Breaking the Limits of Redundancy Systems Analysis

Abstract

Redundancy mechanisms such as triple modular redundancy protect safety-critical components by replication and thus improve systems fault tolerance. However, the gained fault tolerance comes along with costs to be invested, e.g., increasing execution time, energy consumption, or packaging size, for which constraints have to be obeyed during system design. This turns the question of finding suitable combinations of components to be protected into a challenging task as the number of possible protection combinations grows exponentially in the number of components. We propose family-based approaches to tackle the combinatorial blowup in redundancy systems modeling and analysis phases. Based on systems designed in SIMULINK we show how to obtain models that include all possible protection combinations and present a tool chain that, given a probabilistic error model, generates discrete Markov chain families. Using symbolic techniques that enable concise family representation and analysis, we show how SIMULINK models of realistic size can be protected and analyzed with a single family-based analysis run while a one-by-one analysis of each protection combination would clearly exceed any realistic time constraints.

Causality in Configurable Software Systems

“…For quantitative properties, we generated effect sets from configurable system analysis results as illustrated in Section 3.1 for three classes of systems. First, we considered configurable systems modeled for the variability-aware probabilistic model checker Pro-Feat [19], comprising a body sensor network (BSN) model [73] and a velocity control loop (VCL) model of an aircraft [32,35]. In both systems, the reliability (R) of the system is analyzed in terms of the probability of failure of sensors and control components, respectively.…”

“…While it is known how to determine protection configurations with optimal reliability-cost tradeoff [32], reasons for why a protection configuration is optimal or why a component was selected for protection are typically unclear. We address this issue exploiting our causal analysis methods.…”

“…A common principle to increase the reliability of a system is by triple modular redundancy (TMR) where system components are triplicated and their output are combined via a majority vote. Dubslaff et al [32] suggested to model and analyze systems with such protection mechanisms using family-based methods from configurable systems' analysis. To each component they assign a protection feature that specifies whether a component is triplicated or not.…”

Symmetry Breaking in Model Checking of Fault-Tolerant Nuclear Instrumentation and Control Systems

“…Our approach, by contrast, only considers possibility but not probability of fault scenarios. Probabilistic analysis of fault-tolerant redundant systems was also considered in [35], [36]. In particular, work [35] focuses on overcoming the combinatorial explosion caused by multiple system components protected with redundancies.…”

“…Probabilistic analysis of fault-tolerant redundant systems was also considered in [35], [36]. In particular, work [35] focuses on overcoming the combinatorial explosion caused by multiple system components protected with redundancies. Our work is motivated by a similar idea but applied to the explosion of the number of verification configurations.…”