Redundancy Manager Service

group Redundancy Manager

Aggregates component faults to determine system-wide health.

This module simplifies complex failure scenarios. Instead of the main state machine checking many different variables to see if the system is safe, it only needs to check redundancy_manager_get_system_health.

group Types

Enumerations for fault sources and system states.

Typedefs

typedef uint32_t fault_code_t

Generic container for specific error codes.

Specific codes are defined in the header files of the reporting modules. For example, a FAULT_SOURCE_RAIL might report a code corresponding to RAIL_STATUS_OVERCURRENT.

Enums

enum fault_source_t

Identifies the subsystem reporting a failure.

Values:

enumerator FAULT_SOURCE_BATTERY

BMS issues (Over/Under voltage, Temp, etc.)

enumerator FAULT_SOURCE_MPPT

Solar charging failures

enumerator FAULT_SOURCE_RAIL

Rail Controller events (Overcurrents)

enumerator FAULT_SOURCE_SENSOR

I2C/SPI sensor timeouts or bad data

enum system_health_t

High-level classification of EPS health.

Used by the Power Policy application to drive state transitions.

Values:

enumerator SYSTEM_HEALTH_OK

All systems nominal.

enumerator SYSTEM_HEALTH_DEGRADED

Non-critical faults (e.g., one sensor failed), mission continues.

enumerator SYSTEM_HEALTH_FAULT

Critical failure (e.g., Battery critical), requires Safe Mode.

struct redundancy_manager_t
#include <redundancy_manager.h>

The redundancy manager state.

Public Members

bool initialized

The current system health snapshot True if the redundancy manager is initialized.

group Public API

Functions for reporting faults and querying health.

Functions

void redundancy_manager_init(redundancy_manager_t *manager)

Initialize the Redundancy Manager.

Clears all fault registries and sets system health to SYSTEM_HEALTH_OK.

Parameters:

manager – [in] The redundancy manager to initialize

void redundancy_manager_report_fault(redundancy_manager_t *manager, fault_source_t source, fault_code_t code)

Report a fault from a subsystem.

Called by other services when they detect an issue. The Redundancy Manager will log this fault and potentially downgrade the system health.

Parameters:

  • manager – [in] The redundancy manager

  • source – [in] The subsystem reporting the error.

  • code – [in] The specific error code (module specific).

void redundancy_manager_clear_fault(redundancy_manager_t *manager, fault_source_t source, fault_code_t code)

Clear a previously reported fault.

Used when a subsystem recovers or when a fault is manually acknowledged. If all critical faults are cleared, system health may return to SYSTEM_HEALTH_OK.

Parameters:

  • manager – [in] The redundancy manager

  • source – [in] The subsystem clearing the error.

  • code – [in] The specific error code to clear.

system_health_t redundancy_manager_get_system_health(redundancy_manager_t *manager)

Get the current aggregated system health.

This is the primary interface for the application layer.

Parameters:

manager – [in] The redundancy manager

Returns:

system_health_t The worst-case health status currently active.

void redundancy_manager_update(redundancy_manager_t *manager)

Periodic update task.

Processes counters and timeouts. Use this to implement logic such as “Only trigger a system fault if

the sensor error persists for 5 consecutive updates.”