How to Make Good Software 4. Fault Tolerance Engineering: from Requirements to Code Software Architecture and Fault Tolerance 5. Verification and Validation of Fault Tolerant Systems

1. Motivations for the Book Building trustworthy systems is one of the main challenges Faced by software developers, who have been concerned with dependability-related issues since the first day system was built and deployed. Obviously, there have been plenty of changes since then, including the nature of faults and failures, the complexity of systems, the services they deliver and the way society uses them. But the need to deal with various threats (such as failed components, deteriorating environments, component mismatches, human mistakes, intrusions and software bugs) is still in the core of software and system research and development. As computers are now spreading into various new domains (including the critical ones) and the complexity of modern systems is growing, achieving dependability remains central for system developers and users. Accepting that errors always happen in spite of all the efforts to eliminate faults that might cause them is in the core of dependability. To this end 2 various fault tolerance mechanisms have been investigated by researchers and used in industry. Unfortunately, more often than not these solutions exclusively focus on the implementation (e.g. they are provided as mid-dleware/OS services or libraries), ignoring other development phases, most importantly the earlier ones. This creates a dangerous gap between the requirement to build dependable (and fault tolerant) systems and the fact that it is not dealt with until the implementation step step.' One consequence of this is that there is a growing number of situations reported in which fault tolerance means undermine the overall system dependability as they are not used properly. We believe that fault tolerance needs to be explicitly included into traditional software engineering theories and practices, and should become an integral part of all steps of software development. As current software engineering practices tend to capture only normal behaviour, assuming that all faults can be removed during development, new software engineering methods and tools need to be developed to support explicit handling of abnormal situations. Moreover, every phase in the software development process needs to be enriched with phase-specific fault tolerance means. Generally speaking, integrating fault tolerance into software engineering requires: 0 integrating fault tolerance means into system models starting from the early development phases (i.e. requirement and architecture); 0 making fault tolerance-related decisions at each phase by explicit modelling of faults, fault tolerance means and dedicated redundant resources (with a specific focus on fault tolerant software architec-tures); ensuring correct transformations …