Fault-tolerant design

Human error is defined as an act outside the tolerance bounds. These are determined by the technical boundary conditions and may therefore be influenced— within limits— by the designer in the sense that the tolerance region becomes large (fault-tolerant design). This reduces the probability of human error. 

The fail-safe design concept implies the application of fault-tolerant design approaches... 

Previous research on software component failure dependencies seems to have been done primarily for parallel components, typically related to diverse and redrmdant components in fault tolerant designs such as N-version programming. These situations are characterised by components that are subject to the same input. We argue that failure dependencies must be viewed more generally, and that possible causes of dependent failure behaviour are more complex than current methods consider. 

The experience is that for I C systems approval the probabilistic goals are set and needs to be fulfilled. Reasonable consideration of software reliabihty is desired. This could lead to sometimes senseless way of involvement of software faults into Fault Trees and their quantification. The sensitivity analysis of system tolerance to software faults and their common cause aspects is much more meaningful and could reveal the weak points of the I C design. Even if this analysis is mostly quahtative unless we have applicable methodology to estimate particular basic events prob-abftistic parameters, the Fault Tree Analysis Method represents a good base to demonstrate a sound fault tolerant design. 

Fault tolerant unit (FTU) FTU is a part of fault tolerant design. A device (maybe a controller) continues to operate even in the presence of faults. This is achieved primarily by using replication of hardware, software information, and... 

Fault tolerance As defined earlier, fault tolerant designs are aimed at development of systems that could function correctly in the presence of faults. This is primarily achieved by some kind of redundancy to detect or mask a fault. Masking/detections are followed by fault location, containment, and recovery. 

Here, general characteristics and features of fault tolerant designs are discussed. 

The fault tolerant design discussed here mainly pertains to computing systems and intelligent systems for real-time computer systems such as DCS/PLC and/or associated intelligent devices. Here, the discussion is on the basics of hardware and software fault tolerant principles in computing systems, whereas that applicable to control systems is covered in Clause 1.2. Two ways in which fault tolerant designs can be developed are hardware technique and software technique. 

Software fault tolerance For software, fault tolerant design redundancies are required to mask residual design faults. Some of the issues related to this shall include but are not limited to ... 

Design diversity This approach is rather costly. It combines hardware and software fault tolerance in different sets of computing channels. Each channel is developed in different hardware and software in redundant mode to provide the same function. This method is deployed to identify deviation of a channel from the others. The goal is to tolerate both hardware and software design faults [7]. After developing a fault tolerant design it is necessary to validate it from a reliability point of view, discussed later. 

Fault tolerant design for reliability is one of the most difficult tasks to verify, evaluate, and validate. It is either time-consuming or very costly. This requires creating a number of models. Fault injection is an effective method to validate fault tolerant mechanisms. Also an amount of modeling is necessary for error/fault environment and structure and behavior of the design, etc. It is then necessary to determine how well the fault tolerant mechanisms work by analytic studies and fault simulations [7]. The results from these models after analyses shall include but not be limited to error rate, fault rate, latency, etc. Some of the better known tools are HARP—hybrid automated reliability predictor (Duke), SAVE—system availability estimator (IBM), and SHARPE—symbolic hierarchical automated reliability and performance evaluator (Duke). 

Specific I/Os and processing units for SIS, preferably with fault tolerant design... 

E. Dubrova, Fundamentals of dependability. Chapter 2. Fault-Tolerant Design, Springer Science+Business Media, New York, 2013. 

Hardware failure and software failure are two kinds of failures encountered in programmable systems, as already discussed. In cases of hardware failure, fault tolerant designs such as redundancy could be applied. Software failure, as discussed, has to overcome certain procedures, but certain failures (design failure) could include behaviors that can be unsafe. A new technique known as system theoretic process analysis is applied in nuclear installations. This is required to identify the control requirements and then check conditions caused hy inadequate control actions such as ... 

In addition to a few conventional safety considerations (independence of SIS from BPCS, use of redundancy and fault tolerant design, etc., discussed at length in previous chapters) the following points are worth considering as safety issues related to offshore. Risks associated with typical BOP has been presented in Fig. XII/4.1.4-1. Depending on applicability, reader to decide the associated standard for reader s application. 

From the discussions in Chapters VII and VIII, it is clear that SIS and safety integrity level (SIL) are very closely coupled. Also, in order to achieve higher SIL, at times people may have to go for higher redundancies and/or fault tolerant design, which by itself will add cost to SIS. The higher the SIL value, the higher will be the cost of the system as is clear from Fig. APVI/1.2-1. 

It must be noted that the system fault tolerant design reduces sensitivity to the maintenance errors. 

A monitor is a system component that watches the health and operation of another system component. It is generally a part of fault-tolerant design or architecture. A monitor is typically a piece of electronic equipment that keeps track of the operation of a system component and warns of trouble, or is part of a larger subsystem that automatically switches to an alternate component. A monitor is a safety design feature. 

---