Achieving effective diversity between redundant software-based components

All empirical evidence indicates that diversity between redundant software-based components offers some defence against common-mode failure in redundant systems, i.e., it brings gains in reliability or safety. An important question is how to pursue diversity - in the selection or development of such software - so as to achieve large enough gains. Common sense suggests for instance to develop the components, or procure components that have been developed, in "truly independent" ways; and to make them "as diverse as possible", i.e. with intentional differences in their designs and development methods. This advice is unfortunately insufficient for most practical decisions, and turns out sometimes to be self-contradictory, while direct experimental evidence of "what really works" in industrial practice is scarce. This talk will summarise the state of knowledge on these issues: - the ways diversity can be pursued, using a threat-driven approach to analysing the possible "diversity seeking decisions"; - the trade-offs that may arise given the practical constraints in an actual project, having to choose in a limited range of options; and especially the common case when the pursuit of diversity may work against that of high reliability of the individual channels, while the combined effect of these two factors on system-level reliability or safety, the true goal pursued, is difficult to estimate; - mathematical results that in some cases are sufficient for choosing between alternative policies, even without specific experimental evidence. These are based on probabilistic models and identify scenarios under which pursuing some additional degree of either "separation" or "diversification" between the development processes of redundant components is guaranteed to yield improvements at the system level