Insights from Fault Tree Analysis: Dual Parallel Redundancy in OnBoard Computers
- October 17, 2026
- CAVU Aerospace UK
CDH-FS is double redundant OBC based on Microchip SmartFusion2 FPGA with considerable amount of redundancy in design, low power consumption. It’s designed for missions with relatively low onboard processing, simple C&DH operations, budget-friendly & reliable sub-system. It must deliver continuous, deterministic control, data processing, and interfacing under harsh radiation, thermal, and power environments. Single-point failures in memory, microcontrollers, interfaces, or power can lead to loss of mission capability.
To address this, the CDH-FS architecture employs two OBCs operating in parallel as a redundant pair. System-level failure occurs only when both units fail. The accompanying fault tree maps systematically decompose the failure modes of a single OBC and its subsystems. These trees demonstrate why dual parallel redundancy is highly effective at elevating overall system reliability.
Overview of the Fault Tree Structure
The top-level fault tree defines the undesired event “OBC failure”. This top event is the output of an OR gate fed by four primary intermediate events:
- Memory failure
- Problem in microcontroller
- Problem in ports and interfaces
- Power supply failure
Each branch is further developed into basic events (primarily radiation-induced effects such as Single-Event Upsets (SEUs), Single-Event Transients (SETs), and latch-up), component failures, and software issues. Transfer symbols link detailed sub-trees (RS-485, RS-422, CAN, NAND Flash, MRAM, ADDA, etc.).
Memory Branch
- Failures in MRAM (used as RAM and ROM) arise from controller SEUs/SETs or aging/wear-leveling issues in the MRAM chips.
- Failures in NAND Flash (noted with “#3 Redundancy”) similarly stem from controller SEUs/SETs or wear-leveling. The explicit redundancy marking indicates internal mitigation already present at the storage level.
Microcontroller Branch
- User-program failure (undeveloped event).
- Operating-system failure.
- RTC and Watchdog Timer failure, driven primarily by SEUs in registers.
Ports and Interfaces Branch
This is the most extensive sub-tree and covers:
- CAN subsystem (#4) – controller SEUs/SETs and physical-layer problems.
- UART subsystem – further split into RS-485 and RS-422 failures (each with controller SEU/SET and PHY issues).
- GPIO, DAC, SPI, and I2C controllers – again dominated by SEUs in registers and SETs in interconnects, plus voltage-translator or buffer problems (including FPGA ProASIC3 interfaces).
Power Supply Branch
- Under-voltage, over-voltage, short-circuit (including radiation-induced latch-up from heavy ions or protons), and fuse failures.
An additional ADDA (analog-to-digital / digital-to-analog) sub-tree addresses power, ADC (ADG1608, AD7616, controller), and DAC paths, again highlighting SEU/SET sensitivity.
The dominant basic events across the trees are radiation effects (SEU, SET, latch-up) and component aging or physical-layer faults. Software and configuration issues appear but are secondary in the documented structure.
Why Dual Parallel OBC Redundancy Is Highly Effective
Because the top event for a single OBC is an OR combination of many independent or weakly correlated failure modes, the unreliability of one OBC is the sum (approximately) of the un-reliabilities of its major branches. In a high-radiation environment the cumulative probability of any single OBC experiencing a critical failure over a mission lifetime is non-negligible.
When two identical OBCs operate in parallel (hot or warm redundancy with appropriate cross-strapping and voting/switch-over logic), the system fails only if both units fail. Under the realistic assumption that the two units experience largely independent radiation hits and component failures, the system unreliability becomes the product of the individual un-reliabilities.
