🚀 go-pugleaf

In article <DGnCM3.L03.0.-s@inmet.camb.inmet.com> stt@blackstone.camb.inmet.com (Tucker Taft) writes:

  > Viet-Trung Luu (vluu@lagrange.uwaterloo.ca) wrote:
  > : On 12 Oct 1995, Robert I. Eachus wrote:

  > : >    In point of fact the shuttle uses three computers, programmed
  > : > independently and constantly checks them against one another.  If two
  > : > of the three agree fine, if no pair agrees, ask the FOURTH computer,
  > : > and don't compare it to anything.

  > : Then why not add the fourth computer as an additional voter? Why should 
  > : it be any more trusted than the others?

  > There are (were?) five computers on the Shuttle.  At least during
  > critical phases of a mission, four of the computers run the
  > same program,...

   So far we are agreeing violently. ;-) To answer, Viet-Trung Luu's
question, nothing makes the fourth computer preferred, it is actually
biased against as an artifact of the selection process.  I could draw
the cases for you, but it is intuitive once you think about it.  If
all computers agree use any one, if three of the four agree ignore the
odd man out.  The protocol does this. If all FOUR computers disagree,
then choose one arbitrarily (#4), if two pairs agree but disagree with
each other, select one pair (in this case, the one that doesn't have
#4), otherwise if any two agree choose them.

   So in two on two situations, the logic chooses against #4, which is
much more likely--but hopefully still very rare.  In the normal cases
the implementation of the voting rules affects nothing.

  > ...and the fifth is used to compare the outputs of the other four.
  > If it finds a problem, it can shut down one of the main computers,
  > or shut them all down and take over, running a "backup" version of
  > the software which was written by a different company (ours, it
  > turns out -- IBM wrote the main computer software).  The backup
  > software is sufficient to get the shuttle safely back home.

    Hmmm.  Pretty close to what I remember, but there may have been
some changes.  I thought you (Intermetrics) did the initial software
implementation, and developed HAL/S, while IBM developed the hardware.
Later the maintenance work on the main software switched to IBM.  But
the other difference is that I remember the fourth computer being the
(software) odd man out, while the fifth computer switched itself in as
a hot backup to whichever machine had hardware problems.  But the
logic has changed many times during the program.

  > I believe they chose to have 4 main computers so that if one
  > failed, they could disable it and then continue the mission while 
  > still having at least enough main computers so that there was still 
  > a notion of a well defined majority.  Having only 2 computers makes
  > any kind of voting meaningless ;-).

   Yep.  You can say that again!  The sailors version is that with two
clocks you never know the time.  Initially the plan was to have four
operational computers and some spare parts. but IBM reduced the weight
--and power requirements--substantially and it was decided to switch
to a hot backup.

    Two out of three voting has a distinguished history in theory, but
it has tended not to work well in practice, since the voting hardware
is more complex, and has more gate delays, than other schemes.
Stratus for example, uses four processors with a two by two voting
scheme.




   
--

					Robert I. Eachus

with Standard_Disclaimer;
use  Standard_Disclaimer;
function Message (Text: in Clever_Ideas) return Better_Ideas is...