Software Engineering for Students A Programming Approach

17.6 Recovery blocks 251
Recovery blocks will, however, also cope with hardware faults. For example, suppose
that a fault develops in the region of main memory containing the primary sort method.
The recovery block mechanism can then recover by switching over to an alternative
method. There are stories that the developers of the recovery block mechanism at
Newcastle University, England, used to invite visitors to remove memory boards from
a live computer and observe that the computer continued apparently unaffected.
We now examine some of the other aspects of recovery blocks.
The acceptance test
You might think that acceptance tests would be cumbersome methods, incurring high
overheads, but this need not be so. Consider for example a method to calculate a square
root. A method to check the outcome, simply by multiplying the answer by itself, is short
and fast. Often, however, an acceptance test cannot be completely foolproof – because
of the performance overhead. Take the example of the sort method. The acceptance test
could check that the information had been sorted, that is, is in sequence. However, this
does not guarantee that items have not been lost or created. An acceptance test, therefore,
does not normally attempt to ensure the correctness of the software, but instead
carries out a check to see whether the results are acceptably good.
Note that if a fault like division by zero, a protection violation, an array subscript out
of range occurs while one of the sort methods is being executed, then these also constitute
the result of checks on the behavior of the software. (These are checks carried
out by the hardware or the run-time system.) Thus either software acceptance tests or
hardware checks can trigger fault tolerance.
The alternatives
The software components provided as backups must accomplish the same end as the
primary module. But they should achieve this by means of a different algorithm so that
the same problem doesn’t arise. Ideally the alternatives should be developed by different
programmers, so that they are not unwittingly sharing assumptions. The alternatives
should also be less complex than the primary, so that they will be less likely to fail.
For this reason they will probably be poorer in their performance (speed).
Another approach is to create alternatives that provide an increasingly degraded service.
This allows the system to exhibit what is termed graceful degradation. As an example of
graceful degradation, consider a steel rolling mill in which a computer controls a machine
that chops off the required lengths of steel. Normally the computer employs a sophisticated
algorithm to make optimum use of the steel, while satisfying customers’ orders. Should
this algorithm fail, a simpler algorithm can be used that processes the orders strictly
sequentially. This means that the system will keep going, albeit less efficiently.
Implementation
The language constructs of the recovery block mechanism hide the preservation of variables.
The programmer does not need to explicitly declare which variables should be
stored and when. The system must save values before any of the alternatives is executed,