Engineering topics

Butler, Ricky W.

Publications and source records attributed to Butler, Ricky W..

At least 55 records · Page 3

NASA NTRS1993

Semi-Markov Unreliability Range Evaluator

Semi-Markov Unreliability Range Evaluator, SURE, computer program is software tool for analysis of reconfigurable, fault-tolerant systems. Traditional reliability analyses based on aggregates of fault-handling and fault-occurrence models. SURE provides efficient means for calculating accurate upper and lower bounds for probabilities of death states for large class of semi-Markov mathematical models, and not merely those reduced to critical-pair architectures.

Butler, Ricky W.↗

NASA NTRS1993

Programs Help Create And Evaluate Markov Models

Pade Approximation With Scaling (PAWS) and Scaled Taylor Exponential Matrix (STEM) computer programs provide flexible, user-friendly, language-based interface for creation and evaluation of Markov models describing behaviors of fault-tolerant reconfigurable computer systems. Produce exact solution for probabilities of system failures and provide conservative estimates of numbers of significant digits in solutions. Also offer as part of bundled package with SURE and ASSIST, two other reliable analysis programs developed by Systems Validation Methods group at Langley Research Center.

Butler, Ricky W.↗

NASA NTRS1993

An elementary tutorial on formal specification and verification using PVS

A tutorial on the development of a formal specification and its verification using the Prototype Verification System (PVS) is presented. The tutorial presents the formal specification and verification techniques by way of specific example - an airline reservation system. The airline reservation system is modeled as a simple state machine with two basic operations. These operations are shown to preserve a state invariant using the theorem proving capabilities of PVS. The technique of validating a specification via 'putative theorem proving' is also discussed and illustrated in detail. This paper is intended for the novice and assumes only some of the basic concepts of logic. A complete description of user inputs and the PVS output is provided and thus it can be effectively used while one is sitting at a computer terminal.

Butler, Ricky W.↗

NASA NTRS1993

The infeasibility of quantifying the reliability of life-critical real-time software

This paper affirms that the quantification of life-critical software reliability is infeasible using statistical methods, whether these methods are applied to standard software or fault-tolerant software. The classical methods of estimating reliability are shown to lead to exorbitant amounts of testing when applied to life-critical software. Reliability growth models are examined and also shown to be incapable of overcoming the need for excessive amounts of testing. The key assumption of software fault tolerance - separately programmed versions fail independently - is shown to be problematic. This assumption cannot be justified by experimentation in the ultrareliability region, and subjective arguments in its favor are not sufficiently strong to justify it as an axiom. Also, the implications of the recent multiversion software experiments support this affirmation.

Butler, Ricky W.↗

NASA NTRS1993

Formal methods for life-critical software

The use of computer software in life-critical applications, such as for civil air transports, demands the use of rigorous formal mathematical verification procedures. This paper demonstrates how to apply formal methods to the development and verification of software by leading the reader step-by-step through requirements analysis, design, implementation, and verification of an electronic phone book application. The current maturity and limitations of formal methods tools and techniques are then discussed, and a number of examples of the successful use of formal methods by industry are cited.

Butler, Ricky W.↗

NASA NTRS1993

Formal Methods for Life-Critical Software

Butler, Ricky W.↗

NASA NTRS1992

The Second NASA Formal Methods Workshop 1992

The primary goal of the workshop was to bring together formal methods researchers and aerospace industry engineers to investigate new opportunities for applying formal methods to aerospace problems. The first part of the workshop was tutorial in nature. The second part of the workshop explored the potential of formal methods to address current aerospace design and verification problems. The third part of the workshop involved on-line demonstrations of state-of-the-art formal verification tools. Also, a detailed survey was filled in by the attendees; the results of the survey are compiled.

Johnson, Sally C.↗

NASA NTRS1992

The SURE approach to reliability analysis

The SURE computer program, a reliability-analysis tool for ultrareliable computer-system architectures, provides rapid computational capability for semi-Markov models useful in describing the fault-handling behavior of fault-tolerant computer systems. The basic mathematics of SURE and its user interface are described, including a sample interactive session. The basis of the SURE model-pruning capability is presented, and the SURE loop-truncation method is justified. The techniques used to develop a semi-Markov model of a fault-tolerant computer system are also reviewed.

Butler, Ricky W.↗

NASA NTRS1992

Fault-Tree Compiler Program

FTC, Fault-Tree Compiler program, is reliability-analysis software tool used to calculate probability of top event of fault tree. Five different types of gates allowed in fault tree: AND, OR, EXCLUSIVE OR, INVERT, and M OF N. High-level input language of FTC easy to understand and use. Program supports hierarchical fault-tree-definition feature simplifying process of description of tree and reduces execution time. Solution technique implemented in FORTRAN, and user interface in Pascal. Written to run on DEC VAX computer operating under VMS operating system.

Butler, Ricky W.↗

NASA NTRS1992

Formal design and verification of a reliable computing platform for real-time control. Phase 2: Results

The design and formal verification of the Reliable Computing Platform (RCP), a fault tolerant computing system for digital flight control applications is presented. The RCP uses N-Multiply Redundant (NMR) style redundancy to mask faults and internal majority voting to flush the effects of transient faults. The system is formally specified and verified using the Ehdm verification system. A major goal of this work is to provide the system with significant capability to withstand the effects of High Intensity Radiated Fields (HIRF).

Butler, Ricky W.↗

NASA NTRS1992

Design for validation

An approach is outlined for the development of ultrareliable avionics for civil air transports using a design-for-validation philosophy that includes rigorous application of formal methods. The basic concept of the methodology is introduced, and the role of formal methods is explored. The impact of the design-for-validation philosophy on the system design process is then demonstrated by two simple examples. More details about the design-for-validation methodology are then given.

Johnson, Sally C.↗

NASA NTRS1992

Formal Techniques for Synchronized Fault-Tolerant Systems

We present the formal verification of synchronizing aspects of the Reliable Computing Platform (RCP), a fault-tolerant computing system for digital flight control applications. The RCP uses NMR-style redundancy to mask faults and internal majority voting to purge the effects of transient faults. The system design has been formally specified and verified using the EHDM verification system. Our formalization is based on an extended state machine model incorporating snapshots of local processors clocks.

DiVito, Ben L.↗

NASA NTRS1992

Provable Transient Recovery for Frame-Based, Fault-Tolerant Computing Systems

We present a formal verification of the transient fault recovery aspects of the Reliable Computing Platform (RCP), a fault-tolerant computing system architecture for digital flight control applications. The RCP uses NMR-style redundancy to mask faults and internal majority voting to purge the effects of transient faults. The system design has been formally specified and verified using the EHDM verification system. Our formalization accommodates a wide variety of voting schemes for purging the effects of transients.

DiVito, Ben L.↗

NASA NTRS1991

Programs For Modeling Fault-Tolerant Computing Systems

Pade Approximation with Scaling, (PAWS) and Scaling Taylor Exponential Matrix (STEM) computer programs are software tools for design and validation. Provide flexible, user-friendly, language-based interface for input of Markov mathematical methods describing behaviors of fault-tolerant computer systems. Markov models include both recovery from faults via reconfiguration and behaviors of such systems when faults occur. PAWS and STEM produce exact solutions of probability of system failure and provide conservative estimate of number of significant digits in solution. Written in PASCAL and FORTRAN.

Butler, Ricky W.↗

NASA NTRS1991

Design for Validation

The use of computer hardware and software in life-critical applications, such as for civil air transports, demands the use of rigorous formal mathematical validation procedures. However, formal specification and verification will only be tractable if the system is designed in a manner that lends itself to formal methods. Likewise, accurate reliability analysis will only be tractable if the number of interacting components that must be individually included in a single reliability model is kept to a low number and if their failure behavior interactions can be modeled simply. Also, the system must be designed such that the system reliability does not directly depend on system parameters that cannot be accurately determined. This paper presents a design methodology based on the concept of designing a system in such a manner that it can be rigorously validated, or "design for validation."

Johnson, Sally C.↗

NASA NTRS1991

High Level Design Proof of a Reliable Computing Platform

An architecture for fault-tolerant computing is formalized and shown to satisfy a key correctness property. The reliable computing platform uses replicated processors and majority voting to achieve fault tolerance. Under the assumption of a majority of processors working in each frame, we show that the replicated system computes the same results as a single processor system not subject to failures. Sufficient conditions are obtained to establish that the replicated system recovers from transient faults within a bounded amount of time. Three different voting schemes are examined and proved to satisfy the bounded recovery time conditions.

DiVito, Ben L.↗

NASA NTRS1991

Design Strategy for a Formally Verified Reliable Computing Platform

This paper presents a high-level design for a reliable computing platform for real-time control applications. The design tradeoffs and analyses related to the development of a formally verified reliable computing platform are discussed. The design strategy advocated in this paper requires the use of techniques that can be completely characterized mathematically as opposed to more powerful or more flexible algorithms whose performance properties can only be analyzed by simulation and testing. The need for accurate reliability models that can be related to the behavior models is also stressed. Tradeoffs between reliability and voting complexity are explored. In particular, the transient recovery properties of the system are found to be fundamental to both the reliability analysis as well as the "correctness" models.

Butler, Ricky W.↗

NASA NTRS1991

The Infeasibility of Experimental Quantification of Life-Critical Software Reliability

This paper affirms that quantification of life-critical software reliability is infeasible using statistical methods whether applied to standard software or fault-tolerant software. The key assumption of software fault tolerance|separately programmed versions fail independently|is shown to be problematic. This assumption cannot be justified by experimentation in the ultra-reliability region and subjective arguments in its favor are not sufficiently strong to justify it as an axiom. Also, the implications of the recent multi-version software experiments support this affirmation.

Butler, Ricky W.↗