2000 - Draper Laboratory

Table 4. Comparison of single-channel bus and ring topologies.Consequence of failure of a terminal to transmit Network disabled Loss of use of one terminal(or loss of power to the terminal)Uncontrolled broadcasts by a terminal (babbling) Network disabled Network disabledFailure of data path between terminals (opened or shorted) Network disabled All or part of the network disabledWorst-case number of transmissions to pass one message All terminals on the ring must transmit One terminal transmits(requires power)Number of optical or wire connections to each terminal Two optical fibers or wire pairs One wire pair connected to each terminalRing #1BypassBypassBypassBypassBypassBypassBypassDetails of Bypass Switch OperationNormalRing #2Figure 4. Dual counter-rotating ring network topology.the other ring to reach the destination terminal. The dual ringtherefore uses "active" reconfiguration to achieve fault-tolerance.If a single computer is controlling the terminal, the operationof the network is dependent on that computer, both tocorrectly reconfigure the network and to not malfunctionitself. As an example of a computer malfunction, the dual networkwould be disabled if the terminal were to transmit at thewrong time ("babble") on both rings.Similarly for the single-channel bus topology, allowing failureof the bus data path to interrupt all communications is unacceptable.Adding a second redundant bus can correct theproblem, but also requires "active" reconfiguration to determinewhen the backup bus should be used. So as for the dualring, if a single computer controls both terminals, both redundantbuses may be corrupted by a faulty computer, disablingthe entire network.As previously introduced, applications that require absolutedependability make use of TMR. Such systems have been constructedusing triple data buses for many years, e.g., the U.S.Space Shuttle and all fly-by-wire aircraft flight controls. Theuse of TMR with buses is illustrated in Figure 5.Note in Figure 5 that each bus terminal contains its own computerand that the system has been carefully segmented intoindependent channels. On the actuator side of the network, amajority voting device has been used to allow the actuator torespond to only a two-out-of-three consensus of bus commandmessages. Although implementation of the votingdevice will not be discussed, it can be constructed as a "passive"device that simply responds to the majority and does nothave single points of failure.Table 5 makes a summarized comparison of the single, dual,and TMR options. Single failures that lead to network failurehave been highlighted. Only TMR resists all single failures.30Fault-Tolerant Input/Output (I/O) Networks Applied to Ship Control