COMPUTER REDUNDANCY - DESIGN PERFORMANCE AND FUTURE

The literature on the theoretical aspects of redundancy in digital computers is extensive providing a sound basis for highly reliable design. This paper describes the design problems, the reliability prediction, the field performance, and the future application of redundancy techniques to digital systems. Triple modular redundancy (TMR) is described using the logic of the Launch Vehicle Digital Computer utilized in the uprated Saturn I and the Saturn V vehicles. The self-correcting memory of this computer is described along with the associated design problems andthe design verification based on production experience. Consideration is given to system design problems involved with TMR logic. A Monte Carlo technique for predicting computer reliability is considered in a design engineering rather than programmer approach. The unique means of indicating single-channel malfunctions, while continuing to mask these single-channel malfunctions with respect to system operation, is introduced. The result of field operation are given and compared with predicted reliability. Quad redundancy at the component part level is described using the circuitry of the primary processor and data storage (PPDS) for NASA's Orbital Astronomical Observatory. The process of arriving at a quad redundancy implementation is considered in light of the constraints of cost, schedule, and an initial reliability requirement of 95 percent for a year's operation in space. The circuit and system design problems associated with quad redundancy such as impedance and part parameter variations, power consumption, fan out limitations, and testing restrictions are indicated. The results of field operation are given and compared with predicted reliability. The future application of TMR and quad redundancy in digital systems is speculated on and projected for military, space, and commercial usage. Trends in complexity, mission duration, and reliability requirements are projected and possible means of meeting requirements are discussed. Redundancy considerations requiring further study are enumerated. It is concluded thatredundancy will continue to be required for specific future applications. Copyright © 1969 by The Institute of Electrical and Electronics Engineers, Inc.