1. Because the CCS is needed to sense failures and initiate diagnostic and corrective procedures in the absence of, or in conjunction with, ground assistance, it should be highly reliable itself. To meet this challenge, a self-test and repair (ST AR) computer concept was developed at JPL.10 This subsystem features digital processors and memory units, which are backed up by standby units. An additional processor, the test-and-repair processor (TARP) provides failure sensing for the other processors and error checking. The TARP consists of three active redundant processors in a majority voting arrangement with two spares in standby. Because of the complexity of each processor, they are presently divided into two smaller independent units with interswitching capability. This was done to minimize the effect of random failures, thereby increasing reliability. A comparison of this design with a TOPS simplex version of the CCS, a simplex version plus two simplex spares, and the Mariner 1969 CCS is shown in Fig. 5. Here reliability, based on the failure rates shown in Table 1, is plotted versus time. The simplex design merely consists of a computer that has to perform all the TOPS functions, but is minus redundancy and the TARP for interswitching capability among its processors. The simplex plus two spares is simply one computer backed up by two spares, which are switched on when needed by way of ground command. It is probably unfair to compare these four computers for a long-life mission, in that only the STAR computer meets the spacecraft requirements, but the comparison does offer a clear visual picture of the need for increased emphasis in redundancy implementation techniques.
2. There are several unique applications of active parallel redundancy in the TOPS spacecraft design. One of the more interesting, and one that played a large part in the solution of a very challenging long- life reliability question, was "How can the TOPS telemetry subsystem (measurement processor subsystem) handle the large number of sensors (6- 7 times the Mariner requirements) in a flexible formatting arrangement with high reliability over a 100, 000-hour mission (vs 6 to 9 months for Mariner)? 11 By using field effect transistors (FETs) in a switching tree configuration, a commutator was designed
3. This system model is for a baseline spacecraft and does not include science, although it does include the probability of getting some TV data by virtue of requiring approach guidance data from the TV camera. Figure 6 shows the spacecraft probability of success for this baseline spacecraft for the J-U-N 1979 mission. A resulting curve for a double launch, assuming each spacecraft is redundant to the other, results in quite an improvement in the overall picture. Curves for a baseline spacecraft plus a representative science package, using 0. 95 at 100,000 hours for each of the 11 instruments, are also shown. However, this picture is somewhat pessimistic since it assumes all instruments must be successful for mission success. This neglects complementary science and partial survival considerations.