Software engineering critical systems

Critical Systems

Loganathan R.

Prof. Loganathan R., CSE, HKBKCE 1

Objectives
• To explain what is meant by a critical system
where system failure can have severe human
or economic consequence.
• To explain four dimensions of dependability -
availability, reliability, safety and security.
• To explain that, to achieve dependability, you
need to avoid mistakes, detect and remove
errors and limit damage caused by failure.


Critical Systems
• If the system failure results in significant economic losses,
physical damages or threats to human life than the system is
called critical systems. 3 types of it are:
• Safety-critical systems
– Failure results in loss of life, injury or damage to the environment;
– Chemical plant protection system;
• Mission-critical systems
– Failure results in failure of some goal-directed activity;
– Spacecraft navigation system;
• Business-critical systems
– Failure results in high economic losses;
– Customer accounting system in a bank;

System dependability
• The most important emergent property of a critical
system is its dependability. It covers the related
system attributes of availability, reliability, safety &
security.
• Importance of dependability
– Systems that are unreliable, unsafe or insecure are often rejected
by their users(refuse to the product from the same company).
– System failure costs may be very high.(reactor / aircraft navigation)
– Untrustworthy systems may cause information loss with a high
consequent recovery cost.


Development methods for critical systems

• Trusted methods and technique must be used.
• These methods are not cost-effective for other
types of system.
• The older methods strengths & weaknesses
are understood
• Formal methods reduce the amount of testing
required. Example :
– Formal mathematical method


Socio-technical critical systems Failures
• Hardware failure
– Hardware fails because of design and manufacturing
errors or because components have reached the end
of their natural life.
• Software failure
– Software fails due to errors in its specification, design
or implementation.
• Human Operator failure
– Fail to operate correctly.
– Now perhaps the largest single cause of system
failures.


A Simple safety Critical System

• Example of software-controlled insulin pump.
• Used by diabetics to simulate the function of
insulin, an essential hormone that metabolises
blood glucose.
• Measures blood glucose (sugar) using a micro-
sensor and computes the insulin dose
required to metabolise the glucose.


Insulin pump organisation
Insulin reservoir

Needle Clock
assembly
Pump

Sensor Controller Alarm

Display1 Display2

Power supply


Insulin pump data-flow

Blood
Blood
Blood sugar parameters Blood sugar
sensor analysis Blood sugar
level

Insulin
requirement
computation

Insulin Pump control Insulin
commands Insulin requirement
Insulin
delivery
pump
controller


Dependability requirements
• The system shall be available to deliver insulin
when required to do so.
• The system shall perform reliably and deliver
the correct amount of insulin to counteract
the current level of blood sugar.
• The essential safety requirement is that
excessive doses of insulin should never be
delivered as this is potentially life threatening.


System Dependability
• The dependability of a system equates to its
trustworthiness.
• A dependable system is a system that is trusted by its
users.
• Principal dimensions of dependability are:
– Availability :- Probability that it will be up & running & able to deliver
at any given time ;
– Reliability :-Correct delivery of services as expected by user over a
given period of time;
– Safety :-A Judgment of how likely the system will cause damage to
people or its environment;
– Security :- A Judgment of how likely the system can resist accidental
or deliberate intrusions;


Dimensions of dependability

Dependability

Availability Reliability Safety Security

The ability of the system The ability of the The ability of the system The ability of the system
to deliver services when system to deliver to operate without to protect itself against
requested services as specified catastrophic failure accidental or deliberate
intrusion


Other dependability properties
• Repairability
– Reflects the extent to which the system can be repaired in the event of
a failure
• Maintainability
– Reflects the extent to which the system can be adapted to new
requirements;
• Survivability
– Reflects the extent to which the system can deliver services while it is
under hostile attack;
• Error tolerance
– Reflects the extent to which user input errors can be avoided and
tolerated.


Dependability vs performance
• It is very difficult to tune systems to make
them more dependable
• High level dependability can be achieved by
expense of performance. Because it include
extra/ redundant code to perform necessary
checking
• It also increases the cost.


Dependability costs
• Dependability costs tend to increase exponentially as
increasing levels of dependability are required
• There are two reasons for this
– The use of more expensive development techniques and
hardware that are required to achieve the higher levels of
dependability
– The increased testing and system validation that is
required to convince the system client that the required
levels of dependability have been achieved


Costs of increasing dependability

Cost

Low Medium High Very Ultra-high
high
Dependability

Availability and reliability
• Reliability
– The probability of failure-free system operation
over a specified time in a given environment for a
specific purpose
• Availability
– The probability that a system, at a point in time,
will be operational and able to deliver the
requested services
• Both of these attributes can be expressed
quantitatively

Availability and reliability
• It is sometimes possible to include system
availability under system reliability
– Obviously if a system is unavailable it is not
delivering the specified system services
• However, it is possible to have systems with
low reliability that must be available. So long
as system failures can be repaired quickly and
do not damage data, low reliability may not be
a problem
• Availability takes repair time into account


Faults, Errors and failures
• Failures are a usually a result of system errors that
are derived from faults in the system
• However, faults do not necessarily result in system
errors
– The faulty system state may be transient and ‘corrected’
before an error arises
• Errors do not necessarily lead to system failures
– The error can be corrected by built-in error detection and
recovery
– The failure can be protected against by built-in protection
facilities. These may, for example, protect system
resources from system errors

Reliability terminology
Term Description

An event that occurs at some point in time when the system
System failure
does not deliver a service as expected by its users

An erroneous system state that can lead to system behaviour
System error
that is unexpected by system users.

A characteristic of a software system that can lead to a
system error. For example, failure to initialise a variable
System fault
could lead to that variable having the wrong value when it is
used.

Human error or Human behaviour that results in the introduction of faults
mistake into a system.


Reliability Improvement
• Three approaches to improve reliability
• Fault avoidance
– Development technique are used that either minimise the possibility
of mistakes or trap mistakes before they result in the introduction of
system faults
• Fault detection and removal
– Verification and validation techniques that increase the probability of
detecting and correcting errors before the system goes into service are
used
• Fault tolerance
– Run-time techniques are used to ensure that system faults do not
result in system errors and/or that system errors do not lead to system
failures


Reliability modelling
• You can model a system as an input-output
mapping where some inputs will result in
erroneous outputs
• The reliability of the system is the probability
that a particular input will lie in the set of
inputs that cause erroneous outputs
• Different people will use the system in
different ways so this probability is not a static
system attribute but depends on the system’s
environment


Input/output mapping
Inputs causing
erroneous outputs
Input set Ie

Program

Erroneous
outputs
Output set Oe


Reliability perception

Possible
inputs

User
1 Erroneous
inputs

User
3 User
2


Reliability improvement
• Removing X% of the faults in a system will not necessarily
improve the reliability by X%. A study at IBM showed that
removing 60% of product defects resulted in a 3%
improvement in reliability
• Program defects may be in rarely executed sections of the
code so may never be encountered by users. Removing these
does not affect the perceived reliability
• A program with known faults may therefore still be seen as
reliable by its users


Safety
• Safety is a property of a system that reflects the system
should never damage people or the system’s environment
• For example control & monitoring systems in aircraft
• It is increasingly important to consider software safety as
more and more devices incorporate software-based control
systems
• Safety requirements are exclusive requirements i.e. they
exclude undesirable situations rather than specify required
system services
• Safety critical software are 2 types


Types of Safety-critical software
• Primary safety-critical systems
– Embedded software systems whose failure can cause
hardware malfunction which results inhuman injury or
environmental damage.
• Secondary safety-critical systems
– Systems whose failure indirectly results in injury.
– Eg. Medical Database holding details of drugs
• Discussion here focuses on primary safety-critical
systems


Safety and reliability
• Safety and reliability are related but distinct
– In general, reliability and availability are necessary
but not sufficient conditions for system safety
• Reliability is concerned with conformance to a
given specification and delivery of service
• Safety is concerned with ensuring system
cannot cause damage irrespective of whether
or not it conforms to its specification


Unsafe reliable systems
• Reasons why reliable system are not
necessarily safe:
• Specification errors
• It does not describe the required behaviour in some
critical situations
• Hardware failures generating spurious inputs
• Hard to anticipate in the specification
• Operator error
• Context-sensitive commands i.e. issuing the right
command at the wrong time


Safety terminology
Term Definition

An unplanned event or sequence of events which results in human death or injury,
Accident (or
damage to property or to the environment. A computer-controlled machine injuring its
mishap)
operator is an example of an accident.
A condition with the potential for causing or contributing to an accident. A failure of the
Hazard
sensor that detects an obstacle in front of a machine is an example of a hazard.
A measure of the loss resulting from a mishap. Damage can range from many people
Damage
killed as a result of an accident to minor injury or property damage.
An assessment of the worst possible damage that could result from a particular
Hazard severity hazard. Hazard severity can range from catastrophic where many people are killed to
minor where only minor damage results.
The probability of the events occurring which create a hazard. Probability values tend
Hazard
to be arbitrary but range from probable (say 1/100 chance of a hazard occurring) to
probability
implausible (no conceivable situations are likely where the hazard could occur).
This is a measure of the probability that the system will cause an accident. The risk is
Risk assessed by considering the hazard probability, the hazard severity and the
probability that a hazard will result in an accident.


Ways to achieve Safety
• Hazard avoidance
– The system is designed so that hazard simply cannot arise.
– Eg. Press 2 buttons at the same time in a cutting machine to start
• Hazard detection and removal
– The system is designed so that hazards are detected and removed
before they result in an accident.
– Eg. Open relief valve on detection over pressure in chemical plant.
• Damage limitation
– The system includes protection features that minimise the damage
that may result from an accident
– Automatic fire safety system in aircraft.


Security
• Security is a system property that reflects the
ability to protect itself from accidental or
deliberate external attack.
• Security is becoming increasingly important as
systems are networked so that external access
to the system through the Internet is possible
• Security is an essential pre-requisite for
availability, reliability and safety
• Example : Viruses, unauthorised use of service/data modification


Security terminology
Term Definition
Possible loss or harm in a computing system. This can be loss or
Exposure damage to data or can be a loss of time and effort if recovery is
necessary after a security breach.
A weakness in a computer-based system that may be exploited to
Vulnerability
cause loss or harm.
An exploitation of a system vulnerability. Generally, this is from
Attack outside the system and is a deliberate attempt to cause some
damage.
Circumstances that have potential to cause loss or harm. You can
Threats think of these as a system vulnerability that is subjected to an
attack.
A protective measure that reduces a system vulnerability.
Control Encryption would be an example of a control that reduced a
vulnerability of a weak access control system.

Damage from insecurity
• Denial of service
– The system is forced into a state where normal services
become unavailable.
• Corruption of programs or data
– The system components of the system may altered in an
unauthorised way, which affect system behaviour & hence
its reliability and safety
• Disclosure of confidential information
– Information that is managed by the system may be
exposed to people who are not authorised to read or use
that information

Security assurance
• Vulnerability avoidance
– The system is designed so that vulnerabilities do not occur.
For example, if there is no external network connection
then external attack is impossible
• Attack detection and elimination
– The system is designed so that attacks on vulnerabilities
are detected and remove them before they result in an
exposure. For example, virus checkers find and remove
viruses before they infect a system
• Exposure limitation
– The consequences of a successful attack are minimised.
For example, a backup policy allows damaged information
to be restored

Software engineering critical systems

More Related Content

What's hot (20)

Similar to Software engineering critical systems (20)

More from Dr. Loganathan R (20)

Recently uploaded (20)

Software engineering critical systems