Redundancy

A sensor is an opinion. If it hangs too close to the heater in the greenhouse, it reports 25 °C while the tomatoes at the other end freeze. If it fails, you know nothing at all. With several sensors the opinion turns into a decision.

Comparing two sensors#

With two sensors you can tell that something is wrong:

sub diff ta tb
abs diff diff
sgt disagree diff TOLERANZ    # more than 2 K apart

You still do not know which of the two is right. So two sensors are enough for a warning (“sensors disagree, please check”), but not for a safe decision.

Majority vote with three sensors#

Three sensors vote. Each casts a vote “too cold”, and the heater follows the majority:

slt cold ta EIN
slt tmp tb EIN
add cold cold tmp
slt tmp tc EIN
add cold cold tmp
sge tmp cold 2           # at least two votes

A single sensor next to the heater is outvoted. And because a comparison with NaN is always 0, a failed sensor simply casts no vote – the other two decide on their own.

With the same idea the heater gets a hysteresis: votes for “too cold” switch on, votes for “too warm” switch off. If the temperature is in between, everything stays as it is.

Reporting failure#

Redundancy has a trap: if one sensor fails, nobody notices, because everything keeps running. Until the second one fails. That is why the chip counts the valid sensors and reports every failure immediately. Below two valid sensors there is no majority any more – then the heater goes into the safe state.