8 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

Redundancy and the Detection of First Failures*

D. C. JAMESt, senior member, IRE, A. H.
KENT, Jr.t, and J. A. HOLLOWAYt, member, IRE

Summary-The reliability problem is reviewed minimization of size and the long service life re-
with respect to present and future requirements for quired without failures.
military and commercial equipment. Methods of It is, therefore, safe to say that reliability con-
reliability improvement are reviewed and achiev- siderations will continue to be a major factor in
able levels of improvement are indicated for each our ability to progress technologically. Technical
method. Special emphasis is placed on redundancy, journals portray today's situation all too well when
its benefits and disadvantages. The subject of Ma- editorials quote the military. For instance, from
jority Vote is discussed along with failure detection one source we hear that at any given time more
circuitry capable of detecting first failures. The than half of our military radar is down for main-
entire paper is intended to aid the circuit designer tenance and repair and from yet another source,
in his task of achieving higher reliability. The dis- gall of a battleships electronics has never worked
closures pertaining to Majority Vote and failure at any one time." Whether totally true or not, this
detection are considered advances in the state of type of statement is disturbing to those of us who
the art. design and build such equipment. Further, the Air
Force is now asking for satellite equipment with
80,000 hours continous service without failure.
INTRODUCTION With these existing problems facing the design-
ers and manufacturers of electronic (and other) de -
The subject of reliability has been with man vices, a careful review of reliability improvement
from his earliest memories. Unreliable equip- methods is in order. The methods involved canbe
ment has frequently been the cause of incon- divided into the following catagories: 1) Com-
venience and on occasion his death. The desirable ponent Part Improvement, 2) Stress-Level Reduc-
level of reliability of any one device depends upon tion (derating), 3) Circuit Simplification, 4) Main-
the importance of that device to one's comfort of tenance and Production Techniques, and 5) Redun-
safety. When life itself depends upon successful dancy.
performance, reliability cannot be too high. Also,
as the number of devices within a system increases,
reliability of the individual device must in- Component Part Improvement
crease or their utility is lost in a continuous maze
of maintenance problems. The method of component part improvement is
The emphasis on reliability can only be ex- in general quite similar for all cases in that cer-
pected to increase for the following reasons: 1) tain steps are required regardless of the type of
The user of present devices, either home, com- component. These steps are: 1) A large number
mercial, or military, piqued by repeated failures of testing hours must be accrued to establish the
and the resulting repair problems will carefully reliability of the component. These tests include
consider the potential reliability of any replace- various operating stress levels and all applicable
ment item or new additional device. 2) The mili- environmental conditions. These tests are first
tary, faced with the problems of modern technol- run on a control lot and the resulting data usedfor
ogical warfare on the one hand and solving them future comparison. 2) The design of the compo-
with efficiency with respect to the tax dollar on nent is carefully reviewed and all possible im-
the other hand, must insist and is already insist- provements listed. Improvement items may in-
ing on drastic increases in reliability. 3) The ef- clude better base materials, new mechanical de-
fect of the space age on reliability is more pro- sign, new electrical design, improved production
found than any of the foregoing due to required control of materials and assembly techniques. 3)
_____________ ~~~~~~The component is redesigned according to good
*Received June 12, 1962. engineering judgment based on the results of pre-
tThe Martin Company, Denver, Colo. vious tests and past experience with the component.
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 9
4) The tests enumerated in step 1) are repeated liability while good workmanship and procedures
on the improved component. Again large sample can be effective in improving reliability.
sizes and long test periods are required to assure Maintenance techniques bear a similar rela-
reasonable confidence in the test results. 5) These tionship to the realization of high reliability in
steps are repeated until the desired level of re- that unless an intelligent and well-trained main-
liability is realized. tenance staff exists, reliability can become prac-
An excellent example of this method of ap- tically nonexistent after a few maintenance oper-
proach is the Minuteman program. The resulting ations.
improvement in reliability is in the order of one
or two orders of magnitude. Such improvement,
however, has been accomplished at considerable Redundancy
expense in time and dollars. Not as heavily pub-
licized, but of extreme importance, are the relia- After (and only after) all the above have been
bility programs now under way at the majority of fully exploited should redundancy be considered,
the component part manufacturers' plants. and then most carefully. When properly utilized,
two and even three orders of magnitude improve-
ment in reliability can be accomplished. This
Stress-Level Reduction subject will be discussed in detail later in this
paper.
Most types of components become more reli-
able when operated in a manner which results in
reduced stress on the part. These stresses are DETAILED DISCUSSION ON RELIABILITY
introduced not only by the electrical environment IMPROVEMENT IN NONREDUNDANT EQUIPMENT
to which they are subjected, but by their physical
environment as well. In general the reduction of The basic equation for reliability is
any environmental condition to which a component
is vulnerable will result in increased reliability. R = e r
In some cases one or more orders of magnitude
of reliability improvement can be realized. Some where R is the fractional reliability, t is the time
components do not evidence such improvements of required operation, and fr is the effective fail-
and certainly some designs do not lend themselves ure rate. In order to achieve a totally reliable
to derating and environmental isolation. However, equipment (R = 1) the product of t and fr must
this is an effective tool worthy of careful consider- equal zero. Such a condition is considered im-
eration. possible. Further, time may be shortened in
some cases, but cannot be reduced to zero. The
remaining device is to drive the composite fail-
Circuit Simplification ure rate toward zero.
Fig. 1 shows the list of the components from a
The mechanism of simplification of circuitry typical logic and solid-state circuit along with
works at both system and circuit levels. Certainly initial reliabilities for each. The various columns
reduction of system functions and /or performance show representative reliabilities resulting from
levels should reduce the complexity of the system, the improvement methods listed above. Since the
thus improving reliability. At the circuit level, a factor of workmanship is not usually assessed, no
careful review of all applicable circuits will some- figures exist for this important consideration.
times show one to be less complicated, in which Workmanship excellence is assumed to be inher-
case more reliability can be expected. ent. The effects of redundancy are left for later
discussion.
Fig. 1 shows relative degrees of improvement.
Manufacturing and Maintenance Techniques The degree of derating and also simplification are
assumed values for sake of discussion. The fail-
ure rates used herein are not meant to be used
The reliability of any system is highly depend- for actual reliability calculations. They are, how-
ent upon the techniques used in the assembly of ever, typical values which maintain a high degree
both the system and the individual component parts. of reality in the conclusions drawn. The degree
The effect here is very profound in that poor of improvement resulting from derating can be
workmanship can destroy any semblance of re - extracted from curves presented in standard re -
 10 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

(Ambient Tempe:rature = 600 C)

Quantity Component Standard 90 Per Cent 50 Per Cent Minuteman

Name Fr Deration Simplification Fr(4)

Composition -6
600 Resistors 45 x 10 27 x 10 22.5 x lO 4.8 x 10

Silicon -6 -6 -6 2 1
200 Diodes 16x 10 4 x 10 8 x 10 2 x 10
Silicon -6 10 1 l 1
200 Transistors 20 x 10 6 x 106 10 x 10 10 x 10
Foil-Mica -6 -6 -6 -1
100 Capacitors 12 x 10 0.4 x 10 6 x 10 5 x 10-6
Total 93 x 10 6 37.4 x 106 46.5 x 10 21.8 x 10
Fig. 1

liability handbooks and will vary depending upon order of magnitude improvement in failure rate
the component and the degree of derating. The can be predicted.
degree of improvement resulting from simplifica-
tion is directly proportional to the degree of
simplification so long as all other factors remain CALCULATION OF RELIABILITY
unchanged as a result of the simplification.
The figure shows the individual improvements This subject has been discussed in detail in
resulting from the three listed devices. Further other papers [ 1]. However, one point is often
benefits are available through combinations of all overlooked which can cause considerable error in
three devices. The result of any combination is reliability predictions. This has to do with duty
the product of all improvement factors. For in- cycle and the consideration of "ON" failure rates
stance the Fr for six hundred composition resis- vs 'OFF" failure rates. Normally the failure
tors is 45 x 10-6. If Minuteman resistors are rates and resulting reliability only consider the
used and derated to one -tenth maximum rating and failures which occur during operation of equip-
the circuit is then simplified by 50 per cent, the ment. In many cases such consideration is satis-
resulting Fr is 1.44 x 10-6. factory. However, in cases where a very long
storage or "READY" state is maintained followed
4.8 _ 4.8 =144 by a short operational period with no intervening
45 x 45 1.66 x 2 ) maintenance allowed, it is necessary to treat the
\ 27 22.5 / two periods seperately. This last is due to the
difference in failure rates which change as a re-
Similarly the system Fr is equal to 4.75 x 10-6. sult of the changing stress levels. Extrapolation
of existing derating curves indicates that the non-
7 21 .8 21.8 = 4.38 operating failure rate is between one one-hun-
(393
\7.4
x 93
46.5
2.48 x 2
/
dredth and one one -thousandth of the operating
failure rate. We hasten to emphasize that little
is made onbeen
work has
when all the nonredundant improvement devices the done in this area and that no claim
accuracy of the above ratio other
are considered. Thus a failure rate of forty-five than that such an indication does exist. We fur-
failures per million hours for six hundred re- ther assert that the failure rate cannot become
sistors can be reduced to a failure rate of ap-
proximately one and one-half failures per million zero when the equipment is nonoperative
hours of operation. On the system level, a failure Sample Reliability Calculations
rate of ninety-three failures per million hours
reduces to less than five failures per million Several sample calculations are presented here
hours of operation. In each case more than an to lend emphasis to the foregoing comments.
1962 JAMES, KENT Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 11
Case 1-Assume a single circuit element having 1) Reliability (R)-This number is the statis-
F r - 105500 x 10-6 tical prediction of successful completion of the
=
mission of the function to which the reliability fig-
t = hour - (105500) (10-6) ure applies. Expressed in per cent, it is simply a
R = e = e prediction of the percentage of attempts which can
= 0.90 or 90 per cent. be expected to be successful.
Case 2-Assume that derating, component im- 2) Unreliability (Q)-This number is the prob-
provement and circuit simplification have re-
duced the Case 1 failure rate to 5270 x 10-6. ability of failure of a mission. Since the quanti-
R= e
-(I) (5270) (10 -6 ) ties Q and R encompass all possibilities, Q is
equal to l -R.
= 0.9947 or 99.47 per cent.
Case 3-Assume that the Case 2 system is re- 3) Redundancy-A redundant element is any
quired to remain under "READY" status for 2100 duplication of parts or circuitry incorporated for
hours (3 months) and then perform for one hour the sole purpose of increasing reliability.
'OPERATIONAL" without maintenance procedures.
Further assume the failure rate during "READY" 4) Failure-Any change of characteristic, or
is one one-hundredth of the "OPERATIONAL" characteristics, which causes unacceptable oper-
failure rate. ation.
- (1) (-6) -(2100)(5270 N -6)) 5) Circuit Element-Any circuit or arbitrary
R = e (l) (5270 )(10 e s2100
o) division thereof having a defineable function. A
= (0.9947) (0.8994) circuit element may consist of any number of
= 0.8946 or 89.46 per cent. components from one upward.
Case 4-Assume that Case 2 operating time is ex- 6) Failure Rate (Fr) -The predicted rate at
tended to 8000 hours. -6) which a particular circuit element can be expected
R e -(8000) 1(5270) 40- 2 e-42.16
4-1 to fail. Differentiation is made between open and
4.2 x 10 -19 or 4.2 x 10 -17 per cent!! short failure
defined as anymodes.
type of Open-mode failure (Fro) is
failure which precludes
Case 1 assumes a modest reliability in keeping having the proper output with proper input con-
with later discussion on redundancy. Case 2 ditions. Short-mode failure (Frs) is defined as
shows the effects of normal reliability improve- any type of failure which causes an output with no
ment methods whereby better than one order of input. The total failure rate (Frt) is defined as
magnitude improvement is shown. Case 3 shows the sum of Fro and Frs. Four general cases are
the effect of a three month "READY" period on of interest and are now discussed in detail.
the gains achieved by Case 2. Case 4 shows dra-
matically the effects of a one-year operating
time. The obvious conclusion is that such a sys- Case 1-Nonredundant Element
tem cannot meet the requirement. Further cal-
culation shows that the effective system failure
rate must be reduced to less than thirteen fail- ° o
ures per million hours of operation to have a Input (S) Output
ninety per cent probability of a one-year success-
ful operating time. This is an improvement of
over four hundred times in our hypothetical case. Circuit Element Representation
Further steps must be taken to reduce the system
failure rate and/or redundancy must be utilized. From previous definitions we know that:
It is safe to predict that some form of redundancy
will be required to meet such a requirement. 1) The circuit element may have any number
of component parts from one upward.
DETAILED REDUNDANCY DISCUSSION
2) Any component failure within the element
For the purposes of this discussion, the follow- wl as vralfiue
ing definitions are presented:
12 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October
The summation failure rate (Fr) for the ele-
ment is equal to the summation of the individual
Rt = (R + Q
1 -
0)lQ0fnn n
component part failure rates (fr). = QS Qo (6)
In those cases where 'ON' or 'OFF" failure Where Rt is the total reliability of an nth level
modes are of interest, the following statements parallel redundancy. R is the reliability of a
apply: single-circuit element (R = e-t Fr). QO is the
a) The circuit element can be expected to fail
unreliability-
Fr) Qoeisn-od theur
unreliability in the open-mode failure
in either mode. (Qo = I -Ro).
b) The failure rate of either mode of the cir- R = (R + Q0)n = (1 - Q)n (7)
cuit element failure is simply the summation of R =1 - Q n (8)
component part failure rates, fro and frs, which 0 0
would cause that particular element failure mode; If (6) is applied to a first-degree redundancy,
i.e., it is possible to have a component part fail- n becomes 2 and the expression reduces to
ure in one mode and cause an element failure of
the opposite mode. This being true, a detailed R =R +2 RQ (9)
charting of individual component part modes and t o
their resulting circuit element effect is required Assuming R = 0.90, Qt = 0.10 Qs = QO = 0.05
in order to evaluate the summation failure rate in and substituting in (9)
a particular mode. Rt = (0.9)2 +(2) (0.9) (0.05) 0.90 or 90 per
cent.
From the above
If Qs becomes 0.1, QO = 0
Fr = ro (*)+ F rs(*)
frr = z~~~r
Fro rs (1)
~~~cent Rt = (0.9)2 + (2) (0.9) (0) = 0.81 or 81 per
Fro Zfro(*)
=
(2)If Qs = and QO = 0.1
rs Z frs( ) (3) Rt (0.9)2 + (2) (0.9) (0.1) 0.81 + 0.18
=
= 0.99 or 99 per cent.
where (*) is used to designate particular compo-
nent-failure modes as they effect the circuit ele- These three sample calculations emphasize the
ment performance. importance of recognizing probable modes of fail-
ure. The above shows that if the failure modes
c) The reliability of the circuit element in are of equal probability, no improvement in over-
either mode is then calculable and is expressed all reliability can be expected through use of
by parallel redundancy. On the other hand if all
-t F failures are in the short mode, parallel redun-
Ro = e ro (4) dancy will reduce over-all reliability and, if all
R = -t FrS. (5) failures are in the open mode, a considerable in-
s crease in reliability is predicted.
These are simply expressions of the ability of the Eq. (7) expresses the ability of a parallel re-
circuit element to perform without failure in the dundancy to work without short-mode failures.
mode under consideration. Again assuming
R = 0.9, QO = 0.05, and Qs = 0.05 for a first
Case 2-Parallel Redundancy order redundancy (7) becomes
Rs= (R + QO)2 = (0.9 + 0.o5)2 = (0.95)2
This case is presented as two or more circuit = 0.9025 or 90.25 per cent
elements connected in parallel. The circuit ele- similarly (8) becomes
ments used are mutually identical and must meet 2 2
the criteria of Case 1. R0 = 1- Q0 = 1 - 0.05 = 0.9975 or 99.75.
Appendix I, A presents the development of the
mathematical statements which pertain to this per cent which demonstrates that parallel redun-
case. The development is kept general so as to dancy improves open-mode failure reliability to
cover any level of redundancy. From this we de - a marked degree. It follows that if the case exists
rive the statement in which a circuit component has a very small
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 13
Frs or such failures are inconsequential, parallel 1 2
A
Tn
redundancy can be used effectively.
Case 3-Series Redundancy 1
This case is presented as two or more cir-
cuit elements connected in series. As in Case -
2 the circuit elements are identical and are de-
fined in Case 1. z
Appendix I, B develops this case. From this -- -
section of Appendix I we derive Li tn ' n

t s) -Qs (a)
(1 QO)n Qsn (10)
where Rt and R are as defined in Case 2 and Qs
is the unreliability in the short-mode failure 2 -1
(Qs=1 -RS). -
Ro (R +Q)n = (i Q (1)
R= 1(QJ. L 'II
Substitution of the numbers used in Case 2 F-----'
into (10) reveals the following: --A 2
L___ L_____.... ___
1) Again there is no increase in reliability (b)
when QO = Qs. 2) There is a decrease in re-
liability when QO = 0.1 and Qs = 0. 3) There
is an increase in reliability when Q0 = 0 and Fig. 2-(a) 'N' parallel redundancies in series '' times.
(b) 'N' series redundancies in parallel 'm' times.
Qs= O. 1.
Eqs. (11) and (12) show that the converse of
Case 2 is true, i.e., the series redundant case is R = 1 - - (R
(\ + Q )n m (14)
effective in raising reliability in those cases s L oi
where Fro is extremely small or its effect canbe nm
neglected in the application. R = (- Q ) (15)
Case 4-Series-Parallel Redundancy 'N' Series Redundancies in Parallel 'M' Times
(Fig. 2(b)).
There are two possibilities under this head- R = 1 nlm - (R + Qnm (16)
ing, namely; "m" number of case 2 redundancies t L s L V "sJ(
connected in series or, am" number of Case 3 re- R = I
- Qn]m (17)
dundancies connected in parallel. The resulting s s
configurations are shown in Fig. 2. As in previous R = 1 1-(R + Q>n 1 (18)
cases, the predicted relative weights of Fro vs o L \ 5 i
Frs will dictate the choice between these two last
possibilities. Using the numbers from previous examples
where R = 0.90, Qs = Qo= 0.05, let m = n = 2
From Sections C and D of Appendix I, two sets from (16)
of equations are presented here for discussion.
'N' Parallel Redundancies in Series 'M' Times Rt Li - 60X05)2]- [1 - (o.95)2]2
(Fig. 2(a)). 0.99752- 0.0975
= 0.99501 - 0.0095
t~ ~ ~~[
]1-Q1-( (13 = 0.98551 or 98.55 per cent.
14 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

Since (13) and (16) are identical except for circuits followed by a threshold device which re-
QO and Qs, they will give the same Rt in the case jects the sum of less than the majority of inputs.
where Qo = Qs. The two are therefore of equal This is a useable device, but does not provide al-
advantage where Qs = QO. However, where ternate paths in case of first failure within itself.
Qs 7 QO, one configuration will provide better To overcome this difficulty, designers have in
reliability than the other. For instance, as- some cases made the MV logic redundant. The
sume that QO = 0.1 and Qs = 0 substituting in (16) use of 'AND"-'OR' logic may consist of any
logic blocks which satisfy the basic MV (19).
Rt [1 - 0] 2 -[_ - (0.9 + o)202 Fig. 3 is the logic diagram of (19).
= 1- [1 - (0.81)] A
= 1 - (0.19)2
= 0.9639 or 96.39 per cent, substituting AB
in (13)
mv
Rt =[l -(0.1)2]2-[1 -(09 )2 22 ut

= (o.99)2 - (1-1)2
= 0.9801 or 98.01 per cent. Co B

These last two results indicate that the

paralleled-series configuration is more reliable Fig. 3-Logic diagram of (19).
than the seriate -parallel configuration where
Qo>Qs. Also, the converse is true when Qs>Qo.
An important consideration occurs when The minimum number of voting elements is
Qo>>Qs. As this ratio approaches infinity, simple three. More than three elements may be used
parallel redundancy is as effective as a paralleled- where reliability requirements are sufficiently
series combination. In other words, if the prob- stringent. For first failure considerations, three
ability of a short-mode failure is zero, there is voting elements are generally sufficient. When
no benefit to be derived from series redundancy. more than three voting elements are used for
protection against failures beyond the first, a
Logic Configuration1 careful analysis is in order to avoid the anomoly
of a split vote. Further, the MV logic required
The general Boolean statement for majority to take full advantage of more than three voting
voting a triple redundancy of logic blocks A, B, elements becomes extremely tricky when con-
and C is tinued valid system performance is desired be-
MV Output = AB + BC + AC. (19) yond the first failure.
There are several types of logic which can be
used to perform this operation. Some are more The Detection of First Failures
advantageous than others. In general, one way of
expressing redundancy is to say that alternate In a nonredundant system there is no need to
paths are provided for signal flow, in which case look for failures during normal use since a fail-
first failures do not stop over-all performance of ure stops the function. The presence of a failure
the redundant function. Majority-voting logic is therefore self-evident and its location is
which fails to provide an alternate path (or paths) usually easily identified through analysis.
degrades the achievable reliability. Conversely, the detection of first failures in a
There are two approaches. One uses what can redundant system becomes important. This is
be termed a threshold or additive logic, the other true because a single failure does not stop oper-
uses "AND"- "OR" logic. The threshold-logic ation of the system, but a second failure may
circuits consist of resistive or magnetic adding stop it. In other words, the reliability remaining
after a first failure is only as good as the re -
INOTE: This entire discussion is based on the assump- maining
m effectivelylyfuctoAl
functional ccircuitry.
i It is,
Itis
tion that all circuitry involved is digital. It is felt that therefore, desirable to effect repair at the earli-
analog, systems can be adopted to such techniques, but est possible time following a failure and it follows
work in this area has not been done by this group to date. that identification of that failure at the time of its
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 15

occurrence is a first step toward reducing the Majority-Voted Redundancy

time before repair is effected.
Examination of redundant circuitry shows that Majority Vote has been described in other
in most cases, several points in the circuitry technical works. Generally speaking, it is a logi-
must be at or near the same electrical potential cal circuit capable of responding to the majority
when all the elements are functional. This fact of its inputs where these inputs are from three or
may be used in a failure -detection circuit. Fig. 4 more redundant components (a component may
is a diagram of a triply redundant majority-voted have many parts but only one function, in keeping
system. with previous definitions).
Majority Vote is very useful since it protects
against both "ON" or 'OFF" first failures in the
circuitry preceding it, thereby eliminating the
A q e_^
_ need
o for seriate components in the redundant
z group. It is useful wherever the redundant com-
___4W a MV ponents preceeding it are each of equal, or great-
utpu1pt er, complexity as compared with the Majority
Vote circuitry. Strangely enough, except for re -
dundancy of single component parts, the majority
of cases are well suited to Majority Vote. If the
_= C o > ' Z conditions stated above exist, a saving in parts is
effected. In addition it is relatively easy to im-
plement a Majority-Voted system since a single
Fig. 4-A triply redundant majority-voted system. logic block can be designed and then utilized re -
dundantly along with a standard Majority-Vote
Convers wn Q Q tlogic circuit to make up the total logic block. A
Conversllely,pwhenQe»Qrea thereliabidlityygaine word of caution here-the logic block designed
As indicated earlier the above four cases may for majority-vote usage must receive careful re-
be applied in either component-part or function re- liability design consideration before it is incor-
dundancy. The most helpful single component- porated since Majority Vote does not in itself
dundancy.ndaThe helpusinglccomplhonent cure reliability problems. It is only one addi-
partsrheedudany
cases cangecomponent
where a single acomplishedpar in tuhoeseless prblemtool in the solution of a difficult design
part iS much tional
reliable than those in the rest of the circuit.
Over-all component-part redundancy becomes Blocks A, B, and C are defined as identical
very difficult with most components due to the logic functions. With all circuits working normal-
change in the summation electrical characteris- ly, points M, N, and 0 will be equal at all times.
tics of the redundant group with the failure of one Similarly, points X, Y, and Z will be equal at all
part. Even slightly critical circuitry simply does times. It follows that M will not be equal to N and
not lend itself to this type of approach unless a 0 at all times if a component part in logic block
high order of redundancy is used such that a sin- A is faulty. We prefer to identify a failure as a
gle failure no longer changes the electrical "Dissenting Vote," in keeping with the term Ma-
parameters. However, the resulting component- jority Vote. Expressed mathematically, a dis-
part count can rapidly approach that of ten or sention exists when
more individual systems. Such a system becomes
extremely reliable but has several disadvantages, M / N Oor N & 0 = M or O $ M = N, or
namely, 1) it is difficult to design and package, X $ Y = Z or Y $ Z = X or Z $ X = Y.
especially in high-frequency work, 2) it is much
more expensive, and 3) it does not lend itself to Fig. 5 is the logic diagram of a circuit capable
the detection of component failures. (There is of identifying dissention or a "Dissenting Vote.'
further discussion of this item under DETEC- Circuit elements (1) and (2) may be expanded to
TION OF FIRST FAILURES.) Of course, there include any practical number of inputs as the need
are cases where the effect of a component failure arises. The inputs are from the points to be com-
is of no interest. This is especially true where pared. The presence of any inputs without the
maintenance is not available as in unmanned presence of all inputs is sufficient to cause a dis-
space vehicles. In these cases this last objec- senting vote indication (DVI).
tion is not valid.
16 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

0 ~~~~~~~~~~~~~~~~~~~~(a)
InpUt (s) 4,Dissenting a Otu
utu
Vote (b
I{Indication

(c)

Fig. 5-Basic dissenting-vote logic.

A PARTICULAR TRIPLY REDUNDANT

MAJORITY-VOTED CIRCUIT WITH DISSENTING (a)
VOTE (MVDVI) (c)
In an effort to optimize the benefits of MVDVI
considering the economics of space, time and Fig. 7-Logic diagram of the circuit.
dollars, a particular circuit has been developed
and is presented here. Fig.6 is a block diagram cuit. Each of the two diodes was replaced by a
of the circuit. The MV logic has been modified redundant quad. The resulting reliability is cal-
with a slight reduction in total component parts culated in Appendix III, Section A. It is felt that
in both the MV and DVI circuitry. The adequacy the reliability is sufficiently high to warrant the
of the DVI logic is discussed in detail in Appen- function of this circuit without checkout. Re-
dix II and the resulting reliability calculations are commendation is made that the entire MVDVI
presented in Appendix III. Two reliability calcu- circuit be replaced periodically-the period to be
lations are presented for the MVDVI circuit. One based on reliability analysis results.
assumes a three-month 'READY' state plus one- An important consideration arises with re-
hour 'OPERATE' state without maintenance. The dundancy in that the increased component count
reliability improvement for the MVDVI system is reduces the mean time between component-part
one order of magnitude over its nonredundant failures while increasing the mean time between
counterpart. When the requirement is reduced to system failures. This is true since a single com-
only one-hour 'OPERATE' state the reliability ponent part failure does not necessarily stop the
improvement for the MVDVI system is two orders function of the redundant system. The mean
of magnitude over its nonredundant counterpart. time between component part failures therefore
Since these are the same systems in each case has a definite effect upon maintenance require-
this exemplifies the fact that the greatest relia- ments as well as upon the ultimate over-all relia-
bility improvements resulting from MV are ob- bility.
tained from already highly reliable equipment Appendix III presents a thorough reliability
(where t Fr is relatively low). analysis of the MVDVI configuration presented in
Since the final 'OR" in Fig. 7 is outside the Fig. 6. The analysis assumes the same circuit-
protective influence of the DVI circuitry, special element reliability for A, B, and C as used in
emphasis was placed on the reliability of this cir- earlier examples. A direct comparison is there-

Input(s) E Majority

Dissenting Dissenting
Vote ~~~~Vote
ELemen Logic Indication

Fig. 6-Block diagram of the circuit.

1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 17
fore possible between MV and the other forms of slant the considerations toward the designer and
redundancy discussed earlier. his immediate problems. The concept of DVI is
Using the values of R, QO and Qs from the ex- considered worthy of careful consideration as are
amples, we find that total reliability (Rt) is un- many of the points made in regard to the use of
changed in either simple-series or parallel re- redundancy.
dundancy. Further, the two-by-two series parall-
el case (quad) shows one order-of-magnitude im- APPENDIX I
provement using these same parameters. Finally,
the MV case can be expected to provide two or- The Development of Reliability Equations for
ders-of-magnitude improvement. More reliable Fundamental Redundancies
circuit elements will provide even greater im-
provements. The mathematical development of the appropri-
ate useful equations are in the following sequence:
THE UTILIZATION OF DVI Section A: Parallel redundancy.
Section B: Series redundancy.
Since the use of redundancy results in circuit Section C: Senate-parallel redundancy.
failures which in most cases do not cause system Section D: Paralleled-series redundancy.
failures, and since these failures result in net de-
creases in system reliability, DVI becomes useful
in detecting these faults as they occur.
SECTION A: PARALLEL REDUNDANCY
If a totally redundant system is considered, an
interesting use of DVI can be made. First let each
DVI be self-locking so that dissentions are not only
ehAssume a set of elements arranged in a parall-
el manner, that is, such that all elements receive
detected but remembered. Then sum all DVI's equivalent input stimuli and all outputs are con-
within a chassis to provide a chassis-malfunction nected to a common output bus (Fig. 8). First the
indication. Further, chassis indications may be simple case will be examined where n is equal to
summed in any manner desired for presentation 2. A probability-of-survival table may be written
of system status at a convient central point.Check- as shown in Fig. 9. The normal modes of opera-
out of such a system would consist of the initiation tion are next examined and the reliability equation
of (or simulation of) system input signals which written by summing the probability for each nor-
would then cause an exercise of the equipment mal condition.
with immediate detection of any fault. The exist-
ence of a fault (or faults) would be indicated at the
Rt = R El R E2 + R E1 Q oE2 + RE2 Q oE1 . (20)
central indicator panel and could be subsequently If the elements are similar the inherent failure
traced to its origin through a system of testpoints rates are the same; hence,
and/ or indicator lights. R R
An even more attractive situation arises where E1 E2
equipment must ope-rate continuously without fail-
ure. Where manpower is available, the circuit
QoEl= QoE2.
elements can, in large part, be so arranged as to
provide the capability of localizing a fault. Also, Element
replacement of the faulty circuit can be accom- >-1 E
plished without interruption of the system's nor- input(s) output
mal functions.
Some thought has been given to allowing the use
of DVI in satellites wherein the summed DVI's Element
would initiate a code signal indicating presence of l 2
the failure whereupon a service vehicle could be
deployed for the required maintenance function. I
In conclusion it is realized that this paper ElementI
neither provides all the solutions to reliability - Eleen
problems (in fact we suspect the final answer will L -----
not be achieved until 100 per cent reliability is a
reality) or little more than suggests possibilities Fig. 8-A set of elements arranged in a paral-
in most areas. The aim of the paper has been to lel manner.
18 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

From these equations, (20) may be simplified by In the table of n redundancies the terms R and
saying QO excluding Qs, (since Qs defines a failure) will
Rt = R2 + 2RQ (21) appear in the following combinations:Rn, Rn Q09
0
R~~~~~~n-2
2
R Q .. ., RQ , and Q
n-i n
Derivation of the nth Case These terms .

represent all normal elements, one open failure,

The following discussion is only concerned two open failures, .. ., one normal element and
with equal elements. It is observed from the all open elements, respectively. These are also
table, Fig. 9, that any short-mode failure de- the terms of the binomial expansion for
fines a total failure. The case also exists that +Q The coefficients of these terms willbe
all open elements concurrently, define a failure. 0/
A table can be prepared for any n number of re- proven to be the coefficients of the terms of the
dundancies. In this table there is a specific binomial expansion. Therefore, the table (ex-
number of times that a certain combination of cludin Q ) may be expressed as
g s
+Q Since
failures occur without respect to order. Re-
stated, there is a specific number of times a Q , however, expresses a failure, the reliability
combination between two vairiables (r and k) oc-
curs where the order need not be constant but the may be expressed as
number of r terms (nr) and k terms (nk) each re- Rt = (R + Q )lQ n (23)
main constant. The Law of Combinations states
that this number is The following is to show that the coefficient of
the kth term of the binomial expansion may be de-
Cn= n ( (22) n) First, the following identity will be
fined as (k).
k (n-k) !k! k
proven'
Later a proof is given to show that the above ex- (n )+(n)= (+ ) (24)
pression for the Law of Combinations is equal to b eni
the coefficient of the kth term of the binomial ex- by definition
pans ion. (nf\ n\n n! n!
Vk-11 + kk) (n+l-k)! (k-1)! (n-k)!k!
n!k n! (n+1-k) n! (n+1-k+k)
E1 E22 Result (n+l-k)!k! (n+l-k) k!- (n+l-k)-!k!
N N N n! (n+l) (n+1) ! (n+1\
(n+1-k) !k! (n±1-k) !k! k
N 0 N
One possible form of the kth term is now pre-
N S F sented,
O N N (x+y)n = E
k=O
( x)x (25)
O 0 F
To prove this possibility by induction; 1) as-.
o s F sume (25) to be true, and 2) assume n = 1
1X
|S | N | F | (x+y)lN1 F 1-k k
s ~~0 F-
(x+y) k=k- k/1 y

1! 10+ 1! 0 1
N = Normal Condition since 1! = 1 and 0! = 1, the above may be re-
S = Short Condition
0 = Open Condition written as
F = Failure (x+1) 1 = X+Y. (26)

The above is obviously true; assume an arbitrary

Fig. 9-Probability-of-survival table. value of n.
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 19

(x+y)n+1 = (x+y) n (x+y) = (x+y) n x+(x+y) ny. Taking the second summation of 27)2
Substituting for (x+y)n as in(25) 1 (n) n1) yk + [(n)x(n+1-k) k]
+Y)n+l = n(nxn+1-k k (/)n-k k+1 k=01 k=0
k=0' k=0 n± (n+1-k) k
E

Substitution of (k-i) for k may be done by adding 1 x Y

to each limit of the summation. Effectively k-1 +
1 = k. Therefore,

ky0 (k)
k=0
y k (1)x yY (0-1)!n! y
£+1 n n-(k-1) ykk1+1 = n+1 x(n1k)yk
k=1 k=0
n
n+1 - nr,n 1-k k n+1 (n+l-k)) k 1 n+l1o
+ (n )n+1-k y k.
k=1 1 (27) n+1 x(n+lk)yk
Taking the first summation of (27) k=
n) (n + 1 kk (n+1[-k n+1

k-0 Vk Y+ L xkx
-

yj (*) j (n1)x(n+1-k)yk+
k 1 (n+1)
k= n+1 k=1
n+n 1

k=0 (k E k-1) y
n n (n+l-k) yk n! o n+n1
k n n1k (nY1)] x(n+y)!
n! o n+1
= (n)k
k=0 y [- n+1 1
=
IE1 )
,n (n+1-k yk k=(
k=0 n+ 1 n (+-)k
n (n k)k
y + n! o (n+ 1), = (29
k0 (kY= (x
kY)
-1)(n+1)! X y k=Y (29
En+1 kkn x(+ k)y + 0lI oyn1 k=*)Substituting (28) and (29) into (27)
= n\(n+l-k) k n1 n+ 1
k xx
k k/ atrn
(x+y) n
Z E)x (n+lI k)yk
(
O
(n+l-k) k
xOk=O
en i 1 o (n+ 1)
(*) kk,X +(n1)X y n+ 1 (n+ 1-k)k
k=0
n± 1k=
~~~~ k ~~~~~~~~~+
k_EI x

k=O k (+ky Factoring

~~)(n+l-k) yk+0 (n
x)(n+1-k) yk n2±1(xn+11 (n+ 1-k) k [n\ + (

k=0 k=0 k=0

20 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October
By the use of identify (24) the above may be re- ,
written=as 0Element Element (Element
n+ 1
(+)n+1 - (n+) x(n±l-k)yk (30)S1
Fig. 10-A set of elements arranged in a series man-
Formula (25) was shown to be true for n=1. It was ner.
shown true given any nth case, that the (n+ l)th case
is shown to exist and is equal to the nth case if
n' = n+l is substituted for n. Therefore, this for-
mula is true for any defined n where n is an inte- 2 R
ger. N N N
Rs, the probability that the set of elements will
not fail so that it does not affect a short output, is N 0 F
similar to Rt (23), but with one and only one addi- N S N
tional term. Note that 0 0 on the chart for two
elements (Fig. 9) also satisfies the definition. The | N F
expression of this term is Qon. This term added
to Rt defines Rs. Therefore, o 0 F
R = (R+Qo)n Q n+Q n (31) F
R = (R+Q )n. (32) S N N

R the probability that the set of elements will S S F

not fail so that it does not affect an open output, is N = Normal Condition
not satisfied by the case where 0-0 appears on the S = Short Condition
table for two elements (Fig. 9). Examining the 0 = Open Condition
table, note that all of the Rt terms satisfy the F = Failure
definition of Ro; also, all shorting terms also
satisfy the definition. The only remaining term is Fig. 11-Probability-of-survival table.
the term containing all open elements. Therefore,

Qot (Qo)' ten by summing the probability for each normal

since condition.

R-
1- Q RtREl RE2 REl QSE2 RE2 QSEl
thenR° - t n If the elements are similar the inherent failure
(QI)fl.
1 (33) rates are the same; hence,
Since sign is of no consequence, + oo was written. R = RE2
QSEl= QSE2.
SECTION B: SERIES REDUNDANCY Then the formula may be rewritten as

Assume a set of elements arranged in a series Rt=R +2RQ. (34)

where the input of the first element is fed from
the input bus, the output of the first element feeds
the input of the second which feeds the input to the Derivation of the nth case
third,. . . and the output of the nth element feeds
the output bus (Fig. 10). First, let the simple case Again the following discussion will be limited
be examined where n is equal to 2. A probability to the case of equal elements. In referring to
of survival table may be written as shown in Fig. 11, it will be noticed that the occurrence of a
Fig. 11. Again the normal modes of operation catastrophic failure is associated usually with an
may be examined and the equation representing open-mode element failure. Also the case will be
the probability of normal operation may be writ- noted that all elements shorted defines a failure.
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 21

If these observations are compared to the obser- r---

vations of the parallel case, it will be noted that E | t,,---
-ntE
Qs can be substituted for QO. A similar deriva-
tion for the series case as presented for the
parallel case would yield the following formulas: l

Rt (R+Q )n, (36) X

R +=-Q n0 (37)
s~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
X
ss~~~~~~~~~~~~~~~~~L
SECTION C: 'N' SERIES REDUNDANCIES
~~~,EL
L
LE24 , j JE7 -
L-
_j
1

IN PARALLEL 'M' TIMES

It will be noted by observing Fig 12 (a) that a new / | a

element (E') may be derived from each series
leg. Similarly in Fig. 13 (a) a new element (E')
may be derived from each parallel leg. These new
elements (E') may now be placed in simple re- Fig. 13-Parallel combinations in series.
dundancy modes as shown in Fig. 12(b) or Fig. 13
(b). This is the approach used in the derivation of
the formula to follow. Note that (n) may or may
E 7E l E 21 notn equal (m). First, tnt series elements in para-
llel 'm' times will be used. The following formu-
las used in the derivation have been proven previ-
ously:
| s
n+ n+2
-----2n
-
Rt series
R series =(R+Q )n
R series- 1(-s)
5

E Rt parallel= (R+Q)n
~~R5parallel (R+Q)n =
n

(a) Ro parallel = 1- QO),

since
E , s Q = 1-R:

Therefore,
Q (series)= 1-(R+Q )n
ll l the formula associated with the new element (E')
I| may be substituted into the derived parallel for-
| t mula.
l I.-___ _ , l

E E---J
- Rt= [(R+Q )n-Q5n+ 1-(R+Q ) 3 mn[(RQ)nm

(b) Rt (lQn)m _ [1-(R+Q )n]m (38)

Fig. 12-Series combinations in parallel.

22 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

F/\n~n n\l- I m
Rs = R+Qs -Qs + 1-(R+Q A B C
1 ON ON ON
= -Q s (39) | 2 ON ON OFF

3 ON OFF ON
R = 1- [1- (R+QS)m. (40) 4 ON OFF OFF
5 OFF ON ON

SECTION D: 'N' PARALLEL REDUNDANCIES 6 OFF ON OFF

IN SERIES 'M' TIME
7 OFF OFF ON
Similarly the case is derived for n parallel de- 8 OFF OFF OFF
vices in series m times. (Fig. 13.)

Rt [(R+Q + +Q)n] Fig. 14-Possible modes of three elements.

gductively, it is advisable to examine the vot-

- [- l+QI)nn]
ing members as late in the logic as possible.
r F n This allows any failures in the preceding voting
n 1m -
= l-Q0j -1(R+Q0) j m (41) logic to be picked up.
The example shown in the body of this treatise
first compares "x" and "y" by the logic statements
R= (R+ \n ,/n ±lR Qnlm
o L( o) 0o) ( o)i xy + yx (45)

= [l-Q ]m (42) (note that this is the last protected point within
° the circuit). Since x = a (b+c) and y = bc, there-
fore, by substitution
s= 1- [l-(R+Q0) m* (43) xy + yx = a(b+c) (bc)+bc [a (b+c)J.
Since by Boolean algebra
(bc) = b + c
APPENDIX 11 and a (b + c) = (ab + ac)
= (ab) (ac)
THE PROOF OF THE ADEQUACY
OF DISSENTING VOTE LOGIC (a- +b) (a +c)
=a + ab + ac + cb
Inituitive Proof therefore,
xy + yx= (ab + ac) (b + c) + (a +ab
The possible modes of three elements are _ _
shown in Fig. 14. Of these possible modes of + ac + EL) (bc)
combinations only mode 1 and mode 8 satisfy = abb + acb +abc + acc + abc+ abbc
equality and it follows that modes 2 through 7 are
unequal. These modes are the ones of interest to + acbc + bcbc
Dissenting Vote and may be represented in Bo-
olean format as by Boolean Duality this reduces to
abc + abc + abc + abc + abc + abc. (44) abc + abc + abc.
This equation is then representative of and equal Note that this is only one portion of (44). The
to a dissention of the voting members. rest of the logic substatements express the pres-
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 23

ence of only one input and not the other two. Since By applying the above dualities (56) to (55)
an output requires any two inputs to be present
the rest of the failures will be denoted by an in- 0+abc + abc + 0±abc + 0.0 + 0+ab (c+c)
put and not an output or expressed in Boolean +ac (b+b) + abc +0+0
format as = abc + abc + abc + abc + abc + abc. (57)
(a + b + c) x. (46) By the Law of Association (57) can be rewritten
as (45)
Formal Proof abc + abc + abc + abc + abc + abc + abc + abc

A formal proof of the total equation follows. It

=
abc + abc + abc + abc + abc + ac. (58)
demonstrates that the logic indicated in the sum Rearranging by the Law of Association and by the
of (44), and (45), m+m = m duality
xy + yx + x (a + b + c) (47) abc + abc + abc + abc + abc + abc
is equal to the DVI expression (44), = abc + abc + abc + abc + abc + abc.
a bc + ab c + abc + a b c + a bc + ab c By reviewing (47) it can be noted that a disagree-
xy + yx + x (a+b+c) = a bc + ab c abc + a b c ment between x and y will be indicated by
+ a bc + ab c (48) xy + yx.
x = a (b+c) (49) This points out a failure within the Majority Vote
y = bc. (50) circuitry, (see Fig. 7).
Substituting (49) and (50) in (48)
APPENDIX III
a (b+c) (bc) + bc [a (b-c)j SECTION 1
+ (a+b+c) [a (b+c)] = a bc + ab c + abc MV-DVI RELIABILITY CALCULATIONS
+ abc + ab c + a bc. (51)
Using inversion identities Majority-Vote Circuit
(bc)=b + c (52)
a (b+c) = -+ (b+c)
A typical majority-voted redundant circuit con-
+ (53) sists of three identical decision elements whose
Eq. (51) may be rewritten by substituting (52) outputs are majority voted in such manner that
and (53) as any combination of two or more of the decision
elements must be in agreement to provide an
output from the majority-vote circuit [see
= abc + ab c + abc + abc + abc + abc. (54) Fig. 15 (a)].
By the Boolean form of the Law of Distribution In this circuit A, B, and C are the decision
(54) may be rewritten as taken from (44) elements; D, E, and F are the majority vote ele-
ments; and G is the element required to provide
abb +
abb + abc + abc + acc + abc + bcbc + aa + ab
ab+acthe proper stage isolation. Fig. 15 (b) is a re-
liability success diagram which shows the vari-
+ ac + abc + bbc + cbc ous combinations of successful element operations
abc + ababc + abc +
abc + _
a +_
c abc.(55)
abc + a~. (55) necessary to provide the proper majority-vote
circuit output. The reliability calculations are
based on this diagram.
By Boolean duality The probability of successful majority-vote
circuit operation is calculated in four steps.

bb = 0 a+a = 1 1+1 = 1 Step 1-Combine element B and one-half of ele-

bb c+c = 1 00 =0 ment E in parallel with element C and one-half
mO = 0mm= m 10 0. (56) cc~~~~~~
of element E. Let this be known as group X and
consider the group a parallel redundancy.
24 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October
-22f
Input Q= 1-e r2 (60)
put Using (60) the element Q 's are

L QA= QB = QC = i-e-(22) (0.0048) 0.1

(a)
B and E are
QAS QBS QCS= 1/2QA 0.05
S.cceasfulv
Successf.1 if X
if }cessf.1 QAO QBO = QCO = 1/2QA 0.05

d orif
OR
C adFEar
[ 43
Q~~~~~~D
= F = le(
2) (0.42 x 106) =9.24 x0-o6
ORandD
Q Q 1e(22) (0.31 x10 6)
(b) -
= 6.82 x 106
Fig. 15-(a) Majority vote logic. (b) Success diagram. -(22) (0.11 X 1o-)
Step 2-Combine in series redundancy element A = 2.42 x 10 6
and one-half of element D with group X and one-
half of elemient D. Let this become leg 1. -12
QG= 131 x 10 (see Appendix III-Section 11)
Step 3-Combine in series redundancy element B
and one-half of element F with element C and -12
one-half of element F. Let this become leg 2. QGO= 44 x 10
Step 4-Combine in parallel redundancy leg 1 and
one-half of element G with leg 2 and one-half of Q = 87 x 1012
element G.
-(22) 2 (0.32 x 10 6) -6
Calculation of Individual Element Unreliability (0) QE = 1-e 14.08 x 10

1) The maximum equipment nonoperating time -(22) 2 (2133 x 106

since last checkout = t1 = 2100 hours. QES = 1-e
2) The maximum equipment operating time =9.3852 x 106
during one operating cycle = t2 = 1 hour.

3) The nonoperating failure rate (frl) is as- Q 1 e-(22) 2 (0.1067 x 10

sumed to be equal to (0.01) x operating -6
failure rate (fr2)- = 4.6948 x 10

-(t 1fr) (e 2fr2) (59) Calculation of Majority Vote Reliability (R)

(-(2100) (0.01) f 2 8-(1) (r2) Step 1-Element B and one-half of element E is
Q = 1-ke r2 Ike rcombined in parallel with element C and one-half
X ~~~~~of
element E. Since the parallel elements havre
-(21f
2) 2+1f ~~~equal reliabilities, the following formula will be
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 25

QT1 =~~~~~~~~~~~~
Ti =0.05725968
1 -R
RX R +2RQ02 (61)
where QS = Q iQ2 = 0.004876687

R = RB R1/2E - RC R1/2E Q0o1 = QT QS = 0.05238300.

-

R = 0.899993 Step 3-Combine element B and one-half to ele-

ment F in series with element C and one-half of
O BO +1/ 2QEO =0.0500023. element F. Since these elements have equal re-
liabilities (61) may be used in
Substituting in (61) 22 R =R2 +2RQs2
2R
RX = (0.899993) 2 + 2(0.899993) (0.050002) = T2
0.8999874 Where
QX = 1-RX = 0.1000126. R R CR1/2 F
= = (0.9) (0.9999965) =
From Appendix I 0.89999685
Q 2) = Q 2
O =1-(1-Q (62) QS2 C + Q1/2 F 0.05 + 0.00000121 =
QXO= (0.050002) 2= 0.0025 0.05000121
R = 0.80999433 + 0.090001863 =
QXS QX _QXO =
(63) T2
0.89999619
Q XS = (0.1000126)-(0.0025) = 0.0975126.
QT2 1-RT2 = 0.10000381
2
Step 2-Combine the elements from Step 1 and one- QS = QS2= 0.002500121
half of element D in series with element A and
one-half of element D. Since the sections have Q02 = QT2 - S = 0.097503689.
different reliabilities the following is used: From
Appendix I Step 4-Combine the element found in Step 2 and
one-half of element G in parallel with the element
T 1 2 1 2 2 (64) found in Step 3 and one-half of element G. The
reliabilities R and RT2 are then combined in
T TI parallel as follows using (63):
H1 RA R1/2D = (0.9) (0.9999965) * RT =RTl RT2 + RTl Q02 + RT2 Q
0.89998685 Where
H2 =
Rx R1/2D = (0.8999874) (0.9999965) = RTi = 0.94274032 Qol = 0.05238300
0.8999842 RT2 = 0.89999615 Q = 0.097503689
Q 51 = Q AS + Q 1/2DS = 0.05 + 0.00000121 =
RT = 0.84846265 + 0.091920659 +
0.05000121
0.047144498 = 0.9875278.
Q =Q +Q = 0.0975126 + 0.00000121
S2 XS 1/2DS This is an order-of-magnitude improvement over
= 0.0975138. the individual element reliability.
Substituting in (63)
R Ti = 0.80998294 + 0.0450003 + 0.08775708 of Majority
CalculationOperating Vote Reliability for a
Period
One-Hour
R = 0.94274032
Ti The following values for element unreliability
were calculated using T = 1 hour:
26 IRE TRANSACTIONS ON RELIABILITY AND QUALITY CONTROL October

Q Q= 0.0047885
B = Step 3-Again using (61)
QAO QBO QCO 0.0023942 R1 =-R R1/2 F = 0.995210714
QAS = 0.0023942 Qs QCS + Q1/2 FS = 0.00239426
R T2 =R 1 2 +2
QD =
QF =0.42 X 10 -6 + 2R1QS
QDO= 0.00000031 RT2 = 0.99044436526 + 0.0047655864 =
0.9952099517
QDS - 0.00000011 2
Q 22 x 10 12 S =S2 = 0.00000573248
QTQ 0.0047900483
QE 0.00000064T
Q= 0Q4T - Q = 0.0047843159.
QES= 0.0000004266 0
QEO = 0.0000002134. Step 4-Using (63) the total reliability is
R =R R + +R Q
Step 1-Using (61) T T1T2 Tl02 T2QOl
R R R 0.99521118 0.999965266.
C 1/2E=-
=
This is greater than two orders-of-magnitude
= Q + Q 1/2E = 000119725 improvement over the individual element re-
122Eliability.
Rx= R + 2RQ0 = 0.992828326

QX= 0.007171674 SECTION 11

QX = 0.000001433
Calculation of the Reliability of the Diode Quad
QXS= 0.007170241. as used in the MV Circuit

Step 2-Using (64)

1 RA R1/2D = 0.9995211291
2 =X R1/2D = 0.9928261175
QS= QAS + Q 1/2DS = 0.00239427
QS2 =QXS + Q 1/ 2 DS = 0.00717031 Diode Rel iability

RT1 = RIR2+
R21QS2 + R2QS1 RA==R B= RR C -RD'
RTl = 0.98807176213 + 0.0071359735 + Failure rates
0.0023770938
1) F RT = 0.32 X 10
-6 per hour.
RTTi = 0.9975846886 T
= 0.0024153114
Q TlR 2) F = 0.2133 X 10 per hour.
QS= Q5Q5 = 0.000017167658
S1 S2 FR = 0.1067 x 10 -6 Per hour.
~~~~~~~3)
=O QT1 - Q= 0.0023981438.O
1962 JAMES, KENT, Jr., AND HOLLOWAY: DETECTION OF FIRST FAILURES 27

Assumptions BIBLIOGRAPHY
1) Nonoperating time = maximum time since [1] D. R. Earles, 'Reliability Application and
last checkout = 2100 hours. Analysis Guide," The Martin Co., Denver,
2) Operating time = maximum operating time Colo., Martin Doc. M1-60-54; September,
during one operating cycle = 1 hour. 1960.
3) Nonoperating failure rate = 0.01 x operating
failure rate. [2] C. E. Leake, "Understanding Reliability,"
Calculations, Pasadena Lithographers, Inc., Pasadena,
RT =1[ Q ]m [ (R+Q)n Q
m Calif.;

QS= (2100 x .01) + 0.2133 x 101-6 = 4.6926-6

4.6926
= [3] Igor Bazovsky, "Reliability: Theory and
Practice," Prentice Hall Inc., New York, N.Y.;

R = 1 - (2100 x .01) + 1 0.32 x 10 = [4] D. R. Earles, "Component Part Failure Rates

Associated with Installation Environment,"

R
0.99999262
= 1 - [ (4.6926 x 10
2
-
The Martin Co., Denver,
M-60-47; December, 1960.
Colo.,
Martin Doc.

2
- (0.99999296 + 0.0000046926) 2 [5] L. F. Crossman, and E. L. Eagle, 'EagleRe-
0.999999999956 - 0.000000000022
= liability Problem," Bendix Sys. Div. Docu-
ment, Ann Arbor, Mich.; January, 1961.
= 0.999999999934.
R of one diode [6] Aerospace Industries Assn., E. R. P. No.61-9;
T May 12, 1961.
= e - (22 x 0.32 x 10 6) 0.99999296
RQ = 1- [l-(R
OQ [( QS +QS)nm
-

1- [ 1- (0.999999296 + 4.6926 x 10 6) 2]
1 - [1(-99999755) 2] 2 = 999999999978
RSQ (1 - Qn )m = (1 - 22. 1-12)2
= 0.999999999956.