On hierarchical design of computer systems for critical applications

Considers the design of computer systems that must be trusted to satisfy simultaneously a variety of critical requirements such as human safety, fault tolerance, high availability, security, privacy, integrity, and timely responsiveness, and that must continue to do so throughout maintenance and long-term evolution. Hierarchical abstraction is shown to provide the basis for successive layers of trust with respect to the full set of critical requirements, explicitly reflecting differing degrees of criticality.