Misplaced Pages

#35964

72-430: The International Electrotechnical Commission (IEC), via its Technical Committee TC 56 develops and maintains international standards that provide systematic methods and tools for dependability assessment and management of equipment, services, and systems throughout their life cycles. The IFIP Working Group 10.4 on "Dependable Computing and Fault Tolerance" plays a role in synthesizing the technical community's progress in

144-444: A fail-fast component is designed to report at the first point of failure, rather than generating reports when downstream components fail. This allows easier diagnosis of the underlying problem, and may prevent improper operation in a broken state. A single fault condition is a situation where one means for protection against a hazard is defective. If a single fault condition results unavoidably in another single fault condition,

216-415: A minimal layout, to ensure wide accessibility and outreach , such as on game consoles with limited web browsing capabilities. A highly fault-tolerant system might continue at the same level of performance even though one or more components have failed. For example, a building with a backup electrical generator will provide the same voltage to wall outlets even if the grid power fails. A system that

288-570: A Fault-Error-Chain is understood it is possible to construct means to break these chains and thereby increase the dependability of a system. Four means have been identified so far: Fault Prevention deals with preventing faults being introduced into a system. This can be accomplished by use of development methodologies and good implementation techniques. Fault Removal can be sub-divided into two sub-categories: Removal During Development and Removal During Use. Removal during development requires verification so that faults can be detected and removed before

360-624: A combination of public and private sector, and some are private sector only. About 90% of those who prepare IEC standards work in industry. IEC Member countries include: In 2001 and in response to calls from the WTO to open itself to more developing nations, the IEC launched the Affiliate Country Programme to encourage developing nations to become involved in the commission's work or to use its International Standards. Countries signing

432-477: A composite term called Dependability and Security. Practically, applying security measures to the appliances of a system generally improves the dependability by limiting the number of externally originated errors. Threats are things that can affect a system and cause a drop in Dependability. There are three main terms that must be clearly understood: It is important to note that Failures are recorded at

504-428: A degraded level. Dependability means are intended to reduce the number of failures made visible to the end users of a system. Based on how faults appear or persist, they are classified as: Some works on dependability use structured information systems , e.g. with SOA , to introduce the attribute survivability , thus taking into account the degraded services that an Information System sustains or resumes after

576-400: A failure (which is an observable deviation from the specified behavior at the system boundary). Once a fault is activated an error is created. An error may act in the same way as a fault in that it can create further error conditions, therefore an error may propagate multiple times within a system boundary without causing an observable failure. If an error propagates outside the system boundary

648-400: A failure is said to occur. A failure is basically the point at which it can be said that a service is failing to meet its specification. Since the output data from one service may be fed into another, a failure in one service may propagate into another service as a fault so a chain can be formed of the form: Fault leading to Error leading to Failure leading to Error, etc. Since the mechanism of

720-572: A flat piece of road on which to stop. Alternatively, on shallow gradients, the transmission can be shifted into Park, Reverse or First gear, and the transmission lock / engine compression used to hold it stationary, as there is no need for them to include the sophistication to first bring it to a halt. On motorcycles, a similar level of fail-safety is provided by simpler methods; first, the front and rear brake systems are entirely separate, regardless of their method of activation (that can be cable, rod or hydraulic), allowing one to fail entirely while leaving

792-404: A hardware level. The figure of merit is called availability and is expressed as a percentage. For example, a five nines system would statistically provide 99.999% availability. Fault-tolerant systems are typically based on the concept of redundancy. Research into the kinds of tolerances needed for critical systems involves a large amount of interdisciplinary work. The more complex the system,

SECTION 10

#1732780297036

864-422: A level of confidence, whilst Reliability can be measured as failures over time. Confidentiality , i.e. the absence of unauthorized disclosure of information is also used when addressing security. Security is a composite of Confidentiality , Integrity , and Availability . Security is sometimes classed as an attribute but the current view is to aggregate it together with dependability and treat Dependability as

936-435: A non-maskable failure. The flexibility of current frameworks encourage system architects to enable reconfiguration mechanisms that refocus the available, safe resources to support the most critical services rather than over-provisioning to build failure-proof system. With the generalisation of networked information systems, accessibility was introduced to give greater importance to users' experience. To take into account

1008-412: A number of penalties: increase in weight, size, power consumption, cost, as well as time to design, verify, and test. Therefore, a number of choices have to be examined to determine which components should be fault tolerant: An example of a component that passes all the tests is a car's occupant restraint system. While the primary occupant restraint system is not normally thought of, it is gravity . If

1080-634: A number of prominent international conferences, notably the International Conference on Dependable Systems and Networks , the International Symposium on Reliable Distributed Systems and the International Symposium on Software Reliability Engineering . Traditionally, dependability for a system incorporates availability , reliability , maintainability but since the 1980s, safety and security have been added to measures of dependability. Attributes are qualities of

1152-432: A pledge to participate in the work and to encourage the use of IEC Standards in national standards and regulations are granted access to a limited number of technical committee documents for the purposes of commenting. In addition, they can select a limited number of IEC Standards for their national standards' library. Countries participating in the Affiliate Country Programme are: Fault Tolerance Fault tolerance

1224-444: A system is put into production. Once systems have been put into production a system is needed to record failures and remove them via a maintenance cycle. Fault Forecasting predicts likely faults so that they can be removed or their effects can be circumvented. Fault Tolerance deals with putting mechanisms in place that will allow a system to still deliver the required service in the presence of faults, although that service may be at

1296-559: A system that experiences errors with some interruption in service or graceful degradation of performance is termed 'resilient'. In resilience, the system adapts to the error, maintaining service but acknowledging a certain impact on performance. Typically, fault tolerance describes computer systems , ensuring the overall system remains functional despite hardware or software issues. Non-computing examples include structures that retain their integrity despite damage from fatigue , corrosion or impact. The first known fault-tolerant computer

1368-476: A system. These can be assessed to determine its overall dependability using Qualitative or Quantitative measures. Avizienis et al. define the following Dependability Attributes: As these definitions suggested, only Availability and Reliability are quantifiable by direct measurements whilst others are more subjective. For instance Safety cannot be measured directly via metrics but is a subjective assessment that requires judgmental information to be applied to give

1440-812: A vast range of technologies from power generation, transmission and distribution to home appliances and office equipment, semiconductors, fibre optics, batteries, solar energy , nanotechnology , and marine energy, as well as many others. The IEC also manages four global conformity assessment systems that certify whether equipment, system or components conform to its international standards. All electrotechnologies are covered by IEC Standards, including energy production and distribution, electronics, magnetics and electromagnetics , electroacoustics , multimedia , telecommunications and medical technology , as well as associated general disciplines such as terminology and symbols, electromagnetic compatibility, measurement and performance, dependability, design and development, safety and

1512-409: A warning to the operator, and it is still the most common form of level one fault-tolerant design in use today. Voting was another initial method, as discussed above, with multiple redundant backups operating constantly and checking each other's results. For example, if four components reported an answer of 5 and one component reported an answer of 6, the other four would "vote" that the fifth component

SECTION 20

#1732780297036

1584-470: Is pair-and-spare . Two replicated elements operate in lockstep as a pair, with a voting circuit that detects any mismatch between their operations and outputs a signal indicating that there is an error. Another pair operates exactly the same way. A final circuit selects the output of the pair that does not proclaim that it is in error. Pair-and-spare requires four replicas rather than the three of TMR, but has been used commercially. Failure-oblivious computing

1656-403: Is a technique that enables computer programs to continue executing despite errors . The technique can be applied in different contexts. It can handle invalid memory reads by returning a manufactured value to the program, which in turn, makes use of the manufactured value and ignores the former memory value it tried to access, this is a great contrast to typical memory checkers , which inform

1728-409: Is a technique to avoid catastrophic failures in distributed systems. Redundancy is the provision of functional capabilities that would be unnecessary in a fault-free environment. This can consist of backup components that automatically "kick in" if one component fails. For example, large cargo trucks can lose a tire without any major consequences. They have many tires, and no one tire is critical (with

1800-754: Is also available as EN 60034. Standards developed jointly with ISO, such as ISO/IEC 26300 ( Open Document Format for Office Applications (OpenDocument) v1.0 ), ISO/IEC 27001 ( Information technology, Security techniques, Information security management systems, Requirements ), and ISO/IEC 17000 series, carry the acronym of both organizations. The use of the ISO/IEC prefix covers publications from ISO/IEC Joint Technical Committee 1 – Information Technology , as well as conformity assessment standards developed by ISO CASCO (Committee on conformity assessment) and IEC CAB (Conformity Assessment Board). Other standards developed in cooperation between IEC and ISO are assigned numbers in

1872-618: Is available to stream an online video, a lower-resolution version might be streamed in place of the high-resolution version. Progressive enhancement is another example, where web pages are available in a basic functional format for older, small-screen, or limited-capability web browsers, but in an enhanced version for browsers capable of handling additional technologies or that have a larger display. In fault-tolerant computer systems, programs that are considered robust are designed to continue operation despite an error, exception, or invalid input, instead of crashing completely. Software brittleness

1944-422: Is being used as a one-time backup for the footbrake, will not cause immediate danger if it is found to be nonfunctional at the moment of application. Therefore, no redundancy is built into it per se (and it typically uses a cheaper, lighter, but less hardwearing cable actuation system), and it can suffice, if this happens on a hill, to use the footbrake to momentarily hold the vehicle still, before driving off to find

2016-412: Is designed to fail safe , or fail-secure, or fail gracefully , whether it functions at a reduced level or fails completely, does so in a way that protects people, property, or data from injury, damage, intrusion, or disclosure. In computers, a program might fail-safe by executing a graceful exit (as opposed to an uncontrolled crash) to prevent data corruption after an error occurs. A similar distinction

2088-498: Is further classified into hardware, software and information redundancy, depending on the type of redundant resources added to the system. In time redundancy the computation or data transmission is repeated and the result is compared to a stored copy of the previous result. The current terminology for this kind of testing is referred to as 'In Service Fault Tolerance Testing or ISFTT for short. Fault-tolerant design's advantages are obvious, while many of its disadvantages are not: There

2160-495: Is in error when a two-to-one vote is observed. In this case, the voting circuit can output the correct result, and discard the erroneous version. After this, the internal state of the erroneous replication is assumed to be different from that of the other two, and the voting circuit can switch to a DMR mode. This model can be applied to any larger number of replications. Lockstep fault-tolerant machines are most easily made fully synchronous , with each gate of each replication making

2232-409: Is made between "failing well" and " failing badly ". A system designed to experience graceful degradation , or to fail soft (used in computing, similar to "fail safe" ) operates at a reduced level of performance after some component fails. For example, if grid power fails, a building may operate lighting at reduced levels or elevators at reduced speeds. In computing, if insufficient network bandwidth

Dependability - Misplaced Pages Continue

2304-456: Is made up of members, called national committees, and each NC represents its nation's electrotechnical interests in the IEC. This includes manufacturers, providers, distributors and vendors, consumers and users, all levels of governmental agencies, professional societies and trade associations as well as standards developers from national standards bodies. National committees are constituted in different ways. Some NCs are public sector only, some are

2376-653: Is published online as the Electropedia . The CISPR ( Comité International Spécial des Perturbations Radioélectriques ) – in English, the International Special Committee on Radio Interference – is one of the groups founded by the IEC. Currently, 89 countries are IEC members while another 85 participate in the Affiliate Country Programme, which is not a form of membership but is designed to help industrializing countries get involved with

2448-503: Is still working, as of early 2022. Hyper-dependable computers were pioneered mostly by aircraft manufacturers, nuclear power companies, and the railroad industry in the United States. These entities needed computers with massive amounts of uptime that would fail gracefully enough during a fault to allow continued operation, while relying on constant human monitoring of computer output to detect faults. Again, IBM developed

2520-421: Is the ability of a system to maintain proper operation despite failures or faults in one or more of its components. This capability is essential for high-availability , mission-critical , or even life-critical systems . Fault tolerance specifically refers to a system's capability to handle faults without any degradation or downtime. In the event of an error, end-users remain unaware of any issues. Conversely,

2592-508: Is the opposite of robustness. Resilient networks continue to transmit data despite the failure of some links or nodes. Resilient buildings and infrastructure are likewise expected to prevent complete failure in situations like earthquakes, floods, or collisions. A system with high failure transparency will alert users that a component failure has occurred, even if it continues to operate with full performance, so that failure can be repaired or imminent complete failure anticipated. Likewise,

2664-574: The American Institute of Electrical Engineers , and others, which began at the 1900 Paris International Electrical Congress, , with British engineer R. E. B. Crompton playing a key role. In 1906, Lord Kelvin was elected as the first President of the International Electrotechnical Commission. The IEC was instrumental in developing and distributing standards for units of measurement, particularly

2736-714: The gauss , hertz , and weber . It was also first to promote the Giorgi System of standards, later developed into the SI , or Système International d'unités (in English, the International System of Units). In 1938, it published a multilingual international vocabulary to unify terminology relating to electrical, electronic and related technologies. This effort continues, and the International Electrotechnical Vocabulary

2808-589: The mean time between failures should be long enough for the operators to have sufficient time to fix the broken devices ( mean time to repair ) before the backup also fails. It is helpful if the time between failures is as long as possible, but this is not specifically required in a fault-tolerant system. Fault tolerance is notably successful in computer applications. Tandem Computers built their entire business on such machines, which used single-point tolerance to create their NonStop systems with uptimes measured in years. Fail-safe architectures may encompass also

2880-483: The 1960s and 1970s, dependability came to be a measure of [x] as measures of reliability came to encompass additional measures like safety and integrity. In the early 1980s, Jean-Claude Laprie thus chose dependability as the term to encompass studies of fault tolerance and system reliability without the extension of meaning inherent in reliability . The field of dependability has evolved from these beginnings to be an internationally active field of research fostered by

2952-406: The 80000 series, such as IEC 82045–1. IEC Standards are also being adopted by other certifying bodies such as BSI (United Kingdom), CSA (Canada), UL & ANSI / INCITS (United States), SABS (South Africa), Standards Australia , SPC / GB (China) and DIN (Germany). IEC standards adopted by other certifying bodies may have some noted differences from the original IEC standard. The IEC

Dependability - Misplaced Pages Continue

3024-697: The IEC. Originally located in London , United Kingdom, the IEC moved to its current headquarters in Geneva , Switzerland in 1948. It has regional centres in Africa ( Nairobi , Kenya), Asia ( Singapore ), Oceania ( Sydney , Australia), Latin America ( São Paulo , Brazil) and North America ( Worcester, Massachusetts , United States). The work is done by some 10,000 electrical and electronics experts from industry, government, academia, test labs and others with an interest in

3096-421: The compiled program binary directly and does not need to recompile to program. It uses the just-in-time binary instrumentation framework Pin . It attaches to the application process when an error occurs, repairs the execution, tracks the repair effects as the execution continues, contains the repair effects within the application process, and detaches from the process after all repair effects are flushed from

3168-470: The computer software, for example by process replication . Data formats may also be designed to degrade gracefully. HTML for example, is designed to be forward compatible , allowing Web browsers to ignore new and unsupported HTML entities without causing the document to be unusable. Additionally, some sites, including popular platforms such as Twitter (until December 2020), provide an optional lightweight front end that does not rely on JavaScript and has

3240-399: The demands on it are in line with normal traffic flow. The cumulatively unlikely combination of total foot brake failure with the need for harsh braking in an emergency will likely result in a collision, but still one at lower speed than would otherwise have been the case. In comparison with the foot pedal activated service brake, the parking brake itself is a less critical item, and unless it

3312-426: The design of fault-tolerant computer systems for online transaction processing . Hardware fault tolerance sometimes requires that broken parts be taken out and replaced with new parts while the system is still operational (in computing known as hot swapping ). Such a system implemented with a single backup is known as single point tolerant and represents the vast majority of fault-tolerant systems. In such systems

3384-678: The environment. The first International Electrical Congress took place in 1881 at the International Exposition of Electricity , held in Paris. At that time the International System of Electrical and Magnetic Units was agreed to. The International Electrotechnical Commission held its inaugural meeting on 26 June 1906, following discussions among the British Institution of Electrical Engineers ,

3456-517: The exception of the front tires, which are used to steer, but generally carry less load, each and in total, than the other four to 16, so are less likely to fail). The idea of incorporating redundancy in order to improve the reliability of a system was pioneered by John von Neumann in the 1950s. Two kinds of redundancy are possible: space redundancy and time redundancy. Space redundancy provides additional components, functions, or data items that are unnecessary for fault-free operation. Space redundancy

3528-557: The field and organizes two workshops each year to disseminate the results. Dependability can be broken down into three elements: Some sources hold that word was coined in the nineteen-teens in Dodge Brothers automobile print advertising. But the word predates that period, with the Oxford English Dictionary finding its first use in 1901. As interest in fault tolerance and system reliability increased in

3600-408: The first computer of this kind for NASA for guidance of Saturn V rockets, but later on BNSF , Unisys , and General Electric built their own. In the 1970s, much work happened in the field. For instance, F14 CADC had built-in self-test and redundancy. In general, the early efforts at fault-tolerant designs were focused mainly on internal diagnosis, where a fault would indicate something

3672-458: The first fundamental characteristic of fault tolerance in three ways: All implementations of RAID , redundant array of independent disks , except RAID 0, are examples of a fault-tolerant storage device that uses data redundancy . A lockstep fault-tolerant machine uses replicated elements operating in parallel. At any time, all the replications of each element should be in the same state. The same inputs are provided to each replication , and

SECTION 50

#1732780297036

3744-620: The level of performance, the measurement of performability is defined as "quantifying how well the object system performs in the presence of faults over a specified period of time". More regionally focused conferences: International Electrotechnical Commission The International Electrotechnical Commission ( IEC ; French : Commission électrotechnique internationale ) is an international standards organization that prepares and publishes international standards for all electrical , electronic and related technologies – collectively known as " electrotechnology ". IEC standards cover

3816-469: The loss of either only reducing brake power by 50% and not causing as much dangerous brakeforce imbalance as a straight front-back or left-right split, and should the hydraulic circuit fail completely (a relatively very rare occurrence), there is a failsafe in the form of the cable-actuated parking brake that operates the otherwise relatively weak rear brakes, but can still bring the vehicle to a safe halt in conjunction with transmission/engine braking so long as

3888-451: The main components and they would add considerable weight. However, the similarly critical systems for actuating the brakes under driver control are inherently less robust, generally using a cable (can rust, stretch, jam, snap) or hydraulic fluid (can leak, boil and develop bubbles, absorb water and thus lose effectiveness). Thus in most modern cars the footbrake hydraulic brake circuit is diagonally divided to give two smaller points of failure,

3960-523: The more carefully all possible interactions have to be considered and prepared for. Considering the importance of high-value systems in transport, public utilities and the military, the field of topics that touch on research is very wide: it can include such obvious subjects as software modeling and reliability, or hardware design , to arcane elements such as stochastic models, graph theory , formal or exclusionary logic, parallel processing , remote data transmission , and more. Spare components address

4032-466: The other unaffected. Second, the rear brake is relatively strong compared to its automotive cousin, being a powerful disc on some sports models, even though the usual intent is for the front system to provide the vast majority of braking force; as the overall vehicle weight is more central, the rear tire is generally larger and has better traction, so that the rider can lean back to put more weight on it, therefore allowing more brake force to be applied before

4104-416: The process state. It does not interfere with the normal execution of the program and therefore incurs negligible overhead. For 17 of 18 systematically collected real world null-dereference and divide-by-zero errors, a prototype implementation enables the application to continue to execute to provide acceptable output and service to its users on the error-triggering inputs. The circuit breaker design pattern

4176-470: The program of the error or abort the program. The approach has performance costs: because the technique rewrites code to insert dynamic checks for address validity, execution time will increase by 80% to 500%. Recovery shepherding is a lightweight technique to enable software programs to recover from otherwise fatal errors such as null pointer dereference and divide by zero. Comparing to the failure oblivious computing technique, recovery shepherding works on

4248-505: The range 60000–79999 and their titles take a form such as IEC 60417: Graphical symbols for use on equipment . Following the Dresden Agreement with CENELEC the numbers of older IEC standards were converted in 1997 by adding 60000, for example IEC 27 became IEC 60027. Standards of the 60000 series are also found preceded by EN to indicate that the IEC standard is also adopted by CENELEC as a European standard; for example IEC 60034

4320-399: The rest of the machine, like a lot of low-priced bikes after their first few years of use, is on the point of collapse from neglected maintenance. The basic characteristics of fault tolerance require: In addition, fault-tolerant systems are characterized in terms of both planned service outages and unplanned service outages. These are usually measured at the application level and not just at

4392-423: The same outputs are expected. The outputs of the replications are compared using a voting circuit. A machine with two replications of each element is termed dual modular redundant (DMR). The voting circuit can then only detect a mismatch and recovery relies on other methods. A machine with three replications of each element is termed triple modular redundant (TMR). The voting circuit can determine which replication

SECTION 60

#1732780297036

4464-466: The same state transition on the same edge of the clock, and the clocks to the replications being exactly in phase. However, it is possible to build lockstep systems without this requirement. Bringing the replications into synchrony requires making their internal stored states the same. They can be started from a fixed initial state, such as the reset state. Alternatively, the internal state of one replica can be copied to another replica. One variant of DMR

4536-741: The subject. IEC Standards are often adopted as national standards by its members. The IEC cooperates closely with the International Organization for Standardization (ISO) and the International Telecommunication Union (ITU) . In addition, it works with several major standards development organizations, including the IEEE with which it signed a cooperation agreement in 2002, which was amended in 2008 to include joint development work. IEC Standards that are not jointly developed with ISO have numbers in

4608-411: The system boundary. They are basically Errors that have propagated to the system boundary and have become observable. Faults, Errors and Failures operate according to a mechanism. This mechanism is sometimes known as a Fault-Error-Failure chain. As a general rule a fault, when activated, can lead to an error (which is an invalid state) and the invalid state generated by an error may lead to another error or

4680-617: The third test is passed. Therefore, adding seat belts to all vehicles is an excellent idea. Other "supplemental restraint systems", such as airbags , are more expensive and so pass that test by a smaller margin. Another excellent and long-term example of this principle being put into practice is the braking system: whilst the actual brake mechanisms are critical, they are not particularly prone to sudden (rather than progressive) failure, and are in any case necessarily duplicated to allow even and balanced application of brake force to all wheels. It would also be prohibitively costly to further double-up

4752-446: The two failures are considered one single fault condition. A source offers the following example: A single-fault condition is a condition when a single means for protection against hazard in equipment is defective or a single external abnormal condition is present, e.g. short circuit between the live parts and the applied part. Providing fault-tolerant design for every component is normally not an option. Associated redundancy brings

4824-453: The vehicle rolls over or undergoes severe g-forces, then this primary method of occupant restraint may fail. Restraining the occupants during such an accident is absolutely critical to safety, so the first test is passed. Accidents causing occupant ejection were quite common before seat belts , so the second test is passed. The cost of a redundant restraint method like seat belts is quite low, both economically and in terms of weight and space, so

4896-409: The wheel locks. On cheaper, slower utility-class machines, even if the front wheel should use a hydraulic disc for extra brake force and easier packaging, the rear will usually be a primitive, somewhat inefficient, but exceptionally robust rod-actuated drum, thanks to the ease of connecting the footpedal to the wheel in this way and, more importantly, the near impossibility of catastrophic failure even if

4968-497: Was SAPO , built in 1951 in Czechoslovakia by Antonín Svoboda . Its basic design was magnetic drums connected via relays, with a voting method of memory error detection ( triple modular redundancy ). Several other machines were developed along this line, mostly for military use. Eventually, they separated into three distinct categories: Most of the development in the so-called LLNM (Long Life, No Maintenance) computing

5040-654: Was done by NASA during the 1960s, in preparation for Project Apollo and other research aspects. NASA's first machine went into a space observatory , and their second attempt, the JSTAR computer, was used in Voyager . This computer had a backup of memory arrays to use memory recovery methods and thus it was called the JPL Self-Testing-And-Repairing computer. It could detect its own errors and fix them or bring up redundant modules as needed. The computer

5112-416: Was failing and a worker could replace it. SAPO, for instance, had a method by which faulty memory drums would emit a noise before failure. Later efforts showed that to be fully effective, the system had to be self-repairing and diagnosing – isolating a fault and then implementing a redundant backup while alerting a need for repair. This is known as N-model redundancy, where faults cause automatic fail-safes and

5184-410: Was faulty and have it taken out of service. This is called M out of N majority voting. Historically, the trend has been to move away from N-model and toward M out of N, as the complexity of systems and the difficulty of ensuring the transitive state from fault-negative to fault-positive did not disrupt operations. Tandem Computers , in 1976 and Stratus were among the first companies specializing in

#35964