Engineering topics

Butler, Ricky W.

Publications and source records attributed to Butler, Ricky W..

At least 73 records · Page 4

NASA NTRS1991

The Infeasibility of Quantifying the Reliability of Life-Critical Real-Time Software

This paper affirms that the quantification of life-critical software reliability is infeasible using statistical methods whether applied to standard software or fault-tolerant software. The classical methods of estimating reliability are shown to lead to exhorbitant amounts of testing when applied to life-critical software. Reliability growth models are examined and also shown to be incapable of overcoming the need for excessive amounts of testing. The key assumption of software fault tolerance separately programmed versions fail independently is shown to be problematic. This assumption cannot be justified by experimentation in the ultrareliability region and subjective arguments in its favor are not sufficiently strong to justify it as an axiom. Also, the implications of the recent multiversion software experiments support this affirmation.

Butler, Ricky W.↗

NASA NTRS1990

NASA Formal Methods Workshop, 1990

The workshop brought together researchers involved in the NASA formal methods research effort for detailed technical interchange and provided a mechanism for interaction with representatives from the FAA and the aerospace industry. The workshop also included speakers from industry to debrief the formal methods researchers on the current state of practice in flight critical system design, verification, and certification. The goals were: define and characterize the verification problem for ultra-reliable life critical flight control systems and the current state of practice in industry today; determine the proper role of formal methods in addressing these problems, and assess the state of the art and recent progress toward applying formal methods to this area.

Butler, Ricky W.↗

NASA NTRS1990

Design for validation, based on formal methods

Validation of ultra-reliable systems decomposes into two subproblems: (1) quantification of probability of system failure due to physical failure; (2) establishing that Design Errors are not present. Methods of design, testing, and analysis of ultra-reliable software are discussed. It is concluded that a design-for-validation based on formal methods is needed for the digital flight control systems problem, and also that formal methods will play a major role in the development of future high reliability digital systems.

Butler, Ricky W.↗

NASA NTRS1990

High level design proof of a reliable computing platform

The main objectives are: to establish hardware/software platform for ultra-reliable computing; to use fault tolerant computer architecture; to use formal methods to prevent design and implementation errors; and to construct reliability model to quantify reliability estimate. The results show that: ultra-reliable control systems are hard to achieve; simple fault tolerant design is postulated; formal specification of design is constructed; and preliminary correctness proofs are obtained.

Divito, Ben L.↗

NASA NTRS1990

Formal design and verification of a reliable computing platform for real-time control. Phase 1: Results

A high-level design is presented for a reliable computing platform for real-time control applications. Design tradeoffs and analyses related to the development of the fault-tolerant computing platform are discussed. The architecture is formalized and shown to satisfy a key correctness property. The reliable computing platform uses replicated processors and majority voting to achieve fault tolerance. Under the assumption of a majority of processors working in each frame, it is shown that the replicated system computes the same results as a single processor system not subject to failures. Sufficient conditions are obtained to establish that the replicated system recovers from transient faults within a bounded amount of time. Three different voting schemes are examined and proved to satisfy the bounded recovery time conditions.

Divito, Ben L.↗

NASA NTRS1990

Fault-tolerant clock synchronization in distributed systems

Existing fault-tolerant clock synchronization algorithms are compared and contrasted. These include the following: software synchronization algorithms, such as convergence-averaging, convergence-nonaveraging, and consistency algorithms, as well as probabilistic synchronization; hardware synchronization algorithms; and hybrid synchronization. The worst-case clock skews guaranteed by representative algorithms are compared, along with other important aspects such as time, message, and cost overhead imposed by the algorithms. More recent developments such as hardware-assisted software synchronization and algorithms for synchronizing large, partially connected distributed systems are especially emphasized.

Ramanathan, Parameswaran↗

NASA NTRS1990

The art of fault-tolerant system reliability modeling

A step-by-step tutorial of the methods and tools used for the reliability analysis of fault-tolerant systems is presented. Emphasis is on the representation of architectural features in mathematical models. Details of the mathematical solution of complex reliability models are not presented. Instead the use of several recently developed computer programs--SURE, ASSIST, STEM, PAWS--which automate the generation and solution of these models is described.

Butler, Ricky W.↗

NASA NTRS1989

The Fault Tree Compiler (FTC): Program and mathematics

The Fault Tree Compiler Program is a new reliability tool used to predict the top-event probability for a fault tree. Five different gate types are allowed in the fault tree: AND, OR, EXCLUSIVE OR, INVERT, AND m OF n gates. The high-level input language is easy to understand and use when describing the system tree. In addition, the use of the hierarchical fault tree capability can simplify the tree description and decrease program execution time. The current solution technique provides an answer precisely (within the limits of double precision floating point arithmetic) within a user specified number of digits accuracy. The user may vary one failure rate or failure probability over a range of values and plot the results for sensitivity analyses. The solution technique is implemented in FORTRAN; the remaining program code is implemented in Pascal. The program is written to run on a Digital Equipment Corporation (DEC) VAX computer with the VMS operation system.

Butler, Ricky W.↗

NASA NTRS1988

Hardware proofs using EHDM and the RSRE verification methodology

Examined is a methodology for hardware verification developed by Royal Signals and Radar Establishment (RSRE) in the context of the SRI International's Enhanced Hierarchical Design Methodology (EHDM) specification/verification system. The methodology utilizes a four-level specification hierarchy with the following levels: functional level, finite automata model, block model, and circuit level. The properties of a level are proved as theorems in the level below it. This methodology is applied to a 6-bit counter problem and is critically examined. The specifications are written in EHDM's specification language, Extended Special, and the proofs are improving both the RSRE methodology and the EHDM system.

Butler, Ricky W.↗

NASA NTRS1988

Fault-tolerant clock synchronization techniques for avionics systems

This paper examines six provably correct fault-tolerant clock synchronization algorithms. These algorithms are all presented in the same notation to enable easier comprehension and comparison. The advantages and disadvantages of the different techniques are examined and issues related to the implementation of these algorithms are discussed. The paper argues for the use of such algorithms in life-critical applications.

Butler, Ricky W.↗

NASA NTRS1988

Semi-Markov Unreliability-Range Evaluator

Reconfigurable, fault-tolerant systems modeled. Semi-Markov unreliability-range evaluator (SURE) computer program is software tool for analysis of reliability of reconfigurable, fault-tolerant systems. Based on new method for computing death-state probabilities of semi-Markov model. Computes accurate upper and lower bounds on probability of failure of system. Written in PASCAL.

Butler, Ricky W.↗

NASA NTRS1988

SURE reliability analysis: Program and mathematics

The SURE program is a new reliability analysis tool for ultrareliable computer system architectures. The computational methods on which the program is based provide an efficient means for computing accurate upper and lower bounds for the death state probabilities of a large class of semi-Markov models. Once a semi-Markov model is described using a simple input language, the SURE program automatically computes the upper and lower bounds on the probability of system failure. A parameter of the model can be specified as a variable over a range of values directing the SURE program to perform a sensitivity analysis automatically. This feature, along with the speed of the program, makes it especially useful as a design tool.

Butler, Ricky W.↗

NASA NTRS1988

The PAWS and STEM reliability analysis programs

The PAWS and STEM programs are new design/validation tools. These programs provide a flexible, user-friendly, language-based interface for the input of Markov models describing the behavior of fault-tolerant computer systems. These programs produce exact solutions of the probability of system failure and provide a conservative estimate of the number of significant digits in the solution. PAWS uses a Pade approximation as a solution technique; STEM uses a Taylor series as a solution technique. Both programs have the capability to solve numerically stiff models. PAWS and STEM possess complementary properties with regard to their input space; and, an additional strength of these programs is that they accept input compatible with the SURE program. If used in conjunction with SURE, PAWS and STEM provide a powerful suite of programs to analyze the reliability of fault-tolerant computer systems.

Butler, Ricky W.↗

NASA NTRS1988

A survey of provably correct fault-tolerant clock synchronization techniques

Six provably correct fault-tolerant clock synchronization algorithms are examined. These algorithms are all presented in the same notation to permit easier comprehension and comparison. The advantages and disadvantages of the different techniques are examined and issues related to the implementation of these algorithms are discussed. The paper argues for the use of such algorithms in life-critical applications.

Butler, Ricky W.↗

NASA NTRS1988

Automated generation of reliability models

The abstract semi-Markov specification interface to the SURE (Semi-Markov Range Evaluator) tool (ASSIST) program allows the user to describe the Markov model in a high-level language. Instead of listing the individual states of the model, the user specifies the rules governing the behavior of the system, and these are used to automatically generate the model. A small number of statements in the abstract language can describe a large, complex model. Becuase no assumptions are made about the system being modeled, ASSIST can be used to generate models describing the behavior of any type of system. The abstract model definition and the automatic model generation strategy are described. Analysis of an example fault-tolerant architecture, a triad of processor with cold spare processors, shows how the behavior of a system can be captured by a few general rules. The syntax of the ASSIST input language is then described and demonstrated by creating a model to describe the fault behavior of the example architecture. The flexibility of the abstract language is demonstrated by expanding the example to model multiple triads of processors sharing a pool of cold spare processors.

Johnson, Sally C.↗

NASA NTRS1987

Estimating the distribution of fault latency in a digital processor

Presented is a statistical approach to measuring fault latency in a digital processor. The method relies on the use of physical fault injection where the duration of the fault injection can be controlled. Although a specific fault's latency period is never directly measured, the method indirectly determines the distribution of fault latency.

Ellis, Erik L.↗

NASA NTRS1987

Automated model generation for reliability analysis programs

Semi-Markov models (a generalization of Markov models) can be used to calculate the reliability of virtually any fault-tolerant system. However, the process of delineating all of the states and transitions in the model of a complex system can be devastatingly tedious and error-prone. The ASSIST program allows the user to describe the semi-Markov model in a high-level language. Instead of specifying the individual states of the model, the user specifies the rules governing the behavior of the system, and these are used by ASSIST to automatically generate the model. A small number of statements in the abstract language can be used to describe a very large, complex model. Because no assumptions are made about the system being modeled, the ASSIST program can be used to generate models describing the behavior of any type of system. The ASSIST program and its input language are described and illustrated by examples.

Johnson, Sally C.↗

NASA NTRS1987

A preliminary transient-fault experiment on the SIFT computer system

This paper presents the results of a preliminary experiment to study the effectiveness of a fault-tolerant system's ability to handle transient faults. The primary goal of the experiment was to develop the techniques to measure the parameters needed for a reliability analysis of the SIFT computer system which includes th effects of transient faults. A key aspect of such an analysis is the determination of the effectiveness of the operating system's ability to discriminate between transient and permanent faults. A detailed description of the preliminary transient fault experiment along with the results from 297 transient fault injections are given. Although not enough data was obtained to draw statistically significant conclusions, the foundation has been laid for a large-scale transient fault experiment.

Butler, Ricky W.↗