A dual system (デュアルシステム) runs the same processing on two systems at the same time and operates while comparing the results they produce.
Input
Both systems run the same processing
Compare the two results
Output
Keeping devices or systems in duplicate, spares included, so that a single failure does not stop the service is called a redundant configuration, and a dual system is one form of it. When the two results disagree, you know one side has gone wrong, so the system can even confirm that its processing is correct. Because both systems are always running, equipment and operating costs are high.
AnalogyIt is like two clerks each adding up the same invoice and checking their answers against each other before handing it in.
How to rememberDual means "both": both systems are always running the same processing.
Exam points
ExamIn a dual system (デュアルシステム), two systems carry out the same processing in parallel and check their results against each other to raise reliability (信頼性).
ExamSince both systems in a dual system are always processing, the remaining one carries on when the other fails, giving shorter downtime than a configuration that moves the work over to a standby system.
In a duplex system (デュプレックスシステム), only the primary system handles the work in normal operation, while a second standby system waits in case of failure.
Primary system processes
Primary system fails
Switch to standby system
Standby system keeps processing
Once the switch is complete, the standby system carries on in place of the primary system.
4 / 4
The primary system is also called the active system, and the standby system takes over processing when the primary fails. While waiting, the standby system may also be given other work. After the primary fails, processing stays stopped until the switch to the standby system is complete.
AnalogyThink of the starting player on the field and the substitute waiting on the bench for a turn.
Exam points
Mix-upA dual system (デュアルシステム) and a duplex system (デュプレックスシステム) differ in whether, in normal operation, both systems run the same processing and compare the results, or only the primary system (主系) runs it.
ExamIn a duplex system (デュプレックスシステム), how long processing stops after the primary system fails depends on the state the standby system (待機系) is kept in.
Hot standby (ホットスタンバイ) keeps the standby system already running so that it can take over the moment the primary system fails.
The standby system is powered on, with the programs it needs already up and running. Switching over therefore takes little effort, and users see only a very brief interruption. The trade-off is the cost of keeping the equipment running even while it waits.
AnalogyLike a taxi idling at the stand with its engine on, it can pull away the instant someone hails it.
How to rememberHot means already warmed up, so the machine can go right away.
Exam points
ExamUnder hot standby (ホットスタンバイ), the standby system (待機系) waits ready to process at any time and takes over the work immediately when a failure occurs.
Cold standby (コールドスタンバイ) keeps the standby system shut down and, after the primary system fails, starts it up before switching over.
Primary system fails
Start up and prepare standby system
Standby system takes over
Once everything is ready, the standby system takes over and business resumes.
3 / 3
The standby system is left powered off, or at least not yet processing anything. Because it has to be started and configured after the failure occurs, it takes a while for business to resume. The equipment does not run while it waits, so upkeep costs are low.
AnalogyOn a winter morning, a car that has gone stone cold cannot leave until the engine has been started and warmed up.
Exam points
ExamCold standby (コールドスタンバイ) has to begin by starting up the standby system (待機系), so downtime after a primary failure is longer than with hot standby (ホットスタンバイ).
Mix-upHot standby (ホットスタンバイ) and cold standby (コールドスタンバイ) differ in whether the waiting standby system is running or stopped, and that difference accounts for the gap in switchover speed and cost.
Fault tolerant (フォールトトレラント) design arranges a system so that, even if part of it fails, the whole keeps processing.
One part fails
A spare part takes over
The whole keeps running without stopping
It starts from the premise that failures can never be eliminated and builds in advance a configuration that copes when something breaks. A redundant configuration can be seen as this idea put into practice at the level of whole systems. The noun form is fault tolerance (フォールトトレランス).
AnalogyAn airliner with several engines can keep flying on the others if one of them quits.
How to rememberFault means a failure and tolerant means able to bear it: a system that bears its faults and keeps going.
Exam points
ExamFault tolerant (フォールトトレラント) design aims to keep processing after a failure, preparing in advance so that no single fault brings the whole system down.
ExamThe typical way to achieve fault tolerance is duplicating hardware (多重化), that is, hardware redundancy, so the remaining parts pick up the work of the part that broke.
Fail-safe (フェールセーフ) design moves a system to an action on the safe side when something goes wrong, whether from a failure or an operating mistake, so the damage does not spread.
A failure, error or other fault occurs
Move to a safe action such as stopping
Keep accidents and damage from spreading
At the design stage, engineers decide which behavior carries the least danger when something goes wrong and make the system fall back to it. In most cases the safe side means stopping the machine or cutting off its output.
AnalogyA level-crossing barrier built to drop under its own weight when the power goes out will, even when it breaks, end up blocking the road.
How to rememberFail plus safe: when it fails, it fails toward safety.
Exam points
ExamFail-safe (フェールセーフ) design keeps the system in a safe state not only when equipment fails but also when an operating mistake occurs.
Mix-upFault tolerant (フォールトトレラント) design puts continued processing after a failure first, while fail-safe (フェールセーフ) design puts safety first, even if that means stopping.
Fool-proof (フールプルーフ) design assumes users will make operating mistakes and either prevents wrong operations or makes them harmless when they happen.
Form of safeguard
Everyday example
Make the wrong operation physically impossible
A socket that will not accept a plug inserted the wrong way
Do not run until conditions are met
A microwave that will not start heating until the door is shut
Designers treat people as bound to slip up out of habit or assumption and build in mechanisms that keep those slips from turning straight into accidents or failures. These safeguards usually sit in the parts users touch, such as the shape of a device or the layout of a screen.
AnalogyLike a medicine cap a child cannot easily open, it plans for the user's carelessness from the start.
How to rememberThe proof here is the same as in waterproof: able to withstand something, in this case a novice's handling.
Exam points
ExamFool-proof (フールプルーフ) design guards against human operating errors (誤操作), so that a user's mistake does not lead the system into a dangerous state or a wrong result.
ExamFool-proof safeguards include not only making a wrong operation physically impossible but also, for example, using an on-screen message to prompt the user to review the operation.
An abnormality that has already occurred (a failure or an operating mistake)
The human operation itself
What the safeguard does
Moves to a safe state
Prevents wrong operations, or makes them harmless when they happen
Everyday example
A crossing barrier that drops when the power fails
A microwave that will not run with the door open
Key points
In a redundant configuration, how the spare system is kept determines the trade-off between a short interruption on failure and the cost of normal operation.
Preparing for failures means assuming that faults and mistakes will happen sooner or later and deciding in advance on configurations or behaviors that cope when they do.
Human error can be handled not only by mechanisms that prevent wrong operations but also by mechanisms that keep things safe even when a mistake is made.