A hybrid-redundant multiprocessor is proposed in which each processing unit and each memory module is triplicated for purposes of error detection and momentary error masking Reconfiguration allows spare units to replace failed units and allows surviving units to regroup after spares have been exhausted. An arbitrary number of processing units and memory modules can be accommodated. A hybrid-redundant bus system interconnects the processors and memories, where the initial redundancy of the buses is a design parameter. A specialized circuit called a bus guardian unit (BGU) is employed in numerous places to control reconfiguration and testing in such a way as to eliminate susceptibility to failure events that occur in one module at a time. Considerable emphasis is placed on dynamic testing. This approach is briefly compared to other fault-tolerant computer systems.

A damage-and fault-tolerant input/output (I/O) network is presented as an alternative to I/O buses. Such a network differs most significantly from telecommunications networks (such as the ARPA net) in that the nodes of this net are very simple and do not perform such tasks as message or packet switching and buffering. Data routing through the net is directly controlled by a centralized processor with control algorithms being implemented in software. Descriptions of both the network hardware and the most vital points of the control software are provided. It is believed that this network construction represents both an economically viable alternative to data buses and a significant improvement in reliability and survivability, particularly in those applications where physical damage to elements of the I/O system is a possibility, such as in aircraft, shipboard, rapid transit, and industrial situations.