Hardware redundancy

A traditional approach to fault diagnosis in the wider application context is based on hardware i.e. physical) redundancy methods which use multiple lines of sensors, actuators, computers and software to measure and/or control a particular variable. Typically, a voting scheme is applied to the hardware redundant system to decide if and when a fault has occurred and its likely location amongst redundant system components. The use of multiple redundancy in this way is common, for example with digital fly-by-wire flight control... 

Installation qualification Change control reports Parameter change control records Descriptions of hardware redundancy features... 

The aim of the first steps of designing a dependable control system consists in determining the best instrumentation, that is to say, a set of sensors and actuators that, with the lowest cost, allows the system to perform its mission despite the failure of one or several of its components. This activity is generally complex, because two antagonist aspects have to he taken into account (Conrard and Bayart, 2003) The system has to be inexpensive thanks to the minimisation of the number of components and it has to be fault tolerant which generally implies hardware redundancies. 

A sensor whose causality cannot be inverted is usually a hardware redundancy, i.e., there is/are one or more sensor(s) whose output can be used to obtain the measurement of the redundant sensor [3, 5]. For example, a fluid-level sensor in a storage tank and a pressure sensor at the bottom of that tank produce correlated measurements and one of them is a redundant sensor. It must be noted that the causality of the output port of sensors, which may be connected to controllers, is never inverted. The following five compositions are possible in sensor causalities ... 

Non-inverted causality in effort sensor (De) due to hardware redundancy, Non-inverted causality in flow sensor (Df) due to hardware redundancy. Inversion of signal sensor (Ds) to signal source (Ss). 

As already discussed in section 3.2, the landing gear system uses hardware redundancy to mitigate some of the hazards associated with a landing gear control system. The system architecture uses four processors. 

It is better to start the discussions with Fig. VII/1.4-5-1 from where it is clear that just by adding devices in redundant mode, the safety availability does not always increase, as there are pros and cons in each of the applications as shown in the first case, chances are more for spurious trip, in the second case, it is the other way round. So, a detailed study of various redundancy modes will be necessary. Dual configuration shown appears to be safe, but could also be the root cause of spurious trips due to random failures. Now the aim is to find advantages and disadvantages of implementation of various hardware redundancy architectures (industry specific and international standards). It is very useful to understand a few terms such as redundancy,... 

Hardware redundancy In hardware redundancy a set of hardware components needs to be introduced into the system to provide fault tolerance with respect to operational faults. These components are a duplication or triplication of the original set of components hence when there is no fault these are superfluous or redundant. Obviously, removal of the components in the absence of faults has no real impact on system performance. As discussed earlier, for hardware fault tolerance, the most reliable components avaUahle should be used. However, increased component reliability has hardly any impact on fault tolerance if the fault is an operational one. Hardware redundancy is more important in recovery than in prevention. 

Various types of ship-control systems are used in submarines. The ship-control system used in the Seawolf submarine represents the state of the art for such sysfems. This sysfem incorporates various features, including a fault-tolerant computer, automatic modes of control for steering, and flat-panel operator displays [23]. High-speed data buses permit the ship control to interface effectively with the data distrihution system, gyrocompass inertial sensors, and the combat system. Furthermore, hardware redundancy and performance-monitoring software permit the system to function after experiencing malfunctions of ship sensors, control electronics, and the actuation systems it controls. 

Therefore, encoding information [FOR 89] replaced hardware redundancy as the method to ensure safety. A single processor is used. The technique of a coded uniprocessor is based on a probabilistic approach developed in the 1980s. It is noteworthy that during the initial implementation stages of SACEM, two models were developed and compared a prototype based on dual redundancy and a uniprocessor architecture based on (arithmetic) encoding. 

Hardware redundancy to increase coverage of dangerous failures... 

Hardware redundancy to increase the coverage of dangerous faults... 

Hardware redundancy, e.g., one or more hardware components or channels ... 

---