A Theoretical Basis for the Analysis of Multiversion Software Subject to Coincident Errors

Fundamental to the development of redundant software techniques (known as fault-tolerant software) is an understanding of the impact of multiple joint occurrences of errors, referred to here as coincident errors. A theoretical basis for the study of redundant software is developed which 1) provides a probabilistic framework for empirically evaluating the effectiveness of a general multiversion strategy when component versions are subject to coincident errors, and 2) permits an analytical study of the effects of these errors. An intensity function, called the intensity of coincident errors, has a central role in this analysis. This function describes the propensity of programmers to introduce design faults in such a way that software components fail together when executing in the application environment. We give a condition under which a multiversion system is a better strategy than relying on a single version and we study some differences between the coincident errors model developed here and the model that assumes independent failures of component verions.