Minimizing the risk of misfires and duds in a missile control system

Question

I was thinking the other day about all the different ways humanity could end itself -- I won't depress you all by listing them here -- and misfired nuclear missiles came to mind. The problem below is about how to minimize misfires and duds through distributed components and backups. The explanation runs a little long but the problem is complicated (though the mathematics is not) so I wanted to be clear.

Background

In designing a missile defense system, there are two important qualities you must have: reliability and security. By reliability I mean that the system doesn't fail when it is needed, and by security I mean that the system doesn't fire when it isn't supposed to. (And of course there are other important qualities to design for, such as accuracy, but I'm not considering those here.)

To make a system reliable, one solution is to have a number of backups for each component, so that only one of these need be functioning for each component to make the whole thing work.

To make a system secure, we can't simply make a long series of software tests that need to be passed, because in the end if you have only one component which needs to activate in order for the whole thing to go off, one flipped bit could shoot a missile accidentally. (Perhaps this isn't really true but this is what I'm assuming for the problem.) Given this, we want to have a number of different mechanical components, say $ C_1, C_2, \ldots $ which all need to be activated in order for the firing mechanism to succeed.

However there is a slight problem. The more components we have to ensure security, the more backups we need to ensure that all of them function properly. And the more backups we get to ensure reliability, the higher the chance one backup for each component fails.

Assume that they do not need to all fail at the same time, but rather once a bit is erroneously flipped in one backup of one component, it stays flipped for some time period T until someone comes along and replaces it. The longer the time period T, the more likely that one of each of the different components will fail, creating a misfire if they all do.

The Problem

Here is the question. Let $ S $ be the number of different components to ensure security, and let there be $ R $ backups of each of these components to ensure reliability. Assume that the failure rate of any one (backup of a ) component during a time period $ T $ is $ P_f $. Let $ P_m $ denote the probability of a misfire and let $ P_d $ denote the probability of the system failing to fire. (The letter $ d $ is for "dud".) Let $ P_s = \sqrt {P_m^2 + P_d^2}$ denote the total probability of system failure.

What values of $ S $ and $ R $ give the lowest probability of a system failure $ P_s $ over the time period $ T $?

In other words, how many different components and how many backups for each of those components should there be to minimize the risk of either a misfire or a failure to fire?

Answer 1

You need to specify how they are hooked up carefully to calculate the probability, but you can always improve things with more components. One way to connect them is to have $R$ components in parallel and $S$ batches of parallel groups in series. Now you fire if at least one component in every group works and don't fire if at least one group has a component that doesn't. Then when you want to fire, the chance that one group does is $1-(1-P_d)^R$ and the chance that all the groups do is $[1-(1-P_d)^R]^S$ The chance of a misfire of one group is $1-P_m^R$ and the chance of a system misfire is $(1-P_m^R)^S$. If you increase $R,S$ together, you increase the chance of always having desired behavior.

Of course, this assumes all failures are random. As the chance gets closer to what you want, the dominating failures are common ones-sending the fire signal when you don't want to, which then is executed successfully. Oops!