\documentstyle[fullpage]{article}
\title{Duplex and Triplex Designs}
\author{Greg Hudson}
\begin{document}
\maketitle

The article by Gray and Siewiorek describes how to construct fail-fast
devices using two or three copies of a modules and comparing their
outputs.  With online repair, these duplex and triplex designs greatly
improve the MTTF (Mean Time To Failure) of the device, but without
online repair, they actually decrease MTTF by a factor of one half for
the duplex design, and five sixths for the triplex design.  There are
circumstances, however, when it is impossible to repair a device
online, but where it is worthwhile to have a fail-fast device even
though it decreases the MTTF.

In some circumstances, module replacement is not feasible, either
because the system is physically inaccessible to repair personnel
(e.g. on a space satellite) or because the system is too highly
integrated (e.g. on a microchip).  However, if the operation is
critical, it may still be important to notice when the module fails
rather than allow it to run incorrectly.  Once the problem is noticed,
one can employ strategies other than module replacement to solve the
problem.  On a space satellite, there may be an entirely separate
backup system with a separate design, to which the satellite can
switch if the primary system fails.  The economy of microchips is such
that the entire chip can probably be replaced if any part of it goes
wrong.

Under other circumstances, online repair is not feasible, even though
offline module replacement may be.  In this case, a fail-fast
component still prevents the system from operating incorrectly.  In
particular, if a component simply fails rather than operates
incorrectly, this prevents failures from propagating to other modules.

Thus, while duplex and triplex designs reduce the MTTF of a device in
the absence of repair, they can improve the failure characteristics of
a system in some situations.

\end{document}

