Skip to main content

Triple modular redundancy; reliable C/S

Short answer

Triple modular redundancy replicates each component three times and uses a majority voter to mask one faulty unit. Reliable client-server communication handles lost messages by retransmission with idempotent operations or sequence numbers, server crashes with at-least-once or at-most-once semantics, and client crashes with orphan handling such as reincarnation or expiration.

How does triple modular redundancy work? Explain how reliable client server communication can be achieved in distributed system.

Triple modular redundancy

Triple modular redundancy (TMR) masks hardware faults by replicating each component three times and passing the outputs through a voter, which outputs the majority value. A single faulty unit is outvoted by the two correct ones. Voters are also replicated, since a single voter would be a point of failure.

In -> [A1] -> [V1] -> [B1] -> [V4] -> ...
   -> [A2] -> [V2] -> [B2] -> [V5] -> ...
   -> [A3] -> [V3] -> [B3] -> [V6] -> ...
   (A, B = circuits, V = voters)

If A2 produces a wrong output, V1, V2, V3 still output the correct one, as two of the three inputs agree. TMR tolerates one failed unit per stage (K = 1, 2K+1 = 3). It costs three times the hardware.

Reliable client-server communication

Reliable client-server (RPC/RMI) communication deals with the following failures and how to tolerate them.

FailureSolution
Client cannot locate serverReturn an exception to the client; use a name or binding service
Lost request messageClient timer; retransmit the request after time-out
Server crashDepends on when it crashed (see below)
Lost reply messageRetransmit with idempotent operations or sequence numbers/duplicate filtering
Client crashOrphan handling

Server crash: the server may crash before executing the request or after executing it but before replying; the client cannot tell the two apart. Semantics:

  • At-least-once: the client keeps retrying until a reply arrives; the operation may run more than once (fine for idempotent operations).
  • At-most-once: the request is never repeated; if no reply, the client gets an error.
  • Exactly-once: ideal, but cannot be guaranteed in general.

Client crash (orphans): a computation running without a parent client wastes resources and may hold locks. Solutions: extermination (log each call and kill orphans after reboot), reincarnation (broadcast a new epoch; old computations are killed), gentle reincarnation (kill only if the owner cannot be found), and expiration (each call gets a time quantum T; it is killed if not finished).

For TCP-type reliable communication (point-to-point), acknowledgements, sequence numbers and retransmission give reliable delivery; connection loss causes an exception which the application must handle.

✓ Answer checked by Claude Opus 5.5 (high effort)

Related questions

All Distributed System chapter 9 questions →