9. Checking.
It will be almost our most serious problem to make sure that the calculator is doing what it should. We may perhaps distinguish between three kinds of error.
(1) Permanent faults that have developed in the wiring or components, e.g. condensers that have become open circuit.
(2) Temporary errors due to interference, noise reaching unexpected levels, unusual combinations of voltages at some point in the circuit, etc.
(3) Errors due to the use of incorrect instruction tables, or even due to mistaken views as to what the circuit should do.
It will be our intention to install monitoring circuits to detect errors of form (1) fairly soon. The ideal to aim at should be that each conceivable form of failure would give a different indication on the monitor. In practice we should probably simply localise the error to some part, e.g. an adder, which could be changed and then examined at leisure.
Errors of type (2) should not occur when the apparatus is in proper working order, however when a component is beginning to age its deficiencies will often show themselves first in this sort of way. For instance, if the emission of a valve in a Kipp relay circuit is beginning to fail it will eventually not pass on any of the pulses it should, but this will begin with some occasional failures to react. The worst of this can probably be eliminated by frequent test runs in which the conditions of H.T. volts, interference, etc., are all modified in a way calculated to accentuate the deficiencies of the components. Those which are rather down at heel may then be removed, and when the conditions are restored to normal there should be a good margin of safety. We cannot of course rely on this 100%. We need a second string. This will be provided by a variety of checks of the types normally employed in computing, i.e. wherever we can find a simple identity which should be satisfied by the results of our calculations we shall verify it. For instance, if we were multiplying polynomials algebraically we should check by taking a particular value for the variable. If we were calculating the values of an analytic function at equal intervals we should check by differencing. Most of these checks will have to be set up as part of the instruction tables, and the appropriate action to be taken will also be put into them. A few checks will be made part of the circuit. For instance, all multiplications and additions will be checked by repeating them modulo 255.
Incorrect instruction tables (3) will often be shown up by the checks which have been put into these same instruction tables. We may also apply a special check whenever we have made up a new instruction table, by comparing the results with the same job done by means of a different table, probably a more straightforward but slower one. This should eliminate all errors on the part of the mathematicians, but would leave the possibility of lost cards, etc., when the table is being used a second time. This may perhaps be corrected by running a test job as soon as the cards have been put into the machine.
There are three chief functions to be performed by the checking. It must eliminate the possibility of error, help to diagnose faults, and inspire confidence. We have not yet spoken at all of this last requirement. It would clearly not be satisfactory if the checking system in fact prevented all errors, but nobody had any confidence in the results. The device would come to no better end than Cassandra. In order to inspire confidence the checking must have some visible manifestations. Certainly whenever a check fails to work out the matter must be reported by the machine. There would not be time for all checks which do work out to be reported, but there could be a facility by which this could be laid on temporarily at moments of shaken confidence. Another facility which should have a good effect on morale is that of the artificial error. By some means the behaviour of the machine is disturbed from outside, and one waits for some error to be reported. This could be managed quite easily. One could arrange to introduce an unwanted pulse at any point in the circuit. In fact of course we cannot do very much about checking until the machine is made. We cannot really tell what troubles of this kind are in store for us, although one can feel confident that none of them will be insurmountable. We can only prepare against the difficulties we can foresee and hope that they will represent a large percentage of the whole.