Dependability maintenance system, change accommodation cycle execution device, failure response cycle execution device, method for controlling dependability maintenance system, control program, and computer-readable storage medium storing the control program

1. A dependability maintenance system for maintaining dependability of a target system, comprising:

a change accommodation cycle execution device for executing a change accommodation cycle for adding and/or modifying dependability description data indicative of a requirement and specification regarding the dependability of the target system, in accordance with a change in a requirement and specification regarding the target system, during development of the target system or during update of the target system in operation;

a failure response cycle execution device for executing a failure response cycle for avoiding abort of the target system based on the dependability description data when occurrence of failure or a sign of failure is detected during operation of the target system, and

change request transmission means for, when the failure response cycle execution device detects the occurrence of the failure or the sign of failure and abort of the target system is unavoidable, transmitting a request for changing the dependability description data to the change accommodation cycle execution device.

2. The dependability maintenance system as set forth in claim 1 , further comprising a dependability description storage section for storing the dependability description data,

the change accommodation cycle execution device and the failure response cycle execution device executing the change accommodation cycle and the failure response cycle one by one or simultaneously while the change accommodation cycle execution device and the failure response cycle execution device share the dependability description data stored in the dependability description storage section.

3. The dependability maintenance system as set forth in claim 1 , further comprising reconfiguration means for, when the failure response cycle execution device detects the occurrence of the failure or the sign of the failure, reconfiguring the target system based on the dependability description data.

4. The dependability maintenance system as set forth in claim 3 , wherein

the dependability description data describes a procedure of the reconfiguration, and

the reconfiguration means reconfigures the target system in accordance with the procedure of the reconfiguration.

5. The dependability maintenance system as set forth in claim 1 , wherein

when the change accommodation cycle execution device receives a requirement for changing the dependability description data, the change accommodation cycle execution device changes the dependability description data.

6. The dependability maintenance system as set forth in claim 1 , further comprising dependability value determining means for acquiring the dependability description data from the dependability description storage section to determine an evaluation value quantitatively indicative of a value of the dependability of the target system,

the dependability value determining means determining the evaluation value in the change accommodation cycle or the failure response cycle.

7. The dependability maintenance system as set forth in claim 6 , wherein

the dependability description data is data defining a set of a goal node and a monitor node which are related to each other,

the goal node is a node in which a requirement and specification are described in goal form,

the monitor node is evidence which shows that a goal described in the goal node is met and which corresponds to a monitoring point of the target system, and

the dependability value determining means calculates the evaluation value based on a tolerable range of variation for which data acquired from a corresponding monitoring point is related to a monitor node.

8. The dependability maintenance system as set forth in claim 7 , wherein the dependability value determining means calculates the evaluation value based on evidence whose monitor value acquired by monitoring the target system is satisfactory with respect to a tolerable range of variation.

9. The dependability maintenance system as set forth in claim 1 , further comprising script process means for, when the failure response cycle execution device detects the occurrence of the failure or the sign of the failure, executing a script included in the dependability description data,

the script including a scenario for restoring the target system to be in a state defined by a tolerable range of variation.

10. The dependability maintenance system as set forth in claim 1 , further comprising:

a failure-monitoring control section for monitoring a state of the target system and executing a response procedure if necessary;

a dependability description storage section for storing the dependability description data; and

dependability description conversion means for reading out the dependability description data from the dependability description storage section, generating, from the read-out dependability description data, failure-monitoring control data for controlling an operation of the failure-monitoring control section, and supplying the failure-monitoring control data to the failure-monitoring control section,

the failure-monitoring control section operating in accordance with the failure-monitoring control data, so as to monitor the state of the target system and execute a response procedure if necessary.

11. The dependability maintenance system as set forth in claim 10 , further comprising:

at least one monitoring module for monitoring the state of the target system;

at least one action module for executing a response procedure on the target system if necessary;

a monitor management section for selecting the monitoring module and controlling an operation of the monitoring module under control of the failure-monitoring control section; and

an action management section for selecting the action module and controlling an operation of the action module under control of the failure-monitoring control section.

12. The dependability maintenance system as set forth in claim 1 , which is connected with other dependability maintenance system via a network.

13. A change accommodation cycle execution device, constituting the dependability maintenance system as set forth in claim 1 .

14. A failure response cycle execution device, constituting the dependability maintenance system as set forth in claim 1 .

15. The failure response cycle execution device as set forth in claim 14 , comprising dependability description conversion means for reading out the dependability description data from a dependability description storage section, and generating, from the read-out dependability description data, failure-monitoring control data for controlling an operation of a failure-monitoring control section for monitoring a state of the target system and executing a response procedure if necessary.

16. The failure response cycle execution device as set forth in claim 15 , wherein

the failure-monitoring control section is capable of selecting, out of a plurality of modules, a module used for monitoring the state of the target system and executing a response procedure if necessary, and of controlling the selected module,

the dependability description data is written in a format in which one description includes at least a variable to which module-specifying information for specifying the module is settable as a value, and

the dependability description conversion means converts a description to be converted, which is included in the dependability description data, into failure-monitoring control data corresponding to module-specifying information included in the description, in accordance with information indicative of a preset correspondence between the module-specifying information and the failure-monitoring control data.

17. The failure response cycle execution device as set forth in claim 16 , wherein

the correspondence is set according to a fixed part other than a variable part in one description in the dependability description data, and

the dependability description conversion means converts a description in the dependability description data into corresponding failure-monitoring control data by referring to the correspondence set according to the fixed part in the description in the dependability description data.

18. A control program stored in a non-transitory storage medium, the control program causing a computer to function as the dependability description conversion means of a failure-response cycle execution device as set forth in claim 15 .

19. A control program stored in a non-transitory storage medium, the control program causing a computer to function as the means of a dependability maintenance system as set forth in claim 1 .

20. A method for controlling a dependability maintenance system for maintaining dependability of a target system,

the method comprising:

a change accommodation cycle carried out by a change accommodation cycle execution device in the dependability maintenance system, for adding and/or modifying dependability description data indicative of a requirement and specification regarding the dependability of the target system, in accordance with a change in a requirement and specification regarding the target system, during development of the target system or during update of the target system in operation;

a failure response cycle carried out by a failure response cycle execution device in the dependability maintenance system, for avoiding abort of the target system based on the dependability description data when occurrence of failure or a sign of failure is detected during operation of the target system, and

when the failure response cycle execution device detects the occurrence of the failure or the sign of the failure and abort of the target system is unavoidable, transmitting a request for changing the dependability description data to the change accommodation cycle execution device.

21. The method as set forth in claim 20 , further comprising the steps of:

reading out the dependability description data from a dependability description storage section, and

generating, from the read-out dependability description data, failure-monitoring control data for controlling an operation of a failure-monitoring control section for monitoring a state of the target system and executing a response procedure if necessary.