A Technical History of the SEI

also known as using simplicity to control complexity. A key factor in applying this principle is to
have a simple computation of the bounds to be expected from the more complex component. In
the case of the PCA example, the simple bounds might be based on known allowable quantities of
morphine over a specific period, factored by the patient’s weight. As long as the more complex
system (the human) does not exceed those allowable bounds, the human can employ varying
amounts of morphine to combat experienced pain, with each patient using his or her own pain tolerance
as a guiding factor (the complex component).
The Simplex architecture also ensures predictable and guaranteed timing behaviors in spite of failures
of complex components and allows restarting or replacing complex components during operation.
Simplex architecture also enables switching the control to alternative components safely.
This can be done automatically so that if one complex controller fails, a second, alternative controller
using different algorithms can be invoked. An important side effect of this feature is that
developers can incrementally compile a new complex controller and switch control to that controller
while the system is running.
The Consequence: Increased Reliability of Safety-Critical Systems
The architecture principles have been applied successfully to many defense programs as well as
commercial systems. Notable applications of Simplex architecture principles include the F-22 and
F-35. In acknowledging support from the SEI and the University of Illinois at Urbana-Champaign
support during the implementation of those systems, DoD leadership clearly shows that the technology
has been highly regarded.
The SEI Contribution
The Simplex architecture is a software-fault-tolerant architecture. Prior to its development, the
dominant software-fault-tolerant approach was N-version programming [Lyu 1995]. It was shown
that the Simplex architecture significantly outperforms N-version programming under a wide
range of conditions [Sha 2001].
The Simplex architecture grew out of research at the SEI, and three prototype systems were developed
to demonstrate application of the concept. They include an inverted pendulum for experimental
purposes, a diving control system funded by the Navy, and an F-16 advanced maneuvering
control study using Lockheed Martin’s simulator and funded by the Air Force. Important applications
and extensions include the support of safety engineering in networked medical device interoperability
(sponsored by the National Institutes of Health and led by Massachusetts General
Hospital) and its applications to enhance the security of electric power networks (led by the SEI).
Recent extensions and development of technological advances include the System Simplex architecture,
in which the safe controller is implemented in field programmable gate arrays (FPGA)
[Bak 2009]. System Simplex is robust against operating system failures and security attacks on
the application processor. A more economical variant of System Simplex architecture is to implement
the safety controller on a secured core in a multicore chip. Currently, the SEI and the University
of Illinois Urbana-Champaign are collaborating on the extension of the System Simplex
architecture to secure a power generation and distribution network. Another extension is the support
of networked control systems, in which the stability enveloped accounts for the implications
of distributed control challenges [Yao 2013]. An ongoing research project in extending Simplex is
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 41
Distribution Statement A: Approved for Public Release; Distribution is Unlimited