From: rabel@netcom.com (Robert Abeles)
Subject: Re: Space Shuttle Computers
Date: Mon, 06 Apr 92 17:37:59 GMT
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 

The following is from "Press Information, Space Shuttle Transporta-
tion System, July 1980," Rockwell International Space Systems 
Group.

The guidance, navigation, and control (GN&C) system is composed of 
the four orbiter computers and other major components which make up 
the primary flight control system. The computers use a program 
called the digital autopilot to control the vehicle through launch, 
ascent, on-orbit, deorbit, entry, and landing. The guidance, navi-
gation, and control system provides automatic or manual (control 
stick steering) control of the vehicle in all flight phases. During 
launch most of the computer commands are directed to gimbal the 
main engines and solid rocket boosters. To circularize the orbit, 
in orbit, and for deorbit, the computer directs the orbital maneu-
vering system. At external tank separation, in orbit, and during a 
portion of entry, vehicle attitude control commands are directed to 
the reaction control system. In atmospheric flight the computers 
direct the orbiter aerodynamic flight control surfaces.

During critical mission phases (launch and entry), four of the com-
puters are assigned to perform GN&C tasks, operating as a coopera-
tive redundant set. One computer acts as a commander of a given data 
bus in the flight control scheme and initiates all bus transac-
tions. The noncommander computers on the same bus listen to all 
incoming data that the commander requests. Thus, each response to a 
request by any computer is heard by all performing the same redun-
dant operations and verified for consistently identical output. The 
computer redundancy management software module centers around the 
concept that each computer compares its outputs with the other com-
puters in the set. If the comparison disagrees, this disagreement 
is displayed to the flight crew as a CRT message; however, process-
ing continues.

Each of the computers operating in a redundant set operates in syn-
chronized steps and cross-checks results of processing about 440 
times per second. If a computer operating in a redundant set fails 
to meet the synchronization requirements for redundant set opera-
tions, it would be removed from the set. Each computer performs 
about 325,000 operations per second during critical phases of the 
mission.

As an example, Computers 1 through 4 are operating in a redundant 
set when Computer 1 fails to stay synchronized with the other 
three. Computer 1 software recognizes the disagreement and also 
recognizes that it has been voted failed by the other three comput-
ers. Computer 1, therefore, sets a self-fail vote and does not vote 
the other three computers failed.

All intercomputer communications other than synchronization are 
transmitted and received over four specific buses. Cross-strapping 
of the four buses to the four computers allows each computer access 
to the status of the data received or transmitted by the other com-
puters, making possible the verification of identical results among 
the four computers. The four computers are loaded with the same 
software programs. Each bus is assigned to tone of the four comput-
ers in the command mode and the remaining computers operating the 
listen mode for that bus. Each computer has the ability to receive 
data with the other three computers, pass data to the others, 
request data from the others, and perform any other tasks required 
to operate the redundant set. No vehicle systems are connected to 
these buses.

The flight-critical buses are directed into groups of four to be 
compatible with the grouping of the four computers. Commands to 
flight deck crew flight control system (dedicated) displays and the 
forward GN&C system as well as the data from the forward GN&C sen-
sors are transmitted and received over on group of buses (flight-
critical FC-1 through FC-4). The data commands to the aft GN&C sys-
tem, as well as the data from the aft GN&C components, are transmit-
ted and received over FC-5 through FC-8 buses. Each bus in a group 
is assigned to a separate computer operating in a command mode. 

The computer in the command mode issues data request and commands 
to the applicable vehicle systems over its assigned FC (dedicated) 
bus. The remaining three buses in each group are assigned to the 
remaining computers to operate in the listen mode. A computer oper-
ating in the listen mode can only receive data. Thus, if Computer 1 
operates in the command mode on bus FC-1, it listens on the three 
remaining buses. In this manner, each computer commands on one bus 
of a flight-critical group and listens on the remaining three.

Each flight-critical bus in a group of four is commanded by a dif-
ferent computer. There are multiple units of each GN&C hardware 
item (sensors, controllers, flight control effector) and each unit 
is wired to a different MDM (mux/demux) and flight-critical bus. 
The MDM and bus can be assigned to another computer. The flight com-
puter operating system in systems software in each of the redundant 
set computers activates a GN&C executive program and issues com-
mands to the bus and MDM to provide a set of input data. Each MDM 
receives the command from the computer assigned to it, acquires the 
requested data from the GN&C hardware wired to it, and sends the 
data to all four computers.

When the sets of GN&C hardware data arrive at the computers via the 
MDMs and data buses, the data is generally not in the proper format, 
units, or form for use by flight control, guidance, or navigation. 
A subsystem operating program for each type of hardware processes 
the data to make it usable by GN&C software. These programs contain 
the software necessary for hardware operation, activation, self-
testing, and moding. The level of redundancy varies from two to 
four depending on the particular unit. The software which processes 
data from the redundant GN&C hardware is call redundancy manage-
ment. This perform two function: selects, from redundant sets of 
hardware data, one set of data for use by flight control, guidance, 
and navigation; and detects data which is out of tolerance, identi-
fies the faulty unit, and announce the failure to the flight crew 
and to the data collection software.

In the case of four hardware units, the redundancy management soft-
ware utilizes three and holds the fourth in reserve and utilizes a 
middle value select until one of the three is bad, then uses the 
fourth. If one of the remaining three is lost, it would downmode to 
two and use the average of the two. If on of the remaining two were 
lost it would downmode to one and pass the only data it receives.

The three engine interface units between the computers and the 
three main engine controllers accept computer main engine commands, 
reformat them, and transfer them to each main engine controller. In 
return, the engine interface units accept data from the main engine 
controller, reformat it, and transfer it to computers and opera-
tional instrumentation. Main engine functions such as ignition, 
gimbaling, throttling, and shutdown are controlled by the main 
engine controller internally through inputs from the guidance equa-
tions which are computed in the orbiter computers.

During non-critical flight periods in orbit, only on or two comput-
ers are used for GN&C tasks and another for payload operations and 
system management. The remaining three can be used either for pay-
load management or deactivated on standby.

The fifth onboard computer is used as a GN&C backup in the initial 
development flights; however, it also provides unique functions 
such as system non-critical function monitoring and payload command 
and monitoring. The fifth computer has separate independent soft-
ware design and coding activity to protect against generic software 
failures in the primary computer set.

--------------------------------------------------------------------

This description of the orbiters CPU is from IBM Federal Systems 
Division, Shuttle Press Information, Computer Systems for Space 
Shuttle, IBM Corporation.

The central processing unit is a modified model of an IBM AP-101 
computer, an extension of the System/4 Pi line which IBM developed 
for aerospace applications. It is a general-purpose, micropro-
grammed computer which can perform fixed-point and floating-point 
operation. The computer uses dual word lengths (16- and 32-bit 
words for instructions and fixed-point operation, 32- and 64-bit 
words for floating point operation). Three sets of general regis-
ters are provided. Each set has eight 32-bit hardware registers. 
Two sets are used for fixed-point, base and index operations; the 
third set is used for floating-point operations. The computer has 
96-percent fault detections capability achieved by built-in test 
equipment and self-testing programs.

AP-101 specification:

-weight: 55 pounds (25kg)
-size: 7.62 x 10.12 x 19.56 (19.4 x 25.7 x 49.7 cm)
-volume: .87 cubic feet (24,636 cubic cm)
-power: 290 watts
-memory cycle time: 800 nanoseconds
-I/O data rate, max.: 787,000 32-bit words a second
-I/O data path: 32 bits
-instruction words: 16 and 32 bits
-instruction set: 151 instructions


Data Storage

The main memory, containing 106,496 words, each 32 bits in length, 
is functionally one memory although part of it is physically 
located with each processor unit--81,920 words in the central pro-
cessor and 24,576 words in the I/O processor.

Random-access, nonvolatile, nondestructive-readout ferrite cores 
were selected as the main memory for maximum reliability. Use of 
modular core memory (8,192, 32-bit word modules) and double density 
modular core memory (16,384, 32-bit word modules) take advantage of 
the extensive data available in core and array manufacturing and 
the extensive data accumulated from actual use. A unique power sav-
ing design is used, where only the memory module being accessed 
received full power while the other memory modules are in either a 
medium power, standby or low power, quiescent condition.

Each of two, 134 megabit, mass memory tapes acts as a data and pro-
gram storage extension of core memory, providing off-line store for 
the nine separate application program packages used during various 
phases of Shuttle operations. Programs can be transferred from 
either tape to each of up to four of the computers simultaneously 
when the flight regime changes. When a particular operations pro-
gram is selected, it is overlaid on the program already in core. 
Operating system programs, data tables and down-link routines are 
protected from the overlay. Each of the nine program packages is 
configured to constraints of the core available.
-- 
--------------------------------------
- Bob Abeles, rabel@netcom.com       -
--------------------------------------