Alberto Pasquini CARE Workshop 14-15/4/2001 Page 1/11 CARE Workshop Alberto Pasquini Assessment of Software Intensive and Interactive Systems Deep Blue

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 2/11 System functions are used in a process and are the results of a combination of computerized tools and human agents Humans have a central role in performing the activities needed for the for the process goals Large amount of information are stored and managed and elaborated by computers Organizational structures, rules, operative procedures, training, other hardware and software tools play a key role in the process The problem (1) Software Intensive and Interactive Systems

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 3/11 Provide inputs for decision making during design, certification, assessment and operation Quantitative risk assessment in safety analysis and safety cases Easy comparison between different systems and different architectural solutions The problem (2) Potential benefits of the quantitative analysis of Software Intensive and Interactive Systems

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 4/11 Reliability growth models can provide information about: failure rate, or number of residual faults, or failure on demand State of the art State of the art in the quantitative analysis of Software Intensive and Interactive Systems When combined with information about software architectures and operative usages they can give us information about the reliability of these architectures Used for design decision (when to stop testing, etc.) Limited confidence in the quantitative measure R1R1 R2R2 R3R3 R4R4 R5R5 P1P1 P2P2 P3P3 P4P4 P5P5 P6P6

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 5/11 Static characterisation of the operational profile of these systems Limitations of the state of the art (1) Still based on task models of errors when considering the interaction with human agents The operative environment changes (Arianne 5) Interactions with operators changes with skill and training (Therac 25) Procedures and rules are revised and up-dated (Italian railways) ProbabilityActivity 3x10 -3 Error of omission where the items being omitted are embedded in a procedure rather than at the end 3x10 -2 General human error of commission … Chernobyl (deliberated deactivation of the reactor protection system) Colwich, Purely, Cowden, Watford Junction, etc. (train driver failing to apply the brakes after acknowledging receipt of audible and visual warning of red signal)

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 6/11 Limitations of the state of the art (2) System boundary Extended System boundary Adapted from Fault Tree Handbook – Nuclear Regulatory Commission

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 7/11 The research proposal What can reasonably be done (Considering that as we enlarge the circle we are dealing with a more and more uncertain environment) A research proposal based on Distributed Cognition and Reliability Engineering switching the focus on the knowledge needed for the process and on its availability

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 8/11 Distributed Cognition developed to analyse the interaction of humans with cognitive artefacts Human cognition (and activity) mediated by artefacts (rules, tools, representations), internal and external to the mind Ability of the human mind in processing symbolic information strongly bounded, and complex activity requires the aid of artefacts Knowledge for human cognitive activity not located exclusively in the brain, but distributed among brain and cognitive artefacts employed to carry out the activity Distributed Cognition (1) writing, printing and computers shopping list, book-marker

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 9/11 Knowledge can be distributed in different ways between human and cognitive artefacts needed for the activity Distribution changes with time Knowledge stored in artefacts from which it can be activated and used Distributed Cognition (2) Knowledge more or less easy to maintain and to up-date, depending on the type of components wherein it is stored easily and naturally context sensitive help, or hardware tool with "affordance"with difficulty guideline, difficult to locate, or with unclear procedures

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 10/11 Model of knowledge distribution within a process Analysis of different possible distributions and of their evolution Estimation of the probability that knowledge is available and correctly activated (for example a software procedure containing the knowledge of the designers) Distributed Cognition + Reliability Engineering Comparison of different possible design solutions with different distributions of knowledge

Alberto Pasquini CARE Workshop 14-15/4/2001 Page 11/11 Safecomp Safety and Reliability of Industrial Computer Systems Budapest, Hungary, Sept ISSRE Software Reliability Engineering Hong Kong, China, 28 Nov. - 1 Dec With associated workshop on Software Assessment Cross fertilisation of Communities (or ads.)