The TTA's Approach to Resilience after Transient Upsets

Abstract

The Time-Triggered Architecture, as architecture for safety-critical real-time applications, incorporates fault-tolerance mechanisms to ensure correct system operation despite failures. The primary fault hypothesis of the TTA claims to tolerate either the arbitrary failure of any one of its nodes or the passively arbitrary failure of any one of its communication channels. To cover these failure modes, active redundancy techniques are used, which basically means that nodes and channels are physically replicated. The primary fault hypothesis, is, however, not strong enough for certain applications that have to tolerate transient upsets of multiple, possibly all, components in the system. Such a transient upset of the system may break up the synchrony of the nodes and leave disjoined sets of nodes synchronized to each other while the overall synchronization is lost. Although the TTA provides a clique avoidance algorithm that is able to correct a wide class of such multiple transient failures, a stronger algorithm is needed for full coverage. In this paper we discuss a secondary fault hypothesis for the TTA that addresses the transient upset of multiple components and present a new clique resolving algorithm based on the TTA's integrated diagnosis and startup service.

Application-Level Diagnostic and Membership Protocols for Generic Time-Triggered Systems

“…A more recent protocol also requires a majority of active nodes, handles benign faults, and is extended to work in systems with event-triggered scheduling [5]. Authors of [32] identify a class of non fail-silent faults which are not fully tolerated by the TTP/C membership protocol even if bus guardians are used, and fix the problem under the single fault assumption. Our protocols tolerate multiple coincident non-Byzantine and Byzantine faults and have the same message complexity as existing ones, with the exception of the partitionable membership protocol which requires O(2N ) bits per message.…”

“…Experimental evaluation has pointed out some limitations of this integrated approach [31]. The TTA approach of tolerating transient upsets by detecting faulty nodes and by letting them converge to a correct state is discussed in [32]. Such rejuvenation techniques are orthogonal to our work, which only focuses on fault detection, but can be easily integrated with it.…”

Jet Engine Control Using Ethernet with a BRAIN

“…The synchronization protocol should not only include fault tolerant clock synchronization during synchronous operation, but should also consider the less often invoked but equally important startup and integration scenarios The protocol behavior of synchronization should not only include tolerance to all faults within the fault hypothesis, but also include means to address robustness aspects in order to resolve any potential system state after faults outside of the fault hypothesis, within bounded periods in a legal system state. Such robustness is also called self-stabilization of a protocol and in the case of synchronous communication networks referred to as clique resolution or aggregation [PH08,SPK06].…”

Advancements in Dependable Time-Triggered Communication

“…As a result, depending on the communication schedule configuration there is a probability that cliques scenarios are not diagnosed. In LTTP we propose a clique resolution algorithm that is not based on the relative number of correct messages received, but on the absolute number [SPK06]. If the number of received messages falls beyond an off-line calculable threshold for a given duration, cliques are detected.…”