Fault tolerance availability

Reliability and availability Does the running system reliably continue to perform correctly over extended periods of time What proportion of time is the system up and running In the presence of failure, does it degrade gracefully rather than shut down completely Reliability is measured as the mean time to system failure availability is the proportion of time the system is functioning. Both qualities are typically dealt with by making the architecture fault-tolerant using duplicated hardware and software resources. 

Despite the optimistic overtones, robust control is not a solved problem. Some difficult theoretical questions remain in the synthesis area. The available software is, at best, experimental the controller is complex and its structure is not obvious. It generally uses all the measurements and all the manipulated variables in a centralized fashion. On-line tuning is difficult except when the IMC structure is employed [8], Fault tolerance, that is, continued satisfactory or at least stable performance in the event of an actuator or sensor failure, cannot be guaranteed. 

Note that in discussing availability and performance one needs to make reference to the stakeholders responsible for hosting the system. In practice this could be the healthcare organisation, software manufacturer or a third party. The principles of fault tolerance and resilience remain the same irrespective of which party takes commercial responsibility. However the stakeholder responsible for implementing controls will vary as will the information available to safety case developers. In this... 

The international working group that prepared lEC 61508 considered the above factors and specified the extent of fault tolerance required in lEC 61508-2. In preparing this sector-specific standard for the process sector it was considered that the requirements for fault tolerance of field devices and non PE logic solver could be simplified and the requirements in lEC 61511-1 ANSI/ISA-84.00.01-2004 Part 1 (lEC 61511-1 Mod) could be applied as an alternative. It should be noted that subsystem designs may require more component redundancy than what is stated in Tables 5 and 6 in order to satisfy availability requirements. 

If a global time base is available (either directly or via a protocol that bounds relative drift between the set of system clocks), then it is relatively straightforward to build fault-tolerant services on either the time-triggered or event-triggered models. 

Blanke, M., Frei, C., Kraus, R, Patton, R., Staroswiecki, M. (2000). What is fault-tolerant control Aalborg University, Deptirtment of Control Engineering. Available from http //www. iau.dtu.dk/ secretary/pdf/stifeprocess 02h.pdf. 

F atton, R. J. (1997). Fault-tolerant control systems the 1997 situation. In Proceedings of 3rd IFAC Symposium on Fault Detection, Supervision and Safety for Technical Processes ( pp. 1033-1055). Available from http //hull.ac.uk/control/downloads/safepr.pdf. 

The steps executed after fault detection are termed alarm interpretation which classify the actual fault, its characteristics (occurrence time, fault size, consequences, etc.), and the root cause. Fault characterization and quantification is required to determine the immediate process state and to determine whether the fault can be safely accommodated at that process state. Based on this input, fault accommodation may be performed through reconfiguration when standby devices in healthy condition are available or through fault-tolerant control (FTC) where the... 

Fault prevention and fault tolerance, as two of the means to attain dependability [1], have to be considered by designers of critical systems. The former, for example, by means of quality control techniques, while the latter may take the form of replication distribution through replication confers tolerance to the system and allows to get a higher system availability. 

Data replication in DHTs increases the availabihty of data throughout the network. DHT entries are stored at k different peers, usually fc = 3. Large values of k result in increased availabihty and fault tolerance of the sj tem. The downside is reduced system performance due to increasing network traffic. If a peer p that provides a datum d leaves the network, d is stiff available at fc — 1 other peers. Subsequent to peer p s departure, P2P self-organization mechanisms adapt the P2P network s routing tables and choose another peer to store the replicas formerly stored on p. 

One very effective barrier against random device failures is to implement redundancy. Fault tolerance is provided using multiple devices in voting configurations that are appropriate for the SIL. If one device breaks down, another device is available to provide the safety action. Since failures occur randomly, it is less likely that multiple devices fail at the same time. 

Gruzs, Thomas M., High Availability, Fault-Tolerant AC Power Distribution Systems for Critical Loads, Proceedings, Power Quality Solutions/Alternative Energy, Intertec International, Ventura, CA,... 

The downside to RAID level 0 configurations is that it sacrifices fault tolerance, raising the risk of data loss because no room is made available to store redundant data. If one of the drives in the RAID 0 fails for any reason, there is no way of retrieving the lost data, as can be done in other RAID implementations. 

W. Goble, J.C. Grebe, White Paper Hybrid Fault Tolerant Architecture New Levels of Performance, Availability and Safety Integrity, August 27, 2008. Exida RTP 3000 System Report No. RTP 06/10el6 R002 Version VI, Revision R2. 

Fault tolerant design for reliability is one of the most difficult tasks to verify, evaluate, and validate. It is either time-consuming or very costly. This requires creating a number of models. Fault injection is an effective method to validate fault tolerant mechanisms. Also an amount of modeling is necessary for error/fault environment and structure and behavior of the design, etc. It is then necessary to determine how well the fault tolerant mechanisms work by analytic studies and fault simulations [7]. The results from these models after analyses shall include but not be limited to error rate, fault rate, latency, etc. Some of the better known tools are HARP—hybrid automated reliability predictor (Duke), SAVE—system availability estimator (IBM), and SHARPE—symbolic hierarchical automated reliability and performance evaluator (Duke). 

Safety is of paramount importance in the petrochemical industry. Working with flammable and hazardous substances under severe process conditions is always challenging. Naturally, all up-to-date information of the plant must be available at suitable places. There shall be ESDs/PSDs to cope up with emergency situations. In most interlock and safety-related instmmentation, fault tolerant circuits with 2oo3/ loo2 or TMR voting are deployed. SIS SIL is maintained in most cases at SIL3 in these plants. 

Interface). The former tends to be used where high levels of functionality and data rates are needed whereas the latter, which is based on the controller area network (CAN) protocol, is used in applications where there are lower functionality and simple input/output requirements. The manufacturers of these fieldbus systems have worked on developing them for use in safety applications, mainly to incorporate appropriate levels of fault tolerance or safety integrity. This has led to the availability of the Profisafe and AS-Isafe fieldbuses. In addition, PILZ has developed the SafetyBUS fieldbus for safety applications, which is again based on the CAN protocol, and the Open Devicenet Vendors Association has developed a safety version of the DeviceNet fieldbus called DeviceNet Safety. 

Safety integrity level 1 equates to a simple non-redundant single path designed to fail safe with a typical availability of 0.99. Level 2 involves a partially redundant logic structure, with redundant independent paths for elements with lower availability. Overall availability is in the range of 0.999. Level 3 is composed of a totally redundant logic structure. Redundant independent circuits are used for the total interlock system. Diversity is considered an important factor and is used where appropriate. Fault tolerance is enhanced since a single fault of an ESD system component is unlikely to result in a loss of process protection. 

The comparably low reliability and availability of wireless data transfer was treated in several work packages of COOPERS. A parallel use of two diverse wireless channels was discussed but considered too expensive. Therefore, the services were designed fault-tolerant against temporary unavailability of wireless connections. 

NOTE 2 Wear does not occur in software. Limitations in reliability are due to faults in requirements, design and implementation, or due to contextual changes. NOTE 3 Dependability characteristics include availability and its inherent or external influencing factors, such as availability, reliability (including fault tolerance and recoverability), security (including confidentiality and integrity), maintainability, durability, and maintenance support. 

---