A. E. Cooper W. T. Chow

Development of On-board Space Systems

Abstract: This paper describes the functions, characteristics, requirements, and design approaches of the on-board for seven spacezyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA vehicles-Saturn I, Orbiting Astronomical Observatory, Gemini, Saturn IB, Saturn V, Skylab, and Space Shuttle. The data contained in this paper represent an encapsulation of sixteen years of space-borne-computer development. In addition, the evo- lution of computer characteristics such as size, weight, power consumption, computing speed, memory capacity, technology, architec- tural features, software, and fault-tolerant capabilities, is summarized and analyzed to point out the design trends and the motivating causes. The evolution in utilization of the on-board computers;their interface with sensors, displays, and controls; and their interaction with operators are summarized and analyzed to show the increasing role played by computers in the overall space-vehicle system.

Introduction Over the past sixteen years,IBM has been engaged con- In the following sections of this paper the functional, tinuously in thedevelopment and manufacturing of physical, and design characteristics of these computers computer systems for aerospace applications. This peri-zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA aresummarized; the evolution of theircharacteristics od covers essentially theentire history of spacecraft and significant developmenttrends are described; and computer development, as exemplified by the configura- their utilization in therespective host vehicles is dis- tions and applications listed in Table 1. cussed. The on-board spacecraft computer systems vary from a single computer to a functional complexof five comput- Evolution of computer characteristics ers. On an individual computer basis, from the guidance The principal characteristics of the spacecraft computers computer for Saturn I to the in described in subsequentsections are summarized in the Space Shuttle computer complex, computing speed Table 2. From this table, the following evolution can be has increased by 160 times,memory capacity by 13 identified: times,and instruction repertoire by seven times. Con- currently, the weight of the computer has been reduced Increased integration level in circuit technology by a factor of two and the volume by a factor of four, The circuittechnology used in thesecomputers has while the power consumption has remained esssentially evolvedconsiderably from the discrete components of the same. the early 1960s. It progressed to integrated circuits (ICs)

Table 1 Summary of space-computer development.

Development period ProgramComputer type Vehicle conjiguration ~..__~__~ 1959- 1962 Saturn I Unmannedbooster Simplex 1961 - 1965 Orbiting Scientific satellite Redundant at component, logic, and Astronomical levels functional Observatory 1962- 1966 MannedGemini orbital spacecraft Simplex 1962- 1969 Saturn IB Mannedlaunchers for Apollo, Triple modular logic redundancy; Saturn V andSkylab, Apollo-Soyuzself-correcting duplex memory T est Project redundancy Project Test 1968-1972 Skylab orbitalManned spare) and computers(prime laboratoryDual 1972-presentSpaceShuttleReusable manned transporterFive identical computers in a set; to low Earthorbitsredundancy by programassignment 5

ON-BOARDCOMPUTER EVOLUTION I JANUARY 1976 Table 2 zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBASummary of principal characteristics of on-board spacecraft computers. Saturn zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAI OA 0zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA Gemini Suturn IB and V Skylub Space Shuttle Development period 1959-1962 1961-1965 1962-1966 1962-1969 1968-1972 1972-present Logic technology Discrete components Discrete components: Discrete components; Unit logic devices: Transistor-transistor Transistor-transistor logic, medium cordwood packaging cordwood packaging; multilayer logic integrated and large scale integration: multilayer inter- interconnection circuits; multilayer multilayer interconnection connection boards boards interconnection boards boards Data flow Serial Serial Serial Serial Byte parallel Parallel Arithmetic Fixed-point Fixed-point Fixed-point Fixed-point Fixed-point Fixed-point/floating-point Word length (bits) Data: 27 Data: 25 Data: 26 Data: 26 Data: 16 Data: 16 and 32, fixed-point, Instruction: 9 Command: 30 Instruction: 13 Instruction: 13 Instruction: 8 and 16 32 and 64, floating-point Instruction: 16 and 32 Number of instruc- 20 Not applicable 31 18 54 154 tions in repertoire Computing speeds 3.0 Not applicable 7.0 11.3 60 480 fixed-point, 325 floating-point (kops) Special architectural None None None Interrupt None provision Microprogramming, higher order features language, 24 general registers, 19-level interrupt structure Support software Assembler, Not applicable Assembler, linkage Assembler, linkage Assembler, linkage Assembler, linkage editor, simulator editor, simulator, editor, simulator, editor, simulator, simulator, self-test program, self-test program self-test program, self-test program, functional test, functional test functional test compiler under development Memory Type Drum Two-aperture core Two-aperture core coreFerrite core Ferrite Pluggable ferrite core modules, monolithic option Capacity(bits) 98388 (3644 words) Data: 204800 159744 (4096 words) 425984(I6384 words) 262144(16384 words) 1310720 (40960 words) (8 192 words) Command: 15 360 zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA(512 words) Access time (FS) 5 000 Not applicable 2 IO 1.2 0.375 Size (cu. ft.) 3.7 (0.105 m") 5.7 (0.161 m') 1.4 (0.040 m") 2.4 (0.068 m') 2.2 (0.062 m3) 0.87 (0.025 m") Weight (Ib.) 98 (44.5 kg) 246 (111.7 kg) 57.5(26.1 kg) 75 (34.1 kg) 97.5 (44.3 kg) 57.9 (26.3 kg) Input power 278 85 95 1 50 165 350 (watts) Redundancy Simplex Quadruple component Simplex Triple modular Prime and backup Five identical computers in a set; redundancy; triple redundant logic computers redundant operation by modular delay line modules; self- program assignment redundancy; duplex correcting duplex memory redundancy memory Unique design or Unique design Unique design Unique design Unique design AdaptationfromTC- 1 Adaptation from AP-101 adaptation Table 3 zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAEvolution of computing speed. Table zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA4 Evolution of internal memory capacity. Year available Computer Computing speed Year available Computer Capacity (kopsj *'zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA (words) zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA 1960 Saturn I 3 .0 1960 Saturn I 3 644 (27-bit) .0 1963 Gemini 1963 Gemini 4096(39-bit) 1964 Saturn IB and V 11.3 1964 Saturn IB and V 16384 (26-bit) 197 1 Skylab 60 1971 Skylab 16384 (16-bit) 1974 ShuttleSpace (CPU) 325b 1974 SpaceShuttle (CPU) 40960 (32-bit) 480"

"Kilo-operations per second. 'Fixed point bFloatingpoint.

in the late 1960s and to medium scale integration (MSI) Richer instruction repertoire. and large scale integration (LSI) in the early 1970s. Cir- Use of parallel instead of serial operations. cuit densityhas increased from 0.2 gateldevice to as Use of several computers in a system. many as 500 gates/device. This evolutionreflects the increasing yield of the higher level circuits and provides Greater flexibility and eusier use the following benefits: Use of microprogramming to accommodate functional and design changes. Smaller size and weight: a reflection of higher compo- Provision of floating-point arithmetic to ease the tasks nent density. of programming and program validation. Higher speed: shorter distances, lower capacitance. Use of a higher order language to reduce software effort Lower power: less capacitance to drive. and provide better control. Greater reliability: simpler processing (less manual and Provision of more extensive and more refined support more automated) ; fewer external connections. software, such as assemblers,linkage editors, simulators, Lower cost: more automated fabrication and assembly. compilers, and diagnostic programs. Higher density, higher speed internal memories The internal memory used in spacecraft computers has Lessening dominance of physical considerations evolved from magnetic drums to ferrite cores and semi- In the development of early spacecraft computers, the conductors. Memorydensity has increasedfrom 200 minimization of weight, size,and power consumption bits/cu. in. to 2400 bits/ cu. in. ( 12 to 146 Mbits/m3). was adominant design consideration. With the use of In thisevolutionary , access timehas been re- new technology, it is possible to obtain increased comput- duced from 5 milliseconds to 375 nanoseconds. This has ing capacity while maintaining the weight,size, and made possible a great increase in the computing capacity power parameters at essentially the same levels. From of spacecraftcomputers withoutcorresponding in- theSaturn I guidancecomputer to the Space Shuttle creases in weight, size,or power consumption. It has CPU, the number of logic gates per cubic inch of com- also contributed toa decrease in cost. puter volumeincreased from 5 to 100 (0.3 to 6 X lo6 gates per cubic meter). Greater processing capability For early processors, the ability to withstand severe The following trends toward higher processing capability operational environments was of critical concern. Al- are clearly discernible. though this ability is still essential today, the accumulated Higher processing speed The throughput of the space test data and analytical knowledge have helped to make computers increasedfrom 3000 operations per second the environmental design effort less of a preoccupation. (3 kops) for the SaturnI computer to 325 kops (floating- point operation) and to 480 kops (fixed-point operation) Continued importance of fault tolerance for the Space Shuttle computer. Thisis shown in Table 3. Fault tolerance is an importantzyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA feature of space comput- Greatermemory capacity The internalmemory in- ers because of the need to increase computerreliability, creased from 98388 bits for the Saturn I computer to increaseoperating life, assure proper operation during 13 10720 bits for the Space Shuttle CPU. This is shown critical time periods, and avoid maintenance during peri- in Table 4. ods of deployment. 7

JANUARY 1976 ON-BOARD COMPUTER EVOLUTION The need for fault tolerance continues to exist even Use ofmicroprogramming. through the reliability of simplex computershas im- Development of a ‘yamily” of aerospace computers us- proved. In specific applications, suchas in theSpace ing a common basic design. Shuttlewhere the vehicles are manned andtheir safe Sharing of support software by computers in a family. operation is dependent on the computer, fault tolerance Compatibility betweenaerospace computers and com- is even more crucial. mercial computers with respect to components and soft- Several fault-tolerance approaches have been utilized, ware. including quadruple component redundancy for the Or- biting Astronomical Observatory (OAO) , triple-modu- Evolution in the utilization of on-board computers lar-redundant logic modulesfor Saturn zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAIS and V and In conjunction with the evolution of characteristics, the prime and backup computers for Skylab. For the Space use of on-board-computers has also changed. This pro- Shuttle, five identical computers, which can be assigned gress is summarized in Table 5, and several facets are toredundant operation by program control,are used. discussed below.

Adaptation of existing models Increasing dependence of manned space vehicles on The earlier spacecraftcomputers (for Saturn I, OAO, the on-board computer Gemini, Saturn IB and V) were each uniquely designed Thespacecraft computers described in this paperare for a specific application.zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA The later computers (for Sky- used in all of this country’s manned space programs- lab,Space Shuttle) are each adapted from an existing past, present, and under development - with the excep- model. This trend is indicative of several factors in the tion of , the United States’ first manned development of aerospace computers: space venture, where noon-board computer was used. A significant trend is the increasing dependence of manned Maturationof aerospace computerdesign, so that a space vehicles on the on-board computer for their mis- computer model can be developed to anticipate the fu- sion successand safe operation.This results from ture needs before the exact requirements of specific pro- growth in the complexity of mission operation and con- grams are delineated. General availability of advanced components with high tent, the expanded useof on-board computers for critical performancecapability, so that specializeddesign and flight control operations,and greater emphasis on development to extractzyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA greater speed and reliability are autonomy. no longer an overriding necessity. The earlier computersfor Saturn I and OAO were Growth of component density,so that specialized design usedin unmanned applications. For Saturn I, the sur- to minimize weight, size, and power consumption is no vival of the booster and the effectiveness of its mission longer an overriding need. wereboth dependent on the on-board computer. For OAO, the successof the mission is dependent on theon- Theadaptation of an alreadydeveloped computer board computer although the survival of the satellite is offers a number of important advantages: not.

Greater confidence in the capability and producibility of Use fordigital flight control the computer. The basic hardware and software design Theon-board computers for Saturn I, Gemini, Saturn would already be verified, the performance and availabil- IB and V, and the Space Shuttle all perform guidance ity of the components already confirmed, the manufac- and navigation computations. In the earlier vehicles, the turing processses already established. stabilizationand control function, which orients and Shorter development cycle. Earlier availability of mature maintains the vehicle at a specified attitude and attitude computers, withhigher reliability and ready for flight rate, was performed by an analog autopilot or an analog operation. flight control computer. In the Space Shuttle, however, Lower cost for hardware, software, and development. this function is performed by the on-board digital com- Logistic advantages over the program cycle. puter through digital mechanization of the autopilot. Since the dominant natural frequencies of the stabili- The adaptation approachin turn strengthens a number zation and control system are considerably higher than of trends already appearing among aerospace computers those of aguidance and navigation system, a higher [ 11: computation speed is required of the on-board computer. Standardization of word lengths: Sixteen-, 24-, and 32- Typically,two computing cyclesper second are suffi- bit lengths are increasingly being adopted for fixed-point cient for the ascent navigation of a space vehicle while operation; and 32-, 48-,and 64-bit lengths for floating- 25 computing cyclesper second may be required for 8 operation.point zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAflight control. There is also a requirement for a larger

A. E. COOPER AND W. T. CHOW IBM J. RES. DEVELOP. memory capacity.In the Space Shuttle, approximately the orbiter, four subsystems on the solid rocket boost- 8000 main memory words (32 bits per word) and 17 000 ers, and numerous points on the ground support equip- mass memory words (16 bits per word) are used for this ment. Twenty-four time-shared serial digital data buses purpose. zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAare used toaccommodate the data traffic among the The provision of digital flight control by the on-board computers themselves, and between the computers and computer makes possible the use of digital filtering tech- the interfaced subsystems. Ina very real sense, theavion- niques to enhance the vehicle’s stability. The digital con- ic systems in a modern spacecraft are integrated by the trol is simpler, lighter, more adaptable, and more flexible on-board computers. in satisfying the requirements of different flight regimes. It is also more reliable when a redundant arrangement is Move complex man-computer interfaces used. Digital flight control is used in the Apollo com- In the early space vehicles, only indirect man-computer mand and lunarmodules and in newer launchvehi- interfaces through the ground support equipment exist- cles, and its usage is expected to become common. ed. In Gemini, electromechanical decimal wheels were used forreadout and adecimal push-button keyboard Increasing use for system monitoring was used for data insertion. For Skylab attitude control, Inthe early space programs, relatively little use was an octal push-button keyboard was used for data inser- made of the on-board computer to monitor the perfor- tion, Nixie tubes were used for readout, and indicator mance of other subsystems. The on-board computer for lights were used for status display. For the Space Shut- Saturn I monitors and calibrates the gyros and acceler- tle, the man-computerinterfaces are extensive and in- ometers, tests the interfaces and performs flight simula- clude the use of multifunction CRT displays, dedicated tion and countdown duringground operation before displays, status indicators,keyboards, push-buttons, launch. For Saturn IB and V, which have a substantially manual flight controls, and manipulator controls for in- longer mission duration, the on-board computer is used terfacing with the pilots, mission specialists, and payload for self-testing, interface verification, and system valida- specialists. This intensification of the man-computer in- tion before launch. When the vehicle reaches its orbit, terface is a result of the use of on-board computers for the computer is used to check the propulsion system, the the functions of flight control, system management, and mid-course guidance and control system, and other re- payload management. It is also a result of the multiplici- lated systems. The testresults are sent to the ground for ty of flight modes (ascent, orbital, payload deployment analysis. For the Space Shuttle, more extensive testing and retrieval, and reentry) and the multiplicity of pay- andmonitoring tasksare performed by the on-board loads (spacelab, autonomous satellites, and high energy computers, including self-testing,fault detection and stages). fault isolation of vehicle subsystems, checkout of pay- A consequence of this large increase in man-computer load interfaces, and monitoring of payloads and payload interfaces is the need for human engineering efforts, to deployment, as well as prelaunchand preflight check- achievethe simplest instrumentarrangement and the outs. The results arepresented to the flight crew on mul- most effective man-machine interaction. The conversion tifunction and dedicated displays. This is consistent with of computer data intoinformation formats readily intelli- the intended purpose of the SpaceShuttle as a cost- gible to the flight crew calls for increased memory ca- effective airline-type spacetransportation system with pacity and more elaborate input/output and program re- minimal dependence on ground support. In addition to quirements. In the Space Shuttle, approximately 12000 autonomous operation, theuse of the on-board computer main memorywords (32 bits per word) and 38000 forsystem monitoring also relieves the flight crew of mass memory words ( 16 bits per word) are used for this exacting but routine details so that they can concentrate purpose. on the mission-oriented tasks. The principal effect of system monitoring on computer Use of separate input/output units design is the increased memory capacityrequirement. In a modern space application the circuitry needed for For the Space Shuttle,approximately 6000 main memo- input/output operations such as signal conversion, signal ry words (32 bits per word) and 54000 mass memory level shifting, and data buffering and multiplexing, tends words ( 16zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA bits per word) areused for this purpose. to be comparable or larger in size than the CPU. In each zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAof the later programs (Saturn IB and V, Skylab, Space Increase in the number of computer interfaces Shuttle), a separate input/ output processoris used. The As the functions performed and subsystems monitored input/output instrumentation must be tailored for a giv- by the on-board computer increase, the number of sys- en application whereas the CPU can be adapted. This teminterfaces necessarily increases also. In the Space separation facilitates the design and development effort Shuttle, each computerinterfaces with 38 subsystems on and also simplifies the maintenance. 9

JANUARY 1976 ON-BOARD COMPUTER EVOLUTION e, 0 zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA z

aJ 2 10

A. E. COOPER AND W. zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAT. CHOW IBM J. RES. DEVELOP, Guidance computer for the Saturn I rocket booster

Development period: 1959 - 1962 Saturn I was one of the earliestzyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA spacezyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA boostersdeveloped by the UnitedzyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA States. Designed by Wehrner von Braun's team at the Marshall Space Flight Center (Huntsville, Alabama) in late 1959, it was the primary flight-proofiing vehicle for the developmentof the SaturnIB and Saturn V boosters usedthroughout the Apollo space program. Digital computers were just beginning to be applied to guidanceand control systems. The guidance computer was developed by IBM as part of the on-board inertial guidance system. It was ageneral purpose serialcom- puter using discretesemiconductor components and magnetic drum memory.

Computer functions The functions performed by the Saturn I guidance com- puter included the following: Guidance and navigation computation. Steering computation. Issuance of cutoff signals to terminate theengines. Issuance of discrete control signals. Ground checkoutof command signals. Ground support operations: Continuous tests in ready mode for self-checking and monitoring of the gyrosand accelerometers. Periodic maintenance tests for flight simulation, dry- run countdown, and exerciseof interfaces. Manuallyinitiated testsfor accelerometer calibra- tion and gyro drift determination.

New design requirements The developmentof the Saturn I guidance computer was undertaken at atime when both computer technology andspace operation were new. A number of require- ments and environments special tospace applications were encountered for thefirst time. There waslittle prec- edent or previous experience to serve as a guide; much effort was required not only to develop a computer that could adequately perform the necessary functions within the weight, size, and power constraints, but also to un- derstandthe new operational environment.Through these efforts, a reliable computer was developed to serve the needs of Saturn I. These efforts also resulted in a data base and a procedure which were used for the de- velopment of space computers in later programs. Some of the requirements encountered were the following.

1. Thevery stringentweight, size, andpower restric- tions for the on-board equipment. These restrictions are still severe today, but wereespecially harsh in the days of Saturn I before the availability of integrated circuitsand high densitystorage media. These re- strictions prompted many designs trade-offs and the 11

JANUARY 1976 ON-BOARD C:OMPUTER EVOLUTION establishment of systematicand methodical weight Two successful launches have been made to date: Ob- controland power budget procedures.The latter servatoryOAO-2, which waslaunched on December served as a valuable discipline and are used today in 7, 1968, andturned off on February 13, 1973; and every aerospace program. Observatory Copernicus,which was launched on August 2. Thesevere environmental requirements, due to 21, 1972, and is still in continuous operation. With its32- ground operationsas well asto launch and space inch (0.8 m) telescope, Copernicus has detecteda defini- flight conditions. The environmental factors to be sat- tive abundance of deuterium in the interstellargas, isfied included vibration, shock, acoustic noise, elec- which strongly supportsthe supposition thatthe uni- tromagnetic interference,heat, humidity,a salt fog verse is ever expanding. Data from its cluster of four atmosphere, vacuum, space radiation, and, later, nu- x-ray monitoring telescopes haveconfirmed the existence clear radiation. The specific levels of some of these of black holes. factors were not clearly known at the outset of the The Primary Processorand Data Storage (PPDS) design cycle, their effects on electronic components equipment for OAO [ 21 was developed by IBM to sup- and circuits had yet to be investigated and defined port the proper functioning of the observatory. Discrete and, in a number of cases, suitable testequipment components mounted in molded plastic modulesand two- and procedures had to be developed. aperture, non-destructive-readout (NDRO) ferrite cores 3. The need for high reliability in the operating environ- were used. Extensive redundancy was used to meet the ment. This was required at a time before high reliabil- long orbital life requirement. ity components and processes became common. To meet these requirements, techniques and procedures functions were developed atthe component selection,circuit The OAO Primary Processor and Data Storage equip- design, system design, and manufacturinglevels. ment performs the following functions: These techniques contributed much to the success of the Saturn I computer and were instrumental in the Verifying the accuracy of commands received from the development ofhigh reliability components.These ground tracking stations. methods became the forerunners of today’s standard Storing commands in the memory forsubsequent use procedures in the computer industry. when the satellite is not in contact with the ground sta- 4. The need to design foreasy field operation and tions. maintenance. The concepts of designing for a given Executing commands either in real time while in contact personnelsystem andfor a target“time to repair” with a ground station or in delayed mode after the trans- were introduced. mission ceases. 5. The formulation of a digital computer for a real-time Storage of astronomical experimentdata and satellite sampled data control system, at a time when the sta- status information. bility of such a design was still a matter of consider- Preparing stored data for transmission to ground. able concern.This was further complicated atthe Providing the system clock which supplies the basic tim- time by low computing speed, limited both by the ing signals for the entire observatory. available components and by the desire to minimize hardware for reasons of weight, power, and reliabili- New design requirements ty. The analytical studies and simulation techniques In addition to the launch conditions of shock, vibration developed at that time became a foundation on which and acceleration,about which much knowledge had further advances were subsequently made to satisfy been obtained through the Saturn I program, four new the needs of later aerospace programs in which digital requirementswere encountered in thedevelopment of computers areused in faster feedback loops. thePPDS equipment for the Orbiting Astronomical Observatory. These were thefollowing. Primary processor and data storage equipment for 1. The high vacuum environment of outer space [ 31, on the Orbiting Astronomical Observatory theorder of lo-’ mmof mercury(1.33 X Pa)for the intended OAO orbit. Development period: I961 - I965 The Orbiting AstronomicalzyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAObservatory zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA(OAO) is a Two principal design approaches were applied in this largeunmanned satellite designed and built by Grum- consideration: material selection and heat transfer. Un- man AircraftEngineering Corporationunder NASA’s der extreme vacuum, manymaterials have a tendency to Physics and Astronomy Program and is used for astro- decompose or outgas. A small amount of vapor fromthis nomical studies from a vantage point free from the distor- process would contaminate the optics in the OAO ex- 12 tion andselective absorption of the Earth’s atmosphere. perimental packages and degrade their performance. An

A. E. COOPER AND w. T. wow IBM J. RES, DEVELOP. extensive materialstesting program was conducted so Two-aperture, coincident current, non-destructive- that only materials with a minimal tendency to outgas readout ferrite core memory is used in PPDS equipment wereused in the fabrication of the equipment. Most for the storage of both commands and data. Besides the components were hermetically sealed to minimize out- power conservation consideration, the use of the non- gassing, and added protection was obtained by an epoxy destructive-readout memory provides protection to the coating applied over the components. commands and data in the event of power interruption. Heat transfer was a matter of concern because of the This is important for the OAO because of its long mis- absence of convection cooling in a high vacuum environ- siontime and its relatively infrequent contact with ment. Care was taken in the thermal design for all heat ground tracking stations. Since the development of the generated by the electronics to be removed by conduc- OAO, NDRO memory, in several developed forms, has tion and radiation. The epoxy coating applied over the become a desired feature for most space computers and components also served as a heat transfer medium from for some avionic computers. the component to the module case. Black-oxide copper heat sinks were used where high heat dissipation takes 4. The goal of one yearof reliable operation in orbit. place to improve the heat conduction pattern from the The mission goal of one yearin orbit placed exceeding- module base to the panel edge. Panel edges of the subas- ly high reliability requirements on the PPDS equipment. semblies are attached to the frontof the processor case to The reliability prediction of a simplex design using state- conduct internal heat to the case surface, from which it of-the-art components was a disappointinglylow 0.01 can be radiated to the spacecraftskin. The two processor for the one-year mission, even with the use of generous cases aremade of aluminum and coatedwith a high-emis- derating andworst-case design approaches.An ultra- sivity epoxy paint. Thermal analysis and thermal testing high-reliabilty parts program would have been prohibi- were undertaken to supportand verify the thermal design. tively expensive while still yielding submarginal results. Consequently, redundancy at the circuit,logic, and func- 2. The need toconserve power, since the electrical tional levels was systematically applied. The design ef- power of the OAO while in orbit is generated by so- fortwas extensively supported by failuremode tests, lar cells and stored in batteries. zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAcircuit analysis, and reliability analysis [ 41. This system- atic application of redundancy to satisfy the reliability Four principal approaches were used to minimize the zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA goal became a forerunner in the development of fault- power consumptionof the PPDSequipment: tolerant computers. Use of a low but adequate clock frequency, 50 kHz, SO Quadruple component redundancy is used at the cir- that lowzyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA power, low speed logic circuits could be utilized cuit level to obtain a high basic circuit reliability. Redun- throughout the equipment. dant components are used in parallel or series-parallel Extensive useof time sharing so that fewer circuits were arrangements in place of single components. needed. Logic level redundancy is used where non-digital Use of non-destructive-readout memory. Power is con- componentsdo not lend themselvesto component re- served because it is not necessary to rewrite into this dundancy. Triple modular redundancy with a majority memory after the repeated readout of data for transmis- voter is used for magnetorestrictive delay lines and their sion to ground. Further savings are realized because it is linear amplifiers. not necessary to usea dedicated register tohold the read- Functional level redundancy is used where neither out information until it is restored to the memory. circuit level nor logic level redundancy is practical, be- Utilization of power switching to turn off logic functions cause of timing or other design considerations. Two re- and storage zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAlocations when they are not in active use. dundant memory arrays are used for data storage and For manycircuits, power is turned on only when the four redundant arrays areused for command storage. observatory is in real-time contact with a ground station or when a command is ready to be executed. This early Guidance computer for the Gemini manned space application of power switching was to become further vehicle refined and widely used in space computers. Development period: 1962 - 1966 3. The need to store the commands in the memory for Gemini was a two-man space vehicle designed to further subsequent use whenthe satellite is not in contact developthe manned spaceflight capabilitysuccessfully with the ground stations, and the need to store the demonstrated in Project Mercury, and to lay the ground- experimental data and spacecraft status information work for Project Apollo. It was provided with the fa- until the satellite is within transmissionrange of a cilities toexplore the techniques and procedures for ground station. long-durationorbital missions, manned rendezvousand 13

JANUARY 1976 ON-BOARD COMPUTER EVOLUTION docking, extravehicular activities, andjcontrolled reentry Primary Processor and Data Storage equipment.Refine- [ 51. Twelve orbital flights, including ten manned flights, zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBAments were made in the analysis and testing pertaining weremade between 1964 and 1966.Among Gemini’s to circuit design margins, thermal design, and combined several significant differences fromMercury is the in- environmental stresses.These efforts were stimulated troduction of an on-board inertial guidance system [ 6, 71 both by the safety emphasis for manned space flight and to aid the astronauts in spacecraft maneuvers throughoutzyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA by the need to assure maximum dependability in a short the mission. TheGemini guidance computer[8] is a research and development program. general purpose using discrete electronic An area requiringinnovation was the analysisand components and two-aperture, non-destructive-readout, simulation of the computer operational program in com- random-accessferrite core memory.1BM was respon- bination with the spacecraft dynamics and pilot function- sible for the development of this computer and the in- ing [ 91. The spacecraft computer program, consisting of tegration of the guidance systek for theprime contractor, guidance equations and logical operations, was validated McDonnell Aircraft Corporation. by extensive simulation. Mathematical models of space- craft dynamics and environment were combined with the Computer functions flight program to predict behavioral performance. The Gemini guidance computer performs the following The computer operationwas verifed during laboratory functions: testing of the completed computer.The equations of each mode were exercised in a prescribed manner with Ascent During this phase, the computerprovides backup normal interfaces connected, and the outputs were com- guidance commands to the primary guidance system of pared with theresults of simulation. Thespacecraft the launch vehicle. The switchover to backup guidance computerwas then interconnected with a fixed-base is manually controlled by theastronaut, and thecom- crewstation anda general purpose ground computer. puter commands are “faded” in through a redundant set The reentry procedures and functionswere performed of controls in thelauncher autopilot to avoid violent by the man-machine combination with the ground com- corrections of the launch vehicle attitude. puter providinga simulation of the dynamics of the Rendezvous Duringthis phase, the computer provides spacecraft as it reacts with the atmosphere. Finally, as the primary reference and guidance information to the the spacecraft systems were checked out on the launch astronauts for performance of the necessary maneuvers. pad,the computer equations were again checkedas a The orbit parameters of both vehicles are determined by last verification. ground tracking and are used by the ground computers The analysis and simulationtechniques developed to determine the maneuversrequired by the approaching under this program were further refined and broadened spacecraft.This information is transmitted tothe on- and generally applied to subsequent computer develop- board guidance computer under astronaut control. The ments for both manned spacecraft and aircraft purposes. on-board computerprocesses this information along with the sensed spacecraft attitude and displays continu- ously the changing thrust and orientation commands to Guidance computer for Saturn I6 and Saturn V the astronauts in terms of the spacecraft coordinates. Orbital flight On extended missions the ground tracking Development period: 1962 - 1969 network rotates out of the orbital plane and ground data Saturn IBand Saturn V weredeveloped by NASA at become unavailable to the astronauts. The inertial guid- the Marshall Space Flight Center as the standardlaunch ance system and the on-board computer provide a navi- vehicles for the more recent U.S. manned space efforts. gation capability for the astronautsto determine thetime IBM developed and manufactured the instrument of retrofire and to select thelanding site for safe reentry, unit (IU) thatcontains the navigation,guidance, con- in case of emergency. trol, and data processing facilities for both vehicles. The Reentry Duringthis phasethe computer can be used guidance computer [lo], which is part of the IU, is a either to provide the guidance information to the astro- general purpose serial computer using Unit Logic De- nauts for a man-in-the-loop reentry or to feed the com- vice (ULD) microminiature circuit packages and a ran- mands directly to the reentrycontrol system for an auto- dom-accessferrite core memory. To satisfy the safety matic or hands-off reentry. requirements for manned space flight, the computer was designed to continue in accurate operation even afterthe New design requirements occurrence of a transient or a catastrophic failure. Com- The design of the Gemini computer evolved from the puters developed under this program were used in all the technology andapproaches previouslyapplied to, and Apollo and Skylab missions, including the Apollo-Soyuz 14 proven in, theSaturn I guidance computer and the OAO TestProject flight in July1975.

A. E. COOPER AND W. T. CHOW IBM J. RES. DEVELOP.