This paper reports a study on the design and modeling of a highly reliable bubble-memory system. This system has the capability of correcting a single 16-adjacent bit-group error resulting from failures in a single basic storage module (BSM), and detecting with a probability greater than 0.99 any double errors resulting from failures in BSM's. The encoding/decoding network (memory translator) is designed to be self-checking, i.e., a single circuit failure in the translator wiH not produce an erroneous output that goes undetected. The system is able to perform reliable configuration in the event of uncorrectable BSM failures, memory translator failures, and dual-memory buffer failures; even in the presence of a single failure in the status registers controlling the configuration network. The bubble memory under study permits serial accessing of the store with 64 x 1024 bit blocks at a 100-kHz rate. The objective of this study is to develop good fault-tolerant design and analysis methods adequate for newly emerging technologies and prove the practicality by example. The reliability modeling study justifies the design philosophy adopted of employing memory data encoding and a translator to correct single group errors and detect double group errors to enhance the overall system reliability. By a proper design of the memory translator based on a new checking technique, a uniformly high percentage of multiple b-adjacent bit-group error detection is achieved through the use of a proposed code (detects 99.99695 percent of double b-adjacent bit-group errors and 99.9985 percent of triple or more b-adjacent bit-group errors).

Reliability modeling and the mathematical equations involved are discussed for general computer systems organized to be fault tolerant. This paper summarizes the work done over the last four years on mathematical reliability modeling by the authors.

Programmed algorithms for test generation and test evaluation are described. The D-notation is introduced and a test generator (DALG) for combinational logic is presented. The sequential case is then examined. "Real life" constraints related to LSI testing are discussed. Two heuristic test generators satisfying these constraints are introduced. The iterative test generator (ITG) generates tests by transforming the given sequential circuit into an iterative combinational circuit. The macroblock test generator (MTG) uses the same approach but makes use of complex primitives (latches, triggers, etc.) to represent the circuit to be tested. Both the ITG and the MTG are not always guaranteed to generate good tests for each examined failure, and are used in connection with a test evaluator (simulator). Basic features of this evaluator are discussed.

Recovery in a fault-tolerant computer means the continuation of system operation with data integrity after an error occurs. This paper delineates two parallel concepts embodied in the hardware and software functions required for recovery; detection, diagnosis, and reconfiguration for hardware, data integrity, checkpointing, and restart for the software. The hardware relies on the recovery variable set, checking circuits, and diagnostics, and the software relies on the recovery information set, audit, and reconstruct routines, to characterize the system state and assist in recovery when required. Of particular utility is a handware unit, the recovery control unit, which serves as an interface between error detection and software recovery programs in the supervisor and provides dynamic interactive recovery.

Two algorithms are presented: one, DALG-II, computes a test to detect a failure in acyclic logic circuits; the other, TEST-DETECT, ascertains all failures detected by a given test. Both are based upon the utilization of a ``calculus of D-cubes'' that provides the means for effectively performing the necessary computations for very large logic circuits. Strategies for combining the two algorithms into an efficient diagnostic test generation procedure are given. APL specifications of the algorithms are given in an Appendix.