Worked examples — Redundancy — cold standby, hot standby, active redundancy

This page drills the redundancy formulas from the parent topic until every case is muscle memory. We will not introduce new theory — we will stress-test the reliability tools on every kind of input a problem can throw at you: normal numbers, zero time, infinite time, degenerate switches, word problems, and one exam twist.

Before we start, one reminder of the symbols we already earned in the parent note (nothing new here):

Recall The symbols we already built

• $\lambda$ ::: the failure rate — how many failures per hour a single unit averages. Bigger $\lambda$ = fails sooner.
• $R(t)$ ::: reliability at time $t$ — the probability a unit is still alive at time $t$. Starts at $1$ (alive for sure), decays toward $0$.
• $e^{-\lambda t}$ ::: the survival curve of one unit — why exponential? Because a constant failure rate means the chance of surviving the next hour is the same every hour, and multiplying that constant survival over many hours gives an exponential. It is the only curve with "no memory".
• $\text{MTTF}={\int }_0^{\infty }R(t)dt$ ::: mean time to failure — the area under the survival curve. Wider area = lives longer on average.

---

The scenario matrix

Every redundancy problem you will meet falls into one of these case classes. The worked examples below are labelled with the cell they cover, and together they hit every cell.

Cell	Case class	What makes it tricky
A	Normal cold vs hot MTTF	plug numbers, compare $2/\lambda$ vs $3/2\lambda$
B	Reliability at a specific finite time $t$	evaluate $R(t)$, don't confuse with MTTF
C	Zero-time input ($t=0$)	degenerate: every system reads $R=1$
D	Infinite-time limit ($t\to \infty$)	degenerate: every $R\to 0$
E	TMR (active, 2-of-3) crossover	TMR is worse than single for large $t$
F	Imperfect switch (single point of failure)	switch reliability $R_s<1$ multiplies in
G	Power-budget word problem	reliability gain vs watts cost
H	Exam twist — "when does TMR beat single?"	solve inequality for $R$

---

Example A — Cold vs hot standby MTTF (normal numbers)

Forecast: Guess the ordering before reading on. Which redundancy scheme should give the longest average life?

1. Single unit. ${\text{MTTF}}_{\text{single}}=\frac{1}{\lambda }=\frac{1}{2\times 10^{-5}}=50,000$ h. Why this step? This is our baseline — everything else is measured against it.

2. Hot standby. From the parent, ${\text{MTTF}}_{\text{hot}}=\frac{3}{2\lambda }=1.5\times 50,000=75,000$ h. Why this step? Both units age together, so the backup burns half its life just sitting warm — we gain only half a lifetime.

3. Cold standby. ${\text{MTTF}}_{\text{cold}}=\frac{2}{\lambda }=2\times 50,000=100,000$ h. Why this step? The cold backup's clock only starts at switchover, so we gain a full second lifetime.

Verify: Ratio ${\text{MTTF}}_{\text{cold}}:{\text{MTTF}}_{\text{hot}}:\text{single}=2:1.5:1$. Cold wins on paper — matching the parent's key comparison $\frac{2}{\lambda }>\frac{3}{2\lambda }$. Units are hours throughout. ✓ (This cell is A.)

---

Example B — Reliability at a finite mission time

Forecast: MTTF said cold was best. At a specific short time, will cold still look better, and by how much?

1. Single unit. $\lambda t=2\times 10^{-5}\times 10^4=0.2$, so $R=e^{-0.2}=0.8187$. Why this step? We need the single-unit survival first because both redundant formulas are built from it.

2. Hot standby. $R_{\text{hot}}=2e^{-\lambda t}-e^{-2\lambda t}=2(0.8187)-e^{-0.4}=1.6374-0.6703=0.9671$. Why this step? Hot standby fails only when both fail; this formula is $1-(1-e^{-\lambda t}{)}^2$.

3. Cold standby. $R_{\text{cold}}=e^{-\lambda t}(1+\lambda t)=0.8187(1+0.2)=0.8187\times 1.2=0.9824$. Why this step? Cold uses the first two Poisson terms because it survives until the second failure, and the backup didn't age while waiting.

Verify: Order at this time is $R_{\text{cold}}=0.9824>R_{\text{hot}}=0.9671>R_{\text{single}}=0.8187$ — cold is best here too, consistent with Example A. All are probabilities in $[0,1]$. ✓

The figure below plots all three survival curves. Notice they all launch from $R=1$ at the left edge (Example C), the grey single-unit curve sags fastest, and at the red dashed line $t=10,000$ h the three coloured dots sit exactly at the numbers we just computed — blue (cold) highest, orange (hot) just below, grey (single) far lower.

(Cell B.)

---

Example C — The zero-time degenerate case

Forecast: Before computing — what's the probability anything has failed the instant you turn it on?

1. Single: $e^{-\lambda \cdot 0}=e^0=1$.
2. Hot: $2e^0-e^0=2-1=1$.
3. Cold: $e^0(1+0)=1\cdot 1=1$. Why these steps? At $t=0$ nothing has had time to fail. A correct reliability curve must start at $1$ (certain survival). Any formula that gave anything else at $t=0$ would be wrong.

Verify: All three equal $1$. This is the sanity check every reliability formula must pass — if yours doesn't start at $1$, you copied it wrong. ✓ (Cell C.)

---

Example D — The infinite-time limit

Forecast: Given infinite time, does any redundancy scheme survive forever?

1. Single: $\underset{t\to \infty }{\lim }{e}^{-\lambda t}=0$. Why this step? We start with the simplest curve because the other three are all built from $e^{-\lambda t}$ — if it dies, they inherit that death.

2. Hot: $2e^{-\lambda t}-e^{-2\lambda t}\to 2\cdot 0-0=0$. Why this step? Both terms contain a decaying exponential, so each term is dragged to zero independently — a sum of zeros is zero.

3. Cold: $e^{-\lambda t}(1+\lambda t)\to 0$ (exponential beats the linear $\lambda t$). Why this step? This is the one term that could fool you — the $(1+\lambda t)$ factor grows, but $e^{-\lambda t}$ shrinks faster than any polynomial grows, so the product still dies. We must check the fastest-growing factor to be sure.

4. TMR: $3R^2-2R^3$ with $R=e^{-\lambda t}\to 0$ gives $0$. Why this step? TMR's reliability is a polynomial in $R$ with no constant term, so once the underlying unit reliability $R\to 0$ the whole voter output collapses to zero too.

Verify: Every system tends to $0$. Redundancy buys time, never immortality — it slows the decay, it cannot stop it. The area under the slower-decaying curve is exactly the MTTF gain we computed in Example A. ✓ (Cell D.)

---

Example E — TMR and its crossover point

Forecast: TMR always beats a single unit... or does it? Guess what happens when each unit is already unreliable ($R=0.4$).

1. High-quality units, $R=0.9$. $R_{\text{TMR}}=3(0.81)-2(0.729)=2.43-1.458=0.972$. Why this step? When units are good, "2-of-3" masks the rare single failure — TMR ($0.972$) beats single ($0.9$).

2. Poor units, $R=0.4$. $R_{\text{TMR}}=3(0.16)-2(0.064)=0.48-0.128=0.352$. Why this step? When units are bad, needing two to work simultaneously is harder than needing one — TMR ($0.352$) is worse than single ($0.4$)!

Verify: The crossover is exactly $R=0.5$ (see Example H). Above it TMR helps; below it TMR hurts. So $0.9$ helps, $0.4$ hurts — matches. ✓

The figure below draws the grey diagonal (single unit, output = input) against the green TMR curve. Where the green curve sits above the diagonal (shaded green, $R>0.5$) TMR helps; where it dips below (shaded red, $R<0.5$) TMR hurts. The blue dot at $R=0.9$ lands in the green zone, the orange dot at $R=0.4$ lands in the red zone, and the two curves cross exactly at the red dot $R=0.5$.

(Cell E.)

---

Example F — Imperfect switch (single point of failure)

Forecast: The parent warned the switch is itself a single point of failure. Guess: does a $0.98$ switch wipe out the redundancy benefit?

1. Ideal redundant pair. $R_{\text{pair}}=1-(0.05{)}^2=1-0.0025=0.9975$. Why this step? This is the "two computers, perfect switch" fantasy — the number people quote.

2. Multiply by the switch. The whole chain only works if the switch also works, so multiply: $R_{\text{real}}=R_{\text{pair}}\times R_s=0.9975\times 0.98=0.97755$. Why this step? The switch is in series with the redundant block — one series weak link caps the whole system (this is a reliability block diagram with a series element).

3. Sanity vs single unit. Single unit $=0.95$. So real redundancy $0.9776>0.95$ — still a gain, but far short of the $0.9975$ fantasy.

Verify: $0.95<0.9776<0.9975$: redundancy still helps but the switch throws away most of the gain. This is why real spacecraft use fault detection and isolation plus cross-strapping to make the switch itself reliable. ✓ (Cell F.)

---

Example G — Power-budget word problem

Forecast: Reliability says cold has higher MTTF anyway. Does the power budget agree or conflict?

1. Check the hot-standby power draw. Extra load $=12$ W. Available margin $=5$ W. Since $12>5$, hot standby violates the power budget. Why this step? A design that busts the power budget is infeasible regardless of reliability — power is a hard constraint.

2. Check the cold-standby power draw. Extra load $=0$ W (backup OFF). $0\le 5$: fits. Why this step? Cold's zero standby power is its headline advantage on a battery-tight spacecraft.

3. Check the timing requirement. Cold's $90$ s switchover $\le$ tolerable $90$ s gap: acceptable. Why this step? Cold's only downside (delay) is inside the allowed limit here.

Verify: Power ($0\le 5$ ✓), timing ($90\le 90$ ✓), and cold already had the higher MTTF from Example A. Every constraint points to cold standby — a rare case with no tradeoff. ✓ (Cell G.)

---

Example H — Exam twist: solve for the TMR crossover

Forecast: Example E hinted the crossover is $0.5$. Prove it and find the other roots.

1. Set up the equation. $3R^2-2R^3=R$. Why this step? "TMR beats single" ⇔ $3R^2-2R^3>R$; the boundary is equality.

2. Bring to one side and factor. $2R^3-3R^2+R=0\Rightarrow R(2R^2-3R+1)=0\Rightarrow R(2R-1)(R-1)=0$. Why this step? Factoring turns a cubic into three simple roots — no formula needed.

3. Read off the roots. $R=0$, $R=\frac{1}{2}$, $R=1$. Why this step? A product equals zero only when one of its factors is zero, so we set each of the three factors $R$, $2R-1$, $R-1$ to zero in turn — that is the whole point of factoring, it hands us the roots directly.

4. Decide the winning region. Test $R=0.9$ (Example E): TMR $0.972>0.9$ ✓. Test $R=0.4$: TMR $0.352<0.4$ ✓. So TMR beats single exactly when $R>\frac{1}{2}$. Why this step? Roots only mark where the two curves cross; to learn which side wins we must sample one point in each interval between roots — the sign of the difference there settles the whole interval.

Verify: Roots $\{0,\frac{1}{2},1\}$ satisfy the cubic; the sign tests confirm TMR helps above $0.5$ and hurts below. Consistent with Example E. ✓ (Cell H.)

Recall Quick self-test

At $R=0.5$, does TMR beat a single unit? ::: No — they are exactly equal; $R=0.5$ is the crossover. Why does cold standby have higher MTTF than hot? ::: The cold backup doesn't age while OFF, so you gain a full second lifetime instead of only half. A "redundant" system with a fragile switch — where does the switch sit in the reliability block diagram? ::: In series with the redundant block, so it caps total reliability.

---

Where each idea connects

See also: Failure Modes and Effects Analysis (FMEA) to find which failures need covering, Single Event Upset (SEU) for the radiation bit-flips that trigger switchovers, and Byzantine Fault Tolerance for when a faulty unit lies to the voter.