Slashdot Mirror
Space Shuttle Displays Go Glass
cloudscout writes: "NASA has finally decided to bring the space shuttle up to date with a 'glass cockpit.' Until now, the space shuttle cockpit has used a system of gauges and dials designed in the early 70's.
They now have full-color computer displays and controls. Pictures and details are available in this article at WESH Channel 2000. So how long until someone ports MAME to this thing?" Can anyone shed light on what sort of operating system will drive all those screens?
They Write the Right Stuff
There have been 17 bugs total in the last 11 OS revisions of the Shuttle code, approximately 420,000 lines delivered each time.
I don't work on the shuttle, I work in the Avionic biz, which shares many similarities to the shuttle project.
The avionics biz is very conservative when it comes to items that relate to safety. The primary and secondary displays have to be so safe, bug free, and have such a small memory space that they don't use an operating system such as windows, *nix, or DOS. It is strictly bare metal programming. In the boxes that I work on, having 500k of ram to work with is a luxury item.
The graphics are usually handled by seperate chip with a dedicated graphics engine embedded into it. The main processor and graphics chip usually communicate via shared memory locations and the commands don't get any more complicated than "draw blue circle at location x,y with radius r" and many of the items come predrawn.
The GPCs (General Purpose Computer) in the Shuttle use two software packages. Four of the computers run PASS (Primary Avionic Software System), which was originally written by the IBM Federal Systems Division. The fifth computer runs BFS (Backup Flight System), which was originally written by North American-Rockwell. The "operating system" is unique to the Shuttle, it isn't a port of a commercial product. PASS is the primary system, BFS is there as a backup in case of a common mode software failure during ascent or entry. The Shuttle is a fly-by-wire spacecraft. All of the control surfaces, and many other critical functions, are controlled by the computers. Without an operational computer, you crash and burn. Shuttle software is written in a language called HAL/S (High-Order Aerospace Language Shuttle), which was developed by Intermetrics. The Shuttle's operating system is a hard real-time operating system based on cyclic scheduling. A task is guaranteed to get N cycles of CPU time every X milliseconds. The tasks are managed by three executives, the HFE (High Frequency Executive), MFE (Medium Frequency Executive) and LFE (Low Frequency Executive). A task that issues commands to control surfaces is going to run at a high frequency. A task that checks tire pressure (really!) can run at a low frequency.
Mea navis aericumbens anguillis abundat
Think about it. How many other computer systems can you think of that have been running for the last twenty years? How many other systems have had the tens of thousands of hours of testing and, even more importantly, have worked flawlessly every time? The shuttle computers work. They have never failed in flight, period. Some new system? Hah. We all know how solid most applications are today. The above jokes about running CE on this shuttle show that for sure. ;-) The shuttle today does fundamentally the same thing it did twenty years ago; the calculations needed for launch and landing haven't changed. So why replace the most tested piece of code in the world with something new? Would you like to ride in the first flight with brand new software? Thought not.
Next question: So then why upgrade the displays? Partly it's economic - those bulky old dials weigh a lot, and it's still ten kilobucks a pound to LEO. Beyond that, the interface can be made far better and more adaptable than anything you can do with gauges and switches in hardware. Anything that can be done to make the pilot's life easier is a net win. They way they did it, they basically put in a new system which takes the data and runs the displays, leaving the main computers pretty much untouched, running the same ol' rock-solid code.
Another point about the backup system. As Detritus posted elsewhere, the four main machines all run a program called PASS, the Primary Avionic Software System , while the fifth computer runs BFS, the Backup Flight System. These two programs were written by completely independent groups of programmers. To this day, no one who has worked on one of them is allowed to ever see the code for the other. They're completely indepentent. The idea behind this is called "diverse design". The more dissimilar two systems are, the more improbably it becomes that both will fail at the same time. They originally wanted to have totally different hardware for the backup too, but that was nixed to save on costs. Lastly, the backup system most certainly doesn't kick in automatically, under any circumstances. It's the mission commander's call, whether to hit the big red button on the control stick or not. (And yes, it actually is a big red button.) The designers judged that it was better to keep a human in charge than blindly trust the software.