Toward Dependable Safety-Critical Software

The failure of safety-critical systems can result in catastrophic loss of life and property. Hence, it is necessary to assure the reliability of these systems to a high degree of confidence before they are put into operational use. However, at these extreme levels of ultra-high reliability requirements, typically failures rates of less than 10 \Gamma7 failures per hour, errors in the specification and in estimates of the operational profile become significant factors. An approach that has been suggested in practice is to use secondary and tertiary software that meet ultra-high reliability requirements but at a reduced functionality as compared with the primary software. Two major problems are (a) how to select appropriate functionality for the non-primary versions and (b) how to determine when to invoke these backup versions. In this paper, we present a unified approach for handling these two problems. It starts with a rigorous method for assessing ultra-high reliability requirements..