Verification of a Control System Built Using Remote Redundancy by Means of Timed Automata and State Space Exploration

Abstract

Remote redundancy is a novel efficient TMR (triple modular redundancy) structure for real-time control systems. It allows for 2-out-of-3 voting by using only two redundant computing nodes (called local nodes) with access to sensor and actuator peripherals. The third node of the TMR structure is replaced just by a remote process on any node in the network, where some computing capacity is available. This approach significantly reduces the amount of hardware redundancy at the cost of both an increased communication overhead (which is not problematic in modern real-time networks) and an increased complexity. To nevertheless assess the correctness of the approach, this paper presents a functional model using a network of timed automata, allowing to prove the accurate behavior of a fault-tolerant example system under the influence of different fault scenarios. By state space exploration, that verification has successfully been achieved, confirming the results of prior fault tree analysis conducted by the authors and thus providing a well-founded basis for further experimental research on the subject.