# Error Recovery in the Time-Triggered Paradigm with FTT-CAN
## 4 Error Recovery in FTT-CAN
### The Need for Multiple Replicas  
Errors may affect equally messages and their replicas and may occur more than once per EC. Therefore, assuring (probabilistically) the delivery of messages with short deadlines may require re-scheduling several replicas for the same EC, as illustrated in Figure 4, where S stands for the error-server execution (notice that the error recovery would fail if single replica was used by the server). As fault arrivals are modeled by a Poisson process, it is not possible to upper bound the number of faults in any given time interval. However, for a fixed time interval, as the number of faults increases, their probability of occurrence decreases. Therefore, it is possible to compute the number of replicas that guarantees successful and timely transmissions with a reliability goal \(\rho>1-\varepsilon_{G}\), where \(\varepsilon_{G}\) is the maximum probability of failure or system/global unreliability level. The system reliability level is specified in acceptable errors per mission, where a generally accepted mission time is one hour ([PERSON], 2016), thus leading to a common metric of acceptable errors per hour. The system unreliability objective \(\varepsilon_{G}\) can be converted to the error probability that each individual message may tolerate, when considering the messages periods and mission time, being this probability named \(pe_{i}\). Equation (1) can be used and a good approximation of it is obtained using the first two terms of the Taylor series expansion, possible due to very small values of \(pe_{i}\). The new formulation can be solved by upper bounding the \(i\) terms, using the smallest value of \(T_{i}\) and the biggest \(pe_{i}\) (worst GP value will be obtained). Afterwards making all \(n\) elements equal to this bound and applying again Taylor series approximation, as previously, the limit probability \(pe_{i}\) can be obtained. These steps are depicted in Equations (6) and (7). \[GP=\prod_{i=1}^{n}(1-pe_{i})^{\frac{MT}{T_{i}\times LEC}}\cong\prod_{i=1}^{n} \left(1-\frac{MT}{T_{i}\times LEC}pe_{i}\right)\cong 1-n\times\frac{MT}{T_{i} \times LEC}pe_{i} \tag{6}\]  
Figure 4: Message and replica hit by errors. Figure 3: Error recovery process. \[1-n\times\frac{MT}{T_{i}\times LEC}p_{\varepsilon_{i}}=1-\varepsilon_{G}\Leftrightarrow p \varepsilon_{i}=\frac{\frac{\varepsilon_{G}}{\left(\frac{MT}{T_{i}\times LEC} \right)}}{n} \tag{7}\]  
Equation (7) then defines an acceptable fail probability for a given message \(i\), where \(T_{i}\) is the message period (in number of ECs), MT is the mission time and \(n\) is the number of messages subject to the recovery mechanism. This equation shows that the most demanding messages, i.e., with lower \(p\varepsilon_{i}\), are those with smallest period. Since the error-handling mechanism is the same for all messages, design decisions will be made while considering the smallest \(pe_{i}\) value, denoted as \(pe\). Figure 5 depicts a set of representative error scenarios that will be used to obtain a general expression for computing the number of replicas needed to attain a given system reliability level. In practice, the values of \(\lambda\), \(LSW\) and \(pe\) limit the number of scenarios that must be considered. Let us start with the \"one error/one replica\" scenario, shown on the top timeline of Figure 5a. This event sequence occurs if one error affects a TT message, event with probability \(P_{\lambda}(1;\text{LSW})\), and the corresponding replica is also affected by an error, event with probability \(P_{\lambda}(1;\text{C}_{i})\). As errors are independent, the resulting probability (\(p_{1/l}\)) is given by the product of both probabilities. Therefore, the probability of this scenario is given by Equation (8), where message transmission times are upper bounded by \(C_{MAX}\), to enable the derivation of generic equations. If the probability obtained via Equation (8) is lower than \(pe\), then a single replica is enough to guarantee the desired message transmission reliability level. Otherwise, an additional replica must be sent.