{"title":"Hierarchical specification of system behavior","authors":"R. Sumners, J. Abraham","doi":"10.1109/HASE.1997.648052","DOIUrl":"https://doi.org/10.1109/HASE.1997.648052","url":null,"abstract":"Complex systems are commonly broken up into a hierarchy of composed components. This methodology reduces the complexity of the system os a whole and allows teams of designers to attack the problem of definition. We present and propose a hierarchical methodology for the specification of the behaviors of complex designs. We introduce a single BY operator, such that A BY B means \"A is true because of the arbitrarily repeated assertion of the truth of B\". We show its application in the temporal logic of UNITY and present example uses of the BY operator in specifications of complex systems. Usage of the BY operator induces a hierarchy in the specification of the behavior of a system which often corresponds well to the decomposition of the design definition.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"111 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126966622","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Enhancing system dependability with dynamically reconfigurable FPGAs","authors":"K. Kwiat, W. Debany, S. Hariri","doi":"10.1109/HASE.1997.648034","DOIUrl":"https://doi.org/10.1109/HASE.1997.648034","url":null,"abstract":"Configuring computing modules for fault-tolerant or parallel computing requires the presence of certain logical functions. Unavoidable tradeoffs between hardware and software implementations of these functions have created unfavorable attributes for designs. Branching and jumps in software allow only the immediately needed function to take up processing resources, but software cannot match the speed of performing the function in dedicated hardware. Hardware, however, is rigid, and permanently embodying functions in it adds to the overhead (size, weight and power) of the system. Simplifying the hardware to reduce this overhead only restricts how the modules can be configured during operation. Our architecture uses a dynamically reconfigurable field-programmable gate array (FPGA) to bring together the benefits of hardware and software while mitigating the costs of both. The resultant design supports fault tolerance and multiprocessing among computing modules flexibly and judiciously while accelerating the application throughput.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126610428","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Design and assurance strategy for the NRL pump","authors":"Myong H. Kang, A. Moore, I. S. Moskowitz","doi":"10.1109/HASE.1997.648040","DOIUrl":"https://doi.org/10.1109/HASE.1997.648040","url":null,"abstract":"Developing a trustworthy system is difficult because the developer must construct a persuasive argument that the system conforms to its critical requirements. This assurance argument, as well as the software and hardware, must be evaluated by an independent certification team. We present the external requirements and logical design of a specific trusted device, the NRL Pump, and describe our plan, called the assurance strategy, to create the eventual assurance argument. Our assurance strategy exploits currently available graphical specification, simulation, formal proof, and testing coverage analysis tools. Portions of the design are represented by figures generated by the Statemate toolset, and we discuss how those tools, and covert channel analysis will be used to show that the logical design conforms to its external requirements. We conclude with some remarks on a possible physical architecture.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128183132","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Verifying fault-tolerant behavior of state machines","authors":"M. D. Cin","doi":"10.1109/HASE.1997.648044","DOIUrl":"https://doi.org/10.1109/HASE.1997.648044","url":null,"abstract":"Fault tolerant behavior is an important non functional requirement for systems that involve high criticality. We present a framework which allows the analysis of fault tolerant behavior to be undertaken. This framework is based on the notion of state machines and tolerance relations. Results concerning fault tolerant behavior of finite state machines are presented and an illustrative example is discussed. Various kinds of fault tolerant behavior (masking, fail-stop, t-fail-stop, degradable, etc.) are modeled.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126758650","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Ensuring quality of service for multimedia applications in a LAN environment","authors":"H. Fahmi, R. Paul, A. Bashandy, A. Ghafoor","doi":"10.1109/HASE.1997.648066","DOIUrl":"https://doi.org/10.1109/HASE.1997.648066","url":null,"abstract":"We present a mechanism for dynamically allocating network resources in asynchronous LANs for supporting multimedia applications that require quality of service guarantee. The approach is based on the concept of time division multiple access (TDMA). It uses a centralized controller as the bandwidth manager. The total bandwidth is partitioned into two segments: one is used for serving multimedia connections and the other for the normal CSMA/CD sessions. Experimental results reveal that the performance of the proposed scheme is substantially better than that of the random access mechanism. In particular, transmission rates for multimedia hosts are improved significantly with low jitter variations in media streams.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131266289","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A case study of agreement problems in distributed systems: non-blocking atomic commitment","authors":"M. Raynal","doi":"10.1109/HASE.1997.648067","DOIUrl":"https://doi.org/10.1109/HASE.1997.648067","url":null,"abstract":"The paper considers an agreement problem whose practical interest is well known, namely the Non-Blocking Atomic Commitment Problem. First, a generic protocol solving this problem is given and then instantiations of its generic statements are provided for both synchronous and asynchronous distributed systems. These instantiations use a few basic components: timeout mechanism and reliable multicast primitives for synchronous systems unreliable failure detectors and a solution to the consensus problem for asynchronous systems. So, the article can also be considered as an introduction to state of the art concepts and protocols for distributed fault tolerance.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133571218","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A recovery model for extended real-time transactions","authors":"E. Nett, M. Mock","doi":"10.1109/HASE.1997.648050","DOIUrl":"https://doi.org/10.1109/HASE.1997.648050","url":null,"abstract":"A central problem in the design of fault-tolerant real-time systems is that desirable fault tolerance properties are usually realized by mechanisms that counteract real-time guarantees. A prominent example is the all-or-nothing property (also known as failure atomicity), known from transactions. This property normally is realized by the means of isolation and roll-back recovery. However, isolation often unnecessarily decreases the degree of permitted concurrency and results in missed deadlines. Roll-back recovery implies that work is lost and has to be re-done, again leading to missed deadlines. So-called extended transaction models supersede isolation, but their recovery model induces an increased amount of roll-back recovery. In this paper, we present a fundamentally new recovery model to provide the all-or-nothing property without requiring isolation. Based on an active replication technique, we provide a forward error recovery that avoids unnecessary roll-backs by replacing cancelled primary computations with hot-stand-by alternate computations.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133682602","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Automated computation of decomposable synchronization conditions","authors":"Gilberto Matos, James M. Purtilo, E. White","doi":"10.1109/HASE.1997.648041","DOIUrl":"https://doi.org/10.1109/HASE.1997.648041","url":null,"abstract":"High assurance systems have various types of system requirements, most notably safety, real time, reliability, security and availability. The primary goal of high assurance system designers is to integrate various functions of the system while preserving the system consistency with the requirements. We show how automated synchronization based on receptive safety rules facilitates this integration. GenEx is a synchronization tool that computes the synchronization conditions necessary for the system components to satisfy their receptive safety requirements, while preserving the real time and liveness properties of the system. The complexity of concurrent software systems limits the use of formal development and verification techniques in industrial applications. GenEx computes the synchronization conditions independently for each receptive safety rule, thus significantly reducing the complexity of the behavior analysis. We show how, using GenEx synchronization, we designed a controller for a medium sized industrial production system with safety, liveness and real time requirements.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130058060","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Taming the Octopus: using formal models to integrate the Octopus object oriented analysis models","authors":"R. France, J. Bruel, G. Raghavan","doi":"10.1109/HASE.1997.648032","DOIUrl":"https://doi.org/10.1109/HASE.1997.648032","url":null,"abstract":"The object-oriented (OO) modeling techniques of the Octopus method provide good tools for managing the complexity which is inherent in reactive embedded systems. The lack of a precise semantics for the modeling notations used diminishes the role it can play in the development of critical reactive systems. In this paper, we describe an extension to the Octopus analysis techniques that provides support for precise specification and rigorous analysis. We use the formal notation Z to formally describe the concepts captured by Octopus analysis models.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127145966","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Do you trust your compiler? Applying formal methods to constructing high-assurance compilers","authors":"J. M. Boyle, R. Resler, V. Winter","doi":"10.1109/HASE.1997.648033","DOIUrl":"https://doi.org/10.1109/HASE.1997.648033","url":null,"abstract":"Describes how automatic transformation technology can be used to construct a verified compiler for an imperative language. Our approach is to \"transformationally\" pass a source program through a series of canonical forms, each of which correspond to some goal or objective in the compilation process (e.g. introduction of registers, simplification of expressions, etc.). We describe a denotational semantics-based framework in which it is possible to verify the correctness of transformations; the correctness of the compiler follows from the correctness of the transformations.","PeriodicalId":319609,"journal":{"name":"Proceedings 1997 High-Assurance Engineering Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1997-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129435245","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}