李彤《软件工程》教学课件ch20.pptVIP

Insulin pump state constraints Fault detection Preventative fault detection The fault detection mechanism is initiated before the state change is committed. If an erroneous state is detected, the change is not made. Retrospective fault detection The fault detection mechanism is initiated after the system state has been changed. This is used when a incorrect sequence of correct actions leads to an erroneous state or when preventative fault detection involves too much overhead. Preventative fault detection really involves extending the type system by including additional constraints as part of the type definition. These constraints are implemented by defining basic operations within a class definition. Type system extension PositiveEvenInteger 1 PositiveEvenInteger 2 Damage assessment Analyse system state to judge the extent of corruption caused by a system failure. The assessment must check what parts of the state space have been affected by the failure. Generally based on ‘validity functions’ that can be applied to the state elements to assess if their value is within an allowed range. Robust array 1 Robust array 2 Checksums are used for damage assessment in data transmission. Redundant pointers can be used to check the integrity of data structures. Watch dog timers can check for non-terminating processes. If no response after a certain time, a problem is assumed. Damage assessment techniques Forward recovery Apply repairs to a corrupted system state. Backward recovery Restore the system state to a known safe state. Forward recovery is usually application specific - domain knowledge is required to compute possible state corrections. Backward error recovery is simpler. Details of a safe state are maintained and this replaces the corrupted system state. Fault recovery and repair Corruption of data coding Error coding techniques which add redundancy to coded data can be used for repairing data corrupted during transmission. Redundant pointers When redundant point