Fault-Tolerant Systems 2nd Edition By Israel Koren, C. Mani Krishna Chapter 2-11 SOLUTIONS MANUAL

Solutions to Chapter 2 Exercises 1. The lifetime (measured in years) of a processor is exponentially distributed, with a mean lifetime of 2 years. You are told that a processor failed sometime in the interval [4, 8] years. Given this information, what is the conditional probability that it failed before it was 5 years old?

Solution: Denote the lifetime of the processor by T . Since E(T ) = 2, λ = 0.5 and the distribution function of T is F(t) = 1 − e−0.5t . Using the conditional probability formula: Prob{T < 5 | 4 ≤ T ≤ 8} = = = =

Prob{[T < 5] ∩ [4 ≤ T ≤ 8]} Prob{4 ≤ T ≤ 8} Prob{4 ≤ T < 5} Prob{4 ≤ T ≤ 8} F(5) − F(4) F(8) − F(4) e−2 − e−2.5 = 0.455 e−2 − e−4

2. The lifetime of a processor (measured in years) follows the Weibull distribution, with parameters λ = 0.5 and β = 0.6. (a) What is the probability that it will fail in its first year of operation? (b) Suppose it is still functional after t = 6 years of operation. What is the conditional probability that it will fail in the next year? (c) Repeat parts (a) and (b) for β = 2.

1

2

Solutions to Chapter 2 Exercises (d) Repeat parts (a) and (b) for β = 1.

Solution: (a) Denote the lifetime of the processor by T . The distribution function of T is F(t) = 0.6 1 − e−0.5t . The probability that T is no greater than one year is F(1) = 0.393. (b) We use the conditional probability formula: Prob{6 < T ≤ 7 | T > 6} = =

Prob{6 < T ≤ 7} Prob{T > 6} F(7) − F(6) = 0.045 1 − F(6)

3. To get a feel for the failure rates associated with the Weibull distribution, plot them for the following parameter values as a function of the time, t: (a) Fix λ = 1 and plot the failure rate curves for β = 0.5, 1.0, 1.5. (b) Fix β = 1.5 and plot the failure rate curves for λ = 1, 2, 5.

Solution: The failure rate for the Weibull distribution is

2.5

2

2

=1.5 =1; β

1.5

λ

λ=1; β=1.0

1

λ=1; β=0.5

0.5 0

5 =1. β ; =2

λ=5; β=1.5

2.5

Failure Rate

Failure Rate

λ(t) = λβtβ−1

1.5

λ

=1.5

λ=1; β

1 0.5

0

0.2

0.4

t

0.6

0.8

1

0

0

0.2

0.4

0.6

0.8

1

t

Figure 2.1: The failure rate for the Weibull distribution.

4. Write the expression for the reliability Rsystem (t) of the series/parallel system shown in Figure 2.2, assuming that each of the five modules has a reliability of R(t).

Solution: The system can be decomposed into a series system consisting of one unit with the leftmost Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

3

Solutions to Chapter 2 Exercises

Figure 2.2: A 5-module series-parallel system.

4 blocks and the second unit with the rightmost block. If the reliability of the leftmost 4 blocks is RA (t), the system reliability is RA (t)R(t).

Now, we calculate RA (t). This subsystem consists of a parallel arrangement of one unit consisting of the bottom block and another consisting of the other 3 blocks. If RB (t) is the reliability of the top 3 blocks, RA (t) = 1 − (1 − RB (t))(1 − R(t)).

Next, we calculate RB (t): this subsystem consists of a series arrangement of one block with another consisting of two blocks in parallel. Hence, we have RB (t) = R(t)(1 − (1 − R(t))2 ) Substituting all intermediate results yields Rsystem = R5 (t) − 3R4 (t) + 2R3 (t) + R2 (t) 5. The lifetime of each of the seven blocks in Figure 2.3 is exponentially distributed with parameter λ. Derive an expression for the reliability function of the system, Rsystem (t), and plot it over the range t = [0, 100] for λ = 0.02.

Figure 2.3: A 7-module series-parallel system.

Solution: As before, we decompose this structure into two substructures connected in series. The left substructure is four blocks in parallel; the right substructure consists of a series arrangement of two blocks in parallel with one block.

The reliability of this system is thus given by: h ih i 1 − (1 − R(t))4 1 − (1 − R(t))(1 − R2 (t)) = R7 (t)−5R6 (t)+9R5 (t)−6R4 (t)−2R3 (t)+4R2 (t) Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

4

Solutions to Chapter 2 Exercises where R(t) = e−λt .

6. Consider a triplex that produces a one-bit output. Failures that cause the output of a processor to be permanently stuck at 0 or stuck at 1 occur at constant rates λ0 and λ1 , respectively. The voter never fails. At time t, you carry out a calculation whose correct output is 0. What is the probability that the triplex will produce an incorrect result?

(Assume that stuck-at faults are the only ones that a processor can suffer from, and that these are permanent faults; once a processor has its output stuck at some logic value, it remains stuck at that value forever).

Solution: The result will be incorrect if at least two of the three nodes produce a 1. The probability that a node is stuck by time t at either 0 or 1 is 1 − e−(λ0 +λ1 )t , and the probability that it is stuck at 1 (and not at 0) is q(t) =

λ1 1 − e−(λ0 +λ1 )t λ0 + λ1

and the answer is q3 (t) + 3q2 (t)(1 − q(t)) 7. Write the expression for the reliability of a 5MR system and calculate its MTTF. Assume that failures occur as a Poisson process with rate λ per node, that failures are independent and permanent, and that the voter is failure-free.

Solution: Denote by r(t) = e−λt the reliability of an individual node. The reliability of the 5MR system is R5MR (t) =

5 X 5 i=3

i

ri (t)(1 − r(t))5−i

= 10r3 (t) − 15r4 (t) + 6r5 (t) = 10e−3λt − 15e−4λt + 6e−5λt and the MTTF is

Z∞

1 R5MR (t)dt = λ t=0

10 15 6 − + 3 4 5

=

47 60λ

8. Consider an NMR system that produces an eight-bit output. N = 2m + 1 for some m.

Each processor fails at a constant rate λ and the failures are permanent. A failed processor produces any of the 28 possible outputs with equal probability. A majority voter is used to produce the overall output, and the voter is assumed never to fail. What is the probability that, at time t, a majority of the processors produce the same incorrect output after executing some program?

Solution: The probability that an individual processor is faulty at time t is q(t) = 1 − e−λt .

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

5

Solutions to Chapter 2 Exercises The probability that n1 out of the N processors are faulty is

N n1

qn1 (t)(1 − q(t))N−n1

The probability that exactly n2 out of the n1 faulty processors produces the output ω is

n1 n2

2−8n2 (1 − 2−8 )n1 −n2

The probability that a majority of the processors produces ω is N X

n1 X n1 N 2−8n2 (1 − 2−8 )n1 −n2 qn1 (t)(1 − q(t))N−n1 n2 n1

n1 =m+1 n2 =m+1

The number of incorrect outputs is 28 − 1 = 255. Hence, the answer is 255

N X

n1 X N n1 qn1 (t)(1 − q(t))N−n1 2−8n2 (1 − 2−8 )n1 −n2 n1 n2

n1 =m+1 n2 =m+1

9. Design a majority voter circuit out of two- and three-input logic gates. Assume that you are voting on one-bit inputs. (visit Library Genesis for more solution manuals: libgen.is) Solution: Let the inputs be a, b, c. Then, it is easy to check that the logic expression for the voter output is abc + abc + abc + abc, which simplifies to ab + bc + ac. The circuit is shown in Figure 2.4. b c

U X

b c

a V

W

Figure 2.4: Voter circuit diagram.

10. Derive an expression for the reliability of the voter you designed in the previous question.

Assume that, for a given time t, the output of each gate is stuck-at-0 or stuck-at-1 with probability P0 and P1 , respectively (and is fault-free with probability 1 − P0 − P1 ). What is the probability that the output of your voter circuit is stuck-at-0 (stuck-at-1) given that the 3 inputs to the voter are fault-free and do change between 000 and 111?

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

6

Solutions to Chapter 2 Exercises Solution: The voter will be faulty if any of the gates are malfunctioning; since we can implement it using 4 gates, the reliability is R = (1 − p0 − p1 )4 . Note that 1 − R is NOT the probability that the voter output will be wrong every time.

The probability that the output of the voter will be stuck-at-1 is Prob{X is stuck − at − 1 | the inputs are correct} = Prob{OR gate stuck − at − 1} + Prob{OR gate is fault − free} Prob{At least 1 of the AND gates is stuck − at − 1} = p1 + (1 − p0 − p1 )[1 − (1 − p1 )3 ].

The probability that the output of the voter will be stuck-at-0 is Prob{X is stuck − at − 0 | the inputs are correct} = Prob{OR gate stuck − at − 0} + Prob{OR gate is fault − free} Prob{All AND gates are stuck − at − 0} = p0 + (1 − p0 − p1 )p30 .

11. Show that the MTTF of a parallel system of N modules, each of which suffers permanent P 1 failures at a rate λ, is MTTFp = N k=1 kλ .

Solution: Let the state of the system be the number of modules that are still functional and let Tk be P 1 the time spent in state k. Then, E[Tk ] = kλ . Since MTTF = N k=1 E[Tk ], the result follows immediately.

Another way to prove it is as follows: The reliability of the parallel system is R(t) = 1 − (1 − e−λt )N Denoting x = (1 − e−λt ) the above expression can be rewritten as

R(t) = (1 − x)(1 +

N−1 X

xk )

k=1

The MTTF is calculated from 1 MTTF = λ

Z 1 N−1 X 0 k=0

R∞ 0

R(t)dt. Since dx = λe−λt dt, we obtain

1 xk dx = λ

" N−1 #1 X xk+1 k=0

k+1

0

1X 1 1X1 = = λ k+1 λ k N−1

N

k=0

k=1

12. Consider a system consisting of 2 subsystems in series. For improved reliability, you can build subsystem i as a parallel system with ki units, for i = 1, 2. Suppose permanent failures occur at a constant rate λ per unit. (a) Derive an expression for the reliability of this system. (b) Obtain an expression for the MTTF of this system with k1 = 2 and k2 = 3.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

7

Solutions to Chapter 2 Exercises

Solution: (k) (a) The reliability of a parallel system with k units is Rp (t) = 1 − (1 − e−λt )k . Hence, the reliability of the series system is given by (k )

(k )

Rseries = Rp 1 (t)Rp 2 (t) (b) Z∞ MTTF =

Rseries (t)dt = t=0

Z∞ t=0

21 6e−2λt − 9e−3λt + 5e−4λt − e−5λt dt = 20λ

13. List the conditions under which the processor/memory TMR configuration shown in Figure 2.5 will fail, and compare them to a straightforward TMR configuration with three units, in which each unit consists of a processor and a memory. Denote by Rp , Rm and Rv the reliability of a processor, a memory and a voter, respectively, and write expressions for the reliability of the two TMR configurations.

Processor

V

Memory

Processor

V

Memory

Processor

V

Memory

Figure 2.5: Triplicated voters in a processor/memory TMR. Solution: In the first configuration, the system will work correctly so long as at least two processors, at least two memories, and at least two voters are good. Thus, the overall reliability of the first system is h ih ih i R3p + 3R2p (1 − Rp ) R3m + 3R2m (1 − Rm ) R3v + 3R2v (1 − Rv ) In contrast, suppose we vote on the processor-memory pairs as in the second configuration.

The reliability of each processor-memory pair is Rc = Rp Rm . The reliability of the second system is thus equal to h i Rv R3c + 3R2c (1 − Rc ) 14. Write expressions for the upper and lower bounds and the exact reliability of the non series/parallel system shown in Figure 2.6 (denote by Ri (t) the reliability of module i).

Assume that D is a bi-directional unit.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

8

Solutions to Chapter 2 Exercises A

E D

B

C

F

Figure 2.6: A 6-module non-series-parallel system.

Solution: The paths are: AE, BE, CF, ADF, BDF and CDE. The upper bound is Rsystem ≤ 1 − (1 − RA RE )(1 − RB RE )(1 − RC RF )(1 − RA RD RF )(1 − RB RD RF )(1 − RC RD RE ) The minimal cut sets are: EF, ABC, CDE and ABDF. The lower bound is Rsystem ≥ [1 − (1 − RE )(1 − RF )][1 − (1 − RA )(1 − RB )(1 − RC )] [1 − (1 − RC )(1 − RD )(1 − RE )][1 − (1 − RA )(1 − RB )(1 − RD )(1 − RF )] To calculate the exact reliability we expand about module D. If D is faulty A and B are connected in parallel, and then in series with E and all these are in parallel to the series connection of C and F yielding Rsys.|D is faulty = 1 − [1 − (RA + RB − RA RB )RE ](1 − RC RF ) If D is fault-free, A, B and C are connected in parallel, and then in series with the parallel connection of E and F yielding Rsys.|D is fault−free = [1 − (1 − RA )(1 − RB )(1 − RC )][RE + RF − RE RF ] Finally, Rsystem = RD Rsys.|D is fault−free + (1 − RD )Rsys.|D is faulty .

15. The system shown in Figure 2.7 consists of a TMR core with a single spare a which can serve as a spare only for module 1. Assume that modules 1 and a are active. When either of the two modules 1 or a fails, the failure is detected by the perfect comparator C, and the single operational module is used to provide an input to the voter. (a) Assuming that the voter is perfect as well, which one of the following expressions for the system reliability is correct (where each module has a reliability R and the modules are independent).

(1) Rsystem = R4 + 4R3 (1 − R) + 3R2 (1 − R)2 (2) Rsystem = R4 + 4R3 (1 − R) + 4R2 (1 − R)2 (3) Rsystem = R4 + 4R3 (1 − R) + 5R2 (1 − R)2 (4) Rsystem = R4 + 4R3 (1 − R) + 6R2 (1 − R)2

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

9

Solutions to Chapter 2 Exercises

a 1

C

2 3 Figure 2.7: A TMR with a spare.

(b) Write an expression for the reliability of the system if instead of a perfect comparator for modules 1 and a there is a coverage factor c (c is the probability that a failure in one module is detected, the faulty module is correctly identified and the operational module is successfully connected to the voter which is still perfect).

Solution: (a) Equation (3) is correct. The simple way of doing this is to enumerate all possible combinations under which the overall system can be reliable and add up the probabilities of these mutually exclusive events. Another approach is to condition on whether the duplex (a and 1) is up or not: we demonstrate this approach in (b) below. (b) The reliability of the duplex consisting of a and 1 is Rd = R2 +2cR(1−R). Conditioning on the state of the duplex, Rsystem = Prob{System up | duplex up} Prob{duplex up} + Prob{System up | duplex down} Prob{duplex down} = [1 − (1 − R)2 ]Rd + R2 (1 − Rd )

16. A duplex system consists of two active units and a comparator. Assume that each unit has a failure rate of λ and a repair rate of µ. The outputs of the two active units are compared and when a mismatch is detected, a procedure to locate the faulty unit is performed. The probability that upon a failure, the faulty unit is correctly identified and the fault-free unit (and consequently, the system) continues to run properly, is the coverage factor c.

Note that when a coverage failure occurs, the entire system fails and both units have to be repaired (at a rate µ each). When the repair of one unit is complete, the system becomes operational and the repair of the second unit continues, allowing the system to return to its original state. (a) Show the Markov model for this duplex system. (b) Derive an expression for the long-term availability of the system assuming that µ = 2λ.

Solution: The Markov model is shown in Figure 2.8.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

10

Solutions to Chapter 2 Exercises

λ

2λ c 2

1

µ

2µ

F

2λ (1−c) Figure 2.8: Markov model for duplex system.

For the long-term availability, we write the steady-state balance equations.

2λP2 = µP1 2λ(1 − c)P2 + λP1 = 2µPF P2 + P1 + PF = 1 For convenience, denote ρ = λ/µ. The solution to the above equations is P2 = P1 =

1 1 + ρ(3 − c) + ρ2 2ρ 1 + ρ(3 − c) + ρ2

and the availability is P1 + P2 =

1 + 2ρ 1 + ρ(3 − c) + ρ2

If λ = 2µ, ρ = 0.5, and the availability is 2 8 = 2.75 − 0.5c 11 − 2c 17. (a) Your manager in the Reliability and Quality Department asked you to verify her calculation of the reliability of a certain system. The equation that she derived is Rsystem = RC [1 − (1 − RA )(1 − RB )] [1 − (1 − RD )(1 − RE )] + (1 − RC ) [1 − (1 − RA RD )(1 − RB RE )] However, she lost the system diagram. Can you draw the diagram based on the expression above? (b) Write expressions for the upper and lower bounds on the reliability of the system and calculate these values and the exact reliability for the case RA = RB = RC = RD = RE = R = 0.9.

Solution: The diagram is shown in Figure 2.9.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

11

Solutions to Chapter 2 Exercises D C

A

B

E

Figure 2.9: The system diagram for Question 17.

The paths are: AD, BE, ACE and BCD. The upper bound is therefore: Rsystem ≤ 1 − (1 − RA RD )(1 − RB RE )(1 − RA RC RE )(1 − RB RC RD ) = 1 − (1 − R2 )2 (1 − R3 )2 This upper bound is equal to 0.99735 for R = 0.9.

The cut sets are: AB, DE, ACE and BCD. The lower bound is: Rsystem ≥ [1 − (1 − RA )(1 − RB )][1 − (1 − RD )(1 − RE )][1 − (1 − RA )(1 − RC )(1 − RE )] ×[1 − (1 − RB )(1 − RC )(1 − RD )] = [1 − (1 − R)2 ]2 [1 − (1 − R)3 ]2 This lower bound is equal to 0.9781 for R = 0.9.

The value of the exact reliability for the case of RA = RB = RC = RD = RE = R = 0.9 is Rsystem = R(1 − (1 − R)2 )2 + (1 − R)[1 − (1 − R2 )2 ] = 0.97848.

18. A duplex system consists of a switching circuit and two computing units: an active unit with a failure rate of λ1 and a standby idle unit which has a lower failure rate λ2 < λ1 while idle. The switching circuit frequently tests the active unit and when a fault is detected, the faulty unit is switched out, the second unit is switched in and becomes fully operational with a failure rate λ1 . The probability that upon a failure, the fault is correctly detected and the fault-free idle unit resumes the computation successfully, is denoted by c (the coverage factor). Note that when a coverage failure occurs, the entire system fails. (a) Show the Markov model for this duplex system (hint: three states are sufficient). (b) Write the differential equations for the Markov model. Derive an expression for the reliability of the system.

Solution: The states are 1, 2, F: 1, 2 refer to the number of functional processors; F is the systemfailure state. In state 2, both processors are up and the overall failure rate is λ1 + λ2 . In state 1, only the active processor is up and the failure rate is λ1 . From state 2, we can go directly to state 0 if there is a coverage failure. Based on these observations, we can draw the Markov chain shown in Figure 2.10.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

12

Solutions to Chapter 2 Exercises

2

c λ 1+λ 2

1

λ1

F

(1−c)λ 1 Figure 2.10: Markov chain for Question 18.

The differential equations can be written from inspection of the Markov chain. dP2 (t) dt dP1 (t) dt dPF (t) dt

= −(λ1 + λ2 )P2 (t) = (cλ1 + λ2 )P2 (t) − λ1 P1 (t) = (1 − c)λ1 P2 (t) + λ1 P1 (t)

We also have PF (t) = 1 − P1 (t) − P2 (t).

Starting with the initial condition P2 (0) = 1, we obtain P2 (t) = e−(λ1 +λ2 )t . Plugging this expression into the differential equation for P1 (t), we have dP1 (t) + λ1 P1 (t) = (cλ1 + λ2 )e−(λ1 +λ2 )t dt Together with the initial condition P1 (0) = 0, we obtain

cλ1 + λ2 −λ1 t P1 (t) = e − e−(λ1 +λ2 )t λ2 The reliability is given by R(t) = P1 (t) + P2 (t).

19. You have a processor susceptible only to transient failures which occur at a rate of λ per second. The lifetime of a transient fault (measured in seconds) is exponentially distributed with parameter µ. Your fault-tolerance mechanism consists of running each task twice on this processor, with the second execution starting τ seconds after the first. The executions take s seconds each (τ > s). Find the probability that the output of the first execution is correct, but that of the second execution is incorrect.

Solution: For convenience, denote the two executions by E1 , E2 , respectively.

Prob{E1 right and E2 wrong} = Prob{E2 wrong | E1 right}Prob{E1 right]} To calculate these probabilities, observe that the state of the processor over time t is a Markov chain with two states - up and down (or 1 and 0, respectively), with transition Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

13

Solutions to Chapter 2 Exercises

rate λ from state 1 to state 0, and transition rate µ from state 0 to state 1. The differential equation of the state probabilities is given by dP1 (t) dt

= −λP1 (t) + µ P0 (t) = −λP1 (t) + µ(1 − P1 (t))

The solution to this differential equation under the initial condition P1 (0) = 1 is P1 (t) =

µ λ + e−(λ+µ)t λ+µ λ+µ

Suppose the first execution started at time T and ended at time T +s. The second execution started at time T + τ and ended at time T + τ + s.

We can now calculate the different probabilities.

Prob{E1 right} = Prob{processor up at start of E1 and throughout E1 } = Prob{processor up throughout E1 | processor up at start of E1 } × Prob{processor up at start of E1 }

processor up at start of E1 } = e−λs µ λ Prob{processor up at start of E1 } = P1 (T ) = + e−(λ+µ)T λ+µ λ+µ

Prob{processor up throughout E1

|

Prob{E1 right} = P1 (T )e−λs To calculate Prob{E2 wrong | E1 right}, we use the fact that Prob{E2 wrong | E1 right} = 1 − Prob{E2 right | E1 right} and reason as follows. If E1 is right, the processor must have been up throughout the execution of E1 . For E2 to be right as well, the processor must be up at the start of the execution of E2 and throughout. The probability that it is up through the execution given that it was up at the start is equal to e−λs . All we have to do now is find the probability that the processor was up at the beginning of the E2 execution.

The second execution starts τ seconds after the first, which is τ − s seconds after the first is over. Given that the processor was up at the end of E1 and based on the Markov property, the probability that the processor is up at the start of E2 is P1 (τ − s). Therefore, the (conditional) probability that E2 is right is P1 (τ − s)e−λs . Hence, the probability that E2 is incorrect given that E1 was right is 1 − P1 (τ − s)e−λs Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

14

Solutions to Chapter 2 Exercises The probability that E1 is right but E2 is incorrect is therefore: h i P1 (T )e−λs 1 − P1 (τ − s)e−λs µ , and thus the answer can be For a very large T , P1 (T ) can be approximated by λ+µ approximated by i µ −λs h e 1 − P1 (τ − s)e−λs λ+µ

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 3 Exercises 1. Prove that it is possible to find at most 28 8-bit binary words such that the Hamming distance between any two words is at least 3.

Solution: The “volume” of the space of 8-bit binary words is 28 = 256. If the Hamming distance is at least 3, then the spheres of radius 1.5 about any two codewords must be disjoint.

The volume of a sphere of radius 1.5 (i.e., the number of points in the sphere) for any 8-bit word is 9 words: the word itself and those words that differ from it in exactly one bit. Since 256/9 = 28.44, there can be at most 28 disjoint spheres of radius 1.5 (same as spheres of radius 1), and so there can be at most 28 codewords all of which are distance 3 from each other.

2. To an n-bit word with a single parity bit (for a total of (n + 1) bits) a second parity bit for the (n+1)-bit word has been added. How would the error detection capabilities change?

Solution: The first parity bit detects any odd number of errors in the (n + 1) bits, including the check bit. A second parity bit detects any odd number of errors in the (n + 2) bits of the longer codeword. The only errors that are detected only by the second parity bit are the errors that modify this second parity bit. Another way to see is this to note that the second parity bit of every codeword is 0, so it does not increase the minimum distance of the simple parity code.

3. Show that the Hamming distance of an M-of-N code is 2.

Solution:

1

2

Solutions to Chapter 3 Exercises All words at a Hamming distance of 1 from a given codeword (in the M-of-N code) have either M + 1 or M − 1 bits that are 1 are are therefore, not codewords. The smallest Hamming distance to another valid codeword is therefore, at least 2. Changing one bit in a codeword from 0 to 1 and another bit from 1 to 0 will generate a valid codeword at a Hamming distance of 2.

4. Compare two parity codes for data words consisting of 64 data bits: (1) A (72, 64) Hamming code; (2) A single parity bit per byte. Both codes require 8 check bits. Indicate the error correction and detection capabilities, the expected overhead, and list the types of multiple errors that are detectable by these two codes.

Solution: Code (1) can correct a single bit error while (2) can not. The overhead, in terms of hardware and delay, of code (1) is expected to be higher than that of (2). (1) can detect 2 bit errors any where in the word while (2) can detect most 2-bit errors except those that fall within a single byte. (1) may generate for some 3-bit errors a single bit error syndrome leading to an erroneous correction of that bit, while all 3-bit errors will be correctly detected by (2), similarly all 5-bit and 7-bit errors will be detected.

5. Show that a code can detect all unidirectional errors if and only if no two of its codewords are ordered. Two binary N-bit words X and Y are ordered if either xi ≤ yi for all i ∈ {1, 2, . . . , N} or xi ≥ yi for all i ∈ {1, 2, . . . , N}.

Solution: If X and Y are ordered then X ⊕ Y will indicate which unidirectional bit errors will change one of them into the other, in other words, an undetectable unidirectional error.

6. A communication channel has a probability of 10−3 that a bit transmitted is erroneous.

The data rate is 12000 bits per second (bps). Data packets contain 240 information bits, a 32-bit CRC for error detection, and 0, 8, or 16 bits for error correction coding (ECC).

Assume that if 8 ECC bits are added all single bit errors can be corrected, and if 16 ECC bits are added all double bit errors can be corrected. (a) Find the throughput in information bits per second of a scheme consisting of error detection with retransmission of bad packets (i.e., no error correction). (b) Find the throughput if 8 ECC check bits are used, so that single bit errors can be corrected. Uncorrectable packets must be retransmitted. (c) Finally find the throughput if 16 ECC check bits are appended, so that two bit errors can be corrected. As in (b), uncorrectable packets must be retransmitted. Would you recommend increasing the number of ECC check bits from 8 to 16?

Solution: (a) Each packet contains 272 bits. If any error occurs, it is detected (assuming that the CRC always works) and the packet is discarded. The probability that a packet has no errors is (1 − 10−3 )272 = 0.762. The data rate of the code is 240/272 = 0.882. Thus, the throughput in bits per second is 0.762 · 0.882 · 12000 = 8065. (b) With the addition of 8 ECC check bits, each packet contains 280 bits. The probability that a packet has at most one error is (1 − 10−3 )280 + 280 · 10−3 (1 − 10−3 )279 = 0.968.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

3

Solutions to Chapter 3 Exercises

The rate of the code is now 240/280 = 0.857. Thus, the throughput with single bit error correction is 0.968 · 0.857 · 12000 = 9955. (c) The second ECC byte increases the packet size to 288. The probability that a packet of 248 bits has no more than two errors is (1 − 10−3 )288 + 288 · 10−3 (1 − 10−3 )287 +

288 (10−3 )2 (1 − 10−3 )286 = 0.997. The code rate is now 240/288 = 0.833, so the 2 throughput is 0.997 · 0.833 · 12000 = 9966. Increasing the error correction capability in this case resulted in only a marginal increase in the throughput.

7. Derive all codewords for the separable 5-bit cyclic code based on the generating polynomial X + 1 and compare the resulting codewords to those for the non-separable code.

Solution: Data word Separable Non-Separable Data word Separable Non-Separable

0000 00000 00000 1000 10001 11000

0001 00011 00011 1001 10010 11011

0010 00101 00110 1010 10100 11110

0011 00110 00101 1011 10111 11101

0100 01001 01100 1100 11000 10100

0101 01010 01111 1101 11011 10111

0110 01100 01010 1110 11101 10010

0111 01111 01001 1111 11110 10001

8. (a) Show that if the generating polynomial G(X) of a cyclic code has more than one term, all single bit errors will be detected. (b) Show that if G(X) has a factor with three terms, all double bit errors will be detected. (c) Show that if G(X) has X + 1 as a factor, all odd numbers of bit errors will be detected.

That is, if E(X) contains an odd number of terms (errors) it does not have X+1 as a factor.

Also show that CRC-16 and CRC-CCITT contain X + 1 as a factor. What are the error detection capabilities of these cyclic codes?

Solution: (a) The received message is P(X) = C(X)+E(X) where C(X) and E(X) are the transmmited codeword and the error polynomial, respectively. If a single bit error in position i occurs then E(X) = Xi . If G(X) has more than one term, it cannot divide Xi and thus, all single bit errors will be detected. (b) For a double bit error E(X) = Xi + Xj = Xi (1 + X(j−i) ). For the double bit error to be detected neither Xi nor (1 + X(j−i) ) should be divisible by G(X). This holds if G(X) has a factor with 3 terms. (c) Assume that E(X) contains an odd number of terms and is divisible by X + 1. Then, E(X) = (X + 1)B(X) and thus E(1) = 0 which means that E(X) must contain an even number of terms. Both CRCs can detect all single, double and odd numbers of bit errors plus all bursts of up to 16 bit errors.

9. Given that X7 − 1 = (X + 1)g1 (X)g2 (X) where g1 (X) = X3 + X + 1 (a) Calculate g2 (X). (b) Identify all the (7, k) cyclic codes that can be generated based on the factors of X7 − 1.

How many different such cyclic codes exist? (c) Show all the codewords generated by g1 (X) and their corresponding data words.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

4

Solutions to Chapter 3 Exercises Solution: (a) g2 (X) = X3 + X2 + 1. (b) Any single factor or product of two factors (out of three) of X7 − 1 will define a cyclic code: (X + 1) will yield a (7, 6) code, g1 (X) a (7, 4) code, g2 (X) another (7, 4) code, (X + 1)g1 (X) a (7, 3) code, (X + 1)g2 (X) another (7, 3) code, g1 (X)g2 (X) a (7, 1) code. (c) 0000 → 0000000, 0001 → 0001011, 0010 → 0010110, 0011 → 0011101, 0100 → 0101100, 0101 → 0100111, 0110 → 0111010, 0111 → 0110001, 1000 → 1011000, 1001 → 1010011, 1010 → 1001110, 1011 → 1000101, 1100 → 1110100, 1101 → 1111111, 1110 → 1100010, 1111 → 1101001 10. Given a number X and its residue modulo-3, C(X) = |X|3 ; how will the residue change when X is shifted by one bit position to the left if the shifted-out bit is 0? Repeat this for the case where the shifted-out bit is 1. Verify your rule for X = 01101 shifted five times to the left.

Solution: If the shifted-out bit is zero then Xshifted = 2X and C(Xshifted ) = C(2X) = |2 |X|3 |3 . These rules can be summarized in the following table C(X) 00 01 10 C(Xshifted ) 00 10 01 If the shifted-out bit is 1, Xshifted = 2X − 2n (where n is the length of representation of X). Therefore, C(Xshifted ) = C(2X − 2n ) = |2 |X|3 |3 + | − 2n |3 , with |−2n |3 = 2 for n even and |−2n |3 = 1 for n odd.

Using the above rules, we obtain the following residues after each left shift of X = 01101: 1

2

3

4

5

01 → 10 → 10 → 10 → 01 → 00. Since the final residue is 00, the rules are verified.

11. This question relates to soft decisions: recall that in such a case, each bit has a certain probability of being 1 or 0. In such a setting, show that for bits B1 , B2 , 2Prob(B1 ⊕ B2 = 0) − 1 = (2Prob(B1 = 1) − 1)(2Prob(B2 = 1) − 1).

Extend this result to show that 2Prob(B1 ⊕ B2 ⊕ · · · ⊕ Bm = 0) =

m Y

(2Prob(B` = 1) − 1).

`=1

Solution: Denote pi = Prob(Bi = 1). Then, Prob(B1 ⊕ B2 = 0) = p1 p2 + (1 − p1 )(1 − p2 ). Therefore, 2Prob(B1 ⊕ B2 = 0) − 1 = 2[p1 p2 + (1 − p1 )(1 − p2 )] − 1 = 4p1 p2 − 2p1 − 2p2 + 1 = (2p1 − 1)(2p2 − 1) = (2Prob(B1 = 1) − 1)(2Prob(B2 = 1) − 1).

The proof of the extension is similar.

12. Show that a residue check with the modulus A = 2a − 1 can detect all errors in a group of a − 1 (or less) adjacent bits. Such errors are called burst errors of length a − 1 (or less).

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

5

Solutions to Chapter 3 Exercises

Solution: Let us denote the erroneous X by Xerror and let Xerror = X + E, where E denotes a burst error of length a − 1 or less. Error E can be expressed as E = e · 2k where 0 < |e| < 2a .

Since 2k and A = 2a − 1 are relatively prime, E = |e · 2k |A is never zero unless e is zero (i.e., there is no error). Thus, |Xerror |A = |X|A + e · 2k A 6= |X|A .

This implies all the burst errors of length a − 1 or less can be detected.

13. You have a RAID1 system where failures occur at individual disks at a constant rate λ per disk. The repair time of disks is exponentially distributed with rate µ. Suppose we are in an earthquake-prone area, where building-destroying earthquakes occur according to a Poisson process with rate λe . If the building is destroyed, so too is the entire RAID system. Derive an expression for the probability of data loss for such a system as a function of time. Assuming that the mean time between such earthquakes is 50 years, plot the probability of data loss as a function of time using the parameters 1/λ = 500, 000 hours and 1/µ = 1 hour. (visit Library Genesis for more solution manuals: libgen.st) Solution: Define the state of the system by how many disks are up for i = 1, 2 if data loss has not occurred, and 0 if it has. πi (t) is the probability of being in state i at time t, we seek 1 − π0 (t).

For convenience, define a = λe + 2λ, b = µ, c = 2λ, d = µ + λ + λe . The differential equations for the Markov chain (see Figure 3.1) are: λe

2λ

2

1

λ+λe

0

µ

Figure 3.1: Markov chain for Question 12.

dπ2 (t) dt dπ1 (t) dt

= −aπ2 (t) + bπ1 (t) = cπ2 (t) − dπ1 (t)

with the initial conditions π2 (0) = 1, π1 (0) = 0.

One way of solving these equations is to use Laplace transforms. Taking Laplace transforms Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

6

Solutions to Chapter 3 Exercises of these equations, we get: sΠ2 (s) − π2 (0) = −aΠ2 (s) + bΠ1 (s) sΠ1 (s) − π1 (0) = cΠ2 (s) − dΠ1 (s) Solving these equations, we obtain Π1 (s) = Π2 (s) = α1 = α2 =

c (s − α1 )(s − α2 ) s+d , where (s − α1 )(s − α2 ) p −(a + d) + (a + d)2 + 4(bc − ad) 2 p −(a + d) − (a + d)2 + 4(bc − ad) 2

Inverting these Laplace transforms, we obtain: π1 (t) = π2 (t) =

c eα1 t − eα2 t α1 − α2

1 α1 eα1 t − α2 eα2 t + d eα1 t − eα2 t α1 − α2

probability of NO data loss

The probability of not losing any data is shown in Figure 3.2.

1 0.9 0.8 0.7 0.6 0.5 0.4 0.3

0

50

100

150

200

250

300

350

400

450

time (thousands of hours)

Figure 3.2: Probability of not losing data.

14. For a RAID level 3 system with d data disks and one parity disk, as d increases the overhead decreases but the unreliability increases. Suggest a measure for cost-effectiveness and find the value of d which will maximize your proposed measure.

Solution: Selecting a cost-effectiveness measure of the form MTTDL will not yield an optimal value 1 d

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

7

Solutions to Chapter 3 Exercises

√ = (2d+1)λ+µ for d. Another possible measure is MTTDL · d. Taking the derivative with 1 2 (d+1)λ d1.5 √ (µ−5λ)± (5λ−µ)2 −8λ(λ+µ) respect to d and equating it to 0 yields dopt. = .

4λ 15. Given a RAID level 5 system with an orthogonal arrangment of d + 1 strings and g = 8 RAID groups, compare the MTTDL for different values of d from 4 to 10. Assume an exponential repair process for single disks and for strings of disks with repair rates of 1/hour and 3/hour, respectively. Also assume failure rates for single disks and strings of disks of 10−6 /hour and 5 · 10−6 /hour, respectively.

Solution: d 4 5 6 7 8 9 10 MTTDL 6.66 · 108 4.50 · 108 3.25 · 108 2.45 · 108 1.92 · 108 1.54 · 108 1.27 · 108 16. Derive expressions for the reliability and availability of the network shown in Figure 3.3 for the case (r, w) = (3, 3) where a single vote is assigned to each node in the nonhierarchical organization. In this case, both read and write operations can take place if

A

B

D

E

C

Figure 3.3: Network for problem 16. at least three of the five nodes are up. Assume that failures occur at each node according to a Poisson process with rate λ, but the links do not fail. When a node fails, it is repaired (repair includes loading up-to-date data) and the repair time is an exponentially distributed random variable with mean 1/µ. Derive the required expressions for the system reliability and availability using the Markov chains (see Chapter 2) shown in Figure 3.4a and b, respectively, where the state is the number of nodes that are down.

Solution: The probability of failure is given by the probability of being in state F in Figure 3.4(a).

The differential equations for this Markov chain can be written down by inspection of the Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

8

Solutions to Chapter 3 Exercises 5λ

0

4λ

1

µ

3λ

2

5λ

F

0

2µ

4λ

1

µ

2

2µ

(a) Reliability chain

3λ

2λ

3

3µ

λ

4

4µ

5

5µ

(b) Availability chain

Figure 3.4: Markov chains for problem 16 ((r, w) = (3, 3)). chain: dp0 (t) dt dp1 (t) dt dp2 (t) dt dpF (t) dt

= −5λp0 (t) + µp1 (t) = −4λp1 (t) + 2µp2 (t) = −3λp2 (t)

dp0 (t) dp1 (t) dp2 (t) = − + + dt dt dt

Solving this set of equations with the initial condition p0 (0) = 1; pi (0) = 0 ∀i 6= 0, which can be done either numerically or analytically, we can obtain the failure probability.

Availability is modeled by the probability of being in one of the states in the following set: {0, 1, 2}, for t → ∞. Again, we can write by inspection the balance equations of the chain in Figure 3.4(b).

5λp0 4λp1 3λp2 2λp3 λp4 5 X

= = = = =

µp1 2µp2 3µp3 4µp4 5µp5

pi = 1

i=0

For convenience, define ρ = λ/µ. Solving these balance equations, we get: p1 = 5ρp0 ; p2 = 10ρ2 p0 ; p3 = 10ρ3 p0 ; p4 = 5ρ4 p0 ; p5 = ρ5 p0 where

−1 p0 = 1 + 5ρ + 10ρ2 + 10ρ3 + 5ρ4 + ρ5 17. In Figure 3.4, a Markov chain is provided for the case in which nodes can be repaired in an exponentially distributed time. Suppose instead that the repair time was a fixed, deterministic, time. How would this complicate the model?

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

9

Solutions to Chapter 3 Exercises

Solution: When the repair time was exponentially distributed, we do not need to keep track of how long the system has been in any state: the rate out of that state is constant. If, on the other hand, the repair time is a constant, we would need to keep track of this quantity.

The need to do so greatly complicates the model. This is why the exponential assumption is made so often: the simplicity it imparts to the resultant analytical model frequently more than makes up for any loss of accuracy.

18. For the model shown in Figure 3.4, suppose λ = 10−3 and µ = 1. Calculate the reliability and availability of each of the following configurations: (r, w) = (3, 3), (2, 4), (1, 5).

Solution: The case (r, w) = (3, 3) has already been dealt with above: simply plug in the specified values of λ and µ and obtain numerical results.

For the case (r, w) = (2, 4), at least 4 nodes need to be up for the system to function properly. For the reliability calculation, the differential equations would be: dp0 (t) dt dp1 (t) dt dpF (t) dt

= −5λp0 (t) + µp1 (t) = −4λp1 (t) + 2µp2 (t)

dp0 (t) dp1 (t) = − + dt dt

The system will be available if it is in one of the states {0, 1}. We use the same balance equations as we did for the (r, w) = (3, 3) model, but now calculate the availability to be p0 + p1 .

For the case (r, w) = (1, 5), at least 5 nodes must be up for the system to function, i.e., even one failure would render the system unusable. Hence, the reliability would be calculated using the following equations: dp0 (t) dt dpF (t) dt

= −5λp0 (t) + µp1 (t) = −

dp0 (t) dt

For availability, use the same equations as for the (r, w) = (3, 3) model, but now the availability will be p0 .

19. For the example shown in Figure 3.5 the four nodes have an availability 1 while the links have the availabilities indicated in the figure. Use Heuristic 2 to assign votes to the four nodes, write down the possible values for w and the corresponding minimal values of r, and calculate the availability for each possible value of (r, w). Assume that read operations are twice as frequent as write operations.

Solution: Read and write quorums under Heuristic 2: Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

10

Solutions to Chapter 3 Exercises 1.0

0.

7

A

0.9

C 1.0

2 0.

7

B

0.

1.0

D 1.0

Figure 3.5: An example network (numbers indicate availabilities). r 6 5 4 3 2 1

Read Quorums AB, BC, BD, ACD AB, AC, BC, CD, BD B, CD, AC, AD AD, B, C A, B, C, D A, B, C, D

w 6 7 8 9 10 11

Write Quorums AB, BC, BD, ACD BC, ABD, ACD ABC, ABD, BCD ABC, BCD ABCD ABCD

Pr 0.976 0.914 1.000 1.000 1.000 1.000

Pw 0.9760 0.9928 0.8534 0.8492 0.4886 0.4886

A 0.9760 0.9665 0.9511 0.9497 0.8295 0.8295

20. Prove that in the hierarchical quorum generation approach in Section 3.3.2, every possible read quorum intersects with every possible write quorum in at least one node.

Solution: The level of a node is the number of hops it is below the root. Consider level 1. Since r1 + w1 > `1 , any read and write quorums must have a non-empty intersection set, I1 . Let A1 ∈ I1 . If A1 is a leaf, we are done. If not, consider its children (which are of level 2).

Since r2 + w2 > `2 , any read and write quorums among its children must have a non-empty intersection set, I2 . Consider any node A2 ∈ I2 . If A2 is a leaf, we are done. Else, consider its children and use the same argument until we come to a leaf node.

21. Consider the tree shown in Figure 3.6. If p is the probability that a leaf node is faulty, obtain an expression for the probability that read and write quorums exist. Assume that r1 = r2 = w1 = w2 = 2 and that nodes at levels 0 and 1 do not fail.

W

X

A A

B

Level 0

Y

C

D

E

F

G

Z

Level 1

H

I

Level 2

Figure 3.6: A tree for hierarchical quorum generation (m = 3).

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

11

Solutions to Chapter 3 Exercises

Solution: Define the sets α = {A, B, C}, β = {D, E, F}, γ = {G, H, I}. We must have at least two of the sets α, β, γ having two or more functional elements. The probability that set α has two or more functional elements is P = 3p(1 − p)2 + (1 − p)2 . The same expression applies to sets β and γ as well. The probability that at least two of these sets has two or more functional elements is given by 3P2 (1 − P) + P3 22. Show how checksums can be used to detect and correct errors in a scalar by matrix multiplication for the following example. Assume a 3 × 3 matrix 

 1 2 3 A= 4 5 6  7 8 9 Show the corresponding column weighted matrix AC and assume that during the mulitplication of AC by the scalar 2 a single error has occured resulting in the following output 

 2 4 6 2 · A =  8 10 12  14 17 18 Solution: The column weighted matrix AC is  1 2 3  4 5 6     7 8 9 A=    12 15 18  37 44 51 

After multiplying by the scalar 2 and with the single error, we obtain 

2  8  B = 2A =   14  24 74

 4 6 10 12   17 18   30 36  88 102

P For column 2 we calculate S1 = 3i=1 ai,2 − WCS1 = (4 + 10 + 17) − 30 = 1, and S2 = P3 i−1 a i,2 − WCS2 = (4 + 20 + 68) − 88 = 4. Since both S1 and S2 are non-zero, we i=1 2 calculate S2 /S1 = 4 = 2(3−1) implying that a3,2 is erroneous. We correct the error using a3,2 = a3,2 − S1 = 17 − 1 = 16.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 4 Exercises 1. The node (link) connectivity of a graph is the minimum number of node-disjoint (linkdisjoint) paths between any pair of nodes. Show that the node connectivity of a graph can be no greater than its link connectivity, and that neither the node nor the link connectivity can exceed the minimum node-degree of the graph (the degree of a node is the number of edges incident on it). In particular, show that for a graph with ` links and n nodes, the minimum node-degree can never exceed b2`/nc.

Solution: The node connectivity can never be greater than the link connectivity since removing a node entails also removing all the links incident on it.

Suppose the minimum node-degree of a graph is δ. Then, if we pick a node with nodedegree δ and remove all its edges, it will be disconnected. Equally, if we pick all the neighbors of this node and remove them, the graph will be disconnected as well (unless we are left with only this node in the graph, in which case the graph will be trivially connected since it only has one node in it).

Every link has a node at each of its two ends. Suppose the minimum node degree is larger than b2`/nc, i.e., δ = b2`/nc + k, for k > 0. Then, the total number of links in this graph will be lower-bounded by nδ/2, which will exceed `.

2. In this problem, we will study the resilience of a number of networks using simulation (If you are unfamiliar with simulation, it may be helpful to skim through Chapter 10 on simulation techniques). Assume that nodes fail with probability qc and individual links with probability q` . All failures are independent of one another, and a node failure takes with it all the links that are incident on it. Vary qc and q` between 0.01 and 0.25 and find the probability that the network is disconnected. Do this for each of the following

1

2

Solutions to Chapter 4 Exercises networks: (a) n × n rectangular mesh, for n = 10, 20, 30, 40. (b) n × n interstitial mesh with (1, 4) interstitial redundancy, for n = 10, 20, 30, 40. (c) n-dimensional hypercube, for n = 3, 4, 6, 8, 10, 12.

3. For the networks listed above, find the diameter stability vector, DS. 4. Consider an 8 × 8 butterfly network. Suppose that each processor generates a new request every cycle. This request is independent of whether or not its previous request was satisfied, and is directed to memory module 0 with probability 1/2 and to memory module i with probability 1/14, for i ∈ {1, 2, · · · , 7}. Obtain the expected bandwidth of this network.

Solution: (j) Let qi be the probability that output line i of stage j is idle, i.e., does not carry a memory (j)

(j)

request from a processor. Define pi = 1 − qi .

From the top output line of each stage-2 box, we can reach outputs 0, 1, 2, 3. The probability of a processor request to any of them is 1/2 + 3/14 = 10/14 = 5/7. We therefore have: (2/7)2 if i = 0, 1, 2, 3 (2) qi = (5/7)2 if i = 4, 5, 6, 7 (2)

The corresponding value of pi is 45/49 = 0.918 for i = 0, 1, 2, 3 and 24/49 = 0.490 for i = 4, 5, 6, 7. Now, consider input line i of a stage-1 box for i = 0, 1, 2, 3. If this line is carrying a request, the probability that such a request is to the top line of the box is 1/2+1/14 1/2+3/14 = 4/5. The request is to either output line with equal probability for switchboxes with lines 4, 5, 6, 7 in stage 1. Hence,  2  4 (2)  1 − p if i = 0, 1  5 i  

2 (1) (2) qi = 1 − 15 pi if i = 2, 3  

2   (2)  1 − 12 pi if i = 4, 5, 6, 7 (2)

Substituting the values for pi

yields:

(1)

= 0.071; pi = 0.929; for i = 0, 1

(1)

= 0.667; pi = 0.333; for i = 2, 3

(1)

= 0.570; pi = 0.430; for i = 4, 5, 6, 7

qi qi qi

(1)

(1)

(1)

We reason similarly for stage-0 boxes. If an input line to the top box is busy, it will carry a 1/2 request to output 0 with probability 1/2+1/14 = 87 . Input lines to other boxes in this stage Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

3

Solutions to Chapter 4 Exercises are equally likely to request either output line. Hence, we can write:  2  7 (1)  p if i = 0 1 −  8 i  

(0) (1) 2 qi = 1 − 81 pi if i = 1  

2    1 − 1 p(1) if i = 2, 3, 4, 5, 6, 7 2 i The expected bandwidth is

P7

(0) i=0 pi = 4 × 0.384 + 2 × 0.305 + 0.219 + 0.965 = 3.329.

5. We showed how to obtain the probability, for a multistage network, that a given processor is unable to connect to any memory. In our analysis, only link failures were considered.

Extend the analysis to include switchbox failures, which occur with probability qs . Assume that link and switchbox failures are all mutually independent of one another.

Solution: For access from some point to the output end, we require that there be at least one path from that point to the output end that is free of both switchbox and link failures. We have already derived the expressions φ(0) = (1 − q2` ) φ(i) = 1 − (1 − p` φ(i − 1))2 for the case where there are no switchbox failures. If we introduce switchbox failures, we have to ensure that, for a path to exist leading to the output end of a switchbox, both the switchbox and at least one output link must be up. This leads immediately to the equations φ(0) = ps (1 − q2` ) φ(i) = 1 − ps (1 − p` φ(i − 1))2 where ps = 1 − qs .

6. In a 4 × 4 multi-stage butterfly network p` is the probability that a link is fault-free.

Write expressions for the bandwidth BW, connectability Q, and the expected number of accessible processors. Assume that a processor generates memory requests with probability pr . Assume that switches do not fail.

Solution: Connectivity: Q = 16 · p3l Number of accessible processors: Pr{X(2) = 1} = pl [1 − (1 − pl )2 ] Ar = 4pl Pr{X(2) = 1}.

Bandwidth: BW = 4Pr{X(0) = 1} where Pr{X(2) = 1} = pr ; Pr{X(1) = 1} = pr pl − 41 p2r p2l Pr{X(0) = 1} = pr p2l − 41 p2r p3l − 14 p2l (pr pl − 41 p2r p2l )2 .

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

4

Solutions to Chapter 4 Exercises 7. Prove that the extra-stage butterfly network can tolerate the failure of up to one switchbox failure and still retain connectivity from any input to any output. (Assume that if the failed switchbox is either in the extra or the output stages, its bypass multiplexer is functional.)

Solution: The key to the proof is to realize that except for the output and extra stages, each switchbox consists of only even-numbered or only odd-numbered lines. Thus, if a packet is output on an odd-numbered link out of the extra stage, it will remain on odd-numbered links all the way to the input line of the output stage. At this point, if necessary, it can transit to an even-numbered output line.

Now, consider the failure of a switchbox that is in neither the output, nor in the extra, stages. Suppose this box was carrying odd-numbered lines. At the extra stage, move any packet that would have been using this box to an even-numbered line. This packet is then guaranteed to bypass the failed internal box.

It remains to consider the extra and the output stages. If a box in the extra stage fails, use its bypass multiplexer to route around it. If a box on the output stage fails, route around it and get the extra stage to perform the same switching function (straight or cross) that the output stage box would have done if it had been working correctly.

8. Compare the reliability of an N × M interstitial mesh (with M and N both even numbers) to that of a regular N × M mesh, given that each node has a reliability R(t) and links are fault-free. For what values of R(t) will the interstitial mesh have a higher reliability?

Solution: For the (1, 4) scheme, the reliability is greater than that of the mesh if

R5 (t) + 5R4 (t)(1 − R(t))

NM/4

> RNM (t)

⇒ R4 (t) > R5 (t)

which is true for all R(t) < 1.

9. Derive an approximate expression for the reliability of a square (4, 4) interstitial redundancy array with 16 primary nodes and 9 spares. Denote the reliability of a node by R and assume that the links are fault-free.

Solution: One approximation is to view it as an 16-out-of-25 structure, i.e., P9 25 (1 − R)i R25−i .

R16 of 25 = i=0 i Another approximation is to claim that four (out of the 16) have one spare, two sets of four nodes have two spares each, and one set of four has four spares. Thus, Rsystem = [R5 + 5R4 (1 − R)][R6 + 6R5 (1 − R) + 15R4 (1 − R)2 ]2 [R8 + 8R7 (1 − R) + 28R6 (1 − R)2 + 56R5 (1 − R)3 + 70R4 (1 − R)4 ].

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

5

Solutions to Chapter 4 Exercises

10. A 3 × 3 crossbar has been augmented by adding a row and a column, and input demultiplexers and output multiplexers. Assume that a switch can fail with probability qs and when it fails all the incident links are disconnected. Also assume that all links are fault-free but multiplexers and demultiplexers can fail with probability qm . Write expressions for the reliability of the original 3 × 3 crossbar and for the fault-tolerant crossbar. (For the purposes of this question, the reliability of the fault-tolerant crossbar is the probability that there is a functioning 3 × 3 crossbar embedded within the 4 × 4 system). Will the fault-tolerant crossbar have always a higher reliability than the original 3 × 3 crossbar?

Solution: Roriginal crossbar = (1 − qs )9 ;

Rfault−tolerant crossbar ≈ (1 − qm )6 [(1 − qs )9 + 9qs (1 − qs )15 ].

The fault-tolerant crossbar will NOT always be more reliable than the original; it depends on the multiplexer reliability. The fault-tolerant arrangement is more reliable if (1 − qs )9 < (1 − qm )6 [(1 − qs )9 + 9qs (1 − qs )15 ] ⇒ (1 − qm )−6 < 1 + 9qs (1 − qs )6 11. Show that the three cases enumerated in connection with the derivation of the hypercube network reliability (Section 4.2.4) are mutually exclusive. Further, show that Hn is connected under each of these cases. Assume that qc = 0, i.e., that the nodes do not fail.

Solution: In Case 1, both A and B have to be operational; in Case 2, one of them is not. Hence, Case 1 and Case 2 are disjoint.

In Case 2, all links are good while this is not true for Case 3. This ensures that Cases 2 and 3 are disjoint. (visit Library Genesis for more solution manuals: libgen.rs) In Case 1, both A and B are operational; in Case 3, one of them is not and so Cases 1 and 3 are disjoint.

For connectedness, consider nodes x, y.

Connectedness under Case 1: Both A and B are connected and so if x and y are both in either A or in B, they have a path between them. If x ∈ A, y ∈ B, then since at least one dimension-(n − 1) link between them is functional, we have a path that starts at x, transfers on a functional dimension-(n − 1) link to B, and then routes to y.

Connectedness under Case 2: Suppose A is connected and B is not. Then, suppose z is the node in A connected by a dimension-(n − 1) edge to node y. Then, the path from x to z and then to y exists.

Connectedness under Case 3: If the dimension-(n−1) edge zy (where z is defined as in Case 2) is functional, the argument is identical to that used in Case 2. If it is not, then there exists a link connecting y to some other node w ∈ B. Let v ∈ A be the node connected to w along a dimension-(n − 1) link. We can therefore establish a path connecting y to w, connecting w to v, and connecting v to x.

12. Obtain by simulation the network reliability of Hn for n = 5, 6, 7. Assume that qc = 0.

Compare this result in each instance with the lower bound that we derived.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

6

Solutions to Chapter 4 Exercises 13. The links in an H3 hypercube are directed from the node with the lower index to the node with the higher index. Calculate the path reliability for the source node 0 and the destination node 7. Denote by pi,j the probability that the link from node i to node j is operational and assume that all nodes are fault-free.

Solution: The six paths from node 0 to 7 are: P1 = {x0,1 , x1,3 , x3,7 }, P2 = {x0,1 , x1,5 , x5,7 }, P3 = {x0,2 , x2,3 , x3,7 }, P4 = {x0,2 , x2,6 , x6,7 }, P5 = {x0,4 , x4,5 , x5,7 }, P6 = {x0,4 , x4,6 , x6,7 }, The corresponding probabilities are: T1 = p0,1 p1,3 p3,7 , T2 = p0,1 p1,5 p5,7 (1 − p1,3 p3,7 ), T3 = p0,2 p2,3 p3,7 (q0,1 + p0,1 q1,3 (1 − p1,5 p5,7 )), T4 = p0,2 p2,6 p6,7 [q0,1 q2,3 + q0,1 p2,3 q3,7 + p0,1 q3,7 (1 − p1,5 p5,7 ) + p0,1 p3,7 q3,7 q2,3 (1 − p1,5 p5,7 )], T5 = p0,4 p4,5 p5,7 [q0,1 q0,2 + q0,1 p0,2 (1 − p2,3 p3,7 )(1 − p2,6 p6,7 ) + p0,2 p0,1 q3,7 q1,5 (1 − p2,6 p6,7 ) + p0,1 q0,2 q1,5 (1−p1,3 p3,7 )+p0,2 p0,1 p3,7 q1,5 q1,3 q2,3 (1−p2,6 p6,7 ). T6 is derived similarly. Finally, R = T1 + T2 + T3 + T4 + T5 + T6 .

14. All the links in a given 3 × 3 torus network are directed as shown in the diagram below.

Calculate the path reliability for the source node 1 and the destination node 0. Denote by pi,j the probability that the link from node i to node j is operational and assume that all nodes are fault-free.

0

1

2

3

4

5

6

7

8

Solution: There are four paths from node 1 to 0: P1 = {x1,0 }, P2 = {x1,7 , x7,6 , x6,3 , x3,0 }, P3 = {x1,7 , x7,4 , x4,3 , x3,0 }, and P4 = {x1,7 , x7,6 , x6,8 , x8,5 , x5,4 , x4,3 , x3,0 }. The requested path reliability is: R1,0 = p0,1 + q1,0 p1,7 p7,6 p6,3 p3,0 + q1,0 (1 − p7,6 p6,3 )p1,7 p7,4 p4,3 p3,0 + q1,0 q6,3 q7,4 p1,7 p7,6 p6,8 p8,5 p5,4 p4,3 p3,0 15. Generate random graphs in the following way. Start with n nodes; the probability that there is a (bidirectional) link connecting nodes i and j is pe . Vary pe between 0.2 to 0.8 in steps of 0.1 and answer the following for each value of pe . (a) What fraction of these networks are connected? (b) Within the subset of connected networks, if links can fail with probability q` and nodes never fail, what is the diameter stability vector, DS, of the graph? Vary q` Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

7

Solutions to Chapter 4 Exercises between 0.01 and 0.25.

16. Derive the node connectivity of each of the following meshes: triangular, rectangular, and hexagonal.

Solution: 17. If, in a sensor network, the neighbors of a node do not hear from it for a specified amount of time, τ, they can declare it faulty. Briefly describe what factors you would take into account while determining an appropriate value of τ.

Solution: 18. Provide an example of deadlock in wormhole routing. This is a situation in which there are multiple messages which so interfere with one another that none of them can make any progress.

Solution: 19. Consider a rectangular mesh. Suppose node A wishes to send a message to node B which is dx , dy hops away in the x and y directions, respectively. Assuming no turn restrictions, what is the number of node-disjoint (shortest) paths that this message can take?

Solution: (dx + dy )(dx + dy − 1)/2.

20. All the links in the given 5-node chordal network are directed (as shown in the diagram) while the 3 chords are bi-directional. (a) What is the diameter of the given network? Indicate one source-destination distance 3 4

2

5

1 0

that equals the diameter. (b) Denote by dl and dc the transmission delay of a link and a chord, respectively. Calculate the average source-destination path delay assuming that dc = 2dl . (c) Denote by pl the probability that a link is operational and by pc the probability that a chord is operational, and assume that links and chords fail independently and that all nodes are fault-free. Calculate the Path Reliability for the source node 0 and the destination node 1.

Solution: (a) D = 5, e.g., the distance from node 0 to node 5.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

8

Solutions to Chapter 4 Exercises (b) Due to the symmetry of the network we consider only node 0 as a source. Its distances to the other nodes are dl , 2dl , dc , dc + dl and dc + 2dl . The average distance is thus 1 1 5 [6dl + 3dc ] = 5 [12dl ] = 2.4dl . (c) The paths from node 0 to 1 are: {l0,1 } and {c0,3 , l3,4 , l4,1 }. The path Reliability is pl + ql pc p2l .

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 5 Exercises 1. Join N − 1 other people (N = 3, 4, 5 are probably the best choices) to carry out an experiment in writing N-version programs. Write software to solve a set of differential equations, using the Runge-Kutta method. Programs for doing so are widely available, and can be used to check the correctness of each version produced. Pick one of these and compare the output of each version against this reference program for a large number of test cases. Identify the number of bugs in each version and the extent to which they are correlated among versions.

2. The correct output, z, of some program has as its probability density function the truncated exponential function (assume L is some positive constant):

f(z) =

µe−µz 1−e−µL

0

if 0 ≤ z ≤ L otherwise

If the program fails, it may output any value over the interval [0, L] with equal probability.

The probability that the program fails on some input is q.

The penalty for putting out an incorrect value is πbad ; the penalty for not producing any output at all is πstop .

We want to set up an acceptance test in the form of a range check, which rejects outputs outside the range [0, α]. Compute the value of α for which the expected total penalty is minimized.

Solution: First, note that if πbad ≤ πstop , we obviously must set α = L. So, let us consider the case πbad > πstop . The probability of a bad output falling inside the acceptable interval is αL .

1

2

Solutions to Chapter 5 Exercises The probability of a good output falling outside the acceptable interval is ZL

µe−µx e−µα − e−µL dx = −µL 1 − e−µL α 1−e

Given that q is the probability of producing a bad output, we have the expected cost as C(α) = πbad q

α e−µα − e−µL α + πstop q 1 − + (1 − q) L L 1 − e−µL

So, find α such that dC(α) dα = 0: this can be shown, by calculus, to be given by 1 α = − ln µ

q(πbad − πstop )(1 − e−µL ) µπstop (1 − q)L

2

C(α) > 0, thus meeting the requirement of a minimum.

It is easy to check that d dα 2

3. Suggest measures to evaluate the spatial and temporal impact of errors in a variable (as used by a wrapper to determine if that variable is to be duplicated or triplicated).

Solution: 4. In this problem, we will use simulation to study the performance of a bug removal process after an initial debugging (see Chapter 9).

Assume you have a program that has N possible inputs. There are k bugs in the program, and bug i is activated whenever any input in the set Fi is applied. It is not required that Fi ∩ Fj = ∅, and so the bug sets may overlap. That is, the same input may trigger multiple bugs. If Fi has k elements in it, the elements of Fi are obtained by randomly drawing k different elements from the set of possible inputs.

Assume that you have a test procedure that applies inputs to the program. These inputs are randomly chosen from among the ones that have not been applied so far. Also assume that when an input is applied which triggers one or more bugs, those bugs can immediately be removed from the program.

Plot the number of software bugs remaining in the program as a function of the number of inputs applied. Use the following parameters in your simulation: (i) N = 108 , and the number of elements in Fi is uniformly distributed over the set {1, 2, · · · , n}. (a) The total number of bugs is 1000. n = 50 and a total of 106 randomly chosen test inputs are applied. (b) Repeat (a) for n = 75. (c) Repeat (a) for n = 100.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

3

Solutions to Chapter 5 Exercises

(ii) N = 108 ; and the number of elements in Fi has the following probability mass function: Prob{Fi has k elements} =

p(1 − p)k−1 , where k = 1, · · · , n 1 − (1 − p)n

Apply 106 randomly chosen test vectors in all. As before, assume there are 1000 software bugs. (a) n = 50; p = 0.1. (b) n = 75; p = 0.1. (c) n = 100; p = 0.1. (d) Repeat (a) to (c) for p = 0.2. (e) Repeat (a) to (c) for p = 0.3.

Discuss your results.

5. For an expected number of errors Ñ(P) = λP2 over a rejuvenation period P, the optimal q Cr rejuvenation period is Popt = λC where Cr is the cost of each rejuvenation and Ce is e the cost of each error. On a certain computer system it has been decided to double the frequency of rejuvenation.

• (a) By how much would the rejuvenation cost increase (or decrease) with this rejuvenation period compared to the cost with the optimal rejuvenation period?

• (b) By how much would the rejuvenation cost per time unit increase (or decrease) with this rejuvenation period compared to the cost per time unit with the optimal rejuvenation period?

Solution: (a) Crejuv (Popt ) = 2Cr while Crejuv (Popt /2) = 45 Cr , i.e., decrease by 3/8 or 37.5%. (b) Crate (Popt ) = 2Cr /Popt while Crate (Popt /2) = 25 Cr /Popt , i.e., increase by 1/4 or 25%.

6. In this problem, we will use Bayes’s law to provide some indication of whether bugs still remain in the system after a certain amount of testing. Suppose you are given that the probability of uncovering a bug (given that at least one exists) after t seconds of testing is 1−e−µt . Your belief at the beginning of testing is that the probability of having at least one bug is q. (Equivalently, you think that the probability that the program was completely bug-free is p = 1 − q.) After t seconds of testing, you fail to find any bugs at all. Bayes’s law gives us a concrete way in which to use this information to refine your estimate of the chance that the software is bug-free: find the probability that the software is actually bug-free, given that you have observed no bugs at all, despite t seconds of testing.

Let us use the following notation: • A is the event that the software is actually bug-free.

• B is the event that no bugs were caught despite t seconds of testing.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

4

Solutions to Chapter 5 Exercises (a) Show that Prob{A|B} =

p p + qe−µt

(b) Fix p = 0.1, and plot curves of Prob{A|B} against t for the following parameter values: µ = 0.001, 0.01, 0.1, 1.0, 0 ≤ t ≤ 10000. (c) Fix µ = 0.01 and plot curves of Prob{A|B} against t for the following parameter values: p = 0.1, 0.2, 0.3, 0.4, 0.5. (d) What conclusions do you draw from your plots in (b) and (c) above?

Solution: (a) Based on the conditional probability formula, we have: Prob{A|B} = =

Prob{A ∩ B} Prob{B} Prob{B|A}Prob{A} Prob{B ∩ A} + Prob{B ∩ A}

where A is the complement of A, i.e., the event that the software has at least one bug. Let us look at each of the terms in this expression. Clearly, Prob{B|A} = 1. As for Prob{A}, the best estimate we have is that this is equal to p. To calculate Prob{B ∩ A} and Prob{B ∩ C}, we will need to invoke the conditional probability formula once more: Prob{B ∩ A} = Prob{B|A}Prob{A} = p Prob{B ∩ C} = Prob{B|C}Prob{C} = e−µt q Once again, we are using the best estimates we have for Prob{A} and Prob{B}. Substituting back into the expression for Prob{A|B}, we have: Prob{A|B} =

p p + qe−µt

(b) Some numerical results are shown in Figure 5.1. (d) The conclusions one draws from this are the following. µ is the rate at which a faulty piece of software generates errors under testing. So, if µ is small, it takes longer to uncover faults, which is why the probability of being actually bug-free increases more slowly than if µ is large. p is the prior belief in the goodness of the software. If p is large, a small amount of testing without discovering any faults serves to reinforce our belief that the software is bug-free. On the other hand, if p is small, it takes a long testing duration (without any faults being uncovered) for us to reach the same level of confidence that the software is bug-free.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

5

0.4 0.3

5 0.5 0.4 0.3

µ=0.001 0

0.3

0.6

0.2 0.1

0.7

p=

µ=0.1

0.5

µ=

0.6

0.8

p= 0.1

1

0.7

0.

0.8

1 0.9

p=

Prob{A|B}

1 0.9

0.0

Prob{A|B}

Solutions to Chapter 5 Exercises

200

400

600

0.2

800

1000

0.1

0

200

400

600

(a) Impact of µ

800

1000

t

t (b) Impact of p

Figure 5.1: Impact of µ and p on Prob{A|B} 7. This question relates to recovery blocks. Based on the concepts of test sensitivity, s, and false alarm rate, ρfa , as presented in Section 5.4, derive an expression for the fraction of alarms that are false (in a single stage). That is, what is the fraction of times the acceptance test declares the output erroneous when it is actually good? The unconditional probability that the output is good is known to be pg .

Solution: Denote by E the event that the output of the stage is erroneous and by T the event that the acceptance test flags an error. Then, we have by Bayes’s Law: P(E|T ) = = =

P(E ∩ T ) P(T ) P(T |E)P(E) P(T |E)P(E) + P(T |E)P(E) ρfa (1 − pg ) ρfa (1 − pg ) + s(1 − pg )

8. In the context of the SIHFT technique, the term data integrity has been defined as the probability that the original and the transformed programs will not both generate identical incorrect results. Show that if the only faults possible are single stuck-at faults in a bus (see Figure 5.2) and k is either −1 or 2` with ` an integer, then the data integrity is equal to 1. Give an example when the data integrity will be smaller than 1. (Hint: Consider ripple-carry addition with k = −1.)

Solution: For k = 2` a stuck-at-b fault on line i may affect bit i in the original word and bit i − ` in the transformed one. These two words will be identical only if the bits in positions i and i − ` both have the value b. In this case the result is correct. In all other cases, at least one of the words will be incorrect and the two words will be different. If k = −1, for most bit positions a stuck-at-b fault will change one word out of the two and they will no longer be the two’s complement of each other. The only case that needs further discussion is when Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

6

Solutions to Chapter 5 Exercises Stuck−at−0 fault

bit (n−1)

Destination

bit i

... ...

Source

bit 0 bit 1

Figure 5.2: Example of the use of SIHFT. the stuck-at-b fault occurs in the position of the rightmost bit which is equal to 1 since this bit will be equal to 1 in the transformed word as well. If b = 1 both words will be correct. If b = 0 both will be incorrect but they will no longer be the two’s complement of each other. Thus, the data integrity will be equal to 1.

To show that the data integrity can be smaller than 1 consider the following example.

Suppose the number a3 a2 a1 a0 = 0100 is added to b3 b2 b1 b0 = 0001 with k = −1. If no faults occur, the original and transformed results would be 0101 and 1011, respectively. If a stuck-at-0 fault occurs in position 2 such that the value of a2 will no longer affect the sum output but will still participate in the generation of the carry-out, then the result of the original addition would be 0001 and the result of the transformed addition would be 1111 which is the correct two’s complement of the wrong result.

9. Compare the use of the AN code (see Chapter 3) to the RESO technique. Consider the types of faults that can be detected and the overheads involved.

Solution: Both multiply the operand by a constant. However, in the AN code, all intermediate results are multiples of A while in the RESO technique, the intermediate result after the checking, is the correct one and is not multiplied by A. As a result, the AN code must use a value of A that is not a power of 2 and is capable of detecting all single bit errors. The RESO technique can use a simpler factor, say 2, and can also detect all single bit errors.

On the other hand, the RESO technique must check each operation individually, incurring a higher hardware and time overhead compared to the AN code where the checking can be performed after several operations have been completed.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 6 Exercises 1. In Section 6.3.1, we derived an approximation for the expected time between checkpoints as a function of the checkpoint parameters. (a) Calculate the optimum number of checkpoints and plot the approximate total expected execution time as a function of Tov . Assume that T = 1, Tlt = Tov and λ = 10−5 . Vary Tov from 0.01 to 0.2. (b) Plot the approximate total expected execution time as a function of λ. Fix T = 1, Tov = 0.1, and vary λ from 10−7 to 10−1 .

2. In Section 6.3.1, we derived an expression for Nopt , the optimal number of checkpoints.

We noted that this term includes Tr , the recovery time per failure. In particular, Nopt tends to decrease as Tr increases.

Explain why the assumption that there can be no more than one failure in any intercheckpoint interval contributes to the presence of Tr in this expression.

3. You have a task with execution time, T . You take N checkpoints, equally spaced through the lifetime of that task. The overhead for each checkpoint is Tov and Tlt = Tov . Given that during execution, the task is affected by a total of k point failures (i.e., failures from which the processor recovers in negligible time), answer the following questions. (a) What is the maximum execution time of the task? (b) Find N such that this maximum execution time is minimized. It is fine to get a non-integer answer (say x): in practice, this will mean that you will pick the better of bxc and dxe.

1

2

Solutions to Chapter 6 Exercises Solution: T The execution time between checkpoints is te = N+1 + Tov . If there is a failure just before a checkpoint is completed, we have lost te of work. So, the worst-case execution time is Twc = kte + Ntov + T Differentiating with respect to N yields the optimum number of checkpoints: r Nopt =

kT −1 Tov

opt 4. Solve Equation 6.9 numerically and compare the calculated Tex to the value obtained in Equation 6.6 for the simpler model. Assume Tr = 0 and Tlt = Tov = 0.1. Vary λ from 10−7 to 10−2 .

Solution: opt The obtained values are almost identical. The values of Tex for λ = 10−1 , 10−2 , 10−3 , 10−4 , 10−5 , 10−6 and 10−7 are 1.42, 4.47, 14.14, 44.72, 141.42, 447.21 and 1414.21, respectively.

5. A certain program executing on a given computer has an expected total execution time of T = 5 hours (in a fault-free case). The computer experiences transient faults at a constant rate of λ = 5 × 10−6 /sec. (a) What is the probability that the program will complete its execution successfully? (b) To increase the probability of successful completion, checkpointing has been incorporated with an overhead of Tov = 5sec each time a checkpoint is taken. Upon a fault, the program is rolled back and the recovery process takes Tr = 10sec. Using the first order approximation according to which the intercheckpoint interval is given by (see Equation

ov 6.5) Eint ≈ (Tex + Tov ) 1 + λ( Tex +T + Tr ) and the optimal Tex is given by Equation 6.6, 2 calculate the average total time the program will execute on the given computer in the presence of faults and checkpointing. (c) The given program goes through twenty phases of computing, each lasting 20 minutes and at the end of such a phase the size of the program state that needs to be checkpointed is drastically reduced so that Tov = 1 sec. If instead of the optimal placement of checkpoints as in (b), a checkpoint is taken every 20 minutes, what would be the average total time the program will execute in the presence of faults?

Solution: (a) T = 5·60·60 = 18000 sec.; Prob{Succesful completion}= exp(−λ·18000) = exp(−0.09) = 0.914. √ opt T (b) Tex = 2 · 106 + 125 ≈ 1414 sec.; Nopt = opt − 1 = 11.72 ≈ 12; The resulting Tex is Tex

Tex = T/(N + 1) = 18000/13 = 1384.6 sec.; Eint ≈ 1389.6 · [1 + 5 · 10−6 (695 + 10)] = 1394.5 sec. Ttotal = 13 · 1394.5 = 18128.5 sec = 5 hours and 2.14 minutes. (c) Tex = 20 · 60 = 1200 sec; N = 18000/1200 − 1 = 14; Eint ≈ 1201[1 + 5 · 10−6 (610.5)] = 1204.6 sec; Ttotal = 15 · 1204.6 = 18069 sec = 5 hours and 1.15 minutes.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

3

Solutions to Chapter 6 Exercises

6. In this problem, we will look at checkpointing for real-time systems. You have a task whose execution time is T and its deadline is D. N checkpoints are placed equidistant through the lifetime of the task. The overhead for each checkpoint is Tov . Point transient failures occur at a constant rate λ. (a) Derive a first-order model for the probability of missing a deadline, by conditioning on the number of failures over [0, T + NTov ]. Start by calculating the probability of missing a deadline if there is exactly one failure over [0, T + NTov ]. Then, find lower and upper bounds for the probability of missing a deadline if there is more than one failure over [0, T + NTov ]. Use the total probability formula to derive expressions for lower and upper bounds of this probability. (b) Plot the upper bound of the deadline-missing probability as a function of N, where N varies from 0 to min(20, b(P − T )/Tov c). (b.1) Set λ = 10−5 , P = 1.0, Tov = 0.05, and plot curves for the following values of T : 0.5, 0.6, 0.7. (b.2) Set λ = 10−5 , P = 1.0, T = 0.6, and plot curves for the following values of Tov : 0.01, 0.05, 0.09. (b.3) Set P = 1.0, T = 0.6, Tov = 0.05, and plot curves for the following values of λ: 10−3 , 10−5 , 10−7 .

Solution: T + Tov . If ts ≥ t1 , a single point The slack time is ts = D − (T + NTov ). Define t1 = N+1 failure cannot cause a deadline miss, no matter when it occurs. On the other hand, if ts < t1 , a deadline miss will occur if more than ts of work is lost: the probability of this happening, given that exactly one failure has occurred is t1 − ts t1 For convenience, denote by pi the probability of the execution being hit by a total of i failures. The probability of a deadline miss is pmiss =

∞ X

pi P(Deadline miss if i failures|i failures)

i=1

A lower bound is obtained by using the inequality: P(Deadline miss if i failures|i failures) ≥ Prob{Deadline miss if 1 failure|1 failure} for i > 1, and an upper bound by Prob{Deadline miss if i failures|i failures} ≤ 1 Thus, a lower bound of the deadline miss probability will be: (1 − p0 )

t 1 − ts t1

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

4

Solutions to Chapter 6 Exercises An upper bound will be: p1

t1 − ts + 1 − (p0 − p1 ) t1

It only remains to calculate pi , i = 0, 1. From the laws of a Poisson process, we can conclude that p0 = e−λte . Now, consider the probability of exactly one failure over the entire execution. This is the probability that a failure happens sometime during the execution and that no subsequent failure occurs. Since the execution is broken down into a number of inter-checkpoint segments and the final segment, we can simply calculate the probability that one of these segments is hit by exactly one fault and that the others are not hit at all.

The probability, h(τ), that a segment of length τ is hit by exactly one fault can be calculated as follows: Zτ h(τ) = Prob{Segment hit for 1st time in [t, t + dt]} t=0

×Prob{No subsequent failures beyond t} Zτ = Prob{Segment not hit before t}Prob{Segment hit in [t, t + dt]} t=0

×Prob{No subsequent failures} Zτ

= e−λt λe−λτ dt = e−λτ 1 − e−λτ t=0

Now, the execution is broken down into N + 1 segments. N of these segments are of length T T + Tov and the last is of length τ2 = N+1 . From simple probability, we have τ1 = N+1

p1 =

N 1

h(τ1 )(1 − h(τ1 ))N−1 (1 − h(τ2 )) + (1 − h(τ1 ))N h(τ2 )

7. In this problem, we will study what happens if the checkpoint overheads are not constant over time, but vary. That is, there are times when the size of the process state is small and others when they are substantial. Suppose you are given this information, i.e., you have a function, Tov (t), the checkpointing overhead t seconds into the task execution. (a) Devise an algorithm to place checkpoints in such a way that the expected overall overhead is approximately minimized. (You may want to consult reference works on optimization for this). You can assume that if the execution time is T and failure occurs at constant rate λ, λT 1. (b) Let Tov (t) = 10 + sin(t). For T = 1000 and failure rate λ = 10−5 , run your algorithm to place the checkpoints appropriately.

8. Identify all the consistent recovery lines in the following execution of two concurrent processes: Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 6 Exercises

5

Solution: Denote the checkpoints of the top process by CP1 , CP2 , CP3 , CP4 , CP5 and the the checkpoints of the bottom process by CQ1 , CQ2 , CQ3 , CQ4 . The consistent recovery lines are: {CP1 , CQ1 }, {CP1 , CQ2 }, {CP1 , CQ3 }, {CP2 , CQ2 }, {CP2 , CQ3 }, {CP3 , CQ2 }, {CP3 , CQ3 }, {CP4 , CQ3 } and {CP5 , CQ4 }.

9. Suppose you are designing a checkpointing scheme for a distributed system specified to be single-fault-tolerant. That is, the system need only guarantee successful recovery from any one failure: a second failure before the system has recovered from the first one is assumed to be of negligible probability. You decide to take checkpoints and carry out messagelogging. Show that it is sufficient for each processor to simply record the messages it sends out in its volatile memory. (By volatile memory, we mean memory that will lose its contents in the event of a failure).

Solution: See D. B. Johnson and W. Zwaenepoel, “Sender-Based Message Logging,” International Symposium on Fault-Tolerant Computing Systems (FTCS-17), 1987.

10. We have seen that checkpointing distributed systems is quite complex and that uncoordinated checkpointing can give rise to a domino effect. In this problem, we will run a simulation to get a sense of how likely it is that a domino effect will happen.

You have N processors, each of which has its own clock. A processor checkpoints when its clock reads nT for n = 1, 2, · · · . Each processor has its own clock. If t is the time told by a perfect clock, the time told by any of these clocks is given by t + , where is uniformly distributed over the range [−∆, ∆]. The clocks are therefore synchronized with a maximum skew between any two clocks of 2∆.

The messages sent out by the processors can be modeled as follows. Each processor generates messages according to a Poisson process with rate µ; any message can be to any of the N − 1 other processors with equal probability.

Failures strike processors according to a Poisson process with rate λ and processors fail independently of one another.

Write a simulation to evaluate the probability that the domino effect happens in this system. (If you are not familiar with how to write such simulations, look through Chapter 9.)

Study the impact of varying N, ∆, λ, and µ. Comment on your results.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 7 Exercises 1. You have a controlled plant with just one state variable, x(t). Its dynamics are given by the differential equation dx(t) = −5x(t) + 3u(t) dt where the actuator input is specified by the scalar u(t). The plant’s allowed state space is −5 ≤ x(t) ≤ 5. Assume the time units for the differential equations are in seconds.

Zero-order hold is used with period 0.1 second. (That is, the control is updated every 0.1 second, with the actuator setting being held constant throughout that period.) Your actuator is physically limited to the range −1 ≤ u(t) ≤ 1. No matter what the computer may demand, you cannot deliver a control output outside that range.

Determine if fault-tolerance is needed for the cyber platform if the current state is: • (a) x(0) = 0.

• (b) x(0) = 2.

• (c) x(0) = −4.8.

• (d) x(0) = 4.

Solution: 2. You have points in some 4-dimensional space. Define x = (x1 , x2 , x3 , x4 ), y = (y1 , y2 , y3 , y4 ) as two points in that space and A = {1, 2, 3, 4}. Which of the following functions satisfies the properties of a distance measure: • (a) d(x, y) = mini∈A {xi − yi }

1

2

Solutions to Chapter 7 Exercises • (b) d(x, y) = maxi∈A {xi − yi } • (c) d(x, y) = maxi∈A {xi } − maxi∈A {yi }.

• (d) d(x, y) = |x1 − y1 |.

Solution: 3. A set of ten redundant sensors, K = {s1 , s2 , · · · , s10 } is measuring temperature. The error half-width of each measurement is 1o C. The reported temperatures are 100, 101, 104, 105, 106, 110, 105, 106, 117, 103, respectively. Execute the edge-deletion approach and draw the resulting graph. If the threshold for outlier detection is for a node to have fewer than three neighbors, indicate the outlier nodes. (These will be suspected as having suffered at least transient failure.)

4. You have a set of six sensors reporting the following values over the past several sampling periods: ~v1 ~v2 ~v3 ~v4 ~v5 ~v6

: : : : : :

{100, 103, 105, 103, 101, 100, 150, 152} {100, 102, 104, 100, 100, 100, 140, 139} {100, 103, 105, 103, 101, 100, 153, 147} {100, 107, 105, 108, 101, 100, 149, 157} {100, 103, 105, 103, 101, 100, 150, 157} {100, 103, 105, 103, 201, 200, 250, 252}

Calculate the trust rank of each sensor.

Solution: 5. A CPS calculates the function, f(v1 , v2 , v3 ) = v31 + v2 v3 − v1 v2 v3 based on sensor reported values it receives for v1 , v2 , v3 . These are: v1 = 5 ± 1; v2 = 4 ± 3; v3 = 1 ± 0.1. Calculate the uncertainty half-width of f(v1 , v2 , v3 ) for these data.

Solution: 6. The approach to dealing with task overruns can also be used for providing reserve capacity to run additional tasks if a processor fails and its assigned tasks have to be transferred to others. Discuss how this can be done.

7. Derive Equation 7.1 using Bayes’s Law, explicitly showing each step in the process.

8. Construct a set of periodic tasks by selecting their period, nominal execution time and deadline so that the overrun of an iteration of one task leads to the overrun of at least one iteration of every other task.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 7 Exercises

3

9. Show that under the Isolation approach described in Section 7.4.1, the maximum time between activity on a processor by server i is δi .

10. In the aircraft example in Section 7.5, suppose we pick L = (−65.0 1.5 2.6)T . Consider the case where noise is negligible, and where the elevator is stuck at 0.1 radians. A command to set the elevator at 0 radians is sent out. Plot the quantity y ^ (k) − ~y(k) as a function of k; this is the difference between what was expected at the observed pitch angle and what was observed. Assume any reasonable initial state of the aircraft.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 9 1. You are given a set of 10 processors which are believed to follow a Poisson failure process, with failure rate λ per hour per processor. You run the processors for a week, and obtain the following numbers of failures for each processor: 2,2,2,1,1,2,2,2,0,2. (a) What is your estimate for the value of λ? (b) Construct a 95% confidence interval for λ using Equation 9.1. (c) Construct a 95% confidence interval for λ using the fact that for the Poisson distribution E(x) = Var(x) = λ. (d) Explain the difference between the results of parts (b) and (c).

Solution: (a) The average number of failures per week per processor is 2+2+2+1+1+2+2+2+0+2 = 1.6 10 Since there are 168 hours per week, the estimated hourly failure rate is 1.6/168 = 0.009524. (b) Our unbiased estimate of the variance of the failure rate per hour is P10

i=1 (Xi /168 − 0.009524)

10 − 1

2

= 1.73217 × 10−5

The estimate of the standard deviation is therefore The 95% confidence interval is

√

1.73217 × 10−5 = 4.16194 × 10−3 .

[0.009524 − 1.96 × 4.16 × 10−3 , 0.009524 + 1.96 × 4.16 × 10−3 ] = [0.0014, 0.0177]

1

2

Solutions to Chapter 9 (c) If the variance is estimated at 0.009524, the estimate of the standard deviation is 0.09759. The 95% confidence interval is [0.009524 − 1.96 × 0.09759, 0.009524 + 1.96 × 0.09759] = [−0.18175, 0.20080] Note that this confidence interval extends to a negative value of λ, which is absurd on practical grounds; we know that λ ≥ 0, so that the lower estimate is never below 0. (d) In (c), we exploit our knowledge that the failure process is Poisson; in (b), we use the Central Limit Theorem directly. In connection with this, we should point out that the Central Limit Theorem is an asymptotic result, which applies in cases involving a large number of data points. The number of observations in our case is just 10, which is much lower than statisticians would be comfortable with. When observations are so few, any deductions drawn from them must be regarded as suspect.

2. You are given a set of 10 processors which are believed to follow a Poisson failure process, with failure rate λ per hour per processor. The prior density of λ is a uniform distribution over the range [0.001, 0.002]. (a) You run these processors for 100 hours without any of the processors failing. What is the best estimate for the value of λ (the mean of the posterior density of λ)? (b) You continue the experiment for a total of 10, 000 hours without observing any failures. What is your best estimate for λ? (c) Suppose you were to run this experiment for a very long time without any processor failing. What do you think the posterior density function for λ would be?

Solution: (a) For notational convenience, denote by E the event that no failure occurred among any of the processors over a 100-hour period.

The prior density of λ is 1000 inside the range [0.001, 0.002] and 0 outside it. The posterior density is given by f(λ|E) = = = =

Prob{E|λ}f(λ) Prob{E} R0.002

1000e−1000λ

λ=0.001 Prob{E|λ}f(λ)dλ 1000e−1000λ

R0.002

λ=0.001 1000e 1000e−1000λ

−1000λ dλ

e−1 − e−2

(b) First, find the posterior density under these circumstances: proceeding along the same lines as (a), we obtain the posterior density as f10000 (λ) = R0.002

1000e−100000λ

λ=0.001 1000e

−100000λ dλ

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

=

100000e−100000λ e−100 − e−200

c 2020 Elsevier Science (USA) – Do not copy

3

Solutions to Chapter 9 over the range [0.001, 0.002]. The average is given by Z 0.002 101e−100 − 201e−200 λf10000 (λ)dλ = e−100 − e−200 λ=0.001

(c) If we run this for a very long time without any failures being observed, the posterior density function of λ will approach a delta function at λ = 0.001.

3. This question follows up on our comments on the difficulty of validating the reliability of a life-critical system to a sufficiently high level of confidence.

Suppose you were calculating the confidence interval for the reliability of a life-critical system whose true failure probability over a given interval of operation is 10−8 . (Of course, you don’t know that this failure probability is 10−8 , which is why you are gathering statistics). Obtain an estimate of the number of observations you would require to show with 99.999999% confidence that the true failure probability is in the range [0.9 × 10−8 , 1.1 × 10−8 ].

You will need, for this question, an algorithm to calculate the values of the normal distribution with sufficient accuracy. It should not be difficult to find one through an Internet search: see, for example, B. D. Bunday, S. M. H. Bokhari, and K. H. Khan, “A New Algorithm for the Normal Distribution Function,” Sociedad de Estadistica e Investigacion Operativa Test, Vol. 6, No. 1, pp. 369–377, 1997.

Solution: If Φ(x) is the distribution of the normal distribution with mean 0 and standard deviation 1, then we are looking for x such that Φ(x) = 0.999999995. This value of x is approximately 6.1.

The half-width of the confidence interval is therefore 6.1σ, where σ is the standard deviation of the estimate. If the true underlying probability of failure is 10−8 , the variance of the estimate after n observations is 10

−8 ×(1−10−8 )

n

−8

≈ 10n . The standard deviation is therefore

−4

σ = 10√n . We want the half-width of the estimate to be no greater than 0.1 × 10−8 , i.e., we want 6.1σ ≤ 0.1 × 10−8 . This leads to n ≥ 3.721 × 1011 .

4. Evaluate RANDU, which was a routine widely used many years ago to generate uniform random numbers. Its recurrence is Xn+1 = (65539Xn ) mod 231 . Pick X0 = 23 and use each of the methods described in Section 9.4.2. Software for the spectral test can be found on the Internet.

5. Repeat Problem 4 for the random number generator that is included in your favorite computer system or spreadsheet.

6. Given a uniform random number generator, obtain a generator for continuous-valued random variables with the following probability density functions. Assume that the densities are 0 outside the specified ranges, and that µ1 and µ2 have known values. (a) f1 (x) = 0.25,

16 ≤ x ≤ 20.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

4

Solutions to Chapter 9 (b) f2 (x) = 0.4µ1 e−µ1 x + 0.6µ2 e−µ2 x , x ≥ 0.

1 4 −x (c) f3 (x) = 24 x e , x > 0.  if 0 ≤ x ≤ 1  x 2 − x if 1 ≤ x ≤ 2 (d) f4 (x) =  0 otherwise

Solution: (a) Output 16 + 4U. (b) Generate U1 and U2 . If U1 < 0.4, output −(1/µ1 ) ln U2 ; otherwise output −(1/µ2 ) ln U2 . (c) Try the rejection method, with g(x) = µe−µx , x > 0. We have to show that the ratio f(x)/g(x) is everywhere finite for x > 0 and then pick µ to minimize the maximum value taken by this ratio.

Showing that the ratio is everywhere finite is easy: simply find its maximum value and show that it is bounded. We have f(x)/g(x) = (1/µ)x4 e−x(1−µ) Obviously, we have to pick µ < 1. Using calculus, we can conclude that this ratio is 44 e−4 maximized for x = 4/(1 − µ): at that point, the ratio is equal to r(µ) = µ(1−µ) . To make the rejection method as efficient as possible, we want to pick µ to minimize r(µ): it is easy to see that this happens for µ = 1/2. So, use g(x) = 21 e−x/2 , for which c = 43 e−4 . (d) We observe that this function has a triangular shape and is symmetric about x = 1.

With probability 1/2, we have 0 ≤ x ≤ 1; and with probability 1/2, we have 1 < x ≤ 1.

This suggests the following approach. Define a random variable, Y, with density function g(x) =

2x if 0 ≤ x ≤ 1 0 otherwise

and random variable Z with density function h(x) =

2(2 − x) if 1 < x ≤ 2 0 otherwise

√ √ We can generate Y and Z by the inverse transform method: Y = U and Z = 2 − U. So, generate random variable U2 uniform over [0, 1]. If U2 ≤ 1/2, output Y; if U2 > 1/2, output Z. 7. Generate discrete random variables with the following probability mass functions (assume that the parameters have known values): (a) Prob{X = n} = p(1 − p)n−1 ,

n = 1, 2, 3, · · · ;

(b) Prob{X = n} = e−λ λn /n!,

n = 0, 1, 2, · · · ; λ > 0.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

0 < p < 1.

c 2020 Elsevier Science (USA) – Do not copy

5

Solutions to Chapter 9    0.25  0.50 (c) Prob{X = n} = 0.25    0

if n = 1 if n = 2 if n = 3 otherwise

(d) Prob{X = n} = 0.7e−λ λn /n! + 0.3e−2λ (2λ)n /n!.

Solution: Pi For convenience, define pi to be the probability that X = i. Define Pi = j=0 pi ; set P−1 = 0. Generate random variable, U, uniformly distributed over [0, 1]. If U ∈ [Pi−1 , Pi ), output i. This approach can be followed for each of the probability mass functions listed above.

8. When deriving the generator for exponentially distributed random variables, we showed that −(1/λ) ln(1 − U) would work. However, we also pointed out that −(1/λ) ln U would also yield exponentially distributed random variables. Prove that this is the case.

Solution: The proof follows immediately from the fact that 1 − U and U both have the same distribution.

9. When proving the correctness of the rejection method, we omitted some steps. Complete the proof with these steps in place.

Solution:

Prob U ≤

Z∞

f(Y) cg(Y)

Prob U ≤

= y=−∞ Z∞

f(Y) |Y = y cg(Y)

g(y)dy

f(y) g(y)dy cg(y) y=−∞

=

Z∞

f(y) 1 dy = c c y=−∞

=

Prob U ≤

f(Y) |Y ≤ x cg(Y)

Z y≤x

g(y|y ≤ x) = Prob U ≤

f(Y) |Y ≤ x cg(Y)

Prob U ≤

=

=

f(Y) |Y = y, Y ≤ x cg(Y)

g(y|y ≤ x)dy

g(y) G(x) Z

f(y) g(y) F(x) dx = cG(x) y≤x cg(y) G(x)

10. Write a simulation program to obtain the mean time to failure (MTTF) of the system shown below.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

6

Solutions to Chapter 9 10 1

3 2

3 87

2 1

100

0 53

11. Write a simulation program to find the MTTDL of a RAID Level 3 system, consisting of eight data disks and one parity disk. The disks fail independently, according to a Poisson process with rate 10−7 per hour. The repair time (in hours) has an exponential density with mean 1 hour. (a) Estimate the mean time to data loss, MTTDL. (b) Derive the 99% confidence interval for the MTTDL after running a total of 1000 simulation runs. (c) Determine how many runs are required to make the width of the 99% confidence interval less than 10% of the estimated MTTDL (from part (a)). (d) Vary the number of simulations from 1000 to 10000, and plot the width of the confidence interval over this range.

12. Repeat the above simulation, using the method of antithetic variables. Compare the widths of the 99% confidence interval you obtain with the two approaches, for an identical total number of simulations ranging from 1000 to 10000.

13. Repeat the above simulation, using the method of importance sampling. Use the balanced failure biasing technique. Vary the value of p∗ from 0.1 to 0.9, in steps of 0.1, and run 1000 simulations for each such value. Plot the width of the 99% confidence interval as a function of p∗ .

14. Consider the example discussed in Section 9.3.3. Suppose you carry out a few runs to get a rough estimate of π1 and π2 , and end up with π^1 = 0.9 and π^2 = 0.98. Your simulation time budget allows you to carry out a total of 1000 simulation runs, so that n1 +n2 = 1000.

What values should you select for n1 , n2 to minimize the variance of your estimate of the failure probability, π.

Solution: The variances are V1 = 0.9 × 0.1 = 0.09 and V2 = 0.98 × 0.02 = 0.196. This is because the variance of a Bernoulli random variable with parameter π is given by π(1 − π). Hence, we have (5/7)2 × 0.09 (2/7)2 × 0.196 + Var(π) ^ = n1 1000 − n1 For convenience, define k1 = (5/7)2 × 0.09 = 0.045918 and k2 = (2/7)2 × 0.196 = 0.016.

We want to pick n1 to minimize the quantity k1 k2 + n1 1000 − n1 Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

7

Solutions to Chapter 9 It is easy to see that this quantity is minimized for n1 = 629.

15. Simulate the following system. You have a processor that receives tasks with an inter√ √ −t arrival time density function of f(t) = (2/ π) te , t > 0 (this is called the Gamma (3/2, 1) density function). The processing time of each task is constant and equal to 1.

Checkpoints are placed every 0.1 time-units of job execution, and take a total of 0.02 time-units to complete execution.

The operating environment can be in one of two states: benign and harsh. The processor suffers transient failures according to a Poisson process with rate λbenign = 10−6 when it is benign; when it is harsh, the failure rate is λharsh = 10−4 per unit time. On a randomly chosen day, the environment is harsh with probability 0.2 and benign with probability 0.8.

There is no correlation between the state of the environment from one day to another.

The lifetime of a transient failure is exponentially distributed, with mean 0.2. This is a real-time system, and system failure is said to happen if a task is not completed within 10 units of its arrival. Tasks are served in the order of their arrival. (a) Write a simulation program to obtain the probability that the processor suffers system failure on a randomly chosen day. Vary the number of runs from 500 to 10000 and plot the width of the 99% confidence interval as a function of this number of runs. (b) Repeat (a), except that this time, use the method of stratified sampling. Compare the confidence interval widths you obtain in each instance.

16. Consider the system shown in Figure 9.1. Each block suffers failure independently of the

D T

A

3 E

B

P

In

Out

E C

T

3 D

Figure 9.1: Non-series-parallel system. others, according to a Poisson process with rates λA = 0.001, λB = 0.002, λC = 0.005, λD = 0.01, λE = 0.009, λT = 0.005, and λP = 0.00001 per hour. The subscripts refer to the block labels. The blocks marked 3 are perfectly reliable and never fail. The nodes In and Out represent the input and output points, and not blocks: they do not fail.

Each node takes an exponentially distributed amount of time to repair: the mean time to repair is one time unit for all nodes.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

8

Solutions to Chapter 9 Failure happens when there is no longer a path from the In node to the Out node. (a) Write a simulation program to obtain the Mean Time to Failure for this system.

Plot the width of the 99% confidence interval associated with simulation runs ranging from 500 to 10000. (b) Use the method of control variables and repeat part (a). (c) Repeat part (a) by using importance sampling with balanced failure biasing (p∗ = 0.2).

17. Repeat part (a) of the previous problem, with the blocks now suffering failure according to a non-homogeneous Poisson process, in which the failure rates are increasing functions of time. Use λi (t) = t1/3 λi , for i ∈ {A, B, C, D, E, P, T }. Assume that upon node repair, the effective age of that node become 0, i.e., that upon repair, we reset its t to 0.

18. Derive Equation 9.8.

19. (Requires a good background in probability theory) Consider a three-level splitting simulation. If ni , ptrue , i = 1, 2, 3 are as defined in Section 9.4, derive an expression for the i variance of the simulation result as a function of ni , ptrue . Assume that the simulations i starting from each level are independent of those from any other level.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 10 Exercises (c)

1. Derive an expression for the critical area Amiss (u) of square u × u missing-material defects in a conductor of length L and width w. Assume that one side of the defect is always parallel to the conductor, and that L w so that the non-linear edge effects can be ignored.

Solution: (c)

Amiss (u) =

0 if u < w L(u − w) otherwise

2. Use the polygon expansion technique to calculate approximately the critical area for circular short-circuit defects of diameter 3 for the 14 × 7 layout consisting of two conductors shown below.

1111111111111 0000000000000 0000000000000 1111111111111 0000000000000 1111111111111 0000000000000 1111111111111 0000000000000 1111111111111 0000000000000 1111111111111 0000 1111 0000000000000 1111111111111 0000 1111 0000000000000 1111111111111 0000 1111 0000 1111 0000 1111 0000 1111 0000 1111 0000 1111

Solution: The critical area is approximately 10 units (out of the 98 units). See the diagram below. (c)

3. Find the average critical area Amiss for circular missing-material defects in a single conductor of length L and width w using the defect size distribution in Equation 10.1 with

1

2

Solutions to Chapter 10 Exercises

1 0 0 1 0 1 0 1 0 1 0 1 0 1 0 1

1 0 0 1 0 1 0 1 0 1 0 1 0 1 0 1

1 0 0 1 0 1 0 1 0 1 0 1 0 1 0 1

1 1 0 0 1 0 1 0 1 0 0 1 1 0 1 0 1 0 1 0 0 1 1 0 1 0 1 0 1 0 0 1 1 0 1 0 1 0 1 0 0 1 1 0 1 0 1 0 1 0 0 0 0 0 01 1 01 1 01 1 01 1 0 1 0 0 0 0 01 1 01 1 01 1 01 1 0 1 0 0 0 0 01 1 01 1 01 1 01 1 0 1 0 1 1 0 1 0 1 0 0 1 1 0 1 0 1 0 0 1 1 0 1 0 1 0 0 1 1 0 1 0 1 0 0 1 1 0 1 0 1 0

1 0 0 1 0 1 0 1 0 1 0 1 0 1 0 1

1 0 0 1 0 1 0 1 0 1 0 1 0 1 0 1

1 0 0 1 0 1 0 1 0 1 0 1 0 1 0 1

1 0 0 1 0 1 0 1 0 1 0 1 0 1 0 1

1 0 0 1 0 1 0 1 0 1 0 1 0 1 0 1

p = 3. Assume that L w and ignore the non-linear term in Equation 10.6.

Solution: 2x2 x2 For p = 3, k = x2 0−xM2 .

M

0

(c) Amiss =

Z xM

L(x − w)kx−3 dx =

w

Lx20 (xM − w)2 w(x2M − x20 )

(c)

4. (a) Derive an expression for the critical area Amiss (x) of a circular missing-material defect with diameter x in the case of two conductors of length L, width w and separation s (as shown in Figure 10.1). Ignore the non-linear terms, and note that the expression differs for the three cases: x < w; w ≤ x ≤ 2w + s; and 2w + s < x ≤ xM . (c) (b) Find the average critical area Amiss using the defect size distribution in Equation Open−circuit critical area

x/2

w

s Defects

x/2

w

(x−w)

L

Figure 10.1: The critical area for missing-metal defects of diameter x.

10.1 with p = 3. For simplicity, assume xM = ∞.

Solution: (a)  if x < w  0 (c) 2L(x − w) if w ≤ x ≤ 2w + s Amiss (x) =  L(x + s) if 2w + s < x ≤ xM Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

3

Solutions to Chapter 10 Exercises (b) The average critical area for two conductors, if xM = ∞ (where k = 2x2o ), is Z 2w+s Z∞ L(3w + 2s)x2o (c) 2L(x − w)kx−3 dx + L(x + s)kx−3 dx = Amiss = w(2w + s) w 2w+s

5. A chip with an area of 0.2 cm2 (and no redundancy) is currently manufactured. This chip has a pof of θ = 0.6 and an observed yield of Y1 = 0.87. The manufacturer plans to fabricate a similar but larger chip, with an area of 0.3 cm2 , using the same wafer fabrication equipment. Assume that there is only one type of defects, and that the yield of both chips follows the Poisson model Y = e−θAchip d with the same pof θ and the same defect density d. (a) Calculate the defect density d and the projected yield Y2 of the second chip. (b) Let the area of the second chip be a variable A. Draw the graph of Y2 , the yield of the second chip, as a function of A (for A between 0 and 2).

Solution: (a) d = − ln 0.87/0.12 = 1.16 defects/cm2 and Y2 = e−0.6·0.3·1.16 = 0.81. (b) Y2 = 0.87A/0.2 = 0.498A 6. A chip of area Achip (without redundancy, and with one type of defects) is currently manufactured at a yield of Y = 0.9. The manufacturer is examining the possibility of designing and fabricating two larger chips with areas of 2Achip and 4Achip . The designs and layouts of the new chips will be similar to those of the current chip (i.e., same θ), and the defect density d will remain the same. (a) Calculate the expected yields of the two new chips assuming a Poisson model. (b) Calculate the expected yields of the two new chips assuming a Negative Binomial model with α = 1.5. (c) Discuss the difference between the results of (a) and (b) Solution: (a) Y(2Achip ) = Y(Achip )2 = 0.81; Y(4Achip ) = Y(Achip )4 = 0.656. (b) For the Negative Binomial model: Denoting λ = θAchip d, (1 + λ/1.5)−1.5 = 0.9 and λ = 0.109 Y(2Achip ) = (1 + 2λ/1.5)−1.5 = 0.816 ; Y(4Achip ) = (1 + 4λ/1.5)−1.5 = 0.682 (c) Due to the increased clustering of defects in the Negative Binomial model, more chips on the wafer will be fault-free and the yield will be higher.

7. A design consisting of ten identical modules has been manufactured and the observed yield was 0.1. (a) What is the average number of faults, λ, assuming a Poisson yield model? What is λ if the Negative Binomial model with α = 2 is assumed? (b) To increase the yield a single spare module has been added. Ignoring the increase in the area of the chip, calculate the yield of the new design for the Poisson and the Negative Binomial models.

Solution: (a) For the Poisson model λ = 2.3 and for the negative binomial λ = 4.32. (b) For the Poisson model the yield is 0.268 and for the negative binomial it is 0.25.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

4

Solutions to Chapter 10 Exercises 8. For a chip without redundancy assume that X, the number of faults on the chip, follows a compound Poisson distribution. (a) Use as a compounder the triangular density function

fL (`) =

` λ2 2λ−` λ2

0≤`≤λ λ ≤ ` ≤ 2λ

and show that it results in the following expression for the chip yield: Z 2λ

−`

Ychip = Prob{X = 0} =

e fL (`) d` = 0

1 − e−λ λ

2 (10.43)

(b) Now use as a compounder the exponential density function e−`/λ λ

fL (`) = and show that it results in

Z∞ Ychip = Prob{X = 0} =

e−` fL (`) d` =

0

1 1+λ

(10.44)

(c) Compare the yield expressions in Equations 10.1 and 10.2 to those for the Poisson and Negative Binomial models (for chips without redundancy) by drawing the graph of the yield as a function of λ for 0.001 ≤ λ ≤ 1.5. For the Negative Binomial model, use three values of α, namely, α = 0.25, 2, and 5.

9. Why does the spare row in the figure below include a fusible link?

A0 , A0 A1 , A1

...

An ,

Fusible link

A0

...

A A0

Spare row

n

Solution: To disconnect this spare row if faulty cells are detected in it.

10. To a memory array with four rows and eight columns a single spare row and two spare columns have been added. The testing of the memory array has identified four defective Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

5

Solutions to Chapter 10 Exercises cells indicated by an x in the diagram below:  x 0 0 0 0  0 0 0 0 0   0 0 0 0 0 0 x 0 0 0

0 x 0 x

0 0 0 0

 0 0   0  0

(a) List two different ways to reconfigure the memory array, i.e., which rows and columns will be disconnected and replaced by spares. (b) Show a distribution of four defective cells within the array for which the available spares will not be sufficient. How many such distributions of four defective cells exist? (c) Given that there are four defective cells and that they are randomly distributed over the array, what is the probability of such an irreparable distribution?

Solution: (a) Either replace column 6 and use the remaining spare row and column to cover the two left defective cells, or replace row 4 and use the two spare columns to replace columns 1 and 6. (b) Four defective cells such that no two of them are in either the same row or the same column, can not be repaired. There are such 8 · 7 · 6 · 5 = 1680 distributions. (c) The total number of distributions of four defects is

32 4

and the probability is 0.048.

11. A 6 × 6 memory array with two spare rows and two spare columns is shown below in Figure 10.2. Show the corresponding bipartite graph, identify all the must-repair rows and columns, and select additional rows/columns to cover the remaining defective cells.

Will the column-first (row-first) algorithm, if applied after replacing the must-repair rows

R0 R1 R2 R3 R4 R5

x

x

x

x x x

x

x

x

SR0 SR1 C0 C1 C2 C3 C4 C5 SC0 SC1 Figure 10.2: A 6 × 6 memory array with two spare rows, two spare columns and nine defective cells (marked by an x). (must-repair columns), be able to repair the memory array?

Solution: R3 is a must-repair row and C4 is a must-repair column. After replacing these two Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

6

Solutions to Chapter 10 Exercises

R0

C0

R1

C1

R2

C2

R3

C3

R4

C4

R5

C5

by spares R0 becomes a must-repair row and is replaced, Finally, C3 is replaced by the remaining spare column.

If only the must-repair rows are replaced first and then the column-first algorithm is used, then R3 is replaced followed by replacing columns C0 and C1 leaving us with insufficient spares for the remaining defect. If only the must-repair columns are replaced first and then the row-first algorithm is used, then C4 is replaced followed by replacing rows R0 and R3 and finally column C3 yielding a repaired memory.

12. A chip consists of five modules, out of which four are needed for proper operation and one is a spare. Suppose the fabrication process has a fault density of 0.7 faults/cm2 , and the area of each module is 0.1 cm2 . (a) Calculate the expected yield of the chip using the Poisson model. (b) Calculate the expected yield of the chip using the Negative Binomial model with α = 1. (c) For each of the two models in parts (a) and (b), is the addition of the spare module to the chip beneficial from the point of view of the effective yield? (d) Discuss the difference in the answer to (c) between the two models.

Solution: (a) For each module, λ = 0.1 × 0.7 = 0.07.

Ypoisson (5 modules) = 5e−4λ (1 − e−λ ) + e−5λ = 0.96

(b) Ynb (5 modules) = 5 (1 + 4λ/1)−1 − (1 + 5λ/1)−1 + (1 + 5λ/1)−1 = 0.94 (c) Ypoisson (4 modules) = e−4λ = 0.76 Eff Ypoisson (5 modules) = Ypoisson (5 modules)/(5/4) = 0.77 > 0.76 = Ypoisson (4 modules) Adding the spare is beneficial under the Poisson model.

Ynb (4 modules) = (1 + 4λ/1)−1 = 0.78 Eff (5 modules) = Y (5 modules)/(5/4) = 0.75 < 0.78 = Y (4 modules) Ynb nb nb Adding the spare is not beneficial under the Negative Binomial model; it will increase the yield but decrease the effective yield. (d) The Negative Binomial model assumes increased clustering of faults, so that less chips will be faulty and the spare is less beneficial.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 11 Exercises 1. Construct an RSA encryption scheme using p = 61 and q = 53. Select the public key e = 17, which is obviously relatively prime to φ(pq). Find the corresponding private key d and for the message M = 123, calculate the ciphertext and show that that private key allows the decryption of the ciphertext.

Solution: n = pq = 3233 and the resulting private key is d = 2753. The ciphertext for the message M = 123 is 12317 mod 3233 = 855. Decrypting the cyphertext with the private key d yields 8552753 mod 3233 = 123.

2. Develop a software implementation of DES (or find one on the Internet) and apply the fault-based attack shown in Table 11.2. Modify the program to inject the faults, and write another program to find the secret key.

3. Complete the example (in the chapter) of injecting a fault into the private key d of an RSA decryption device that uses the public key (e, N) = (7, 77) and the private key (d, N) = (43, 77). Assume a ciphertext of 37 as in the example. List all possible single-bit errors and all double-bit errors that can be injected into d. For each error on your list find the erroneous plaintext that the device will produce. Are all the erroneous plaintexts unique?

Solution: i To simplify the solution we first find the values of 372 mod 77 for i = 0, 1, ·, 5. These values are: 371 mod 77 = 37, 372 mod 77 = 60, 374 mod 77 = 58, 378 mod 77 = 53, 3716 mod 77 = 37, and 3732 mod 77 = 60. The single-bit errors that can be injected into d and the corresponding erroneous plaintexts are listed below:

1

2

Solutions to Chapter 11 Exercises Erroneous d 001011 111011 100011 101111 101001 101010 Erroneous plaintext 4 25 67 60 4 71 The double-bit errors that can be injected into d and the corresponding erroneous plaintexts are listed below: Erroneous d 011011 000011 001111 001001 001010 110011 111111 111001 Erroneous plaintext 71 64 1 36 23 15 64 71 Erroneous d 111010 100111 100001 100010 101101 101110 101000 Erroneous plaintext 9 36 64 58 1 37 23 Clearly, not all the erroneous plaintexts are unique and as a result, a larger number of fault injections experiments will be needed to obtain all the bits of d.

4. Develop a software implementation of RSA (or find one on the internet), use the prime numbers p = 7 and q = 11 as in the example in this chapter and select e = 7. This yields the public key (e, n) = (7, 77) and the private key (d, n) = (43, 77). Inject single-bit failures in your program, and obtain all the bits of the private key.

5. Use the program and parameters from Problem 4 and add a residue check with the modulus 3. Repeat the single bit faults attack. Will the modified program detect all such faults?

6. Show that x8 mod g(x) = x4 + x3 + x + 1 for the generator polynomial of AES g(x) = x8 + x4 + x3 + x + 1.

Solution: Divide x8 by x8 + x4 + x3 + x + 1 to prove it.

7. Verify all 16 results of the MixColumns step that are shown in Figure 11.6 f.

8. Inject a single bit error in the state matrix shown in Figure 11.6 c replacing the first byte 19 by 18, and calculate the erroneous state matrix at the end of round 2. Compare your result to the matrix shown in Figure 11.6 h. How many bytes are in error?

Solution: The erroneous state matrix at the end of round 2 will be: 17 48 ab 95 68 9f 35 2b 6b 5b ea 43 02 6a 50 49 instead of a4 9c 7f f2 68 9f 35 2b 6b 5b ea 43 02 6a 50 49. Thus, 4 bytes are in error.

9. Suppose you are using AES with data blocks and key of size 128 bits. Your messages however are only 50-bit long. What would you put in the unused 78 bit positions?

Solution: You should put a random number in the remaining 78 bit positions rather than all 0s since using all 0s would simplify the task of crypto-analysis.

10. Verify the correctness of the parity prediction equations for the MixColumns step in AES. 11. (a) Why does AES use short keys (e.g., 128 bits) while RSA uses long keys (e.g., 1024 bits)? (b) AES has a larger plain text block size than DES (128 vs. 64). Is this an advantage?

Solution:

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy

Solutions to Chapter 11 Exercises

3

(a) RSA relies on the difficulty of factoring large integers and 128-bit numbers are not sufficiently large. AES relies on the difficulty of searching through 2128 possible keys. (b) Yes since it is less likely to have the same cyphertext repeat.

12. (a) Will eliminating the MixColumn step in AES make it more vulnerable to attacks?

Explain. (b) Will a single bit flip in the plaintext always result in 64 flipped bits in the ciphertext after an AES encryption?

Solution: (a) The MixColumn step is the only one that mixes columns. Without it one can attack one byte at a time at a complexity of 16 · 28 = 212 . (b) True on average but not for every plaintext.

Solutions for Fault-Tolerant Systems, 2nd Edition, by Koren and Krishna

c 2020 Elsevier Science (USA) – Do not copy