@
IFLY_INDIGO
Another point I would like to add is that redundancy means duplication which usually 'kicks in' AFTER a failure.
No.. You need redundancy to detect faults.
Wee may have an application with a pressure sensor to monitor if the oil pressure is so low that it could damage an engine.
The sensor might have failure modes where you can't detect if the reading is correct or not.
In this case you need to compare the reading with another sensor to find out if the pressure reading is ok. In case of disagreement you might not know witch of the two sensors are correct.
This is fine if it is ok to stop the engine on pressure disagreement.
If we are not allowed to stop the engine on a false low reading then we need additional redundancy. E.g. 2oo3 or dual 1oo2.
Micro-controllers have the same problem, it is not able to detect if it has had a hardware error, resulting in a faulty calculation. (There are some that claim that they can do this like the TMS570)
Normally lock-stepping and voting is used. (Design to avoid Byzantine faults).