## 5 Modelling Rationale
### Modelling Assumptions
#### 5.3.2 Failure Model and Fault-Tolerance Coverages of the Modelled System  
The failure model of a system includes the failure modes of each one of its components. Therefore, we need to specify the failure modes of all the devices included in the system, i.e., in this case the devices of the network. The failure modes that constitute the failure model, as well as the proportions with which they manifest, have a strong influence on the system reliability. Thus, we take both these aspects into account while defining our models. To better understand the influence of the failure modes, we are going to use a simplified version of the failure mode hierarchy used in [30], which is, at the same time, an extended version of the hierarchy presented in [31]. The simplified version we use in this paper is shown in Figure 5. This hierarchy classifies the failure modes that a system can exhibit in terms of their degree of restriction, being the inner failure modes more restricted, in terms of the faulty behaviours compatible with the mode, than the outer modes. Additionally, inner failure modes are more benevolent and easier to deal with, while outer failure modes are harsher and harder to deal with. We next describe those failure modes relevant to understanding this work:  
Byzantine: lack of restrictions on the way the system can behave. It includes two-faced behaviours, i.e., a faulty device sending different information to different devices, and impersonations, i.e., a faulty device pretending to be a different device. Incorrect computation: the system delivers an incorrect result, either in the value or the time domain, but without showing two-faced behaviours nor impersonating other systems. Performance: the system delivers a correct result in the value domain, but fails to do it in the time domain. Omission: the system delays the delivery of a result forever. As we have already explained in Section 4, temporary faults affecting a link are assumed to provoke an omission. This means that we will assume that the only failure mode that links exhibit is omission. The consequence of a frame omission on the reliability metric depends on whether the network is provided with space or time redundancy. A frame omission in a given path prevents the listener from receiving the corresponding message edition through that path, unless the frame is replicated in the time domain in that path. In the particular case of the analyses presented here, we are considering that the network does not have space redundancy, i.e., the stream traverses a single path, both if TSN or PTRF is considered. In the case of TSN, since it does not count with any time redundancy mechanisms, only one copy of each message edition is transmitted through the path. As a consequence, if a temporary fault in a link corrupts a frame, the conveyed message edition does not reach its destination, provoking the failure of the stream. Conversely, PTRF transmits through the path several replicas of the frames that convey each message edition. Thus, the omission of a replicated frame does not provoke the failure of the stream, as long as the listener receives at least one replica of that replicated frame. As regards bridges and end-systems, they are assumed to exhibit Byzantine failures, when faulty. The impact of such failures on the exchange of frames through the stream depends on the following aspects: (i) whether or not space redundancy is used; (ii) whether the faulty device is TSN or PTRF-enabled; (iii) whether the faulty hardware is involved in the transmission or the reception capabilities of the device, i.e., whether it affects an output or an input port; (iv) how the faulty hardware can affect the transmission/reception operations of the device. Table 1 specifies the expression used to model the unreliability of bridges and end-systems; the proportions of their different failure modes; and the impact of each failure mode on the reliability metric that we have defined in the previous subsection when using TSN and PTRF with a single path.