Reliability and fault response

Reliability is the probability that a system performs its required function under stated conditions for a stated time. Safety asks about unacceptable harm; availability asks whether service is ready. They overlap but are not synonyms. A robot can be safely stopped yet unavailable, or highly available while hiding a hazardous failure. Requirements need operating conditions and time horizon rather than adjectives such as “robust.”

A fault is a cause, an error is an incorrect internal state, and a failure is externally incorrect service. A loose encoder connector is a fault; a frozen wheel count is an error; driving the wrong distance is a failure. A fault-response table lists cause, observable symptom, detection, reaction, recovery, and retained evidence. For independent series elements whose success probabilities are R1 and R2, combined success is R = R1R2. Two elements each at 0.99 yield 0.9801, showing that adding required parts can reduce mission reliability. Independence is a strong assumption, not a free fact.

Detection should use independent evidence when practical. A commanded motor with zero encoder change could mean a disconnected encoder, stalled wheel, or driver problem; current and inertial motion can separate hypotheses. The build decision might be: if command exceeds 20% for 300 ms while encoder count stays unchanged, command zero and latch DRIVE_FAULT. Threshold and delay must reject normal startup yet respond before damage, using tested bounds.

A common misconception is that redundancy automatically improves reliability. Two sensors sharing one connector, supply, algorithm, or environmental weakness can fail together; voting also introduces logic and diagnostic complexity. Another failure is automatically resetting faults so quickly that evidence disappears or motion resumes into the same condition. Prefer bounded energy, explicit safe or degraded states, latched cause records, and deliberate recovery criteria. Do not create destructive faults to test them: inject messages, disconnect only unpowered low-voltage signals, or use simulation and current limits.