Fault tolerance terms

Progress has been made on the control structure problem. Despite its flaws, optimal control is now used in industry, though in a somewhat modified form and couched in terms of model predictive control. This new framework is much more intuitive. With this framework, fault tolerance can be... 

Which of the following physical network topologies offers the most fault tolerance in terms of cable interruption, while balancing requirements for amount of cable required ... 

A computerized party is even worse, because at present, any complicated computer system can be misused by not only one, but many people, such as operators, maintenance personnel, and designers. In terms of fault tolerance It is a series system with respect to trust, instead of a parallel system, as the judicial system should be. 

Machines safety circuits sometimes require special components such as relays, contactors, interlocks, and E-stops. Common terms associated with these machine components are control reliable, fault tolerant, aaA fail-safe, which means that they fail to a safe condition after a single fault (not multiple faults). 

The steps executed after fault detection are termed alarm interpretation which classify the actual fault, its characteristics (occurrence time, fault size, consequences, etc.), and the root cause. Fault characterization and quantification is required to determine the immediate process state and to determine whether the fault can be safely accommodated at that process state. Based on this input, fault accommodation may be performed through reconfiguration when standby devices in healthy condition are available or through fault-tolerant control (FTC) where the... 

Frequently Used Terms in Fault Tolerant Control... 

Following are a few important terms frequently used in fault tolerant control ... 

Regulation 18 covers the safety integrity of control systems that carry out safety functions. Such control systems need to have sufficient integrity, in terms of fault tolerance and reliability, when compared to the amount of risk reduction they are aiming to achieve. This subject is treated in detail in Chapter 13. 

A particularly important requirement for such systems is that they must have a safety integrity matched to the amount of risk reduction that the system is aiming to achieve, where the term safety integrity is usually understood to be a goodness factor that combines the concepts of reliability and fault tolerance. This may sound a difficult concept at first, and its realisation is often far from easy, but the principle is straightforward. It simply says that the higher the contribution that a safety-related system makes to safety, the better must be the system s safety performance. Safety performance of such systems is considered later in the chapter, after the main elements shown in Figure 13.1 are described in more detail. 

Thus far the components that make up a control system have been described without considering in detail how they are integrated to ensure that the systems have sufficient robustness, or safety integrity, for the safety application in which they will be used. Safety integrity refers to the reliability with which the system will perform the safety-related tasks it has been designed to perform, as well as the extent to which it will continue to perform its safety functions in the event of faults occurring. We are therefore interested in system performance in terms of reliability and fault tolerance. 

In the following tables m refers to the number of failures which lead to system failure. The tables provide the maximum SIL which can be claimed for eaeh SFF case. The expression m + 1 implies redundancy whereby there are (m + 1) elements and m failures are sufficient to cause system failure. The term Hardware Fault Tolerance (HFT) is commonly used. An HFT of 0 implies simplex (i.e., no failures tolerated). An HFT of one implies m out of (m + 1) (i.e., one failure tolerated) and so on. 

The objective of this task is to develop models of dependability assessment for alternative design paradigms. In particular reuse, and module evolution through versions, seem plausible candidates for achieving reliability. They may even allow more accurate evaluation of reliability by taking account of previous experience of use. Another concern is reliability assessment in fault tolerant architectures. Reliability of software iarchitectures can only be estimated in terms of what is known about the systems. We will investigate two aspects ... 

Fault tolerant architectures are amenable to the same treatment. Different configurations can be modelled in terms of their dependability properties when fully functional and under various stages of degradation. Assessment of complex systems will have degrees of tolerance. Formality as an assessment criterion can only be applied to elements of the system which are accessible and accurately documented. Hence a two layered approach may be taken to specify intra-module reliability criteria which are either present or absent (e.g. degrees of formal specification of the module internals and interface) and inter-module dependability in terms of formal assessment of interprocess communication. 

A fault is a method of determining cause or affixing blame. It is best safety practice to define faults in terms of failures. Although not every fault in a system causes a failure in that system, faults that either exist within or interact with a system may result in a system failure. When a system is determined to have faults that do not cause failures in the system, the system is said to be fault tolerant. ... 

Where an initiating fault can be shown deterministically not to result in a threat to a specific KSF (e.g. the plant being tolerant, in terms of reactivity control, to the ejection of a single control rod), such an event is only addressed in the DBA. 

There are a large number of machinery safety applications in which there is no justification, in terms of risk reduction, for having a dual channel singlefault tolerant single-fault detection architecture such as this. For example, an interlocked access door on an electrical panel in which the components are all protected to IP2X standard and which is only accessed once a week would only warrant a single channel category 1 interlock. 

Majority vote architectures are infrequently used, apart from some launchers (but the example of Ariane 5 confirms that selective redundancy architecture also meets the need, including in terms of continuity of service) and orbital transport vehicles. Their main disadvantage, at least for satelhtes or exploration probes, is the increase of mass and energy consumption compared to a selective architecture. Moreover, these architectures do not detect and tolerate common mode faults (that is why in the ATV the conventional detection mechanisms on each unit are kept in addition to the comparison mechanism). 

---