Dependability

Dependability is a quality that describes the degree of trust a user can put onto the service that the system delivers. It consists of reliability and availability. The former gives the probability that the system fails within a given time, the latter describes the proportion of time during which the system will meet its specification[Lor89].

Requirement 3 (Dependability)   Within a given configuration the system shall not fail, but the degree of availability is allowed to vary according to the operational status of the system components.

We relaxed a given definition of [Lor89] for our dependability requirement statement. Availability and reliability are fuzzy terms. We tolerate partial availability. We prefer to have a system running twenty four hours, seven days a week even if it does not permanently deliver the nominal performance over a system that has deadtimes during which no data can be taken at all. Thus single faults must not bring the whole system down. The same holds for exchange of system components. If errors occur, performance may be decreased, but the entire system should not stop working. Rationales for the requirement can be given as follows:

• Loss of data due to data acquisition failure shall be avoided. Supplying a particle beam and running the detector is very expensive (supraliquid helium cooling, power supply of detectors and electronics, preparation of the experiment). Availability may be reduced, but system fault shall be prevented.

• The system shall tolerate permanent failure of components. Physical components of the data acquisition system may not be accessible because of their underground location. Detector shutdown for maintenance of the DAQ system is not acceptable.

• As the system runs in 24/7 mode it shall be capable of self configuration and recovery. Only overall system critical situations shall require human interference.

• In situ reconfiguration (software upgrade, debugging, calibration) shall not require interruption of the data acquisition. As monitoring and calibration might be done at reasonable short time intervals full shutdown and restart would otherwise lead to significant loss of data.

• Erroneous behaviour of a single DAQ component shall not cause failure of the whole system. Every component shall behave fail silent. This means, it shall detect its fault and give up its participation. The remaining system shall detect that a component resigned and will aim at compensating the loss.

When designing software for the data acquisition system, we have to keep the dependability requirement in mind. The whole system is only as dependable as the weakest element in its chain of software components.