GP-B Post-Flight Analysis—Final Report - Gravity Probe B - Stanford ...

electronic components to recover from the effects of solar radiation bombardment and other space hazards.Following is a brief description of GP-B's on-board computers and the techniques used to detect and correctsingle and multi-bit errors.14.1.2.1 Overview of Computers On-Board the GP-B SpacecraftGP-B has several computers on-board the spacecraft. The main flight computer and its twin backup are calledthe CCCA (Command & Control Computer Assembly). These computers were assembled for GP-B by theSouthwest Research Institute. They use approximately 10-year old IBM RS6000 Central Processing Units(CPUs), with 4 MB of radiation-hardened RAM memory. These computers, along with ruggedized powersupplies are encased in sturdy aluminum boxes, with sides up to 1/4” thick.In addition to the A-side (main) and B-Side (backup) flight computers, the GP-B spacecraft has two otherspecial-purpose computers—one for the Gyro Suspension System (GSS) and one for the SQUID ReadoutElectronics (SRE). Each of these specialized computers contains 3 MB of radiation-hardened RAM memory andcustom circuit boards designed and built here at Stanford University. Because of the custom circuit boards,these computers are housed in special aluminum boxes that were also built at Stanford.14.1.2.2 Memory Error Detection & Correction (EDAC) LogicThe RAM memory in these computers is protected by Error Detection and Correction logic (EDAC), built intothe computer's firmware. Specifically, the type of EDAC logic used is called SECDED, which stands for “SingleError Correction, Dual Error Detection.” Here's how it works. For every 64 bits of RAM in the computer'smemory, another 8 bits are reserved for EDAC. This produces a unique 64-bit checksum value for each RAMlocation. A firmware process called memory scrubbing runs continually in the background, validating thechecksums for the entire bank of RAM memory locations every 2.5 seconds.If the EDAC detects an error in which only one single bit is incorrect—a single-bit error (SBE)—in a memorylocation checksum value, it sends an interrupt signal to the CPU, and the CPU automatically fixes the error bywriting the correct value back into that memory location. However, if the EDAC detects an error involvingmore than one bit—a multi-bit error (MBE)—-it generates a different type of interrupt signal causing the CPUto store the address of the bad memory location in a table that is transmitted to our mission operations center(MOC) during each telemetry communications pass.14.1.2.3 Correcting Multi-Bit ErrorsWhenever the computer engineers on our operations team discovered the presence of one or more MBEs, theyimmediately looked up the use of that memory location in a map of the computer's memory. If that location wasin an area of memory that was not being used, the MBE was said to have been “benign.” In fact, most, but not all,of the MBEs we experienced during the mission occurred in benign memory locations. In these cases, one of thecomputer engineers traveled to the Integrated Test Facility (ITF),—then located at Lockheed MartinCorporation's Palo Alto office, about 15 minutes away from the GP-B MOC, but now located at Stanford—todetermine what value was supposed to be contained in the corrupted memory location. The ITF is a verysophisticated flight simulator that maintains a ground-based replica of all the systems running on thespacecraft.404 March 2007 Chapter 14 — Data Collection, Processing & Analysis