Fault tolerance dependability

The hardware and software used to implement LIMS systems must be vahdated. Computers and networks need to be examined for potential impact of component failure on LIMS data. Security concerns regarding control of access to LIMS information must be addressed. Software, operating systems, and database management systems used in the implementation of LIMS systems must be vahdated to protect against data cormption and loss. Mechanisms for fault-tolerant operation and LIMS data backup and restoration should be documented and tested. One approach to vahdation of LIMS hardware and software is to choose vendors whose products are precertified however, the ultimate responsibihty for vahdation remains with the user. Vahdating the LIMS system s operation involves a substantial amount of work, and an adequate vahdation infrastmcture is a prerequisite for the constmction of a dependable and flexible LIMS system. 

However, for structuring to have some direct relevance to questions of operational dependability, and in particular fault tolerance, it must be what might be described as strong—strong structuring actually controls interactions within and between systems, and limits error propagation in both time and space, i.e., constitutes real not just perceived or imagined boundaries. 

Powell et al. 2001] D. Powell, A. Adelsbach, C. Cachin, S. Creese, M. Dacier, Y. Deswarte, T. McCutcheon, N. Neves, B. Pfitzmann, B. Randell, R. Stroud, P. Verfssimo and M. Waidner. MAFTIA (Malicious-and Accidental-Fault Tolerance for Internet Apphcations), in Supplement of the 2001 Int. Conf. on Dependable Systems and Networks, pp. D32-D35, Goteborg, Sweden, IEEE Computer Society Press, 2001. 

Laprie J. Dependable computing and fault tolerance concepts and terminology. Laboratory for analysis and architecture of systems. National Center for Scientific Research 1985. http // www.macedo.ufbabr/conceptsANDTermonology.pdf. 

Markov models are generally considered more flexible than other methods. On a single drawing, a Markov model can show the entire operation of a fault tolerant control system including multiple failure modes. Different repair rates can be modeled for different failure situations. If the model is created completely, it will show full system success states. It will also show degraded states where the system is still operating successfully but is vulnerable to further failures. The modeling technique provides clear ways to express failure sequences and can be used to model time dependent probabilities. 

ANSl/lSA-84.00.01-2004 (lEC 61511 Mod) has a requirement for nainimum levels of "hardware fault tolerance" as a function of SIL level. This means that redundancy for purposes of achieving the safety function must be done depending on the SIL level target of the SIF. For field instruments and non-programmable logic solvers, the chart is shown in Figure 7-6. 

To deal with variations in quality requirements, we can define a set of quality factors and metrics for the factors. The choice of factors that are important and their level depends on the application. For example, security is an important factor for e-commerce applications and fault-tolerance is important for flight software. Typical... 

Analysis can be exceedingly cumbersome way to represent the data dependency analysis of the code. Architectural contributions are dispersed between large numbers of separate fault trees, and therefore it may be difficult to establish a holistic view of the fault tolerance of the S/W architecture. 

LARES — A novel approach for describing system reconfigurability in dependability models of fault-tolerant systems... 

Due to the dynamic behavior of reconfigurable fault-tolerant systems, the creation of stochastic dependability models is a difficult task. Traditional techniques like fault trees or rehabdity block diagrams are no longer sufficient in many cases, because they assume all components to be of a Boolean nature. However, in today s adaptable and reconfigurable systems, components must be described by more than the states active and failed in order to reflect the different roles of a component in a reconfigurable system. Moreover, often the system itself is not considered to be Boolean, but different failure classes are discriminated. Finally, the basic events (component failures and repairs) cannot be assumed to be independent, but common cause failure, failure propagation, limited repair capacities etc. must be taken into account. 

Previous research on software component failure dependencies seems to have been done primarily for parallel components, typically related to diverse and redrmdant components in fault tolerant designs such as N-version programming. These situations are characterised by components that are subject to the same input. We argue that failure dependencies must be viewed more generally, and that possible causes of dependent failure behaviour are more complex than current methods consider. 

ABSTRACT This paper deals with the design of control systems. The aim of the proposed method is to optimize the instrumentation scheme while satisfying criteria of financial cost and dependability. This method uses a structural model that describes qualitatively the different relations that link the physical variables. By analyzing this model, it is possible to obtain the different ways to estimate the unknown variables in function of the measurements provided by the sensors. The number of these ways may be interpreted as a fault tolerant level of the estimation possibilities. In this context, the optimization consists in finding the instrumentation scheme that satisfies the required fault tolerant level constraints with the lowest financial cost. The two main contributions of this paper are first an extension of the structural model in order to take into accoimt different operating modes and their specific features and second a clear formalization of the optimization problem that takes into account the costs of devices and specified fault tolerant level. 

The aim of the first steps of designing a dependable control system consists in determining the best instrumentation, that is to say, a set of sensors and actuators that, with the lowest cost, allows the system to perform its mission despite the failure of one or several of its components. This activity is generally complex, because two antagonist aspects have to he taken into account (Conrard and Bayart, 2003) The system has to be inexpensive thanks to the minimisation of the number of components and it has to be fault tolerant which generally implies hardware redundancies. 

The rest of the paper is structured as follows. In following section 2, the structural analysis is presented as a mean to determine the different ways to estimate a given quantity. Section 3 deals with the dependability and a way to assess it thanks to a fault tolerance level criterion. The optimization method is described in section 4 and applied on an illustrative example in section 5. 

An accurate evaluation of dependability parameters such as reliability value or failure rate is not needed. Consequently, the concept of fault tolerant level may be used to specify dependability of each mission of the system. It consists in fixing a minimal required mnn-ber of failures that can induce the unavaUabiLity of the mission. From a practical point of view, this method is attractive. Indeed, it enables a system to be evaluated without having lot of information about the reliability characteristics of all usable devices. 

Between these five discrete states 16 transitions 2) can be defined, depending on the set of possible states for each component and an initial state for the nominal system stale. The conditions of those state transitions are defined by a logical syntax, addressing the system component and the component state. Additionally, it is possible to address not just single component states but also logical combinations of different component states by setting combined conditions in order to provide a system with fault-tolerant capabilities. 

Dugan, J.B. andTrivedi, K.S. (1989). Coverage modeling for dependability analysis of fault-tolerant systems. IEEE Transactions on Computers, vol.38, no.6, p 145 155. 

C. Weaver, T. Austin, A Fault Tolerant Approach to Microprocessor Design, IEEE Inti. Conference on Dependable Systems and Networks (DSN-2001), July 2001. 

Hardware fault tolerance Systems must have a certain level of resilience to random hardware faults, depending on the SIL specification. This may be achieved using a combination of redundant components and sub-systems, frequent manual testing and repair and computer-automated testing ( diagnostics ). 

Loose coupling minimizes dependencies and thus helps scalability, flexibility and fault tolerance. When dependencies are reduced, modifications have minimized effects and the systems still run when some of them are down. When problems occur, it is important to decrease their effects and consequences. Josuttis [46] elaborates on several strategies to apply loose coupling. 

Engineering workpieces cannot be consistently produced to an exact size. This is due to a number of reasons such as wear on cutting tools, errors in setting up, operator faults, temperature differences or variations in machine performance. Whatever the reason, allowance must be made for some error. The amount of error which can be tolerated - known as the tolerance - depends on the manufacturing method and on the functional requirements of the workpiece. For example, a workpiece finished by grinding can be consistently made to finer tolerances than one produced on a centre lathe. In a similar way, a workpiece required for agricultural equipment would not... 

NOTE 3 It is important to note that the hardware fault tolerance requirements represent the minimum component or subsystem redundancy. Depending on the application, component failure rate and proof-testing interval, additional redundancy may be required to satisfy the SIL of the SIF according to 11.9. 

Fault prevention and fault tolerance, as two of the means to attain dependability [1], have to be considered by designers of critical systems. The former, for example, by means of quality control techniques, while the latter may take the form of replication distribution through replication confers tolerance to the system and allows to get a higher system availability. 

No claims shall be made in the safety manual, in respect of the hardware fault tolerance or the safe failure fraction or any other functional safety characteristic that is dependent on knowledge of safe and dangerous failure modes, unless the underlying assumptions, as to what constitute safe and dangerous failure modes, are clearly specified. ... 

---