Tenths of a Second Since 2000 — Java Bug Hunt

Briefing

Modelled on the loss of NASA's Deep Impact spacecraft in August 2013. Contact was lost in August 2013 and the mission was declared over the following month. The probable cause NASA's team described was a time-keeping limit: the fault-protection software counted time in tenths of a second since 1 January 2000, and that count no longer fitted in 32 bits once it passed 2^32 tenths — in August 2013 — leaving the onboard computers unable to keep a sensible clock.

This reconstruction keeps the flight software's time tags in a long but still masks them to 32 bits, so the tag wraps back to a small number at the boundary and fault protection sees time run backwards.

Fix SpacecraftClock so time tags keep counting past 2^32 tenths.

Bug report

BUG-DI-2013 · Priority: Critical · Reported by: mission operations

SpacecraftClock:

• toTag(secondsSince2000) returns tenths of a second since 2000-01-01T00:00:00 — exactly secondsSince2000 * 10, for any mission time representable in a long (no wrap at 2^32 = 4,294,967,296 tenths)
• toSeconds(tag) is the inverse (tag / 10)
• elapsedTenths(earlier, later) is later - earlier

FaultProtection.check(previous, current) (locked) resets the computer when time goes backwards or jumps more than a day between readings.

Observed: two readings one second apart, straddling 429,496,729.6 s after 2000 (August 2013), produce tags 4294967290 and 4 — fault protection resets, and keeps resetting.

Logs

[fp] tag prev=4294967290 cur=4 step=-4294967286
[fp] CLOCK_FAULT_RESET (1 of n)
[fp] CLOCK_FAULT_RESET (2 of n)

The code as shipped

src/clock/SpacecraftClock.java (editable)

class SpacecraftClock {
    // Time tags count tenths of a second since 2000-01-01T00:00:00, stored in
    // the 32-bit field the flight software was specified with.
    static final long TAG_MASK = 0xFFFFFFFFL;

    static long toTag(long secondsSince2000) {
        return (secondsSince2000 * 10) & TAG_MASK;
    }

    static long toSeconds(long tag) {
        return tag / 10;
    }

    static long elapsedTenths(long earlierTag, long laterTag) {
        return laterTag - earlierTag;
    }
}

Read-only context: src/clock/FaultProtection.java.