Redundancy — cold standby, hot standby, active redundancy: Exercises

3.6.32 · D4 · Physics › Spacecraft Structures & Systems Engineering › Redundancy — cold standby, hot standby, active redundancy

Shuru karne se pehle, do quantities jinpar hum constantly rely karte hain, plus do standby formulas jo scratch se re-derive ki gayi hain taaki tumhe inhe blindly maanna na pade.

Figure — Redundancy — cold standby, hot standby, active redundancy

Formula Hot-standby reliability aur MTTF

$= 3/ (2 λ)$ derive karna Ek hot pair mein, dono units $t = 0$ se powered hain, isliye dono $λ$ rate par age karte hain. System tab survive karta hai jab at least ek alive ho; fail tabhi hota hai jab dono dead hon.

Ek unit ke $t$ tak dead hone ki chance: $1 - e^{- λ t}$ .
Dono ke dead hone ki chance (independent hain, toh multiply karo): $(1 - e^{- λ t})^{2}$ .
Toh survival ek minus woh hai: $R_{hot} (t) = 1 - (1 - e^{- λ t})^{2} = 2 e^{- λ t} - e^{- 2 λ t} .$ Yeh blue curve hai. MTTF uska area hai: $MTTF_{hot} = \int_{0}^{\infty} (2 e^{- λ t} - e^{- 2 λ t}) d t = \frac{2}{λ} - \frac{1}{2 λ} = \frac{3}{2 λ} .$ $3/2$ kyun? Har $e^{- aλ t}$ integrate hokar $1/ (aλ)$ deta hai; $2 e^{- λ t}$ gives $2/ λ$ , aur $- e^{- 2 λ t}$ mein se $1/ (2 λ)$ subtract hota hai. Intuitively: backup hot baithkar age karta rehta hai, isliye jab uski zaroorat padti hai tab tak woh already aadha lifetime spend kar chuka hota hai — tum aadhi lifetime gain karte ho, poori nahi.

Formula Cold-standby reliability aur MTTF

$= 2/ λ$ derive karna Ek cold pair mein backup OFF hota hai, isliye woh age nahi karta jab tak primary die na ho jaye. Uski clock sirf switchover par start hoti hai (perfect detection/switching assume karo). System tabhi die karta hai jab doosra unit fail ho — yaani jab tak 2 se kam failures huey hain hum abhi alive hain. Ek constant-rate (Poisson) process ke liye time $t$ tak 0 ya 1 failures ki probability pehle do Poisson terms hain: $R_{cold} (t) = 0 failures e^{- λ t} + 1 failure λ t e^{- λ t} = e^{- λ t} (1 + λ t) .$ Yeh pink curve hai. MTTF uska area hai: $MTTF_{cold} = \int_{0}^{\infty} e^{- λ t} (1 + λ t) d t = \frac{1}{λ} + \frac{1}{λ} = \frac{2}{λ},$ $\int_{0}^{\infty} λ t e^{- λ t} d t = 1/ λ$ use karke. Hot se bada kyun? Backup ek poora fresh lifetime contribute karta hai instead of half-used one, isliye pehle $1/ λ$ ke upar $1/ λ$ aur add ho jaata hai. Is extra reliability ki price hai switchover delay.

Common mistake Careful: exponential model ki limits hain

Upar saari formulas constant failure rate $λ$ (the "memoryless" exponential distribution) aur perfect switching assume karti hain. Do edge cases yeh tod dete hain:

Non-exponential wear-out: real mechanical parts (bearings, gyros) ki hazard rate life mein badhti jaati hai — ek Weibull distribution, exponential nahi. Tab $3/2 λ$ aur $2/ λ$ ke neat results nahi chalte aur tumhe actual $R (t)$ integrate karna padta hai.
Imperfect switching: agar switch khud probability $c < 1$ se succeed karta hai (uska coverage), toh cold-standby MTTF $\frac{1}{λ} (1 + c)$ ki taraf drop karta hai, aur $c = 0$ ke saath redundancy tumhe kuch nahi deta. Yahi reason hai parent note kyun warn karta hai ki switch ek single point of failure hai.
Warm standby cold aur hot ke beech hai: backup partially powered hota hai aur reduced rate $μ$ par age karta hai jahan $0 < μ < λ$ , aur MTTF $2/ λ$ (cold) aur $3/ (2 λ)$ (hot) ke beech milta hai.

Level 1 — Recognition

Problem 1.1

Ek ek sentence mein batao, cold standby, hot standby, aur active (parallel) redundancy ke beech defining difference kya hai backup ki power state aur switchover time ke terms mein.

Recall Solution

Cold standby: backup powered OFF hota hai; switchover slow hota hai (seconds–minutes) kyunki ise power on, boot, aur sync karna padta hai.
Hot standby: backup powered ON aur synchronized hota hai lekin uska output ignore hota hai; switchover near-instant hota hai (milliseconds).
Active redundancy: sab units simultaneously run karte hain aur unke outputs voting/averaging se combine hote hain; koi switchover hota hi nahi — faults masked ho jaate hain.

Problem 1.2

Ek component ki failure rate $λ = 2 \times 1 0^{- 4}$ failures per hour hai. Uski MTTF kya hai, aur $t = 1000$ hours ke baad uski reliability kya hai?

Recall Solution

MTTF bas $1/ λ$ hai: $MTTF = \frac{1}{2 \times 1 0 ^{- 4}} = 5000 hours.$ Reliability $t = 1000$ h par: $R (1000) = e^{- λ t} = e^{- (2 \times 1 0^{- 4}) (1000)} = e^{- 0.2} \approx 0.8187.$ Toh lagbhag $81.9%$ chance hai ki unit 1000 hours par abhi bhi alive hai.

Level 2 — Application

Problem 2.1

Ek spacecraft transponder ka $λ = 5 \times 1 0^{- 5}$ /h hai. Tum ek hot standby twin add karte ho. Is formula ka use karke: $MTTF_{hot} = \frac{3}{2 λ},$ hot-standby MTTF nikaalo aur single unit se compare karo.

Recall Solution

Single unit: $MTTF_{single} = 1/ λ = 1/ (5 \times 1 0^{- 5}) = 20, 000$ h. Hot standby (intro mein derive ki gayi formula): $MTTF_{hot} = \frac{3}{2 λ} = \frac{3}{2 ( 5 \times 1 0 ^{- 5} )} = 30, 000 h.$ Gain hai $30, 000/20, 000 = 1.5 \times$ — exactly woh "aadhi lifetime gain" result, kyunki dono units saath age karte hain.

Problem 2.2

Same transponder, lekin ab perfect switching ke saath cold standby twin use karo, jahan: $MTTF_{cold} = \frac{2}{λ} .$ Uski MTTF nikaalo aur hot standby ke upar improvement ratio batao.

Recall Solution

$MTTF_{cold} = \frac{2}{5 \times 1 0 ^{- 5}} = 40, 000 h.$ Hot standby ke against ratio: $40, 000/30, 000 = 1.333 \dots \approx 1.33 \times$ . Cold standby jeet jaata hai kyunki backup switched off rehte hue age nahi karta — uski "clock" sirf switchover par start hoti hai.

Problem 2.3

Problem 2.1 ke hot-standby pair ke liye, $t = 20, 000$ h par system reliability compute karo, intro mein derive ki gayi reliability formula use karke: $R_{hot} (t) = 1 - (1 - e^{- λ t})^{2} = 2 e^{- λ t} - e^{- 2 λ t} .$

Recall Solution

Intro derivation se yaad karo ki yeh formula "system tabhi fail hota hai jab dono units dead hon" se aati hai, yaani $R_{hot} = 1 - (1 - e^{- λ t})^{2}$ , jo expand hokar $2 e^{- λ t} - e^{- 2 λ t}$ deta hai. Yahan $λ t = (5 \times 1 0^{- 5}) (20, 000) = 1$ . $R_{hot} = 2 e^{- 1} - e^{- 2} = 2 (0.36788) - 0.13534 = 0.73576 - 0.13534 = 0.6004.$ Toh lagbhag $60.0%$ . Usi time par single unit se compare karo: $e^{- 1} \approx 36.8%$ — redundancy ne one-MTTF mark par survival chance almost double kar di.

Level 3 — Analysis

Problem 3.1

Ek Triple Modular Redundancy (TMR) voter teen identical units use karta hai, har ek ki reliability $R$ hai. System kaam karta hai agar 3 mein se at least 2 kaam karein: $R_{TMR} = 3 R^{2} (1 - R) + R^{3} = 3 R^{2} - 2 R^{3} .$ (a) $R = 0.9$ ke liye $R_{TMR}$ compute karo. (b) Kis value of $R$ par TMR single unit se koi benefit nahi deta (yaani $R_{TMR} = R$ )?

Recall Solution

(a) $R = 0.9$ ke saath: $R_{TMR} = 3 (0.81) - 2 (0.729) = 2.43 - 1.458 = 0.972.$ Failure probability $0.10$ se $0.028$ ho gayi — $3.6 \times$ reduction.

(b) $3 R^{2} - 2 R^{3} = R$ set karo: $2 R^{3} - 3 R^{2} + R = 0 \Rightarrow R (2 R - 1) (R - 1) = 0.$ Roots: $R = 0, R = 0.5, R = 1$ . Meaningful break-even hai $R = 0.5$ . Interpretation: TMR tabhi help karta hai jab har unit already ek coin flip se better ho ( $R > 0.5$ ). $0.5$ ke neeche, teen bure units zyada baar galat vote karte hain — majority likely galat majority hogi.

Problem 3.2

Reliability Block Diagrams referencing karte hue: ek subsystem mein do blocks series mein hain (dono ko kaam karna zaroori hai), har ek ki $R = 0.95$ hai. Phir tum poore subsystem ki ek redundant copy parallel mein rakhte ho. Final reliability nikaalo.

Recall Solution

Pehle series: dono blocks survive karne chahiye, toh multiply karo: $R_{series} = 0.95 \times 0.95 = 0.9025.$ Phir parallel: parallel pair tabhi fail hota hai jab dono subsystems fail hon: $R_{parallel} = 1 - (1 - 0.9025)^{2} = 1 - (0.0975)^{2} = 1 - 0.009506 = 0.990494.$ Final reliability $\approx 0.9905$ . Redundancy ne $0.9025$ subsystem ko $0.99$ tak push kar diya — "1 minus product of failures" rule block-diagram analysis ka workhorse hai.

Level 4 — Synthesis

Problem 4.1

Tumhare paas sirf 8 W spare ka Power Budget hai. Ek cold-standby unit wait karte waqt 0 W draw karta hai lekin switch over hone mein 120 s leta hai. Ek hot-standby unit continuously 4 W draw karta hai lekin 50 ms mein switch karta hai. Tumhara payload critical 300 s descent burn ke dauran 1 s se zyada downtime tolerate nahi kar sakta.

(a) Descent ke dauran tumhe konsa architecture use karna chahiye, aur kyun? (b) Baaki mission mein, power budget respect karne ke liye tumhe kya karna chahiye?

Recall Solution

(a) Descent ke dauran, downtime limit 1 s hai lekin cold standby ko switch hone mein 120 s chahiye — cold standby requirement meet nahi kar sakta. Tumhe hot standby use karna hi padega, jiska $50 ms ≪ 1 s$ hai. 4 W cost 8 W budget mein fit ho jaati hai. (b) Critical burn ke baahir koi tight downtime requirement nahi hai, toh backup cold (0 W) run karo taaki power bachao aur aging reduce ho (yaad karo $MTTF_{cold} = 2/ λ > 3/2 λ = MTTF_{hot}$ ). Design answer: ek mode-switched backup — cruise ke dauran cold, descent se kuch minutes pehle hot command kiya jaaye taaki jab 1 s window khule tab woh booted aur synced ho. Yeh FDI logic (Fault Detection and Isolation, intro mein define ki gayi) use karta hai switch trigger karne ke liye, aur dono benefits milte hain: low average power aur jab matter kare tab fast switchover. Note karo ki yeh "cold in cruise, hot near the burn" mode effectively warm-standby strategy hai disguise mein.

Problem 4.2

Ek voter ka decision sirf ek silent failure nahi balki ek lying unit ko survive karna chahiye jo alag-alag receivers ko alag-alag galat values bhejta hai (ek Byzantine fault). Classic TMR (2-of-3 majority) kitne faults tolerate karta hai, aur ek Byzantine fault ke liye kitne units chahiye? Dekho Byzantine Fault Tolerance.

Recall Solution

Classic TMR 1 fail-silent ya consistent-wrong fault mask karta hai (2-of-3 still agree karte hain). Lekin ek Byzantine unit voter-A ko value $x$ aur voter-B ko value $y$ bhej sakta hai, yeh assumption todta hai ki sab teen outputs ek jaisi dekhte hain. Byzantine result require karta hai $N \geq 3 f + 1$ units $f$ malicious faults tolerate karne ke liye. $f = 1$ ke liye: $N \geq 3 (1) + 1 = 4.$ Toh 4 units chahiye (Quad redundancy) — yahi reason hai Shuttle ne apne voting set mein 4 IMUs fly kiye, 3 nahi.

Level 5 — Mastery

Problem 5.1

Ek spacecraft flight computer ke liye ek redundancy scheme design aur justify karo jo (i) 10-year mission par random hardware wear-out aur (ii) frequent Single Event Upsets (cosmic rays se bit flips) dono survive kar sake. Dekho Single Event Upset (SEU) aur Failure Modes and Effects Analysis (FMEA).

Given: har computer ki permanent-failure rate $λ = 1 \times 1 0^{- 5}$ /h hai. Mission length $T = 10$ years $= 87, 600$ h. Assume karo ki har uncorrected SEU jo output tak pahunche mission-relevant error cause karta hai, SEU-induced upset rate $λ_{SEU} = 1 \times 1 0^{- 6}$ /h per unit ke saath.

(a) Mission ke dauran permanent wear-out ke against single-unit reliability compute karo. (b) Mission ke dauran ek bare unit ki SEU reliability quantify karo, aur dikhao ki TMR voting ise kaise reduce karta hai. (c) Ek aisi architecture propose karo jo dono failure classes handle kare aur overall mission reliability estimate karo, TMR core ko cold-standby spare ke saath combine karke.

Recall Solution

(a) Permanent wear-out, single unit. $λ T = (1 \times 1 0^{- 5}) (87, 600) = 0.876$ , toh: $R_{single} = e^{- 0.876} \approx 0.4165.$ Ek single computer ke paas 10 saal survive karne ka sirf $\sim 42%$ chance hai — unacceptable.

(b) SEU class — quantified. Ek bare unit ke liye, probability ki woh mission ke dauran koi mission-relevant SEU error deliver na kare woh khud ek exponential survival term hai rate $λ_{SEU}$ ke saath: $R_{SEU,single} = e^{- λ_{SEU} T} = e^{- (1 0^{- 6}) (87, 600)} = e^{- 0.0876} \approx 0.9161.$ Toh ek akela unit $\sim 8.4%$ time ek unmasked SEU se corrupt ho jaata hai — flight computer ke liye bahut zyada. TMR yeh fix karta hai: ek SEU ek transient, per-unit event hai, toh ek single upset 2-of-1 out-vote ho jaata hai. Mission-relevant SEU error ab require karta hai ki do units same voting window mein upset hon. Per-unit SEU survival ko $r = R_{SEU,single} = 0.9161$ treat karte hue, TMR SEU reliability "at least 2 of 3 good" formula hai: $R_{SEU,TMR} = 3 r^{2} - 2 r^{3} = 3 (0.8392) - 2 (0.7688) = 2.5175 - 1.5376 = 0.9799.$ SEU failure probability $8.4%$ se lagbhag $2.0%$ tak drop ho gayi — yeh woh fault-masking payoff hai, aur yeh kaam sirf active/voting redundancy kar sakti hai, kyunki standby switching ek bit flip catch karne ke liye bahut slow hai.

Do failure classes ko do alag tools chahiye:

Failure class	Sahi tool	Kyun
SEU (bit flip) — transient, self-healing	Active TMR / voting + memory scrubbing	Flipped bit instantly masked hota hai 2-of-3 vote se; koi permanent unit lost nahi hota
Wear-out — permanent, cumulative	Cold standby spare	Backup zero rate par age karta hai; MTTF extend karta hai

(c) Hybrid architecture. Ek TMR core (3 active units + voter) run karo SEUs ko cycle-by-cycle mask karne ke liye, plus ek cold-standby spare TMR core jo tab switch in ho jab FDI confirm kare ki active core permanently fail ho gayi hai. (Ek transient SEU ko hard failure se distinguish karna exactly ek FMEA task hai.)

Step 1 — ek TMR core ki permanent-failure reliability mission ke dauran, $R = 0.4165$ use karke: $R_{TMR} = 3 R^{2} - 2 R^{3} = 3 (0.17347) - 2 (0.07225) = 0.52041 - 0.14450 = 0.3759.$ Note karo $R_{TMR} = 0.376 < R_{single} = 0.416$ — TMR akela yahan wear-out ke liye worse hai, kyunki $R = 0.42$ par hum barely $0.5$ break-even se upar hain, aur 10 saal mein 2-of-3 ka survive karna 1 ka survive karne se harder condition hai. TMR transient SEUs ko mission ke andar mask karne ke liye superb hai lekin long-term wear-out survival extend nahi karta.

Step 2 — cold-standby spare core add karo. Har core ko ek "super-unit" model karo jiska permanent reliability $R_{c} = R_{TMR} = 0.3759$ hai. Cold-standby formula $R = e^{- λ_{c} T} (1 + λ_{c} T)$ use karne ke liye hume core-equivalent rate $λ_{c}$ chahiye. Hum ise $e^{- λ_{c} T} = R_{c}$ invert karke laate hain. Dono sides ka natural log lete hue (log exponential ko undo karta hai): $- λ_{c} T = ln R_{c} = ln 0.3759 \Rightarrow λ_{c} T = - ln 0.3759 = + 0.9784.$ Minus sign isliye aata hai kyunki $ln 0.3759$ negative hai (yeh 1 se neeche ke number ka log hai), aur ise negate karne se positive $λ_{c} T$ milta hai. Ab intro mein derive ki gayi cold-standby reliability formula apply karo: $R_{hybrid,perm} = e^{- λ_{c} T} (1 + λ_{c} T) = 0.3759 (1 + 0.9784) = 0.3759 \times 1.9784 = 0.7437.$

Step 3 — SEU fold in karo aur overall verdict do. Hybrid ki permanent-survival reliability $0.744$ hai; uske active TMR core ki SEU reliability $0.980$ hai. Dono failure mechanisms independent maante hue, overall mission reliability unka product hai: $R_{overall} = R_{hybrid,perm} \times R_{SEU,TMR} = 0.7437 \times 0.9799 \approx 0.7288.$ Ek single bare unit se compare karo jo dono mechanisms survive kare: $R_{single} \times R_{SEU,single} = 0.4165 \times 0.9161 = 0.3816$ . Hybrid overall mission reliability $\sim 0.38$ se $\sim 0.73$ tak le jaata hai — almost $1.9 \times$ improvement — saath hi har transient SEU ko har clock cycle par mask karta hai, jo na ek bare unit kar sakta hai na ek bare cold spare.

Mastery insight: SEU tool (TMR voting) aur wear-out tool (cold spare) alag failure physics ko alag timescales par attack karte hain — ek microsecond transients mask karta hai, doosra decade-long lifetime extend karta hai. Akela koi bhi kaafi nahi hai, isliye ek real flight computer unhe layer karta hai, aur honest reliability number woh product hai jo har layer khareedti hai.

Recall Self-test recap (answers cover karo)

Cold vs hot: kiski MTTF zyada hai? ::: Cold ( $2/ λ$ vs $3/2 λ$ ) — backup off rehte waqt age nahi karta. $R_{hot} = 2 e^{- λ t} - e^{- 2 λ t}$ kahan se aata hai? ::: $1 - (1 - e^{- λ t})^{2}$ — system tabhi die karta hai jab dono units die karein. $R_{cold} = e^{- λ t} (1 + λ t)$ kahan se aata hai? ::: 0-failure aur 1-failure Poisson terms ka sum — doosri failure par hi die karta hai. Hot standby kab use karna zaroori hai? ::: Jab downtime tolerance cold switchover time se chhoti ho. TMR break-even per-unit reliability? ::: $R = 0.5$ ; TMR sirf iske upar help karta hai. Ek Byzantine fault tolerate karne ke liye kitne units chahiye? ::: $N \geq 3 f + 1 = 4$ . Transient SEU konsa flavor mask karta hai? ::: Active redundancy (voting) — bura output instantly out-vote ho jaata hai. FDI ka full form aur kaam kya hai? ::: Fault Detection and Isolation — fault detect karta hai, guilty unit isolate karta hai, switch fire karta hai. TMR ko cold spare ke saath layer kyun karein (Problem 5.1)? ::: TMR har cycle mein transient SEUs mask karta hai; cold spare wear-out lifetime add karta hai — alag failure physics alag timescales par, toh dono reliabilities multiply karo.