System Engineering Experiences Harold Sasnowitz, IEEE Life Senior Member

Agenda Angle Rate Bombing System Space Shuttle Harpoon Missile Airborne Mine Countermeasures

What is Real Time Software? Time of arrival of the solution is part of the solution Usually have hardware timer(s) causing interrupts

US Navy Angle Rate Bombing System (ARBS) Circa 1975 Purpose: precision bombing using horizontal flight path Computer Interface: Discretes, Direct memory access, interrupts, serial and parallel channels Processor: SP-1, two page processor, 250 Kop/sec Programmed in assembler language Radar image projected onto HUD; Pilot places crosshairs on target and computer determines release point Problem posed as three DMA channels, always in particular order Initial flight testing resulted in system failure: HUD blanks when system engaged Finding: DMA channel order different than originally specified Be sure specification reflects real requirement Be sure test software reflects real requirement

Space Shuttle System description 300 Kop/sec 256Kbytes ferrite core memory – later updated to semiconductor memory Programmed in HAL/S (C like) System Requirement: survive two like failures Five general purpose computers, all executing identical software All sensors and flight effectors fault tolerant and redundant All 5 computers receive all data input All 5 computers receive output data from the other 4 computers and “fail votes” Input and output sum check on minor cycle basis First launch failure at t-30 seconds

First Launch Failure Insufficient processing power drives software design 50 msec major cycle ~10 minor cycles/major cycle Computers send/compare received/calculated data Non-compare sets “fail vote” Different set of data in different minor sec backup brought into redundant set Prime sent wrong minor cycle number 7 “fixes” to create this condition

Shuttle Reliability Study Purpose: Recommend flight rules for mission abort due to computer system failures Method: Determine reliability of Shuttle computer system Reliability at time t is probability system will be working at time t For components: R=e -λt What is λ? Failure rate in failures per million hours For system: R(t)=∫e -λt dt What is λ for a system?

System State Space Diagram 4/1 4/0 3/1 λ λ λ λ λ λ 3/0 λ Vehicle loss λ

What is system λ? λ 12 λ 13 λ 14 Λ 1,23 λ 22 λ 33 λ 11 Partial Matrix shown Complete matrix is 23 x 23 elements

For system: R=∫e -λt dt Solution is alternating infinite sum Programmed in APL A high order language that has the feel of spreadsheet, but looks like a classical software language

US Navy Harpoon Anti-ship Missile Circa 1971 Mid-course Guidance Unit (MGU) Programmed in assembler language One page, 250 kops; 8K core memory For tracking state vector (v, a) contains Attitude Reference Assembly (ARA) Contains 3 gyros and 3 accelerometers ARA interface to counters in computer Present position provided by launch computer before launch Target location determined and provided by on-board radar 50 msec hardware timer interrupt causes software interrupt Interrupt Handler reads counters Test software showed g slightly off 50 msec counter off by one

US Navy Airborne Mine Countermeasures Initial Deployment Now Purpose: find and destroy shallow and deepwater mines Sensors controlled from console on-board MH-60S Numerous tests required to qualify equipment beyond performing basic function Temperature, humidity, salt spray, electromagnetic compatibility, others Coordinating scheduling of production, factory flight testing, Navy operational testing complex Programmed in C Each sensor developed by programmed by different company

Software Failures in History 22/7 = ∏ ? 24 hours = one day? How many times does the earth make a complete rotation on its axis in one 365 day year? Space probe missed Mars because dimension that should have been in English measure was in metric Errors in formula transcription (handwritten to code) The number of significant figures matters

Questions

First Flight Failure First flight not vertical launch Drop from Shuttle Carrier Aircraft Shuttle and Carrier held together with pyro bolts At separation “GPC 2 light” Studied System Services software looking for “single point failures” “All leaves cancelled” Lost Weekend to engineering staff Bad solder joint on a computer card Proved system design