The experimental fault-tolerant memory system described in this paper has been designed to enable the modular addition of spares, to validate the theoretical fault-secure and self-testing properties of the translator/corrector, to provide a basis for experiments using the new testing and correction processes for recovery, and to determine the practicality of such systems. The hardware design and implementation are described, together with methods of fault insertion. The hardware/ software interface, including a restricted single error correction/double error detection (SEC/DED) code, is specified. Procedures are carefully described which, 1) test for specified physical faults, 2) ensure that single error corrections are not miscorrections due to triple faults, and 3) enable recovery from double errors.

This paper reports a study on the design and modeling of a highly reliable bubble-memory system. This system has the capability of correcting a single 16-adjacent bit-group error resulting from failures in a single basic storage module (BSM), and detecting with a probability greater than 0.99 any double errors resulting from failures in BSM's. The encoding/decoding network (memory translator) is designed to be self-checking, i.e., a single circuit failure in the translator wiH not produce an erroneous output that goes undetected. The system is able to perform reliable configuration in the event of uncorrectable BSM failures, memory translator failures, and dual-memory buffer failures; even in the presence of a single failure in the status registers controlling the configuration network. The bubble memory under study permits serial accessing of the store with 64 x 1024 bit blocks at a 100-kHz rate. The objective of this study is to develop good fault-tolerant design and analysis methods adequate for newly emerging technologies and prove the practicality by example. The reliability modeling study justifies the design philosophy adopted of employing memory data encoding and a translator to correct single group errors and detect double group errors to enhance the overall system reliability. By a proper design of the memory translator based on a new checking technique, a uniformly high percentage of multiple b-adjacent bit-group error detection is achieved through the use of a proposed code (detects 99.99695 percent of double b-adjacent bit-group errors and 99.9985 percent of triple or more b-adjacent bit-group errors).

AFTER approximately 20 years of obscurity, the field of fault-tolerant computing was revived by the formation of the IEEE Technical Committee on Fault-Tolerant Computing, by a series of articles in COMPUTER for January/ February 1971, by the 1971 International Symposium on Fault-Tolerant Computing in Pasadena, Calif., and by an IEEE TRANSACTIONS ON COMPUTERS Special Issue on Fault-Tolerant Computing in November 1971. Interest and activity continued apace, and the 1972 International Symposium on Fault-Tolerant Computing was held in Newton, Mass. Most of the excellent papers in this second IEEE TRANSACTIONS Special Issue on Fault-Tolerant Computing were presented at that symposium. As an introduction to these papers, consideration of the ultimate goals of this discipline and the universe in which our work is being done is most appropriate.

This paper demonstrates two improvements in coding techniques that could be used for memory word coding. First, within the fixed structure of a Hamming single-error-correcting, double-error-detecting (SEC/DED) code, an improvement can be obtained in circuit cost and operational speed over more conventional code implementations. Second, the mechanics of error correction in a fault-tolerant computer may be carried out via conventional hardware means or by use of the existing system facilities, such as the combination of the microprogram unit, local store, and the arithmetic-logic unit. These improvements may be obtained by the use of Rotational Coding schemes in conjunction with a technique calied "lookaside correction." This paper first shows a generalized algorithm for specifying the parity check matrix of Rotational Codes. The structure implemented by the parity check matrix in this paper is not merely encoding and decoding circuitry, but translates between Rotational Code forms and byte-parity encoded forms. The unique feature of these translators is that use of the Rotational Code permits the error correction to be performed on only a subset of the data word bits, and only if a single-error condition has been detected. The correction mechanism may be either a hardware logic circuit or firmware. The paper concludes with a comparison of the circuit requirements and correctional speed of the Hamming (72, 64) single-error-correcting, double-error-detecting code, as it normally would be implemented, and a Rotational Code translator also operating on 64 data bits and 8 check bits.

Reliability modeling and the mathematical equations involved are discussed for general computer systems organized to be fault tolerant. This paper summarizes the work done over the last four years on mathematical reliability modeling by the authors.

A method is given of designing a simple self-checking and self-testing decoder checking circuit which uses much less circuitry than previous checkers. An analysis is given of the circuit savings and of the probability of erroneous decoder operation before error detection.

Recovery in a fault-tolerant computer means the continuation of system operation with data integrity after an error occurs. This paper delineates two parallel concepts embodied in the hardware and software functions required for recovery; detection, diagnosis, and reconfiguration for hardware, data integrity, checkpointing, and restart for the software. The hardware relies on the recovery variable set, checking circuits, and diagnostics, and the software relies on the recovery information set, audit, and reconstruct routines, to characterize the system state and assist in recovery when required. Of particular utility is a handware unit, the recovery control unit, which serves as an interface between error detection and software recovery programs in the supervisor and provides dynamic interactive recovery.