Development of on-Board Space Computer Systems

8/3/2019 Development of on-Board Space Computer Systems

1/15

A. E. CooperW. T. Chow

Development of On-board Space Computer SystemsAbstract: This paper describes he functions, characteristics, requirements, and design approaches of the on-board computers forseven space vehicles-Saturn I , Orbiting Astronomical Observatory, Gemini, Saturn IB, Saturn V , Skylab, and Space Shuttle. Thedata contained in this paper represent an encapsulation of sixteen years of space-borne-computer development. In addition, the evo-lution of computer characterist ics such as size, weight, power consumption, computing speed , memory capacity , technology, architec-tural features , software, and fault-tolerant capabilities, is summarized and analyzed to point out the design trends and the motivatingcauses. The evolution in utilization of the on-board computers; heir interface with sensors, displays, and controls; and heir interactionwith operators are summarized and analyzed to show the increasing role played by computers in the overall space-vehicle system.

IntroductionOver the pas t s ixteen years ,B M has been engaged con-tinuously in the evelopm ent nd manufacturing ofcomputer systems for aerospace applications. This peri-od covers essentially theentire history of spacecraftcom puter deve lopm ent, as exemplified by the configura-tions and applications listed in Table 1 .

Th e on-board spacecraft computer sys tems vary froma single compu ter to a functional complexof five comput-ers. On an individual com puter basis, from the guidancecomputer for Saturn I to the Central Processing Unit inthe Space Shut t le comp uter comp lex, computing speedhas increased by 160 times,memory apacityby 13times,and nstruction repertoire by seven times. Con-currently, the weight of the com pute r has been reducedby a factor of two and the volume by a facto r of four,while the power consum ption has remained esssentiallythe same.

In the following sections of this paper the functional,physical, and design characteristics of these com putersaresum ma rized; he evolution of theircharacteristicsand significant develo pm ent rend saredescribed; andtheir utilization in the espectivehos t vehicles is dis-cussed.Evolution of computer characteristicsTh e principal chara cteristics of the spacecraft computersdescribed in subsequ ent ections re summarized inTable 2. Fro m this table, the following evolution can beidentified:

Increased integration level in circuit technologyThe circuitechnology sed in these omp utershasevolvedconsiderably from the discrete components ofthe early 1960s. It progressed to integrated circuits ( ICs)

Table 1 Summary of space-computer development .Development period Program Vehicleypeomputer conjiguration

~ . . _ _ ~ _ _ ~1959- 1962 Saturn I Unmannedooster Simplex1961- 1965 Orbiting Scientific satellite Redundant a t component, logic, andAstronomical functionalevels

Observatory1962- 1966 Geminianned orbital spacecraft Simplex1962- 1969 Saturn IB Mannedaunchersor Apollo, Triple modular logic redundancy;Saturn V Skylab,nd Apollo-Soyuzelf-correcting duplex memoryTestrojectedundancy1968-1972 Skylab Mannedrbital laboratoryualomputersprimendpare)1972-presentpacehuttleeusable manned transporterive identical computers in a set;to low Earthrbitsedundancy by programssignment 5

J A N U A R Y 1976 O N - B O A R D C O M P U T E R EVOLUTION


2/15

Table 2 Summary of principal characteristics of on-board spacecraft computers.Saturn I OA0

Development periodLogic technology

Data flowArithmeticWord length (bits)

Number of instruc-tions in repertoire(kops)features

Computing speedsSpecial architectural

Support software

MemoryTypeCapacity bits)

Access time ( F S )Size (cu. ft.)Weight (Ib.)Input power(watts)Redundancy

Unique design oradaptation

1959-1962Discrete components

SerialFixed-pointData: 27Instruction: 9203.0None

Assembler,simulator

Drum98388 (3644 words)

5 00 03.7 (0.105 m")98 (44.5 kg)278Simplex

Unique design

1961-1965Discrete components:cordwood packaging

SerialFixed-pointData: 25Command: 30Not applicableNot applicableNone

Not applicable

Two-aperture coreData: 204800Command: 15360Not applicable5.7 (0.161 m')246 (111.7 kg)85

( 8 192 words)(512 words)

Quadruple componentredundancy; triplemodular delay lineredundancy; duplexmemory redundancyUnique design

Gemin i1962-1966Discrete components;cordwood packaging;multilayer inter-connection boards

SerialFixed-pointData: 26Instruction: 13317.0None

Assembler, linkageeditor, simulator,self-test program

Two-aperture core159744 (4096 words)

21.4 (0.040 m")57.5 26.1 kg)95Simplex

Unique design

S u t u rn I B a n d V Skylub Space Shut t le1962-1969Unit logic devices:multilayer

boardsinterconnection

SerialFixed-pointData: 26Instruction: 13

1968-1972Transistor-transistorlogic integratedcircuits; multilayerinterconnectionboardsByte parallelFixed-pointData: 16Instruction: 8 and 16

18 5411.3 60Nonenterrupt provision

Assembler, linkage Assembler, linkageeditor, simulator, editor, simulator,self-test program, self-test program,functional test functional testFerriteoreerriteore425984 I6384 words) 262144 16384 words)

I O 1.22.4 (0.068 m') 2.2 (0.062 m3)75 34.1 kg) 97.5 (44.3 kg)150 165Triple modular Prime and backupredundant logicmodules; self- computerscorrecting duplexmemoryUnique design AdaptationromC- 1

1972-presentTransistor-transistor logic, mediumand large scale integration:

boardsmultilayer interconnection

ParallelFixed-point/floating-pointData: 16 and 32, fixed-point,Instruction: 16 and 32154

32 and 64, floating-point

480 fixed-point, 325 floating-pointMicroprogramming, higher orderlanguage, 24 general registers,19-level interrupt structureAssembler, linkage editor,simulator, self-test program,functional test,compiler under developmentPluggable ferrite core modules,1310720 (40960 words)monolithic option

0.3750.87 (0.025 m")57.9 26.3 kg)3 5 0Five identical computers in a set;redundant operation byprogram assignment

Adaptation from AP-101


3/15

Table 3 Evolution of computing speed. Table 4 Evolution of internal memory capacity.Year available Compu ter Compu ting speed

(kops *' Year available Comp uter Capacity( wo rd s )1960 Saturn I 3 01963 Gemini.0 19641971 Saturn IB and V 11.3Skylab 601974 Spacehuttle (CPU) 325b

480"

1960 Saturn I 3 644 (27-bit)1963 Gemini 4096(39-bit)1964 Saturn IB and V 16384 (26-bit)1971 Skylab 16384 (16-bit)1974 Spacehuttle (CPU) 40960 (32-bit)

bFloatingpoint."Kilo-operationsper second. 'Fixed point

in the late 1960s and to medium sca le integration (MSI)and large scale integration (L SI) in the early 1970s. Cir-cuit densityhas ncreased from 0.2 ga te ldevice o asmany as 500 gate s/dev ice. This evolution eflects theincreasing yield of the higher level circuits and providesthe following benefits:Smaller s ize and weight: a reflection of higher compo-nent densi ty.Higher speed: shorter distances, lower capacitance.L ower power : less capacitance to drive.Greater re l iabi l ity: simpler processing (less man ual andmore automated) ; ewer external connections.L o w e r c o s t : more autom ated fabrication and assembly.

Higher dens i ty , higher speed internal memoriesTh e internal memory used in spacecra ft com puters hasevolved from magnetic drums to ferrite cores and semi-conductors . Memorydensity has increased rom 200bits /cu. in. to 2400 bi ts / cu. in. ( 12 to 146 Mbi t s /m3) .In thisevolutionary process, access timehasbeen e-duced from 5 milliseconds to 375 nanose conds. T his hasmade possible a great increase in the computing capacityof spacecraftomputers withoutorrespondingn-crea ses in weight, size, o rpowerconsumpt ion .It hasalso contribu ted to decrease in cost.

Greater process ing capabil i tyThe following trends toward higher processing capabilityare clearly discernible.Higher process ing speed Th e throughput of the spacecomputers increasedfrom 3000 operat ions per second(3 kops) for the Saturn comp uter to 325 kops (f loating-point operation ) and to 48 0 kops (fixed-point operation)for the Space Shut t le computer . Thiss shown in Table 3.Greatermemory apac i ty The internalmemory in-creased from 98388 bi ts for the Saturn I com puter to13 10720 bits for the Sp ace S hut t le CP U. T his is shownin Table 4.

Richer instruction repertoire.U s e of parallel instead of serial operations.U s e of several computers in a sys tem.

Greater f lexibi l i ty and eus ier useU se of microprogramming to accomm odate functionaland design changes.Provision of f loat ing-point ar i thmetic to ease the tasksof programming and program validation.Us e of a higher order language o redu ce software effortand provide better control.Provision of m ore extensive and more refined supportso f tware , such as assem blers, inkage editors, simulators,compilers, and diagnostic programs.

L essen ing dominance of physical considerat ionsIn the development of early spacecra ft com puters, theminimization of weight, size,an dpowerconsumptionwas adominantdesign considera tion. With the use ofnew techno logy, it is possible to obtain increased comp ut-ing capacity while maintaining the weight, ize, ndpow er param eters at essentially he same levels. Fromth eSaturn I guidancecomputer o heSpaceShuttleC PU , the number of logic gates per cubic inch of com-puter volume ncreased rom 5 to 100 (0.3 to 6 X lo6gates per cubic meter).Fo r early proc essors, the ability to w ithstand severeoperational environments was of critical concern. Al-though this ability is still essential today, the accumulatedtest data and analytical knowledge have helped to makethe environmental design effort less of a preoccupat ion.

Cont inued impor tance of faul t toleranceFault tolerance is an important feature of space com put-ers because of the need to increase computer eliability,increaseoperating life, assure pro per ope ration duringcritical time periods, and avoid maintenance during peri-ods of deployment . 7

J A N U A R Y 1976 O N- BO A RD CO M PUTER EVO LUTI O N


4/15

The need for fault tolerance continues to exist eventhrough the reliability of simplex computershas im-proved. In specific applications, suchas in theSpaceShuttlewhere he vehicles are manned and heirsafeoperation is depende nt on the compu ter, fault toleranceis even more crucial.Several fault-tolerance approache s ha ve been utilized,including q uadruple component redundancy for the Or-bit ing Astronomical Observatory (OAO) , triple-modu-lar-redundant logic mo dule s orSatu rn I S and V andpr ime and backup computers for Skylab. For the SpaceShuttle, five identical computers, which can be assignedto edundantoperation by program control,are used.

Adaptation of existing modelsThe earlier spacecraftcompu ters (for Saturn I, O A O ,Gemini, Saturn IB and V) were e ach uniquely designedfor a specific application. The lat er com puters (for Sky-lab,SpaceShuttle)are eachadapted from an existingmodel. This trend is indicative of several factors in thedevelopm ent of aerospace compu ters:Maturationof aerospace computerdesign, so that acompu ter model can be developed to anticipate the fu-ture needs before the exact requiremen ts of specific pro-grams are delineated.General availability of advanced components with highperformancecapability, so that specializeddesign anddevelopm ent to extract greater speed and reliability areno longer an overriding ne cessity.Growth of component density,o that specialized designto minimize weight, size, and pow er consumption is nolonger an overriding need.

The dapta tion of an alreadydeveloped computeroffers a number of important advantages:Greater confidence n the capability and producibility ofthe compu ter. The basic hardware and software designwould already b e verified, the performance and availabil-ity of the compo nents already confirmed, the manufac-turing processses already e stablished.Shorter development cycle. Earlier availability of maturecomputers, withhigher reliability and ready for flightoperation.Lower cost for hardware, software, and development.Logistic advantages over the program cy cle.

The adaptat ion approach n turn s trengthens a numberof trends already appearing among aerospace compu ters[ 11:Standardization of word lengths: Sixteen-, 24-, and 32-bit lengths a re increasingly being adopted for fixed-pointoperation; and 32-, 48-, nd 64-bit engths for floating-

8 pointperation.

A . E. COOPER AN D W. T. CHOW

Use ofmicroprogramming.Development of a yamily of aerospace computers us -ing a common basic design.Sharing of support software by comp uters in a family.Compatibility betweenaerospacecomputersand com-mercial compu ters with resp ect to com pone nts an d soft-ware.Evolution in the utilization of on-board computersIn conjunction with the evolution of cha racte ristics, theuse of on-board-com puters has also changed. This pro-gress is summarized in Table 5, and several facets arediscussed below.

Increasing dependence of manned space vehicles onthe on-board computerThespacecraf tcom puters described in this paperareused in all of this countrys manned spac e progra ms-past, present, and under development - ith the excep-tion of Project M ercury, the United States first mannedspace venture, where no n-board comp uter w as used. Asignificant trend is the increasing dependence of mannedspace vehicles on the on-board co mputer for their mis-sion success nd safe operation.Thisesults fromgrowth in the complexity of mission operation and con-tent, the expanded use f on-board computers forcriticalflight control operations,ndreatermphasisnautonomy.

Th e earlier com puters orSaturn I and OAO wereused nunmannedapplications. For Satu rn I, he sur-vival of the boos ter and the effectiveness of its missionwerebothdependenton heon-boardcomputer .ForOA O, the succe ss f the mission is dependen t on theon -board computer although the survival of the satellite isnot.

Use fordigital flight controlTheon-boardcomputers fo rSaturnI, Gemin i ,SaturnIB and V, and he Space Shuttle all perform guidanceand navigation computations. In the earlier vehicles, thestabilization nd ontrol unction,which orients andmaintains the vehicle at a specified attitude and attituderate, was performed by an analog autopilot or an analogflight control comp uter. In the Space Shuttle, however,this function is performed by the on-board digital com-pute r through digital mechanization of the autopilot.

Sinc e the dom inant natural frequencies of the stabili-zation and contro l syste m are considerably higher thanthose of aguidancean dnavigation system, a highercomputation speed is required of the on-board com puter.Typically, wocomputing cyclespersecondare suffi-cient fo r the asc ent navigation of a space vehicle while25 computing cyclesper second may be required forflight control. There is also a requirem ent for a arger

IB M J. RES. DEVELOP.


5/15

memory capacity.In heSpaceShuttle, approximately8000 main memory words (3 2 bits per word) and 17000mass memory words ( 1 6 bits per word) are used for thispurpose.

The provision of digital flight control by the on-boardcomputer makes possible the use of digital filtering tech-niques to enhance the vehicles stability. The digital con-trol is simpler, lighter, more adaptable, and more flexiblein satisfying the requirements of different flight regimes.It is also more reliable when a redundant arrangement isused. Digital flight control is used in the Apollo com-mand and lunarmodules and in newer launchvehi-cles, and its usage is expected to become common.

Increasing use for system moni toringIn he early space programs, relatively little use wasmade of the on-board computer to monitor the perfor-mance of other subsystems. The on-board computer forSaturn I monitors and calibrates the gyros and acceler-ometers , tests the interfaces and performs flight simula-tion and countdown during round operation beforelaunch. For Saturn I B and V , which have a substantiallylonger mission duration, the on-board computer is usedfor self-testing, interface verification, and system valida-tion before aunch. When the vehicle reaches its orbit,the computer is used to check the propulsion system, themid-course guidance and control system, and other re-lated systems. The test esults are sent to the ground foranalysis. For the Space Shutt le, more extensive testingandmonitoring tasksare performed by the on-boardcomputers, including self-testing,ault detection andfault isolation of vehicle subsystems, checkout of pay-load interfaces, and monitoring of payloads and payloaddeployment, as well as prelaunchand preflight check-outs. The results are resented to the flight crew on mul-tifunction and dedicated displays. This is consistent withthe intended purpose of the SpaceShuttle as a cost-effective airline-type space ransportation system withminimal dependence on ground support. In addition toautonomous operation, the se of the on-board computerforsystem monitoring also relieves the flight crew ofexacting but routine details so that they can concentrateon the mission-oriented tasks.

The principal effect of system monitoring on computerdesign is the increased memory capaci ty equirement.For the Space Shuttle,approximately 6000 main memo-ry words ( 3 2 bits per word) and 54000 mass memorywords ( 16 bits per word) areused for this purpose.

Increase in the number of computer interfacesAs the functions performed and subsystems monitoredby the on-board computer increase, the number of sys-tem nterfacesnecessarily increases also. In he SpaceShuttle, each computer nterfaces with 38 subsystems on

the orbiter , four subsystems on the solid rocket boost-ers, and numerous points on the ground support equip-ment. Twenty-four time-shared serial digital data busesare used toaccommodate hedata traffic among thecomputers themselves, and between the computers andthe interfaced subsystems. Ina very real sense, theavion-ic systems in a modern spacecraf t are integrated by theon-board computers.

M o v e complex man-computer in terfacesIn the early space vehicles, only indirect man-computerinterfaces through the ground support equipment exist-ed. In Gemini, electromechanical decimal wheels wereused forreadoutand adecimalpush-buttonkeyboardwas used for data insertion. For Skylab attitude control,an octal push-button keyboard was used for data inser-tion, Nixie ubes were used for readout, and indicatorlights were used for status display. For the Space Shut-tle, the man-computer nterfaces are extensive and in-clude the use of multifunction C RT displays, dedicateddisplays, status indicators,eyboards, push-buttons,manual flight controls, and manipulator controls for in-terfacing with the pilots, mission specialists, and payloadspecialists. This intensification of the man-computer in-terface is a result of the use of on-board computers forthe functions of flight control, system management, andpayload management. It is also a result of the multiplici-ty of flight modes (ascent, orbital, payload deploymentand retrieval, and reentry) and the multiplicity of pay-loads (spacelab, autonomous satellites, and high energystages).

A consequence of this large increase in man-computerinterfaces is the need for human engineering efforts, toachieve he simplest instrumentarrangement and themost effective man-machine interaction. The conversionof computer data into nformation formats readily intelli-gible to the flight crew calls for increased memory ca-pacity and more elaborate input/output and program re-quirements. In the Space Shutt le, approximately 12000main memorywords (32 bits per word) and 38000mass memory words ( 16 bits per word) are used for thispurpose.

U s e of separate input /output uni t sIn a modern space application the circuitry needed forinput/output operations such as signal conversion, signallevel shifting, and data buffering and multiplexing, tendsto be comparable or larger in size than the CPU. In eachof the later programs (Saturn I B and V, Skylab, SpaceShutt le), a separate input/ output processor s used. Theinput /output instrumentation must be tailored for a giv-en application whereas he CPU can be adapted. Thisseparat ion facilitates the design and development effortand also simplifies the maintenance. 9

J A N U A R Y 1 9 7 6 ON -B OA R D C OM PU T E R EVOLUTION


6/15

aJ210

e,0z

A. E. COOPER AN D W. T. CHOW IB M J. RES. DEVELOP,


7/15

Guidance computer for the Saturn I rocket boosterDevelopment per iod: 1959- 962Saturn I was one of the earliest space boostersdevelopedby the United States. Designed by W ehrner von Braun'steam at he Marshall Space Flight Center (Huntsville,Alabama) in late 1959, it was the primary flight-proofiingvehicle for the develop mentf the Saturn B and Saturn Vboosters used hroughout the Apollo space program.Digital com puters were just beginning to be applied toguidancean dcontrol system s. The guidance com puterwas developed by IBM as part of the on-board inertialguidance sy stem . It was ageneral purpo se serialcom-puter using discrete emicon ductor omp onents andmagnetic drum memory.

Computer func t ionsTh e functions performed by the Saturn I guidance com-puter included the following:Guidan ce and navigation computation.Steering compu tation.Issua nce of cutoff signals to term inate thengines.Issu anc e of discrete control signals.Ground checkoutof command signals.Ground support operat ions:

Continu ous tests in ready m ode for self-checking andPeriodic ma inten anc e tests for flight simulation, dry-Manuallynitiated testsor ccelerom eter calibra-

monitoring of the gyros nd accelerometers.run countdown, and exercisef interfaces.tion and gyro drift determination.

N e w design requirementsThe deve lopmentof the Saturn I guidance computer wasundertaken at a imewhen both com puter technologyan dspaceoperation were new. A number of require-ments and environm ents special to pace applicationswere encountered for the irst time. The re was ittle prec-edent or previous exp erience to serve as a guide; m ucheffort was required not only to deve lop a com puter thatcould adequa tely perform th e necessary functions w ithinthe weight, size, and powe r constraints, but also to un-derstandhe new operational environm ent.Throughthese efforts, a reliable comp uter was developed to servethe needs of Satur n I. Thes e efforts also resulted in adata base and a procedure which w ere used for the de-velopment of space comp uters in later programs. So meof the requirem ents enco untered were the following.1. Thevery stringentweight,size, andpower estric-

t ions for the on-board equipmen t . These res tr ic t ionsare still severe tod ay, but were specially harsh in thedays of Saturn I before the availability of integratedcircuits nd high density toragemedia. Th ese re-strictions prom pted many designs rade-offs and the

ON -B OA R D C

1

:OM PU T E R E V OL U T I ONA N U A R Y 1 9 7 6


8/15

establishment of systematicand methodical weightcontrol nd ower budget procedu res .The at terserved as a valuable discipline and are used to day inevery aerospace program.

2. T heeverenvironmentalequirements ,ueoground operat ionsas well as o aunchand paceflight conditions. Th e env ironm enta l facto rs to b e sat-isfied included vibration, shock, acoustic noise, elec-tromagnetic interference,heat, humidity,a salt fogatmosp here, vacuum, space radiation, and, later, nu-clear radiation. Th e specific levels of som e of the sefactors were not clearly known at the outs et of thedesign cycle, their effects on electronic com pone ntsand circuits had yet o be investigated and definedand, in a number of cases, suitable testequipmentand procedures had to be developed.

3. Th e need for high reliability in the ope rating environ-ment. Th is was required a t a time before high reliabil-i ty components and processes became comm on. Tomeet these requirements , techniques and procedureswere developed at he component select ion,circuitdesign, system design, and manufacturingevels.These techniques contributed much to the success ofthe Saturn I com puter and were instrumental in thedevelopment ofhigh reliability com pon ents.Thesemethods became the forerunners of todays standardprocedures in the computer industry.

4. he need to design for asy field operation andmainten ance. The concep ts of designing for a givenpersonnelsystem andfo r a targettime to repairwere introduced.

5. The formulation of a digital com puter for a real-timesampled data control system, at a time when the sta-bility of such a design was still a m atter of consider-able concern.Thiswas urther complicated at hetime by low computing speed, limited both by theavailable compo nents and by th e desire to minimizehardw are for reasons of weight, power, and reliabili-ty. The analytical stud ies and simulation technique sdeveloped at that time became a foundation on whichfurther advances were subsequent ly made to satisfythe needs of later aerospa ce programs in w hich digitalcomputers areused in faster feedback loops.

Primary processor an d data storage equipme nt forthe Orbiting Astronomical ObservatoryDevelopment period: I 9 6 1 - 965The Orbi t ing AstronomicalObserva tory OAO) i s alargeunmannedsatellitedesigned and built by Gru m-man AircraftEngineering Corporationunder NASAsPhysics and Astronomy Program and is used for as t ro-nomical stud ies from a vantage point free from the dis tor-

12 tion andelective absorp tion of the Earths atmosp here.

Tw o successful aunches have been m ade to date: Ob-servatoryOAO -2, which was aunchedonDecember7 , 1968, and urnedoffonFebruary13, 1973; andObserva tory Copernicus ,which was launched on A ugust21, 1972,and is still in continu ous operation . With its2-inch (0.8 m) telescope, Copernicus has detected defini-tive abun dance of deu terium in the interstellar as,which strongly supports he supposition that he uni-verse is ever expanding. D ata from its cluster of fourx-ray monitoring telescopes have onfirmed the existe nceof black holes.

The P r imary P roces soran dDataS t o r a g e P P D S )equipment for OA O [21 was developed by IB M to sup-por t the pro per functioning of the observato ry. Discretecom ponen ts mounted in molded plastic m odules nd two-aperture, non-des truct ive-readout (N D RO ) ferr i te coreswere used. Extensive redundancy was used to meet thelong orbital life requireme nt.

Processor functionsT h e O A O Primary Processor and D ata Storage equip-ment performs the following func tions:Verifying the accuracy of commands received from theground tracking station s.Storing commands in the memory forsubsequent usewhen the satellite is not in contac t with the ground sta-tions.Executing commands either in real time while in contactwith a ground statio n or n delayed mode after th e trans-mission cease s.Storage of astronomical experimentdataand satellitestatus information.Preparing stored data for transmission to ground.Providing the system clock which supplies the basic tim-ing signals for the entire observatory.

N e w design requirementsIn addition to the launch conditions of shock , vibrationand acceleration, bout which mu ch knowledge hadbeen obtained throug h the Saturn I program, four newrequirementswereencou ntered in thedevelopment ofth ePPD S quip men t or he Orbi ting AstronomicalObserva tory . These were theollowing.1 . Th e high vacuum environment of outer space [ 31 , onth eorder of lo- mmof mercury 1.33 X Pa) or

the intended OAO orbit.Tw o principal design appro aches w ere applied in thisconsidera tion: m aterial selection and heat transfer. Un-der extreme vacuum, manymaterials ha ve a tendency todecompose or outgas . A small amount of vapor from hisprocess would contaminate he opt ics in the OA O ex-perimental packages and degrade their performance. A n

A. E. COOPER AN D w. T. w ow IB M J . RES, DEVELOP.


9/15

extensive materials estingprogramwas conducted sothat only materials with a minimal tend ency o outgaswereused in the fabrication of the equipment . Mostcom pone nts were hermetically sealed to minimize out-gassing, and added protection was obtained by a n epo xycoating applied over the c omp onents.

Heat t ransfer was a matter of concern because of theabsenc e of con vection cooling in a high vacuum environ-ment. Care was taken in the thermal design for all heatgenera ted by the electronics to be removed by con duc-tion an d radiation. T he epoxy coating applied ove r thecomponents also served as a heat transfer medium fromthe compon ent to the module case. Black-oxide copperheat sinks were used w here high heat dissipation takesplace to improve the heat condu ction pattern from themodule base to the panel edge. Panel edges of the subas-semblies are attach ed to the fro ntf the pro cessor case tocond uct internal hea t to the case surface, from which itcan be radiated to the spacecraft kin. The two processo rcases aremade of aluminum and coatedwith a high-emis-sivity epoxy paint. Therm al analysis and thermal testingwere undertaken to supportnd verify the thermal design.2 . Th e need toconservepow er, ince he electrical

power of the OAO while in orbit is generated by so-lar c ells and store d in batteries.

Four principal approaches were used to minimize thepower consumptionof the PPDS equipment:Use of a low but adequate clock frequency, 50 k H z , S Othat low power, low speed logic circuits could be utilizedthroug hout the equipment.Extensive useof time sharing so that few er circuits wereneeded.Use of non-destructive-readout memory. Power is con-served because it is not necessary o rewrite nto thismemory after the repeated read out of data for transmis-sion to ground. F urth er savings are realized becau se it isnot n ecessary to use dedicated regis ter toold the read-out information until i t is restored to the memory.Utilization of power switching to turn off logic functionsand storage locations when th ey are not in active use.For manycircuits, pow er is turned on only when theobserva tory is in real-time con tact with a ground stationor when a command is ready to be ex ecuted. This earlyapplication of power switching was to become furtherrefined and widely used in space com puters.3. Th e need to s tore the com mand s in the memory for

subseq uent use when he satellite is not in contactwith the ground stations, and the need to store heexperimental data and spacecraf t status informationuntil the satellite is within transmission ange of aground station.

JANUARY 1976

Two-aperture, coincident current, non-destructive-readou t ferrite c ore memory is used in PPDS equipmentfor the stora ge of both commands and data . Besides thepower conservat ion considerat ion, he use of the non-destructive-re adou t memory provides protection to th ecomm ands and data in the event of pow er interruption.Th is is importan t for the OAO because of its long mis-sionime ndtselativelynfrequent contact withground tracking stations. Since the develo pme nt of theOA O, NDRO memory, in several developed forms, hasbecome a desired feature for most space computers andfor some avionic computers .4. Th e goal of one yearof reliable ope ratio n in orbit.

Th e mission goal of one year n orbit placed exceeding-ly high reliability req uirem ents o n the PPD S equipment.T he reliability prediction of a simplex design using state-of-the-art components was a disappointingly ow 0.01for the one -yea r mission, even with the use of generousderating andworst-case design appro aches.An ultra-high-reliabilty parts program would have been prohibi-tively expensive while still yielding submarginal results.Consequent ly, redundancy at the ci rcui t ,ogic, and func-tional evels was systema tically applied. Th e design ef-fortwas extensively supported by failuremode tes ts ,circuit analysis, and reliability analysis [41. This sys tem-atic application of redundancy to satisfy the reliabilitygoal became a forerun ner in the dev elop me nt of fault-tolerant computers .

Quad ruple com pone nt redundancy is used at the cir-cuit level to obtain a high basic circuit reliability. Red un -dant com pone nts are used in parallel or series-parallelarrange men ts in place of single compon ents.

Logic level redundancy is used where non-digitalcomponents donot lend them selves ocomponent re-dund ancy. Triple mod ular redundancy with a majorityvoter is used for m agnetorestrictive delay lines and theirlinear amplifiers.

Functional level redundancy is used where neithercircuit level nor logic level redundancy is practical, be-caus e of timing or other design considerations. Tw o re-dundant memory arrays are used for data s torage andfour redun dant arrays are sed for command storage.Guidance computer for the Gemini manned spacevehicleDevelopment period: 1962- 966Gem ini w as a two-man spa ce vehicle designed to furthe rdevelo p he manned spaceflight capabilitysuccessfullydemonstrated in Project Mercury, and to lay the ground-work for Project Apollo. I t was provided with the fa-cilities toexplore he echniquesandprocedures orlong-durationrbitalissions,anned rendezvousnd 1

ON-BOARD COMPUTER E VOL UT IO


10/15

docking, extravehicular activities, andjcontrolled reentry[51. Twelve orbital flights, including ten manned flights,weremadebetween1964and 1966.AmongGeminisseveral significant differences fromMercury s he in-troduction of an on-board nertial guidance system [6 , 71to aid the ast ronauts in spacecraft maneuvers throughoutthe mission. TheGemini guidance computer 8] is ageneral purpose serial computer using discrete electroniccomponents and wo-aperture, non-destructive-readout,random-accessferritecore memory.1BMwas respon-sible for the development of this computer and the in-tegration of the guidance systek for therime contractor,McDonnell Aircraft Corporation.

Compu ter funct ionsThe Gemini guidance computer performs the followingfunctions:Ascent During this phase, the computerprovides backupguidance commands to the primary guidance system ofthe launch vehicle. The switchover to backup guidanceis manually controlled by theastronaut , and thecom-puter commands are faded in through a redundant setof controls in the auncher autopilot to avoid violentcorrections of the launch vehicle attitude.Rendezvous During his phase, he computer providesthe primary reference and guidance nformation to theastronauts for performance of the necessary maneuvers.The orbit parameters of both vehicles are determined byground tracking and are used by the ground computersto determine the maneuvers equired by the approachingspacecraft.This information is transmitted to he on-board guidance computer under astronaut control. Theon-board computer rocesses this information alongwith the sensed spacecraf t a ttitude and displays continu-ously the changing thrust and orientation commands tothe astronauts in terms of the spacecraft coordinates.Orbital flight On extended missions the ground trackingnetwork rotates out of the orbital plane and ground databecome unavailable to the astronauts. The inertial guid-ance system and the on-board computer provide a navi-gation capability for the astronauts o determine the imeof retrofire and to select the anding site for safe reentry,in case of emergency.Reentry During his phase hecomputercan be usedeither to provide the guidance information to the astro-nauts for a man-in-the-loop reent ry or to feed the com-mands directly to the reentrycontrol system for an auto-matic or hands-off reentry.

New des ign requirements

Primary Processor and Data Storage equipment.Refine-ments were made in the analysis and testing pertainingto circuit design margins, thermal design, and combinedenvironmental stresses.These efforts were stimulatedboth by the safety emphasis for manned space flight andby the need to assure maximum dependability in a shortresearch and development program.

An area requiring nnovationwas the analysisandsimulation of the computer operational program in com-bination with the spacecraft dynamics and pilot function-ing [91. The spacecraft computer program, consisting ofguidance equations and logical operations , was validatedby extensive simulation. Mathematical models of space-craft dynamics and environment were combined with theflight program to predict behavioral performance.

The computer operationwas verifed during laboratorytesting of the completed computer.Theequations ofeach mode were exercised in a prescribed manner withnormal interfaces connected, and the outputs were com-pared with the esults of simulation. The pacecraftcomputerwas hen nterconnected with a fixed-basecrewstation andageneral purpose ground computer.The reentry procedures and functionswereperformedby the man-machine combination with the ground com-puter providinga imulation of the dynamics of thespacecraf t as it reacts with the atmosphere. Finally, asthe spacecraft systems were checked out on the launchpad, hecomputerequationswere again checkedas alast verification.

The analysis and simulationechniques evelopedunder this program were further refined and broadenedand generally applied to subsequent computer develop-ments for both manned spacecraft and aircraft purposes.

Guidance computer for Saturn I6 and Saturn V

Developme nt period: 1962- 969Saturn IBand Saturn V weredeveloped by NASA atthe Marshall Space Flight Center as the standard aunchvehicles for the more recent U . S . manned space efforts.IBM developed and manufactured the instrumentunit ( I U ) thatcontains he navigation,guidance, con-trol, and data processing facilities for both vehicles. Theguidance computer [ lo ] , which is part of the IU , is ageneral purpose serial computer using Unit Logic De-vice ( ULD) microminiature circuit packages and a ran-dom-accessferritecore memory. To satisfy the safetyrequirements for manned space flight, the computer wasdesigned to continue n accurate operation even after heoccurrence of a transient or a catastrophic failure. Com-

The design of the Gemini computer evolved from he puters developed under this program were used in all thetechnology andapproaches previouslyapplied to, and Apollo and Skylab missions, including the Apollo-Soyuz

14 proven in, theSaturn I guidance computer and the O A O TestProject flight in July 975.

A . E. C OOPE R A N D W. T. C HOW IB M J . RES. D E V E L O P .


11/15

Computer functionsThe guidance computer for Saturn IB and performs thefollowing functions:Prelaunch checkou t The processing of a test program toensure that all guidance system interfaces operate prop-erly prior to flight. The program includes computer self-testing, mission simulation, and system tests, amongothers.Booster guidance The computationsor avigation,steering, and stage cutoff.Orbital checkout Testing of the propulsion system, themid-course guidance and control system, and other re-lated I U systems, and transmittal of the test results tothe ground for analysis.Payload trajectory injection Computat ions of navigation,steering, booster cutoff, and booster eparation.Vehiclesequencing Issuance of discrete commands ocontrol vehicle operation.

Ne w design requirementsVery high reliability was required of the Saturn guidancecomputer , with a design goal of 0.99 for a 250-hour mis-sion. T o meet this goal, all conventional high reliabilitytechniques were fully utilized, including1. Conservative design- implicity and olerance or2 . Thorough qualification of parts and processes.3. One-hundred-percent screening of components and4. In-process inspection.5. Detailed laboratory analysis and corrective action for

wide variations.

assemblies.

any failed part.In addition, triple modular redundancy [ 1 1 1 was used

for the computer ogic, which is divided into seven mod-ules. Three identical circuits are provided for each mod-ule. Theoutputs of these identical circuitsare rans-mitted to he next module hrough majority rule votercircuits. A disagreement detector monitors system per-formance by signaling the ground equipment when themodule outputs arenot all identical.

Self-correcting duplex redundancy is used for memo-ry. Two dentical memories are used, eachnormally con-trolled by an independent buffer register. An odd-paritybit is used for malfunction indicationand an error-de-tection circuit for monitoringmemorydrive current.When an errors detected in one memory, operations im-mediately transferred to the other memory. Both memo-ries are thenregenerated by the buffer register of thegood memory, thus correcting the transient error. Afterthe parity-checking and rror-detection circuits haveverified that he malfunctioning memory has been cor-rected, each memory is again controlled by its own buf-fer register.

J A N U A R Y 1976

Skylab attitude control computer systemDevelopment period: 1968- 97 2The primary objectives of the Skylab missions of 1973and 1974 were to establish a manned workshop in Earthorbit, odevelop orbital operation echniques, o per-form biomedical and orollary experiments regardingmans physiological and psychological ability to live andwork in space, and to conduct an extensive variety ofexperimentsor practicalpplicationsndcience.These objectiveswere well achieved, although Skylabbecame better known for its early mishaps (the loss ofthe micrometeoroid shield and oneof its solar panels) andthe successful in-space repair effort.

The Skylab was in active operation in its 233-nautical-mile (432-km) orbit for eight months and was inhabitedduring five of those months. It s principal parts ncludeI . A workshop, which provides living quarters and work

areas for the astronauts.2. The Apollo TelescopeMount, which houses eightinstrumentsfor he observation of the sunand thestars, and provides the structure for the telescopes aswell as for the four olar panels.

3. The Multiple Docking Adapter, which serves as thedocking port for he visiting Apollo Command andService Module, and contains the control and displaypanels for the telescope array.

4. T he Airlock Module, located between the workshopand the Multiple DockingAdapter, which providesthe exit to space for the astronauts.

The atti tude control of the Skylab cluster in space isperformed by the Skylab Attitude Control System 12-141. A unctionaldiagram of this system is shown inFig. 1. Control is provided initially by the cold gas thrust-ers and hen by the hree controlmomentgyros. Sunsensors, rate gyrosand a star-tracker provide the ontrolreference. Thecomputersystemprocesses hesensordata , performs the control computations, and issues thesignals for control and display. It also accepts ground,pre-recorded and manual command input, and providessystem redundancy management.9 Computer systemTwo computers are used in the Skylab Attitude ControlSystem, one functioning as he prime unit (energized)and one as the backup unit (not energized) t o provide a97-percent-reliable operation or he 240-day mission.Each computer contains 16384 words of memory whichcan be reloaded from either a read-only tape recorder ora radio link in case of a transient failure. The WorkshopComputer Interface Unit (W CI U) , which serves as theinput/output unit for the computers, contains two sec-tions, one energized and one not energized. It also con-tainsommonectionithriplemodular redundant 1

O N- BO ARD CO M PUTER EVOLUTIO


12/15

16

C o m p u t e r No . I

Compute r N o . 2

Figure 1 Functionaldiagram of theSkylab attitudecontrolsystem. TC-1: IB M TC-1 Digital Computer; IOA: Input/OutputAssembly; W C I U : WorkshopComputer InterfaceUni t ; CMG:ControlMoment Gyro; TCSA:ThrustControlSwitch Assembly.

circuits and storage to accomplish automatic switchoverand software initiation. This common section is alwaysenergized.

The switchover from the prime computer to the back-up computer is made automatically in the event of a crit-ical failure. In heevent of a non-critical ailure, theswitchover can be accomplished by external means, byan astronaut or by ground command. Each of the com-puters is a high reliability version of an IB M System 4Pi,Model TC- 1, with an added input/ output assembly.

N e w design requirementsThe most significant new requirement pertaining to theSkylab attitude control computer was the igh reliabilityoperation for such a long mission duration. T o achievethat, new procedures were invoked. Those proceduresincluded1. Audit of all circuit and computer design specifics.2 . High reliability screening and bum-in of components.3. Separate high reliability line for fabrication.4. ntensified qualification tests to uncover potential

weak points.5 . High speed vibration tests with computer operatingnear 100-percent dutycycle odetect all transient

irregularities.6. Thorough failure mode analysis.

computer o a backup computer (of he order of onesecond) and for reloading a memory (of the order of tenseconds)can be accepted.The reliability and ailuremode analysis efforts have added new information to thedata bank of high reliability quality control. A case inpoint is the discovery that fine (0.8- to 1.2-mil-diameter;20- to 30-pm) gold balls can be formed from the eutecticbond used in sealing flat packs, pick up a charge duringvibration, and move to cause a short circuit when poweris turnedon. These packageswere emovedand e-placed with components passivated with a glass seal toavoid potential failure.

Computer complex fo r th e Space ShuttleD e v e lopm e n t pe r iod :1972 p r e s e n tThe Space Shuttle, scheduled to become operational in1980, is a reusablespace ransportationsystem beingdeveloped by the National Aeronaut ics and Space Ad-ministration with Rockwell International Corporation asthe prime contractor.Intended o providea routinespace operation in near-Earth orbits, it is designed to beboth economic and versatile.Spacelabs can becarriedaloft by the Shuttle for manned operation in orbit. Free-flying satellites and payloads such as he Large SpaceTelescope [ 151 can be deployed, erviced, ande-covered. Space vehicles with propulsive stages can beplaced in igh energy or planetaryrajectories. TheSpace Shuttle Orbiter, which carries he crew and thepayload, is intended to remain in orbit for seven to 30days and to be readied for reuse in a two-week groundturnaround.

C o m p u t e r c o m p l e xThe computercomplex, currently under developmentbyIB M [ 161, is part of the Space Shuttle avionics systemlocated in theOrbiter.It provideson-board data pro-cessing for guidance,navigation,andcontrol (GNC)systemmanagement; ayload management; and pre-launch and preflight checkouts . As the central data pro-cessor, the computer complex interfaces with 38 subsys-tems on he orbiter, four on he solid rocket boosters,and the ground support equipment hrough umbilicalconnections.

The computer complex is designed to provide the re-quired processing and interfacing capability, to meet theenvironmental requirements, and to satisfy the variousweight, ize,power, ndperformance constraints. naddition, the following development goals, based on theoverall system objective, re being used as a guide.Flexibili ty To accommodate growth in processing and

The system design approach established and proven in interfacing requirements, oanticipatechanges in pro-this program has since been applied to other aerospace grams ndnstructions, and oprovide optimalpro-programs in which the time for switching from a failed grammability.

A . E. COOPER A N D w. r. C H O W IB M J. RES. DEVELOP.


13/15

Reliability To minimize theoccurrence of failure, toachieve fail-operational/ fail-safe system performance,and to satisfy the safety requirements of fly-by-wire op-eration (where pilot commands are transmitted to heactuators by electrical signals).Low developmen t risk To safeguard the program sched-ule of the Space Shuttle.Low cost To meet the program objective.

As the result of many design studies and rade-off anal-yses, he following approachesare being used n theformulation of the Space Shuttle computer complex:1 . Use of multiple high performance computers to pro-

vide the total computing capacity.Five identical general purpose compute rs (GPCs) a re

used and interconnected through digital data buses. Dur -ing critical flight phases, four of the computers are as-signed to GNC tasks and operat e as a cooperative re-dundant set [ 171. The computationsof each computer inthis set are verified by the other computers. In this way,the computer complex supports the fail-operational/fail-safe system performance. The fifth computer is assignedto systemmanagement functions.

During non-critical flight periods, in orbit, one com-puter is used for GN C tasksandanotherfor systemmanagement: the remaining three can be either used forpayload management or deactivated as standby replace-ments. The use of multiple identical computers satisfiesthe overall avionics objectives in fault tolerance, parti-tioning, and unctional solation. Italso simplifies thecomputer design and development task.2. Us e of separate input/ output processors for nforma-

tion transfer and control.Each GPC in the computer complex consists of two

separate processing nits: centra l processing nit(CPU) , which provides the central computational capa-bility, and an input/ output processor (IOP) which per-forms and controls the input/output operations for theCPU. This separation acilitates the design and develop-ment of thecomputerand simplifies the maintenanceand replacement efforts.3. Use of time-shared serial digital data buses to accom-

modate hedata traffic among thecomputers andbetween the computersand other subsystems.This provides the flexibility to accommodate modifica-

tions in system configuration and resul ts in lower equip-mentweight. Twenty-fourcomputerdatabuses, orga-nized into seven groups, are tilized. The data transfer stime-division multiplexed using pulse code modulation.Each bus operates at aclock rate of one megabit persecond.

J A N U A R Y 1976

4. Use of microprogramming for both the CPU and the10P.

This provides a high degree of flexibility to implementa comprehensive instruction repertoire and to accommo-date changes in both the instruction set and the systemarchitecture.Theuse of microprogramming foraero-space computers has become economically feasible withthe availability of monolithic programmable read-onlymemory.5. Provision of floating-point as well as fixed-point oper-

ation in thecentral processingunit foreasier pro-gramming and program validation.

6. U se of higher order language in the programming ofthe CPU to reduce software effort and provide bettercontrol.

The capability of the CPU to perform floating-pointoperationsand its flexibility to implement pecializedmicrocoded nstructions make he use of higher orderlanguage here bothpractical and efficient. The higherorder language used in the Shuttle computer is designat-ed as H A L / S .7. Us e of random-access, non-volatile, destructive-read-

out ferrite cores as he main memory for maximumreliability and minimum risk. The useof modular corememory takes advantage of the extensive experienceavailable in core and array manufacturingand theextensive data ccumulated from actual se.

A lower cost alternative main memory ncorporatingvolatile monolithic storage is also vailable. It is used in anumber of Space Shuttle computersallocated for groundinstallation in crew trainers. Thisalternative memoryprovides the same level of functional performance as thecore memory.8. Us e of high capacity mass memories for permanent

on-board , off-line bulk storage to supplement the on-line random-access internalmemories of the com-puters.

Two identical tape units are used, each providing astorage capacity of 134 megabits of data . The data toredin the massmemories ncludeprelaunch and preflighttest outines; fault solationdiagnostic testprograms;display formats; overlay program segments to be loadedon-line during specific missionphases: andduplicatecopies of resident on-line programs for initial loading, re-loading, or reconfiguration of the computers.9. Use of proven concepts, state-of-the-art echnology,

qualified components,and subassembliesalready inproduction for maximum reliability and economy aswell as minimum schedule and cost risk. 17

ON-BOARD C OM PU T E R EVOLUTION


14/15

-i !

r""""""""""',II III

r"""""""""""""""""""""IIIIIIIunit

ControlunitIIIIIII II I II III I II III I II II II II II II II II I II I III MemoryI I bu s III 40 960 36-bit words I II II IL""""""""""~ IC PU

Mastercontrollersequence

Digitaldata bu snetworktolfromavionlcssubsystemsand otherGPCs

i!Discrete

Other GPCsIsplay consolei

I I i" 1 IO P I

Figure 2 Functional diagram of the Space Shuttle general purpose computer. BCE: Bus Control Element; MIA: Multiplexor Inter-face Adapter.

A functional block diagram of the GPC, ndicating theinterconnectionbetween theCPUand heassociatedIO P, is shown in Fig. 2. A 36-bit parallel, bidirectionaldata channel is provided a s the primary communicationinterface between the two units.

Centrul processing unitThe central processing unit is a modified model of anIBM AP-IO1 computer , which is itself an extension ofthe Advanced 4Pi computer family and shares a com-mon, mature technology base with all 4Pi models. It is ageneral purpose, microprogrammed computer hat hasthe capability of performing fixed-point and floating-point operations. The computer uses dual word lengths(16- and 32-bit words for nstruct ionsand fixed-pointoperation, 32- and4-bitwordsor floating-pointopera tion). Three se ts of general registers are provided.Each set has eight 32-bit hardware registers. Two setsare used for fixed-point, base, and index operations; thethird set is used for floating-point opera tion . The corn-puteras a 96-percent fault detection capability,achieved by built-in tes t equipment and self-testing pro-grams. It is housed in a dip-brazed aluminum alloy struc-ture to fit a standard air transport ack case.

Input/ output processorAll data transmission among GP Cs and between GP Cs

18 andhe interfacing Spacehuttleubsystems is per-

A. E. C O O P E R AN D W. T. C H O W

formed by the input/output processors underC P U con-trol. One IOP is associated with each CPU to providedirectand passivemonitoring of thedata traffic. Thedesign approaches for the IOP and the CPU are similar,in that the IOP meets the same specifications and envi-ronmental requirements as the CPU.

Each IOP interfaces with the other IOPs and with theinterfacing subsystems over the 24 separate serial databuses. The IOP contains set of 24 independentproces-sors, called Bus Control Element processors. A25thprocessor, the Master Sequence Controller, controls theoperation of the other 24 processors. These 25 proces-sors act, in effect, as 25 digital computers and operatefrom software programs stored in main memory. TheIOP data processingprograms are independent of theCPU programs and have heir own unique instructionset. Each Bu s Control Element controls aMultiplexorInterface Adapter, which is connected to the serial databusviabus couplers.TheAdapter ransmits and e-ceives information, encodes and decodes bus data , andtests for parity and proper synchronizationof bits.

A ControlMonitor performs many of the miscel-laneous control functions internal to the IOP and allowsthe CPU to monitor the status of redundancy manage-ment, interrupts,andotherSpaceShuttlesubsystems.The Redundancy Management logic detects and isolatesfailuresccurring uring redundant GP C operation.Built-in test equipment and self-test programs are pro-

IB M J. R E S . DEVELOP.


15/15

vided for fault detection in the IOP. Part of the GPCmain memory is physically located in the IOP case. Theaddressing logic of the entire main memory,however,resides within the CPU.SummaryThe principal characteristics and applications of sevenspace-bornecomputers developed in thepast sixteenyears have been desc ribed. The space vehicles and theirdata processing requirements have been identified. Thecomputers significant parameters and the applicationenvironment in which they operate have been analyzedto determine the trends f development andutilization.

New technologies and advanced techniques havebeenassimilated steadily. This has contributed to a great in-crease in computing capacity and a decrease in the size,weight, and power consumption of the typical on-boardcomputer. These features are utilized in the design ofnew vehicles so that theirmissionscanbeperformedwith greater flexibility and efficiency. They make possi-ble theextensive use of on-board system testing andmonitoring so that vehicular tasks can be accomplishedwith greater assurance. They have also paved the wayfor the increased use of standardized computers for var-ied applications. The data and analysis contained in thispaper stronglyndicate that evolutionoward highercomputingcapability, larger memory capacity,greaterprogramming flexibility, and more advanced fault-toler-ance methods is a continuing process .References1. W . T. Chow, Airborne Computer Technology, Proceed-ings of the Tenth Space Congress, Cape Canaveral, Flori-da, April 1973; published by theCanaveral Council ofTechnical Sodieties.

2. T. B. Lewis, Primary Processor and Data Storage Equip-ment for theOrbitingAstronomical Observatory, IEEETrans. Electronic Computers EC-12, 667 (1963).3. K. E. Harris, Electronic PackagingDesign for the OA OPrimary ProcessorandDataStorage Equipment, Pro-ceedings of the Fourth nternationalElectronicCircuitPackagingSymposium, Boulder, Colorado,August1963;published by Plenum Press, New York.4. J. E. Anderson, Seven Years of OAO, T R 6 8 - 8 2 5 - 2 2 4 4 ,IBM Federal Systems Division, Owego, New York, April1968.

5 . C. W . Mathews, The Gemini Program, Astronaut ics &Aeronaut ics 2, 22 (November 1964).6. W. J. Blatz, R. F. Pannett, E. L. Salyers, and G. J. Weber ,30 (November 1964).Gemini Design Features, Astronaut ics & Aeronaut ics 2,7 . R. R. Carley, C. D. Babb, and J. H. Slavin, Inertial Guid-anceSystemPerformance Review Gemini7/6 Mission,presented at the 8th NationalAerospaceElectronicsConference , Dayton, Ohio, May 1966; abstract only pub-lished in the Proceedings by the Dayton IEEE Section.

8. J. C. Hundley and R. A. Watson, A Digital Computer in

1

OrbitalFlight, T R6 3 - 8 2 5 - 8 9 2 , IBM FederalSystemsDivision, Owego , New York , Oct ober 1964.9. J. L. Gross, Real Time, Hardware-In-The-Loop Simula-tion Verifies Performance of Gemini Computer and Opera-tional Program, T R 6 6 - 8 2 5 - 1 7 88 , IBMFederalSystemsDivision, Owego, New York, January1967.0.M. M. Dickinson, J. B. Jackson, and G. C. Randa, SaturnV Launch Vehicle Digital Computer and Data Adapte r,AFIPS Conference Proceedings, 26 , Fall Join t ComputerConference , 1964, pp. 501-516;ublished by SpartanBooks, Inc., Baltimore, Maryland.1. R. E. Lyons and W . Vanderkulk, The Use of Triple Mod-ular Redundancy to Jmprove Computer Reliability, I B MJ . R e s . D e v e l o p . 6, 200 (1962).2. W . D. Chubb and S. M. Seltzer, Skylab Attitude Controland Pointing Control System, Technica lNoteN A S AT N 0 - 6 0 6 8 , National Aeronautics and Space Administra-

tion. Washington. D. C.. February 1971.13. P. A . Castruccio and J. E. Irby, All-Digital Attitude Con-trol System forSkylab, Proceedings of the Fifth IFACSymposium on Automat ic Control in Spa ce, Genoa, Italy,June1973; available in microfiche, American Institute ofAeronautics ndAstronautics,NewYork, rder A 7 4 -3 9 4 8 9 .14. T. R. Coon and J. E. Irby, Skylab Attitude Control sys-tem, IB M J . R e s .D e v e l o p . 20 , 58 (1976, this issue).15. F. J . Hudson, Large Space Telescope, IB M J . R e s . D e -velop. 20 , 67 (1976, this issue).16. A. E. Cooper and W. T. Chow, Shuttle Computer Com-plex, Proceedings of the Sixth Triennial W orld Con gress,IFAC 1975, S)oston/Cambridge,Massachusetts,August1975.17. J. R. Sklaroff, Redundancy Management Technique orSpace Shuttle Computers, IB M J . R e s . D e v e l o p . 20 , 20

(1976, this is sue).

Rece ived June 9 , 19 75; rev i sed Augus t 27 , 19 75

The authorsare with he I B M FederalSystemsDivi-sion,O w e g o , N e w Y o r k 1 3 8 2 7 .

JANUARY 1976 ON-BOARD (

19

lOMPUTER EVOLUTION

Documents

Development of on-Board Space Computer Systems