Dans une composition de services Web basée protocole, un ensemble de services composants se collaborent pour donner lieu à un service Composite. Chaque service est représenté par un automate à états finis (AEF). Au sein d’un AEF, chaque transition exprime l’exécution d’une opération qui fait avancer le service vers un état suivant. Une exécution du composite correspond à une séquence de transitions où chacune est déléguée à un des composants. Lors de l’exécution du composite, un ou plusieurs composants peuvent devenir indisponibles. Ceci peut produire une exécution incomplète du composite, et de ce fait un recouvrement est nécessaire. Le recouvrement consiste à transformer l’exécution incomplète en une exécution alternative ayant encore la capacité d’aller vers un état final. La transformation s'effectue en compensant certaines transitions et exécutant d’autres. Cette thèse présente une étude formelle du problème de recouvrement dans une composition de service Web basée protocole. Le problème de recouvrement consiste à trouver une meilleure exécution alternative parmi celles disponibles. Une meilleure alternative doit être atteignable à partir de l’exécution incomplète avec un nombre minimal de compensations visibles (vis-à-vis le client). Pour une exécution alternative donnée, nous prouvons que le problème de décision associé au calcul du nombre de transitions invisiblement compensées est NP-Complet. De ce fait, nous concluons que le problème de décision associé au recouvrement appartient à la classe ΣP2. / In a protocol-based Web service composition, a set of available component services collaborate together in order to provide a new composite service. Services export their protocols as finite state machines (FSMs). A transition in the FSM represents a task execution that makes the service moving to a next state. An execution of the composite corresponds to a sequence of transitions where each task is delegated to a component service. During composite run, one or more delegated components may become unavailable due to hard or soft problems on the Network. This unavailability may result in a failed execution of the composite. We provide in this thesis a formal study of the automatic recovery problem in the protocol-based Web service composition. Recovery consists in transforming the failed execution into a recovery execution. Such a transformation is performed by compensating some transitions and executing some others. The recovery execution is an alternative execution of the composite that still has the ability to reach a final state. The recovery problem consists then in finding the best recovery execution(s) among those available. The best recovery execution is attainable from the failed execution with a minimal number of visible compensations with respect to the client. For a given recovery execution, we prove that the decision problem associated with computing the number of invisibly-compensated transitions is NP-complete. Thus, we conclude that deciding of the best recovery execution is in ΣP2.

Abstract Radio communication is used in increasingly diversified device typologies. Telecommunications with a reduced detrimental impact on health and environment, and an improved cost-efficiency and working lifetime are expected by institutions, end-users, operators and manufacturers. Moreover, with more networks present or more articulated systems, dependability of the entirety is to be ensured. The related need of efficiency in various compartments – such as in the use energy or the radio spectrum – and of effectiveness in adapting to changing operating conditions can be achieved with cognitive features. This dissertation addresses network reconfiguration and dependability by cognitive measures from multiple perspectives – each covered by a respective part of this work – providing guidelines for cognitive networks design. A rationalising view on cognitive networks with related taxonomies and models includes a discussion on the dynamics and interactions in networks operating closely and simultaneously (here, concurrent networks). While cognitive domains are specified for cognitive functions, with a more generic scope control functions are assigned to topological domains. This allows a flexible exploitation of the system design by decoupling the specification of system functions from their mapping onto network devices that will host them. As interaction plays an important role in many topical scenarios, a model for networked engineered cognitive entities comprising four categories (observation, interworking, consolidation, operation) and two levels (a cognitive frontier and a metacognitive hub) is presented here. Its cognitive phases are considered with regard to the other architectural elements. Moving the focus down to the levers for exploitation of context awareness, are presented solutions for efficient use of resources and dependability in general, considering the network dynamics. For communication link and network adaptation, the effective capacity is captured by a compact-form expression also considering imperfections, while learning is exploited for reducing overhead, and collaboration for fairly maximising energy save. / Tiivistelmä Käyttäjät, operaattorit ja laitevalmistajat toivovat tulevilta tietoliikennejärjestelmiltä sekä aiempaa pienempiä haitallisia vaikutuksia terveyteen ja ympäristöön että parannettua kustannustehokkuutta ja toiminta-aikaa. Lisäksi olisi varmistettava useiden verkkojen ja niiden muodostamien monimutkaisten järjestelmien kokonaisuuden luotettava toiminta. Tarvittava tehokkuus energian ja radioresurssien käytössä, samoin kuin kyky sopeutua muuttuviin käyttötilanteisiin, voidaan saavuttaa kognitiivisilla radioteknikoilla. Tämä väitöskirja käsittelee kognitiivisten menetelmien tuomaa radioverkkojen mukauttamista ja luotettavuutta eri näkökulmista. Samalla esitetään kognitiivisten verkkojen suunnittelun periaatteita ja lähtökohtia. Väitöskirja sisältää katsauksen kognitiivisiin radioverkkoihin niihin liittyvine luokitteluineen ja malleineen, sekä tarkastelee samanaikaisesti ja läheisesti toimivien verkkojen (rinnakkaisten verkkojen) dynamiikkaa ja vuorovaikutuksia. Työssä määritetään kognitiiviset lohkot kognitiivisine toimintoineen, kun taas topologiset tasot hallintatoimintoineen määritetään yleisemmin. Tämä mahdollistaa järjestelmäsuunnittelun joustavan hyödyntämisen erottamalla järjestelmän toimintojen määrittelyn toteuttavista verkkolaitteista. Koska vuorovaikutus on merkittävä tekijä useissa sovellusskenaarioissa, verkottuneille keinotekoisille kognitiivisille yksiköille ehdotetaan tässä neljä luokkaa (havainnointi, yhteistoiminta, vakauttaminen, toiminta) sekä kaksi vyöhykettä (kognitiivinen raja-alue ja metakognitiivinen keskus) sisältävää mallia. Mallin kognitiiviset vaiheet käsitellään suhteessa muihin arkkitehtuurin elementteihin. Järjestelmän kontekstitietoisuuden hyväksikäyttöön liittyen esitetään ratkaisuja resurssien tehokkaaseen käyttöön ja yleisemmin luotettavuuteen ottaen huomioon verkkojen dynamiikkaa. Yhteyksien ja verkkojen mukauttamisesta esitetään analyyttinen ratkaisu saavutettavan tehollisen kapasiteetin määrittämiseksi, huomioiden mahdolliset epäideaalisuudet. Kognitiivista oppimista hyödynnetään hallintalikenteen vähentämiseksi ja yhteistyötä energiansäästön maksimoimiseksi verkon alueella tasapuolisesti.

In this Ph.D. thesis, a new methodology for the fault tolerant system state synchronization design and its recovery from faults is presented. A state synchronization method designed by means of the proposed methodology allows to repair the state of sequential logic elements implemented in the FPGA application logic, which cannot be repaired by the partial dynamic reconfiguration. The proposed methodology describes possible state synchronization design methods with respect to TMR granularity, dependence of the system function on its previous states and the system architecture. The methodology focuses on coarse-grained TMR architectures and state synchronization in the systems controlled by means of finite state machines or a processor. The use of the methodology is demonstrated on the CAN bus control system and the microcontroller NEO430, for which specific synchronization methods were designed. The systems reliability and new ability of the systems for recovery from faults were verified in the presence of simulated SEU faults. The experimental results and the contribution of this thesis are discussed in the conclusion.

At avionics control and critical systems is necessary guarantee a minimal level of fault tolerance and their high reliability. On the electronic components in these devices has an undesirable influence environment conditions and mainly cosmic ray. In this paper are described the most common failure types of semiconductor components and devices together with modern methods which can be increased the system fault tolerance and its overall reliability. There are introduced aspects of the avionic systems design due to finally certification and ways to evaluate its safety. This thesis describes design and implementation of the CAN bus control system for the FPGA platform which uses the CANAerospace application protocol. Created system design is improved by the TMR architecture. Fault tolerance of both system version is tested by the SEU framework which allows using the dynamic partial reconfiguration generate an SEU failures into running FPGA design.

It is a fact that software has bugs. These bugs can lead to failures. Especially dependability and security failures are a great threat to software users. This thesis introduces four novel approaches that can be used to automatically harden software at the user's site. Automatic hardening removes bugs from already deployed software. All four approaches are automated, i.e., they require little support from the end-user. However, some support from the software developer is needed for two of these approaches. The presented approaches can be grouped into error toleration and bug removal. The two error toleration approaches are focused primarily on fast detection of security errors. When an error is detected it can be tolerated with well-known existing approaches. The other two approaches are bug removal approaches. They remove dependability bugs from already deployed software. We tested all approaches with existing benchmarks and applications, like the Apache web-server.:1 Introduction 1 1.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.2 Automatic Hardening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.3 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.4 Theses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2 Enforcing Dynamic Personalized System Call Models 9 2.1 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2 SwitchBlade Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.3 System Call Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.3.1 Personalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2.3.2 Randomization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.4 Model Learner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.4.1 Problem: False Positives . . . . . . . . . . . . . . . . . . . . . . . . 22 2.4.2 Data- ow-Based Learner . . . . . . . . . . . . . . . . . . . . . . . . 26 2.5 Taint Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.5.1 TaintCheck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.5.2 Escaping Valgrind . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.5.3 Replay of Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2.6 Model Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 2.6.1 Loading the System Call Model . . . . . . . . . . . . . . . . . . . . 31 2.6.2 Checking System Calls . . . . . . . . . . . . . . . . . . . . . . . . . 31 2.7 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 2.7.1 Synthetic Exploits . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 2.7.2 Apache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 2.7.3 Exploits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 2.7.4 Micro Benchmarks . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 2.7.5 Model Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.7.6 Stateful Application . . . . . . . . . . . . . . . . . . . . . . . . . . 39 2.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 3 Speculation for Parallelizing Runtime Checks 43 3.1 Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.1.1 Compiler Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . 47 3.1.2 Runtime Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 3.2 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.3 Deterministic Replay and Speculation . . . . . . . . . . . . . . . . . . . . . 52 3.3.1 Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.3.2 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 3.4 Switching Code Bases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 3.4.1 Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 3.4.2 Integration with parexc chkpnt . . . . . . . . . . . . . . . . . . 58 3.4.3 Code Transformations . . . . . . . . . . . . . . . . . . . . . . . . . 59 3.4.4 Stack-local Variables . . . . . . . . . . . . . . . . . . . . . . . . . . 67 3.5 Speculative Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 3.5.1 Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 3.5.2 Deadlock Avoidance . . . . . . . . . . . . . . . . . . . . . . . . . . 69 3.5.3 Storage Back-ends . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 3.6 Parallelized Checkers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 3.6.1 Out-of-Bounds Checks . . . . . . . . . . . . . . . . . . . . . . . . . 70 3.6.2 Data Flow Integrity Checks . . . . . . . . . . . . . . . . . . . . . . 71 3.6.3 FastAssert Checker . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 3.6.4 Runtime Checking in STM-Based Applications . . . . . . . . . . . . 72 3.7 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 3.7.1 Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 3.7.2 Checking Already Parallelized Applications . . . . . . . . . . . . . . 77 3.7.3 ParExC Overhead . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 3.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 4 Automatically Finding and Patching Bad Error Handling 83 4.1 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 4.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 4.3 Learning Library-Level Error Return Values from System Call Error Injection 89 4.3.1 Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 4.3.2 E cient Error Injection . . . . . . . . . . . . . . . . . . . . . . . . 91 4.3.3 Obtain OS Error Specification . . . . . . . . . . . . . . . . . . . . . 92 4.4 Finding Bad Error Handling . . . . . . . . . . . . . . . . . . . . . . . . . . 92 4.4.1 Argument Recording . . . . . . . . . . . . . . . . . . . . . . . . . . 93 4.4.2 Systematic Error Injection . . . . . . . . . . . . . . . . . . . . . . . 94 4.4.3 Static Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 4.5 Fast Error Injection using Virtual Machines . . . . . . . . . . . . . . . . . 99 4.5.1 The fork Approach . . . . . . . . . . . . . . . . . . . . . . . . . . 100 4.5.2 Virtual Machines for Fault Injection . . . . . . . . . . . . . . . . . . 101 4.6 Patching Bad Error Handling . . . . . . . . . . . . . . . . . . . . . . . . . 102 4.6.1 Error Value Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . 103 4.6.2 Preallocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 4.6.3 Patch Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 4.7 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 4.7.1 Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 4.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 5 Robustness and Security Hardening of COTS Software Libraries 117 5.1 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 5.2 Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 5.3 Test Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 5.3.1 Ballista Type System . . . . . . . . . . . . . . . . . . . . . . . . . . 123 5.3.2 Meta Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 5.3.3 Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 5.3.4 Type Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 5.3.5 Type Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . 128 5.3.6 Reducing the Number of Test Cases . . . . . . . . . . . . . . . . . . 128 5.3.7 Other Sources of Test Values . . . . . . . . . . . . . . . . . . . . . . 130 5.4 Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 5.4.1 Check Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 5.4.2 Parameterized Check Templates . . . . . . . . . . . . . . . . . . . . 133 5.5 Protection Hypotheses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 5.5.1 Minimizing the Truth Table . . . . . . . . . . . . . . . . . . . . . . 134 5.5.2 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 5.6 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 5.6.1 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 5.6.2 Autocannon as Dependability Benchmark . . . . . . . . . . . . . . 138 5.6.3 Protection Hypotheses . . . . . . . . . . . . . . . . . . . . . . . . . 139 5.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 6 Conclusion 143 6.1 Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 References 147 List of Figures 159 List of Tables 163 Listings 165

Safe airspace of airports worldwide is crucial to ensure that passengers, workers, and airplanes are safe from external threats, whether malicious or not. In recent years, several airports worldwide experienced intrusions into their airspace by unmanned aerial vehicles. Based on this observation, there is a need for a reliable detection system capable of detecting unmanned aerial vehicles with high accuracy and integrity. This thesis proposes time redundant triplex parallel diverse convolutional neural network architectures trained to detect unmanned aerial vehicles to address the aforementioned issue. The thesis aims at producing a system capable of real-time performance coupled with previously mentioned networks. The hypothesis in this method will result in lower mispredictions of objects other than drones and high accuracy compared to singular convolutional neural networks. Several improvements to accuracy, lower mispredictions, and faster detection times were observed during the performed experiments with the proposed system. Furthermore, a new way of interpreting the intersection over union results for all neural networks is introduced to ensure the correctness and reliability of results. Lastly, the system produced by this thesis is analyzed from a dependability viewpoint to provide an overview of how this contributes to dependability research.

Dans les systèmes embarqués critiques, assurer la sûreté de fonctionnement est primordial du fait, à la fois, des exigences en sûreté dictées par les autorités de certification et des contraintes en sûreté de ces systèmes où des défaillances pourraient conduire à des évènements catastrophiques, voire la perte de vies humaines. Les architectures de ces systèmes sont aujourd'hui de plus en plus distribuées, s'appuyant sur des réseaux numériques complexes, ce qui pose la problématique de l'intégrité des communications. Dans ce contexte, nous proposons une approche bout en bout pour l'intégrité des communications, basée sur le concept du " canal noir " introduit par l'IEC 61508. Elle utilise les codes détecteurs d'erreurs CRC, Adler et Fletcher. Selon le niveau de redondance des systèmes, nous proposons une approche multi-codes (intégrité jugée sur un lot de messages) pour les systèmes dotés d'un niveau de redondance important et une approche mono-code (intégrité jugée sur chaque message) pour les autres cas. Nous avons validé ces propositions par des expérimentations évaluant le pouvoir de détection intrinsèque de chaque code détecteur et la complémentarité entre ces code en termes de pouvoir de détection, ainsi que leurs coûts de calcul avec une analyse de l'impact du type de leur implémentation et de l'environnement matériel (standard et embarqué : processeurs i7, STM32, TMS320C6657 et P2020). L'approche mono-code a été appliquée à un cas d'étude industriel : les futurs systèmes de commande de vol d'Airbus Helicopters. / In critical embedded systems, ensuring dependability is crucial given both dependability requirements imposed by certification authorities and dependability constraints of these systems where failures could lead to catastrophic events even loss of human lives. The architectures of these systems are increasingly distributed deploying complex digital networks which raise the issue of communication integrity. In this context, we propose an end to end approach for communication integrity. This approach is based on the "black channel" concept introduced by IEC 61508. It uses error detection codes particularly CRC, Adler and Fletcher. Depending on the redundancy level of targeted systems, we propose a multi-codes approach (integrity of a set of messages) for systems with an important redundancy level and a single- code approach (integrity per message) for the other cases. We validated our proposals through experiments in order to evaluate intrinsic error detection capability of each error detection code, their complementarity in terms of error detection and their computational costs by analyzing the impact of the type of implementation and the hardware environment (standard or embedded: i7, STM32, TMS320C6657 and P2020 processors). The single-code approach was applied to an industrial case study: future flight control systems of Airbus Helicopters.

The topics described in this diploma thesis belong to the area of digital systems testability analysis. Basic concepts as dependability, controllability, observability and testability are explained. Methods of raising testability and dependability of digital circuits are mentioned including the metrics which allow to evaluate testability parameters. Furthermore, the thesis describes the formal model of digital systems which introduces the implementing part of the thesis. Within this part, a program tool is demonstrated, which allows to identify the components of digital circuits and their function. The other function of the program tool is to create control circuits that check the correct function of such digital circuits.

The study aimed to identify and analyse methods for establishing external communication between humans and autonomous/teleoperated machines/vehicles using various Human-Machine Interfaces (HMIs). The study was divided into three phases. The purpose of the first phase was to identify and highlight previously tested/researched methods for establishing external communication by conducting a literature review. The findings from the literature review were categorised into six points of interest: machine indications, test delivery methods, HMI technologies/types, symbols, textual/numerical messages, and colours associated with different indications. Based on these findings, four HMIs (projection, display, LED-strip, and auditory) were selected for evaluation in a virtual reality environment for the second phase of the study, which has the purpose of identifying which of the human-machine interfaces can effectively communicate the intentions of autonomous/teleoperated machines to humans. The results of phase two indicate that the participants preferred projection as the most effective individual HMI, and when given the option to combine two HMIs, projection combined with auditory was the most preferred combination. The participants were also asked to pick three HMIs of their choosing, resulting in the projection, display and audible HMI combination being the preferred option. The evaluation of HMIs in a virtual reality environment contributes to improving dependability and identifying usability issues.  The objective of the third and final phase was to gather all the findings from the previous phases and subsequently refine the report until it was considered finalised. Future work includes enhancing the realism of the VR environment, refining machine behaviour and scenarios, enabling multiple participants to simultaneously interact with the environment, and exploring alternative evaluation methods. Addressing these areas will lead to more realistic evaluations and advancements in human-machine interaction research.

One of the objectives of this study is to develop a methodology, together with a set of software programs that evaluate, in a power system, the risks of catastrophic failures caused by hidden failures in the hardware or software components of the protection system. The disturbance propagation mechanism is revealed by the analysis of the 1977 New York Blackout. The step-by-step process of estimating the relay hidden failure probability is presented. A Dynamic Event Tree for the risk-based analysis of system catastrophic failures is proposed. A reduced 179-bus WSCC sample system is studied and the simulation results obtained from California sub-system are analyzed. System weak links are identified in the case study. The issues relating to the load and generation uncertainties for the risk assessment of system vulnerabilities are addressed. A prototype system - the Hidden Failure Monitoring and Control System (HFMCS) - is proposed to mitigate the risk of power system catastrophic failures. Three main functional modules - Hidden Failure Monitoring, Hidden Failure Control and Misoperation Tracking Database - and their designs are presented. Hidden Failure Monitoring provides the basis that allows further control actions to be initiated. Hidden Failure Control is realized by using Adaptive Dependability/Security Protection, which can effectively stop possible relay involvement from triggering or propagating disturbance under stressed system conditions. As an integrated part of the HFMCS, a Misoperation Tracking Database is proposed to track the performance of automatic station equipment, hence providing automatic management of misoperation records for hidden failure analysis. / Ph. D.