-In Test (BIT) | |
| |
| |
| |
| Introduction | |
| |
| |
| |
| The FIT PLA | |
| |
| |
| |
| Scan Design and LSSD | |
| |
| |
| |
| Boundary Scan | |
| |
| |
| |
| Discussion about BIT Evolution | |
| |
| |
| |
| Built-In Self-Test (BIST) | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Test Sequence Generation and Signature Analysis | |
| |
| |
| |
| Towards On-Line Testing | |
| |
| |
| |
| To Place the Tester in the Application Site | |
| |
| |
| |
| In-situ Maintenance Operation | |
| |
| |
| |
| Integration of the Tester to the Product's Activity | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Fault Tolerance Means | |
| |
| |
| |
| Error Detecting and Correcting Codes | |
| |
| |
| |
| General Context | |
| |
| |
| |
| Error Model | |
| |
| |
| |
| Redundant Coding | |
| |
| |
| |
| Application to Error Detection and Correction | |
| |
| |
| |
| Limitations of our Study | |
| |
| |
| |
| Definitions | |
| |
| |
| |
| Separable and Non-Separable Codes | |
| |
| |
| |
| Hamming Distance | |
| |
| |
| |
| Redundancy and Efficiency | |
| |
| |
| |
| Parity Check Codes | |
| |
| |
| |
| Single Parity Code | |
| |
| |
| |
| Multiple Parity Codes | |
| |
| |
| |
| Unidirectional Codes | |
| |
| |
| |
| M-out-of-n Codes | |
| |
| |
| |
| Two-Rail Codes | |
| |
| |
| |
| Berger Codes | |
| |
| |
| |
| Arithmetic Codes | |
| |
| |
| |
| Limitations of the Hamming Distance | |
| |
| |
| |
| Residual Codes | |
| |
| |
| |
| Application of EDC Codes to Different Classes of Systems | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| On-Line Testing | |
| |
| |
| |
| Two Approaches of On-Line Testing | |
| |
| |
| |
| Discontinuous Testing | |
| |
| |
| |
| External Tester | |
| |
| |
| |
| Test Performed by One of the Regulators | |
| |
| |
| |
| Test Distributed Between the Regulators | |
| |
| |
| |
| Precautions | |
| |
| |
| |
| Continuous Testing: Self-Testing | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Use of Functional Redundancy | |
| |
| |
| |
| Use of Structural Redundancy | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Fail-Safe Systems | |
| |
| |
| |
| Risk and Safety | |
| |
| |
| |
| Seriousness Classes | |
| |
| |
| |
| Risk and Safety Classes | |
| |
| |
| |
| Fail-Safe Systems | |
| |
| |
| |
| Fail-Safe Techniques | |
| |
| |
| |
| Intrinsic Safety | |
| |
| |
| |
| Safety by Structural Redundancy | |
| |
| |
| |
| Self-Testing Systems and Fail-Safe Systems | |
| |
| |
| |
| Fail-Safe Applications | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Fault-Tolerant Systems | |
| |
| |
| |
| Introduction | |
| |
| |
| |
| Aims | |
| |
| |
| |
| From Error Detection Towards Fault Tolerance | |
| |
| |
| |
| N-Versions | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Realization of the Duplicates and the Voter | |
| |
| |
| |
| Performance Analysis | |
| |
| |
| |
| Backward Recovery | |
| |
| |
| |
| Principles and Use | |
| |
| |
| |
| Recovery Cache | |
| |
| |
| |
| Recovery Points | |
| |
| |
| |
| Forward Recovery | |
| |
| |
| |
| Principles | |
| |
| |
| |
| Recovery Blocks | |
| |
| |
| |
| Termination Mode | |
| |
| |
| |
| Comparison | |
| |
| |
| |
| Similarities | |
| |
| |
| |
| Differences | |
| |
| |
| |
| Use of Multiple Techniques | |
| |
| |
| |
| Impact on the Design | |
| |
| |
| |
| Some Application Domains | |
| |
| |
| |
| Watchdog and Reset | |
| |
| |
| |
| Avionics Systems | |
| |
| |
| |
| Data Storage | |
| |
| |
| |
| Data Transmission | |
| |
| |
| |
| Exercises | |
| |
| |
| |
| Conclusions | |
| |
| |
| |
| Needs and Impairments | |
| |
| |
| |
| Dependability Needs | |
| |
| |
| |
| Dependability Impairments | |
| |
| |
| |
| Protective Means | |
| |
| |
| |
| Fault Prevention | |
| |
| |
| |
| Fault Removal | |
| |
| |
| |
| Fault Tolerance | |
| |
| |
| |
| Dependability Assessment | |
| |
| |
| |
| Quantitative Approaches | |
| |
| |
| |
| Qualitative Approaches | |
| |
| |
| |
| Choice of Methods | |
| |
| |
| |
| Error Detecting and Correcting Codes | |
| |
| |
| |
| Reliability Block Diagrams | |
| |
| |
| |
| Testing Features of a Microprocessor | |
| |
| |
| |
| Study of a Software Product | |
| |
| |
| |
| Answer to the Exercises | |
| |
| |
| Glossary | |
| |
| |
| References | |
| |
| |
| Index | |