Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Typically in commercial embedded systems, a <a href="https://en.wikipedia.org/wiki/Watchdog_timer" rel="nofollow noreferrer">watchdog timer </a> would be utilized to reset the processor in the case that it fails to respond by periodically "kicking the dog". All AVR microcontrollers (and many if not most other brands as well) have an internal watchdog timer. Though a design with an independent, external watchdog timer is typically more robust and reliable. Like <a href="http://www.embedded.com/electronics-blogs/beginner-s-corner/4023849/Introduction-to-Watchdog-Timers" rel="nofollow noreferrer">this</a>:</p> <p><img src="https://i.stack.imgur.com/nUl3r.gif" alt="external watchdog setup"></p> <p>For systems that require an even higher degree of fault tolerance, for instance aerospace applications, triple redundant or <a href="https://en.wikipedia.org/wiki/Triple_modular_redundancy" rel="nofollow noreferrer">triple modular redundant</a> architectures are used.</p> <p>In a triple redundant system, three identical processing components perform the same task at the same time. The result is then sent to a voting circuit or what John von Neumann called a "<a href="https://ece.uwaterloo.ca/~ssundara/courses/prob_logics.pdfSection=features3&amp;template=/ContentManagement/ContentDisplay.cfm&amp;ContentID=30533" rel="nofollow noreferrer">majority organ</a>" (Section 4.2.2). The output of the voting circuit is the majority opinion of the three processing components.</p> <p><img src="https://i.stack.imgur.com/Z8Eel.gif" alt="triple redundancy"></p> <p>This allows for one of the processing components to fail without affecting the operation of the system. However, if the voting circuit fails, then the whole system fails as well. A triple modular redundant system does away with this single point of failure by implementing three voting circuits as well.</p> <p><img src="https://i.stack.imgur.com/PS3n9.gif" alt="triple modular redundant"></p> <p>Eventually though, the three outputs will need to be combined into one result again leading to a single point of failure. Even if that point of failure is the human looking at three gauges, each monitoring the same temperature.</p> <p>What you need to determine is just how <a href="https://en.wikipedia.org/wiki/Fault-tolerant" rel="nofollow noreferrer">fault-tolerant</a> you need your system to be and what kind of <a href="https://en.wikipedia.org/wiki/Mean_time_between_failures" rel="nofollow noreferrer">mean time between failures (MTBF)</a> your system can handle. Then design your redundancy system around that.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload