Reliability modeling and analysis of dynamic TMR using standby spare

Mathur, F. P.

English

NASA Technical Reports Server

N A T I O N A L  A E R O N A U T I C S  A N D  S P A C E  A - D M I N I S T R A T I O N  
Technical Report 32-7467 
Reliabilify Modeling and Analysis of a Dynamic 
TMR Sysfem Using Standby Spares 
J E T  P R O P U L S I O N  L A B O R A T O R Y  
C A L I F O R N I A  I N S T I T U T E  O F  T E C H N O L O G Y  
P A S A D E N A ,  C A L I F O R N I A  
November 1, 1969 
https://ntrs.nasa.gov/search.jsp?R=19700018771 2020-03-12T02:10:59+00:00Z
N A T I O N A L  AERONAUTICS A N D  SPACE A D M I N I S T R A T I O N  
Technical Report 32 -7467 
Reliabilify Modeling and Analusis of a Dynamic 
TMR System Using Sfandby Spares 
E P. Mafhur 
J E T  P R O P U L S I O N  L A B O R A T O R Y  
C A L I F O R N I A  I N S T I T U T E  O F  T E C H N O L O G Y  
P A S A D E N A ,  C A L I F O R N I A  
November 1, 1969 
Prepared Under Contract No. NAS 7-1 00 
National Aeronautics and Space Administration 
Preface 
The work described in this report was performed by the Astrionics Division of 
the Jet Propulsion Laboratory, and was presented originally to the Seventh Annual 
Allerton Conference on Circuit and System Theory, held at  the University of 
Illinois, Urbana, October 8-10, 1969. 
JPL TECHNICAL REPORT 32- 9467 
Especially helpful were Mr. William F. Scott, Mr. John J. Wedel, Jr., and 
Mr. George R. Hansen for providing the atmosphere conducive to this research 
and for their encouragement. Special thanks are also due Dr. Ho-sen Lin for his 
many helpful suggestions regarding the mathematics given here. Particularly, the 
author is deeply grateful to Professor Algirdas A. Avizienis for introducing him 
to the subject of fault-tolerance and for the skillful and generous guidance given 
in negotiating the abundance of literature available in this field. 
JPL TECHNICAL REPORT 32- 1467 
Contents 
. . . . . . . . . . . . . . . . . . . . . . . . .  I . Introduction 1 
. . . . . . . . . . . . . . . . . . . .  I 1  . The TMR/Spares System 1 
. . . . . . . . . . . . . . . . . . . . . . . . .  Ill . Conclusion 5 
. . . . . . . . . . . . . . . . . . . . . . . . . . .  References 7 
Figures 
. . . . . . . . . . . . . . . . . . .  . 1 Simple TMR types of systems 2
2 . Reliability of NMR types of systems vs normalized time AT . . . . . . . . .  2 
. . . . . . . . . . . . . . . . . . .  3 . TMRISpares system concept 3
4 . TMRISpares system block diagram . . . . . . . . . . . . . . . . .  3
5 . Comparative reliability curves of TMR/Spares and NMR systems 
. . . . . . . . . . . . . . .  as a function of the simplex reliability R 6 
6 . Comparative reliability curves of TMRISpares and NMR systems 
. . . . . . . . . . . . . . .  as a function of the normalized time AT 6 
JPL TECHNICAL REPORT 32- 1467 
Abstract 
A dynamic TMR (triple modularly redundant) system using standby spares, 
referred to as the TMR/Spares system in this report, is developed, modeled, and 
analyzed. The characteristic reliability equation of such a system is derived. The 
behavior of the system reliability as a function of the nonredundant system and 
normalized time is plotted and comparisons are made with conventional TMR 
systems. The TMR/Spares model is considered to be a major addition to the 
redundancy techniques available to the designer of fault-tolerant computers. 
JPL TECHNICAL REPORT 32- 1467 
Reliability Modeling and Analysis of a Dynamic 
TMR System Using Standby Spares 
I. Introduction 
The use of protective redundancy to enhance reliability 
(Refs. 1 and 2)-once every step has been taken under the 
limitations of the prevailing state of technology to select, 
screen, and package highly reliable components-has, as a 
result of the research conducted and applications made in 
this field over the last decade (Refs. 3 and 4), found wide 
acceptance as a fundamental procedure, and is a process 
that nature in her apparent working sanctions (Ref. 5). 
Protective redundancy has been classified as being 
either massive or selective, and as static or dynamic. The 
first classification springs from an organizational point of 
view (Ref. 2), the latter from a f~~nctional point of view 
(Ref. 6). This report presents a system concept that is a 
hybrid because i t  uses both static and dynamic redun- 
dancy. I t  is a combination of two well-known techniques, 
triple modular redundancy (TMR) and replacement sys- 
tem (RS) redundancy. 
II. The TMR/Spares System 
The simple, TMR types of systems are first reviewed 
and are illrrstrated in Fig. 1. A simplex, or nonredundant, 
system having reliability R or R (T) is shown in Fig. la .  
Throughout this report the term reliability means the 
probability that a system required to perform a certain 
task will not malfunction prior to its mission time T. The 
reliability of a simple TMR system as shown in Fig. l b  is 
given by the following well-known equation: 
The generaIization of the TMR concepts (Ref. 7) to a 
system using 17 = 2N + 1 units and having an N + 
restoring organ is illustrated in Fig. l c  and is designated 
as the NMR system; its well-known reliability equation is 
The family of curves illustrating the behavior of the NMR 
system is shown in Fig. 2, with reliability plotted as a 
function of normalized time AT. 
The underlying failure law will be assumed to be expo- 
nential (Ref. 8). Thus the simplex reliability R is given by 
exp (-AT), where A is the failure rate of the nonredun- 
dant system when it is active. In the ensuing development 
of the probabilistic model for the TMR/Spares systems, 
the assumption of statistical independence of failures has 
been made. 
JPL TECHNICAL REPORT 32- 1467 
(a) SIMPLEX 
(b) TMR 
(c)  NMR 
I 
Fig. 1. Simple TMR types of systems 
0 0.4 0.8 1.2 1.6 2 .0  
NORMALIZED TIME AT 
Fig. 2. Reliability of NMR types of systems vs normalized time AT 
JPL TECHNICAL R E P O R T  32-1467 
The TMR/Spares system concept (Fig. 3) consists of a designated by p (p L A), with the corresponding reliability 
TMR core, with an associated bank of S spare units con- R, = exp ( -  pT). The physical realization of such a sys- 
figured so that when one of the basic TMR units fails the tem is shown in Fig. 4, where the disagreement detector 
spare unit replaces it and restores the TMR core to the compares the system output with each one of the basic 
all-perfect state. The active TMR units have a failure rate triplicated units. When a disagreement occurs, a signal is 
designated by A, while the standby spare units, which are transmitted to the switching unit which replaces the dis- 
said to be in a dormant mode (Ref. 9), have a failure rate agreeing unit by switching it out and switching in one of 
SYSTEM INPUTS 
SPARES 
- 
t 
SYSTEM OUTPUT 
Fig. 3. TMR/Spares system concept 
R-S-D UNIT 
r - - -  1 
TRIPLICATED 
UNITS 
SPARES L- RESTORING 
ORGAN 
Fig. 4. TMR/Spares system block diagram 
TECHNICAL REPORT 32-1467 
the spares. If the spare fails while in the dormant mode, At some time t the spare unit d fails, leaving the system 
the disagreement will still exist and the switching unit in basic TMR for the unelapsed time [T - t ] .  The prob- 
will replace it with another spare. The TMR/Spares sys- ability of this event is 
tem reduces to a simple TMR system when all the spares 
have been exhausted, and the whole system fails upon the 
- 
exhaustion of all the spares and the failure of any two of 
the basic triplicated units. 
The TMR/Spares system concept has been considered 
in other research from the architectural standpoint where 
(Refs. 10 and 11). A basic derivation (Ref. 12) of the reli- 
ability equation when dormancy of the spare units is not RTMRl0 [ T - t ] = R 3 [ T - t ]  + 3 R Z [ T - t ]  ( 1 - R [ T - t ] )  
considered (i.e., when all the S + 3  units inthe system are 
considered to have identical failure rates) yields 
which is the reliability of a simple TMR system for a mis- 
R+rixR/S = 1  - (1  - R)'+' [ l  + R  X ( S  + 2)] (3)  sion time [T  - t] .  
which is simply the probability that at least any two of the Case 3. active unit fails before the spare: 
total S + 3  units survive the mission duration. 
An expression for the reliability of a TMR/l system 
(i.e., a TMR/Spares system with one spare) is now de- 
rived. Let the three basic triplicated units be designated 0  T  
as a, b, and c, and the spare as d, as follows: 
At some time t  either n or b or c fails and is replaced by 
the spare d, thus leaving the system in basic TMR for the 
rest of the time [T - t ] .  The probability of this event is 
Three cases may be distinguished which yield the suc- Summing these three cases yields 
cess of the system for any mission time T. 
Case 1. All units survive time T:  
abc abc 
O l d  d  I T  
R ~ I R ~  [TI = R3 ( T )  Rs ( T )  + (3X + y )  
This event has the probability R q R , .  Similarly, it may be shown that 
Case 2. The spare unit is the first to fail: RTMR/z f TI = R3 ( T )  Ri ( T )  + (3h + 2y) 
JPL TECHNICAL REPORT 32- 1467 
and, in general, 
which may, by making the appropriate substitution, be rewritten as 
&,R/s+l [TI = R3 (2") R v  (T) (1 + [3* + (S + 1) r l ~ T e t ~ ~ * + ~ ~ + ~ ~ p ~ *  R 
The recursive Eq. (7) has the solution 
where K = A/p; pLX;  1 L K  <co; and 
For the special situation K = co, i.e., p = 0, the solution (8) reduces to 
-1 
An alternative way of writing Eq. (8) is 
The proof that Eq. (10) is the solution to the recursive the nonredundant unit, i.e., the simplex system having 
integral Eq. (7) can be verified by inserting Eq. (10) in reliability R. A family of curves for the number of spares 
the right-hand side of Eq. (7). equal to 6, 4, 2, and 1 is shown; for comparison, the reli- 
ability curves of the generalized TMR system (NMR) as 
given by Eq. (2) are also shown. The same family of curves In the derivation of the system equations, it was as- is also shown in Fig. 6 as a function of normalized time AT. 
sumed that the restoring organ, the switching unit, and 
the disagreement detector (jointly referred to as the R-S-D 
unit) are fail-proof. To incorporate the unreliability of 
these units, a lumped parameter R,., reflecting their re- Ill. Conclusion 
liability, may be assigned; and with the simplifying 
assumption that the R-S-D unit has a series reliability 
relative to the ideal TMR/Spares configuration, the term 
R ,  may be used as a product term to directly modify 
Eqs. ,(8), (9), and (10). 
The TMR/Spares system has been developed, and its 
characteristic reliability equation was derived and ana- 
lyzed under the assumptions of statistically independent 
failures and an exponential failure law, and under condi- 
tions of dormant failure rates for the spares. The behavior 
of the equations as a function of the nonredundant system 
The behavior of Eq. (10) is shown graphically in Fig. 5 and normalized time has been shown graphically, From 
for the case in which K = 1. Reliability is plotted versus these curves, the improvement in reliability resulting from 
JPL TECHNICAL REPORT 32- 1467 5 
the hybridization of simple TMR with RS redundancy is value of 0.233, and may be further reduced by allocating 
readily seen. I t  is to be noted that the well-known cross- more spares. Another major advantage in hardware and 
over point (which in NMR systems occurs at a reliability cost of the TMR/Spares system over the NMR system is 
of 0.5, with the resulting manifold constraints in practical that for an equal number of total units 77 the NMR system 
implementation of such systems) in the TMR/Spares will tolerate failures of only 17/2 units, whereas the TMR/ 
system having only one spare is reduced to a maximum Spares system will tolerate 7 - 2 failures. 
RELIABILITY R 
Fig. 5. Comparative reliability curves of TMR/Spares and NMR 
systems as a function of the simplex reliability R 
Fig. 6 . Comparative reliability curves of TMR/Spares and NMR 
systems as a function of the normalized time XT 
JPL TECHNICAL REPORT 32- 1467 
References 
1. Moore, E. F., and Shannon, C. E., "Reliable Circuits Using Less Reliable 
Relays," J. Franklin Znst., Vol. 262, Pt. I, pp. 191-208, and Vol. 262, Pt. 11, 
pp. 281-297, 1956. 
2. Avizienis, A. A., "Design of Fault-Tolerant Computers," in Conference Pro- 
ceedings of The American Federation of Information Processing Societies, 
Vol. 31, proceedings of the Fall Joint Computer Conference, Anaheim, Calif., 
Nov. 1416, 1967. Thompson Book Company, Washington, D.C. 
3. Avizienis, A. A,, Mathur, F. P., Rennels, D., and Rohr, J., "Automatic Mainte- 
nance of Aerospace Computers and Spacecraft Information and Control Sys- 
tems," Paper 69-966, presented at the AIAA Aerospace Computer Systems 
Conference, Los Angeles, Sept. 8-10, 1969. 
4. Anderson, J. E., and Macri, F. J., "Multiple Redundancy Applications in a 
Computer," in Proceedings of tlze 1967 Annual Symposium on Reliability, 
Washington, D.C., Jan. 10-12, 1967, pp. 553-562. Institute of Electrical and 
Electronics Engineers, Inc., New York, N.Y. 
5. von Neumann, J., "Probabalistic Logics and the Synthesis of Reliable Organ- 
isms From Unreliable Components," in Auto~izata Studies, pp. 43-98, Princeton 
University Press, Princeton, N. J., 1956. 
6. Short, R. A,, "The Attainment of Reliable Digital Systems Through the Use 
of Redundancy-a Survey," Computer Group News, pp. 2-17, March 1968. 
7. Knox-Seith, J. K., "Improving and Reliability of Digital Systems by Redun- 
dancy and Restoring Organs," Ph.D. thesis, Department of Electrical Engineer- 
ing, Stanford University, August 1964. 
8. Drenick, R. F., "The Failure Law of Complex Equipment," J. Soc. Ind. Appl. 
Math., Vol. 8, No. 4, pp. 680-690, December 1960. 
9. Mathur, F. P., "Reliability Study of Fault-Tolerant Computers," in Supp0t.t- 
ing Research and Aduatzced Development, Space Programs Summary 37-58, 
Vol. 111, pp. 106-113. Jet Propulsion Laboratory, Pasadena, Calif., Aug. 31, 
1969. 
10. Goldberg, J., Levitt, K. N., and Short, R. A., Techniques for the Realization of 
Ultrareliable Spaceborne Computers, Final Report-Phase I, Project 5580, 
Stanford Research Institute, Menlo Park, Calif., October 1967. 
11. Goldberg, J., Green, M. W., Levitt, K. N., and Stone, H. S., Tecllniques for the 
Realization of Ultrareliable Spaceborne Computers, Interim Scientific Report 2, 
Project 5580, Stanford Research Institute, Menlo Park, Calif., October 1967. 
12. Roth, J. P., Bouricius, W. G., Carter, W. C., and Schneider, P. R., Phase II of 
an Architectural Study for a Self-Repairing Computer, Inteinational Business 
Machines Corporation, Watson Research Center, Watson Heights, N.Y. Report 
SAMSO TR-67-106, November 1967. Also, AD-825460, Defense Documenta- 
tion Center, Alexandria, Va. 
JBL TECHNICAL REPORT 32- 9467 
NASA - JPL - toml . ,  L.A., Calif. 


Reliability modeling and analysis of a dynamic TMR system using standby spares

Abstract

Similar works

Full text

Available Versions

NASA Technical Reports Server