Killing our own voter in orbit, on purpose

ESA’s go-ahead for a second run came on 20 October, with no date. Everything public says confirmed, not scheduled, and will until ESA names a slot.

The first run showed a stuck replica and a kill. The second asks four more questions in one package. Segment one runs the shrinking quorum through a lifecycle: a self-test at tick 20, a bit flip at 30, a hang at 60, a stuck replica at 120, and a bit stuck in the last replica’s result register at tick 1,280. That tick is a known-answer test tick, every 64, so the test fails on the tick the fault appears, the replica is retired, and the run halts at 1,281 with no wrong result delivered. Cap 80 seconds. Segment two is fixed TMR on the same schedule, cap 30: correct to tick 119, then disagreement on every tick. Segment three runs the shrinking quorum with a checkpoint every 100 ticks, and after 30 seconds the script kills it with SIGKILL. Our own process, in user space, nothing on the platform touched. The checkpoint is copied aside and the voter restarts for 30 seconds more and resumes from it, with two replicas, not three, because the stuck one is hardware state.

The kill makes the shell print “Killed” and the voter exit 137. The README tells ESA to expect both.

In ESA’s image on the laptop the whole run takes 109 seconds. v0.4.0 was tagged, the package built from the release and run again: 111 seconds, the segment one event log identical, 698 correct and zero wrong, halted at 1,281. At a 2% share, to mimic the flight processor, segment one halts after 40 seconds against its 80.

The package went out that night. The reply to ESA had promised it within a week.