Question bank — Fault tolerance — fail-safe vs fail-operational

False — "safe" is contextual. In an aircraft at cruise, shutting down (the fail-safe move) is the dangerous option; there loss of function is worse than degraded function, so fail-operational is the safer design.

False — it needs one for the case where redundancy is finally exhausted. Hybrid designs (like the insulin pump) stay operational through transient faults, then fall back to a fail-safe shutdown when a fault persists.

False — TMR gives $\text{MTTF}=\frac{5}{6\lambda }$, which is lower than a single unit's $\frac{1}{\lambda }$. TMR wins on early-life reliability, not on long-run average lifetime.

False — $\beta$ does not change the total failure rate $\lambda$ at all; it only changes which kind of failure occurs, converting dangerous failures into detected safe ones.

False — identical channels share every common-mode failure (same software bug, same power rail). Against a design bug, three identical units are exactly as vulnerable as one.

False — detection is not continuation. A watchdog typically forces a reset or a safe state; that is a fail-safe reaction unless a redundant unit keeps the function alive.

False — availability $A$ measures being up and operational, not being correct. A system can be highly available while producing subtly wrong outputs; that's why we track dangerous-failure rate separately.

False — passive-safe reaches safety by doing nothing (power down, disconnect, spring pulls to REST); active-safe must keep doing something (hold the brakes clamped). Active-safe needs a working actuator, so it is harder to guarantee.

The reliance on software commanding the brake is the flaw. Truly fail-safe means the brake engages on loss of power/signal without software acting — a spring-loaded, energize-to-release brake. If the CPU that must "command" is itself dead, nothing engages.

The gain is far larger than 99%. Dangerous rate is $(1-\beta )\lambda$, so $\beta =0.99$ divides the dangerous rate by 100, giving roughly a 100× (two orders of magnitude) improvement in Mean Time To Dangerous Failure, not 99%.

TMR tolerates only one failure. With a majority voter, two failed units outvote the one good one, so the system fails on the second fault. Three units buy single-fault tolerance, not double.

Voting protects against independent faults in identical software. A bug in the shared voting/software logic is a common-mode failure present in all three; majority voting cannot outvote a defect they all share. That is why dissimilar (diverse) backup exists.

Wrong per the parent note — Direct Law is still software-driven fly-by-wire (stick maps directly to surfaces, minus envelope protection). The only mechanical backup is rudder + trimmable stabilizer for steadying, not full manual flight.

It is a hybrid. It stays operational only for transient faults via cross-checking processors; for persistent faults it deliberately becomes fail-safe by stopping delivery and alarming, because a wrong dose can be fatal.

Backwards. The safe default is RED; if initialization or a fault leaves the variable untouched, it must land on the harmless state. Defaulting to GREEN means an uninitialized or stuck system shows "go" — the dangerous outcome.

Because a detected failure can trigger the safe state, so it stops being dangerous. Raising $\beta$ shifts probability mass from the $(1-\beta )\lambda$ dangerous stream to the $\beta \lambda$ safe stream, shrinking dangerous rate and multiplying MTTDf.

They pull opposite ways: fail-safe wants to stop on any doubt, fail-operational wants to keep going. You cannot simultaneously stop and continue, so real systems pick a strategy per function or stage a hybrid (operate a while, then fall to safe).

To continue a function after a unit dies, you need another unit ready to carry it — that is redundancy. To merely stop safely, a single passive mechanism (a spring, a de-energizing relay) suffices; nothing has to keep the function alive.

Identical copies share common-mode failures — one design bug or one shared power fault takes them all. Diverse implementations are unlikely to fail from the same cause, so they cover the failure class that pure replication cannot.

Early on, unit failures are rare and independent, so the voter almost always has a healthy majority — big reliability boost. As time grows, the probability of a second failure climbs and eventually the redundant system is worse than betting on one long-lived unit (hence the lower MTTF).

MTTF is the area under the reliability curve, ${\int }_0^{\infty }{R}_{\text{sys}}(t)dt$, with $R_{\text{sys}}=3e^{-2\lambda t}-2e^{-3\lambda t}$ (probability that at least two units still work). Integrating term by term gives $\frac{3}{2\lambda }-\frac{2}{3\lambda }=\frac{9-4}{6\lambda }=\frac{5}{6\lambda }$ — the two-failure "wait" contributes less than the single unit's $\frac{1}{\lambda }$, which is why TMR's average life is shorter.

Availability answers "is it running?"; dangerous-failure rate answers "when it acts, could it act harmfully?" A system can score high on one and badly on the other, so a single number hides the failure mode that actually kills people.

The specification demands reaching the safe state within the deadline with probability $\ge 1-ϵ$; the boundary instant $t_f+\Delta t_{max}$ must be included as "in time." Any design that only usually makes it, or slips past $\Delta t_{max}$, violates the safety claim.

Redundancy is exhausted, so it can no longer continue safely by voting. A well-designed system detects this and falls back to a defined safe state (or best-effort degraded mode); an ill-designed one silently produces unchecked, possibly dangerous, output.

In the model ${\lambda }_d=(1-\beta )\lambda =0$, so MTTDf $=1/{\lambda }_d\to \infty$ — dangerously optimistic. In reality $\beta =1$ is unachievable; some failure modes evade detection or the detector itself fails, so true dangerous rate is small but never exactly zero.

DMR can detect the disagreement but cannot decide which channel is faulty — there is no majority to break the tie. The safe response is usually to declare a fault and go to a safe state, which is why DMR alone is fail-safe, not fail-operational.

It has no healthy backup to switch to yet, so during the vulnerable window it must either hold outputs inert or default to the safe state until all channels are confirmed live — treating startup as a temporarily non-operational phase.

Optimistic — the binomial/TMR formulas assume independent failures. Any shared cause makes real simultaneous failures more likely than the maths predicts, so the true reliability is worse than the number on paper.

No — perfect safety would require never acting when uncertain (favouring shutdown), while $A=1$ requires never being down. Real design trades one against the other; the "right" balance depends on whether lost function or wrong function is the greater harm.