8 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL
Redundancy and the Detection of First Failures*
D. C. JAMESt, senior member, IRE, A. H.
KENT, Jr.t, and J. A. HOLLOWAYt, member, IRE
Summary-The reliability problem is reviewed
with respect to present and future requirements for
military and commercial equipment. Methods of
reliability improvement are reviewed and achiev-
able levels of improvement are indicated for each
method. Special emphasis is placed on redundancy,
its benefits and disadvantages. The subject of Ma-
jority Vote is discussed along with failure detection
circuitry capable of detecting first failures. The
entire paper is intended to aid the circuit designer
in his task of achieving higher reliability. The dis-
closures pertaining to Majority Vote and failure
detection are considered advances in the state of
the art.
INTRODUCTION
The subject of reliability has been with man
from his earliest memories. Unreliable equip-
ment has frequently been the cause of incon-
venience and on occasion his death. The desirable
level of reliability of any one device depends upon
the importance of that device to one's comfort of
safety. When life itself depends upon successful
performance, reliability cannot be too high. Also,
as the number of devices within a system increases,
reliability of the individual device must in-
crease or their utility is lost in a continuous maze
of maintenance problems.
The emphasis on reliability can only be ex-
pected to increase for the following reasons: 1)
The user of present devices, either home, com-
mercial, or military, piqued by repeated failures
and the resulting repair problems will carefully
consider the potential reliability of any replace-
ment item or new additional device. 2) The mili- environmental conditions. These tests are first
tary, faced with the problems of modern technol-
ogical warfare on the one hand and solving them
with efficiency with respect to the tax dollar on
the other hand, must insist and is already insist-
ing on drastic increases in reliability. 3) The ef-
fect of the space age on reliability is more pro-
found than any of the foregoing due to required
_____________
*Received June 12, 1962.
tThe Martin Company, Denver, Colo.
October
minimization of size and the long service life re-
quired without failures.
It is, therefore, safe to say that reliability con-
siderations will continue to be a major factor in
our ability to progress technologically. Technical
journals portray today's situation all too well when
editorials quote the military. For instance, from
one source we hear that at any given time more
than half of our military radar is down for main-
tenance and repair and from yet another source,
gall of a battleships electronics has never worked
at any one time." Whether totally true or not, this
type of statement is disturbing to those of us who
design and build such equipment. Further, the Air
Force is now asking for satellite equipment with
80,000 hours continous service without failure.
With these existing problems facing the design-
ers and manufacturers of electronic (and other) de -
vices, a careful review of reliability improvement
methods is in order. The methods involved canbe
divided into the following catagories: 1) Com-
ponent Part Improvement, 2) Stress-Level Reduc-
tion (derating), 3) Circuit Simplification, 4) Main-
tenance and Production Techniques, and 5) Redun-
dancy.
Component Part Improvement
The method of component part improvement is
in general quite similar for all cases in that cer-
tain steps are required regardless of the type of
component. These steps are: 1) A large number
of testing hours must be accrued to establish the
reliability of the component. These tests include
various operating stress levels and all applicable
run on a control lot and the resulting data usedfor
future comparison. 2) The design of the compo-
nent is carefully reviewed and all possible im-
provements listed. Improvement items may in-
clude better base materials, new mechanical de-
sign, new electrical design, improved production
control of materials and assembly techniques. 3)
~~~~~~The component is redesigned according to good
engineering judgment based on the results of pre-
vious tests and past experience with the component.
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 9
4) The tests enumerated in step 1) are repeated liability while good workmanship and procedures
on the improved component. Again large sample can be effective in improving reliability.
sizes and long test periods are required to assure Maintenance techniques bear a similar rela-
reasonable confidence in the test results. 5) These tionship to the realization of high reliability in
steps are repeated until the desired level of re- that unless an intelligent and well-trained main-
liability is realized. tenance staff exists, reliability can become prac-
An excellent example of this method of ap- tically nonexistent after a few maintenance oper-
proach is the Minuteman program. The resulting ations.
improvement in reliability is in the order of one
or two orders of magnitude. Such improvement,
however, has been accomplished at considerable Redundancy
expense in time and dollars. Not as heavily pub-
licized, but of extreme importance, are the relia- After (and only after) all the above have been
bility programs now under way at the majority of fully exploited should redundancy be considered,
the component part manufacturers' plants. and then most carefully. When properly utilized,
two and even three orders of magnitude improve-
ment in reliability can be accomplished. This
Stress-Level Reduction subject will be discussed in detail later in this
paper.
Most types of components become more reli-
able when operated in a manner which results in
reduced stress on the part. These stresses are DETAILED DISCUSSION ON RELIABILITY
introduced not only by the electrical environment IMPROVEMENT IN NONREDUNDANT EQUIPMENT
to which they are subjected, but by their physical
environment as well. In general the reduction of The basic equation for reliability is
any environmental condition to which a component
is vulnerable will result in increased reliability. R = e r
In some cases one or more orders of magnitude
of reliability improvement can be realized. Some where R is the fractional reliability, t is the time
components do not evidence such improvements of required operation, and fr is the effective fail-
and certainly some designs do not lend themselves ure rate. In order to achieve a totally reliable
to derating and environmental isolation. However, equipment (R = 1) the product of t and fr must
this is an effective tool worthy of careful consider- equal zero. Such a condition is considered im-
eration. possible. Further, time may be shortened in
some cases, but cannot be reduced to zero. The
remaining device is to drive the composite fail-
Circuit Simplification ure rate toward zero.
Fig. 1 shows the list of the components from a
The mechanism of simplification of circuitry typical logic and solid-state circuit along with
works at both system and circuit levels. Certainly initial reliabilities for each. The various columns
reduction of system functions and /or performance show representative reliabilities resulting from
levels should reduce the complexity of the system, the improvement methods listed above. Since the
thus improving reliability. At the circuit level, a factor of workmanship is not usually assessed, no
careful review of all applicable circuits will some- figures exist for this important consideration.
times show one to be less complicated, in which Workmanship excellence is assumed to be inher-
case more reliability can be expected. ent. The effects of redundancy are left for later
discussion.
Fig. 1 shows relative degrees of improvement.
Manufacturing and Maintenance Techniques The degree of derating and also simplification are
assumed values for sake of discussion. The fail-
ure rates used herein are not meant to be used
The reliability of any system is highly depend- for actual reliability calculations. They are, how-
ent upon the techniques used in the assembly of ever, typical values which maintain a high degree
both the system and the individual component parts. of reality in the conclusions drawn. The degree
The effect here is very profound in that poor of improvement resulting from derating can be
workmanship can destroy any semblance of re - extracted from curves presented in standard re -
 10 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

(Ambient Tempe:rature = 600 C)

Quantity Component Standard 90 Per Cent 50 Per Cent Minuteman

Name Fr Deration Simplification Fr(4)

Composition -6
600 Resistors 45 x 10 27 x 10 22.5 x lO 4.8 x 10

Silicon -6 -6 -6 2 1
200 Diodes 16x 10 4 x 10 8 x 10 2 x 10
Silicon -6 10 1 l 1
200 Transistors 20 x 10 6 x 106 10 x 10 10 x 10
Foil-Mica -6 -6 -6 -1
100 Capacitors 12 x 10 0.4 x 10 6 x 10 5 x 10-6
Total 93 x 10 6 37.4 x 106 46.5 x 10 21.8 x 10
Fig. 1

liability handbooks and will vary depending upon
the component and the degree of derating. The
degree of improvement resulting from simplifica-
tion is directly proportional to the degree of
simplification so long as all other factors remain
unchanged as a result of the simplification.
The figure shows the individual improvements
resulting from the three listed devices. Further
benefits are available through combinations of all
three devices. The result of any combination is
the product of all improvement factors. For in-
stance the Fr for six hundred composition resis-
tors is 45 x 10-6. If Minuteman resistors are
used and derated to one -tenth maximum rating and
the circuit is then simplified by 50 per cent, the
resulting Fr is 1.44 x 10-6.
4.8 _ 4.8 =144
45 x 45 1.66 x 2
\ 27 22.5
Similarly the system Fr is equal to 4.75 x 10-6.
7 21 .8 21.8 = 4.38
(393
\7.4
x 93
46.5
2.48 x 2
/
when all the nonredundant improvement devices
are considered. Thus a failure rate of forty-five
failures per million hours for six hundred re-
sistors can be reduced to a failure rate of ap-
proximately one and one-half failures per million
hours of operation. On the system level, a failure
rate of ninety-three failures per million hours
reduces to less than five failures per million
hours of operation. In each case more than an
order of magnitude improvement in failure rate
can be predicted.
CALCULATION OF RELIABILITY
This subject has been discussed in detail in
other papers [ 1]. However, one point is often
overlooked which can cause considerable error in
reliability predictions. This has to do with duty
cycle and the consideration of "ON" failure rates
vs 'OFF" failure rates. Normally the failure
rates and resulting reliability only consider the
failures which occur during operation of equip-
ment. In many cases such consideration is satis-
factory. However, in cases where a very long
storage or "READY" state is maintained followed
by a short operational period with no intervening
) maintenance allowed, it is necessary to treat the
/ two periods seperately. This last is due to the
difference in failure rates which change as a re-
sult of the changing stress levels. Extrapolation
of existing derating curves indicates that the non-
operating failure rate is between one one-hun-
dredth and one one -thousandth of the operating
failure rate. We hasten to emphasize that little
is made onbeen
work has
the done in this area and that no claim
accuracy of the above ratio other
than that such an indication does exist. We fur-
ther assert that the failure rate cannot become
zero when the equipment is nonoperative
Sample Reliability Calculations
Several sample calculations are presented here
to lend emphasis to the foregoing comments.
1962 JAMES, KENT Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES
Case 1-Assume a single circuit element having
F r - 105500 x 10-6
=
t = hour - (105500) (10-6)
R = e = e
= 0.90 or 90 per cent.
Case 2-Assume that derating, component im-
provement and circuit simplification have re-
duced the Case 1 failure rate to 5270 x 10-6.
R= e
-(I) (5270) (10 -6 )
= 0.9947 or 99.47 per cent.
Case 3-Assume that the Case 2 system is re-
quired to remain under "READY" status for 2100
hours (3 months) and then perform for one hour
'OPERATIONAL" without maintenance procedures.
Further assume the failure rate during "READY"
is one one-hundredth of the "OPERATIONAL"
failure rate.
- (1) (-6) -(2100)(5270 N
R = e (l) (5270 )(10 e s2100
o)
= (0.9947) (0.8994)
= 0.8946 or 89.46 per cent.
Case 4-Assume that Case 2 operating time is ex-
tended to 8000 hours. -6)
R e -(8000) 1(5270) 40- 2 e-42.16
4-1
4.2 x 10 -19 or 4.2 x 10 -17 per cent!!
Case 1 assumes a modest reliability in keeping
with later discussion on redundancy. Case 2
shows the effects of normal reliability improve-
ment methods whereby better than one order of
magnitude improvement is shown. Case 3 shows
the effect of a three month "READY" period on
the gains achieved by Case 2. Case 4 shows dra-
matically the effects of a one-year operating
time. The obvious conclusion is that such a sys-
tem cannot meet the requirement. Further cal-
culation shows that the effective system failure
rate must be reduced to less than thirteen fail-
ures per million hours of operation to have a
ninety per cent probability of a one-year success-
ful operating time. This is an improvement of
over four hundred times in our hypothetical case.
Further steps must be taken to reduce the system
failure rate and/or redundancy must be utilized.
It is safe to predict that some form of redundancy
will be required to meet such a requirement.
DETAILED REDUNDANCY DISCUSSION
For the purposes of this discussion, the follow-
ing definitions are presented:
11
1) Reliability (R)-This number is the statis-
tical prediction of successful completion of the
mission of the function to which the reliability fig-
ure applies. Expressed in per cent, it is simply a
prediction of the percentage of attempts which can
be expected to be successful.
2) Unreliability (Q)-This number is the prob-
ability of failure of a mission. Since the quanti-
ties Q and R encompass all possibilities, Q is
equal to l -R.
3) Redundancy-A redundant element is any
duplication of parts or circuitry incorporated for
the sole purpose of increasing reliability.
4) Failure-Any change of characteristic, or
characteristics, which causes unacceptable oper-
ation.
-6)) 5) Circuit Element-Any circuit or arbitrary
division thereof having a defineable function. A
circuit element may consist of any number of
components from one upward.
6) Failure Rate (Fr) -The predicted rate at
which a particular circuit element can be expected
to fail. Differentiation is made between open and
short failure
defined as anymodes.
type of Open-mode failure (Fro) is
failure which precludes
having the proper output with proper input con-
ditions. Short-mode failure (Frs) is defined as
any type of failure which causes an output with no
input. The total failure rate (Frt) is defined as
the sum of Fro and Frs. Four general cases are
of interest and are now discussed in detail.
Case 1-Nonredundant Element
° o
Input (S) Output
Circuit Element Representation
From previous definitions we know that:
1) The circuit element may have any number
of component parts from one upward.
2) Any component failure within the element
wl as vralfiue
12 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October
The summation failure rate (Fr) for the ele-
ment is equal to the summation of the individual
Rt = (R + Q
1 -
0)lQ0fnn n
component part failure rates (fr). = QS Qo (6)
In those cases where 'ON' or 'OFF" failure Where Rt is the total reliability of an nth level
modes are of interest, the following statements parallel redundancy. R is the reliability of a
apply: single-circuit element (R = e-t Fr). QO is the
a) The circuit element can be expected to fail
unreliability-
Fr) Qoeisn-od theur
unreliability in the open-mode failure
in either mode. (Qo = I -Ro).
b) The failure rate of either mode of the cir- R = (R + Q0)n = (1 - Q)n (7)
cuit element failure is simply the summation of R =1 - Q n (8)
component part failure rates, fro and frs, which 0 0
would cause that particular element failure mode; If (6) is applied to a first-degree redundancy,
i.e., it is possible to have a component part fail- n becomes 2 and the expression reduces to
ure in one mode and cause an element failure of
the opposite mode. This being true, a detailed R =R +2 RQ (9)
charting of individual component part modes and t o
their resulting circuit element effect is required Assuming R = 0.90, Qt = 0.10 Qs = QO = 0.05
in order to evaluate the summation failure rate in and substituting in (9)
a particular mode. Rt = (0.9)2 +(2) (0.9) (0.05) 0.90 or 90 per
cent.
From the above
If Qs becomes 0.1, QO = 0
Fr = ro (*)+ F rs(*)
frr = z~~~r
Fro rs (1)
~~~cent Rt = (0.9)2 + (2) (0.9) (0) = 0.81 or 81 per
Fro Zfro(*)
=
(2)If Qs = and QO = 0.1
rs Z frs( ) (3) Rt (0.9)2 + (2) (0.9) (0.1) 0.81 + 0.18
=
= 0.99 or 99 per cent.
where (*) is used to designate particular compo-
nent-failure modes as they effect the circuit ele- These three sample calculations emphasize the
ment performance. importance of recognizing probable modes of fail-
ure. The above shows that if the failure modes
c) The reliability of the circuit element in are of equal probability, no improvement in over-
either mode is then calculable and is expressed all reliability can be expected through use of
by parallel redundancy. On the other hand if all
-t F failures are in the short mode, parallel redun-
Ro = e ro (4) dancy will reduce over-all reliability and, if all
R = -t FrS. (5) failures are in the open mode, a considerable in-
s crease in reliability is predicted.
These are simply expressions of the ability of the Eq. (7) expresses the ability of a parallel re-
circuit element to perform without failure in the dundancy to work without short-mode failures.
mode under consideration. Again assuming
R = 0.9, QO = 0.05, and Qs = 0.05 for a first
Case 2-Parallel Redundancy order redundancy (7) becomes
Rs= (R + QO)2 = (0.9 + 0.o5)2 = (0.95)2
This case is presented as two or more circuit = 0.9025 or 90.25 per cent
elements connected in parallel. The circuit ele- similarly (8) becomes
ments used are mutually identical and must meet 2 2
the criteria of Case 1. R0 = 1- Q0 = 1 - 0.05 = 0.9975 or 99.75.
Appendix I, A presents the development of the
mathematical statements which pertain to this per cent which demonstrates that parallel redun-
case. The development is kept general so as to dancy improves open-mode failure reliability to
cover any level of redundancy. From this we de - a marked degree. It follows that if the case exists
rive the statement in which a circuit component has a very small
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 13
Frs or such failures are inconsequential, parallel 1 2
A
Tn
redundancy can be used effectively.
Case 3-Series Redundancy 1
This case is presented as two or more cir-
cuit elements connected in series. As in Case -
2 the circuit elements are identical and are de-
fined in Case 1. z
Appendix I, B develops this case. From this -- -
section of Appendix I we derive Li tn ' n

t s) -Qs (a)
(1 QO)n Qsn (10)
where Rt and R are as defined in Case 2 and Qs
is the unreliability in the short-mode failure 2 -1
(Qs=1 -RS). -
Ro (R +Q)n = (i Q (1)
R= 1(QJ. L 'II
Substitution of the numbers used in Case 2 F-----'
into (10) reveals the following: --A 2
L___ L_____.... ___
1) Again there is no increase in reliability (b)
when QO = Qs. 2) There is a decrease in re-
liability when QO = 0.1 and Qs = 0. 3) There
is an increase in reliability when Q0 = 0 and Fig. 2-(a) 'N' parallel redundancies in series '' times.
(b) 'N' series redundancies in parallel 'm' times.
Qs= O. 1.
Eqs. (11) and (12) show that the converse of
Case 2 is true, i.e., the series redundant case is R = 1 - - (R
(\ + Q )n m (14)
effective in raising reliability in those cases s L oi
where Fro is extremely small or its effect canbe nm
neglected in the application. R = (- Q ) (15)
Case 4-Series-Parallel Redundancy 'N' Series Redundancies in Parallel 'M' Times
(Fig. 2(b)).
There are two possibilities under this head- R = 1 nlm - (R + Qnm (16)
ing, namely; "m" number of case 2 redundancies t L s L V "sJ(
connected in series or, am" number of Case 3 re- R = I
- Qn]m (17)
dundancies connected in parallel. The resulting s s
configurations are shown in Fig. 2. As in previous R = 1 1-(R + Q>n 1 (18)
cases, the predicted relative weights of Fro vs o L \ 5 i
Frs will dictate the choice between these two last
possibilities. Using the numbers from previous examples
where R = 0.90, Qs = Qo= 0.05, let m = n = 2
From Sections C and D of Appendix I, two sets from (16)
of equations are presented here for discussion.
'N' Parallel Redundancies in Series 'M' Times Rt Li - 60X05)2]- [1 - (o.95)2]2
(Fig. 2(a)). 0.99752- 0.0975
= 0.99501 - 0.0095
t~ ~ ~~[
]1-Q1-( (13 = 0.98551 or 98.55 per cent.
14 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL
Since (13) and (16) are identical except for
QO and Qs, they will give the same Rt in the case
where Qo = Qs. The two are therefore of equal
advantage where Qs = QO. However, where
Qs 7 QO, one configuration will provide better
reliability than the other. For instance, as-
sume that QO = 0.1 and Qs = 0 substituting in (16)
Rt [1 - 0] 2 -[_ - (0.9 + o)202
= 1- [1 - (0.81)]
= 1 - (0.19)2
= 0.9639 or 96.39 per cent, substituting
in (13)
Rt =[l -(0.1)2]2-[1 -(09 )2 22
= (o.99)2 - (1-1)2
= 0.9801 or 98.01 per cent.
These last two results indicate that the
paralleled-series configuration is more reliable
than the seriate -parallel configuration where
Qo>Qs. Also, the converse is true when Qs>Qo.
An important consideration occurs when
Qo>>Qs. As this ratio approaches infinity, simple
parallel redundancy is as effective as a paralleled-
series combination. In other words, if the prob-
ability of a short-mode failure is zero, there is
no benefit to be derived from series redundancy.
Logic Configuration1
The general Boolean statement for majority
voting a triple redundancy of logic blocks A, B,
and C is
MV Output = AB + BC + AC. (19)
There are several types of logic which can be
used to perform this operation. Some are more
advantageous than others. In general, one way of
expressing redundancy is to say that alternate
paths are provided for signal flow, in which case
first failures do not stop over-all performance of
the redundant function. Majority-voting logic
which fails to provide an alternate path (or paths)
degrades the achievable reliability.
There are two approaches. One uses what can
be termed a threshold or additive logic, the other
uses "AND"- "OR" logic. The threshold-logic
circuits consist of resistive or magnetic adding
INOTE: This entire discussion is based on the assump-
tion that all circuitry involved is digital. It is felt that
analog, systems can be adopted to such techniques, but
work in this area has not been done by this group to date.
October
circuits followed by a threshold device which re-
jects the sum of less than the majority of inputs.
This is a useable device, but does not provide al-
ternate paths in case of first failure within itself.
To overcome this difficulty, designers have in
some cases made the MV logic redundant. The
use of 'AND"-'OR' logic may consist of any
logic blocks which satisfy the basic MV (19).
Fig. 3 is the logic diagram of (19).
A
AB
mv
ut
Co B
Fig. 3-Logic diagram of (19).
The minimum number of voting elements is
three. More than three elements may be used
where reliability requirements are sufficiently
stringent. For first failure considerations, three
voting elements are generally sufficient. When
more than three voting elements are used for
protection against failures beyond the first, a
careful analysis is in order to avoid the anomoly
of a split vote. Further, the MV logic required
to take full advantage of more than three voting
elements becomes extremely tricky when con-
tinued valid system performance is desired be-
yond the first failure.
The Detection of First Failures
In a nonredundant system there is no need to
look for failures during normal use since a fail-
ure stops the function. The presence of a failure
is therefore self-evident and its location is
usually easily identified through analysis.
Conversely, the detection of first failures in a
redundant system becomes important. This is
true because a single failure does not stop oper-
ation of the system, but a second failure may
stop it. In other words, the reliability remaining
after a first failure is only as good as the re -
maining
m effectivelylyfuctoAl
functional ccircuitry.
i It is,
Itis
therefore, desirable to effect repair at the earli-
est possible time following a failure and it follows
that identification of that failure at the time of its
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES
occurrence is a first step toward reducing the
time before repair is effected.
Examination of redundant circuitry shows that
in most cases, several points in the circuitry
must be at or near the same electrical potential
when all the elements are functional. This fact
may be used in a failure -detection circuit. Fig. 4
is a diagram of a triply redundant majority-voted
system.
A q
z group. It is useful wherever the redundant com-
___4W a MV
utpu1pt
_= C o > ' Z
Fig. 4-A triply redundant majority-voted system.
Convers wn Q Q
Conversllely,pwhenQe»Qrea thereliabidlityygaine
As indicated earlier the above four cases may
be applied in either component-part or function re- liability design consideration before it is incor-
dundancy. The most helpful single component-
dundancy.ndaThe helpusinglccomplhonent
partsrheedudany
cases cangecomponent
where a single acomplishedpar in tuhoeseless prblemtool in the solution of a difficult design
part iS much
reliable than those in the rest of the circuit.
Over-all component-part redundancy becomes
very difficult with most components due to the
change in the summation electrical characteris-
tics of the redundant group with the failure of one
part. Even slightly critical circuitry simply does
not lend itself to this type of approach unless a
high order of redundancy is used such that a sin-
gle failure no longer changes the electrical
parameters. However, the resulting component-
part count can rapidly approach that of ten or
more individual systems. Such a system becomes
extremely reliable but has several disadvantages,
namely, 1) it is difficult to design and package,
especially in high-frequency work, 2) it is much
more expensive, and 3) it does not lend itself to
the detection of component failures. (There is
further discussion of this item under DETEC-
TION OF FIRST FAILURES.) Of course, there
are cases where the effect of a component failure
is of no interest. This is especially true where
maintenance is not available as in unmanned
space vehicles. In these cases this last objec-
tion is not valid.
15
Majority-Voted Redundancy
Majority Vote has been described in other
technical works. Generally speaking, it is a logi-
cal circuit capable of responding to the majority
of its inputs where these inputs are from three or
more redundant components (a component may
have many parts but only one function, in keeping
with previous definitions).
Majority Vote is very useful since it protects
against both "ON" or 'OFF" first failures in the
circuitry preceding it, thereby eliminating the
e_^
_ need
o for seriate components in the redundant
ponents preceeding it are each of equal, or great-
er, complexity as compared with the Majority
Vote circuitry. Strangely enough, except for re -
dundancy of single component parts, the majority
of cases are well suited to Majority Vote. If the
conditions stated above exist, a saving in parts is
effected. In addition it is relatively easy to im-
plement a Majority-Voted system since a single
logic block can be designed and then utilized re -
dundantly along with a standard Majority-Vote
tlogic circuit to make up the total logic block. A
word of caution here-the logic block designed
for majority-vote usage must receive careful re-
porated since Majority Vote does not in itself
cure reliability problems. It is only one addi-
tional
Blocks A, B, and C are defined as identical
logic functions. With all circuits working normal-
ly, points M, N, and 0 will be equal at all times.
Similarly, points X, Y, and Z will be equal at all
times. It follows that M will not be equal to N and
0 at all times if a component part in logic block
A is faulty. We prefer to identify a failure as a
"Dissenting Vote," in keeping with the term Ma-
jority Vote. Expressed mathematically, a dis-
sention exists when
M / N Oor N & 0 = M or O $ M = N, or
X $ Y = Z or Y $ Z = X or Z $ X = Y.
Fig. 5 is the logic diagram of a circuit capable
of identifying dissention or a "Dissenting Vote.'
Circuit elements (1) and (2) may be expanded to
include any practical number of inputs as the need
arises. The inputs are from the points to be com-
pared. The presence of any inputs without the
presence of all inputs is sufficient to cause a dis-
senting vote indication (DVI).
16 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL
0 ~~~~~~~~~~~~~~~~~~~~(a)
InpUt (s) 4,Dissenting
Vote
I{Indication
Fig. 5-Basic dissenting-vote logic.
A PARTICULAR TRIPLY REDUNDANT
MAJORITY-VOTED CIRCUIT WITH DISSENTING
VOTE (MVDVI)
In an effort to optimize the benefits of MVDVI
considering the economics of space, time and
dollars, a particular circuit has been developed
and is presented here. Fig.6 is a block diagram
of the circuit. The MV logic has been modified
with a slight reduction in total component parts
in both the MV and DVI circuitry. The adequacy
of the DVI logic is discussed in detail in Appen-
dix II and the resulting reliability calculations are
presented in Appendix III. Two reliability calcu-
lations are presented for the MVDVI circuit. One
assumes a three-month 'READY' state plus one-
hour 'OPERATE' state without maintenance. The
reliability improvement for the MVDVI system is
one order of magnitude over its nonredundant
counterpart. When the requirement is reduced to
only one-hour 'OPERATE' state the reliability
improvement for the MVDVI system is two orders
of magnitude over its nonredundant counterpart.
Since these are the same systems in each case
this exemplifies the fact that the greatest relia-
bility improvements resulting from MV are ob-
tained from already highly reliable equipment
(where t Fr is relatively low).
Since the final 'OR" in Fig. 7 is outside the
protective influence of the DVI circuitry, special
emphasis was placed on the reliability of this cir-
Input(s) E Majority
ELemen
Fig. 6-Block diagram of the circuit.
October
a Otu
utu
(b
(c)
(a)
(c)
Fig. 7-Logic diagram of the circuit.
cuit. Each of the two diodes was replaced by a
redundant quad. The resulting reliability is cal-
culated in Appendix III, Section A. It is felt that
the reliability is sufficiently high to warrant the
function of this circuit without checkout. Re-
commendation is made that the entire MVDVI
circuit be replaced periodically-the period to be
based on reliability analysis results.
An important consideration arises with re-
dundancy in that the increased component count
reduces the mean time between component-part
failures while increasing the mean time between
system failures. This is true since a single com-
ponent part failure does not necessarily stop the
function of the redundant system. The mean
time between component part failures therefore
has a definite effect upon maintenance require-
ments as well as upon the ultimate over-all relia-
bility.
Appendix III presents a thorough reliability
analysis of the MVDVI configuration presented in
Fig. 6. The analysis assumes the same circuit-
element reliability for A, B, and C as used in
earlier examples. A direct comparison is there-
Dissenting Dissenting
Vote ~~~~Vote
Logic Indication
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 17
fore possible between MV and the other forms of slant the considerations toward the designer and
redundancy discussed earlier. his immediate problems. The concept of DVI is
Using the values of R, QO and Qs from the ex- considered worthy of careful consideration as are
amples, we find that total reliability (Rt) is un- many of the points made in regard to the use of
changed in either simple-series or parallel re- redundancy.
dundancy. Further, the two-by-two series parall-
el case (quad) shows one order-of-magnitude im- APPENDIX I
provement using these same parameters. Finally,
the MV case can be expected to provide two or- The Development of Reliability Equations for
ders-of-magnitude improvement. More reliable Fundamental Redundancies
circuit elements will provide even greater im-
provements. The mathematical development of the appropri-
ate useful equations are in the following sequence:
THE UTILIZATION OF DVI Section A: Parallel redundancy.
Section B: Series redundancy.
Since the use of redundancy results in circuit Section C: Senate-parallel redundancy.
failures which in most cases do not cause system Section D: Paralleled-series redundancy.
failures, and since these failures result in net de-
creases in system reliability, DVI becomes useful
in detecting these faults as they occur.
SECTION A: PARALLEL REDUNDANCY
If a totally redundant system is considered, an
interesting use of DVI can be made. First let each
DVI be self-locking so that dissentions are not only
ehAssume a set of elements arranged in a parall-
el manner, that is, such that all elements receive
detected but remembered. Then sum all DVI's equivalent input stimuli and all outputs are con-
within a chassis to provide a chassis-malfunction nected to a common output bus (Fig. 8). First the
indication. Further, chassis indications may be simple case will be examined where n is equal to
summed in any manner desired for presentation 2. A probability-of-survival table may be written
of system status at a convient central point.Check- as shown in Fig. 9. The normal modes of opera-
out of such a system would consist of the initiation tion are next examined and the reliability equation
of (or simulation of) system input signals which written by summing the probability for each nor-
would then cause an exercise of the equipment mal condition.
with immediate detection of any fault. The exist-
ence of a fault (or faults) would be indicated at the
Rt = R El R E2 + R E1 Q oE2 + RE2 Q oE1 . (20)
central indicator panel and could be subsequently If the elements are similar the inherent failure
traced to its origin through a system of testpoints rates are the same; hence,
and/ or indicator lights. R R
An even more attractive situation arises where E1 E2
equipment must ope-rate continuously without fail-
ure. Where manpower is available, the circuit
QoEl= QoE2.
elements can, in large part, be so arranged as to
provide the capability of localizing a fault. Also, Element
replacement of the faulty circuit can be accom- >-1 E
plished without interruption of the system's nor- input(s) output
mal functions.
Some thought has been given to allowing the use
of DVI in satellites wherein the summed DVI's Element
would initiate a code signal indicating presence of l 2
the failure whereupon a service vehicle could be
deployed for the required maintenance function. I
In conclusion it is realized that this paper ElementI
neither provides all the solutions to reliability - Eleen
problems (in fact we suspect the final answer will L -----
not be achieved until 100 per cent reliability is a
reality) or little more than suggests possibilities Fig. 8-A set of elements arranged in a paral-
in most areas. The aim of the paper has been to lel manner.
18 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

From these equations, (20) may be simplified by In the table of n redundancies the terms R and
saying QO excluding Qs, (since Qs defines a failure) will
Rt = R2 + 2RQ (21) appear in the following combinations:Rn, Rn Q09
0
R~~~~~~n-2
2
R Q .. ., RQ , and Q
n-i n
Derivation of the nth Case These terms .

represent all normal elements, one open failure,

The following discussion is only concerned two open failures, .. ., one normal element and
with equal elements. It is observed from the all open elements, respectively. These are also
table, Fig. 9, that any short-mode failure de- the terms of the binomial expansion for
fines a total failure. The case also exists that +Q The coefficients of these terms willbe
all open elements concurrently, define a failure. 0/
A table can be prepared for any n number of re- proven to be the coefficients of the terms of the
dundancies. In this table there is a specific binomial expansion. Therefore, the table (ex-
number of times that a certain combination of cludin Q ) may be expressed as
g s
+Q Since
failures occur without respect to order. Re-
stated, there is a specific number of times a Q , however, expresses a failure, the reliability
combination between two vairiables (r and k) oc-
curs where the order need not be constant but the may be expressed as
number of r terms (nr) and k terms (nk) each re- Rt = (R + Q )lQ n (23)
main constant. The Law of Combinations states
that this number is The following is to show that the coefficient of
the kth term of the binomial expansion may be de-
Cn= n ( (22) n) First, the following identity will be
fined as (k).
k (n-k) !k! k
proven'
Later a proof is given to show that the above ex- (n )+(n)= (+ ) (24)
pression for the Law of Combinations is equal to b eni
the coefficient of the kth term of the binomial ex- by definition
pans ion. (nf\ n\n n! n!
Vk-11 + kk) (n+l-k)! (k-1)! (n-k)!k!
n!k n! (n+1-k) n! (n+1-k+k)
E1 E22 Result (n+l-k)!k! (n+l-k) k!- (n+l-k)-!k!
N N N n! (n+l) (n+1) ! (n+1\
(n+1-k) !k! (n±1-k) !k! k
N 0 N
One possible form of the kth term is now pre-
N S F sented,
O N N (x+y)n = E
k=O
( x)x (25)
O 0 F
To prove this possibility by induction; 1) as-.
o s F sume (25) to be true, and 2) assume n = 1
1X
|S | N | F | (x+y)lN1 F 1-k k
s ~~0 F-
(x+y) k=k- k/1 y

1! 10+ 1! 0 1
N = Normal Condition since 1! = 1 and 0! = 1, the above may be re-
S = Short Condition
0 = Open Condition written as
F = Failure (x+1) 1 = X+Y. (26)

The above is obviously true; assume an arbitrary

Fig. 9-Probability-of-survival table. value of n.
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 19

(x+y)n+1 = (x+y) n (x+y) = (x+y) n x+(x+y) ny. Taking the second summation of 27)2
Substituting for (x+y)n as in(25) 1 (n) n1) yk + [(n)x(n+1-k) k]
+Y)n+l = n(nxn+1-k k (/)n-k k+1 k=01 k=0
k=0' k=0 n± (n+1-k) k
E

Substitution of (k-i) for k may be done by adding 1 x Y

to each limit of the summation. Effectively k-1 +
1 = k. Therefore,

ky0 (k)
k=0
y k (1)x yY (0-1)!n! y
£+1 n n-(k-1) ykk1+1 = n+1 x(n1k)yk
k=1 k=0
n
n+1 - nr,n 1-k k n+1 (n+l-k)) k 1 n+l1o
+ (n )n+1-k y k.
k=1 1 (27) n+1 x(n+lk)yk
Taking the first summation of (27) k=
n) (n + 1 kk (n+1[-k n+1

k-0 Vk Y+ L xkx
-

yj (*) j (n1)x(n+1-k)yk+
k 1 (n+1)
k= n+1 k=1
n+n 1

k=0 (k E k-1) y
n n (n+l-k) yk n! o n+n1
k n n1k (nY1)] x(n+y)!
n! o n+1
= (n)k
k=0 y [- n+1 1
=
IE1 )
,n (n+1-k yk k=(
k=0 n+ 1 n (+-)k
n (n k)k
y + n! o (n+ 1), = (29
k0 (kY= (x
kY)
-1)(n+1)! X y k=Y (29
En+1 kkn x(+ k)y + 0lI oyn1 k=*)Substituting (28) and (29) into (27)
= n\(n+l-k) k n1 n+ 1
k xx
k k/ atrn
(x+y) n
Z E)x (n+lI k)yk
(
O
(n+l-k) k
xOk=O
en i 1 o (n+ 1)
(*) kk,X +(n1)X y n+ 1 (n+ 1-k)k
k=0
n± 1k=
~~~~ k ~~~~~~~~~+
k_EI x

k=O k (+ky Factoring

~~)(n+l-k) yk+0 (n
x)(n+1-k) yk n2±1(xn+11 (n+ 1-k) k [n\ + (

k=0 k=0 k=0

20 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October
By the use of identify (24) the above may be re- ,
written=as 0Element Element (Element
n+ 1
(+)n+1 - (n+) x(n±l-k)yk (30)S1
Fig. 10-A set of elements arranged in a series man-
Formula (25) was shown to be true for n=1. It was ner.
shown true given any nth case, that the (n+ l)th case
is shown to exist and is equal to the nth case if
n' = n+l is substituted for n. Therefore, this for-
mula is true for any defined n where n is an inte- 2 R
ger. N N N
Rs, the probability that the set of elements will
not fail so that it does not affect a short output, is N 0 F
similar to Rt (23), but with one and only one addi- N S N
tional term. Note that 0 0 on the chart for two
elements (Fig. 9) also satisfies the definition. The | N F
expression of this term is Qon. This term added
to Rt defines Rs. Therefore, o 0 F
R = (R+Qo)n Q n+Q n (31) F
R = (R+Q )n. (32) S N N

R the probability that the set of elements will S S F

not fail so that it does not affect an open output, is N = Normal Condition
not satisfied by the case where 0-0 appears on the S = Short Condition
table for two elements (Fig. 9). Examining the 0 = Open Condition
table, note that all of the Rt terms satisfy the F = Failure
definition of Ro; also, all shorting terms also
satisfy the definition. The only remaining term is Fig. 11-Probability-of-survival table.
the term containing all open elements. Therefore,

Qot (Qo)' ten by summing the probability for each normal

since condition.

R-
1- Q RtREl RE2 REl QSE2 RE2 QSEl
thenR° - t n If the elements are similar the inherent failure
(QI)fl.
1 (33) rates are the same; hence,
Since sign is of no consequence, + oo was written. R = RE2
QSEl= QSE2.
SECTION B: SERIES REDUNDANCY Then the formula may be rewritten as

Assume a set of elements arranged in a series Rt=R +2RQ. (34)

where the input of the first element is fed from
the input bus, the output of the first element feeds
the input of the second which feeds the input to the
third,. . . and the output of the nth element feeds
the output bus (Fig. 10). First, let the simple case
be examined where n is equal to 2. A probability
of survival table may be written as shown in
Fig. 11. Again the normal modes of operation
may be examined and the equation representing
the probability of normal operation may be writ-
Derivation of the nth case
Again the following discussion will be limited
to the case of equal elements. In referring to
Fig. 11, it will be noticed that the occurrence of a
catastrophic failure is associated usually with an
open-mode element failure. Also the case will be
noted that all elements shorted defines a failure.
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 21

If these observations are compared to the obser- r---

vations of the parallel case, it will be noted that E | t,,---
-ntE
Qs can be substituted for QO. A similar deriva-
tion for the series case as presented for the
parallel case would yield the following formulas: l

Rt (R+Q )n, (36) X

R +=-Q n0 (37)
s~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
X
ss~~~~~~~~~~~~~~~~~L
SECTION C: 'N' SERIES REDUNDANCIES
~~~,EL
L
LE24 , j JE7 -
L-
_j
1

IN PARALLEL 'M' TIMES

It will be noted by observing Fig 12 (a) that a new / | a

element (E') may be derived from each series
leg. Similarly in Fig. 13 (a) a new element (E')
may be derived from each parallel leg. These new
elements (E') may now be placed in simple re- Fig. 13-Parallel combinations in series.
dundancy modes as shown in Fig. 12(b) or Fig. 13
(b). This is the approach used in the derivation of
the formula to follow. Note that (n) may or may
E 7E l E 21 notn equal (m). First, tnt series elements in para-
llel 'm' times will be used. The following formu-
las used in the derivation have been proven previ-
ously:
| s
n+ n+2
-----2n
-
Rt series
R series =(R+Q )n
R series- 1(-s)
5

E Rt parallel= (R+Q)n
~~R5parallel (R+Q)n =
n

(a) Ro parallel = 1- QO),

since
E , s Q = 1-R:

Therefore,
Q (series)= 1-(R+Q )n
ll l the formula associated with the new element (E')
I| may be substituted into the derived parallel for-
| t mula.
l I.-___ _ , l

E E---J
- Rt= [(R+Q )n-Q5n+ 1-(R+Q ) 3 mn[(RQ)nm

(b) Rt (lQn)m _ [1-(R+Q )n]m (38)

Fig. 12-Series combinations in parallel.

22 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

F/\n~n n\l- I m
Rs = R+Qs -Qs + 1-(R+Q A B C
1 ON ON ON
= -Q s (39) | 2 ON ON OFF

3 ON OFF ON
R = 1- [1- (R+QS)m. (40) 4 ON OFF OFF
5 OFF ON ON

SECTION D: 'N' PARALLEL REDUNDANCIES 6 OFF ON OFF

IN SERIES 'M' TIME
7 OFF OFF ON
Similarly the case is derived for n parallel de- 8 OFF OFF OFF
vices in series m times. (Fig. 13.)

Rt [(R+Q + +Q)n] Fig. 14-Possible modes of three elements.

gductively, it is advisable to examine the vot-

- [- l+QI)nn]
ing members as late in the logic as possible.
r F n This allows any failures in the preceding voting
n 1m -
= l-Q0j -1(R+Q0) j m (41) logic to be picked up.
The example shown in the body of this treatise
first compares "x" and "y" by the logic statements
R= (R+ \n ,/n ±lR Qnlm
o L( o) 0o) ( o)i xy + yx (45)

= [l-Q ]m (42) (note that this is the last protected point within
° the circuit). Since x = a (b+c) and y = bc, there-
fore, by substitution
s= 1- [l-(R+Q0) m* (43) xy + yx = a(b+c) (bc)+bc [a (b+c)J.
Since by Boolean algebra
(bc) = b + c
APPENDIX 11 and a (b + c) = (ab + ac)
= (ab) (ac)
THE PROOF OF THE ADEQUACY
OF DISSENTING VOTE LOGIC (a- +b) (a +c)
=a + ab + ac + cb
Inituitive Proof therefore,
xy + yx= (ab + ac) (b + c) + (a +ab
The possible modes of three elements are _ _
shown in Fig. 14. Of these possible modes of + ac + EL) (bc)
combinations only mode 1 and mode 8 satisfy = abb + acb +abc + acc + abc+ abbc
equality and it follows that modes 2 through 7 are
unequal. These modes are the ones of interest to + acbc + bcbc
Dissenting Vote and may be represented in Bo-
olean format as by Boolean Duality this reduces to
abc + abc + abc + abc + abc + abc. (44) abc + abc + abc.
This equation is then representative of and equal Note that this is only one portion of (44). The
to a dissention of the voting members. rest of the logic substatements express the pres-
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 23

ence of only one input and not the other two. Since By applying the above dualities (56) to (55)
an output requires any two inputs to be present
the rest of the failures will be denoted by an in- 0+abc + abc + 0±abc + 0.0 + 0+ab (c+c)
put and not an output or expressed in Boolean +ac (b+b) + abc +0+0
format as = abc + abc + abc + abc + abc + abc. (57)
(a + b + c) x. (46) By the Law of Association (57) can be rewritten
as (45)
Formal Proof abc + abc + abc + abc + abc + abc + abc + abc

A formal proof of the total equation follows. It

=
abc + abc + abc + abc + abc + ac. (58)
demonstrates that the logic indicated in the sum Rearranging by the Law of Association and by the
of (44), and (45), m+m = m duality
xy + yx + x (a + b + c) (47) abc + abc + abc + abc + abc + abc
is equal to the DVI expression (44), = abc + abc + abc + abc + abc + abc.
a bc + ab c + abc + a b c + a bc + ab c By reviewing (47) it can be noted that a disagree-
xy + yx + x (a+b+c) = a bc + ab c abc + a b c ment between x and y will be indicated by
+ a bc + ab c (48) xy + yx.
x = a (b+c) (49) This points out a failure within the Majority Vote
y = bc. (50) circuitry, (see Fig. 7).
Substituting (49) and (50) in (48)
APPENDIX III
a (b+c) (bc) + bc [a (b-c)j SECTION 1
+ (a+b+c) [a (b+c)] = a bc + ab c + abc MV-DVI RELIABILITY CALCULATIONS
+ abc + ab c + a bc. (51)
Using inversion identities Majority-Vote Circuit
(bc)=b + c (52)
a (b+c) = -+ (b+c)
A typical majority-voted redundant circuit con-
+ (53) sists of three identical decision elements whose
Eq. (51) may be rewritten by substituting (52) outputs are majority voted in such manner that
and (53) as any combination of two or more of the decision
elements must be in agreement to provide an
output from the majority-vote circuit [see
= abc + ab c + abc + abc + abc + abc. (54) Fig. 15 (a)].
By the Boolean form of the Law of Distribution In this circuit A, B, and C are the decision
(54) may be rewritten as taken from (44) elements; D, E, and F are the majority vote ele-
ments; and G is the element required to provide
abb +
abb + abc + abc + acc + abc + bcbc + aa + ab
ab+acthe proper stage isolation. Fig. 15 (b) is a re-
liability success diagram which shows the vari-
+ ac + abc + bbc + cbc ous combinations of successful element operations
abc + ababc + abc +
abc + _
a +_
c abc.(55)
abc + a~. (55) necessary to provide the proper majority-vote
circuit output. The reliability calculations are
based on this diagram.
By Boolean duality The probability of successful majority-vote
circuit operation is calculated in four steps.

bb = 0 a+a = 1 1+1 = 1 Step 1-Combine element B and one-half of ele-

bb c+c = 1 00 =0 ment E in parallel with element C and one-half
mO = 0mm= m 10 0. (56) cc~~~~~~
of element E. Let this be known as group X and
consider the group a parallel redundancy.
24 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October
-22f
Input Q= 1-e r2 (60)
put Using (60) the element Q 's are

L QA= QB = QC = i-e-(22) (0.0048) 0.1

(a)
B and E are
QAS QBS QCS= 1/2QA 0.05
S.cceasfulv
Successf.1 if X
if }cessf.1 QAO QBO = QCO = 1/2QA 0.05

d orif
OR
C adFEar
[ 43
Q~~~~~~D
= F = le(
2) (0.42 x 106) =9.24 x0-o6
ORandD
Q Q 1e(22) (0.31 x10 6)
(b) -
= 6.82 x 106
Fig. 15-(a) Majority vote logic. (b) Success diagram. -(22) (0.11 X 1o-)
Step 2-Combine in series redundancy element A = 2.42 x 10 6
and one-half of element D with group X and one-
half of elemient D. Let this become leg 1. -12
QG= 131 x 10 (see Appendix III-Section 11)
Step 3-Combine in series redundancy element B
and one-half of element F with element C and -12
one-half of element F. Let this become leg 2. QGO= 44 x 10
Step 4-Combine in parallel redundancy leg 1 and
one-half of element G with leg 2 and one-half of Q = 87 x 1012
element G.
-(22) 2 (0.32 x 10 6) -6
Calculation of Individual Element Unreliability (0) QE = 1-e 14.08 x 10

1) The maximum equipment nonoperating time -(22) 2 (2133 x 106

since last checkout = t1 = 2100 hours. QES = 1-e
2) The maximum equipment operating time =9.3852 x 106
during one operating cycle = t2 = 1 hour.

3) The nonoperating failure rate (frl) is as- Q 1 e-(22) 2 (0.1067 x 10

sumed to be equal to (0.01) x operating -6
failure rate (fr2)- = 4.6948 x 10

-(t 1fr) (e 2fr2) (59) Calculation of Majority Vote Reliability (R)

(-(2100) (0.01) f 2 8-(1) (r2) Step 1-Element B and one-half of element E is
Q = 1-ke r2 Ike rcombined in parallel with element C and one-half
X ~~~~~of
element E. Since the parallel elements havre
-(21f
2) 2+1f ~~~equal reliabilities, the following formula will be
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 25

QT1 =~~~~~~~~~~~~
Ti =0.05725968
1 -R
RX R +2RQ02 (61)
where QS = Q iQ2 = 0.004876687

R = RB R1/2E - RC R1/2E Q0o1 = QT QS = 0.05238300.

-

R = 0.899993 Step 3-Combine element B and one-half to ele-

ment F in series with element C and one-half of
O BO +1/ 2QEO =0.0500023. element F. Since these elements have equal re-
liabilities (61) may be used in
Substituting in (61) 22 R =R2 +2RQs2
2R
RX = (0.899993) 2 + 2(0.899993) (0.050002) = T2
0.8999874 Where
QX = 1-RX = 0.1000126. R R CR1/2 F
= = (0.9) (0.9999965) =
From Appendix I 0.89999685
Q 2) = Q 2
O =1-(1-Q (62) QS2 C + Q1/2 F 0.05 + 0.00000121 =
QXO= (0.050002) 2= 0.0025 0.05000121
R = 0.80999433 + 0.090001863 =
QXS QX _QXO =
(63) T2
0.89999619
Q XS = (0.1000126)-(0.0025) = 0.0975126.
QT2 1-RT2 = 0.10000381
2
Step 2-Combine the elements from Step 1 and one- QS = QS2= 0.002500121
half of element D in series with element A and
one-half of element D. Since the sections have Q02 = QT2 - S = 0.097503689.
different reliabilities the following is used: From
Appendix I Step 4-Combine the element found in Step 2 and
one-half of element G in parallel with the element
T 1 2 1 2 2 (64) found in Step 3 and one-half of element G. The
reliabilities R and RT2 are then combined in
T TI parallel as follows using (63):
H1 RA R1/2D = (0.9) (0.9999965) * RT =RTl RT2 + RTl Q02 + RT2 Q
0.89998685 Where
H2 =
Rx R1/2D = (0.8999874) (0.9999965) = RTi = 0.94274032 Qol = 0.05238300
0.8999842 RT2 = 0.89999615 Q = 0.097503689
Q 51 = Q AS + Q 1/2DS = 0.05 + 0.00000121 =
RT = 0.84846265 + 0.091920659 +
0.05000121
0.047144498 = 0.9875278.
Q =Q +Q = 0.0975126 + 0.00000121
S2 XS 1/2DS This is an order-of-magnitude improvement over
= 0.0975138. the individual element reliability.
Substituting in (63)
R Ti = 0.80998294 + 0.0450003 + 0.08775708 of Majority
CalculationOperating Vote Reliability for a
Period
One-Hour
R = 0.94274032
Ti The following values for element unreliability
were calculated using T = 1 hour:
26 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

Q Q= 0.0047885
B = Step 3-Again using (61)
QAO QBO QCO 0.0023942 R1 =-R R1/2 F = 0.995210714
QAS = 0.0023942 Qs QCS + Q1/2 FS = 0.00239426
R T2 =R 1 2 +2
QD =
QF =0.42 X 10 -6 + 2R1QS
QDO= 0.00000031 RT2 = 0.99044436526 + 0.0047655864 =
0.9952099517
QDS - 0.00000011 2
Q 22 x 10 12 S =S2 = 0.00000573248
QTQ 0.0047900483
QE 0.00000064T
Q= 0Q4T - Q = 0.0047843159.
QES= 0.0000004266 0
QEO = 0.0000002134. Step 4-Using (63) the total reliability is
R =R R + +R Q
Step 1-Using (61) T T1T2 Tl02 T2QOl
R R R 0.99521118 0.999965266.
C 1/2E=-
=
This is greater than two orders-of-magnitude
= Q + Q 1/2E = 000119725 improvement over the individual element re-
122Eliability.
Rx= R + 2RQ0 = 0.992828326

QX= 0.007171674 SECTION 11

QX = 0.000001433
Calculation of the Reliability of the Diode Quad
QXS= 0.007170241. as used in the MV Circuit

Step 2-Using (64)

1 RA R1/2D = 0.9995211291
2 =X R1/2D = 0.9928261175
QS= QAS + Q 1/2DS = 0.00239427
QS2 =QXS + Q 1/ 2 DS = 0.00717031 Diode Rel iability

RT1 = RIR2+
R21QS2 + R2QS1 RA==R B= RR C -RD'
RTl = 0.98807176213 + 0.0071359735 + Failure rates
0.0023770938
1) F RT = 0.32 X 10
-6 per hour.
RTTi = 0.9975846886 T
= 0.0024153114
Q TlR 2) F = 0.2133 X 10 per hour.
QS= Q5Q5 = 0.000017167658
S1 S2 FR = 0.1067 x 10 -6 Per hour.
~~~~~~~3)
=O QT1 - Q= 0.0023981438.O
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 27

Assumptions BIBLIOGRAPHY
1) Nonoperating time = maximum time since [1] D. R. Earles, 'Reliability Application and
last checkout = 2100 hours. Analysis Guide," The Martin Co., Denver,
2) Operating time = maximum operating time Colo., Martin Doc. M1-60-54; September,
during one operating cycle = 1 hour. 1960.
3) Nonoperating failure rate = 0.01 x operating
failure rate. [2] C. E. Leake, "Understanding Reliability,"
Calculations, Pasadena Lithographers, Inc., Pasadena,
RT =1[ Q ]m [ (R+Q)n Q
m Calif.;

QS= (2100 x .01) + 0.2133 x 101-6 = 4.6926-6

4.6926
= [3] Igor Bazovsky, "Reliability: Theory and
Practice," Prentice Hall Inc., New York, N.Y.;

R = 1 - (2100 x .01) + 1 0.32 x 10 = [4] D. R. Earles, "Component Part Failure Rates

Associated with Installation Environment,"

R
0.99999262
= 1 - [ (4.6926 x 10
2
-
The Martin Co., Denver,
M-60-47; December, 1960.
Colo.,
Martin Doc.

2
- (0.99999296 + 0.0000046926) 2 [5] L. F. Crossman, and E. L. Eagle, 'EagleRe-
0.999999999956 - 0.000000000022
= liability Problem," Bendix Sys. Div. Docu-
ment, Ann Arbor, Mich.; January, 1961.
= 0.999999999934.
R of one diode [6] Aerospace Industries Assn., E. R. P. No.61-9;
T May 12, 1961.
= e - (22 x 0.32 x 10 6) 0.99999296
RQ = 1- [l-(R
OQ [( QS +QS)nm
-

1- [ 1- (0.999999296 + 4.6926 x 10 6) 2]
1 - [1(-99999755) 2] 2 = 999999999978
RSQ (1 - Qn )m = (1 - 22. 1-12)2
= 0.999999999956.