2. vargas@computer.org1 Fault-Tolerant Systems Design Part 1

3. vargas@computer.org2 1. Introduction: Basic Definitions Fault-Tolerance is the ability of a system to continuously perform correctly its tasks after the occurrence of a fault.

4. vargas@computer.org3 Reliability of a system is the function, R(t), defined as the probability of the system to perform correctly through the time interval [t 0, t], given that the system was performing correctly at t 0. 1. Introduction: Basic Definitions

5. vargas@computer.org4 Availability is the function, A(t), defined as the probability of the system to operate correctly and to be available to perform its tasks through the interval [t 0, t]. 1. Introduction: Basic Definitions

6. vargas@computer.org5 Fault-Tolerant Systems can be designed by means of two basic approaches: Fault Masking Detection, localization and recovery, (via reconfiguration) of the system to remove the defective part. 2. Design of FT Systems

7. vargas@computer.org6 If the option is reconfiguration, then... before... Fault detection techniques Fault location techniques after... Fault recovery techniques 2. Design of FT Systems

8. vargas@computer.org7 Fault Recovery Techniques... Rollback Recovery Forward Recovery 2. Design of FT Systems

9. vargas@computer.org8 All techniques to design FT systems are based on some type and degree of redundancy. 2. Design of FT Systems

10. vargas@computer.org9 Redundancy is implemented through the use of HW, SW, information, or time beyond that necessary to system normal operation.  Results in a not negligible impact in the system in terms of performance, size, weight, power consumption, and reliability. 2. Design of FT Systems

11. vargas@computer.org10 Active Passive Hybrid Redundancy at the HW Level: 2. Design of FT Systems

12. vargas@computer.org11 1.  Based on the concept of fault masking to hide the occurrence of faults and prevent the faults from resulting in errors (developed around the concept of majority voting)  Do not provide for faults detection, but simply mask them HW Redundancy: 1. Passive 2. Design of FT Systems

13. vargas@computer.org12 Module 1 Module 2 Module 3 Voter Output Basic concept of Triple Modular Replication (TMR) Proc 1 Proc 2 Proc 3 Voter The use of triplicated voters in a TMR configuration Voter Mem 1 Mem 2 Mem 3 HW Redundancy: 1. Passive 2. Design of FT Systems

14. vargas@computer.org13 Example of SW voting VoterTask Task A Task B Task A Proc 1 Proc 3 Proc 2 HW Voting x SW Voting ? 1. The availability of processor to perform the voting 2. The speed at which voting must be performed 3. The criticality of space, power, and weight limitations 4. The # of different voters that must be provided 5. The flexibility required of the voter with respect to future changes in the system HW Redundancy: 1. Passive 2. Design of FT Systems

15. vargas@computer.org14 n In practical applications of voting, 3 results in a TMR system may not completely agree, even in a fault-free environment: e.g., A/D converters in sensors may produce quantities that disagree in the least-significant bits. This disagreement can propagate into larger discrepancies after computation, which can significantly affect the voting process. HW Redundancy: 1. Passive 2. Design of FT Systems

16. vargas@computer.org15  Solution  Mid-Value Select Technique A TMR system selects the value that lies in the middle of the others : Corrupted signal Uncorrupted signals Selected signals HW Redundancy: 1. Passive 2. Design of FT Systems

17. vargas@computer.org16  Attempts to achieve fault tolerance by means of fault detection, fault location, reconfiguration, and recovery (property of fault masking is not obtained: there is no attempt to prevent faults from producing errors within the system)  More suitable for applications where temporary, erroneous results are acceptable, as long as the system reconfigures and regains its operational status in a satisfactory length of time HW Redundancy: 2. Design of FT Systems 2. Active (or Dynamic)

18. vargas@computer.org17 Duplication of Functional Units Standby Blocks  Hot Standby Sparing  Cold Standby Sparing HW Redundancy: 2. Design of FT Systems 2. Active (or Dynamic)

19. vargas@computer.org18 Comparison Task Processor A Comparison Task Processor B Error Signals AB Processor A’s Result Processor B’s Result Shared Memory Processor A’s Private Memory Processor A’s Result Processor B’s Private Memory Processor B’s Result A software implementation of duplication with comparison 2. Active (or Dynamic) HW Redundancy: 2. Design of FT Systems

20. vargas@computer.org19 3. Hybrid HW Redundancy: 2. Design of FT Systems  Combines the attractive features of both the Active and the Passive approaches

21. vargas@computer.org20 Consistency Checks Capacity Checks N-Self Checking Programming N-Version Programming Recovery Blocks SW Redundancy: 2. Design of FT Systems

22. vargas@computer.org21 Use the previous knowledge about the chacacteristics of a given information to check the information correctness. Typically, for most applications, it is well known that a certain quantity of a given operand cannot assume values beyond predefined limits. Software Redundancy: Consistency Check 2. Design of FT Systems

23. vargas@computer.org22 Examples...  A processing system can sample and store many sensor readings in a typical control application.  The amount of cash requested by a patron at a bank’s teller machine should never exceed the maximum withdrawal allowed. Software Redundancy: Consistency Check 2. Design of FT Systems

24. vargas@computer.org23 Examples...  The address generated by a computer should never lie outside the address range of the available memory.  In a computer, each instruction code can be checked to verify that it is not one of the illegal codes. Software Redundancy: Consistency Check 2. Design of FT Systems

25. vargas@computer.org24 Capability checks are performed to verify that a system possesses the capability expected. Software Redundancy: Capability Check 2. Design of FT Systems

26. vargas@computer.org25 Examples...  Check whether a computer has the complete memory available.  Check whether the processors in a multiprocessor system are working properly.  Periodically, a processor can execute specific instructions on specific data and compare the results to known results stored in a ROM: check for ALU and Memory Software Redundancy: Capability Check 2. Design of FT Systems

27. vargas@computer.org26 Software Redundancy: N-Self Checking Programming 2. Design of FT Systems

28. vargas@computer.org27 Software Redundancy: N-Self Checking Programming 2. Design of FT Systems

29. vargas@computer.org28 Software Redundancy: N-Version Programming 2. Design of FT Systems

30. vargas@computer.org29 Software Redundancy: N-Version Programming 2. Design of FT Systems

31. vargas@computer.org30 Software Redundancy: N-Version Programming 2. Design of FT Systems

32. vargas@computer.org31 Software Redundancy: Recovery Blocks 2. Design of FT Systems

33. vargas@computer.org32 Software Redundancy: Recovery Blocks 2. Design of FT Systems

34. vargas@computer.org33 Parity and Berger Codes Arithmetic Codes Hamming Codes Checksum Code CRC ( Cyclic Redundancy Checking ) Code Information Redundancy: 2. Design of FT Systems

35. vargas@computer.org34 Transient Fault Detection Permanent Fault Detection Re-computation for Error Correction Time Redundancy: 2. Design of FT Systems

36. vargas@computer.org35 Transient Faults Detection Time Redundancy: 2. Design of FT Systems The fundamental concept is to perform the same computation two or more times and compare the results to determine if a discrepancy exists.

37. vargas@computer.org36 Time Redundancy: 2. Design of FT Systems Permanent Faults Detection Computation Encode Data Decode Result Store Result Store Result Compare Results Data Time t 0 Data Time t 1 Error

38. vargas@computer.org37 Time Redundancy: 2. Design of FT Systems Permanent Faults Detection Example encoding functions might include the compl ementation operator and an arithmetic shift. Suppose that we wish to detect errors in data transmitted over a parallel bus using the time redundancy approach. At time t 0, we transmit the original data, and at time t 0 + Δ, we transmit the complement of the data ( Alternating Logic Approach ). If a line of the bus is stuck at either a 1 or a 0, the two versions of the information that are received will not be complements of each other. Therefore, the fault can be detected..

39. vargas@computer.org38 Time Redundancy: 2. Design of FT Systems Re-computation for Error Correction Time redundancy approach can also provide for error correction if the computations are repeated three or more times. AND Consider the example of a logical AND operation. Suppose the operation is performed three times: first, without shifting the operands; second, with a one-bit logical shift of the operands; and third, with a two-bit logical shift of the operands.

40. vargas@computer.org39 Unfortunately, this approach will NOT work for arithmetic operations because the adjacent bits are not independent. A single, faulty bit slice can affect more than one bit of the result. The results generated using the shifted operands are then shifted back to their original positions. Because each of the three operations used operands that were displaced from each other by at least one bit position, a different bit in each result will be affected by the faulty bit slice. If the bits of each position are then compared, the results due to the faulty bit slice can be corrected by performing a majority vote on the three results obtained for each bit position. Time Redundancy: 2. Design of FT Systems Re-computation for Error Correction