Exercises — Redundancy — cold standby, hot standby, active redundancy

• Cold standby: backup is powered OFF; switchover is slow (seconds–minutes) because it must power on, boot, and sync.
• Hot standby: backup is powered ON and synchronized but its output is ignored; switchover is near-instant (milliseconds).
• Active redundancy: all units run simultaneously and their outputs are combined by voting/averaging; there is no switchover at all — faults are masked.

MTTF is just $1/\lambda$: $\text{MTTF}=\frac{1}{2\times 10^{-4}}=5000\text{ hours.}$ Reliability at $t=1000$ h: $R(1000)=e^{-\lambda t}=e^{-(2\times 10^{-4})(1000)}=e^{-0.2}\approx \mathrm{0.8187.}$ So about a $81.9\%$ chance the unit is still alive at 1000 hours.

Single unit: ${\text{MTTF}}_{\text{single}}=1/\lambda =1/(5\times 10^{-5})=20,000$ h. Hot standby (formula derived in the intro): ${\text{MTTF}}_{\text{hot}}=\frac{3}{2\lambda }=\frac{3}{2(5\times 10^{-5})}=30,000\text{ h.}$ The gain is $30,000/20,000=1.5\times$ — exactly the "you gain half a lifetime" result, because both units age together.

${\text{MTTF}}_{\text{cold}}=\frac{2}{5\times 10^{-5}}=40,000\text{ h.}$ Ratio versus hot standby: $40,000/30,000=1.333\dots \approx 1.33\times$. Cold standby wins because the backup does not age while switched off — its "clock" starts only at switchover.

Recall from the intro derivation that this formula comes from "the system fails only when both units are dead," i.e. $R_{\text{hot}}=1-(1-e^{-\lambda t}{)}^2$, which expands to $2e^{-\lambda t}-e^{-2\lambda t}$. Here $\lambda t=(5\times 10^{-5})(20,000)=1$. $R_{\text{hot}}=2e^{-1}-e^{-2}=2(0.36788)-0.13534=0.73576-0.13534=\mathrm{0.6004.}$ So about $60.0\%$. Compare a single unit at the same time: $e^{-1}\approx 36.8\%$ — redundancy nearly doubled the survival chance at the one-MTTF mark.

(a) With $R=0.9$: $R_{\text{TMR}}=3(0.81)-2(0.729)=2.43-1.458=\mathrm{0.972.}$ Failure probability dropped from $0.10$ to $0.028$ — a $3.6\times$ reduction.

(b) Set $3R^2-2R^3=R$: $2R^3-3R^2+R=0\Rightarrow R(2R-1)(R-1)=0.$ Roots: $R=0,R=0.5,R=1$. The meaningful break-even is $\mathbf{R}=0.5$. Interpretation: TMR only helps when each unit is already better than a coin flip ($R>0.5$). Below $0.5$, three bad units vote wrong more often than one — the majority is likely to be the wrong majority.

Series first: both blocks must survive, so multiply: $R_{\text{series}}=0.95\times 0.95=\mathrm{0.9025.}$ Then parallel: the parallel pair fails only if both subsystems fail: $R_{\text{parallel}}=1-(1-0.9025{)}^2=1-(0.0975{)}^2=1-0.009506=\mathrm{0.990494.}$ Final reliability $\approx 0.9905$. Redundancy pushed a $0.9025$ subsystem up to $0.99$ — the "1 minus the product of failures" rule is the workhorse of block-diagram analysis.

(a) During descent, the downtime limit is 1 s but cold standby needs 120 s to switch — cold standby cannot meet the requirement. You must use hot standby, whose $50\text{ ms}\ll 1\text{ s}$. The 4 W cost fits inside the 8 W budget. (b) Outside the critical burn there is no tight downtime requirement, so run the backup cold (0 W) to save power and reduce aging (recall ${\text{MTTF}}_{\text{cold}}=2/\lambda >3/2\lambda ={\text{MTTF}}_{\text{hot}}$). Design answer: a mode-switched backup — cold during cruise, commanded hot a few minutes before descent so it is booted and synced when the 1 s window opens. This uses the FDI logic (Fault Detection and Isolation, defined in the intro) to trigger the switch, and gets both benefits: low average power and fast switchover when it matters. Note this "cold in cruise, hot near the burn" mode is effectively a warm-standby strategy in disguise.

Classic TMR masks 1 fail-silent or consistent-wrong fault (2-of-3 still agree). But a Byzantine unit can send value $x$ to voter-A and value $y$ to voter-B, breaking the assumption that everyone sees the same three outputs. The Byzantine result requires $N\ge 3f+1$ units to tolerate $f$ malicious faults. For $f=1$: $N\ge 3(1)+1=4.$ So you need 4 units (Quad redundancy) — which is exactly why the Shuttle flew 4 IMUs in its voting set, not 3.

(a) Permanent wear-out, single unit. $\lambda T=(1\times 10^{-5})(87,600)=0.876$, so $R_{\text{single}}=e^{-0.876}\approx \mathrm{0.4165.}$ A single computer has only a $\sim 42\%$ chance of surviving 10 years — unacceptable.

(b) SEU class — quantified. For a bare unit, the probability it delivers no mission-relevant SEU error over the mission is itself an exponential survival term with rate ${\lambda }_{\text{SEU}}$: $R_{\text{SEU,single}}=e^{-{\lambda }_{\text{SEU}}T}=e^{-(10^{-6})(87,600)}=e^{-0.0876}\approx \mathrm{0.9161.}$ So a lone unit is corrupted by an unmasked SEU $\sim 8.4\%$ of the time — far too high for a flight computer. TMR fixes this: an SEU is a transient, per-unit event, so a single upset is out-voted 2-of-1. A mission-relevant SEU error now requires two units upset in the same voting window. Treating the per-unit SEU survival as $r=R_{\text{SEU,single}}=0.9161$, the TMR SEU reliability is the "at least 2 of 3 good" formula: $R_{\text{SEU,TMR}}=3r^2-2r^3=3(0.8392)-2(0.7688)=2.5175-1.5376=\mathrm{0.9799.}$ The SEU failure probability dropped from $8.4\%$ to about $2.0\%$ — that is the fault-masking payoff, and it is a job only active/voting redundancy can do, because standby switching is far too slow to catch a bit flip.

Two failure classes need two different tools:

(c) The hybrid architecture. Run a TMR core (3 active units + voter) to mask SEUs cycle-by-cycle, plus one cold-standby spare TMR core switched in when FDI confirms the active core has permanently failed. (Distinguishing a transient SEU from a hard failure is exactly an FMEA task.)

Step 1 — permanent-failure reliability of one TMR core over the mission, using $R=0.4165$: $R_{\text{TMR}}=3R^2-2R^3=3(0.17347)-2(0.07225)=0.52041-0.14450=\mathrm{0.3759.}$ Notice $R_{\text{TMR}}=0.376<R_{\text{single}}=0.416$ — TMR alone is worse here for wear-out, because at $R=0.42$ we are barely above the $0.5$ break-even, and needing 2-of-3 to survive 10 years is a harder condition than needing 1. TMR is superb for masking transient SEUs within a mission but does not extend long-term wear-out survival.

Step 2 — add the cold-standby spare core. Model each core as one "super-unit" with permanent reliability $R_c=R_{\text{TMR}}=0.3759$. To use the cold-standby formula $R=e^{-{\lambda }_{c}T}(1+{\lambda }_{c}T)$ we need the core-equivalent rate ${\lambda }_c$. We get it by inverting $e^{-{\lambda }_{c}T}=R_c$. Taking the natural log of both sides (the log undoes the exponential): $-{\lambda }_{c}T=\ln R_c=\ln 0.3759\Rightarrow {\lambda }_{c}T=-\ln 0.3759=+\mathrm{0.9784.}$ The minus sign appears because $\ln 0.3759$ is negative (it's the log of a number below 1), and negating it gives the positive ${\lambda }_{c}T$. Now apply the cold-standby reliability formula derived in the intro: $R_{\text{hybrid,perm}}=e^{-{\lambda }_{c}T}(1+{\lambda }_{c}T)=0.3759(1+0.9784)=0.3759\times 1.9784=\mathrm{0.7437.}$

Step 3 — fold in SEU and give the overall verdict. The permanent-survival reliability of the hybrid is $0.744$; the SEU reliability of its active TMR core is $0.980$. Assuming the two failure mechanisms are independent, overall mission reliability is their product: $R_{\text{overall}}=R_{\text{hybrid,perm}}\times R_{\text{SEU,TMR}}=0.7437\times 0.9799\approx \mathrm{0.7288.}$ Compare a single bare unit that must survive both mechanisms: $R_{\text{single}}\times R_{\text{SEU,single}}=0.4165\times 0.9161=0.3816$. The hybrid lifts overall mission reliability from $\sim 0.38$ to $\sim 0.73$ — nearly a $1.9\times$ improvement — while also masking every transient SEU at each clock cycle, which neither a bare unit nor a bare cold spare can do.

The mastery insight: the SEU tool (TMR voting) and the wear-out tool (cold spare) attack different failure physics on different timescales — one masks microsecond transients, the other extends decade-long lifetime. Neither alone suffices, so a real flight computer layers them, and the honest reliability number is the product of what each layer buys.

Cold vs hot: which has longer MTTF? ::: Cold ($2/\lambda$ vs $3/2\lambda$) — backup doesn't age while off. Where does $R_{\text{hot}}=2e^{-\lambda t}-e^{-2\lambda t}$ come from? ::: $1-(1-e^{-\lambda t}{)}^2$ — system dies only when both units die. Where does $R_{\text{cold}}=e^{-\lambda t}(1+\lambda t)$ come from? ::: Sum of the 0-failure and 1-failure Poisson terms — dies only on the second failure. When must you use hot standby? ::: When downtime tolerance is shorter than the cold switchover time. TMR break-even per-unit reliability? ::: $R=0.5$; TMR only helps above it. Units needed to tolerate one Byzantine fault? ::: $N\ge 3f+1=4$. Which flavor masks a transient SEU? ::: Active redundancy (voting) — the bad output is out-voted instantly. What does FDI stand for and do? ::: Fault Detection and Isolation — detects a fault, isolates the guilty unit, fires the switch. Why layer TMR with a cold spare (Problem 5.1)? ::: TMR masks transient SEUs each cycle; the cold spare adds wear-out lifetime — different failure physics on different timescales, so multiply the two reliabilities.