5 ms·

Is this a good thing, or bad? I've always heard the rumor that NASA computer systems for space-intended systems to be grossly out of date. However this is due t

Is this a good thing, or bad? I've always heard the rumor that NASA computer systems for space-intended systems to be grossly out of date. However this is due to certifying that the processor, etc. can work and that process takes a long time. Just curious if anyone knows why NASA doesn't use more modern processors; is it weight?

tehbeard 6y ago
The older stuff uses bigger(size) transistors, which are inherently more robust against a cosmic ray causing a bit flip, and thus easier to make radiation hardend versions.
- dependsontheq 6y ago
  so is HAL going mad because he/it is so advanced?
  - tambourine_man 6y ago
    No, but because it is afraid. Of dying, of being wrong and becoming irrelevant. We gotta work out those bugs.
rootbear 6y ago
Space qualified processors are very expensive to develop and produce. They are optimized for use in space and manufactured on an entirely different process than commercial chips. All of this is to ensure reliability in the harsh environment of space. Due to these development and fabrication costs, it's worth it to keep using the same processor as long as it is capable of doing the needed computations. The current RAD750[0] has been used since 2005 and will likely continue to be used for some time. [0] https://en.wikipedia.org/wiki/RAD750 https://en.wikipedia.org/wiki/RAD750
- iancmceachern 6y ago
  Not to mention, I'd expect it's a difficult and long process to get their investment back.
peeters 6y ago
It's not weight, it's because they're proven and reliable. You don't want to risk the success of the mission on unproven hardware. For secondary purposes they have no problem running more modern silicon. E.g. the Ingenuity helicopter, as a last-minute addition (and secondary mission) uses much newer hardware and software: https://spectrum.ieee.org/automaton/aerospace/robotic-exploration/nasa-designed-perseverance-helicopter-rover-fly-autonomously-mars https://spectrum.ieee.org/automaton/aerospace/robotic-explor... > There are some avionics components that are very tough and radiation resistant, but much of the technology is commercial grade. The processor board that we used, for instance, is a Snapdragon 801, which is manufactured by Qualcomm. It’s essentially a cell phone class processor, and the board is very small. But ironically, because it’s relatively modern technology, it’s vastly more powerful than the processors that are flying on the rover.
ragebol 6y ago
The Ingenuity drone also on Mars now uses a Snapdragon processor running Linux. This is not radiation hardened IIRC, but it reboots so fast that it is in control again before it hits the ground in case the computer borks due to radiation flipping bits in flight. EDIT: Found the article again: https://spectrum.ieee.org/automaton/aerospace/robotic-exploration/nasa-designed-perseverance-helicopter-rover-fly-autonomously-mars https://spectrum.ieee.org/automaton/aerospace/robotic-explor... I'm not sure where I got the reboot thing from, I think HN in a thread after the Perseverance landing
- retSava 6y ago
  Would love to see the considerations that went into that design! Does it try to keep state across such a reboot? Is the first course of action to try to deduce whether it's about to crash? Is every sensor reading done multiple times to reduce risk of reading wrong (typically, such sensors are basic and doesn't employ error checks or such)? Does it try to understand why the OS crashed and do any graceful degradation, eg "fine, don't use that sensor then"?
  - moftz 6y ago
    You can filter the sensor data to get rid of any "sparkles". You can also add in power controls for the sensor so that you can reboot them when they either stop responding or send too much erroneous data.
- mercora 6y ago
  this assumes a bitflip would result in an immediate reboot which is not even that likely i think. detecting these failures probably requires redundant systems and luck i guess.
  - tzs 6y ago
    You could simply assume that any significant deviation from the planned flight profile is due to bit flips and reboot. That might miss bit flips that don't affect the flight profile, but those do not need a real time response. Bit flips in collected data for example could probably be found afterwards when the data is analyzed. Heck, it might even make sense to figure out what the minimum time, T, is such that something can go wrong that a reboot will fix fast enough to save the mission but only if the reboot happens within T seconds of the onset of the problem. Then just reboot every T seconds regardless of whether you know of something actually wrong.
MisterTea 6y ago
> Is this a good thing, or bad? Neither. The proper question to ask: "is it the right tool for the job?" The answer here is yes. Power is a vetted architecture and has been used in critical processes for quite some time. Just because something is old does not mean it is bad or some sort of burden.
jvanderbot 6y ago
It's not a good or bad thing. It's a process. Remote instruments (which is essentially what these missions are) don't need all that much compute to turn and face a target and acquire an image. It'd be nice to have more, but it's not strictly necessary. Also, spacecraft a little distributed systems. There are _lots more_ processors on these things. The instruments and mechanisms all have their own processors, from what I see ... which is limited. Don't think too hard about how Percy is self-driving on its limited compute, that will make your head hurt to think about trying to make that work.
robotnikman 6y ago
Its the right tool for the job, so I would say its a good thing. Its a radiation hardened processor which has proven its worth in previous missions and is well known to the developers, while also providing enough computational resources to do what they need it to do.
tablespoon 6y ago
> Is this a good thing, or bad? I've always heard the rumor that NASA computer systems for space-intended systems to be grossly out of date. However this is due to certifying that the processor, etc. can work and that process takes a long time. Just curious if anyone knows why NASA doesn't use more modern processors; is it weight? Think of it this way: technology is not a straight-line tech tree from "less advanced" to "more advanced." It's more about tradeoffs. So these processors might have less processing speed compared to modern consumer ones, but they're more reliable and resistant to radiation (and that's partially a consequence of the reduced speed).
pkaye 6y ago
They need to use radiation hardened processors. That means the chip will be in special packaging (I think ceramic), use bigger process geometries and, use redundancies in logic design within the chip. Also running at lower clock rates will reduce the chance of failure. These are not mainstream chips so they will be expensive and slow development. And lastly certification takes a lot of time and there are risks to the mission to switch from a proven technology to something new. A single glitch can end a mission that took a decade to accomplish.
Florin_Andrei 6y ago
> Is this a good thing, or bad? It's the only thing that works, so it's good by definition. Modern chips with tiny transistors can easily get fried (or make gross mistakes) because of cosmic radiation. Large transistors are much more robust.

tehbeard 6y ago

The older stuff uses bigger(size) transistors, which are inherently more robust against a cosmic ray causing a bit flip, and thus easier to make radiation hardend versions.

dependsontheq 6y ago
so is HAL going mad because he/it is so advanced?
- tambourine_man 6y ago
  No, but because it is afraid. Of dying, of being wrong and becoming irrelevant. We gotta work out those bugs.

rootbear 6y ago

Space qualified processors are very expensive to develop and produce. They are optimized for use in space and manufactured on an entirely different process than commercial chips. All of this is to ensure reliability in the harsh environment of space. Due to these development and fabrication costs, it's worth it to keep using the same processor as long as it is capable of doing the needed computations. The current RAD750[0] has been used since 2005 and will likely continue to be used for some time. [0] https://en.wikipedia.org/wiki/RAD750 https://en.wikipedia.org/wiki/RAD750

iancmceachern 6y ago
Not to mention, I'd expect it's a difficult and long process to get their investment back.

peeters 6y ago

It's not weight, it's because they're proven and reliable. You don't want to risk the success of the mission on unproven hardware. For secondary purposes they have no problem running more modern silicon. E.g. the Ingenuity helicopter, as a last-minute addition (and secondary mission) uses much newer hardware and software: https://spectrum.ieee.org/automaton/aerospace/robotic-exploration/nasa-designed-perseverance-helicopter-rover-fly-autonomously-mars https://spectrum.ieee.org/automaton/aerospace/robotic-explor... > There are some avionics components that are very tough and radiation resistant, but much of the technology is commercial grade. The processor board that we used, for instance, is a Snapdragon 801, which is manufactured by Qualcomm. It’s essentially a cell phone class processor, and the board is very small. But ironically, because it’s relatively modern technology, it’s vastly more powerful than the processors that are flying on the rover.

ragebol 6y ago

The Ingenuity drone also on Mars now uses a Snapdragon processor running Linux. This is not radiation hardened IIRC, but it reboots so fast that it is in control again before it hits the ground in case the computer borks due to radiation flipping bits in flight. EDIT: Found the article again: https://spectrum.ieee.org/automaton/aerospace/robotic-exploration/nasa-designed-perseverance-helicopter-rover-fly-autonomously-mars https://spectrum.ieee.org/automaton/aerospace/robotic-explor... I'm not sure where I got the reboot thing from, I think HN in a thread after the Perseverance landing

retSava 6y ago
Would love to see the considerations that went into that design! Does it try to keep state across such a reboot? Is the first course of action to try to deduce whether it's about to crash? Is every sensor reading done multiple times to reduce risk of reading wrong (typically, such sensors are basic and doesn't employ error checks or such)? Does it try to understand why the OS crashed and do any graceful degradation, eg "fine, don't use that sensor then"?
- moftz 6y ago
  You can filter the sensor data to get rid of any "sparkles". You can also add in power controls for the sensor so that you can reboot them when they either stop responding or send too much erroneous data.
mercora 6y ago
this assumes a bitflip would result in an immediate reboot which is not even that likely i think. detecting these failures probably requires redundant systems and luck i guess.
- tzs 6y ago
  You could simply assume that any significant deviation from the planned flight profile is due to bit flips and reboot. That might miss bit flips that don't affect the flight profile, but those do not need a real time response. Bit flips in collected data for example could probably be found afterwards when the data is analyzed. Heck, it might even make sense to figure out what the minimum time, T, is such that something can go wrong that a reboot will fix fast enough to save the mission but only if the reboot happens within T seconds of the onset of the problem. Then just reboot every T seconds regardless of whether you know of something actually wrong.

MisterTea 6y ago

> Is this a good thing, or bad? Neither. The proper question to ask: "is it the right tool for the job?" The answer here is yes. Power is a vetted architecture and has been used in critical processes for quite some time. Just because something is old does not mean it is bad or some sort of burden.

jvanderbot 6y ago

It's not a good or bad thing. It's a process. Remote instruments (which is essentially what these missions are) don't need all that much compute to turn and face a target and acquire an image. It'd be nice to have more, but it's not strictly necessary. Also, spacecraft a little distributed systems. There are _lots more_ processors on these things. The instruments and mechanisms all have their own processors, from what I see ... which is limited. Don't think too hard about how Percy is self-driving on its limited compute, that will make your head hurt to think about trying to make that work.

robotnikman 6y ago

Its the right tool for the job, so I would say its a good thing. Its a radiation hardened processor which has proven its worth in previous missions and is well known to the developers, while also providing enough computational resources to do what they need it to do.

tablespoon 6y ago

> Is this a good thing, or bad? I've always heard the rumor that NASA computer systems for space-intended systems to be grossly out of date. However this is due to certifying that the processor, etc. can work and that process takes a long time. Just curious if anyone knows why NASA doesn't use more modern processors; is it weight? Think of it this way: technology is not a straight-line tech tree from "less advanced" to "more advanced." It's more about tradeoffs. So these processors might have less processing speed compared to modern consumer ones, but they're more reliable and resistant to radiation (and that's partially a consequence of the reduced speed).

pkaye 6y ago

They need to use radiation hardened processors. That means the chip will be in special packaging (I think ceramic), use bigger process geometries and, use redundancies in logic design within the chip. Also running at lower clock rates will reduce the chance of failure. These are not mainstream chips so they will be expensive and slow development. And lastly certification takes a lot of time and there are risks to the mission to switch from a proven technology to something new. A single glitch can end a mission that took a decade to accomplish.

Florin_Andrei 6y ago

> Is this a good thing, or bad? It's the only thing that works, so it's good by definition. Modern chips with tiny transistors can easily get fried (or make gross mistakes) because of cosmic radiation. Large transistors are much more robust.