The TTA's Approach to Resilience after Transient Upsets

Abstract. The Time-Triggered Architecture, as architecture for safety-critical realtime applications, incorporates fault-tolerance mechanisms to ensure correct system operation despite failures. The primary fault hypothesis of the TTA claims to tolerate either the arbitrary failure of any one of its nodes or the passively arbitrary failure of any one of its communication channels. To cover these failure modes, active redundancy techniques are used, which basically means that nodes and channels are physically replicated. The primary fault hypothesis, is, however, not strong enough for certain applications that have to tolerate transient upsets of multiple, possibly all, components in the system. Such a transient upset of the system may break up the synchrony of the nodes and leave disjoined sets of nodes synchronized to each other while the overall synchronization is lost. Although the TTA provides a clique avoidance algorithm that is able to correct a wide class of such multiple transi...

• Type: Journal
• Year: 2006
• Where: RTS
• Authors: Wilfried Steiner, Michael Paulitsch, Hermann Kopetz
• Keywords: Arbitrary Failure, Primary Fault Hypothesis, RTS 2006, Transient Upset