Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How NASA built Artemis II’s fault-tolerant computer

cacm.acm.org

Post reply on HN
Print view View original

101–110 of 257 posts

Re: How NASA built Artemis II’s fault-tolerant computer

#101

Post by JumpCrisscross »

ramraj07 wrote: post #26
1970-01-01 wrote: post #23

Earlier quoted context omitted.

Google then had complete regret not doing this with ECC RAM: https://news.ycombinator.com/item?id=14206811

It got them to where they need to be to then worry about ECC. This is like the dudes who deploy their blog on kubernetes just in case it hits front page of new york times or something.

> then had complete regret not doing this with ECC RAM

Yeah, my takeaway is Google made the right choice going with non-ECC RAM so they could scale quickly and validate product-market fit. (This also works from a perspective of social organisation. You want your ECC RAM going where it's most needed. Not every college dropout's Hail Mary.)

Re: How NASA built Artemis II’s fault-tolerant computer

#102

Post by JumpCrisscross »

themafia wrote: post #61
georgehm wrote: post #58

>Effectively, eight CPUs run the flight software in parallel. The engineering philosophy hinges on a >“fail-silent” design. The self-checking pairs ensure that if a CPU performs an erroneous calculation >due to a radiation event, the error is detected immediately and the system responds. >“A faulty computer will fail silent, rather than transmit the ‘wrong answer,’” Uitenbroek explained. >This approach simplifies the…

In the Shuttle they would use command averaging. All four computers would get access to an actuator which would tie into a manifold which delivered power to the flight control surface. If one disagreed then you'd get 25% less command authority to that element.

> In the Shuttle they would use command averaging

I think the Shuttle, operating only in LEO, had more margin for error. Averaging a deep-space burn calculation is basically the same as killing the crew.

Re: How NASA built Artemis II’s fault-tolerant computer

#105

Post by ggm »

dmk wrote: post #3

The quote from the CMU guy about modern Agile and DevOps approaches challenging architectural discipline is a nice way of saying most of us have completely forgotten how to build deterministic systems. Time-triggered Ethernet with strict frame scheduling feels like it's from a parallel universe compared to how we ship software now.

Time triggered Ethernet is part of aircraft certified data bus and has a deep, decades long history. I believe INRIA did work on this, feeding Airbus maybe. It makes perfect sense when you can design for it. An aircraft is a bounded problem space of inputs and outputs which can have deterministic required minima and then you can build for it, and hopefully even have headroom for extras.

Ethernet is such a misnomer for something which now is innately about a switching core ASIC or special purpose hardware, and direct (optical even) connects to a device.

I'm sure there are also buses, dual redundant, master/slave failover, you name it. And given it's air or space probably a clockwork backup with a squirrel.

Re: How NASA built Artemis II’s fault-tolerant computer

#106

Post by dyauspitr »

buster wrote: post #77
dyauspitr wrote: post #54

Earlier quoted context omitted.

Agile is not meant to make solid, robust products. It’s so you can make product fragments/iterations quickly, with okay quality and out to the customer asap to maximize profits.

You hopefully know thats not true. But it's a matter of quality goals. Need absolute robustness? Prioritize it and build it. Need speed and be first to market? Prioritize and build it. You can do both in an agile way. Many would argue that you won't be as fast in a non-agile way. There is no bullet point in the agile manifest saying to build unreliable software.

Yeah, I know it’s not true in the sense that that’s not what it’s meant to do, but I’m saying practically that’s what usually ends up happening.

Re: How NASA built Artemis II’s fault-tolerant computer

#107

Post by adrian_b »

ajaystream wrote: post #92

[flagged]

This is similar to the difference between using error-correcting codes and using erasure codes combined with error-detecting codes.

The latter choice is frequently simpler and more reliable for preventing data corruption. (An erasure code can be as simple as having multiple copies and using the first good copy.)

Re: How NASA built Artemis II’s fault-tolerant computer

#109

Post by themafia »

JumpCrisscross wrote: post #102
themafia wrote: post #61

Earlier quoted context omitted.

In the Shuttle they would use command averaging. All four computers would get access to an actuator which would tie into a manifold which delivered power to the flight control surface. If one disagreed then you'd get 25% less command authority to that element.

> In the Shuttle they would use command averaging I think the Shuttle, operating only in LEO, had more margin for error. Averaging a deep-space burn calculation is basically the same as killing the crew.

The GNC loop runs several times per second. The desired output will consequently be increased by the working computers to achieve the target. The computer does not "dead reckon" anything.

Travelling through Max-Q in Earth atmosphere on ascent is far more dangerous.

Post reply on HN