CAMBRIDGE 39, MASSACHUSETTS

COPY# OF THIS YOCUMENT CONTAINS

/'x

/$S-COPIES

f-3

PAGES

R- 41 0 GENERAL DESIGN CHARACTERISTICS O F THE APOLLO GUIDANCE COMPUTER ABSTRACT

This report describes the Apollo Guidance Computer in its general design characteristics, flexibility, reliability, and inflight repair capabilities. Since the Command Module computer and LEM computer differ basically only in form factor and theref o r e weight and volume, the characteristics detailed here apply I to both types of computer. by EldonC. May 1 9 6 3
Hall

TABLE OF CONTENTS

Page . I I1 I11 IV Computer Characteristics.

. . Computer Flexibility . . . . Reliability . . . . . . . Inflight Repairs . . . . .
a
e
I

. . . . . . . . . . .
a
. 1

e

. .
I

1

. I

12 15
19

a

I

I

APPENDIX I . APPENDIX I1 APPENDIX111

. .

.

a

. . . . . . . . . .
I

I

.
a

. 22
a

. . . . . . .

LIST REFERENCES OF

. . . . . . . . . . . . , . . . . . . . . . .
e
a

26

a

e

II

.
, ,

34
38

iv

SECTION I COMPUTER CHARACTERISTICS The Command Module (C/M) computer and the LEM computer are electrically the same with interchangeable pluggable subassemblies. The form factors of the two computers are different, therefore the volume and weight of the two are different. The C / M computer is just under 2 cubic feet (see Fig. 1) ( 2 cubic feet is the space in the C / M allocated for the computer) and weighs approximately 110 lbs. This volume and weight contains the mechanical structure to support and interconnect the electronic modules, transfer the heat to the cold plate interface of the spacecraft, provide the electrical wiring channels f o r the G & N spacecraft interface, and last, provide storage space for spare parts since the computer does not use all the allocated space. The LEM computer (Fig. 2) is contained in a volume of approximately 0, 9 cubic feet and weighs approximately 50 lbs. Figure 3 is a picture of the C/M computer using the LEM packaging form factors. The volume of this design is 1. 5 cubic feet and it would weigh around 70 lbs. There is space within the volume allocated to add a complete tray of spare parts for the computer. See Appendix I.
A s has been stated, both

of t h e s e c o m p u t e r s a r e e l e c t r i -

cally the same and include all interfaces with the presently understood LEM and C/M systems. Therefore, the following discussion of the functional capabilities of the computer applies to both of these computers. The C /M computer is required to operate two
G & N system at the navi-

display panels, one associated with the

gational bay, the other associated with the spacecraft's main display panel. T h i s computer has 24, 576 words of fixed memory. Present thinking on the LEM computer is that there w i l l be only one computer display panel and the memory capacity will be 1 2 , 288 words of fixed memory. A brief description of the computer characteristics are contained in Table I.
1

u E 0 a c 2 C .

.

23 Psec 9 3 .registers’ + z) 234 Psec 971.7 psec 24. 1 Psec 1 1 . with overflow correction Memory Cycle Time (MCT) Wired-in (Core memory Rope) - 11. 576 words C / M configuration 12. 7 psec 20 counters 4 5 25 16 -e J Pulsed outputs under program control P u l s e d o u t w t s not under program control (Timing signals for Telemetry: Signal processing for both up telemetry (or PACE digital command system) and down telemetry.Load. Increment.258 words LEM configuration -I Erasable memory (Coincident current Ferrite) Normal order code Involuntary instructions (Interrupt.Power Word Length: 1 6 bits (15 b i t s t parity) Number System: one’s complement. Table I AGC Characteristics .Start) Interrupt options Add instruction time 1 1024 words 11 instructions 8 instructions 5 options . 6’psec \”- Multdply (excluding Index) Double precision Add subroutine (X+X) + IY + y) = ( Z Double precision multiply subroutine Counter incrementing Number of counters (input) Discrete input r e g i s t e r s Discrete outputs .

l- I I 5 .

The central registers participate in the instructions and cause the desired mathematical transformations to be effected. it also has properties that make it ind&s. These using semiconductor networks (micrologic gates a r e the same as those use'd throughout the computer for decoding operation codes and addresses. R-408. This group contains input and output registers which communicate between the computer and the rest of the Apollo system. These three types of m e m o r y a r e employed to optimize requirements for reliability and flight maintenance without sacrificing the flexibility requirements of the guidance computer. consisting of 16 r e g i s t e r s .truetible short of mechanical dam age. t h e r e is no inflight failure that candestroy this part of the memory. But they also require a comparatively long time to read from and write into (about 12 psec).To further define the memory capacity and speed. Appendixlil. 000 words. which was extracted from of these characteristics. The permanent memory requires very few active components and very little power to operate. contains a description The AGC uses three types of memory circuits. The central registers and the input-output registers are made NOR gates). The t e m p o r a r y or erasable memory is a coincident current type similar to those used in most computers made in recent years. modified instructions. high output. and input data. h a s a read-write time of about 2 ~ s e and is about a 1000 t i m e s l a r g e r in volume c than the other two types of memory. and low drive power requirements. The cores are ceramic instead of metal but display the same characteristics. Both of these types of m e m o r y are relatively economical and dense in terms of the number of words per unit volume. It holds about a 1 0 2 4 words. generating control . The third type of memory. very low temperature sensitivity. we must look in detail at the characteristics of the machine. that is. that is. The second type is for the temporary storage of intermediate results. one is for a permanent storage of instructions and constants and holds about 24.

To further elaborate on the speed capabilities of the machine. The interpreter's main advantage is that it conserves memory and makes the programming of complicated arithmetic operations much easier. 6 is a logic stick containing 1. double precision add. double precision add of 234ysec. T h e r e a r e 72 interpreter instructions presently available:::. that is. Figure 5 is a picture of a rope memory stick which contains 2048 words of storage. Charles A. To increase the capabilities of the machine from the programming point of view and to reduce the memory required for processing complicated computational functions. Therefore.024 words of storage. A List Processing Interpreter for AGC 4. That is. 6 psec.20 micrologic elements. The programmer can program the machine in machine language and realize the speeds quoted in the table for the basic machine. and double precision multiply of 971psec. When the interpreter is used. interpreter instructions have been employed in the AGC. All of t h e s e f u n c t i o n s a r e r e f e r r e d t o as logic circuits. The speed of the computer depends in part on the transition times of the various logic elements used and upon the memory cycle time required to read and write into the memory which is 11. These a r e instructions such as vector operations of various types. and Fig. 1/ 7 / 6 2 7 I . double precision a d d requires approximately 1440 v s e c and double precision multiply requires about 2690 psec. These numbers apply when the ma- chine is programmed in what is called basic machine language. multiply instruction time of 93.. Muntz.alonger time than when done in basic machine language. 4 psec.signals. these double precision add and double precision multiply instructionst&ke. When computational time is not important. Figure 4 is a picture of an erasable memory which contains 1. and double precision rhultiply. pulse forming networks and translating networks. 7 p s e c . a trade off exists between speed and memory consumed. :: I MIT/IL AGC Memo # 2 . we should consider the numbers quoted in the table. the add instruction time 23.

w i l l be done in basic machine language. is a very fast machine when operating in basic machine language and a very powerful computational tool when~programmed with the interpreter. In general. telemetry. such as: operation of the displays. the AGC do not require high speed computation. the interpreter instructions are designed for the navigational computations involved and normally In conclusion. .the programmer can use the interpreter language and realize the savings in memory at the cost of machine speed. data processing. The counter incrementing and interrupt features also save time and storage capacity required for the computer to service the interface functions. and the G & N control. Many of the control type functions that the computer is r e q u i r e d t o do.

9 .

.

11 .

B. Eight double precision words are required to be changed at these times. The data could be read in via the keyboard in the spacecraft. the advantages of the fixed memory far outweigh any disadvantage that may arise in changing memory. Changes Required to Repair a P r o g r a m "Goof" It is this type of change which cannot be anticipated 12 . The data required for a s t r o dynamic constants w i l l be p r e p a r e d w e l l in advance of an anticipated flight. A. C. the following list is stated. Changes due toAstrodynamicConstants Every two weeks these constants w i l l have t o b e changed.Launch Window The new data is updated by the digital command syst e m of PACE every fifteen minutes during the countdown. One might think that the fixed memory would make the machine somewhat less flexible than other machines with nondestruct type permanent storage. However with the techniques now available to build this memory in modular form (2048 words / module). To change these constants one plug-in fixed memory module w i l l have to be changed. This data is read in automatically into the erasable memory.SECTION I1 COMPUTER FLEXIBILITY In the previous section the capabilities of the computer were described. To explore the requirements of the system which will r e - quire changing the data stored in the computer memory. and memory modules built for each two week interval of anticipated launch.Changesdueto. From this description it is clear that the computer is a fast machine with a very large fixed memory for prog r a m s t o r a g e .

and will require time to provide"3 new memory module. Also. 13 . the module can be constructed during the time the program verification is being accomplished. The programming and verification cycle is independent of the type of memory used. When considering the time required to produce a new memory (see Fig. During system check-out a "goof" need not delay the new check-out proceedures since the program changes can be made and read into the erasable memory for checking until the fixed memory module is complete. 7) it is clear that the actual fabrication time is a s m a l l p a r t of the overall problem of programming and verification of the program. The actual replacement of the bad module can be done in a f e w minutes at any point in the check-out sequence.

7 Time Diagram Line .1 z 4 a 0 n RECOGNIZE FORMULATE PROBLEM SOLUTION I 0 U I f w I I a I FABRICATE & CHECK MEMORY MODULE 1 3 1 RECHECK AGC SIMULATOR 1 DAYS 4 I 14 SIMULATE NEW PROGRAM 7 I I I I I I I 1 3 I1 1 0 TIME DAYS 1 7 24 25 i n Fig.

t h e r e is no projection into the future for increased component liability. also tests are being run to determine failure modes and i f possible to obtain a failure rate that has a higher confidence level than the one used. That is. The computation of the MTBF in R-395 indicates the section of the computer with the highest failure rate is the logic section which contains the micrologic gate elements" This results from the large volume usage of micrologic and the component failure rate assumed. To reduce this predicted failure rate t h e r e is considerable work in analysis and specification of these logic elements. one should make the further comment that from the past history of these computers it is determined that the welded type connection is at l e a s t a n o r d e r of magnitude more reliable than the solder type connections. the computations in R-395 have assumed re- w i l l produce that failure in any single component in the computer a failure of the computer. In mentioning failures due to connections. the failure rates that a r e being realized on these computers in the field a r e due t o f a i l u r e s of interconnections rather than failures of components. 15 . MIT has made reliability predictions on computers in the past using the same basic assumption and philosophy of reliability prediction. Therefore. It has been demonstrated that these MTBF predictions a r e at least a factor of 4 lower than the MTBF rehlized in field operation.SECTION I11 RELIABILITY The MTBF that has been quoted in R-395 and in discussions concerning the reliability of the computer is one that is a r r i v e d at using present day figures on semiconductors and parts. In addition. Also it is well established on computers using present day components that interconnections have been a greater cause for failure than components themselves.

O Z o / ~ / l O O O hours. It is not quite as c l e a r what the trade of.3 9 5 is 0 . and it is desirable to repair this failure. the computer is operated in idle mode for a large percentage of the time. It has been suggested that the Apollo computer should be designed using redundancy to increase the MTBF. The packaging and production techniques that are employed in the Apollo computer are identical to the techniques which have been used in production computers for several years at Raytheon where the Apollo computer is being produced.from the point of view of volume. and process controls have been improved and optimized f o r Apollo. It is therefore clear that the failure rate com- puted f o r the micrologic section of the computer is higher than should be expected.fs a r e when considering inflight repair. since in many cases a large percentage of the failures can be attributed to the processes used in the assembly of the final computer from the basic components. Taking this fact into account. conditions. This long production history will reduce the failures due to production problems to a minimum. The failure rate assumed in R . Redundancy is clearly undesirable . O l % / l O O O hours (6) . the bugs in these techniques have been worked out. the M T H F for the complete mission becomes 4000 hours. the production techniques are well established. By extrapolating this failure rate to the worst case computer operating conditions. When discussing reliability one should discuss the production techniques used to build a computer. The M T B F quoted in R . the failure rate would be 0. According to present planning of the mission profile.3 9 5 (4) assumes the computer is operating at full power 100% of the time. 044”$00/1000hours when operated in high stres:. weight and power. Another paint .From data published by the vendor micrologic failure rates are lower than 0. however it is easy to say that i f t h e r e is any inflight failure. the r e p a i r of the redundant computer is more difficult. More data and tests a r e r e q u i r e d t o f u r t h e r verify these predictions. Therefore.

>I< . form of the machine should have an MTBF many orders of magnitude greater than the mission time. R. shouldbemade:triplicated. 17 . 8 shows the comparison.Spartan Books pp. I : Wilcox. The redundant machine has a higher probability of s u c c e s s n e a r z e r o t i m ebut the probability of success drops more rapidly and is lower than that of the nonredundant machine after an elapsed time equal to the MTBF of the nonredundant machine. . A s a result an effective MTBF which is very high can be quoted.majority-typelogiccircuitsactually reduce the MTBF rather than increase it since there are more To illustrate this. H. W. the nonredundant components involved in the redundant machine. 3 6 7 . andMann. . C . . RedundancyTechniques for ComputingSystems. Also t h e s t a r t of the mission must be near zero time on the probability curve to make the probability of s u c c e s s v e r y high. To make redundancy pay. Fig.

I .8 REDUNDANT MACHINE 0 c) 3 v) 0.4 m NON REDUNDANT MACHINE a a 0 02 . I I .6 > a > k c A " m Q 0. 8 Comparison of Non-redundant vs Redundant Computers .o v) v) w 0.5 ~ I r I 0.5 I I.o NORMALIZED TIME + r issi-on n Fig.

In this approach. Therefore.inflight repair. An inflight repair philosophy is contained in has been done on techAppendix HI. Recentlymorework niques for inflight repair''). down t o t h r e e o r less replaceable units. The Micro the front of Monitor plugs into the computer test connector at one tray and makes it possible to force transfer of control directly t o any desired memory location and read the contents of any location. The first of these approaches employs a device called the Micro Monitor which is designed to communicate with the computer when the malfunction makes the displays inoperative. The second approach is more systematic and by using it a single failure in a replaceable module can be repaired with certainty in about 1. 99995. wenow have two approaches to accomplish. One half of all possible failures can be repaired in 20 minutes. 966. we m u s t r e l y on inflight repair in order to realize the required probability of s u c c e s s of 0. A s a result of this investigation.SECTION IV INFLIGHT REPAIR Since this computer has an inflight MTBF of 4000 hours. 5 hours. The disadvantages of this approach are that the Micro Monitor must be c a r r i e d on board (the estimated weight is 5 t o 10 lbs) and that the operator must exercise considerable thought as well as*follow bugging. The Micro Monitor is a scaled down version of t h e e s s e n t i a l p a r t s of the GSE equipment required for computer de- is known to be effective in direct proportion to the training and native skill of the operator and would enable a moderately skilled operator to isolate a l a r g e c l a s s of failures quite readily. This device defined procedures to isolate a fault. An operator with training of three to six months should be able to locate faults and repair the computer within an hour. which is called the 19 . the probability of s u c c e s s is 0.

Figure 9 is a curve of the probability of s u c c e s s as a function of time. 5 hours. another group of modules are replaced. the universal tool for extracting modules and one spare module for each different kind. The only aids required are the procedures on microfilm. the operator replaces certain groups of modules and then attempts to run a check problem using the display and keyboard. With the present mechanical design this replacement and check procedure w i l l accomplish the repair with certainty in about 1. which takes about 10 minutes. has a probability of successful repair of 35%. Using well defined procedures. if not. a spare module is a s s u m e d for every different kind of module (of the 2 9 spare modules). If the check can be accomplished the failure has been repaired.“Systematic replacement” method. The first step in the procedure. e t c . 20 .

PROBABILITY OF SUCCESSFUL REPAIR r u ’ a b. b 0 0 0 C .

APPENDIX I Using the LEM packaging form factors the computer will fit into the space allocated in the C / M (see Fig. The two trays f o r logic and fixed memory a r e located in the center. 0 0 0 words. Since fixed memory is now only one half a tray the memory capacity is reduced to 1 2 . the power supply and erasable mcmory tray on the lower right hand side with the G & N to C / M interface connectors directly above this tray. The three modules labeled rope and the four labeled driver module is 6000 words of memory and its electronics. One half of this tray contains the erasable memory and i t s of the tray contains the power supply. lower equipment bay). assembly directly above the computer. 1 0 which is a photograph of this configuration in the mock-up of the C/M. Four sections like this in the fixed memory tray w i l l hold 2 4 . electronics. Fig. 0 0 0 words of memory and all the driver electronics.. Fig. . The other half In this L E M configuration this t r a y m a r r i e s with one half of the fixed memory tray to become one of the two trays required for the L E M computer. Four sections of t h e logic modules in the logic tray make up the complete logic section of the machine. Note the power and servo Note also the space on the left of the computer for a complete tray of spare modules. 11 is a side view of the computer tray assembly with both logic and rope memory modules shown plugged into the t r a y connector. 1 2 is the power supply and erasable memory tray.

.

24 .

d h P E ' a . 25 . k a .

the permanent memory can be compared to a punched paper tape. In this way. consisting of s i x t e e n r e g i s t e r s . and memory. It holds about 1024 words. and input data. It a l s o h a s properties that make it indestructible short of mechanical damage. and the computer can be returned t o full operation without extensive reprogramming and data entry. The only way to destroy the information on the paper tape is to mechanically destroy the tape. which communicate between the computer and the rest of the Apollo system. .000 words. has a read-write time of about two microseconds. these can be repaired. These three types of memory are employed t o optimize the requirements for reliability and inflight maintenance without sacrificing the speed and flexibility requirements of the Apollo Guidance Computer. The permanent memory requires very few . A second type is for temporary storage of i n t e r mediate results. The major disadvantage . and the Central registers which participate in the steps within instructions that cause the desired mathematical transformations to be effected. that is. active components and very little power to operate. modified instructions. MEMORY AND LOGIC The AGC u s e s t h r e e t y p e s of memory circuits. The third type of memory. but they also require a comparatively long time to read from and write into (about 1 2 microseconds). and holds about 24. One is for permanent storage of instructions and constants. This group contains the input and output is about 1000 times larger than sixteen words of the first two types of registers. This property permits electronic failures to occur. t h e r e is no inflight failure of any kind that can destroy t h i s p a r t of the memory.A P P E N D I X IT A. Both of these types of memory are relatively economical and dense in terms of number of words per unit volume.

Data that must be changed during inflight computations or for last minute mission changes is stored in the second type memory. the "PACE" digitalcommandsystembeforelaunch. In case of inflight failure that destroys the information in this memory the computation can be restarted v e r y few w o r d s . The type of data stored in the permanent memory can be determined well in advance and any changes would require serious consideration and extensive studies before making changes. This disadvantage. the up telemetry link during flight. s o named for its physical resemblance to a rope. is not s e r i o u s in the light of the inflight reliability advantages. It is estimated that the time required to build the memory is less than two weeks and takes only a few minutes to install in the computer.Of the permanent memory is that it takes time to make changes in the information stored since a new memory module must be built when a change is required. of the astronaut's keyboard. A group of 21 wires threading 1024 toroidal permalloy cores in a certain way can be made to carry currents such that any desired core w i l l reverse the direction of its magnetization. 2. 3. Data may be entered into this memory via any one of three methods: 1. The Rope. by reading in only a . which was developed at MIT/IL for a deep space probe computer.makes use of the non-linear magnetic properties of a ferromagnetic alloy called Permalloy. the time lag of a few weeks for construction of the new memory. The permanent memory employs a device called a Rope. the temporary storage.

and ISR switches it. To switch core 2 apply IIA and 12* and ISR To switch core 3 apply IIB and IBA and ISR . . Afterwards. The effect is the same as that in a .To switch core 4 apply IIA and IZA and ISR The inhibit currents prevent switching in the cores they thread. To switch core 1 apply IIB and 12Band ISR. A switching core induces. but not in the wires which do not thread the core. I26 4 Core Rope Selection (sense lines not shown) The following is an example of the method used to switch the flux in one of the 1 0 2 4 c o r e s .a detectable voltage between the ends of a sense wire which threads the core.ROPE 1 . When one c u r r e n t of each pair is applied only one core is free to switch. . Two p a i r s of inhibit wires and a set-reset wire are employed. Ten pairs of inhibit currents select one of 1024 c o r e s . ISR is r e v e r - sed to restore the core to its initial state.

it may be said that each core stores four 1 6 bit words. A r r a y s s i m i l a r t o t h e s e a r e used in most computers made in recent years. e. The address or location of a word is defined by the particular core which is switching. the information in them cannot be altered electrically. ERASABLE MEMORY \ 29 . Unlike the rope. Thus a sense line w i l l generate a binary one or zero for each core. Ropes are wired-in storage. but display nearly the same characteristics. The cores are ceramic instead of metal. The number of sense lines in the AGC r o p e s is 6 4 and since the AGC word size is defined as 1 6 bits. depending on whether or not it threads the core. The temporary or Erasable memory employs a large numb e r of very small magnetic cores arranged in what is known as a c o i n c i d e n t c u r r e n t a r r a y . called sense lines.transformer. A num- ber of such wires. the Erasable memory requires a separate core for each bit of a word since the value of a bit is determined by the direction of the last previous reversal of t h e c o r e ' s m a g n e t i s m as opposed to the geometric nature of storage in a rope (i. where a wire through a c o r e is in effect a secondary winding with which one can sense changes in the core flux. and by which of the four sets of 1 6 sense lines is being looked at. are threaded through the cores in the Rope. whether a w i r e t h r e a d s a c o r e or not).

The speed of operation codes and addresses. generation of output signals. . one writes. or just logic. T h e C e n t r a l r e g i s t e r s a r e m a d e of t r a n s i s t o r c i r c u i t s generally known as flip-flops. and its transition time is l e s s t h a n a tenth of a microsecond. are pulsed in the reverse direction.The following is a brief description of the function of the erasable memory. in which case the core will remain at zero. If a voltage is induced at that time in the sense wire it means that the core w a s initially in the To write into the core. control of input signals. One core. This is fast enough for signals to propagate through various stages to develop the necessary results in the time allotedby the 1 2 m i c r o second memory cycle time. The NOR gates used in the Central registers a r e used throughout the computer for various purposes. Information is represented by the direction of t h e c o r e ' s magnetization. generation of a computer depends in part upon the transition times of the various logical elements used. unless there is c u r rent in the write inhibit wire at write time. for the flip-flop. the select currents one direction. - 30 CONFIDENT& . plus two more to act as read and write gates. but switches when t h e r e is current in both. and one s e n s e s . The core is insensitive to current in a single select wire. or NOR gates. This w i l l switch the core to a one unless inhibit current is simultaneously applied. and is detected by trying t o switch the core to the zero direction. such as decoding of control signals. Two wires select. threaded by four wires stores a bit. Each bit of storage requires two basic logical "building blocks". In the AGC the NOR gate is the only type of logical element needed to make all of the necessary logic circuits. and all of the other pulse forming and translating networks which are r e ferred t o as logic circuits.

The instruction set uses a central register called an accumulator.B. The instructions include the four basic arithmetic operations of Addition. or p r o g r a m s which were known t o be desired for the Apollo mission. They were chosen from a wide variety of candidates on the basis of their usefulness in connection with the types of instruction sequences. One instruction is used to modify the instruction which follows it by adding t o it the contents of a specified memory register. which forms a word composed of the bit by bit logical products of the two operand words. One t r a n s fers from the accumulator to memory. There a r e eleven instructions in the repertoire of the AGC. and for how expensive they would be t o i m p l e m e n t in t e r m s of equipment. One s p e c i - fies an address at which to begina new sequence of instructions.andDivision. T h e r e a r e t h r e e 'data handling instructions for the transfer of numbers between the memory and the accumulator.of the number in memory to the accumulator. There are two sequence-breaking instructions. The other causes the computer to skip one or more instructions if the operand is of a particular sign and magnitude.and one logical operation. INSTRUCTIONS t. It gets its name from the fact that the sum of two operands is placed there by an addition. Mask.Subtraction. One transfers the negative . whose function is t o s t o r e one of the operands for instructions involving two operands. The other exchanges the contents of accumulator and memory. C.Multiplication. s o that the sum of several numbers can be accumulated by a s e r i e s of additions. INCREMENTS AND INTERRUPTS The AGC includes some non-voluntary instructions which 31 .

They a r e frequently found in computers required to operate within timedependent systems. Events which require special immediate attention can cause the computer to transfer control to a sequence designed to cope with the event. Both increments and interrupts w i l l occur as a m a t t e r of course. is in analog to digital conver- sion. The speed with which the computer can execute a sequence of ordinary instructions is reduced as the activity of increments and interrupts increases. They a r e executed when c e r t a i n s i g nals from outside the computer cause the computer to interject them at a convenient point. A subsequent resume operation returns the computer to the original program at the point at which it was interrupted. display time markers. Pulses which indicate changes in the positions of i n s t r u m e n t a r m a t u r e s a r e a c c u m u l a t e d i n t h e i r respective counters as they occur. subtracting one. and do not imply system abnormality when they occur. The execution time of a n 32 . keyboard entries. and certain armature zero signals. The primary use of these registers. reading the status of electromechanical measuring instruments to high precision. to keep track of output pulses from the AGC to other subsystems. There are two types of non-voluntary instructions in AGC. e .s e t it apart from a typical general purpose computer. There a r e twenty r e g i s t e r s which can be s o treated. The second type of involuntary instruction is the program interrupt. Other counters a r e used to keep a r e c o r d of time. preselected time markers. Six different events a r e s o treated: certain system error signals. One causes a register in erasable memory to be altered. either by adding E. and to receive informationfrom the ground control center via the up tklemetry link or the PACE command system. i. These instructions are not under the control of the instruction sequence. without the need of scanning by elaborate programs. up link word completion. and forty separate input signals which can cause them t o be s o treated. . called counters. or doubling.

These pulses are routed to various destinations by output r e g i s t e r s which a r e s i m i l a r t o t h e c e n t r a l r e g i s t e r s i n t h a t t h e y a r e m a d e of flip-flops. 400. Others a r e sent to the telemetry interface circuit to be transmitted to the ground control center. Others provide commands to other spacecraft systems. 000 per second. 5. e t c . 100. If i n c r e m e n t r e q u e s t s a r r i v e a t a total rate of 85. 800. 6. The inputs to the computer are of two classes. scale. 78125. 3. and otherwise operate them. 4 0 0 p u l s e s p e r second. Some control the numerical computer displays to the crew of the spacecraft. The various bits of the words stored in the output registers control the various pulse outputs. upto 1 0 2 . 200. 1. 5625. where composites of input bits may be processed like other computer words. ordinary instruction execution is virtually stopped. 2 5 . 25. One is the c l a s s of pulse inputs t o the counter increment circuit and the is t h e c l a s s of pulse o r D. 50. 125. The pulses originate in generates pulsed wave forms a circuit called a scaler which of 0. C. . since increment requests take precedence over instructions. The other inputs to the input registers. INPUT AND OUTPUT The AGC supplies pulses at controlled rates and in controlled numbers to the electromechanical components of the guidance system in order to orient. 1 2 . .increment is about 1 2 microseconds. Some output bits have functions other than pulse rate generation. D. program interrupt circuit.

Dave Gilbert Subj:InflightTesting Gentlemen: In the meetings on Feb. 4. 1. There w i l l be a m e t e r in the IFTS. Ground -~ & Rules Requirements & Maintenance These are copied from the minutes of the MIT/MSC Pace Meetings of Feb. The following is the first cut at a definition of this AGC inflight test philosophy. for fault 7. NASA requested information on the test philosophy for the AGC. Sufficient access points are required to isolate faults An additional assumption is that only single failures will be considered. to within 3 or 4 modules. 1963. 6.APPENDIX 1 1 1 AG $67-63 15 March 1963 NASA Manned Spacecraft Center Houston 1. There w i l l be a scanning comparator in the IFTS. the ground rules for inflight testing were defined. 2 7 . There may be a movable probe (presumably connected to the meter). Only replaceable modules w i l l be checked. . 2 7 and 2 8 . 5. but may add one if a requirement is shown. 3. with various representatives ofNASA. 2.2 8 . Texas Attn: M r . No oscilloscope. The astronaut and the vehicle may be used isolation.

Requirements on IFTS MIT requires that the following points be connected to the inflight test system for test and maintenance of the AGC subsystem. Even assuming a 'scope. Fault Detection To meet the requirements for inflight maintenance. in most cases. Excessive cabling would be required between the IFTS and the AGC. C. The loading due to the capacity in the cabling to the IFTS would. e. It would be necessary to provide buffering circuits. the signals sent to IFTS. prevent proper functioning of the computer. 2 5 cps square wave) for observation of the oscillation on the meter. 1. Temperature Power monitoring points GND + 3 V (A) +3V(B) +13V 3. e . 1 m s e c . The AGC has self testing capability. There . There are no further requirements on the IFTS for the reasons listed below: a. The circuits and displays provided are capable of detecting faults and can be used t o isolate these faults to repairable sub-assemblies. d. b. Abnormal behavior of other G&N sub-systems and computer self test routines w i l l detect the remaining 1 0 % of the failures. 2. The testing equipment provided (i. the meter) is inadequate for examining signals with rise times of the order of . it is doubtful that it could be of much help because there are very few computer poiuta at which a stationary pattern may be expected. the AGC w i l l rely heavily on self testing programs and on various error detecting circuits designed into the computer. Lowest frequency scaler signal (1. During normal operating modes of the G&N System. the G&N alarm indicators and the function of the computer display and controls w i l l be capable of detecting at least 90% of all possible failures in the computer sub-assembly. .

Briefly these instructions are as follows: 1. it may be isolated to less than 5 replaceable sub-assemblies. The one exception to this is the clock synch t o t h e S / C central timing system.may be a v e r y s m a l l p e r c e n t a g e of faults which will require comparison with ground tracking data in order to detect the fault. therefore they may be used to check each other by comparison tests. 2. For faults in the displays: Displays are redundant. Here a self t e s t plug is used to connect computer output into computer inputs. It is also assumed that step-by-step instructions will be available for the astronaut. operating in parallel. Exercising the G&N or the S/C can detect the remaining faults . the computer self test routines w i l l be capable of detecting 98% of all faults in the G&N. These routines and procedures will isolate faults in the G&N System to within or without the AGC. Fault Location To accomplish fault location. T h e s e r o u t i n e s a r e not II debugging" or maintenance routines. These routines w i l l check that all the instructions are properly executed and that both memory and arithmetic units are operating correctly. These lists will have . For faults in the input /output of the computer: Another s e t of s u b r o u t i n e s a r e used with the AGC disconnected from the G & N and S/C. Maintenance In general. they a r e intended for rapid checking of the correctness of the AGC. the maintenance procedure consists of matching the symptoms exhibited by the AGC (the alarms in particular) with check lists available for the astronaut. During checkout modes of operation. 3. If the fault is within the AGC. The likelihood' of these tests being completed successfully if t h e r e are malfunctions in memory control or arithmetic units is e x t r e m e l y s m a l l . it is assumed that all computer inputs and outputs can be decoupled from the other subsystems. For faults internal to AGC: A s e r i e s of subroutines is initialed through the keyboard by the astronaut. It w i l l not be interrupted unless there is a failure in the clock. The routines called for in this case check that all interfaces a r e there and that they are electrically sound.

Very truly yours. etc. Eldon C. 37 . To accomplish the repair it is assumed for the purpose of t h i s r e p o r t t h a t t h e r e a r e 100% s p a r e s . With this assumption better than 98% of the faults can be located to one stick by replacing one of the 3 t o 5 sticks suspected of fa'aults then repeating the self tests described. The tools required to remove sticks is assumed to be part of S/C supplies. H a l l Division Director Computer Development ECH:ms Dist .indications of probable causes of the failure and operation instructions for further tests or an indication of stick at fault. until the faulty stick is removed.

1962.Ramon. Partridge. and. 3.May1963. Wilcox.Albert. Massachusetts Institute of Technology. Alonso. 7. . Cambridge 39. A. A List P r o c e s s i n g 6. Spartan Books. p. May 1963. Massachusetts Institute of Technology. R. RedundancyTechniques 367. andBlaiASmith H. D D Memo#90.Cambridge 39. Massachusetts. Mayo.George E. W.Charles A.LIST OF REFERENCES 1. R-393. I1 AGC Inflight Repair.CONFIDENTIAL.CONFIDENTIAL.Mann. 2.February1963.DesignConcepts of theApolloGuidance Computer.. May 196 3 . D D Memo#88. Hopkins. Hopkins. f o r Computing Systems. M I T / I L AGC Memo # 2 . 5.andKruszewski'.Alonso.Jayne. R. Muntz. Logical Description f o r the Apollo Guidance Computer.CONFIDENTIAL.FailureRateEstimate of the Fairchild Micrologic. 4. Interpreter for ACC 4. I AGC MalfunctionDetection. Apollo Guidance and Navigation System Reliability Apportionments and Inertial Analysis. George W. C. .Wesco.. . Instrumentation Laboratory. AGC Memo #4.R-408. Instrumentation Laboratory. H. Massachusetts. J a n u a r y 7. R-395. 38 .

S e a r s L. Halzel R. I. Nugent E. B e r r y NAA ( 2 ) W. Weintz A. Hopkins F.Neilson C. F l a n d e r s I. Olsson N. Toth R. R. F l e m i n g L. T. Wrigley External Distribution NASA ( 50 ) W. C h e r r y W. F e l i x J. Shansky H. H e n r y NASA S. P a r k e r J. B e r k G. P o t t e r D. M. Chilton NASA P. C r o c k e r M. Dunipace (Cape Canaverall R. R. Bean E. D r o u g a s J. Cushman J. Kupfer D.Rhine NASA ( 3 ) S. S t i r l i n g A F Inspectors F. Copps G. Bryant John Miller R. Laats T.Woodbury W. Alonso Apollo L i b r a r y ( 2 ) W.Weaton W. Donaghey Raytheon c/o WESCO ( 2 ) . P. Nevins J. K r a m e r W. Shuck W. G r e g o r e k NAA R. R. Dahlen E . R y k e r c / o AC S p a r k P l u g F. Lawton Samuelian Sarmanian Scholten Therrien R. Boyd J.C. E b e r s o l e NASA ( 2 ) Maj. W e a t h e r b e e Maj. Koso M. Mayo John McNeil James Miller R. Sherman (Lincoln) T. Houston R. Johnston B. Lickly G.Hickey A. Duggan Eldon Hall E. Magee MIT/IL Library ( 6 ) G. Ladd A. F e l l e m a n W. T r a g e s e r D. Wilk E. Hoag P. S t a m e r i s E. Todd NAA ( 6 ) AC S p a r k P l u g ( 1 0 ) Grumman ( 6 ) Kollsman (10) Raytheon (1 0) J . Katz D. G r a n t D. Battin P . Boyce R. Gediman F. Bow ditch A. K. J a n s s o n M. G r a fc / oK o l l s m a n L. Hanley W.APOLLO DISTRIBUTION LIST M. Dunbar K. E u v r a r d P.