Redundancy — cold standby, hot standby, active redundancy: Question bank

Before the traps, we lock down every symbol and word the questions lean on, and picture what each one looks like. Nothing below is used until it is built here.

The vocabulary these traps assume

Figure — Redundancy — cold standby, hot standby, active redundancy

The picture above shows the three redundancy states: cold (backup dark/OFF), hot (backup lit but its output ignored), and active (all three lit, feeding a voter). Keep it in your mind's eye as you read the traps.

Deriving the MTTF numbers (so the traps are not magic)

The traps below quote $MTTF_{cold} = 2/ λ$ and $MTTF_{hot} = 3/2 λ$ . Here is why, step by step, with the reliability curves in figure s03.

Formula Step 3 — cold standby: backup ages only after switchover (sequential sum)

The OFF backup does not age while waiting; its clock starts at switchover. With perfect detection/switching, the system's total life is the sum of two full independent lifetimes, $T = T_{1} + T_{2}$ , each exponential with rate $λ$ . Why the sum gives $e^{- λ t} (1 + λ t)$ : the sum of two independent exponentials is an Erlang-2 (Gamma with shape 2) distribution. Equivalently, count failures as a Poisson process at rate $λ$ : the system survives past $t$ if fewer than 2 failures have occurred by $t$ , i.e. either $0$ or $1$ failure. Those two Poisson terms are $e^{- λ t}$ (zero failures) and $λ t e^{- λ t}$ (exactly one), so $R_{cold} (t) = 0 failures e^{- λ t} + 1 failure λ t e^{- λ t} = e^{- λ t} (1 + λ t)$ $MTTF_{cold} = \int_{0}^{\infty} e^{- λ t} (1 + λ t) d t = \frac{1}{λ} + \frac{1}{λ} = \frac{2}{λ}$

The curves above show it directly: near $t = 0$ (the mission window) the redundant curves sit above the single unit; the area under each curve is its MTTF.

Keep these anchors in mind: cold standby = backup OFF, ages only after switchover; hot standby = backup ON and aging in parallel; active redundancy = all units run and a voter combines outputs (fault masking).

True or false — justify

Two computers on board automatically means the system is single-fault tolerant

False — the switch, watchdog, and power routing are themselves single points of failure; a redundant part is useless if the thing that activates it dies.

Cold standby always gives a longer mean-time-to-failure than hot standby

True in the ideal model (

2/ λ

3/2 λ

) because the OFF backup does not age while waiting — but only if detection and switching are perfect, which real hardware never fully is.

Hot standby has near-zero switchover time because it skips failure detection

False — it still needs

t_{detect}

; what it skips is

t_{power-on}

t_{boot}

, and

t_{sync}

, since the backup is already running and synchronized.

Active (TMR) redundancy needs no failure detection to survive one bad unit

True for masking — the majority voter outputs the correct value regardless of which unit is wrong, so the mission survives even before anyone identifies the culprit.

A hot standby unit consumes no extra power because it "just sits there"

False — it is fully powered and processing continuously; that constant draw is exactly the price you pay for the fast switchover, and it must be booked into the mission Power Budget as a permanent load, not a spare.

TMR with three units can tolerate two simultaneous failures

False — majority-of-3 needs at least 2 healthy units; two failures leave one, and one cannot form a majority, so the vote is no longer trustworthy.

TMR's long-run MTTF (

5/6 λ

) beats a single unit's (

1/ λ

)

False — it is actually smaller; TMR wins on surviving the mission window (early time), not on infinite-horizon average life, because after the first failure the remaining pair is weaker than a fresh single unit.

Cold standby is useless for systems that cannot tolerate downtime

True — its whole weakness is the seconds-to-minutes boot/init gap (

t_{power-on} + t_{boot} + t_{sync}

), so anything needing continuous operation (e.g. reaction wheels mid-slew) must use hot or active redundancy.

Spot the error

"We averaged all three sensor outputs, so one faulty sensor can't hurt us."

Wrong — a plain average lets an outlier drag the result (

10

°/s +

0.1

0.1

gives

3.4

°/s). You need median or explicit outlier rejection (outlier logic), not arithmetic mean.

"Software watchdog detects when the primary computer hangs, then switches to backup."

Wrong — if the software is hung it cannot run its own detector; the watchdog must be independent hardware that fires on missing heartbeats.

"Both units are identical models, so the design is fully redundant."

Wrong — identical units share common-mode failures: the same Single Event Upset (SEU), thermal fault, or design bug can kill both at once. True robustness sometimes needs dissimilar (diverse) redundancy.

"Redundancy always improves reliability, so add as many backups as possible."

Wrong — each backup adds mass, power, thermal load, and switching complexity, and the extra switches add new failure points; beyond a point reliability drops. A reliability block diagram shows this: every added switch is a series element that can only lower the total.

"The reliability formulas assume the two units fail together."

Wrong — they assume the units fail independently; that is why we multiply probabilities like

(1 - e^{- λ t})^{2}

. Correlated failures break this and make real systems worse than the formula predicts.

"The

5/6 λ

MTTF proves TMR is worse than a single unit, so never use it."

Wrong — MTTF is an infinite-horizon average; for a fixed mission time TMR's reliability is higher (it masks the first fault). The formula also assumes the memoryless exponential model, which real parts only approximate.

"Voting logic can't fail, it's just a comparator."

Wrong — the voter is a real component with its own failure rate

λ

and is a single point of failure; critical designs make the voter itself redundant or extremely simple and hardened.

"Cross-strapping just means having a spare wire."

Wrong — cross-strapping lets each unit route to multiple downstream elements, so a failed switch or path can be bypassed; it removes the single-path bottleneck, not just adds a spare cable.

Why questions

Why does hot standby's MTTF come out to

3/2 λ

instead of

2/ λ

Because both units are powered and aging from

t = 0

; the backup has already "burned" part of its life while sitting hot (see the

2 e^{- λ t} - e^{- 2 λ t}

curve), so you gain only half a lifetime, not a full one.

Why does cold standby's survival function take the Erlang-2 form

e^{- λ t} (1 + λ t)

Because the total life is the sum of two independent exponential lifetimes; equivalently the system survives past

t

only if the Poisson failure count is

0

1

, whose probabilities

e^{- λ t}

and

λ t e^{- λ t}

add to

e^{- λ t} (1 + λ t)

Why is the watchdog timer implemented in hardware rather than software?

A hung or crashed processor cannot execute code that checks whether it has crashed; only an external, independently clocked circuit can notice the missing heartbeat and force a switch.

Why can't TMR tell you which unit is faulty from the vote alone?

The majority vote only produces the correct answer and flags "someone disagrees"; identifying the culprit needs extra comparison logic — this is the job of Fault Detection and Isolation.

Why do crewed spacecraft (e.g. Shuttle IMUs) prefer active voting over cold standby?

Navigation and control cannot pause for a boot cycle; active redundancy masks faults with zero interruption, keeping the guidance solution continuous through a failure.

Why does cold standby reduce wear-out failures?

Components that are powered OFF do not experience thermal cycling, electromigration, or bearing wear at the operating rate, so their aging clock (and effective

λ

) stops until they are switched on.

Why does re-acquiring GPS lock from cold matter during Mars entry?

Cold re-acquisition takes tens of seconds (a large

t_{sync}

), but entry/descent/landing lasts only minutes with no margin; hot standby keeps a locked, synchronized solution ready so the gap is milliseconds.

Edge cases

What happens to a TMR system when a second unit fails and only one remains?

The system degrades to a single unit with no voting majority; it may still run but has lost fault masking, so many designs switch to a "last-good" or safe mode rather than trust one output.

In the reliability formulas, what does

λ \to 0

represent and what do the MTTFs do?

λ \to 0

means a near-perfect component that almost never fails;

2/ λ

3/2 λ

, and

5/6 λ

all blow up to infinity, correctly saying an unbreakable part needs no backup.

If failure detection is perfect and instant, do cold and hot standby differ in switchover time?

Yes — even with instant detection, cold still pays

t_{power-on} + t_{boot} + t_{sync}

, while hot pays only

t_{activate}

; the difference is the startup sequence, not the detection.

What is the reliability of a "redundant" system whose single shared switch fails?

It collapses to zero regardless of how healthy the backups are — a series element (the switch) multiplies the whole chain, so one shared switch failure defeats all parallel redundancy behind it.

What if the detector is too eager and reports a failure that did not happen (a false positive)?

A spurious detection triggers an unnecessary switchover — you burn a healthy backup, add a real switchover gap for no reason, and in hot/active systems may oscillate between "good" units; this is why detection thresholds and confirmation windows are tuned to trade missed failures against false alarms.

If both hot-standby units are hit by the same SEU pattern, what protection remains?

None from redundancy — a common-mode Single Event Upset (SEU) can corrupt both simultaneously; you then rely on error-correcting hardware or dissimilar designs, not on having two identical copies.

Do the MTTF formulas still hold if a part has a rising failure rate near end of life?

No — they assume the memoryless exponential model (constant

λ

); with wear-out (a bathtub curve) the survival functions and the

2/ λ

3/2 λ

5/6 λ

results change, and the backup's aging behaviour must be modelled explicitly.

When does adding more voting units require worrying about Byzantine Fault Tolerance?

When a faulty unit can send different wrong values to different voters (not just be silent); tolerating that arbitrary lying behaviour needs more units and agreement protocols than simple majority-of-3.

Recall Quick self-test

One phrase for each: cold standby's price ::: switchover delay while the backup boots ( $t_{power-on} + t_{boot} + t_{sync}$ ). Hot standby's price ::: continuous power draw and faster aging of the backup (MTTF only $3/2 λ$ ). Active redundancy's price ::: highest mass/power and reliance on voter and outlier logic (median / threshold rejection). Meaning of $λ$ ::: failures per hour; its reciprocal $1/ λ$ is the single-unit MTTF. What TMR and IMU stand for ::: Triple Modular Redundancy and Inertial Measurement Unit.