High Dependability Computing Program Modeling Dependability(16)

Individuals and organizations increasingly use sophisticated software systems from which they demand great reliance. “Reliance ” is contextually subjective and depends on the particular stakeholder’s needs; therefore, in different circumstances, the sta

be tolerated for Service X when MTTF is greater than 1000 hours”, where a response time failure is when the system fails responding within 2 seconds.

characterization:

- Type

- Adverse Condition - Attack - UpgradesHAZARD

characterization:

- Type

- User(s) hazard

- Environment hazard

Figure 6. Introducing a “measure” in UMD

2.5 Enhancing UMD: capturing the “System Reaction”

Up to now, we have used UMD to specify “negative” non-functional requirements [9], i.e. to specify undesired system’s behaviors, as a whole, or while delivering specific services. Here, we want to extend the framework to enable the stakeholder to provide ideas about means to improve dependability. In other terms, to enable stakeholders, while expressing their views of dependability in terms of acceptable manifestations of failures and hazards, to specify also how the system should behave to be more dependable from their point of view.

UMD can easily address such a need. It is in fact possible to introduce the concept of reaction as another basic item, through which the stakeholder can describe the desired system behavior in case of occurrence of the issue. The resulting, and final structure for UMD is illustrated in Figure 7. Again, while the concept of reaction has been added to the Hardware component, its characterization has been added to the Software component. As example, we adopted the following Reaction Types:

Warning Services: to warn users about what happened or is happening (the issue); Mitigation Services: to reduce the impact of the issue on the users (e.g., a word processor should save the open files if a crash occurs);

Alternative Services: to help users to carry on their tasks regardless of the issue (e.g., for a PC, if the floppy drive does not work, the users can export data via email);