Practical Techniques for Damage Connnement in Software

In a large software system that is required to be dependable, preventing the spread of damage from one system component to another is important. Damage connnement both allows damage to be assessed in a reasonable way once an error is detected and prevents a fault in a single component from causing sudden collapse of the entire system. This paper examines techniques for constraining the spread of damage, both the kinds of constraints required and the means for enforcing those constraints. Techniques developed primarily or exclusively for uses other than fault tolerance are described and examined for suit-ability in connning damage. The innuence on damage connnement of the level of dependability required, e.g., for safety-critical systems versus other systems, is also discussed.