Triple Modular Redundancy System Research Articles

Automatic Fuzzy Parameter Selection in Dynamic Fuzzy Voter for Safety Critical Systems

The main objective of this research paper is designing automatic fuzzy parameter selection based dynamic fuzzy voter for safety critical systems with limited system knowledge. Existing fuzzy voters for controlling safety critical systems and sensor fusion are surveyed and safety performance is empirically evaluated. The major limitation identified in the existing fuzzy voters is the static fuzzy parameter selection. Optimally selected static fuzzy parameters work only for a particular set of data with the known data ranges. In this paper, a dynamic or automatic fuzzy parameter selection method for fuzzy voters is proposed based on the statistical parameters of the local set of data in each voting cycle. Safety performance is empirically evaluated by running the static and dynamic fuzzy voters on a simulated triple modular redundant (TMR) system for 10000 voting cycles. Experimental results show that proposed Dynamic fuzzy voter is giving almost 100% safety if two of the three modules of the TMR System are error free. Dynamic voter is designed in such a way that it can be plugged in and used in any safety critical system without having any knowledge regarding the data produced and their ranges.

Design and reliability, availability, maintainability, and safety analysis of a high availability quadruple vital computer system

With the development of high-speed railways in China, more than 2000 high-speed trains will be put into use. Safety and efficiency of railway transportation is increasingly important. We have designed a high availability quadruple vital computer (HAQVC) system based on the analysis of the architecture of the traditional double 2-out-of-2 system and 2-out-of-3 system. The HAQVC system is a system with high availability and safety, with prominent characteristics such as fire-new internal architecture, high efficiency, reliable data interaction mechanism, and operation state change mechanism. The hardware of the vital CPU is based on ARM7 with the real-time embedded safe operation system (ES-OS). The Markov modeling method is designed to evaluate the reliability, availability, maintainability, and safety (RAMS) of the system. In this paper, we demonstrate that the HAQVC system is more reliable than the all voting triple modular redundancy (AVTMR) system and double 2-out-of-2 system. Thus, the design can be used for a specific application system, such as an airplane or high-speed railway system.

Development of an automatic subsea blowout preventer stack control system using PLC based SCADA

An extremely reliable remote control system for subsea blowout preventer stack is developed based on the off-the-shelf triple modular redundancy system. To meet a high reliability requirement, various redundancy techniques such as controller redundancy, bus redundancy and network redundancy are used to design the system hardware architecture. The control logic, human–machine interface graphical design and redundant databases are developed by using the off-the-shelf software. A series of experiments were performed in laboratory to test the subsea blowout preventer stack control system. The results showed that the tested subsea blowout preventer functions could be executed successfully. For the faults of programmable logic controllers, discrete input groups and analog input groups, the control system could give correct alarms in the human–machine interface.

DEPENDABILITY ANALYSIS OF HYBRID REDUNDANCY SYSTEMS USING FUZZY APPROACH

With the increasing demand for high reliability in mission critical systems such as space shuttle, digital flight and real time control to mention a few, reliability analysis of fault tolerant systems continues to be the focus of most researchers. The reliability analysis of triple modular redundancy (TMR) and hybrid redundancy (TMR with spares) systems is in general carried out with the assumption of failure rate being precise. However, in practice failure rate is imprecise due to the uncertainties of system operation. In this paper, the dependability analysis of hybrid redundancy systems (HRS) comprising of N-modular redundancy (NMR) and standby redundancy is presented assuming failure rates and repair rates as fuzzy numbers. Each module of the NMR is assumed to have access to a number of cold spares and a repair facility. A Markov model for the HRS is developed. As the Markov model parameters may not be precisely known due to various reasons, vertex method and α-cut method is applied. These methods allow uncertainty-based parameters that are represented as fuzzy numbers. The dependability measures such as availability and reliability are obtained. A comparative study of the fuzzy results and the conventional results using probability concepts is presented.

Design of heartbeat invalidation detecting mechanism in triple modular redundancy multi‐machine system

PurposeAccording to the high‐reliability requirement and especial structure of triple modular redundancy (TMR) emergent trip multi‐machine system, the purpose of this paper is to introduce a highly effective invalidation detecting mechanism based on heartbeat mechanism.Design/methodology/approachThe structure of TMR system is designed to be multi‐master and multi‐save. According to the multi‐machine environment, an invalidation detecting mechanism is designed. Considering the advantage and weakness of the traditional PULL and PUSH heartbeat model, the mechanism combines PUSH model with PULL model. To further enhance real‐time ability and reliability of the invalidation detecting mechanism, hierarchy heartbeat monitor and integrating the heartbeat message into data transmission are designed in the mechanism.FindingsThe invalidation detecting mechanism combines PUSH with PULL heartbeat monitor model can enhance reliability and decrease the system misdiagnosis rate greatly. By adapting hierarchy heartbeat mechanism and integrating the heartbeat detecting message into the data transmission, the system communication cost is decreased and the input‐to‐output response time is shortened. The effectiveness and reliability of this mechanism are proved by system field commissioning and MATLAB simulation.Originality/valueUsing a new heartbeat invalidation detecting mechanism, this paper provides a new way of fault diagnosis of TMR multi‐machine system.

Triple modular redundancy

In computing, triple modular redundancy (TMR) is a fault tolerant form of N-modular redundancy, in which three systems perform a process and that result is processed by a voting system to produce a single output. If any one of the three systems fails, the other two systems can correct and mask the fault. If the voter fails then the complete system will fail. However, in a good TMR system the voter is much more reliable than the other TMR components. Alternatively, if there is another stage of TMR logic following the current one (for example, in systems such as the Saturn Launch Vehicle Digital Computer), then three voters are used - one for each copy of the next stage of logic.

Design and RAMS Analysis of a Fault-Tolerant Computer Control System

This paper presents a fault-tolerant computer system. It is designed as a double 2-out-of-2 architecture based on component redundant technique. Also, a quantitative probabilistic model is presented for evaluating the reliability, availability, maintainability and safety (RAMS) of this architecture. Hierarchical modeling method and Markov modeling method are used in RAMS analysis to evaluate the system characteristics. The double 2-out-of-2 system is compared with the other two systems, all voting triple modular redundancy (AVTMR) system and dual-duplex system. According to the result, the double 2-out-of-2 system has the highest dependability. Especially, the system can satisfy the safety integrity level (SIL) 4, which means the system's probability of catastrophic failure less than or equal to 10 −8 per hour, therefore, it can be applied to life critical systems such as high-speed railway systems.

TMR Voting in the Presence of Crosstalk Faults at the Voter Inputs

In high reliability systems, the effectiveness of fault tolerant techniques, such as Triple-Modular-Redundancy (TMR), must be validated with respect to the faults that are likely in the current technology. In todays' Integrated Circuits (IC), this is the case of crosstalks, whose importance is growing because of device & interconnect scaling. This paper analyzes the problem of crosstalk faults at the inputs of voters in TMR systems. In particular, possible problems are illustrated, and it is shown that such crosstalk may invalidate the reliability of both voting, and diagnosing operations. The problem is analyzed from a probabilistic point of view. Its occurrence is estimated by using a set of TMR systems obtained with combinational benchmarks as functional modules. The possible problems of such operations are discussed in the presence of crosstalk faults. It is shown that crosstalk may invalidate the reliability of both voting, and diagnosis operations. A probabilistic model of the voting & diagnosis operations in the presence of crosstalk has been developed. Finally, such a model has been used to estimate the probability of voting & diagnosis failures in a set of TMR systems obtained by using combinational benchmarks as functional modules. We have shown that the presence of crosstalk faults at voter inputs may impair both the voting, and the diagnosis mechanisms. This problem has been quantified by applying a probabilistic model of crosstalk fault effects on voting and diagnosis to a set of benchmark circuits. Results show that crosstalk may create a reliability problem for TMR systems. Such a problem can be solved by using on-line testing or design for testability providing additional controllability & observability to the replicated functional units.

Informatics in radiology (infoRAD): A complete continuous-availability PACS archive server.

The operational reliability of the picture archiving and communication system (PACS) server in a filmless hospital environment is always a major concern because server failure could cripple the entire PACS operation. A simple, low-cost, continuous-availability (CA) PACS archive server was designed and developed. The server makes use of a triple modular redundancy (TMR) system with a simple majority voting logic that automatically identifies a faulty module and removes it from service. The remaining two modules continue normal operation with no adverse effects on data flow or system performance. In addition, the server is integrated with two external mass storage devices for short- and long-term storage. Evaluation and testing of the server were conducted with laboratory experiments in which hardware failures were simulated to observe recovery time and the resumption of normal data flow. The server provides maximum uptime (99.999%) for end users while ensuring the transactional integrity of all clinical PACS data. Hardware failure has only minimal impact on performance, with no interruption of clinical data flow or loss of data. As hospital PACS become more widespread, the need for CA PACS solutions will increase. A TMR CA PACS archive server can reliably help achieve CA in this setting.

A timeout-based message ordering protocol for a lightweight software implementation of tmr systems

Replicated processing with majority voting is a well-known method for achieving reliability and availability. Triple modular redundant (TMR) processing is the most commonly used version of that method. Replicated processing requires that the replicas reach agreement on the order in which input requests are to be processed. Almost all synchronous and deterministic ordering protocols published in the literature are time-based in the sense that they require replicas' clocks to be kept synchronized within some known bound. We present a protocol for TMR systems that is based on timeouts and does not require clocks to be kept in bounded synchronism. Our design efforts focus on keeping the ordering delays small, without an unnecessary increase in message overhead. Consequently, we are able to show that no symmetric protocol that works only with unsynchronized clocks can provide a smaller worst-case delay. We also demonstrate through analysis and experiments that our protocol is faster than a time-based one of identical message complexity in certain situations which can prevail in many application settings.

Installation of an integrated turbine-generator control system for a pulp mill

A British Columbian pulp mill had experienced the spiral of death many times when the turbine-generator controls were unable to survive the loss of utility tie-line connections. The mill has two high-efficiency rotary turbine-generator units rated 32.2 MVA each and a heat sink capable of generating 47 MW, approximately 87% of the mill power needs, though only 44 MW was being produced. The mill believed that with a load rejection strategy the mill had the potential to continue operation after the loss of a utility tie. In order to ride through the loss of the utility and to fully utilize the process heat sink, the mill needed to replace the 1960s-era turbine-generator control system supplied by the turbine-generator original equipment manufacturer. A triple modular redundant control system for each unit was installed. These systems integrate turbine governor controls and generator excitation control system in a single digital control. The systems are connected in order to jointly coordinate dispatch of real and reactive power demands and achieve load control for the mill. In a staged test, the mill was able to survive the loss of a utility tie-line, and has increased total generation. The new system completely automates the startup, loading, and synchronizing of both generators.

Reliability analysis of triple modular computer systems with redundant voters and restricted maintenance

Presents five newly developed models for a Triple Modular Redundancy system having zero, one, two, three, and N voters. Expressions for reliabilities and mean time to failure with and without repair are developed. The plots for state probabilities, reliabilities and mean time to failure are shown.

An optimal single error locating TSC-TMRsystem

A triple modular redundancy (TMR) system incorporates majority voting to achieve fault tolerance, although not all single faults can be tolerated due to the possibility of voter failure. A totally self-checking (TSC) circuit is introduced to monitor the TMR system; it receives the outputs of each module and that of the voter to generate three system statuses, and three module status outputs. The TSC–TMR system has the capability to detect all single fault occurrences inclusive of the checking circuitry, thus achieving optimum availability and maintainability regarding single fault occurrences. Morphic Boolean algebra forms the basis of the TSC fault detecting circuit design. Morphic building blocks constitute the newly designed checking circuit.

Comparative redundancy, an alternative to triple modular redundant system design

A new scheme for implementing highly reliable digital systems is proposed. The method has a circuitry overhead which is comparable to that of the triple modular redundancy (TMR) scheme, although it is shown to have a reliability, and more importantly a mean time to failure, improvement well beyond that expected from the standard TMR systems. The reliability and mean time to failure are both developed from a discrete state, continuous time, Markov model of the new system. The results for the reliability and mean time to failure characteristics for this new design of system, termed comparative redundancy, are compared to both TMR and a single unit.

Sequencing tasks to minimize the effects of near-coincident faults in TMR controller computers

Although Triple Modular Redundancy (TMR) has been widely used to mask the effects of a single faulty module, it cannot tolerate coincident faults in multiple modules caused by a common source, such as an environmental disruption or malfunction of a shared component. We propose a method to eliminate or alleviate the effects of (near) coincident faults by sequencing tasks on different modules in a TMR system. Specifically, we develop an effective sequencing of tasks to simply place an optimal distance (in the sense of minimizing the mean number of faulty tasks due to TMR failures) between the copies of a task to be executed on different modules. Several examples are presented, showing significant improvements in reducing TMR failures with the proposed task sequencing.

Design and analysis of an optimal instruction-retry policy for TMR controller computers

An instruction-retry policy is proposed to enhance the fault-tolerance of triple modular redundant (TMR) controller computers by adding time redundancy to them. A TMR failure is said to occur if a TMR system fails to establish a majority among its modules' outputs due to multiple faulty modules or a faulty voter. Either multiple consecutive TMR failures the active period of which exceeds a certain time limit or the exhaustion of spares as a result of frequent system reconfigurations may result in failure to meet the timing constraints of one or more tasks, called the dynamic failure, during a given mission. An optimal instruction-retry period is derived by minimizing the probability of dynamic failure upon detection of either a masked (by the TMR) error or a TMR failure. We also derive the minimum number of spares needed to keep below the pre-specified level the probability of dynamic failure for a given mission by using the derived optimal retry period.

Impact of Near-Coincident Faults on Digital Flight Control Systems

The effects of near-coincident faults must be taken into account in designing highly reliable digital flight control systems. In this paper closed-form solutions for permanent and transient near-coincident fault factors are derived, based on the behavioral decomposition/aggregation technique and Markov version of the CARE III coverage model. Parameters of the model are assumed to be exponentially distributed. The influence of fault detection rate, fault detectability, error production and propagation rates, error detectability, and transient fault/error transition rate on the near-coincident fault factors is discussed. Eventually, a homogeneous, continuous-time Markov chain is used for describing a triple modular redundant (TMR) system. The near-coincident fault factors are employed for analyzing the effect of the interfering faults on reliability of the TMR computer. System reliability and nearcoincident fault unreliability are plotted as functions of mission time, fault detectability, and weight of permanent and transient fault/errors. The impact of near-coincident faults can be curbed by increasing fault detectability. That impact is also lower when the percentage of transients is higher.

The effect of compensating faults models on NMR system reliability

Realistic estimates of the reliability of systems with N-tuple modular redundancy (NMR), must consider the effect of compensation of logic faults. Earlier analyses that include compensating faults are impractical to use, yield very complex mathematical formulas for reliability indices, and/or concern the simplest triple modular redundancy (TMR) system only. This paper gives a general approach to the problem. Two models of compensating faults are considered. For either model the lower and upper bounds on frequency of compensating faults are found. By applying some results of NMR system evaluation, the new estimates of upper and lower bounds of NMR system reliability with respect to compensating faults are derived. A simple algebraic form of the final results makes them useful.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

A trace-based compositional proof theory for fault tolerant distributed systems

We present a compositional network proof theory to specify and verify safety properties of fault tolerant distributed systems. We abstract from the precise nature and occurrence of faults, but model their effect on the externally visible input and output behavior. To this end a failure hypothesis is formalized as a relation between the normal behavior (i.e. the behaviour when no faults occur) of a system and its acceptable behaviour, that is, the normal behaviour together with the exceptional behaviour (i.e. the behaviour whose abnormality should be tolerated). The method is compositional to allow reasoning with the specifications of processes while ignoring their implementation details. A compositional formalism to reason about the normal behaviour is extended with a single rule by which a specification of the acceptable behaviour can be obtained from the specification of the normal behaviour and a predicate characterizing the failure hypothesis. Soundness and relative network completeness are proved. Our approach is illustrated by applying it to a triple modular redundant system and the alternating bit protocol.

VLSI common voting module for fault-tolerant TMR system in industrial system control applications

Abstract The preliminary results of research on designing a new type of VLSI voting circuitry, called the common voting module (CVM) are presented. The CVM is suitable for implementation in triple modular redundant systems for industrial process control applications operating in hazardous areas. Assembling the VLSI components with the electronic instruments, computers and actuators into fault-tolerant system, we achieve a fault-detection recovery and failure isolation far exceeding non-VLSI implementations. The fundamental idea is to design and partition the logical elements so that effective fault detection, identification of the faulty source, and synchronization can be done by a novel method, which places the detection responsibility inside the VLSI chip. The CVM allows an asynchronous data transfer between the redundant system's modules and is implemented as a Moore sequencer.