Practical techniques for damage confinement in software

In a large software system that is required to be dependable, preventing the spread of damage from one system component to another is important. Damage confinement both allows damage to be assessed in a reasonable way once an error is detected and prevents a fault in a single component from causing sudden collapse of the entire system. This paper examines techniques for constraining the spread of damage, both the kinds of constraints required and the means for enforcing those constraints. Techniques developed primarily or exclusively for uses other than fault tolerance are described and examined for suitability in confining damage. The influence on damage confinement of the level of dependability required, e.g., for safety-critical systems versus other systems, is also discussed.