The authors have developed a moderately systematic approach for estimating the dependability of fault-tolerant computing systems. They propose injecting signals into the hardware at the integrated circuit pin level and monitoring the system to determine measures such as which faults are detected, which are corrected, and the length of time it takes the system to respond to the faults.

The method depends on identifying the faults (F) to be detected by the system, the activations (A) of the system over which the faults might occur, the readouts (R) used to monitor the system’s operation, and the measures (M) derived from the readouts, so the dependability of the system can be analyzed. The authors dub these concerns the FARM set and point out that it may be used to analyze dependability from an axiomatic model of the system (such as a Petri net model), a simulation of the system, or a physical model of the system, including operational prototypes. The method has only been applied to physical models, however.

The authors have designed and built a fault injection system, called MESSALINE, to implement their approach. MESSALINE has been used to test two systems, and the complete results have been reported elsewhere. A summary of the results is included in this paper, providing measures such as the percentage of injected faults that were detected and the latency time for fault correction.

The method described in the paper seems to be a step in the right direction for validating the design of fault-tolerant systems. It cannot yet be called a methodology because the authors fail to give sufficient detail to permit others to apply the same approach; for example, they do not give a systematic means for deriving the activations to be used in testing. In addition, only hardware faults are considered; the authors make no attempt to analyze the behavior of the system with respect to software faults. Finally, no objective technique seems to exist for deciding how complete the coverage is that one obtains from using the approach.

For one not versed in the terminology and methods of hardware fault tolerance, the paper is difficult reading. Terminology, such as fault, failure, and activation, is largely undefined, and the authors have used a style that tends to obscure rather than clarify issues.