N-version programming has been proposed as a method of incorporating fault tolerance into software. Multiple versions of a program (i.e. "N") are prepared and executed in parallel. Their outputs are collected and examined by a voter,and, if theyare not identical, it is assumed that the majority is correct. This method depends for its reliability improvement on the assumption that programs that have been developed independently will fail independently.Inthis paper an experiment is described in which the fundamental axiom is tested. Atotal of twenty sevenversions of a program were prepared independently from the same specification at twouniversities and then subjected to one million tests. The results of the tests revealed that the programs were individually extremely reliable but that the number of tests in which more than one program failed was substantially more than expected. The results of these tests are presented along with an analysis of some of the faults that were found in the programs. Background information on the programmers used is also summarized. The conclusion from this experiment is that N-version programming must be used with care and that analysis of its reliability must include the effect of dependent errors. Keywords and Phrases: Multi-version programming, N-version programming, software reliability,fault-tolerant software, design diversity. * This work was sponsored in part by NASA grant number NAG1-242 and in part by a MICROgrant cofunded by the state of California and Hughes Aircraft Company. 1.

Abstract not found

We have identified a difficulty in the implementation of N-version programming. The problem, which we call the Consistent Comparison Problem,arises for applications in which decisions are based on the results of comparisons of finite-precision numbers. We showthat when versions makecomparisons involving the results of finite-precision calculations, it is impossible to guarantee the consistencyoftheir results. It is therefore possible that correct versions may arrive atcompletely different outputs for an application that does not apparently have multiple correct solutions. If this problem is not dealt with explicitly,an N-version system may be unable to reach a consensus evenwhen none of its component versions fail.

Abstract not found