Redundant units

Box 9.1 Conversion factors between some redundant units and the SI... 

The loss of operational time when significant preventive maintenance inspections are made is one of the reasons PM programs are often less than successful. This is especially true in applications where there are few redundant units and equipment must operate at 100% of capacity. In some situations the loss form shutdown is considered too high a penalty and preventive maintenance inspections are resisted. 

Asynchronous behaviour of units and networks neither at the hardware level nor at the protocol level. This avoids the risk of multiple units hangs due to the failure of a single unit or network. The operation management of redundant units is easier thanks to the fact that networks work independently of the status of the coimected imits and units work independently of the status of the connected networks. 

Software faults may be SCCFs when the same software is used in identical redundant units in a system architecture as it is the case in the Tihange 1 NIS and when they are triggered by a condition common to all channels. For instance, a neutron flux going over a threshold limit. As we know that software faults can only be design faults, the best way - and may be the only way- to prevent software SCCF is to make sure that SCCF prone software components are as error free as possible . 

In the loo2 architecture, redundant units are used. This means that common cause must be included in the modeling. Using a Beta factor of 0.02, the model parameters are shown in Table F-4. 

Using the four total failure rates from Table F-3, common cause must be added to the model because redundant units are present. Using the same Beta factor as before (Beta = 0.02), the failure rates are calculated in Table F-11. 

Redundant devices using different technologies may also decrease common-cause susceptibility if the redundant units respond differently to a common stress. This can be accomplished by designing redundant subsystems using diverse technology. Many think that using "different manufacturers" provides diversity. This is not true if both devices respond similarly to the same stress. Diversity works only if the redundant devices respond differently to a common stress. 

For revealed failures the MDT consists of the active mean time to repair (MTTR) PLUS any logistic delays (e.g., travel, site access, spares procurement, administration). For unrevealed failures the MDT is related to the proof-test interval (T), PLUS the active MTTR, PLUS any logistic delays. The way in which failure is defined determines, to some extent, what is included in the down time. If the unavailability of a process is confined to failures while production is in progress then outage due to scheduled preventive maintenance is not included in the definition of failure. However, the definition of dormant failures of redundant units affects the overall unavailability (as calculated by the equations in the next Section). 

Similarity (Diversity between redundant units reduces CCF)... 

Table 2.4 Reliability Improvement due to Redundant Unit Allocation for the Dissipative Regulator in the Spacecraft Power System as a Function of Mission Duration...

Mission Duration (mo.) Number of Redundant Units (CC, DSR) System Reliability (%)... 

The data summarized in Tables 2.4 and 2.5 indicate that spacecraft power system reliability improves with an increase in redundant units, regardless of the type of regulator integrated in the power system. Furthermore, it is evident from the reliability data that the number of redundant units (2, 2) for the dissipative regulator offers higher reliability compared with the PWM regulator. 

When all three redundant units such as DET, CC, and battery booster (BB) are integrated in the spacecraft power, the data presented in Table 2.6 indicate that the reliability improvement is not impressive. The DET redundant option, however, offers the lowest system cost and system weight as a function of mission duration. The major reliability improvement is due to the shunt regulator circuit used in the DET system as illustrated in Figure 2.5. 

Table 2.6 Reliability Improvement of tbe Spacecraft Power System Using All Redundant Units Sucb as Direct Energy Transfer, Charge Controller, and Battery Booster...

In a multilevel serial system after redundancy allocation, the reliability of the higher level units could be obtained from the reliability of all its child units including all replicas. In general, a given unit C/, in the multilevel system has Uj subunits, Uy, U, .. t/, , which must be connected either in series or in parallel. When x is the number of redundant units, there are npc sub-units in the level below C/,. A unit in the yth redundant unit of the m h sub-unit of U, is denoted U ,. Thus, the reliability of unit U for multilevel series and parallel configurations can be calculated using the following equations ... 

As shown by Eq. (10), the cost C, of unit C/,.may be calculated from, the cost of /th replica of mih. child unit and, the additional cost of mth child unit when configuring redundancy. also denotes the number of redundant units in the mth... 

When the number of redundant units is too large, the combinatorial number in equation (7) could easily become too large to calculate. For example, a phased array radar may contains tens of thousands of components, and less than 10% of component failures are permitted for the radar working state. Using MAT-LAB (R2012a), we can obtain that Cimm 2.0501 X 10 , but larger combinatorial number would become incomputable. 

The Philae subsystems are as follows central on-board computer (dual modular, in some parts triple redundant), power distribution subsystem (in some parts dual redundant) thermal control (dual redundant) landing gear fly-wheel anchoring (dual redundant) active descent subsystem radio telecommunication (dual redundant) units. 

Unlike failures due to hardware defects that appear randomly (excluding common mode), the misdeeds of residual design errors may not always be prevented by redundancy. In fact, an unsafe specification error can be awakened by a particular combination of iiqtuts, which will irreversibly affect the output regardless of the number of redundant units. 

The organization of the electrical distribution is adapted to the satellite redundancy. This is usually a second-degree redundancy, therefore the electric power system is also organized to store, manage, and distribute electric power in two charmels, which are as independent as possible, so that for each element of the satellite, the nominal and redundant units are powered separately. 

However a number of tasks impose strong constraints of availability and duration of service inteimption. This is particularly the case for telecommunications satellites. The use of computers in hot redundancy, or at least warm ", then reduces the recovery time in case of failure. Note that even in hot redundancy, a selective redundancy scheme is adopted (one unit is master and actually sends the commands). Error detection is based on the same techniques as in cold or warm redimdancy, without comparing outputs of redundant units. 

In warm redundancy, the redundant unit is powered but does not perform nominal processing. It may still update its context (and further accelerate the recovery time with regards to a cold redundancy) and rmdertake testing procedures, reducing dormant faults. 

Depending on the time constraints of recovery and continuity of service or availability needs, a solution of either warm or hot redundancy can be adopted. Hot redundancy allows a very short recovery time, consistent with the needs of a launcher, such as Ariane 5. On a satellite, a longer recovery time can be considered without any perceptible impact on the service. A warm redundancy solution will reduce latency by test programs on the redundant unit. In both cases, warm or hot redundancy will enable the mission context to be managed independently on each unit, limiting the potential propagation of faults. 

Regarding safety, the management of a survival mode is based on the definition of procedures that are as simple as possible, and the choice of the smallest possible set of resources, with minimal dependencies on resources used for the mission, at least for the suspected resources after the failure that led to the decision to engage the survival mode. For example, the redundant unit may be used for every element necessary for survival that was used before the failure (but this is not always the best solution because of dormant faults in the inactive units). 

Each application then computes its own output (as it would be without redundancy) and begins to update its own state, the only difference being that these calculations are done only if the redundancy allows in other words, the redundancy can freeze all cyclical application processing. Finally, the outputs are provided by the application to SEC RED, which decides, still according to its own state and the outputs of the redundant unit, if they can be applied as they are, or if they should be forced to a restrictive state. 

Like safety inputs, outputs are either wired binary outputs or messages sent to remote equipment. If a unit is not authorized to issue its outputs (e.g. it is isolated and passive), they are forced to a restrictive state, and sending messages is prevented. In the final cycle, each unit sends the output computed by its safety application to the redundant unit, and a comparison process is made on both sides in order to detect differences. These differences appear mainly due to differences at the context level. 

To avoid this behavior, SEC RED on each unit compares the outputs of the local unit with the outputs of the redundant unit (received by the inter unit link). If differences exist, the outputs of each unit are applied as is (so that if an output management card is faulty, the outputs are still applied by the equipment). However, if a difference between the outputs is detected, then for each problematic output, all transition from restrictive state to permissive state is prohibited (see Figure 11.5). 

Hence when considering the choice of sensor, bear in mind that if it does not meet the best credentials it may be necessary to install redundant units to meet the SIL targets. 

There are two redundant hardware Protective Logic Units working in parallel. The outputs of these two redundant units are voted using logic one out of two at the actuator/interlock device level. 

---