A quorum that outlives its ground team

dusk is a Monte Carlo of redundancy policies on hardware that decays over a mission measured in decades. Three policies see identical fault histories. Fixed triple modular redundancy votes on three units and stops when it cannot. Standby simplex runs one unit and swaps in a spare. A shrinking quorum votes on three, compares on two, and checks itself on one.

Hardware life is Weibull with shape 1.5 and a scale of 125 years, a median of about 98. Over 10,000 missions, the quorum does 132.6 years of useful work against 99.0 for triple redundancy, 1.34 times as much, with a confidence interval of 1.33 to 1.35. It is never lower on any single mission. Against simplex it runs the same service life, does 160% of the work, and returns 59% fewer undetected errors.

The cost is that a vote on one unit can be wrong without anyone knowing, so the comparison needs a price for a wrong result. Triple redundancy comes out ahead only if one undetected error costs more than 136 years of useful work.

The interesting part is the ground. While a support team exists, it can make the calls the quorum makes on board, and a mission with the ground behind it does as well as the quorum does. So the whole gain lives in the years after the team is gone. If support ends at launch the gain is 1.34 times. At 50 years it is 1.25, at 100 it is 1.11, and if support never ends it is 1.00. How fast the ground answers, anywhere from one day to 180, makes no difference to two decimal places. Voyager’s support has run 49 years.

The references got the same treatment as the numbers. All twelve were checked against the primary sources. One sentence called the fallback from triple redundancy to simplex textbook, and nothing readable confirmed that the cited textbook covers it, so it now says only that the idea is not new, with no citation.

The parameters are illustrative, not calibrated, and the modelled ground team never makes a mistake, which flatters the ground. The results are at dusk.mru.space.