Command and Data Handling System

In the last lesson we looked at spacecraft communications, the command and telemetry system.  We saw how a spacecraft collects data from its various subsystems and how it relays information back to ground.  But we left out a very large part of that process, the computer system in the middle.  In this lesson we'll look at just that: spacecraft computer systems and how they're used.

This is a simple block diagram of the major components of a spacecraft computer system.  It's essentially the same as the personal computer you're looking at now.  At the center is the processor data bus, which transfers data between the various components.  There is also a spacecraft data bus, which performs the same task: it transfers data and instructions between the processor and the various spacecraft systems.  The two are connected by the bus interface, or bridge, which converts input into a form acceptable to the computer.  It acts as a bridge, hence the name, between the computer and the various systems.
The central processing unit (CPU) is what actually performs the tasks and carries out instructions.  It can perform a number of actions each second, defined by its clock rate, given in hertz (Hz).  CPU's also have an associated integer value, which defines the maximum value of integer it can handle.  An 8-bit processor can handle up to 8 binary digits (256 in decimal).  It also limits how many memory locations the CPU can access (again, for an 8-bit processor it is 256, that is it can keep track of at most 256 different variables).
Co-processors are additional processors added to assist the CPU by handling specific tasks.  The most common home example is a graphics co-processor, or graphics card.  This second processor handles all graphical tasks, reducing the load on the CPU.  Many muliprocessor (or multi-core) systems have extra processors that take up tasks as assigned by the CPU, rather than performing dedicated tasks.
Watchdogs are dedicated processors that monitor the CPU for faults.  A watchdog timer does this by looking for hang-ups, when the CPU has been locked into the same task for an unusually long time.  When it observes a hang-up the watchdog forces the system to reset.  It's necessary to have this on a spacecraft, since it must function with minimal human intervention.  There's no one around to hit the reset button, so we have a watchdog.
Memory comes in two main forms: random access memory (RAM) and read only memory (ROM).  RAM is volatile, it disappears when the system is shut off.  RAM is like short-term memory, it's where the computer stores what it's working on right now.  ROM is nonvolatile, it sticks around even when the computer is off.  It's like long-term memory, it's where the computer stores programs and instructions for later use.
Spacecraft can accumulate a great deal of data that must be stored until it can be transmitted.  Mass storage is a kind of large scale read only memory.  Magnetic disk drives (hard disk drives) are the more familiar mass storage device with magnetic disks that store information.  They are rapidly being replaced by solid state drives, which store information on collections of integrated circuits.  SSD's are smaller and denser, have no moving parts to generate heat or break down, and more durable.  The down side is that SSD's tend to consume more power when in use.
Input-Output (i/o) ports allow the bus to communicate with other devices.  They come in two varieties: serial and parallel.  Serial ports exchange one bit and a time, parallel ports exchange one word (a word being the number of bits the processor works with) at a time.  Since parallel ports must exchange on multiple wires (one per bit) serial architecture can have more connection.  Parallel can also become unweildly at high data rates.
Devices connected to i/o ports can be mapped (described to the processor) in two ways.  i/o mapping references a specific port location, separate from all other memory.  This dedicates that port to that particular function.  Memory mapping treats the port as a location in memory, which can be modified and altered through use.  Direct memory access allows devices to access memory without going through the CPU.  Rather than giving data to the CPU, which decides how to store it, the device places the data in memory for the CPU to access as necessary.

Faults occur when something goes wrong with the computer hardware.  Faults can be hard failures, they remain for the rest of the mission, or soft failures, they occur once.  One very important source of faults in spacecraft is ionizing radiation.  Radiation effects are cumulative, the total ionizing dose (TID) a component is exposed to limits its life span.  Over time the component breaks down, requiring more power to operate and slowing down its functions, until eventually it stops working entirely.
Because information is stored and transmitted in a computer by electrical charge ionizing radiation, which deposits or removes charge, can alter bits in memory.  This is known as a single event upset, and can be much more serious than it initially sounds.  A single flipped bit can convert a stored command into complete gibberish or, worse, another command.
Radiation induced noise can cause latch-up in CMOS (complementary metal oxide semiconductor) components.  Latch-up occurs when a path of low resistance forms over the semi-conductor, effectively a short circuit.  High power flow across it quickly destroys the component.
Faults prevention is possible through careful design of components, a process called radiation hardening.  Radiation hardened components are, however, expensive and bulky compared to their ordinary counterparts and little effort has been put into their development since the end of the Cold War.
Another method of prevention is shielding components.  Radiation loses energy, and thus capacity to do damage, as it passes through matter.  By covering sensitive components with high density materials the effect of radiation is diminished.  Shielding, however, requires excess mass be carried by the spacecraft and can interfere with cooling systems.
When something does go wrong fault detection becomes necessary.  One method is parity, using extra bits when storing data.  These extra bits record whether a word or collection of data is odd or even.  A common implementation of parity is called Hamming code.
Another method is triple modular redundancy.  Here three identical systems perform each task.  An error is quickly noted if one of the three disagrees, it can then be determined if it has a soft or hard failure.  Three isn't an upper limit, the Space Shuttle had four primary computers that performed each operation and a fifth that activated to resolve difference between the four.  Any error in one resulted in it being shutdown for the remainder of the mission.  While effective, redundancy requires significantly extra mass as it triples (or more) the number of components.
Multiple cores can be used as a form of redundancy.  In a master/slave (or watchdog) system two or more processors are used.  The slave processor performs all the same operations as the master, and checks the results. 
Instead of redundancy a watchdog can also look for specific signals that all is well.  An improper sequence detector has a checklist of results that it expects when operations are run.  If something doesn't occur, or occurs in the wrong order, it signals that a fault has occurred.
When a fault occurs the system has to repeat the last action to determine the nature of the fault.  Fault rollback records a rollback point each time control is transferred between tasks.  When faults occur it returns the system to what it was doing when the last task started.  This works best when the system transfers between many tasks quickly, since in that case the last task won't have been too long ago.

Older spacecraft used hardwired logic circuits, which perform specific operations based on their design.  Logic circuits have to be specifically designed based on their function, which cannot change during operation. 
Modern spacecraft use embedded software, electronically stored and implemented commands.  It's preferred because it's reprogrammable, programs can be modified and repaired by the ground crew during operation.  Programs can also be reused between systems and between missions.
Spacecraft software is designed in exactly the same way as the software on a personal computer.  Underlying everything is the operating system, which continuously runs to perform basic operations and schedule events.  When instructed, either by ground personnel or on a schedule, the OS executes programs, pre-written sets of instructions.
Computer programs are written using a programming language.  Programming languages work very much like spoke languages in that they convey information.  In this case they convey sets of instructions from the programmer to the computer.  Once written programs are compiled, or translated, from something a person can read to binary machine language the computer can read and implement.
Programs are built with functions, or subroutines.  A function is a self-contained collection of computer code that executes a specific task.  Functions are used for operations that must be performed many times or may be reused from one program to the next.  The computer knows what to do and when by following logical commands.
Computer logic is what allows the program to make decisions and act.  Logic falls into two basic types: selection and loops.  Selection allows a program to decide amongst a collection of alternatives.  The most basic form of selection is a simple if - then statement: if this, then that.  Additional options are added by an else statement: if this, then that, else this.  Loops tell a program to repeat an action.  It can be told to repeat the action while something is true, or until something happens.
That is essentially all the computer can do, respond to what happens based on what it has already been told to do.  An autonomous spacecraft must have its contingency procedures already written and must know when to implement them.  Remember: computer make decisions, they don't think.