What is the Internet?

Hundreds of sites in many different domains provide access to a vast range of information sources. The growth of these information sources and the development of applications such as Netscape and Mosaic has encouraged the active participation of new groups of users. Most of these participants only possess a minimal knowledge of the communications mechanisms that support computer networks.

The fact that most of the people using the Net only have a minimal idea of the underlying technology creates quite a few problems. For example, I once heard a teacher say to her class that the delays in retrieving information over the web were 'a bug in the system'. She was accessing a site in Australia. That's a bit like saying that gravity is a bug in physics. Unless you understand the ways in which computer networks operate then you can't make the best use of them. For example, most people try to restrict their web access to the early morning in Glasgow. This is because many remote sites become saturated as the mass of American users come on-line.

Why is the Internet important?

The growth in electronic mail was largely restricted to academic communities, i.e. Universities and colleges, until the late 1980s. It then became increasingly common for companies to develop internal mail systems. These were typically based around proprietary systems that were sold as part of a PC networking package. Most large businesses could not see the point of hooking up to the Internet and so addresses were only valid within that local area network. Concerns over Internet security also encouraged businesses to isolate their users accounts from the outside world. However, things are changing. The ability to rapidly transfer information using systems such as Netscape and Mosaic has encouraged more companies to extend their e-mail access. Indeed, Netscape now includes mail handling facilities. Other groups of users have been encouraged to use electronic mail by the growth of an application called LotusNotes - the popularity of this systems was one of the reasons cited for IBM's decision to buy the Lotus company. Similarly, there have been persistent rumours that the growth of the World Wide Web is attracting Microsoft to launch hostile bids for the Netscape Corporation.

The World Wide Web grew from the National Centre for Supercomputer Applications (NCSA), University of Illinois and from CERN, a European Research Centre for nuclear physics, where there were concerted efforts to improve the means of passing files over remote networks. In both cases, they were groups of potential users rather than people who would regard themselves as primarily `interface designers'. The work at the NCSA led to the development of the Mosaic in 1993. Mosaic was a free program that did much to attract the initial user group to the Web. Netscape was then developed as a commercial successor once there were enough users for the web to be successful. Nobody would pay money for a browser until there was enough information on the web.

Mail

Addressing and Routing

Mail groups

Filtering and Uncertainty

News.

Updates

Computers as Tools

Winograd and Flores.

This section looks at ways in which computers are being developed to provide new types of tools. In particular, the development of mobile devices through cellular and satellite telephone systems creates new mechanisms for the storage and retrieval of remote information. The introduction of ubiquitous computers, that is computers which integrate 'seamlessly' into our daily lives, creates opportunities to 'add value' to a wide range of objects. Groupware systems provide tools for coordinating the activities of teams of people; it breaks down the communications barriers that isolate single users operating single machines.

Mobile Computation

Groupware

Another class of systems supports teleworking. These enable groups of users to remotely log-in to their place of work. They need not be physically present in their office. Teleworking can combine elements of mobile computation if the user is moving around the country as they work. It can also include elements of groupware if they have to cooperate with their colleagues over the network.

Mobile Computation

The Limitations of Traditional Networks.

• they are expensive to maintain. A considerable amount of re-cabaling is required every time a new node is added to a network. This work can be reduced by connectors that can simply be snapped into place on an existing cable. Alternative, connector boxes can be used that resemble telephone junction boxes. These offer a fixed number of plugs that users can exploit to hook up their devices. In either case, the physical characteristics of the wiring impose considerable limits on the flexibility of the network.
• they can be insecure One way of attacking a computer system is simply to hook another computer onto the cabling and listen to the traffic that is passing from one point to another. this is called eaves-dropping. Radio based communication may be less vulnerable because any eaves-dropper would have to locate the frequency of the transmission that they were interested in. This frequency might then be changed every so often to prevent eavesdroppers from continuing to monitor a channel even if they could find it;
• they may not support all user tasks There are some systems that simply cannot use conventional computer networks. Applications ranging from Gas Board vans to military command and control systems cannot simply trail cables everywhere they go. Instead, there must be some way for `on-board' computers to communicate with their central servers;
• not good for consumer electronics If companies want to `hook-up' a range of household devices, for example a PC to a heating controller or a video recorder or a Hi-Fi, then few people are willing to tear-up their house to install a local area network between the rooms in their house.

Mobile Computing Infrastructure

Strengths and Weaknesses of Cellular Technology.

Cellular Architectures.

What Will These Systems Look Like?

Secondly, future systems might exploit an opaque approach. In contrast, this would force the user to `log into' a remote transceiver before dispatching a message. This would enable the user to choose whether or not to incur a lengthy delay when transferring data between sites.

Mobile Computing Infrastructure

The Strengths and Weaknesses of Satellite Networks.

Geostationary satellites

Low Earth Satellites

Groupware

What are they?

• conferencing systems; These systems range from simple messaging applications where textual messages may appear below the user's name, to full-blown video conferencing systems. In either case, the intention is to reduce the problems that can arise during telephone conversations. In particular, these systems avoid the irritations that can arise when three or more people try to communicate over the same phone line. In the case of video conferencing systems, there are important visual cues about who wants to talk next etc. At present, the communications infrastructure on the Internet can support relatively low quality video conferencing where delays may interrupt both images and sound. A range of attempts are being made to address these problems. For example, ATM (Asynchronous Transfer Mode) networks provide means of firing multimedia data at high speeds across local and wide are networks. The department has one of the world's leading research groups in this area.
• multi-user text editors; These systems enable groups of users to simultaneously edit the same document. This is important, for example, if two different groups have to work on different sections of a joint publication. The alternative would be to send and re-send different drafts between the various sites. Each site would then be unsure about whether they had the most recent copy or whether it was `in the post'. If both groups can access the most recent version that the other group is working on then these problems may be avoided.
• CASE tools; These are Computer-Aided Software Engineering systems. They help groups of programmers to develop code. For example, they might provide information about the data types that must be used in two different areas of a program. They may also help teams to work out where their colleagues are currently concentrating within a system.
• command and control systems; These applications include computer interfaces to systems on-board aircraft or within power generation systems. Again, the various operators must cooperate to preserve the safety of an application. Confusion would result if one user tried to shut-down a component while another tried ti start it up.
• and many many more...;

Groupware

What are the problems?

• Synchronous and Asynchronous Systems The first problem is that is may be difficult for users to know exactly who else is using the system. Synchronous means `at the same time'. Asynchronous means `at different times' or independent. You get both types of CSCW systems. For example, a system that supports collaboration between groups in Scotland and Australia need not be synchronous. Time differences mean that there would only be small periods of time when they would both be working on the system, If the application is asynchronous then many of the problems of contention (see below) do not arise.
• Contention This occurs when two or more users want to gain access to a resource that cannot be shared. For example, it may not be possible for people to work on exactly the same piece of text at the same time. Alternatively, users might be prevented from simultaneously interacting with a process component. This would stop people attempting to start and stop a piece of equipment.
• Interference This arises when one user frustrates another by getting in their way. For example, one person might want to move a piece of text while another attempts to edit it. Similarly, one user might want the others in a group to vote on a decision while another user might want to continue the discussion.
• Different views It is unlikely that all of the users of a system will want to look at the same pieces of data at the same time. So for example, one person might be looking at the start of a document while another might be working on the closing paragraphs. In such circumstances, there can be considerable confusion if one user has to tell another about the information on their screen because they may not be able to see it at the same time. Similarly, one user might be looking at one component in a chemical plant while another might be looking elsewhere. It would then be difficult for the first user to keep track of what the second is doing.

Groupware

What are the solutions?

• Locking mechanisms.
  These techniques bar access to a shared resource for some period of time. The problem here is to guarantee fairness. This means that all users will be allocated the resource that they require. A related issue is one of `liveness'. This means that any particular user will eventually be granted that resource. In any event, a critical issue is the granularity of the lock. For example, a simple solution is to lock an entire document so that only one user can write to a file at any one time. Alternatively, locks may be placed on paragraphs or even sentences so that only one user may access that particular section of the resource. The smaller the lock, the more flexible the system. However, the smaller the lock, the greater the complexity of managing the system.
• Priority protocols.
  If you use locks then you must decide what happens if two or more users attempt to acquire the locked resource at the same time. One solution is to associate priorities with particular users. For example, members of staff may be granted access to a printer before all student jobs. this approach reduces the fairness in the system because some users may be excluded from accessing the system if members of staff continually print out their jobs before the students ever acquire the device.
• Voting.
  A more equitable solution is to ask everyone who should have access to a shared resource. in other words, the team takes a vote before anyone gets a chance on the document, paragraph or sentence. Obviously, this imposes a massive overhead because dozens of requests for votes might be generated on a particular system.
• Split and independent views.
  Finally, the problems of monitoring other users' activities might be reduced by splitting the screen in various ways. For example, one window might provide a high level view of a processing plant. another might be more focussed upon your own activity. Similarly, what are know as `video portholes' enable users to view cameras in a number of different locations at the same time. By double clicking on the image from a particular camera, the users view may be expanded to see that room in more detail.

Mobile Computing Infrastructure

Exercise: CSCW Design.

Design a viewing mechanism whereby you could see the exact sections that all of the other users were currently working on. One way of doing this would be to represent the document and on that representation show a number of different icons to represent the position of the other users' mice.

Implement a locking system where each user could select a section of text and exclude other users from accessing it. How would a user release the lock that they held on a piece of text? What errors might occur while using the system?

Implement a voting system in which each user could vote against someone being able to access a paragraph, sentence or word. How would the votes of the other users be gathered and how would te results be communicated?

How might the system have to be changed if, instead of a textual document, the group were working on a computer program? Could procedures and functions be represented as different pages of a document? Where would lock be imposed? On procedures and functions? What would happen if one user attempted to edit the definitions for a type that was used in various places in a program?

Security

Why bother?

The increasing interconnection of the world's computer networks is a an issue because more and more companies are connecting to the Internet. In the past, they preserved their security by denying all external access to their systems. The increasing use of the web to advertise and sell products has meant, however, that more commercial systems are hooking up to the Internet. The increasing communications opportunities provided by electronic mail has also encouraged greater inter-connection. All of this increases the stakes for malicious and criminal users. Electronic funds transfers and commercially sensitive email messages are tempting targets. For example, an eavesdropper might be concerned to find out any information they can that might affect the share price of a company.

The increasing value of the information being stored and transferred across the world's computer networks is also increasing the importance of security. It is now the case that many companies would simply cease trading if they lost their computer records. For instance, imagine what would happen to a bank that lost all of its account details. In the past, companies would keep manual or paper-based records in addition to their digital systems. Today this is not always the case. In such circumstances, companies and government organisations will employ disaster management companies to provide back-up machines and shadowing systems to create duplicates of any essential data.

The technological sophistication of the general population is increasing. This means that more and more people have the knowledge and ability to `beat the system'. This means that commercial and governmental organisations must continually stay one step ahead of the people who who `hack' or `crack' into their systems. (Note: some programmers call themselves `hackers' because they hack the code into shape. The media often refer to people who attack computer systems as `hackers'. Many programmers find this irritating and would prefer the term `crackers' for people who attack systems. Hmmmmmmmmmm)

Different attitudes to digital data

If you take or steal someones diary, they immediately become concerned about its loss. They may forget appointments, tutorials, lectures, parties, other peoples phone numbers, their own phone number and so on. If the diary contains information about their credit cards, bank accounts or medical conditions then there may be further concerns. So, generally, most people keep their diaries in a safe place.

In contrast, many people will leave their passwords lying around on scraps of paper. In systems that require passwords to access them, they may walk off and leave themselves still logged onto the system. For many novice users in an educational environment this can have very irritating consequences. Your `friends' may start sending lots of abusive email messages to lecturers so that they look as if they come from the user who left themselves logged on, In other situations, I've seen people create bogus web pages for users who leave themselves logged on. `Select this link to view my social life', and then it takes you to a page about knitting or kangaroos or whatever. Alternatively, other users might use the opportunity to look at your solution to a recent assessment. In a commercial setting, a malicious useer might delete critical files, look at your data and so on.

The real differences between digital and `physical' sources of information, is that it is incredibly easy to copy and forge digital data. It is also easy to search for any information that the user might leave unprotected. These are strong reasons why you must be more careful with digital security than with more conventional systems.

Information is valuable

• once a secret is lost you cant get it back.
  Firstly, once someone has had access to sensitive or critical information, it is no longer possible to pretend that this information is not in the public domain. For instance, you cannot assume that the person who broke into your system will not have passed information onto others who may also have an interest in your data. The ease with which people can duplicate electronic information makes this a particular problem.
• intruders may not leave any footprints.
  If your system does not have an efficient accounting system then you may be completely unaware that someone can access your data. This is especially worrying if they could alter your data in their favour. For example, a bank's records might be gradually changed to show an increasing balance in the intruder's account.
• digital data is easily destroyed.
  If a malicious person has access to your system then they could easily issue a request that will delete all of the files in a directory. The same command might then go on to delete all files in a sub-directory, a sub-sub-directory, sub-sub-sub-directory and so on. Such a recursive deletion might take many hours if you had to physically rip or burn up physical data.
• information often has a strategic importance.
  Even if intruders do not make massive changes to your information, a few subtle changes to particular values might have a profound impact upon a company's behaviour. For example, changing the price quoted for an airline ticket so that your competitors are always a few pounds cheaper than you could have a massive impact upon the amount of business that you do.

Who can you trust?

As the greatest security threats come from within an organisation, it follows that many companies have clear rules of disclosure. These specify what can and what cannot be revealed to outside organisations. These rules extend to the sort of access that may be granted to the company's computer systems. A particular concern here is what repair facilities may be provided for information that contains sensitive data. One of the most effective means of breeching security is to act as a repair man/woman and copy the disks of any machine that you are working on.

Finally, security is based around a transitive closure of the people that you trust. This basically means that if you pass information onto someone you trust, then you'd better be sure that you trust all of the people that they trust and so on. If they pass your information onto someone else then you have to trust all of the people that this new person trusts as well...

Inferences from information?

• absence of information
  . This is critical because people can often make judgements based on the absence of information. If your system contains no records about a particular subject then an `intruder' may conclude that you are completely ignorant about a critical aspect of their operations. In military terms, this equates to finding out that your enemy knows nothing about your plans to attack them.
• network monitoring
  . It is also important to understand that certain inferences can be made even if the `intruder' cannot accurately see the content of messages passed over a computer network. For example, if two companies work in the same industry and the amount of network traffic increases between their head offices then this may indicate a potential merger or joint venture. Similarly, a burst of traffic might be anticipated immediately before a military operation.
• transfer of funds
  . Again, if money enters or leaves an account, an `intruder' might make certain inferences about the transaction that led to the payment. An important clue here would be the account details from where the funds originated.

Technological Threats

Trojan Horses

Time Bombs

Worms

The most famous example of a worm was created by Robert Morris. Over 6000 computers were eventually infected by the program. The consequences reached such a scale that the US government suspected a deliberate attempt to attack their systems by either a terrorist organisation or a foreign government. The program used several different techniques to gain access to remote sites. The first involved passing a parameter to a mail system that was longer than the mail tool expected. A loophole in the design of the mailtool meant that the remainder of the parameter was executed as a separate command. This contained the instructions necessary to replicate the worm. Other forms of attack attempted to log on as another user by entering a list of common passwords, such as password, my_password, celtic, rangers, thistle etc. If all of these attempts failed then the worm used a standard dictionary to attack people's passwords.

Eavesdropping

More sophisticated eavesdropping may measure the amount of electromagentic radiation that is emitted from a display. this in turn can be used to reconstruct an image of the information that is presented on the display. The protection that can be provided against such forms of attack involves the introduction of shields into the walls, floors and ceilings of office appartments. Again, the costs of such measures must be balanced against the potential costs of someone accessing your data.

There are numerous examples of less advanced forms of eavesdropping. Perhaps the best known is the alleged attempt by British Airways to obtain information from Virgin Atlantic's computer systems. This was the subject of prolonged litigation where BA were accused of having accessed Virgin's records that were stored on part of a computer that was leased from a BA company.

In retrospect, it seems surprising that Virgin would have considered such a vulnerable set-up. In this case, they were able to make good their losses through the courts. In other situations, they might not have been so fortunate. It would, perhaps, have been better not to have created the opportunity for such as `attack'?

Information Retrieval Systems

• feedback mechanisms
  . These techniques give searchers some information about the level of confidence the system has that a particular document will match a query. This can reduce the time taken to search for information because documents can be ignored if they have a predicted relevance below some threshold value. For instance, if a person was interested in any documents about the space shuttle then a document about astronauts might be returned with a 50% relevance factor while a document about aircraft might be returned with only a 30% relevance factor. These weightings are calculated by the system on the basis of previous queries with the system. If the user always looks at the astronaut files when searching for information about the space shuttle then the relevance for those documents will increase.
• efficient indexing
  . This is the process by which a system can allocate key terms to the documents in a system so that it does not have to search the entire set of data in response to each query. For example, if a document of 1,000 words contained the word `space' more than 50 times but the word `orange' only once then the document may be indexed under space but not orange.
• natural language queries
  . It is no longer necessary for users to learn complex query languages to use these systems. Although, it might be assumed that anyone who had the expertise to attack a secure system would also have the expertise to learn how to use an information retrieval system.

Protection Mechanisms

Encryption

• secret key encryption. In this approach, you have an algorithm which hides the message. in order to decode any file, you need a key to extract the original message. For example, if you take the position of any character in the alphabet and add two positions to it you can get a coded message. A -> C, B -> D, C -> E, D -> F and so on. In order to decode this message you need to know the system that was used and you also need to know the key, that is that you must more the characters two places to the left to get the original message. If you moved the characters four places or five places the whole thing would fail.
• public key encryption. This is slightly more difficult to explain. Basically, you have two keys. One is used to encrypt the message. anyone can have this as a means of sending you a secret. You also devise an algorithm which means that nobody else can decode the message without another second key that is kept secret. This will be covered in more detail in third and fourth year courses.

Digital Signatures

This technology is absolutely critical. Even if the details seem a bit hard to follow, it is very much worth thinking about because digital signatures will be at the centre of electronic payments over the world's computer systems. Unless you can be sure that someone has personally sent an order for a product then it would be easy for someone to issue a hoax request for a good or service that they had no intention of paying for. Folk history has it that one of the undergraduates in York issued an order for a rocket launcher from the Alabama State Armoury, all in the name of the head of Department,

Please, please, please, don't try this here...

Access control Lists

There are a number of alternative security mechanisms, In particular, it is possible to develop systems around access control lists. These associate lists of users with objects in the system. Only those users on the list can access that resource. For instance, a system might ensure that only the user of a file can write to it but any number of ther users can read it.

If we put these approaches together, we have a system in which users have a list of privileges. These are like keys that the user can present to gain access to a resource. Some systems hide their files so that only those users who know the exact location of a file can access it. The location of the files, or its path, becomes the key. Each resource will also have a list of users who can access it. The user presenting the key must not only have the correct status to access the resource, they must also appear on the resources list. Unsurprisingly this is know as the lock and key method.

Security policies

A security policy is a set of assumptions that guide the application of security mechanisms. For example, if you wanted to protect certain areas of your system then you could put locks and keys on those areas. Keys would only be granted to users who had the relevant permissions. By regularly changing these keys, the organisation might attempt to reduce the chances of anyone continuing to gain unauthorised entry.

One extension of this policy is know as fire-walling. In this approach, you erect defences around particular areas of your system. Password access and other checks are used to ensure that even if someone does gain access to one area of your system then they cannot access other areas. Many Universities implement this policy by requiring users to have different passwords on their various accounts. Technically, it would be possible for all systems to consult a central password file. This would mean that if someone gained illicit access to one machine they would gain access to all of the user's other accounts on other machines.

Other security policies associate privileges with groups. Typically, in Universities these privileges may differ between academic staff, support staff and students. In commercial organisations, they may differ between departments and user groups. In any event, it is critical to ensure that users cannot acquire privileges beyond those associated with the rest of their group. The right to grant and deny permissions must, therefore, be carefully controlled. If you have permission to grant permissions then you control the system, This is why this permission is associated with the `super user' in Unix systems.

Exercise: Security policies

In many organisations, there is a compromise to be made between security and freedom of access. The more passwords you need, the more protection mechanisms you install, the harder it is to gain access to the resources that you require. Why is it that many organisations opt for maximum access until something bad happens?

Do you think that this University ought to take more care over the security of its resources? Are there any ways that you can think of that people might use to gain access to your laser password or any other protection mechanisms that you might have used in the University?

Safety

Introduction

The term `luddism' refers to a strong negative reaction against the introduction of technology. It accurately describes many peoples' response to the introduction of informatio n technology. This antipathy towards computer systems need not be an unthinking response. For example, any user who has experienced the intermittant crashes that affect P Cs and workstations is, perhaps, justified in questioning the introduction of in formation technology into car control systems, medical applications and chemical processes. This section addresses these concerns by identifying the threats and protection mechanisms that have been developed to preserve the safety of computer applicati ons.

The Myth of the Cyborg

The myth of the cyborg has had an important impact upon popular attitudes toward s the safety of technology. This myth has been popularised by Hollywood, in films such as Terminator and Bla de Runner. It is, however, part of a longer stream of literature. These earlier sources include writers such as H.G. Wells and Mery Shelley. They were less concerned about the nature of the technology itself than in the ( potentially subservient) relationship between people and the machines that they create. In modern times, the introduction of complex, computer controlled systems has in creased the relevance of this relationship. However, the threat may be less immediate, less spectacular and less obvious tha n that portrayed by Terminator. We are not threatened today by a malign supercomputer seeking to destroy humanit y. However, our everyday `safety' is almost entirely dependant upon information tec hnology. Modern society is almost entirely supported by information technology. If the world's computer systems failed then so would our food and power distribu tion networks. There is a very real sense in which we are all cyborgs. We are all dependant on machines to survive.

Risk

What do you think of this argument? On the one hand it is appealing; computers never killed anyone. On the other hand, it is seriously flawed for without some source of error then the risk need not have been incurred. The important point is that, as engineers, we must go beyond the raw risk statis tics and examine the contribution that the computer systems make to the overall safety of the system as a whole. If we want to reduce the risk then we have to find those parts of the system tha t pose the greatest danger of failure.

There are further problems with the previous argument. Kletz presents the risk as 1 in 10^-7. What does this mean? One interpretation would have us believe that a risk of 1 x 10^-7 means that one person will die for every 10,000,000 that are exposed to the hazard (s ee N. Storey, Safety-Critical Computer Systems, Addison Wesley, 1996). In order to validate such a statistic we would have to have clear grounds for as sessing the potential results of exposing 10,000,000 people to the specified ris k. There are unlikely to be many volunteers. In consequence, it is best to be extremely skeptical about the reliability and a ccuracy of such low probability estimates for the risks of technological failure s.

What is Risk?

Frequency

	Y_POS_MAX: NATURAL := 10;
	X_POS_MAX: NATURAL := 10;

	for Y in 1..Y_POS_MAX loop
		for X in 1 to X_POS_MAX loop
			SCAN(X, Y);
		end loop;
	end loop;

Cost or Utility

Hardware Failure

Transient failures

Intermittent failures

Persistent failures

Hardware Fault Detection/Resolution

Triple Multiple Redundancy

This form of voting raises a number of issues. The first is cost. Each critical element will have to be replicated by N-1 other components, where N is a prime number in order to avoid any split decisions. This increases cost but will also have consequent effects upon both the weight o f any device and the amount of heat that is generated by the circuit. Heat is significant because unless sufficient cooling is provided then this will , in turn, introduce faults into the system over time.

The second issue in voting systems is that of duplicated failure paths. If exactly the sam hardware is used in all of the replicated components then the y may all share a common design flaw. This means that they will all agree on the same 'wrong' decision. In consequence. most practical applications will use different hardware to perfo rm the same function. comparisons are then made between the outputs from these multiple, redundant sys tems.

Signal comparison

Information redundancy

Watchdog timers

The monitored application, in contrast, will continue to increment the counter so that it is above zero. Only if the application crashes, will the counter start to fall towards zero.

Bus Monitoring

Software Failure

Requirements Flaws

Design Flaws

Implementation Flaws

	RESULT, DIVIDEND : NATURAL:= 1;

	DIVISOR : NATURAL:= 0;
	RESULT:= DIVIDEND/DIVISOR;

Testing Flaws

Why are Requirements Difficult?

There are two different types of requirements. Functional requirements relate narrowly to the functions that the system must pe rform. They include whether the program will include software to compute particular res ults or offer particular services. Non-functional requirements refer to more qualitative issues. They include issues such as the provision of a `usable' user interface.

It is, arguably, easier to gather functional rather than non-functional requirem ents. Customers and client sare often focussed upon the functions that the system must provide. This is similar to many people's experience of buying a new HI-FI or video. They arrive looking for Dolby-C with multi-channel seven day pre-programming. Unfortunately, the ease with which these functions can be used is often determin e by the non-functional requirements that are easily lost amongst the frenzy to acquire new features.

Requirements are difficult to gather because they often conflict. The person who is paying for a piece of software is seldom the person who will u se it the most. This create conflict because users might prefer a high quality graphical user in terface that line management are reluctant to pay for,

Requirements are difficult because people are often vague about what they want. they only realise what they don't want when you put your first system in front o f them.

Requirements are hard because they change over time as working practices evolve and as new requirements are discovered from producing early versions that fail.

Why is Testing Difficult?

As mentioned, it is not possible to test all possible paths of execution in comp uter programs that manipulate potentially infinite number representations. For example, how would one set about to test whether a program worked for all na tural numbers? Test it with 1 then 2 then 3 then 4 and so on up to infinity (or the maximum rep resentable number on the system)? Given that it is not possible to test everything there are essentially two souti ons that have similar aims.

Solution 1: formal verification.
The UK is a world leader in what have b ecome known as `formal methods'. These are mathematical techniques that can be used to prove that a program is co rrect through a process of logical deduction. Rather than testing that a program works for all natural numbers, it is possible to prove that it works for a base case, such as 1, and then prove that it works for any natural number plus one. This process of argumentation is costly, slow and painstaking but has a proven v alue in aerospace and nuclear applications.

Solution 2: structured testing.
This appraoch does not attempt to test all possible execution paths. It does, however, focus testing upon critical areas of a program. These areas are either identified as being important during the requirements sta ge or they are identified through the programmer's skill and expertise. For example, it is always good to test what happends when variables reach their upper and lower limits. In any event, it is CRITICAL that programmers document the rationale behin d any test that they perform. Other programmers must be able to read and understand the objectives for any tes t.

Human Failure

Incorrect plans

Slips

Lapses

Intrusions

This is not an exhaustive list. Cognitive psychologists and human factors experts are actively extending this ta xonomy to provide more complete models of human error types.

User vs Designer vs Manager?

Often, what appears to be operator error is the result of management failures. Even if the systems that they operate are well designed and implemented, then ac cidents can be caused because operators are poorly trained to use them. This raises practical problems because often operators are ill-equipped to respo nd to the low frequency, high-cost errors that were emtnioned in the section on risk. How then can companies predict these rare events that users should be trained to cope with?

Further sources of error come from poor working environments. Again, a system may work well in a development environment but the noise, heat, vibration, altitude of a users daily life may make the system 'unfit' for purpose.

Human Factors Solutions

There are, however, some obvious steps that can be taken to reduce boith the fre quency and the cost of human error. In terms of cost, it is possible to engineer decision support systems that provi de users with guidance and help during the performance of critical operations. These systems may even implement `cool off' periods where users' commands will n ot be effective until they have reviewed the criteria for a decision. These systems engineering solutions actively impose interlocks to control and li mit the scope of human intervention. the consequences are obvious when such locks are placed upon inappropriate areas of a system.

It is also possible to improve working practices. Most organisations see this is part of an on-going training program. In safety-critical applicatiuons there may be continuous and on the job competan ce monitoring as well as formal examinations.