Derivation and use of a survivability criterion for DDP systems * by RICHARD

With the advent of low cost compact computing systems, there has been a natural tendency to bring the computer to the job rather than the job to the computer. The geographical distribution of computing also leads to a necessity to interconnect installations so that they can share data, provide back up computing support, and permit rapid transfer of messages between sites. We are now seeing the emergence (1,2) of networks of computers interconnected by communication facilities. There are numerous benefits to be achieved by this dispersal of computing facilities including more reliable overall operational capability, better overall service to geographically separated sites, and the advantages of being able to utilize a wide range of software and hardware facilities available through telecommunication systems. Inherent in a distributed data processing (DDP) system is to a varying degree some interdependence of each computing site and the interconnecting communications system. Failure of a particular DDP network computer site, hereafter referred to as a node, will have a negative effect on the overall distributed data processing system. In a similar vein, failure of communication links will reduce the performance of the system. A study was initiated to examine these failure modes and develop criteria to measure the performance of a DDP system, including its associated data distributions, in terms of individual equipment failure modes and associated probabilities. The term survivability index is used as a performance parameter of a DDP system and an objective function has been defined to provide a measure of survivability in terms of the nodes and links of a network and their failure probabilities, data set distributions, and weighting factors for network nodes and computer programs. Having derived an objective function to measure DDP performance, alternative data set distributions and network architectures can be evaluated. Criteria can be included such as addition or deletion of communication links, movement of programs among nodes, duplication of data sets, etc. Constraints can be introduced which limit the number and size