🚀 go-pugleaf

Viet-Trung Luu (vluu@lagrange.uwaterloo.ca) wrote:
: On 12 Oct 1995, Robert I. Eachus wrote:

: >    In point of fact the shuttle uses three computers, programmed
: > independently and constantly checks them against one another.  If two
: > of the three agree fine, if no pair agrees, ask the FOURTH computer,
: > and don't compare it to anything.

: Then why not add the fourth computer as an additional voter? Why should 
: it be any more trusted than the others?

There are (were?) five computers on the Shuttle.  At least during
critical phases of a mission, four of the computers run the
same program, and the fifth is used to compare the outputs of the
other four.  If it finds a problem, it can shut down one of the main
computers, or shut them all down and take over, running a "backup" 
version of the software which was written by a different company 
(ours, it turns out -- IBM wrote the main computer software).  The backup
software is sufficient to get the shuttle safely back home.

I believe they chose to have 4 main computers so that if one
failed, they could disable it and then continue the mission while 
still having at least enough main computers so that there was still 
a notion of a well defined majority.  Having only 2 computers makes
any kind of voting meaningless ;-).

During non-critical phases of a mission, the responsibilities of
the computers are a little more flexible, I believe.

: - Trung

-Tucker Taft   stt@inmet.com
Intermetrics, Inc.