An Assumptions Management Framework for Systems Software

Critical systems in areas ranging from avionics to consumer car control systems are being built by integrating commercial-off-the-shelf (COTS) components. Software components used in these systems need to satisfy many formally unexpressed, yet necessary conditions, termed as assumptions, for their correct functioning. Invalid assumptions have been determined to be the root cause of failures in many such systems; for example, in the Ariane 5 rocket failure. In the current software engineering practices, many of these assumptions are not recorded in a machine-checkable format, which makes validating the assumptions a manual and an error-prone task. This thesis examines this problem in detail and evolves a framework, called the assumptions management framework (AMF), which provides a vocabulary for discussing assumptions, a language for encoding assumptions in a machine-checkable format and facilities to manage the assumptions in terms of composition and setting policies on assumption validation. A relevant subset of assumptions can be validated or flagged as invalid automatically as the system evolves. AMF allows the assumption specification process to blend with the components' source-code and architecture specification. This enables AMF to be applied to existing systems with minor or no modifications in components' implementation and design. Performance and scalability tests show that the AMF implementation is scalable to be applied to large-scale systems. Case-studies were conducted on representative systems to study the nature and number of defects caused by invalid assumptions. It was found that a significant number of defects in the systems studied had invalid assumptions as the root-cause. It was found that AMF has the ability to encode and validate majority of the assumptions that caused defects in these systems. This can prevent such defects in the future or warn in advance of potential defects when assumptions are invalid. Analyzing and correcting one of the invalid assumptions in Iperf, an end-to-end bandwidth measurement tool, resulted in significantly better bandwidth estimates by Iperf across high-bandwidth networks. In most cases, it also resulted in savings of over 90% in terms of both network traffic generated and bandwidth measurement times.