The Voyagers have been so reliable due to careful design, plus lots of redundancy.
Voyager employs three dual-redundant computer systems per spacecraft. The first, the CCS, is nearly identical to that flown on Viking, performing sequencing and spacecraft health functions along with new ones necessitated by the addition of the other computers. Telemetry data formatting and transmission handled by the Flight Data System are done on Voyager with the help of a custom-built computer. Attitude control and articulation of the scan platform are accomplished with the third computer system.
One concept from the STAR computer proposed for the TOPS, applicable to Voyager, is dormancy. JPL's project staff believed that equipment would last longer if unpowered4. Although both CCSs are always powered, rarely are both Flight Data Systems running, and both attitude control computers are never turned on at the same time. Full bit-for-bit redundancy is not maintained in the dual memories. For example, "expended" algorithms, such as the deployment sequence executed shortly after separation from the booster, need not be maintained5. Both memories are accessed by the single active processor in each system. The Flight Data System keeps a copy of its instructions in both memories, but intermediate data and variables can be stored in either memory. This seemingly casual attitude toward memory duplication tightens up considerably near encounter periods, which is one time that both CCS processors are in tandem mode.
The Voyagers are regularly updated in-flight with new software:
In-flight programming allowed for new routines and programs to be uploaded regularly in non-volatile memory and eliminated the need for large amounts of memory to be required onboard.
You're assuming these computers can't be rebooted. Voyager 2's FDS was rebooted in 2010, for example.
Engineers successfully reset a computer onboard Voyager 2 that caused an unexpected data pattern shift, and the spacecraft resumed sending properly formatted science data back to Earth on Sunday, May 23. Mission managers at NASA's Jet Propulsion Laboratory in Pasadena, Calif., had been operating the spacecraft in engineering mode since May 6. They took this action as they traced the source of the pattern shift to the flip of a single bit in the flight data system computer that packages data to transmit back to Earth. In the next week, engineers will be checking the science data with Voyager team scientists to make sure instruments onboard the spacecraft are processing data correctly.
Spacecraft in general are built to assure operations can continue even if errors occur. They usually have watchdog systems: a simple circuit outside the main computer that can command a reboot if the main computer is unresponsive for too long. They also have emergency modes: simple programs that make sure the probe can still communicate if the main programs have failed.
As pioneered on Mariner X, a disaster backup sequence was stored in the Voyager 2 CCS memory for the Uranus encounter, and later for the Neptune encounter. Required because of the loss of redundancy after the primary radio receiver developed an internal short, the backup sequence will execute minimum experiment sequences and transmit data to earth; it occupies 20% of the 4K memory.
Reliability starts in the design phase.
- they used high-quality, space-rated parts
they designed the spacecraft so that parts were always well within their tolerances (i.e. parts were not used at full power or near their temperature limits)
If a silicon-based component was designed to operate at a junction temperature of 110°C, JPL engineers would use a combination of junction temperature derating and high proto-flight temperatures so that junction temperatures never rose above 65°C. A similar temperature reduction was made for GaAs parts, which were typically designed to operate at 130°C.
they minimized thermal cycling: the spacecraft was kept at a constant temperature, and electronics were left on instead of being switched off
- the design was subjected to worst case analysis:
A circuit is analysed to determine whether the circuit will properly function if all of the environmental and parts-related parameters are "stacked" at their worst-case levels. Jones explained how this works: "If the gain of a part is at its worst case at high temperature, then you select that gain, and if the part next door performs poorest at a very low temperature, then you select that parameter."
The Voyager engineering team ignored their superiors who just wanted a design that would last for the 4 planetary encounters:
Looking at engineers' testimonials from when it was built, Dodd said the original designers were told not to worry about reaching interstellar space and focus on making sure the Voyagers could observe Jupiter and Saturn.
“Basically they kind of ignored those directions, nodded their heads and did what they wanted to make it capable of getting to interstellar space,” she said.
