3 ms·

Interesting points about the automotive world.... and I absolutely agree with you about the certification problems with a mix of safe/non-safe components. I've

Interesting points about the automotive world.... and I absolutely agree with you about the certification problems with a mix of safe/non-safe components. I've never heard the 2xN = 1x(N+1) argument, but will that improve for >2 ? e.g. triply-redundant systems? I think the root problem there is the "wishful thinking" isn't it?

dfox 10y ago
The 2xN = 1x(N+1) argument is usually presented as being somehow directly derived from IEC 61508, which is certainly non-sense. I've even seen reasoning along the lines of "it runs on Windows NT, thus it's inherently SIL2, there are two redundant IPCs running that code, so it's SIL3". As for dual-redundant vs. triply-redundant it highly depends on whether shutting the system down on failure of one redundant component is desirable outcome, both railway signaling and most industrial systems can and are designed that way, but for systems where that is not possible (either because they need some non-trivial actions to get into safe state or because the whole SIL dance is about keeping the thing running at all costs for business/legal reasons) the dual-redundancy actually decreases the reliability, because additional components handling the redundancy also have their own failure probability (and in many systems does fail more often than whatever it is supposed to protect from failure, especially in master-slave systems that attempt to detect which of the halves had failed and respond to that by failover to the other one). Interesting approach that is often used for road traffic signalling and general industrial control is that there is second control system, that only checks that outputs of the primary control system are consistent (for traffic signals, it is trivial boolean function of the outputs, usually implemented in hardwired circuitry) and shuts the whole thing down when they are not.

dfox 10y ago

The 2xN = 1x(N+1) argument is usually presented as being somehow directly derived from IEC 61508, which is certainly non-sense. I've even seen reasoning along the lines of "it runs on Windows NT, thus it's inherently SIL2, there are two redundant IPCs running that code, so it's SIL3". As for dual-redundant vs. triply-redundant it highly depends on whether shutting the system down on failure of one redundant component is desirable outcome, both railway signaling and most industrial systems can and are designed that way, but for systems where that is not possible (either because they need some non-trivial actions to get into safe state or because the whole SIL dance is about keeping the thing running at all costs for business/legal reasons) the dual-redundancy actually decreases the reliability, because additional components handling the redundancy also have their own failure probability (and in many systems does fail more often than whatever it is supposed to protect from failure, especially in master-slave systems that attempt to detect which of the halves had failed and respond to that by failover to the other one). Interesting approach that is often used for road traffic signalling and general industrial control is that there is second control system, that only checks that outputs of the primary control system are consistent (for traffic signals, it is trivial boolean function of the outputs, usually implemented in hardwired circuitry) and shuts the whole thing down when they are not.