Redundancy — cold standby, hot standby, active redundancy

The Three Flavors of Redundancy

1. Cold Standby

How It Works — Step by Step:

Normal State: Primary component operates, backup is OFF
Failure Detection: A watchdog circuit or software detects primary failure (timeout, error signal, health check)
Switchover: Control logic commands the backup to power on
Initialization: Backup goes through startup sequence (can take seconds to minutes)
Operational: Backup now performs primary's function

WHY cold standby?

Saves power and thermal load during mission (critical for battery-powered spacecraft)
Reduces wear-out failure modes (components OFF don't age as fast)
Simplest to implement when switchover delay is acceptable

Example: Mars Rover Computer

A Mars rover has two identical flight computers. One runs the rover (primary), the other is powered off (cold standby).

Scenario: Primary computer experiences a radiation-induced bit flip that crashes the kernel
Detection: Watchdog timer expires (no heartbeat signal for 10 seconds)
Action: Power distribution unit cuts power to primary, energizes backup
Result: Backup boots (takes ~2 minutes), rover resumes operations with minimal state loss

Why this step? The watchdog timer is independent hardware — if software hangs, software can't detect its own hang. Hardware must intervene.

2. Hot Standby

Derivation of Switchover Time:

Let's derive why hot standby is faster.

In cold standby: $t_{\text{switch, cold}} = t_{\text{detect}} + t_{\text{power-on}} + t_{\text{boot}} + t_{\text{sync}}$

In hot standby: $t_{\text{switch, hot}} = t_{\text{detect}} + t_{\text{activate}}$

Why? Because $t_{\text{power-on}} = 0$ (already on), $t_{\text{boot}} = 0$ (already booted), and often $t_{\text{sync}} \approx 0$ (continuously synchronized).

Typical values:

Cold standby: 1–120 seconds
Hot standby: 1–100 milliseconds

WHY hot standby?

Critical systems that can't tolerate downtime (reaction wheels during precision pointing, transponders during entry/descent/landing)
When loss of state during switchover is unacceptable
When failure detection itself is fast and reliable

Example: GPS Receiver on Satellite

A satellite uses GPS for orbit determination. It has two GPS receivers:

Primary receiver actively tracks satellites and computes position
Hot standby receiver is ON, tracking same satellites, computing same solution, but output is ignored

Scenario: Primary receiver's RF frontend fails (no signal)

Detection: Output solution diverges from expected orbit, or receiver reports "no lock" (detected in<1 second)
Action: Software switch routes hot standby output to navigation filter
Result: Navigation continues with<100ms gap, no lock re-acquisition needed

Why this step? Re-acquiring GPS lock from cold takes30–60 seconds. During Mars entry, that's mission-ending.

Formula Reliability Improvement Factor

For a component with failure rate $\lambda$ (failures per hour), the mean time to failure (MTTF) without redundancy is: $\text{MTTF}_{\text{single}} = \frac{1}{\lambda}$

Case 1: Hot Standby (both units powered and aging simultaneously = parallel redundancy)

Both units start at $t=0$ and age at the same rate. The system survives as long as at least one unit works. It fails only when both have failed.

Probability a single unit has failed by $t$ : $1 - e^{-\lambda t}$ . Probability both failed (independent): $(1 - e^{-\lambda t})^2$ .

So system reliability is: $R_{\text{hot}}(t) = 1 - (1 - e^{-\lambda t})^2 = 2e^{-\lambda t} - e^{-2\lambda t}$

MTTF is $\int_0^\infty R(t)\, dt$ : $\text{MTTF}_{\text{hot}} = \int_0^\infty \left(2e^{-\lambda t} - e^{-2\lambda t}\right) dt = \frac{2}{\lambda} - \frac{1}{2\lambda} = \frac{3}{2\lambda}$

Why $3/2$ ? Both units age simultaneously, so the backup has already "used up" some of its life while sitting hot. You gain half a lifetime, not a whole one.

Case 2: Cold Standby (backup does NOT age until switched on = sequential use)

The backup is OFF, so it does not age until the primary fails. Its "clock" starts only at switchover. Assuming perfect detection/switching, the total lifetime is the sum of two independent lifetimes.

The system fails when the second unit fails. Reliability is the probability that fewer than 2 failures have occurred by $t$ — a sum of the first two Poisson terms: $R_{\text{cold}}(t) = e^{-\lambda t}\left(1 + \lambda t\right)$

MTTF: $\text{MTTF}_{\text{cold}} = \int_0^\infty e^{-\lambda t}(1 + \lambda t)\, dt = \frac{1}{\lambda} + \frac{1}{\lambda} = \frac{2}{\lambda}$

where the second term uses $\int_0^\infty \lambda t\, e^{-\lambda t}\, dt = 1/\lambda$ .

Key comparison: $\text{MTTF}_{\text{cold}} = \dfrac{2}{\lambda} > \dfrac{3}{2\lambda} = \text{MTTF}_{\text{hot}}$ . Cold standby gives a longer MTTF because the backup doesn't age while waiting — the price is switchover delay. Hot standby trades some reliability for instant switchover.

3. Active Redundancy (Parallel Redundancy)

How Voting Works — Triple Modular Redundancy (TMR):

Three identical units compute the same function. A voter compares outputs.

Majority voting rule: $\text{Output} = \text{majority}(A, B, C)$

If A=1, B=1, C=0 → Output = 1 (2-of-3 agree)

WHY does this work?

Single fault tolerance: One unit can fail arbitrarily (wrong output, stuck, noisy) and the voter still produces correct output
Fault detection: Disagreement signals that someone is faulty (though you don't know who without more logic)

Example: Inertial Measurement Unit (IMU) on Crewed Spacecraft

The Space Shuttle had 4 IMUs (actually 5, but 4 in voting set):

Each IMU measures angular rates (3 gyros) and accelerations (3 accelerometers)
All 4 outputs feed into a consolidation algorithm
Algorithm computes median or weighted average (outlier rejection)

Scenario: One gyro in IMU-2 drifts due to bearing wear

Detection: IMU-2's X-axis rate differs from IMU-1, IMU-3, IMU-4 by >threshold
Action: Consolidation algorithm down-weights IMU-2 or excludes it
Result: Navigation solution remains accurate, mission continues, crew never notices

Why this step? You can't just "average" with a faulty sensor — if one reads 10°/s and three read 0.1°/s, average is 2.5°/s (wrong!). Median or outlier rejection is crucial.

Formula Reliability of TMR vs Single Unit

For three units with reliability $R(t)$ each, TMR system works if at least 2 of 3 work: $R_{\text{TMR}}(t) = \binom{3}{2} R^2(1-R) + \binom{3}{3} R^3$ $= 3R^2(1-R) + R^3 = 3R^2 - 2R^3$

Derivation:

$\binom{3}{2} R^2(1-R)$ : Choose 2 to work, 1 to fail
$R^3$ : All 3 work

Surprising result: For $R < 0.5$ , $R_{\text{TMR}} < R$ ! Redundancy hurts if components are very unreliable.

Why? Because you need two to agree. If each only works 40% of the time, the chance two work simultaneously is low.

Crossover point: Set $3R^2 - 2R^3 = R$ : $3R - 2R^2 = 1 \implies R = 0.5$

Engineering lesson: Only use redundancy when individual components are reasonably reliable ( $R > 0.5$ ).

Comparison Table

Type	Power	Switchover Time	MTTF (2 units)	Best Use
Cold Standby	Low (backup OFF)	Seconds to minutes	$2/\lambda$	Non-critical, power-limited missions
Hot Standby	High (backup ON)	Milliseconds	$3/(2\lambda)$	Time-critical systems
Active Redundancy	Highest (all ON)	None (fault masked)	(voting-dependent)	Safety-critical, fault-intolerant

Recall Explain to a 12-Year-Old

Imagine you're doing homework and your pencil breaks. Cold standby: You have a backup pencil in your backpack. You have to stop, open the bag, find it, sharpen it. Takes a minute, but you saved weight by not carrying two pencils in your hand all day. Bonus: that spare pencil is fresh and unused — it lasts a full lifetime because you never touched it before.

Hot standby: You have a backup pencil already in your other hand, sharpened and ready. The instant your first one breaks, you switch. No time lost, but your hand was tired holding two pencils — and both pencils have been getting worn from being carried around, so together they don't last quite as long.

Active redundancy: You write with THREE pencils taped together. If one breaks, the other two keep writing — you don't even notice. But it's bulky and weird to hold.

Spacecraft engineers pick which "pencil strategy" based on: How bad is it if I stop writing? How much weight can I carry? How much battery do I have?

Connections

Failure Modes and Effects Analysis (FMEA) — How to identify what needs redundancy
Reliability Block Diagrams — Series vs parallel modeling
Power Budget — Why cold standby saves mission-critical power
Fault Detection and Isolation — Algorithms that enable hot standby switching
Byzantine Fault Tolerance — When redundant units might give wrong answers, not just fail
Single Event Upset (SEU) — Radiation-induced failures that redundancy protects against

Flashcards

#flashcards/physics

What is the key difference between cold standby and hot standby? :: Cold standby: backup is powered OFF, takes seconds-minutes to activate, and does NOT age while waiting. Hot standby: backup is powered ON and synchronized, switches in milliseconds, but ages continuously.

Why does active redundancy (TMR) fail to improve reliability when R < 0.5?

Because TMR requires at least 2-of-3 to agree. If individual reliability R < 0.5, the probability that 2+ units work simultaneously is lower than 1 unit working alone. Redundancy only helps when components are reasonably reliable (R > 0.5).

Derive MTTF for hot standby (parallel) from first principles

Both units age from t=0. System reliability R(t) = 1 − (1−e^(−λt))² = 2e^(−λt) − e^(−2λt). MTTF = ∫₀^∞ R dt = 2/λ − 1/(2λ) = 3/(2λ).

Derive MTTF for cold standby from first principles

Backup doesn't age until switched on, so lifetimes add. R(t) = e^(−λt)(1 + λt). MTTF = ∫₀^∞ e^(−λt)(1+λt) dt = 1/λ + 1/λ = 2/λ. (Uses ∫₀^∞ λt e^(−λt) dt = 1/λ.)

Why is cold-standby MTTF (2/λ) larger than hot-standby MTTF (3/(2λ))?

In cold standby the backup stays fresh (doesn't age) until needed, so you gain a full second lifetime. In hot standby both units age simultaneously, so the backup has already consumed part of its life — you gain only half a lifetime. The tradeoff: hot standby switches instantly, cold standby has switchover delay.

What is the single-point failure in many redundant systems?

The switching logic itself (relay, control circuit, software arbiter). If the switch fails, the redundant component can't take over even if it's functional. Mitigation: cross-strapping or redundant switches.

In TMR voting, why use median instead of average?

Average is corrupted by outliers. If 3 sensors read [0.1, 0.1, 10.0], average = 3.4 (wrong). Median = 0.1 (correct). Median or outlier rejection prevents a single faulty sensor from corrupting the output.

When is cold standby preferred over hot standby?

When: (1) power/thermal budget is tight, (2) switchover delay is acceptable, (3) backup wear-out/aging is a concern (cold standby preserves backup life). Example: Mars rover computers.

What does "fault masking" mean in active redundancy?

The system continues correct operation without interruption even as components fail. Failures are "masked" by voting/averaging — external observer sees no glitch. Example: One IMU fails, spacecraft navigation unaffected.

Concept Map

Hinglish (regional understanding)

Intuition Hinglish mein samjho

Dekho yaar, redundancy ka core idea bahut simple hai — space mission mein billions of rupees lagte hain aur ek baar rocket launch ho gaya toh koi technician upar jaake repair nahi kar sakta. Isliye agar ek component fail ho gaya toh poori mission barbaad. Solution? Backup components rakho jo primary fail hone par takeover kar lein. Bas ek catch hai — extra backup ka matlab hai zyada mass, zyada power, aur zyada complexity. Yahi tradeoff engineer ko balance karna padta hai, jaise cliff climbing mein do ropes safe toh hain par bhaari bhi.

Ab teen flavors samajh lo. Cold standby mein backup OFF rehta hai — power zero consume karta hai, lekin fail hone par usko detect karna, switch karna, boot karna padta hai, jismein seconds se minutes lag sakte hain (jaise Mars rover ka second computer). Hot standby mein backup ON aur synchronized rehta hai, isliye switchover almost instant (milliseconds) hota hai, par continuously power kha raha hai — ye critical systems ke liye jahan downtime bilkul tolerate nahi hoti, jaise precision pointing ya landing ke time. Formula se clear hai: cold mein $t_{boot}$ aur $t_{power-on}$ add hote hain, hot mein wo zero ho jaate hain, isliye speed ka fark aata hai.

Sabse important cheez jo students bhool jaate hain — sirf do computers hone se aap redundant nahi ho jaate! Jo switch primary se backup pe transfer karta hai (relay, control logic), wo khud ek single point of failure ban sakta hai. Kai real missions isliye fail hui hain kyunki backup toh theek tha par switch mar gaya. Isiliye spacecraft mein cross-strapped architecture use karte hain jahan har component multiple paths le sakta hai. Ye samajhna zaroori hai kyunki reliability engineering mein weakest link hi poore system ko decide karti hai — chahe baaki sab perfect ho.

Redundancy — cold standby, hot standby, active redundancy

The Three Flavors of Redundancy

1. Cold Standby

2. Hot Standby

3. Active Redundancy (Parallel Redundancy)

Comparison Table

Connections

Flashcards

Concept Map

Hinglish (regional understanding)

Go deeper — visual, from zero

Test yourself — Spacecraft Structures & Systems Engineering

Connections