Toward a resourceful method of software fault tolerance

The most widely used software fault tolerance methods, N-version Programming (NVP) and recovery blocks, were developed from hardware fault tolerance practices. We believe that the effectiveness of these software methods is limited by their reliance on a hardware analogy. For instance, both NVP and recovery blocks view the program state as a fixed set of modules that, when faulty, are replaced rather than corrected. We outline a new method, that borrows from the robust data structures (RDS) software fault tolerance method, which takes into account the dynamic nature of the program state. RDS defines error detection and correction procedures for dynamically sized data structures such as lists and trees. Similarly, we view an execution state as a structure of linked dynamic blocks for which RDS-like detection and correction procedures may be specified. This allows us to correct errors in individual dynamic blocks, instead of replacing entire modules. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. ’99 ACM Southeast Regional Conference 1999 ACM 1-58113-128-3/99/0004 5.00 1.0 Introduction Software fault tolerance methods are designed to overcome execution errors by modifying variable values to create an acceptable program state. The need to prevent the failure of software controlling critical systems such as nuclear reactors, patient lifesupport, and railway routing justifies the cost of software fault tolerance. For example, the FAA's goal for airline industry software is a maximum failure rate of 10-9, one critical failure every billion hours. The most widely used software fault tolerance methods, N-version Programming (NVP) and recovery blocks, were developed from hardware fault tolerance practices. However, reliance on a hardware analogy sometimes limits the effectiveness of these software methods. For instance, both NVP and recovery blocks tend to replace faulty modules rather than correct them. In addition, both methods usually examine a fixed number of variables and perform a fixed set of error detection and correction procedures. We outline an alternative method of correcting errors by modifying the execution state without replacing software modules. Our goal is to create resourceful systems able to develop and carry out alternate ways of correcting errors, depending on the current execution state [1]. We begin by illustrating an error that may reduce the effectiveness of both NVP and recovery block systems. 2.0 Illustrating A Software Fault We examine the execution of a faulty program using the contour model [7]. Each contour represents a dynamic block, called an environment. The label associated with an environment (e.g., E1) denotes its relative order of creation. Included in each contour is the return environment from which the block was invoked. Figure 1 shows the Pascal program FindPath that searches for a path between two vertices of a directed graph. The program accepts an adjacency matrix, the vertex at which the path starts, and the vertex at which the path ends. If a path exists from the start vertex to the finish vertex, "result" is set to "True", and to "False" otherwise. For the sake of simplicity we use a graph with 5 vertices. However the methods described in this paper also apply to graphs having larger numbers of vertices. Program FindPath (Input, Output); Const Numvertices = 5; Var start, finish, i, j: Integer; result: Boolean; matrix: array[1. Numvertices, 1.Numvertices] of Integer; Function Search(vertex: Integer): Boolean; Var k: Integer; Begin Search := False; If (vertex = finish) Then Search := True Else Begin k := 1; While (Search = False and k ≤ Numvertices) Do Begin If (matrix(vertex, k) = True) Then Search := Search(k); k := k + 1; End {While}; End {If}; End {Search}; Begin {main} Readln(start, finish); For i := 1 to Numvertices Do For j := 1 to Numvertices Do Readln(matrix[i,j]); result := Search(start); Writeln(result);