Redundancy — cold standby, hot standby, active redundancy: Visual walkthrough

We will need one idea from probability and nothing else. Let's earn it.

Step 1 — What "failure rate $λ$ " actually means

WHAT. A component fails at random. We describe how fast it tends to die with one number, written $λ$ (the Greek letter "lambda"). It is a count of failures per unit time — say, per hour.

WHY this number and not another. We could try to say "it lasts exactly 5000 hours." But real hardware doesn't die on schedule; it dies randomly. The only honest thing we can state is a rate: on average, how many failures pile up per hour. If $λ = 0.001$ per hour, then in one hour there is a $0.001$ chance this part dies. That single number is enough to predict everything else.

PICTURE. Look at the timeline below. Each little tick is a "roll of the dice" per hour. Most hours the part survives; occasionally it dies. A bigger $λ$ packs the death-events closer together.

Step 2 — From rate to the survival curve $e^{- λ t}$

WHAT. We want the probability that one unit is still alive after a stretch of time $t$ . Call it $R (t)$ — the reliability. The answer is $R (t) = e^{- λ t} .$

WHY the exponential and not a straight line. Chop time into tiny slices of width $Δ t$ . In each slice the part survives with probability $(1 - λ Δ t)$ — it dodges death that slice. To survive many slices you multiply those survival chances together. Multiplying many equal factors is exactly what an exponential is. Let the slices shrink and the product becomes $e^{- λ t}$ . That is why the exponential appears — it is repeated survival, compounded.

Let's read the symbols, right where they sit:

$e$ — the fixed constant $2.718 \dots$ , the natural base that pops out of "multiply survival over and over."
$- λ t$ — the exponent. It's negative because surviving gets harder as time grows. $λ$ scales how fast; $t$ is how long you've waited.
At $t = 0$ : $R (0) = e^{0} = 1$ (brand new, certainly alive). As $t \to \infty$ : $R \to 0$ (everything dies eventually).

PICTURE. The curve starts at $1$ and decays smoothly to $0$ . Steeper $λ$ = faster decay.

The failure probability is just the leftover: $F (t) = 1 - e^{- λ t}$ . Hold onto both — the two redundancy schemes multiply and add these differently, and that is the whole story.

Step 3 — The area trick: turning a curve into MTTF

WHAT. We want a single headline number: the Mean Time To Failure, the average lifetime. The trick is: $MTTF = \int_{0}^{\infty} R (t) d t .$

WHY an integral, and why of $R$ . The symbol $\int_{0}^{\infty} \dots d t$ means "add up thin vertical strips of area from $t = 0$ to forever." Here is the beautiful fact: the area under the survival curve equals the average lifetime. Intuition — at each moment $t$ , the fraction still alive is $R (t)$ ; a unit that is alive at $t$ contributes one more instant $d t$ to its own lifespan. Summing "alive-ness" over all time totals up everyone's lifetime, divided out to an average. So area = mean life. We chose the integral because it is the one tool that converts "who's alive when" into "how long on average."

PICTURE. The shaded region under $e^{- λ t}$ is the MTTF. For a single unit that area is a clean $1/ λ$ .

Check it: $\int_{0}^{\infty} e^{- λ t} d t = \frac{1}{λ}$ . So one unit lasts $1/ λ$ on average. If $λ = 0.001/ hr$ , that's $1000$ hours. This is our baseline — the number redundancy must beat.

Recall Why is MTTF the area under

$R (t)$ ? Because $R (t)$ is the fraction still alive at $t$ , and summing that fraction over all time (the integral) totals up all the lifespans into an average. ::: Area under the survival curve = average lifetime.

Step 4 — HOT standby: two units aging together

WHAT. In hot standby, both units are powered from $t = 0$ . Both age. The system lives as long as at least one survives; it dies only when both are dead.

WHY multiply the failure chances. "Both dead" means unit-A dead AND unit-B dead. For independent parts, AND means multiply their failure probabilities: $F_{both} (t) = (1 - e^{- λ t}) \times (1 - e^{- λ t}) = (1 - e^{- λ t})^{2} .$ Reading it: each factor $(1 - e^{- λ t})$ is "this one unit already dead by $t$ " from Step 2; the exponent $2$ is "two independent units both dead."

The system reliability is whatever's left over: $R_{hot} (t) = 1 - (1 - e^{- λ t})^{2} = 2 e^{- λ t} - e^{- 2 λ t} .$

$2 e^{- λ t}$ — count each unit's survival once (two of them).
$- e^{- 2 λ t}$ — subtract the double-counted "both alive" overlap so we don't tally it twice.

PICTURE. The green two-unit curve sits above the single-unit curve — redundancy buys survival — but it still starts at $1$ and both units are burning their clocks together from the very start.

Now take the area (Step 3's trick): $MTTF_{hot} = \int_{0}^{\infty} (2 e^{- λ t} - e^{- 2 λ t}) d t = \frac{2}{λ} - \frac{1}{2 λ} = \frac{3}{2 λ} .$ The $\frac{2}{λ}$ comes from the two survival terms; the $- \frac{1}{2 λ}$ is the overlap you subtract because $e^{- 2 λ t}$ decays twice as fast (its area is half). Net: $\frac{3}{2 λ}$ — one and a half lifetimes.

Step 5 — Why only HALF a lifetime, not a whole one

WHAT. The hot backup gained you $\frac{3}{2 λ} - \frac{1}{λ} = \frac{1}{2 λ}$ — half a lifetime. Not a full one. Why?

WHY. Because the backup was switched on the whole time, aging in parallel. By the moment the primary finally dies, the hot backup has already spent part of its own life sitting there hot and running. You inherit a partly-used spare, not a fresh one.

PICTURE. Two bars aging together: when the primary bar runs out, the backup bar is already partly consumed (shaded). The leftover white piece is the bonus — only about half a bar.

Step 6 — COLD standby: the backup's clock is frozen

WHAT. In cold standby the backup is OFF. An unpowered part barely ages (Step 1's dice aren't being rolled — no power, no wear). Its lifetime clock starts only at switchover. So the total system life is the primary's life plus a fresh full backup life stacked after it.

WHY add, not overlap. The two lifetimes now happen in sequence, never at the same time. Sequential independent lifetimes add. The system dies at the second failure. The probability that fewer than 2 failures have happened by $t$ (i.e. zero or one so far) is the first two terms of the Poisson survival: $R_{cold} (t) = zero failures yet e^{- λ t} + exactly one failure, running on the spare λ t e^{- λ t} = e^{- λ t} (1 + λ t) .$

$e^{- λ t}$ — nobody has died; primary still running.
$λ t e^{- λ t}$ — exactly one death occurred and we're now living on the fresh backup. The $λ t$ counts "how much time has been spent," the $e^{- λ t}$ keeps the survival envelope.

PICTURE. The cold curve (magenta) sits above the hot curve everywhere — the frozen backup makes the whole system live longer.

Area again: $MTTF_{cold} = \int_{0}^{\infty} e^{- λ t} (1 + λ t) d t = \frac{1}{λ} + \frac{1}{λ} = \frac{2}{λ} .$ The first $\frac{1}{λ}$ is the primary's full life; the second $\frac{1}{λ}$ (from $\int_{0}^{\infty} λ t e^{- λ t} d t$ ) is the backup's full life added on. Two full lifetimes.

Step 7 — The head-to-head, and the price of the win

WHAT. Line them up: $MTTF_{cold} = \frac{2}{λ} > \frac{3}{2 λ} = MTTF_{hot} > \frac{1}{λ} = MTTF_{single} .$

WHY cold wins on paper — but not always in life. Cold wins the reliability math because its spare stays fresh. The cost hides in time: the parent note's switchover budget $t_{detect} + t_{power-on} + t_{boot} + t_{sync}$ can run to minutes for cold, versus milliseconds for hot. During Mars entry, minutes are fatal even if MTTF is larger. So the choice is reliability vs. downtime, exactly the tradeoff Reliability Block Diagrams and Power Budget force you to weigh.

PICTURE. All three survival curves stacked, with the three shaded areas labelled by their MTTF value.

Step 8 — The degenerate cases (never let the reader fall off a cliff)

WHAT & WHY & PICTURE — the corners that break naive intuition:

$t = 0$ (brand new). Every scheme gives $R = 1$ . Both curves start together at the top-left — redundancy gives no head start at birth, only staying power. On the summary figure, all curves meet at $(0, 1)$ .
$t \to \infty$ (long mission). All reliabilities decay to $0$ — redundancy delays doom, never abolishes it. That is why deep-space missions still get shorter as $λ t$ grows.
Imperfect switching ( $p_{switch} < 1$ ). Our cold-standby formula secretly assumed the switch always works. If the switch itself fails with probability $1 - p_{switch}$ , cold's advantage shrinks: $R_{cold}^{real} (t) = e^{- λ t} + p_{switch} λ t e^{- λ t} .$ When $p_{switch} = 1$ this is our Step 6 result; when $p_{switch} = 0$ it collapses to a single unit ( $e^{- λ t}$ ) — the backup is useless because you can never reach it. This is the parent note's "the switch is a single point of failure," now visible in the algebra. Hot standby, needing only $t_{activate}$ , is less exposed to this — a reason it survives FMEA scrutiny in fast-switch cases.
Powered-but-idle wear (cold not perfectly frozen). If the "off" backup actually ages at reduced rate $α λ$ with $0 < α < 1$ , cold's MTTF slides between $\frac{3}{2 λ}$ (when $α = 1$ , effectively hot) and $\frac{2}{λ}$ (when $α = 0$ , truly frozen). Reality lives in that band.

The one-picture summary

One figure holds the whole journey: the single-unit exponential (baseline area $1/ λ$ ), the hot curve above it (area $3/2 λ$ , backup aging alongside), and the cold curve highest (area $2/ λ$ , backup frozen until called). The gaps between the shaded areas are the reliability you bought — and the arrow marks the price you pay: switchover time.

Recall Feynman retelling — the whole walkthrough in plain words

A part dies at random; how fast is one number, $λ$ . ::: Survival compounds each instant, giving the curve $e^{- λ t}$ . The average lifetime is the area under that curve. ::: For one part that area is $1/ λ$ . Hot standby powers both parts from the start, so they age together; the system dies only when both die, which means multiply their failure chances. ::: You gain only half a lifetime, $\frac{3}{2 λ}$ , because the spare wore out partway while sitting hot. Cold standby keeps the spare off, freezing its clock; its full life stacks after the primary's. ::: You gain a whole lifetime, $\frac{2}{λ}$ — but you pay minutes of switchover time and you must trust the switch.