## 5 Modelling Rationale
### Modelling Assumptions
#### 5.3.2 Failure Model and Fault-Tolerance Coverages of the Modelled System
A fault affecting the PTRF transmission components may manifest as the two following failure modes in addition to the Byzantine failure mode of TSN transmission devices: (i) queuing corrupted frame replicas, or (ii) queuing an incorrect number of frame replicas. Table 2 also explains these two failure modes and their impact. The first one provokes the failure of the stream. In contrast, the second one only provokes such a failure when it creates more replicas than expected (\(n>k\)), as having more frames in the network would cause the schedule to be violated, or when it creates no replicas (\(n=0\)). Otherwise, this second failure mode simply reduces the ability to tolerate further faults affecting the message edition (\(0<n<k\)). The proportion of these PTRF-specific failure modes can be parameterised in the model, but Table 1 shows the proportions selected for our sensitivity analysis. We can see in the table that the proportion of the TSN Byzantine and the buffered failure modes in the output port of PTRF talkers and bridges is 83.33% (labelled as \"TSN + buffer\" in the table). Let us explain how we obtain this value. As we have previously said, we assume that the failure rate of PTRF devices is 50% higher than for TSN ones due to the extra hardware required by PTRF, i.e., TSN's logic occupies 2/3 of the hardware while PTRF's logic occupies 1/3. We then assume that TSN's Byzantine failure mode has a proportion of 2/3 (66.67%), while PTRF's failure modes have a proportion of 1/3 (33.33%). On top of that, we assume that the failure modes of PTRF's transmission are equiprobable, i.e., the probability of frame replicas being corrupted in the buffer and the probability of creating the wrong number of replicas are the same (50%), and 50% of a proportion of 1/3 is 16.66%. Since the corruption of frames in the replication buffer always causes the failure of the stream, just like TSN Byzantine failures, we can group these two failure modes into a single failure mode with a proportion of 66.67% + 16.66% = 83.33% (TSN + buffer). On the other hand, since the faults that affect the replica creation counter do not always result in the failure of the stream, we cannot group this failure mode with the ones previously discussed. Since the proportion of faults that affect the replication counter is 16.66% and we assume that the probability of creating more replicas than expected is the same as creating less, we obtain a failure mode proportion of 8.33% for \(n>k\) and 8.33% for \(n<k\). On the other hand, a fault affecting the PTRF reception components may manifest as in TSN, but also in the following two ways: (i) by failing to eliminate all surplus replicas of a message edition upon reception, or (ii) by eliminating all replicas of a message edition upon reception. Table 2 further explains these failure modes and why both of them cause the failure of the stream. As we can see in Table 1, faults in the reception of bridges and listeners always cause the stream to fail. Thus, we group all the failure modes into one which we call fail to eliminate that has a proportion of 100%. Finally, another important aspect that has an important impact on dependability in general, and on reliability in particular, is the value of the coverage associated with the FT mechanisms. Coverage can be roughly defined as the probability with which a system or fault-tolerance mechanism behaves as intended. We find different types of coverage. First, we find the assumption coverage, which refers to the probability with which faults  
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Component Failure** & **Description** & **Stream Failure** \\ \hline Frames corrupted in the replication buffer & Temporary faults can result in the corruption of frames before they are replicated, e.g., due to a bit flip. If the frame that is going to be replicated is corrupted, all the replicas will be corrupted too and the receiver will drop them when checking the CRC.