3 ms·

The video strongly implies that the conditions for 1201/1202 alarms might, or might not, lead to a crash. The take in the video is that they got lucky both in s

The video strongly implies that the conditions for 1201/1202 alarms might, or might not, lead to a crash. The take in the video is that they got lucky both in sim and reality.

garaetjjte 3y ago
I don't know if CuriousMarc discovered something new, but AFAIK: Cause of alarms is described there: https://www.doneyles.com/LM/Tales.html https://www.doneyles.com/LM/Tales.html Alarms indicated system restart, but because landing program was designed to automatically restart with data from last checkpoint, checklists deemed it was safe to continue. The trouble though was what was causing the restarts: due to unexpected CPU time stealing from hardware, new SERVICER jobs were scheduled before previous one finished! And previous job wasn't removed from list immediately (that only happened when everything restarted with alarm), which mean that with load fluctuations previously interrupted stale jobs could be continued. In effect there were multiple active instances of routine that was never designed to be reentrant, potentially stomping over global variables and submitting stale commands. The reason that effects of this were relatively benign was that the last thing SERVICER did was updating display, and that's where unintended behavior appeared. In case hardware was stealing a bit more time and jobs would be interrupted near throttle command submission, effects would have been worse. See also https://www.ibiblio.org/apollo/Documents/LUMINARY-memo-138.pdf https://www.ibiblio.org/apollo/Documents/LUMINARY-memo-138.p... >It is now known that the stacking up of Servicer jobs which precedes a 1201 or 1202 alarm in the event of TLOSS can cause completely wrong throttle and attitude commands, and in one special case, random branching. This happens because the Servicer job can clobber its own erasables. Luckily this did not happen to Apollo 11, which encountered TLOSS estimated at up to 15%. EDIT: I watched the talk and I'm not sure whether he implies there's additional CDU problem, or just discussion about exact amount of CDU-caused TLOSS, so I hope he will explain that on the channel.

The video strongly implies that the conditions for 1201/1202 alarms might, or might not, lead to a crash. The take in the video is that they got lucky both in sim and reality.

garaetjjte 3y ago

I don't know if CuriousMarc discovered something new, but AFAIK: Cause of alarms is described there: https://www.doneyles.com/LM/Tales.html https://www.doneyles.com/LM/Tales.html Alarms indicated system restart, but because landing program was designed to automatically restart with data from last checkpoint, checklists deemed it was safe to continue. The trouble though was what was causing the restarts: due to unexpected CPU time stealing from hardware, new SERVICER jobs were scheduled before previous one finished! And previous job wasn't removed from list immediately (that only happened when everything restarted with alarm), which mean that with load fluctuations previously interrupted stale jobs could be continued. In effect there were multiple active instances of routine that was never designed to be reentrant, potentially stomping over global variables and submitting stale commands. The reason that effects of this were relatively benign was that the last thing SERVICER did was updating display, and that's where unintended behavior appeared. In case hardware was stealing a bit more time and jobs would be interrupted near throttle command submission, effects would have been worse. See also https://www.ibiblio.org/apollo/Documents/LUMINARY-memo-138.pdf https://www.ibiblio.org/apollo/Documents/LUMINARY-memo-138.p... >It is now known that the stacking up of Servicer jobs which precedes a 1201 or 1202 alarm in the event of TLOSS can cause completely wrong throttle and attitude commands, and in one special case, random branching. This happens because the Servicer job can clobber its own erasables. Luckily this did not happen to Apollo 11, which encountered TLOSS estimated at up to 15%. EDIT: I watched the talk and I'm not sure whether he implies there's additional CDU problem, or just discussion about exact amount of CDU-caused TLOSS, so I hope he will explain that on the channel.