14
$\begingroup$

I watched a documentary on Voyager 1 and 2 last night and wondered "how is the digital equipment on them still operating"?

I work in IT, and decided to look up what the longest running servers were - recently there have been servers that ran 17 years and 24 years respectively before requiring reboot. These are records AFAIK. Now, being in IT and having dealt with a variety of legacy applications, I can say that I'm often astonished by how long things can last, and am keen to know how Voyager is still alive.

With the Voyager missions, I imagine the following would have potentially fatal effects on the equipment:

  • Fatal or irrecoverable errors in operating code.
  • Radiation from the Sun, Jupiter, and Saturn - despite shielding, surely some would still get through?
  • Graviational forces entering slingshot trajectories with major planetary bodies could cause fracture or stress on physical components.
  • Magnetic forces when approaching planetary magnetic fields could play havoc with electronic equipment.
  • Temperature changes, while not fast, would still cause components to cool to very low temperates. This may be enough to cause the "fixed on" metal components on circuit boards to contract enough to fracture or crack.
  • Firing up thrusters for short periods could cause immediate local spikes on temperature in various components, which may have stayed at a reasonably stable temperature for long periods. The heat stress could again cause components to fracture or crack.
  • Electronic components running continuously for long periods run the risk of shorting or burning out.

Can anyone explain how these stresses have been catered for and/or mitigated for so long?

$\endgroup$
  • 3
    $\begingroup$ I really like your question and it touches on a central theme in space exploration. When you say "still operating" are you including or excluding reboots? Take a look at the following for some context; jpl.nasa.gov/news/news.php?release=2010-151 $\endgroup$ – uhoh Dec 15 '17 at 3:50
  • 1
    $\begingroup$ I wasn't aware that they were able to remotely reboot! I thought that maybe it was a fire and forget type operation, where they ran through every eventuality of the code before packaging it up and sending it off on it's mission. So I guess the code part is answered - I'm still keen to know how the craft is able to physically hold up to the various stresses that we don't even consider in day-to-day use of electronic and digital equipment. $\endgroup$ – e_i_pi Dec 15 '17 at 3:56
  • 1
    $\begingroup$ fyi I've just asked What's the record for the longest time a deep space craft has functioned without a reboot? $\endgroup$ – uhoh Dec 15 '17 at 4:13
  • 6
    $\begingroup$ After launch Voyager is most of the time in zero gravity state. Only during maneuvers using the thrusters there is very little gravity. But during slingshot trajectories with major planetary bodies there is no gravity that could cause fracture or stress on physical components. $\endgroup$ – Uwe Dec 15 '17 at 11:09
  • 1
    $\begingroup$ Planetary magnetic fields are giants in size, but very weak. Therefore resulting magnetic forces are very weak too and would not harm electronic equipment. $\endgroup$ – Uwe Dec 15 '17 at 23:50
19
$\begingroup$

The Voyagers have been so reliable due to careful design, plus lots of redundancy.

Voyager employs three dual-redundant computer systems per spacecraft. The first, the CCS, is nearly identical to that flown on Viking, performing sequencing and spacecraft health functions along with new ones necessitated by the addition of the other computers. Telemetry data formatting and transmission handled by the Flight Data System are done on Voyager with the help of a custom-built computer. Attitude control and articulation of the scan platform are accomplished with the third computer system.

One concept from the STAR computer proposed for the TOPS, applicable to Voyager, is dormancy. JPL's project staff believed that equipment would last longer if unpowered4. Although both CCSs are always powered, rarely are both Flight Data Systems running, and both attitude control computers are never turned on at the same time. Full bit-for-bit redundancy is not maintained in the dual memories. For example, "expended" algorithms, such as the deployment sequence executed shortly after separation from the booster, need not be maintained5. Both memories are accessed by the single active processor in each system. The Flight Data System keeps a copy of its instructions in both memories, but intermediate data and variables can be stored in either memory. This seemingly casual attitude toward memory duplication tightens up considerably near encounter periods, which is one time that both CCS processors are in tandem mode.

The Voyagers are regularly updated in-flight with new software:

In-flight programming allowed for new routines and programs to be uploaded regularly in non-volatile memory and eliminated the need for large amounts of memory to be required onboard.

You're assuming these computers can't be rebooted. Voyager 2's FDS was rebooted in 2010, for example.

Engineers successfully reset a computer onboard Voyager 2 that caused an unexpected data pattern shift, and the spacecraft resumed sending properly formatted science data back to Earth on Sunday, May 23. Mission managers at NASA's Jet Propulsion Laboratory in Pasadena, Calif., had been operating the spacecraft in engineering mode since May 6. They took this action as they traced the source of the pattern shift to the flip of a single bit in the flight data system computer that packages data to transmit back to Earth. In the next week, engineers will be checking the science data with Voyager team scientists to make sure instruments onboard the spacecraft are processing data correctly.

Spacecraft in general are built to assure operations can continue even if errors occur. They usually have watchdog systems: a simple circuit outside the main computer that can command a reboot if the main computer is unresponsive for too long. They also have emergency modes: simple programs that make sure the probe can still communicate if the main programs have failed.

As pioneered on Mariner X, a disaster backup sequence was stored in the Voyager 2 CCS memory for the Uranus encounter, and later for the Neptune encounter. Required because of the loss of redundancy after the primary radio receiver developed an internal short, the backup sequence will execute minimum experiment sequences and transmit data to earth; it occupies 20% of the 4K memory.

Reliability starts in the design phase.

  • they used high-quality, space-rated parts
  • they designed the spacecraft so that parts were always well within their tolerances (i.e. parts were not used at full power or near their temperature limits)

    If a silicon-based component was designed to operate at a junction temperature of 110°C, JPL engineers would use a combination of junction temperature derating and high proto-flight temperatures so that junction temperatures never rose above 65°C. A similar temperature reduction was made for GaAs parts, which were typically designed to operate at 130°C.

  • they minimized thermal cycling: the spacecraft was kept at a constant temperature, and electronics were left on instead of being switched off

  • the design was subjected to worst case analysis:

    A circuit is analysed to determine whether the circuit will properly function if all of the environmental and parts-related parameters are "stacked" at their worst-case levels. Jones explained how this works: "If the gain of a part is at its worst case at high temperature, then you select that gain, and if the part next door performs poorest at a very low temperature, then you select that parameter."

The Voyager engineering team ignored their superiors who just wanted a design that would last for the 4 planetary encounters:

Looking at engineers' testimonials from when it was built, Dodd said the original designers were told not to worry about reaching interstellar space and focus on making sure the Voyagers could observe Jupiter and Saturn.

“Basically they kind of ignored those directions, nodded their heads and did what they wanted to make it capable of getting to interstellar space,” she said.

$\endgroup$
  • 1
    $\begingroup$ Of course very careful design and redundancy, but also some good luck. $\endgroup$ – Uwe Dec 15 '17 at 11:01
  • $\begingroup$ Wow, wasn't expecting such a thorough and well researched answer. This is brilliant, very interesting to read about redundancy and worst case scenario planning. Also, the use of watchdog systems is interesting for me - I see them as critical for high availability no fail systems, not all enterprises are aware of their purpose let alone importance. Thank you for your answer, wonderful! $\endgroup$ – e_i_pi Dec 17 '17 at 10:38
5
$\begingroup$

Concerning mechanical Stress:

As Uwe has pointed out in the comments, there is no large mechanical stress on the probe at any point in the mission after launch.

The thrusters cause stress, but not more than a theoretical combined maximum of 13.3N distributed among 16 thrusters. The load-bearing structures are designed to handle this.

During the entirety of a gravity assist, the spacecraft is in free fall, so it will not experience any acceleration. There will only be a tiny tidal force due to one end of the spacecraft being slightly closer to the central body than the opposite end.

As for thermal stress, heat soak is an issue, but the manufacturer of the thruster makes sure that the thrusters are adequately cooled by radiation. Other components can see some heat radiation from the thrusters' plume, but it is important to note that these things are tiny, and do not produce a lot of heat to begin with.

$\endgroup$
  • 2
    $\begingroup$ After handling the stress during launch, the load-bearing structures have to handle very weak stress caused by the forces from the thrusters. $\endgroup$ – Uwe Dec 16 '17 at 11:15

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.