Redundancy implementations and consideration of related failures in spacecraft electronic systems

Redundancy is a technique that has been used to improve space electronic systems reliability. The traditional implementation has been to incorporate redundancy by having the passive or active availability of two separate boxes that perform the same function. Technical advances have led to higher interconnect density at the part, circuit board, and electronic box levels. Coupled with these advances, the desire to keep weight and power requirements to a minimum while continually expanding overall system performance, has led to designs that incorporate lesser degrees of redundancy and no longer show the same degree of physical separation as in the past. This lack of separation can increase the probability of common cause and propagating failures, which compromise the capability that redundancy provides. In addition, the cycle time for manufacture and test of electronic units has been shortened significantly which increases the probability that prime and redundant units have experienced the same manufacturing and test processes and environments. Also, the probability of having parts from the same lot in multiple boxes has increased, thus leading to the potential of one part defect having a deleterious impact across multiple systems. Undoubtedly, advances in automation and improvement and standardization of manufacturing and test processes have been major contributors to reliability growth; however, the potential for common-cause failures should be explicitly realized both in the necessary manufacturing and test controls and in system reliability calculations. The purpose of this paper is to provide a brief overview of redundancy as it has been applied in the space industry. It will also discuss different types of redundancy implementations and vulnerabilities to dependent failures. Potential mitigations are discussed.

1. Introduction

The primary considerations in determining whether or not redundancy is required have been whether or not the loss of a critical function would lead to the loss or severe degradation of a mission and whether or not redundancy could be implemented within the weight, power, and cost constraints of a mission. The decision to incorporate redundancy is made in part with the assumption that problems initiated by random faults can appear regardless of the amount of attention given to quality issues (such as how well an electronic box is made and the quality of parts that go into it).