Redundancy — cold standby, hot standby, active redundancy: Question bank

3.6.32 · D5 · Physics › Spacecraft Structures & Systems Engineering › Redundancy — cold standby, hot standby, active redundancy

Traps se pehle, hum har symbol aur word ko lock kar lete hain jinpe questions rely karte hain, aur picture karte hain ki har cheez kaisi dikhti hai. Jo kuch bhi neeche hai wo tab tak use nahi hota jab tak yahan build nahi hota.

Ye vocabulary jo ye traps assume karte hain

Definition Switchover-time symbols (sab seconds mein measure hote hain)

Jab primary fail hoti hai aur backup takeover karti hai, total gap named pieces se bana hota hai, har ek seconds mein duration:

$t_{detect}$ — primary ke fail hone ko notice karne ka time (watchdog timeout, error flag).
$t_{power-on}$ — ek backup ko energise karne ka time jo OFF tha.
$t_{boot}$ — us backup ko apna startup sequence run karne ka time.
$t_{sync}$ — current state load karne ka time taaki backup wahan match kare jahan primary thi.
$t_{activate}$ — sirf ek already-running backup ko route karne ka time.

Cold standby saalon paancho pay karta hai; hot standby sirf $t_{detect} + t_{activate}$ pay karta hai kyunki backup already powered, booted, aur synced hai. Donon timelines side by side ke liye figure s02 dekho.

Figure — Redundancy — cold standby, hot standby, active redundancy

Upar ki picture teen redundancy states dikhati hai: cold (backup dark/OFF), hot (backup jala hua par uska output ignore kiya gaya), aur active (teeno jale hue, voter ko feed kar rahe hain). Jab tum traps padhte ho toh ise apne dimaag mein rakho.

MTTF numbers derive karna (taaki traps magic na lagein)

Neeche ke traps $MTTF_{cold} = 2/ λ$ aur $MTTF_{hot} = 3/2 λ$ quote karte hain. Yahan kyun hai, step by step, figure s03 mein reliability curves ke saath.

Formula Step 3 — cold standby: backup sirf switchover ke baad age karta hai (sequential sum)

OFF backup wait karte waqt age nahi karta; uski clock switchover par start hoti hai. Perfect detection/switching ke saath, system ki total life do puri independent lifetimes ka sum hai, $T = T_{1} + T_{2}$ , dono rate $λ$ ke saath exponential. Sum $e^{- λ t} (1 + λ t)$ kyun deta hai: do independent exponentials ka sum ek Erlang-2 (Gamma with shape 2) distribution hai. Equivalently, failures ko Poisson process rate $λ$ par count karo: system $t$ ke baad survive karta hai agar $t$ tak 2 se kam failures hui hain, yaani $0$ ya $1$ failure. Wo do Poisson terms hain $e^{- λ t}$ (zero failures) aur $λ t e^{- λ t}$ (exactly one), toh $R_{cold} (t) = 0 failures e^{- λ t} + 1 failure λ t e^{- λ t} = e^{- λ t} (1 + λ t)$ $MTTF_{cold} = \int_{0}^{\infty} e^{- λ t} (1 + λ t) d t = \frac{1}{λ} + \frac{1}{λ} = \frac{2}{λ}$

Upar ke curves ise directly dikhate hain: $t = 0$ ke paas (mission window) redundant curves single unit ke upar baithe hain; har curve ke neeche ka area uska MTTF hai.

In anchors ko dimaag mein rakho: cold standby = backup OFF, sirf switchover ke baad age karta hai; hot standby = backup ON aur parallel mein aging; active redundancy = sab units run karte hain aur ek voter outputs combine karta hai (fault masking).

True ya false — justify karo

Do computers on board automatically matlab system single-fault tolerant hai

False — switch, watchdog, aur power routing khud single points of failure hain; ek redundant part useless hai agar wo cheez jo use activate karti hai mar jaaye.

Cold standby hamesha hot standby se zyada mean-time-to-failure deta hai

Ideal model mein True (

2/ λ

3/2 λ

) kyunki OFF backup wait karte waqt age nahi karta — lekin sirf tab agar detection aur switching perfect ho, jo real hardware mein kabhi fully nahi hoti.

Hot standby ka near-zero switchover time hota hai kyunki ye failure detection skip karta hai

False — ise abhi bhi

t_{detect}

chahiye; jo ye skip karta hai wo hai

t_{power-on}

t_{boot}

, aur

t_{sync}

, kyunki backup already running aur synchronized hai.

Active (TMR) redundancy ko ek bad unit survive karne ke liye koi failure detection nahi chahiye

Masking ke liye True — majority voter correct value output karta hai regardless ki kaun sa unit galat hai, toh mission tab bhi survive karta hai jab koi culprit identify nahi kiya gaya.

Hot standby unit koi extra power consume nahi karta kyunki wo "bas wahan baitha hai"

False — wo fully powered aur continuously process kar raha hota hai; wo constant draw exactly wo price hai jo tum fast switchover ke liye pay karte ho, aur ise mission Power Budget mein permanent load ke roop mein book karna hota hai, spare ke roop mein nahi.

TMR teen units ke saath do simultaneous failures tolerate kar sakta hai

False — majority-of-3 ko kam se kam 2 healthy units chahiye; do failures ek bachata hai, aur ek majority form nahi kar sakta, toh vote ab trustworthy nahi hai.

TMR ka long-run MTTF (

5/6 λ

) single unit ke (

1/ λ

) ko beat karta hai

False — ye actually chhota hai; TMR mission window (early time) mein survive karne mein jeet-ta hai, infinite-horizon average life mein nahi, kyunki pehli failure ke baad bacha hua pair ek fresh single unit se kamzor hota hai.

Cold standby un systems ke liye useless hai jo downtime tolerate nahi kar sakte

True — iska poora weakness seconds-to-minutes boot/init gap hai (

t_{power-on} + t_{boot} + t_{sync}

), toh kuch bhi jise continuous operation chahiye (e.g. reaction wheels mid-slew) ko hot ya active redundancy use karni chahiye.

Error dhundho

"Humne saalon teeno sensor outputs ka average liya, toh ek faulty sensor humein hurt nahi kar sakta."

Galat — plain average ek outlier ko result drag karne deta hai (

10

°/s +

0.1

0.1

gives

3.4

°/s). Tujhe median ya explicit outlier rejection (outlier logic) chahiye, arithmetic mean nahi.

"Software watchdog detect karta hai jab primary computer hang karta hai, phir backup mein switch karta hai."

Galat — agar software hung hai toh wo apna khud ka detector run karne ke liye code execute nahi kar sakta; watchdog independent hardware hona chahiye jo missing heartbeats par fire kare.

"Dono units identical models hain, toh design fully redundant hai."

Galat — identical units common-mode failures share karte hain: same Single Event Upset (SEU), thermal fault, ya design bug dono ko ek saath maar sakta hai. Sacchi robustness ko kabhi kabhi dissimilar (diverse) redundancy chahiye hoti hai.

"Redundancy hamesha reliability improve karti hai, toh jitna ho sake utna backup add karo."

Galat — har backup mass, power, thermal load, aur switching complexity add karta hai, aur extra switches naye failure points add karte hain; ek point ke baad reliability drop hoti hai. Ek reliability block diagram ye dikhata hai: har added switch ek series element hai jo total ko sirf lower kar sakta hai.

"Reliability formulas assume karte hain ki do units saath fail hoti hain."

Galat — ye assume karte hain ki units independently fail hoti hain; isliye hum probabilities multiply karte hain jaise

(1 - e^{- λ t})^{2}

. Correlated failures ye tod deti hai aur real systems ko formula ke predict kiye se bura banati hai.

5/6 λ

MTTF prove karta hai ki TMR single unit se worse hai, toh kabhi use mat karo."

Galat — MTTF ek infinite-horizon average hai; ek fixed mission time ke liye TMR ki reliability zyada hoti hai (wo pehli fault mask karta hai). Formula ye bhi assume karta hai ki memoryless exponential model, jo real parts sirf approximate karte hain.

"Voting logic fail nahi ho sakta, ye sirf ek comparator hai."

Galat — voter ek real component hai apni khud ki failure rate

λ

ke saath aur ek single point of failure hai; critical designs voter ko khud redundant banate hain ya extremely simple aur hardened.

"Cross-strapping ka matlab sirf ek spare wire hona hai."

Galat — cross-strapping har unit ko multiple downstream elements tak route karne deta hai, toh ek failed switch ya path bypass kiya ja sakta hai; ye single-path bottleneck ko remove karta hai, sirf spare cable add nahi karta.

Why questions

Hot standby ka MTTF

3/2 λ

kyun aata hai

2/ λ

ki jagah?

Kyunki dono units

t = 0

se powered aur aging hain; backup ne apni life ka kuch hissa already "burn" kar liya hai hot baithte waqt (dekho

2 e^{- λ t} - e^{- 2 λ t}

curve), toh tujhe sirf aadhi lifetime milti hai, poori nahi.

Cold standby ka survival function Erlang-2 form

e^{- λ t} (1 + λ t)

kyun leta hai?

Kyunki total life do independent exponential lifetimes ka sum hai; equivalently system

t

ke baad survive karta hai sirf tab agar Poisson failure count

0

1

ho, jinki probabilities

e^{- λ t}

aur

λ t e^{- λ t}

milke

e^{- λ t} (1 + λ t)

deti hain.

Watchdog timer hardware mein kyun implement hota hai software ki bajaye?

Ek hung ya crashed processor code execute nahi kar sakta jo check kare ki wo crash hua hai ya nahi; sirf ek external, independently clocked circuit missing heartbeat notice kar sakta hai aur switch force kar sakta hai.

TMR vote se akela kaun sa unit faulty hai ye kyun nahi bata sakta?

Majority vote sirf correct answer produce karta hai aur flag karta hai "koi disagree kar raha hai"; culprit identify karne ke liye extra comparison logic chahiye — ye Fault Detection and Isolation ka kaam hai.

Crewed spacecraft (e.g. Shuttle IMUs) cold standby ki jagah active voting kyun prefer karte hain?

Navigation aur control ek boot cycle ke liye pause nahi kar sakte; active redundancy faults ko zero interruption ke saath mask karta hai, guidance solution ko failure ke through continuous rakhta hai.

Cold standby wear-out failures kyun reduce karta hai?

Jo components powered OFF hain unhe operating rate par thermal cycling, electromigration, ya bearing wear experience nahi hoti, toh unki aging clock (aur effective

λ

) tab tak rukti hai jab tak wo switch on nahi ho jaate.

Mars entry ke dauran cold se GPS lock re-acquire karna kyun matter karta hai?

Cold re-acquisition mein tens of seconds lagte hain (ek bada

t_{sync}

), lekin entry/descent/landing sirf minutes chalti hai bina kisi margin ke; hot standby ek locked, synchronized solution ready rakhta hai toh gap milliseconds ka hota hai.

Edge cases

Ek TMR system mein kya hota hai jab ek doosra unit fail ho jaata hai aur sirf ek bachta hai?

System ek single unit mein degrade ho jaata hai bina voting majority ke; ye shayad abhi bhi run kare lekin fault masking kho chuka hai, toh bahut saare designs "last-good" ya safe mode mein switch karte hain rather than ek output trust karne ke.

Reliability formulas mein,

λ \to 0

kya represent karta hai aur MTTFs kya karte hain?

λ \to 0

matlab ek near-perfect component jo almost kabhi fail nahi hota;

2/ λ

3/2 λ

, aur

5/6 λ

sab infinity tak blow up karte hain, correctly kehte hue ki ek unbreakable part ko backup ki zaroorat nahi.

Agar failure detection perfect aur instant hai, toh kya cold aur hot standby switchover time mein differ karte hain?

Haan — instant detection ke saath bhi, cold abhi bhi

t_{power-on} + t_{boot} + t_{sync}

pay karta hai, jabki hot sirf

t_{activate}

pay karta hai; difference startup sequence hai, detection nahi.

Ek "redundant" system ki reliability kya hai jiska single shared switch fail ho jaata hai?

Ye zero ho jaati hai regardless ki backups kitne healthy hain — ek series element (switch) poori chain ko multiply karta hai, toh ek shared switch failure uske peeche ki saari parallel redundancy ko defeat kar deta hai.

Kya hoga agar detector bahut eager ho aur ek failure report kare jo hui hi nahi (false positive)?

Ek spurious detection unnecessary switchover trigger karta hai — tum ek healthy backup burn kar lete ho, bina kisi reason ke ek real switchover gap add ho jaata hai, aur hot/active systems mein "good" units ke beech oscillate ho sakta hai; isliye detection thresholds aur confirmation windows tune ki jaati hain missed failures ko false alarms se trade karne ke liye.

Agar dono hot-standby units ko same SEU pattern hit kare, toh kaun sa protection bachta hai?

Redundancy se koi protection nahi — ek common-mode Single Event Upset (SEU) dono ko simultaneously corrupt kar sakta hai; phir tum error-correcting hardware ya dissimilar designs par rely karte ho, do identical copies hone par nahi.

Kya MTTF formulas tab bhi hold karte hain agar part ki end of life ke paas rising failure rate ho?

Nahi — ye memoryless exponential model (constant

λ

) assume karte hain; wear-out ke saath (bathtub curve) survival functions aur

2/ λ

3/2 λ

5/6 λ

results change ho jaate hain, aur backup ki aging behaviour explicitly model karni padti hai.

Aur voting units add karne ke baad Byzantine Fault Tolerance ki chinta kab karni padti hai?

Jab ek faulty unit alag-alag wrong values alag-alag voters ko bhej sakta hai (sirf silent nahi); us arbitrary lying behaviour ko tolerate karne ke liye simple majority-of-3 se zyada units aur agreement protocols chahiye.

Recall Quick self-test

Har ek ke liye ek phrase: cold standby ki price ::: switchover delay jab backup boot karta hai ( $t_{power-on} + t_{boot} + t_{sync}$ ). Hot standby ki price ::: continuous power draw aur backup ka faster aging (MTTF sirf $3/2 λ$ ). Active redundancy ki price ::: sabse zyada mass/power aur voter aur outlier logic par reliance (median / threshold rejection). $λ$ ka matlab ::: failures per hour; iska reciprocal $1/ λ$ single-unit MTTF hai. TMR aur IMU ka full form ::: Triple Modular Redundancy aur Inertial Measurement Unit.