Resilient Redundancy: Design Study of the New HTV (H-II Transfer Vehicle)

This work proposes a new "resilient redundancy" design.

While redundancy design is commonly believed to increase reliability of system, it could REDUCE it by the complexity and hidden common-mode errors introduced by the redundancy itself. [1][2]

Conventional "switch-over" redundancy management design inherently leads to discontinuity of control. Because of this discontinuity, system behavior could become unpredictable. Paradoxically, design efforts to prevent the discontinuity could make system even more unpredictable due to complexity introduced by "transient-special" control logic.

In this paper, we analyze the difference between conventional redundancy design and "nature's redundancy" such as the redundancy of right & left hands. Then a new redundancy design for the H-II Transfer Vehicle (HTV) is proposed. "Redundancy without backup string" concept will be described in detail. Although there are no backup strings, the system maintains mission capability against any combinations of two failures. The system redundancy is composed of non-identical triple strings all of which can operate either independently or jointly. The idea is based on Resilient Engineering. The goal is to realize a system to "adjust its functioning prior to, during, or following changes and disturbances" [3] in redundant manner, but without inviting unexpected behavior or control discontinuity.

Next, safety control architecture under the new redundancy design will be discussed. Conventional safety design often requires independent barriers in the system. Common implementation relies on multiple backup strings or independent safety devices. However, independent backup or safety devices can become a heavy load to the system because the unused backups will not contribute to the mission. As the result of it, safety and mission often conflict each other and it happens that mission capability needs to be compromised in order to protect safety and vice versa. By introducing the "redundancy without backup" policy, we propose to establish a new design paradigm where mission capability and safety can overcome that "zero-sum trade-off" relationship.