The use of proof in diversity arguments

The limits to the reliability that can be claimed for a design-diverse faul t-tolerant system are mainly determined by the dependence that must be expe cted in the failure behaviours of the different versions: claims for indepe ndence between version failure processes are not believable. In this note w e examine a different approach, in which a simple secondary system is used as a back-up to a more complex primary. The secondary system is sufficientl y simple that claims for its perfection (with respect to design faults) are possible, but there is not complete certainty about such perfection. It is shown that assessment of the reliability of the overall fault-tolerant sys tem in this case may take advantage of claims for independence that are mor e plausible than those involved in design diversity.