🚀 go-pugleaf

On 12 Oct 1995, Robert I. Eachus wrote:

>    In point of fact the shuttle uses three computers, programmed
> independently and constantly checks them against one another.  If two
> of the three agree fine, if no pair agrees, ask the FOURTH computer,
> and don't compare it to anything.

Then why not add the fourth computer as an additional voter? Why should 
it be any more trusted than the others?

>    In this environment, when detecting an internal error, the best
> thing to do is to restart and sync up as soon as possible.  (There are
> many occasions where "two out of three" votes result from slightly
> different sensor data. (The sampling is not synchronous, this lowers
> risk from sensor data corrupted by noise being used by all computers.)
> Even if two computers are recovering, the shuttle is fine.  But if two
> computers continue running with corrupted data, things may be very
> unfine.

Unless the third computer (or fourth?) computer fails at that point, of 
course...

>     Of course since the shuttle won't launch unless all of the
> computers agree, there were some early launches scrubbed due to lack
> of computer synchronization.  (Someone thought that since the shuttle
> "wasn't moving" on the pad, the match should be exact.  But the
> earth's rotation does affect the inertial guidance system, so the
> computer clocks had to be nearly synchronized for the results to
> match.)  Later versions of the software allow just enough "slop" for
> this situation.

They didn't check their assumption?!?

- Trung