Formal Development of Reactive Fault Tolerant Systems

Architectures based on Coordinated Atomic action (CA action) concepts have been used to build concurrent fault-tolerant systems. This conceptual model combines concurrent exception handling with action nesting to provide a general mechanism for both enclosing interactions among system components and coordinating forward error recovery measures. This paper proposes an architectural model to guide the formal specification of concurrent fault-tolerant systems. This architecture provides built-in CSP (Communicating Sequential Process) processes and predefined channels to coordinate exception handling of the user-defined components. As a result, a formal and general architecture supporting software fault-tolerance are ready to be used.

<p>One of the most dominant philosophies within programming disciplines is the philosophy of layered systems. In a layered system (or hierarchical system) the layers are thought of as each implementing an abstract machine on top of the lower layers. Such an abstract machine in turn implements utilities (e.g. data-structures and operations) to be used at higher layers.</p><p>This paper will focus on exception handling in block-structured systems (as a special case of layered systems). It will be argued that none of the existing programming language proposals for exception handling support secure and well-behaved termination of activities in a block-structured system. Moreover, it is argued that certain termination strategies within block-structured systems cannot be implemented using the existing proposals. As a result of this discussion and as a solution to the problems, a hierarchical, co-operative exception handling mechanism is proposed.</p>

Component-based software systems built out of reusable software components are being used in a wide range of applications which have high dependability requirements. In order to accomplish the required levels of dependability, it is necessary to incorporate into these complex systems means for to cope with software faults. Exception handling is a well-known technique for adding forward error recovery to software systems supported by various mainstream programming languages. However, exception handling for component-based applications at the architectural level introduces new challenges which are not addressed by traditional exception handling systems, such as unavailability of source code, specially when off-the-shelf components are employed. In this paper, we present an exception handling system which adds fault tolerance to component-based systems at the architectural level. Our solution considers issues which are specific to component-based applications, such as unavailability of source code. We also present a framework which implements the proposed exception handling system for applications built using the C2 architectural style.KeywordsService RequestException HandlingArchitectural LevelDependable SoftwareClient ComponentThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This article provides a framework for understanding the nature, role, functioning, design, and effects of organizational oversight systems. Using a case study with elements recognizable to an academic audience, the authors explore how a dean of a fictitious School of Medicine might use organizational control structures to develop effective solutions to global disarray within the academic medical center. Organizational control systems are intended to help influence the behavior of people as members of a formal organization. They are necessary to motivate people toward organizational goals, to coordinate diverse efforts, and to provide feedback about problems. The authors present a model of control to make this process more visible within organizations. They explore the overlap among academic medical centers and large businesses-for instance, each is a billion-dollar enterprise with complex internal and external demands and multiple audiences. The authors identify and describe how to use the key components of an organization's control system: environment, culture, structure, and core control system. Elements of the core control system are identified, described, and explored. These closely articulating elements include planning, operations, measurement, evaluation, and feedback systems. Use of control portfolios is explored to achieve goal-outcome congruence. Additionally, the authors describe how the components of the control system can be used synergistically by academic leadership to create organizational change, congruent with larger organizational goals. The enterprise of medicine is quickly learning from the enterprise of business. Achieving goal-action congruence will better position academic medicine to meet its multiple missions.

Exception handling in a complex concurrent and distributed system (e.g. one involving cooperating rather than just competing activities) is often a necessary, but a very difficult, task. No widely accepted models or approaches exist in this area. The object-oriented paradigm, for all its structuring benefits, and real-time requirements each add further difficulties to the design and implementation of exception handling in such systems. In this paper, we develop a general structuring framework based on the coordinated atomic (CA) action concept for handling exceptions in an object-oriented distributed system, in which exceptions in both the value and the time domain are taken into account. In particular, we attempt to attack several difficult problems related to real-time system design and error recovery, including action-level timing constraints, time-triggered CA actions, and time-dependent exception handling. The proposed framework is then demonstrated and assessed using an industrial real-time application-the Production Cell III case study.

ASTRAL is a formal specification language for realtime systems. It is intended to support formal software development, and therefore has been formally defined. In ASTRAL a realtime system is modeled by a collection of state machine specifications and a single global specification. This paper focuses on extending the ASTRAL methodology to allow the composition of ASTRAL system specifications into specifications of larger and more complex systems. The ASTRAL language includes structuring mechanisms that allow one to build modularized specifications of complex systems with layering. In this paper we concentrate on how to combine these complex system specifications into specifications of even more complex realtime systems. This is accomplished by adding a COMPOSE section to the language that provides the needed information to combine two or more ASTRAL specifications into a single new one. In this paper we also introduce the necessary proof obligations to assure that the assumptions of each of the components of the larger system are satisfied by the other components of the system that replace the previous external environment. We also discuss how some exported transitions become internal transitions of the new system. A telephony example with local central controls that interface to long distance units is used to motivate the extensions.

In this paper, we first discuss the various algebraic approaches to exception handling specification. We show that none of them is completely satisfactory, and we explain why the algebraic specification of exception handling (error introduction, error propagation and error recovery) must not be made using only equations, but also "declarations". We present an approach allowing all forms of error handling, and at the same time keeping specifications well-structured and easily understandable.KeywordsOperational SemanticError MessageError RecoveryException HandlingGround TermThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The chapter presents a case study demonstrating how security requirements of an Industrial Automation and Control System (IACS) component can be represented in a form of Protection Profile that is based on IEC 62443 standards and how compliance assessment of such component can be supported by explicitly representing a conformity argument in a form based on the OMG SACM metamodel. It is also demonstrated how an advanced argument assessment mechanism based on Dempster-Shafer belief function theory can be used to support assessors while analyzing and assessing the conformity argument related to an IACS component. These demonstrations use a NOR-STA tool for representing, managing and assessment of evidence-based arguments, which have been developed in our research group.

A model based on a Petri net (PN) is proposed for controlling flexible manufacturing systems (FMSs). The model can describe not only normal sequential processes but also interruptive exceptional handling processes by means of simple structures. A layered structure and two types of token are introduced into a PN to describe exception handling and error recovery. An application in which this model was used to program a programmable logic controller (PLC) is described. The description of cell control can be simplified by the model. >

Practical exception handling and resolution in concurrent programs

Multi-clock is commonly used in complex systems. So if synchronous signals in one clock domain are transferred to another clock domain, they will become asynchronous signals. Asynchronous signals will cause metastable state, which will lead to unpredictable results. How metastabilities led to errors in a system is described first. Then a simulation of RS flip flop using pspice is to show the detail procedure of metastability. To demonstrate how often metastabilities will happen, a FPGA based experimentation is realized by changing the internal layout of flip flop manually, which changes the propagation delay between them.

Mobile agent systems often require sophisticated cooperation and coordination during error detection and recovery. In this paper we propose novel fault tolerance mechanisms that support co-operative exception handling in such systems. The paper demonstrates how mechanisms like these can be formally developed and analysed. We start with identifying the typical modes of failures in agents and analysing possible failure and recovery scenarios in mobile systems. Stepwise refinement is used as our formal framework for top-down development and verification. Using the framework we formally verify the essential model properties, such as interoperability, local and global state consistency and termination of error recovery. Our approach provides developers with formal generic patterns for incorporating fault-tolerance mechanisms into mobile agent systems. We also demonstrate how the results of our formal development can be instantiated and reused in developing real-world agent software.

A simulation system was established in the Matlab/Simulink environment based on the bionic underwater vehicle propelled by multiple undulating fins. It was composed of motion and attitude controller and plant model including 6DOF rigid body kinetic model, carrier's hydrodynamic model, and multiple undulating fins' hydrodynamic model. All parts of the simulation system were designed in detailed, and a layered control system was put forward. Finally, the performance of the control channels for speed, depth and yawing were simulated in terms of the real design parameters and hydrodynamic coefficients. Results show that the simulation system has important significance to research on the dynamic of the bionic underwater vehicle and verify the design of control system.

When dealing with such complex systems such as the software package of a smart mobile phone, it is necessary to apply powerful methods to detect and report errors when they occur. This paper probes and analyzes a powerful debug method called trap and exception handling, which is supported by the ARM platforms. The method can easily capture some valuable debug information. When a fatal error occurs during runtime or system detects an abnormal, a trap or an exception shall be logged and stored in the non-volatile random access memory (NVRAM). The information must be enough and easy for engineer to analyze the software error.

As automation of manufacturing systems becomes commonplace, the design, construction, and use of computerized control systems has become an increasingly vital problem. Computerized control systems are typically large, complex systems that are composed of components of lesser complexity which are developed and validated separately. Frequently, different components of the control system are made by different vendors and are designed to work with humans but not with other automated systems. Systems which are found in manufacturing environments include production machinery, communication software and hardware, computer hardware, databases, file systems, and production management software.