Redundancy — cold standby, hot standby, active redundancy

3.6.32 · Physics › Spacecraft Structures & Systems Engineering

Teen Tarah ki Redundancy

1. Cold Standby

Yeh Kaise Kaam Karta Hai — Step by Step:

Normal State: Primary component operate kar raha hai, backup OFF hai
Failure Detection: Ek watchdog circuit ya software primary ki failure detect karta hai (timeout, error signal, health check)
Switchover: Control logic backup ko power on karne ka command deta hai
Initialization: Backup startup sequence se guzarta hai (kuch seconds se minutes tak lag sakte hain)
Operational: Backup ab primary ka kaam karta hai

WHY cold standby?

Mission ke dauran power aur thermal load bachata hai (battery-powered spacecraft ke liye critical hai)
Wear-out failure modes kam karta hai (components OFF rehne par utni tezi se age nahi hote)
Implement karna sabse simple hai jab switchover delay acceptable ho

Example: Mars Rover Computer

Ek Mars rover mein do identical flight computers hote hain. Ek rover chalata hai (primary), doosra powered off hai (cold standby).

Scenario: Primary computer mein radiation-induced bit flip hoti hai jo kernel crash kar deti hai
Detection: Watchdog timer expire ho jata hai (10 seconds tak koi heartbeat signal nahi)
Action: Power distribution unit primary ki power kaat deta hai, backup ko energize karta hai
Result: Backup boot hota hai (~2 minutes lagte hain), rover operations resume karta hai minimal state loss ke saath

Yeh step kyun? Watchdog timer independent hardware hota hai — agar software hang ho jaye, toh software khud apna hang detect nahi kar sakta. Hardware ko intervene karna padta hai.

2. Hot Standby

Switchover Time ki Derivation:

Chaliye derive karte hain ki hot standby faster kyun hota hai.

Cold standby mein: $t_{switch, cold} = t_{detect} + t_{power-on} + t_{boot} + t_{sync}$

Hot standby mein: $t_{switch, hot} = t_{detect} + t_{activate}$

Kyun? Kyunki $t_{power-on} = 0$ (already on hai), $t_{boot} = 0$ (already boot ho chuka hai), aur aksar $t_{sync} \approx 0$ (continuously synchronized hai).

Typical values:

Cold standby: 1–120 seconds
Hot standby: 1–100 milliseconds

WHY hot standby?

Critical systems jo downtime afford nahi kar sakte (precision pointing ke dauran reaction wheels, entry/descent/landing ke dauran transponders)
Jab switchover ke dauran state loss acceptable nahi hoti
Jab failure detection khud fast aur reliable hoti hai

Example: Satellite Par GPS Receiver

Ek satellite orbit determination ke liye GPS use karta hai. Uske paas do GPS receivers hain:

Primary receiver actively satellites track karta hai aur position compute karta hai
Hot standby receiver ON hai, same satellites track kar raha hai, same solution compute kar raha hai, lekin output ignore ki jaati hai

Scenario: Primary receiver ka RF frontend fail ho jata hai (koi signal nahi)

Detection: Output solution expected orbit se diverge kar jata hai, ya receiver "no lock" report karta hai (1 second se kam mein detect ho jata hai)
Action: Software switch hot standby output ko navigation filter tak route kar deta hai
Result: Navigation <100ms gap ke saath continue karta hai, koi lock re-acquisition nahi chahiye

Yeh step kyun? Cold se GPS lock re-acquire karne mein 30–60 seconds lagte hain. Mars entry ke dauran, yeh mission-ending hai.

Formula Reliability Improvement Factor

Ek component ke liye jiska failure rate $λ$ hai (failures per hour), redundancy ke bina mean time to failure (MTTF) hai: $MTTF_{single} = \frac{1}{λ}$

Case 1: Hot Standby (dono units powered aur simultaneously aging = parallel redundancy)

Dono units $t = 0$ par start hote hain aur same rate par age karte hain. System tab tak survive karta hai jab tak kam se kam ek unit kaam kare. Yeh fail tab hota hai jab dono fail ho jayein.

Probability ki ek single unit $t$ tak fail ho chuki hai: $1 - e^{- λ t}$ . Probability ki dono fail ho gaye (independent): $(1 - e^{- λ t})^{2}$ .

Toh system reliability hai: $R_{hot} (t) = 1 - (1 - e^{- λ t})^{2} = 2 e^{- λ t} - e^{- 2 λ t}$

MTTF hai $\int_{0}^{\infty} R (t) d t$ : $MTTF_{hot} = \int_{0}^{\infty} (2 e^{- λ t} - e^{- 2 λ t}) d t = \frac{2}{λ} - \frac{1}{2 λ} = \frac{3}{2 λ}$

$3/2$ kyun? Dono units simultaneously age karte hain, isliye backup ne apni life ka kuch hissa "use up" kar liya hai hot baith ke. Tumhe aadha lifetime milta hai, poora nahi.

Case 2: Cold Standby (backup tab tak age nahi karta jab tak switch na ho = sequential use)

Backup OFF hai, isliye yeh age nahi karta jab tak primary fail na ho. Uski "clock" sirf switchover par shuru hoti hai. Perfect detection/switching maante hue, total lifetime do independent lifetimes ka sum hai.

System tab fail hota hai jab doosra unit fail hota hai. Reliability probability hai ki $t$ tak 2 se kam failures hui hain — yeh pehle do Poisson terms ka sum hai: $R_{cold} (t) = e^{- λ t} (1 + λ t)$

MTTF: $MTTF_{cold} = \int_{0}^{\infty} e^{- λ t} (1 + λ t) d t = \frac{1}{λ} + \frac{1}{λ} = \frac{2}{λ}$

jahan doosra term $\int_{0}^{\infty} λ t e^{- λ t} d t = 1/ λ$ use karta hai.

Key comparison: $MTTF_{cold} = \frac{2}{λ} > \frac{3}{2 λ} = MTTF_{hot}$ . Cold standby zyada MTTF deta hai kyunki backup wait karte hue age nahi hota — price hai switchover delay. Hot standby instant switchover ke liye thodi reliability trade karta hai.

3. Active Redundancy (Parallel Redundancy)

Voting Kaise Kaam Karta Hai — Triple Modular Redundancy (TMR):

Teen identical units same function compute karte hain. Ek voter outputs compare karta hai.

Majority voting rule: $Output = majority (A, B, C)$

Agar A=1, B=1, C=0 → Output = 1 (2-of-3 agree)

WHY yeh kaam karta hai?

Single fault tolerance: Ek unit arbitrarily fail ho sakta hai (galat output, stuck, noisy) aur voter phir bhi correct output produce karta hai
Fault detection: Disagreement signal karta hai ki koi faulty hai (halanki bina aur logic ke pata nahi lagta kaun)

Example: Crewed Spacecraft Par Inertial Measurement Unit (IMU)

Space Shuttle mein 4 IMUs the (actually 5, lekin 4 voting set mein):

Har IMU angular rates (3 gyros) aur accelerations (3 accelerometers) measure karta hai
Sab 4 outputs ek consolidation algorithm mein feed hote hain
Algorithm median ya weighted average compute karta hai (outlier rejection)

Scenario: IMU-2 mein ek gyro bearing wear ki wajah se drift karta hai

Detection: IMU-2 ka X-axis rate IMU-1, IMU-3, IMU-4 se >threshold se differ karta hai
Action: Consolidation algorithm IMU-2 ko down-weight karta hai ya exclude karta hai
Result: Navigation solution accurate rehti hai, mission continue karta hai, crew ko pata bhi nahi chalta

Yeh step kyun? Tum sirf faulty sensor ke saath "average" nahi kar sakte — agar ek 10°/s read kare aur teen 0.1°/s, average 2.5°/s ho jaata hai (galat!). Median ya outlier rejection crucial hai.

Comparison Table

Type	Power	Switchover Time	MTTF (2 units)	Best Use
Cold Standby	Kam (backup OFF)	Seconds se minutes	$2/ λ$	Non-critical, power-limited missions
Hot Standby	Zyada (backup ON)	Milliseconds	$3/ (2 λ)$	Time-critical systems
Active Redundancy	Sabse zyada (sab ON)	Kuch nahi (fault masked)	(voting-dependent)	Safety-critical, fault-intolerant

Recall Ek 12-Saal ke Bacche Ko Samjhao

Socho tum homework kar rahe ho aur tumhari pencil toot jaati hai. Cold standby: Tumhare bag mein ek backup pencil hai. Tumhe rukna padega, bag kholna padega, pencil dhundni padegi, sharpen karni padegi. Ek minute lagta hai, lekin tumne pura din do pencils haath mein pakad ke weight nahi uthaya. Bonus: woh spare pencil bilkul fresh aur unused hai — kyunki tumne pehle use hi nahi ki thi, woh poora lifetime chalti hai.

Hot standby: Tumhare doosre haath mein already ek backup pencil hai, sharpened aur ready. Jis pal pehli toot jaaye, tum switch kar lo. Koi time waste nahi, lekin tumhara haath do pencils pakad ke thak gaya — aur dono pencils saath-saath carry hone se ghis rahi thin, isliye milake utni der nahi chaltin.

Active redundancy: Tum TEEN pencils ek saath tape karke likhte ho. Agar ek toot jaaye, baaki do likhti rehti hain — tumhe pata bhi nahi chalta. Lekin yeh bulky hai aur pakadna ajib lagta hai.

Spacecraft engineers decide karte hain kaun si "pencil strategy" use karein, yeh dekh ke: Kitna bura hoga agar main likhna band kar doon? Kitna weight carry kar sakta hoon? Meri battery kitni hai?

Connections

Failure Modes and Effects Analysis (FMEA) — Yeh identify karo ki kise redundancy chahiye
Reliability Block Diagrams — Series vs parallel modeling
Power Budget — Cold standby mission-critical power kyun bachata hai
Fault Detection and Isolation — Algorithms jo hot standby switching enable karte hain
Byzantine Fault Tolerance — Jab redundant units sirf fail nahi hote balki galat answers bhi de sakte hain
Single Event Upset (SEU) — Radiation-induced failures jinse redundancy protect karti hai

Flashcards

#flashcards/physics

What is the key difference between cold standby and hot standby? :: Cold standby: backup powered OFF hota hai, activate hone mein seconds-minutes lagte hain, aur wait karte hue age nahi karta. Hot standby: backup powered ON aur synchronized hota hai, milliseconds mein switch karta hai, lekin continuously age karta hai.

Why does active redundancy (TMR) fail to improve reliability when R < 0.5?

Kyunki TMR ko kam se kam 2-of-3 ka agree karna chahiye. Agar individual reliability R < 0.5 ho, toh probability ki 2+ units simultaneously kaam karein, akele 1 unit ke kaam karne se kam hoti hai. Redundancy tab hi help karta hai jab components reasonably reliable hon (R > 0.5).

Derive MTTF for hot standby (parallel) from first principles

Dono units t=0 se age karte hain. System reliability R(t) = 1 − (1−e^(−λt))² = 2e^(−λt) − e^(−2λt). MTTF = ∫₀^∞ R dt = 2/λ − 1/(2λ) = 3/(2λ).

Derive MTTF for cold standby from first principles

Backup tab tak age nahi karta jab tak switch na ho, isliye lifetimes add hoti hain. R(t) = e^(−λt)(1 + λt). MTTF = ∫₀^∞ e^(−λt)(1+λt) dt = 1/λ + 1/λ = 2/λ. (Uses ∫₀^∞ λt e^(−λt) dt = 1/λ.)

Why is cold-standby MTTF (2/λ) larger than hot-standby MTTF (3/(2λ))?

Cold standby mein backup fresh rehta hai (age nahi karta) jab tak zaroorat na ho, isliye tumhe poora doosra lifetime milta hai. Hot standby mein dono units simultaneously age karte hain, isliye backup apni life ka hissa consume kar chuka hota hai — tumhe sirf aadha lifetime milta hai. Tradeoff: hot standby instantly switch karta hai, cold standby mein switchover delay hoti hai.

What is the single-point failure in many redundant systems?

Switching logic khud (relay, control circuit, software arbiter). Agar switch fail ho jaye, toh redundant component kaam nahi sambhal sakta chahe woh functional bhi ho. Mitigation: cross-strapping ya redundant switches.

In TMR voting, why use median instead of average?

Average outliers se corrupt ho jaata hai. Agar 3 sensors [0.1, 0.1, 10.0] read karein, average = 3.4 (galat). Median = 0.1 (sahi). Median ya outlier rejection ek faulty sensor ko output corrupt karne se rokta hai.

When is cold standby preferred over hot standby?

Jab: (1) power/thermal budget tight ho, (2) switchover delay acceptable ho, (3) backup wear-out/aging concern ho (cold standby backup ki life preserve karta hai). Example: Mars rover computers.

What does "fault masking" mean in active redundancy?

System bina interruption ke correct operation continue karta hai jab components fail hote hain. Failures voting/averaging se "mask" ho jaati hain — bahar ka observer koi glitch nahi dekhta. Example: Ek IMU fail ho, spacecraft navigation unaffected rahe.