TABLE OF CONTENTS When a capacitor shorts or a relay is stuck the only possible way to restore service is to remove and replace the failed item. Unless a redundant path exists, the system will be out of service until the failed component has been replaced. In some cases, if repeated failures of the same part have occurred, a design change will be undertaken; it may become effective as a general retrofit or as a selective retrofit only for units undergoing repair. In the case of software failures, service can often be immediately corrected by restarting the program or computer, but permanent correction always requires a design change. Since the design change may not always receive high priority, software that is known to be defective by the developer may be used routinely by the operator, who is usually not aware of the defect [1].
The bright side of this picture is that once a software fault has been successfully corrected it will never again cause a failure. Thus, "test and fix" is a much more powerful means of reliability improvement for software than it is for hardware. Permanent fault removal is also the basis of software reliability growth models, which are discussed in Section 7.4.
Given that there are fundamental differences between software and hardware failures, we must still acknowledge that both can contribute to system failures and downtime. A manager of a newly installed plant environmental control system is confronted with the problem...
