Antenna diodes in the Pentium processor

I was studying the silicon die of the Pentium processor and noticed some puzzling structures where signal lines were connected to the silicon substrate for no apparent reason. Two examples are in the photo below, where the metal wiring (orange) connects to small square regions of doped silicon (gray), isolated from the rest of the circuitry. I did some investigation and learned that these structures are "antenna diodes," special diodes that protect the circuitry from damage during manufacturing. In this blog post, I discuss the construction of the Pentium and explain how these antenna diodes work.

Closeup of the Pentium die showing the silicon and bottom metal layer. The arrows indicate connections to two antenna diodes. I removed the top two layers of metal for this photo.

Intel released the Pentium processor in 1993, starting a long-running brand of high-performance processors: the Pentium Pro, Pentium II, and so on. In this post, I'm studying the original Pentium, which has 3.1 million transistors.1 The die photo below shows the Pentium's fingernail-sized silicon die under a microscope. The chip has three layers of metal wiring on top of the silicon so the underlying silicon is almost entirely obscured.

The Pentium die with the main functional blocks labeled. Click this photo (or any other) for a larger version.

Modern processors are built from CMOS circuitry, which uses two types of transistors: NMOS and PMOS. The diagram below shows how an NMOS transistor is constructed. A transistor can be considered a switch between the source and drain, controlled by the gate. The source and drain regions (green) consist of silicon doped with impurities to change its semiconductor properties, forming N+ silicon. The gate consists of a layer of polysilicon (red), separated from the silicon by an absurdly thin insulating oxide layer. Since the oxide layer is just a few hundred atoms thick,2 it is very fragile and easily damaged by excess voltage. (This is why CMOS chips are sensitive to static electricity.) As we will see, the oxide layer can also be damaged by voltage during manufacturing.

Diagram showing the structure of an NMOS transistor.

The Pentium processor is constructed from multiple layers. Starting at the bottom, the Pentium has millions of transistors similar to the diagram above. Polysilicon wiring on top of the silicon not only forms the transistor gates but also provides short-range wiring. Above that, three layers of metal wiring connect the parts of the chip. Roughly speaking, the bottom layer of metal connects to the silicon and polysilicon to construct logic gates from the transistors, while the upper layers of wiring travel longer distances, with one layer for signals traveling horizontally and the other layer for signals traveling vertically. Tiny tungsten plugs called vias provide connections between the different layers of wiring. A key challenge of chip design is routing, directing signals through the multiple layers of wiring while packing the circuitry as densely as possible.

The photo below shows a small region of the Pentium die with the three metal layers visible. The golden vertical lines are the top metal layer, formed from aluminum and copper. Underneath, you can see the horizontal wiring of the middle metal layer. The more complex wiring of the bottom metal layer can be seen, along with the silicon and polysilicon that form transistors. The small black dots are the tungsten vias that connect metal layers, while the larger dark circles are contacts with the underlying silicon or polysilicon. Near the bottom of the photo, the vertical gray bands are polysilicon lines, forming transistor gates. Although the chip appears flat, it has a three-dimensional structure with multiple layers of metal separated by insulating layers of silicon dioxide. This three-dimensional structure will be important in the discussion below. (The metal wiring is much denser over most of the chip; this region is one of the rare spots where all the layers are visible.)

Closeup of the Pentium die showing the metal layers. The L-shaped hook towards the lower left is a connection to an antenna diode. This photo shows a tiny part of the floating point unit. To show all the layers in focus, I combined multiple images with focus stacking.

The manufacturing process for an integrated circuit is extraordinarily complicated but I'll skip over most of the details and focus on how each metal layer is constructed, layer by layer. First, a uniform metal layer is constructed over the silicon wafer. Next, the desired pattern is produced on the surface using a process called photolithography: a light-sensitive chemical called "resist" is applied to the wafer and exposed to light through a patterned mask. The light hardens the resist, creating a protective coating with the pattern of the desired wiring. Finally, the unprotected metal is etched away, leaving the wiring.

In the early days of integrated circuits, the metal was removed with liquid acids, a process called wet etching. Inconveniently, wet etching tended to eat away metal underneath the edges of the mask, which became a problem as integrated circuits became denser and the wires needed to be thinner. The solution was dry etch, using a plasma to remove the metal. By applying a large voltage to plates above and below the chip, a gas such as HCl is ionized into a highly reactive plasma. This plasma attacks the surface (unless it is protected by the resist), removing the unwanted metal. The advantage of dry etching is that it can act vertically (anisotropically), providing more control over the line width.

Although plasma etching improved the etching process, it caused another problem: plasma-induced oxide damage, also called (metaphorically) the "antenna effect."3 The problem is that long metal wires on the chip could pick up an electrical charge from the plasma, producing a large voltage. As described earlier, the thin oxide layer under a transistor's gate is sensitive to voltage damage. The voltage induced by the plasma can destroy the transistor by blowing a hole through the gate oxide or it can degrade the transistor's performance by embedding charges inside the oxide layer.4

Several factors affect the risk of damage from the antenna effect. First, only the transistor's gate is sensitive to the induced voltage, due to the oxide layer. If the wire is also connected to a transistor's source or drain, the wire is "safe" since the source and drain provide connections to the chip's substrate, allowing the charge to dissipate harmlessly. Note that when the chip is completed, every transistor gate is connected to another transistor's source or drain (which provides the signal to the gate), so there is no risk of damage. Thus, the problem can only occur during manufacturing, with a metal line that is connected to a gate on one end but isn't connected on the other end. Moreover, the highest layer of metal is "safe" since everything is connected at that point. Another factor is that the induced voltage is proportional to the length of the metal wire, so short wires don't pose a risk. Finally, only the metal layer currently being etched poses a risk; since the lower layers are insulated by the thick oxide between layers, they won't pick up charge.

These factors motivate several ways to prevent antenna problems.5 First, a long wire can be broken into shorter segments, connected by jumpers on a higher layer. Second, moving long wires to the top metal layer eliminates problems.6 Third, diodes can be added to drain the charge from the wire; these are called "antenna diodes". When the chip is in use, the antenna diodes are reverse-biased so they have no electrical effect. But during manufacturing, the antenna diodes let charge flow to the substrate before it causes problems.

The third solution, the antenna diodes, explains the mysterious connections that I saw in the Pentium. In the diagram below, these diodes are visible on the die as square regions of doped silicon. The larger regions of doped silicon form PMOS transistors (upper) and NMOS transistors (lower). The polysilicon lines are faintly visible; they form transistor gates where they cross the doped silicon. (For this photo, I removed all the metal wiring.)

Closeup of the Pentium die showing transistors. The metal and polysilicon layers have been removed to show the silicon.

Confusingly, the antenna diodes look almost identical to "well taps", connections from the substrate to the chip's positive voltage supply, but have a completely different purpose. In the Pentium, the PMOS transistors are constructed in "wells" of N-type silicon. These wells must be raised to the chip's positive voltage, so there are numerous well tap connections from the positive supply to the wells. The well taps consist of squares of N+ doped silicon in the the N-type silicon well, providing an electrical connection. On the other hand, the antenna diodes also consist of N+ doped silicon, but embedded in P-type silicon. This forms a P-N junction that creates the diode.

In the Pentium, antenna diodes are used for only a small fraction of the wiring. The diodes require extra area on the die, so they are used only when necessary. Most of the antenna problems on the Pentium were apparently resolved through routing. Although the antenna diodes are relatively rare, they are still frequent enough that they caught my attention.

Antenna effects are still an issue in modern integrated circuits. Integrated circuit fabricators provide rules on the maximum allowable size of antenna wires for a particular manufacturing process.7 Software checks the design to ensure that the antenna rules are not violated, modifying the routing and inserting diodes as necessary. Violating the antenna rules can result in damaged chips and a very low yield, so it's more than just a theoretical issue.

Thanks to /r/chipdesign and Discord for discussion. If you're interested in the Pentium, I've written about standard cells in the Pentium, and the Pentium as a Navajo rug. Follow me on Mastodon (@[email protected]) or Bluesky (@righto.com) or RSS for updates.

Notes and references

1. In this post, I'm looking at the Pentium model 80501 (codenamed P5). This model was soon replaced with a faster, lower-power version called the 80502 (P54C). Both are considered original Pentiums. ↩

2. IC manufacturing drives CPU performance states that gate oxide thickness was 100 to 300 angstroms in 1993. ↩

3. The wires are acting metaphorically as antennas, not literally, as they collect charge, not picking up radio waves.

   Plasma-induced oxide damage gave rise to research and conferences in the 1990s to address this problem. The International Symposium on Plasma- and Process-Induced Damage started in 1996 and continued until 2003. Numerous researchers from semiconductor companies and academia studied the causes and effects of plasma damage. ↩

4. The damage is caused by "Fowler-Nordheim tunneling", where electrons tunnel through the oxide and cause damage. Flash memory uses this tunneling to erase the memory; the cumulative damage is why flash memory can only be written a limited number of times. ↩

5. Some relevant papers: Magnetron etching of polysilicon: Electrical damage (1991), Thin-oxide damage from gate charging during plasma processing (1992), Antenna protection strategy for ultra-thin gate MOSFETs (1998), Fixing antenna problem by dynamic diode dropping and jumper insertion (2000). The Pentium uses the "dynamic diode dropping" approach, adding antenna diodes only as needed, rather than putting them in every circuit. I noticed that the Pentium uses extension wires to put the diode in a more distant site if there is no room for the diode under the existing wiring. As an aside, the third paper uses the curious length unit of kµm; by calling 1000 µm a kµm, you can think in micrometers, even though this unit is normally called a mm. ↩

6. Sources say that routing signals on the top metal prevents antenna violations. However, I see several antenna diodes in the Pentium that are connected directly from the bottom metal (M1) through M2 to long lines on M3. These diodes seem redundant since the source/drain connections are in place by that time. So there are still a few mysteries... ↩

7. Foundries have antenna rules provided as part of the Process Design Kit (PDK). Here are the rules for MOSIS and SkyWater. I've focused on antenna effects from the metal wiring, but polysilicon and vias can also cause antenna damage. Thus, there are rules for these layers too. Polysilicon wiring is less likely to cause antenna problems, though, as it is usually restricted to short distances due to its higher resistance. ↩

Reverse-engineering a three-axis attitude indicator from the F-4 fighter plane

We recently received an attitude indicator for the F-4 fighter plane, an instrument that uses a rotating ball to show the aircraft's orientation and direction. In a normal aircraft, the artificial horizon shows the orientation in two axes (pitch and roll), but the F-4 indicator uses a rotating ball to show the orientation in three axes, adding azimuth (yaw).1 It wasn't obvious to me how the ball could rotate in three axes: how could it turn in every direction and still remain attached to the instrument?

The attitude indicator. The "W" forms a stylized aircraft. In this case, it indicates that the aircraft is climbing slightly. Photo from CuriousMarc.

We disassembled the indicator, reverse-engineered its 1960s-era circuitry, fixed some problems,2 and got it spinning. The video clip below shows the indicator rotating around three axes. In this blog post, I discuss the mechanical and electrical construction of this indicator. (The quick explanation is that the ball is really two hollow half-shells attached to the internal mechanism at the "poles"; the shells rotate while the "equator" remains stationary.)

The F-4 aircraft

The indicator was used in the F-4 Phantom II3 so the pilot could keep track of the aircraft's orientation during high-speed maneuvers. The F-4 was a supersonic fighter manufactured from 1958 to 1981. Over 5000 were produced, making it the most-produced American supersonic aircraft ever. It was the main US fighter jet in the Vietnam War, operating from aircraft carriers. The F-4 was still used in the 1990s during the Gulf War, suppressing air defenses in the "Wild Weasel" role. The F-4 was capable of carrying nuclear bombs.4

An F-4G Phantom II Wild Weasel aircraft. From National Archives.

The F-4 was a two-seat aircraft, with the radar intercept officer controlling radar and weapons from a seat behind the pilot. Both cockpits had a panel crammed with instruments, with additional instruments and controls on the sides. As shown below, the pilot's panel had the three-axis attitude indicator in the central position, just below the reddish radar scope, reflecting its importance.5 (The rear cockpit had a simpler two-axis attitude indicator.)

The cockpit of the F-4C Phantom II, with the attitude indicator in the center of the panel. Click this photo (or any other) for a larger version. Photo from National Museum of the USAF.

The attitude indicator mechanism

The ball inside the indicator shows the aircraft's position in three axes. The roll axis indicates the aircraft's angle if it rolls side-to-side along its axis of flight. The pitch axis indicates the aircraft's angle if it pitches up or down. Finally, the azimuth axis indicates the compass direction that the aircraft is heading, changed by the aircraft's turning left or right (yaw). The indicator also has moving needles and status flags, but in this post I'm focusing on the rotating ball.6

The indicator uses three motors to move the ball. The roll motor (below) is attached to the frame of the indicator, while the pitch and azimuth motors are inside the ball. The ball is held in place by the roll gimbal, which is attached to the ball mechanism at the top and bottom pivot points. The roll motor turns the roll gimbal and thus the ball, providing a clockwise/counterclockwise movement. The roll control transformer provides position feedback. Note the numerous wires on the roll gimbal, connected to the mechanism inside the ball.

The attitude indicator with the cover removed.

The diagram below shows the mechanism inside the ball, after removing the hemispherical shells of the ball. When the roll gimbal is rotated, this mechanism rotates with it. The pitch motor causes the entire mechanism to rotate around the pitch axis (horizontal here), which is attached along the "equator". The azimuth motor and control transformer are behind the pitch components, not visible in this photo. The azimuth motor turns the vertical shaft. The two hollow hemispheres of the ball attach to the top and bottom of the shaft. Thus, the azimuth motor rotates the ball shells around the azimuth axis, while the mechanism itself remains stationary.

The components of the ball mechanism.

Why doesn't the wiring get tangled up as the ball rotates? The solution is two sets of slip rings to implement the electrical connections. The photo below shows the first slip ring assembly, which handles rotation around the roll axis. These slip rings connect the stationary part of the instrument to the rotating roll gimbal. The black base and the vertical wires are attached to the instrument, while the striped shaft in the middle rotates with the ball assembly housing. Inside the shaft, wires go from the circular metal contacts to the roll gimbal.

The first set of slip rings. Yes, there is damage on one of the slip ring contacts.

Inside the ball, a second set of slip rings provides the electrical connection between the wiring on the roll gimbal and the ball mechanism. The photo below shows the connections to these slip rings, handling rotation around the pitch axis (horizontal in this photo). (The slip rings themselves are inside and are not visible.) The shaft sticking out of the assembly rotates around the azimuth (yaw) axis. The ball hemisphere is attached to the metal disk. The azimuth axis does not require slip rings since only the ball shells rotates; the electronics remain stationary.

Connections for the second set of slip rings.

The servo loop

In this section, I'll explain how the motors are controlled by servo loops. The attitude indicator is driven by an external gyroscope, receiving electrical signals indicating the roll, pitch, and azimuth positions. As was common in 1960s avionics, the signals are transmitted from synchros, which use three wires to indicate an angle. The motors inside the attitude indicator rotate until the indicator's angles for the three axes match the input angles.

Each motor is controlled by a servo loop, shown below. The goal is to rotate the output shaft to an angle that exactly matches the input angle, specified by the three synchro wires. The key is a device called a control transformer, which takes the three-wire input angle and a physical shaft rotation, and generates an error signal indicating the difference between the desired angle and the physical angle. The amplifier drives the motor in the appropriate direction until the error signal drops to zero. To improve the dynamic response of the servo loop, the tachometer signal is used as a negative feedback voltage. This ensures that the motor slows as the system gets closer to the right position, so the motor doesn't overshoot the position and oscillate. (This is sort of like a PID controller.)

This diagram shows the structure of the servo loop, with a feedback loop ensuring that the rotation angle of the output shaft matches the input angle.

In more detail, the external gyroscope unit contains synchro transmitters, small devices that convert the angular position of a shaft into AC signals on three wires. The photo below shows a typical synchro, with the input shaft on the top and five wires at the bottom: two for power and three for the output.

A synchro transmitter.

Internally, the synchro has a rotating winding called the rotor that is driven with 400 Hz AC. Three fixed stator windings provide the three AC output signals. As the shaft rotates, the phase and voltage of the output signals changes, indicating the angle. (Synchros may seem bizarre, but they were extensively used in the 1950s and 1960s to transmit angular information in ships and aircraft.)

The schematic symbol for a synchro transmitter or receiver.

The attitude indicator uses control transformers to process these input signals. A control transformer is similar to a synchro in appearance and construction, but it is wired differently. The three stator windings receive the inputs and the rotor winding provides the error output. If the rotor angle of the synchro transmitter and control transformer are the same, the signals cancel out and there is no error output. But as the difference between the two shaft angles increases, the rotor winding produces an error signal. The phase of the error signal indicates the direction of error.

The next component is the motor/tachometer, a special motor that was often used in avionics servo loops. This motor is more complicated than a regular electric motor. The motor is powered by 115 volts AC, 400-Hertz, but this isn't sufficient to get the motor spinning. The motor also has two low-voltage AC control windings. Energizing a control winding will cause the motor to spin in one direction or the other.

The motor/tachometer unit also contains a tachometer to measure its rotational speed, for use in a feedback loop. The tachometer is driven by another 115-volt AC winding and generates a low-voltage AC signal proportional to the rotational speed of the motor.

A motor/tachometer similar (but not identical) to the one in the attitude indicator).

The photo above shows a motor/tachometer with the rotor removed. The unit has many wires because of its multiple windings. The rotor has two drums. The drum on the left, with the spiral stripes, is for the motor. This drum is a "squirrel-cage rotor", which spins due to induced currents. (There are no electrical connections to the rotor; the drums interact with the windings through magnetic fields.) The drum on the right is the tachometer rotor; it induces a signal in the output winding proportional to the speed due to eddy currents. The tachometer signal is at 400 Hz like the driving signal, either in phase or 180º out of phase, depending on the direction of rotation. For more information on how a motor/generator works, see my teardown.

The amplifier

The motors are powered by an amplifier assembly that contains three separate error amplifiers, one for each axis. I had to reverse engineer the amplifier assembly in order to get the indicator working. The assembly mounts on the back of the attitude indicator and connects to one of the indicator's round connectors. Note the cutout in the lower left of the amplifier assembly to provide access to the second connector on the back of the indicator. The aircraft connects to the indicator through the second connector and the indicator passes the input signals to the amplifier through the connector shown above.

The amplifier assembly.

The amplifier assembly contains three amplifier boards (for roll, pitch, and azimuth), a DC power supply board, an AC transformer, and a trim potentiometer.7 The photo below shows the amplifier assembly mounted on the back of the instrument. At the left, the AC transformer produces the motor control voltage and powers the power supply board, mounted vertically on the right. The assembly has three identical amplifier boards; the middle board has been unmounted to show the components. The amplifier connects to the instrument through a round connector below the transformer. The round connector at the upper left is on the instrument case (not the amplifier) and provides the connection between the aircraft and the instrument.8

The amplifier assembly mounted on the back of the instrument. We are feeding test signals to the connector in the upper left.

The photo below shows one of the three amplifier boards. The construction is unusual, with some components stacked on top of other components to save space. Some of the component leads are long and protected with clear plastic sleeves. The board is connected to the rest of the amplifier assembly through a bundle of point-to-point wires, visible on the left. The round pulse transformer in the middle has five colorful wires coming out of it. At the right are the two transistors that drive the motor's control windings, with two capacitors between them. The transistors are mounted on a heat sink that is screwed down to the case of the amplifier assembly for cooling. The board is covered with a conformal coating to protect it from moisture or contaminants.

One of the three amplifier boards.

The function of each amplifier board is to generate the two control signals so the motor rotates in the appropriate direction based on the error signal fed into the amplifier. The amplifier also uses the tachometer output from the motor unit to slow the motor as the error signal decreases, preventing overshoot. The inputs to the amplifier are 400 hertz AC signals, with the phase indicating positive or negative error. The outputs drive the two control windings of the motor, determining which direction the motor rotates.

The schematic for the amplifier board is below. The two transistors on the left amplify the error and tachometer signals, driving the pulse transformer. The outputs of the pulse transformer will have opposite phase, driving the output transistors for opposite halves of the 400 Hz cycle. One of the transistors will be in the right phase to turn on and pull the motor control AC to ground, while the other transistor will be in the wrong phase. Thus, the appropriate control winding will be activated (for half the cycle), causing the motor to spin in the desired direction.

Schematic of one of the three amplifier boards. (Click for a larger version.)

It turns out that there are two versions of the attitude indicator that use incompatible amplifiers. I think that the motors for the newer indicators have a single control winding rather than two. Fortunately, the connectors are keyed differently so you can't attach the wrong amplifier. The second amplifier (below) looks slightly more modern (1980s) with a double-sided circuit board and more components in place of the pulse transformer.

The second type of amplifier board.

The pitch trim circuit

The attitude indicator has a pitch trim knob in the lower right, although the knob was missing from ours. The pitch trim adjustment turns out to be rather complicated. In level flight, an aircraft may have its nose angled up or down slightly to achieve the desired angle of attack. The pilot wants the attitude indicator to show level flight, even though the aircraft is slightly angled, so the indicator can be adjusted with the pitch trim knob. However, the problem is that a fighter plane may, for instance, do a vertical 90º climb. In this case, the attitude indicator should show the actual attitude and ignore the pitch trim adjustment.

I found a 1957 patent that explained how this is implemented. The solution is to "fade out" the trim adjustment when the aircraft moves away from horizontal flight. This is implemented with a special multi-zone potentiometer that is controlled by the pitch angle.

The schematic below shows how the pitch trim signal is generated from the special pitch angle potentiometer and the pilot's pitch trim adjustment. Like most signals in the attitude indicator, the pitch trim is a 400 Hz AC signal, with the phase indicating positive or negative. Ignoring the pitch angle for a moment, the drive signal into the transformer will be AC. The split windings of the transformer will generate a positive phase and a negative phase signal. Adjusting the pitch trim potentiometer lets the pilot vary the trim signal from positive to zero to negative, applying the desired correction to the indicator.

The pitch trim circuit. Based on the patent.

Now, look at the complex pitch angle potentiometer. It has alternating resistive and conducting segments, with AC fed into opposite sides. (Note that +AC and -AC refer to the phase, not the voltage.) Because the resistances are equal, the AC signals will cancel out at the top and the bottom, yielding 0 volts on those segments. If the aircraft is roughly horizontal, the potentiometer wiper will pick up the positive-phase AC and feed it into the transformer, providing the desired trim adjustment as described previously. However, if the aircraft is climbing nearly vertically, the wiper will pick up the 0-volt signal, so there will be no pitch trim adjustment. For an angle range in between, the resistance of the potentiometer will cause the pitch trim signal to smoothly fade out. Likewise, if the aircraft is steeply diving, the wiper will pick up the 0 signal at the bottom, removing the pitch trim. And if the aircraft is inverted, the wiper will pick up the negative AC phase, causing the pitch trim adjustment to be applied in the opposite direction.

Conclusions

The attitude indicator is a key instrument in any aircraft, especially important when flying in low visibility. The F-4's attitude indicator goes beyond the artificial horizon indicator in a typical aircraft, adding a third axis to show the aircraft's heading. Supporting a third axis makes the instrument much more complicated, though. Looking inside the indicator reveals how the ball rotates in three axes while still remaining firmly attached.

Modern fighter planes avoid complex electromechanical instruments. Instead, they provide a "glass cockpit" with most data provided digitally on screens. For instance, the F-35's console replaces all the instruments with a wide panoramic touchscreen displaying the desired information in color. Nonetheless, mechanical instruments have a special charm, despite their impracticality.

For more, follow me on Mastodon as @[email protected] or RSS. (I've given up on Twitter.) I worked on this project with CuriousMarc and Eric Schlapfer, so expect a video at some point. Thanks to John Pumpkinhead and another collector for supplying the indicators and amplifiers.

Notes and references

Specifications9

1. This three-axis attitude indicator is similar in many ways to the FDAI (Flight Director Attitude Indicator) that was used in the Apollo space flights, although the FDAI has more indicators and needles. It is more complex than the Soyus Globus, used for navigation (teardown), which rotates in two axes. Maybe someone will loan us an FDAI to examine...
    ↩

2. Our indicator has been used as a parts source, as it has cut wires inside and is missing the pitch trim knob, several needles, and internal adjustment potentiometers. We had to replace two failed capacitors in the power supply. There is still a short somewhere that we are tracking down; at one point it caused the bond wire inside a transistor to melt(!). ↩

3. The aircraft is the "Phantom II" because the original Phantom was a World War II fighter aircraft, the McDonnell FH Phantom. McDonnell Douglas reused the Phantom name for the F-4. (McDonnell became McDonnell Douglas in 1967 after merging with Douglas Aircraft. McDonnell Douglas merged into Boeing in 1997. Many people blame Boeing's current problems on this merger.) ↩

4. The F-4 could carry a variety of nuclear bombs such as the B28EX, B61, B43 and B57, referred to as "special weapons". The photo below shows the nuclear store consent switch, which armed a nuclear bomb for release. (Somehow I expected a more elaborate mechanism for nuclear bombs.) The switch labels are in the shadows, but say "REL/ARM", "SAFE", and "REL". The F-4 Weapons Delivery Manual discusses this switch briefly.

   

   The nuclear store consent switch, to the right of the Weapons System Officer in the rear cockpit. Photo from National Museum of the USAF.

    ↩

5. The photo below is a closeup of the attitude indicator in the F-4 cockpit. Note the Primary/Standby toggle switch in the upper-left. Curiously, this switch is just screwed onto the console, with exposed wires. Based on other sources, this appears to be the standard mounting. This switch is the "reference system selector switch" that selects the data source for the indicator. In the primary setting, the gyroscopically-stabilized inertial navigation system (INS) provides the information. The INS normally gets azimuth information from the magnetic compass, but can use a directional gyro if the Earth's magnetic field is distorted, such as in polar regions. See the F-4E Flight Manual for details.

   

   A closeup of the indicator in the cockpit of the F-4 Phantom II. Photo from National Museum of the USAF.

   The standby switch setting uses the bombing computer (the AN/AJB-7 Attitude-Reference Bombing Computer Set) as the information source; it has two independent gyroscopes. If the main attitude indicator fails entirely, the backup is the "emergency attitude reference system", a self-contained gyroscope and indicator below and to the right of the main attitude indicator; see the earlier cockpit photo. ↩

6. The diagram below shows the features of the indicator.

   

   The features of the Attitude Director Indicator (ADI). From F-4E Flight Manual TO 1F-4E-1.

   The pitch steering bar is used for an instrument (ILS) landing. The bank steering bar provides steering information from the navigation system for the desired course. ↩

7. The roll, pitch, and azimuth inputs require different resistances, for instance, to handle the pitch trim input. These resistors are on the power supply board rather than an amplifier board. This allows the three amplifier boards to be identical, rather than having slightly different amplifier boards for each axis. ↩

8. The attitude indicator assembly has a round mil-spec connector and the case has a pass-through connector. That is, the aircraft wiring plugs into the outside of the case and the indicator internals plug into the inside of the case. The pin numbers on the outside of the case don't match the pin numbers on the internal connector, which is very annoying when reverse-engineering the system. ↩

9. In this footnote, I'll link to some of the relevant military specifications.

   The attitude indicator is specified in military spec MIL-I-27619, which covers three similar indicators, called ARU-11/A, ARU-21/A, and ARU-31/A. The three indicators are almost identical except the the ARU-21/A has the horizontal pointer alarm flag and the ARU-31/A has a bank angle command pointer and a bank scale at the bottom of the indicator, along with a bank angle command pointer adjustment knob in the lower left. The ARU-11/A was used in the F-111A. (The ID-1144/AJB-7 indicator is probably the same as the ARU-11/A.) The ARU-21/A was used in the A-7D Corsair. The ARU-31/A was used in the RF-4C Phantom II, the reconnaissance version of the F-4. The photo below shows the cockpit of the RF-4C; note that the attitude indicator in the center of the panel has two knobs.

   

   Cockpit panel of the RF-4C. Photo from National Museum of the USAF.

   The indicator was part of the AN/ASN-55 Attitude Heading Reference Set, specified in MIL-A-38329. I think that the indicator originally received its information from an MD-1 gyroscope (MIL-G-25597) and an ML-1 flux valve compass, but I haven't tracked down all the revisions and variants.

   Spec MIL-I-23524 describes an indicator that is almost identical to the ARU-21/A but with white flags. This indicator was also used with the AJB-3A Bomb Release Computing Set, part of the A-4 Skyhawk. This indicator was used with the integrated flight information system MIL-S-23535 which contained the flight director computer MIL-S-23367.

   My indicator has no identifying markings, so I can't be sure of its exact model. Moreover, it has missing components, so it is hard to match up the features. Since my indicator has white flags it might be the ID-1329/A.

    ↩

Inside a ferroelectric RAM chip

Ferroelectric memory (FRAM) is an interesting storage technique that stores bits in a special "ferroelectric" material. Ferroelectric memory is nonvolatile like flash memory, able to hold its data for decades. But, unlike flash, ferroelectric memory can write data rapidly. Moreover, FRAM is much more durable than flash and can be be written trillions of times. With these advantages, you might wonder why FRAM isn't more popular. The problem is that FRAM is much more expensive than flash, so it is only used in niche applications.

Die of the Ramtron FM24C64 FRAM chip. (Click this image (or any other) for a larger version.)

This post takes a look inside an FRAM chip from 1999, designed by a company called Ramtron. The die photo above shows this 64-kilobit chip under a microscope; the four large dark stripes are the memory cells, containing tiny cubes of ferroelectric material. The horizontal greenish bands are the drivers to select a column of memory, while the vertical greenish band at the right holds the sense amplifiers that amplify the tiny signals from the memory cells. The eight whitish squares around the border of the die are the bond pads, which are connected to the chip's eight pins.1 The logic circuitry at the left and right of the die implements the serial (I²C) interface for communication with the chip.2

The history of ferroelectric memory dates back to the early 1950s.3 Many companies worked on FRAM from the 1950s to the 1970s, including Bell Labs, IBM, RCA, and Ford. The 1955 photo below shows a 256-bit ferroelectric memory built by Bell Labs. Unfortunately, ferroelectric memory had many problems,4 limiting it to specialized applications, and development was mostly abandoned by the 1970s.

A 256-bit ferroelectric memory made by Bell Labs. Photo from Scientific American, June, 1955.

Ferroelectric memory had a second chance, though. A major proponent of ferroelectric memory was George Rohrer, who started working on ferroelectric memory in 1968. He formed a memory company, Technovation, which was unsuccessful, and then cofounded Ramtron in 1984.5 Ramtron produced a tiny 256-bit memory chip in 1988, followed by much larger memories in the 1990s.

How FRAM works

Ferroelectric memory uses a special material with the property of ferroelectricity. In a normal capacitor, applying an electric field causes the positive and negative charges to separate in the dielectric material, making it polarized. However, ferroelectric materials are special because they will retain this polarization even when the electric field is removed. By polarizing a ferroelectric material positively or negatively, a bit of data can be stored. (The name "ferroelectric" is in analogy to "ferromagnetic", even though ferroelectric materials are not ferrous.)

This FRAM chip uses a ferroelectric material called lead zirconate titanate or PZT, containing lead, zirconium, titanium, and oxygen. The diagram below shows how an applied electric field causes the titanium or zirconium atom to physically move inside the crystal lattice, causing the ferroelectric effect. (Red atoms are lead, purple are oxygen, and yellow are zirconium or titanium.) Because the atoms physically change position, the polarization is stable for decades; in contrast, the capacitors in a DRAM chip lose their data in milliseconds unless refreshed. FRAM memory will eventually wear out, but it can be written trillions of times, much more than flash or EEPROM memory.

The ferroelectric effect in the PZT crystal. From Ramtron Catalog, cleaned up.

To store data, FRAM uses ferroelectric capacitors, capacitors with a ferroelectric material as the dielectric between the plates. Applying a voltage to the capacitor will create an electric field, polarizing the ferroelectric material. A positive voltage will store a 1, and a negative voltage will store a 0.

Reading a bit from memory is a bit tricky. A positive voltage is applied, forcing the material into the 1 state. If the material was already in the 1 state, minimal current will flow. But if the material was in the 0 state, more current will flow as the capacitor changes state. This allows the 0 and 1 states to be distinguished.

Note that reading the bit destroys the stored value. Thus, after a read, the 0 or 1 value must be written back to the capacitor to restore its previous state. (This is very similar to the magnetic core memory that was used in the 1960s.)6

The FRAM chip that I examined uses two capacitors per bit, storing opposite values. This approach makes it easier to distinguish a 1 from a 0: a sense amplifier compares the two tiny signals and generates a 1 or a 0 depending on which is larger. The downside of this approach is that using two capacitors per bit reduces the memory capacity. Later FRAMs increased the density by using one capacitor per bit, along with reference cells for comparison.7

A closer look at the die

The diagram below shows the main functional blocks of the chip.8 The memory itself is partitioned into four blocks. The word line decoders select the appropriate column for the address and the drivers generate the pulses on the word and plate lines. The signals from that column go to the sense amplifiers on the right, where the signals are converted to bits and written back to memory. On the left, the precharge circuitry charges the bit lines to a fixed voltage at the start of the memory cycle, while the decoders select the desired byte from the bit lines.

The die with the main functional blocks labeled.

The diagram below shows a closeup of the memory. I removed the top metal layer and many of the memory cells to reveal the underlying structure. The structure is very three-dimensional compared to regular chips; the gray squares in the image are cubes of PZT, sitting on top of the plate lines. The brown rectangles labeled "top plate connection" are also three-dimensional; they are S-shaped brackets with the low end attached to the silicon and the high end contacting the top of the PZT cube. Thus, each PZT cube forms a capacitor with the plate line forming the bottom plate of the capacitor, the bracket forming the top plate connection, and the PZT cube sandwiched in between, providing the ferroelectric dielectric. (Some cubes have been knocked loose in this photo and are sitting at an angle; the cubes form a regular grid in the original chip.)

Structure of the memory. The image is focus-stacked for clarity.

The physical design of the chip is complicated and quite different from a typical planar integrated circuit. Each capacitor requires a cube of PZT sandwiched between platinum electrodes, with the three-dimensional contact from the top of the capacitor to the silicon. Creating these structures requires numerous steps that aren't used in normal integrated circuit fabrication. (See the footnote9 for details.) Moreover, the metal ions in the PZT material can contaminate the silicon production facility unless great care is taken, such as using a separate facility to apply the ferroelectric layer and all subsequent steps.10 The additional fabrication steps and unusual materials significantly increase the cost of manufacturing FRAM.

Each top plate connection has an associated transistor, gated by a vertical word line.11 The transistors are connected to horizontal bit lines, metal lines that were removed for this photo. A memory cell, containing two capacitors, measures about 4.2 µm × 6.5 µm. The PZT cubes are spaced about 2.1 µm apart. The transistor gate length is roughly 700 nm. The 700 nm node was introduced in 1993, while the die contains a 1999 copyright date, so the chip appears to be a few years behind the cutting edge as far as node.

The memory is organized as 256 capacitors horizontally by 512 capacitors vertically, for a total of 64 kilobits (since each bit requires two capacitors). The memory is accessed as 8192 bytes. Curiously, the columns are numbered on the die, as shown below.

With the metal removed, the numbers are visible counting the columns.

The photo below shows the sense amplifiers to the right of the memory, with some large transistors to boost the signal. Each sense amplifier receives two signals from the pair of capacitors holding a bit. The sense amplifier determines which signal is larger, deciding if the bit is a 0 or 1. Because the signals are very small, the sense amplifier must be very sensitive. The amplifier has two cross-connected transistors with each transistor trying to pull the other signal low. The signal that starts off larger will "win", creating a solid 0 or 1 signal. This value is rewritten to memory to restore the value, since reading the value erases the cells. In the photo, a few of the ferroelectric capacitors are visible at the far left. Part of the lower metal layer has come loose, causing the randomly strewn brown rectangles.

The sense amplifiers.

The photo below shows eight of the plate drivers, below the memory cells. This circuit generates the pulse on the selected plate line. The plate lines are the thick white lines at the top of the image; they are platinum so they appear brighter in the photo than the other metal lines. Most of the capacitors are still present on the plate lines, but some capacitors have come loose and are scattered on the rest of the circuitry. Each plate line is connected to a metal line (brown), which connects the plate line to the drive transistors in the middle and bottom of the image. These transistors pull the appropriate plate line high or low as necessary. The columns of small black circles are connections between the metal line and the silicon of the transistor underneath.

The plate driver circuitry.

Finally, here's the part number and Ramtron logo on the die.

Closeup of the logo "FM24C64A Ramtron" on the die.

Conclusions

Ferroelectric RAM is an example of a technology with many advantages that never achieved the hoped-for success. Many companies worked on FRAM from the 1950s to the 1970s but gave up on it. Ramtron tried again and produced products but they were not profitable. Ramtron had hoped that the density and cost of FRAM would be competitive with DRAM, but unfortunately that didn't pan out. Ramtron was acquired by Cypress Semiconductor in 2012 and then Cypress was acquired by Infineon in 2019. Infineon still sells FRAM, but it is a niche product, for instance satellites that need radiation hardness. Currently, FRAM costs roughly $3/megabit, almost three orders of magnitude more expensive than flash memory, which is about $15/gigabit. Nonetheless, FRAM is a fascinating technology and the structures inside the chip are very interesting.

For more, follow me on Mastodon as @[email protected] or RSS. (I've given up on Twitter.) Thanks to CuriousMarc for providing the chip, which was used in a digital readout (DRO) for his CNC machine.

Notes and references

1. The photo below shows the chip's 8-pin package.

   

   The chip is packaged in an 8-pin DIP. "RIC" stands for Ramtron International Corporation.

    ↩

2. The block diagram shows the structure of the chip, which is significantly different from a standard DRAM chip. The chip has logic to handle the I²C protocol, a serial protocol that uses a clock and a data line. (Note that the address lines A0-A2 are the address of the chip, not the memory address.) The WP (Write Protect) pin, protects one quarter of the chip from being modified. The chip allows an arbitrary number of bytes to be read or written sequentially in one operation. This is implemented by the counter and address latch.

   

   Block diagram of the FRAM chip. From the datasheet.

    ↩

3. An early description of ferroelectric memory is in the October 1953 Proceedings of the IRE. This issue focused on computers and had an article on computer memory systems by J. P. Eckert of ENIAC fame. In 1953, computer memory systems were primitive: mercury delay lines, electrostatic CRTs (Williams tubes), or rotating drums. The article describes experimental memory technologies including ferroelectric memory, magnetic core memory, neon-capacitor memory, phosphor drums, temperature-sensitive pigments, corona discharge, or electrolytic diodes. Within a couple of years, magnetic core memory became successful, dominating storage until semiconductor memory took over in the 1970s, and most of the other technologies were forgotten. ↩

4. A 1969 article in Electronics discussed ferroelectric memories. At the time, ferroelectric memories were used for a few specialized applications. However, ferroelectric memories had many issues: slow write speed, high voltages (75 to 150 volts), and expensive logic to decode addresses. The article stated: "These considerations make the future of ferroelectric memories in computers rather bleak." ↩

5. Interestingly, the "Ram" in Ramtron comes from the initials of the cofounders: Rohrer, Araujo, and McMillan. Rohrer originally focused on potassium nitrate as the ferroelectric material, as described in his patent. (I find it surprising that potassium nitrate is ferroelectric since it seems like such a simple, non-exotic chemical.) An extensive history of Ramtron is here. A Popular Science article also provides information. ↩

6. Like core memory, ferroelectric memory is based on a hysteresis loop. Because of the hysteresis loop, the material has two stable states, storing a 0 or 1. While core memory has a hysteresis loop for magnetization with respect to the magnetic field, ferroelectric memory The difference is that core memory has hysteresis of the magnetization with respect to the applied magnetic field, while ferroelectric memory has hysteresis of the polarization with respect to the applied electric field. ↩

7. The reference cell approach is described in Ramtron patent 6028783A. The idea is to have a row of reference capacitors, but the reference capacitors are sized to generate a current midway between the 0 current and the 1 current. The reference capacitors provide the second input to the sense amplifiers, allowing the 0 and 1 bits to be distinguished. ↩

8. Ramtron's 1987 patent describes the approximate structure of the memory. ↩

9. The diagram below shows the complex process that Ramtron used to create an FRAM chip. (These steps are from a 2003 patent, so they may differ from the steps for the chip I examined.)

   

   Ramtron's process flow to create an FRAM die. From Patent 6613586.

   Abbreviations: BPSG is borophosphosilicate glass. UTEOS is undoped tetraethylorthosilicate, a liquid used to deposit silicon dioxide on the surface. RTA is rapid thermal anneal. PTEOS is phosphorus-doped tetraethylorthosilicate, used to create a phosphorus-doped silicon dioxide layer. CMP is chemical mechanical planarization, polishing the die surface to be flat. TEC is the top electrode contact. ILD is interlevel dielectric, the insulating layer between conducting layers. ↩

10. See the detailed article Ferroelectric Memories, Science, 1989, by Scott and Araujo (who is the "A" in "Ramtron"). ↩

11. Early FRAM memories used an X-Y grid of wires without transistors. Although much simpler, this approach had the problem that current could flow through unwanted capacitors via "sneak" paths, causing noise in the signals and potentially corrupting data. High-density integrated circuits, however, made it practical to associate a transistor with each cell in modern FRAM chips. ↩

Inside the guidance system and computer of the Minuteman III nuclear missile

The Minuteman missile was introduced in 1962 as a key part of America's nuclear deterrent. The Minuteman III missile is currently the only US land-based intercontinental ballistic missile (ICBM), with 400 missiles ready for launch, spread across five central states.1 The missile contains a precision guidance system, capable of delivering a warhead to a target 13,000 km away (8000 miles) with an accuracy of 200 meters (660 feet).

The diagram below shows the guidance system of the Minuteman III missile (1970). This guidance system contains over 17,000 electronic and mechanical parts, costing $510,000 (about $4.5 million in current dollars). The heart of the guidance system is the gyro stabilized platform, which uses gyroscopes and accelerometers to measure the missile's orientation and acceleration. The computer uses the measurements from the platform to determine the missile's position and guide the missile on its trajectory to the target. Other key components are the missile guidance set controller, which contains electronics to support the gyro stabilized platform, and the amplifier, which interfaces the computer with the rest of the missile. In this blog post, I take a close look at the components of the guidance system that was used until the early 2000s.2

The Minuteman III guidance system (NS-20). Click on this image (or any other) for a larger version. Original image from National Air and Space Museum.

Fundamentally, the guidance computer constantly compares the missile position to the desired trajectory and generates the appropriate steering commands to keep the missile on track.3 The diagram below shows how directing the engine nozzles causes the missile to rotate around its three axes: roll, pitch, and yaw.4 In the silo, the roll angle (the azimuth) is aligned with the direction to the target. The missile takes off vertically and then the missile gradually rotates along the pitch axis to tilt over toward the target. During flight, adjustments along all three axes keep the missile on target. The Minuteman III has four rocket stages so the guidance computer jettisons each rocket stage and ignites the next stage in sequence.

The roll, pitch, and yaw axes for the Minuteman missile. The engine diagrams show how the nozzles are directed to rotate around each axis, Modified from A Simulation of Minuteman Trajectories, with changed axes.

The guidance platform

The idea behind inertial navigation is to keep track of the missile's position by constantly measuring its acceleration. By integrating the acceleration, you get the velocity. And by integrating the velocity, you get the position. Inertial navigation is self-contained, a big advantage for a missile since the enemy can't jam your navigation. The hard part is measuring the acceleration and angles with extreme accuracy, since even tiny errors are multiplied as the missile travels.

In more detail, the Minuteman's inertial guidance is built around a gyroscopically stabilized platform, which is kept in a fixed orientation. The platform is mounted on two beryllium gimbals. Feedback from gyroscopes drives three torque motors to rotate the gimbals to keep the stable platform in exactly the same orientation no matter how the missile twists and turns.

The Minuteman III stable platform. Original image from National Air and Space Museum.

The diagram below shows the components of the stable platform, in approximately the same orientation as the photo above. Three accelerometers are mounted on the stable platform to measure acceleration. The accelerometers are oriented along three perpendicular axes so each one measures acceleration along one axis. (The accelerometer axes are not aligned with the platform axes; this distributes the acceleration (mostly "up") across the accelerometers, increasing accuracy.) The two alignment mirrors allow the stable platform to be aligned with a precise device called an autocollimator, as will be described below. The gyrocompass uses the Earth's rotation to precisely determine North, providing a backup alignment technique. Both the alignment mirrors and the gyrocompass can be rotated to a precise angle, reported by the resolver.

The stable platform for Minuteman II and III. Modified from Minuteman weapon system history and description.

To target a Minuteman I missile, the missile had to be physically rotated in the silo to be aligned with the target, an angle called the launch azimuth. This angle had to be extremely precise, since even a tiny angle error will be greatly magnified over the missile's journey. Aligning the missile was a tedious process that used the North Star to determine North. Since the star was not visible from inside the silo, a complex surveying technique was used, using a surveyor's theodolite to measure the angles between the North Star and three concrete monuments outside the silo. Inside the silo, the closest monument was visible through a sighting tube, allowing the precise angle measurement to be transferred to the silo. After many more measurements inside the silo, a special device called an autocollimator was positioned precisely 90° from the desired launch azimuth. The autocollimator shot a beam of light through a window in the side of the missile, where it bounced off a mirror on the stable platform and returned to the autocollimator. If the returning beam wasn't exactly parallel, the autocollimator sent a signal to the missile, causing the stable platform to rotate as needed. The result of this process was that the stable platform was exactly aligned with the desired angle to the target.5

The guidance platform was completely redesigned for Minuteman II and III, eliminating the time-consuming alignment that Minuteman I required. The new platform had an alignment block with rotating mirrors. Instead of rotating the missile, the autocollimator remained fixed in the East position and the mirror (and thus the stable platform) was rotated to the desired launch azimuth. The new guidance platform also added a gyrocompass under the alignment block, a special compass that could precisely align itself to North by precessing against the Earth's rotation. At first, the gyrocompass was used as a backup check against the autocollimator, but eventually the gyrocompass became the primary alignment. For calibration, the alignment block also includes electrolytic bubble levels to position the stable platform in known orientations with respect to local gravity.6

The alignment block with mirrored surfaces. Image from National Air and Space Museum.

The photo above shows the alignment block on top of the gyrocompass. The front and back of the block are the precision mirrors that reflect the light beam from the autocollimator. The circles on top of the block and at the right are two level detectors, with set screws for exact adjustment. The platform has four level detectors, allowing it to be aligned against gravity in multiple positions. Like the gimbals, the gyrocompass assembly is made of beryllium due to its rigidity and light weight; it has a warning sticker because beryllium is highly toxic.

The diagram below shows how the axes align with the gimbals of the stable platform.7 Note the window at the top of the photo. Light from the autocollimator shines in through the window, reflects off the mirror on the alignment block, and returns through the window to the autocollimator. The autocollimator detects any error in alignment and signals the guidance system to correct its position accordingly.

Coordinate system for the stable platform. Note that these axes don't match the missile axes; the stable platform axes remain constant as the missile turns. Original image from National Air and Space Museum.

The stable platform uses gyroscopes to maintain its fixed orientation as the missile turns. The idea behind a gyroscope is that a spinning disk will tend to maintain its spin axis. The problem is that any friction, even from precision ball bearings, will reduce the accuracy. The solution in the Minuteman is a "gas bearing", where the gyroscope rotor is supported by an extremely thin layer of hydrogen. As shown below, the gyroscope is built around a stationary marble-sized ball (blue), fastened to the gyroscope frame at the top and bottom. The rotor (pink) is clamped around the equator of the ball and spins at high speed, powered by an induction motor (windings green, rotor yellow). If the gyroscope frame is tilted, the rotor will stay in its orientation. The resulting change in angle between the frame and the rotor is detected by sensitive capacitive pickups (purple). The gyroscope is sensitive to tilt in two axes: left-right, and front-back. Since nothing touches the rotor except the thin layer of gas around the ball, the influence of friction is minimal.

A gas-bearing gyroscope. Based on patent 3,025,708.

A gas-bearing gyroscope has the problem that when it starts or stops, the gas layer dissipates, allowing the rotor and the bearing to rub. The Minuteman missile's guidance system was kept continuously running, so starts and stops were infrequent. Moreover, when the gyroscope did need to be started, the electronics gave it a 40-volt jolt to get it up to speed quickly. Because the Minuteman's guidance system was always running—and its solid-fuel engines didn't require fueling—the missile could be launched in under a minute.

To summarize the guidance trajectory, a Minuteman flight is typically about 35 minutes,8 but only the first few minutes are powered by the rockets; the warheads coast most of the way on a ballistic trajectory. The first three rocket stages are active for just 180 seconds; this completed the boost phase for Minuteman I and II. However, the innovation of Minuteman III was that it held three warheads, a system called MIRV (Multiple Independently-targeted Reentry Vehicles). To direct these warheads to their targets, Minuteman III has a fourth stage, called PSRE (Propulsion System Rocket Engine), mounted just below the guidance system. The PSRE was active for 440 seconds, directing each warhead on its specific path. (Meanwhile, a retro-rocket sent the third stage in a random direction. Otherwise, it would tag along with the warheads, acting as a giant radar beacon for enemy anti-ballistic-missile systems.) The warheads travel very high, typically over 800 nautical miles (1500 km), more than three times the altitude of the International Space Station. As for the multiple-warhead MIRV, the Minuteman III missiles were converted back to single warheads as part of the New START arms reduction treaty, with the last MIRV removed in June 2014.

A MIRV configuration with three W78 warheads on the Minuteman III MK-12A reentry vehicle system. The conical reentry vehicles are smaller than you might expect, just under 6 feet tall (181 cm). In comparison, the Titan II had a reentry vehicle that was 14 feet long (4.3 m), holding a massive 9-megaton warhead. Photo from GAO-21-210.

The Minuteman D-17B computer

The guidance computer has a key role in the Minuteman missile, determining the missile's position from the stable platform data, executing a guidance algorithm, and steering the missile on the desired trajectory. Before explaining the D-37 computer used in Minuteman II and III, I'll start by discussing the D-17B computer used in the first Minuteman, since its characteristics strongly influenced the later computers. The Minuteman I computer was very primitive by modern standards. Although it was a 24-bit machine, it was a serial computer, operating on one bit at a time. The big advantage of serial processing is that it dramatically reduces the hardware requirements. Since the computer only processes one bit at a time, it uses a one-bit ALU. Moreover, the buses and datapaths are one bit wide rather than 24 bits. The disadvantage, of course, is that a serial computer is slow; the D-17B took 27 clock cycles (24 bits and three overhead) to perform any operation. At best, the computer could perform 12,800 additions per second.

The computer has an unusual cylindrical structure, 29 inches (74 cm) in diameter, designed to fit the diameter of the Minuteman missile. The computer itself is the bottom half of the cylindrical shell. The top half is the electronic equipment chassis, holding the power supplies for the computer and the stable platform, as well as servo control amplifiers, oscillators, and converters.

The Minuteman I guidance computer. The computer itself is the bottom half of the cylinder, with the disk drive in the 4 o'clock position. The upper half is electronics to drive the IMU and rocket. The IMU itself would be mounted in the center. Photo by Steve Jurvetson, CC BY 2.0.

The computer doesn't have any RAM. Instead, all instructions, data, and registers are stored on a hard disk, but not like a modern hard disk. The disk has separate, fixed heads for each track so it can access tracks without seeking. (This approach is similar to a computer built around drum memory, except the drum is flattened.) In total, the disk held just 2727 24-bit words (approximately 8 Kbytes). The computer's serial processing and its disk-based storage worked well together. The disk provided data one bit at a time, which the computer would process serially. The results were written back to the disk, one bit at a time as calculation proceeded. The write head was positioned just behind the read head so a value could be overwritten as it was computed.

The photo below shows the numerous read and write heads for the D-17B's hard disk. Note that the heads are fixed (unlike modern hard drives), and the heads are widely distributed across the surface. (There is no need for different tracks to be aligned.) I believe that the green and white heads in pairs are for the "regular" tracks, while the heads with other spacings implement registers and short-term storage called loops.9

Disk head assembly from the D-17B. Photo by LaserSam, CC BY-SA 40.

The D-17B computer was transistorized. The photo below shows one of its circuit boards, crammed with transistors (the black cylinders), resistors, diodes, and other components. (This board is a read amplifier, amplifying the signals from the hard disk.) The computer used diode-resistor logic and diode-transistor logic to minimize the number of transistors; as a result, it used 6282 diodes and 5094 resistors compared to 1521 silicon and germanium transistors (source).

A read amplifier circuit board from the D-17B. Photo from bitsavers.

The computer supported 39 instructions. Many of the instructions are straightforward: add, subtract, multiply (but no divide), complement, magnitude, AND, left shift, and right shift. The computer handled 24-bit words as well as 11-bit split words, so many of these instructions had "split" versions to operate on a shorter value. One unusual instruction was "split compare and limit", which replaced the accumulator value with a limit value from memory, if the accumulator value exceeded the limit.

The focus of the computer was I/O with 48 digital inputs, 26 incremental inputs, 28 digital outputs, 12 analog voltage outputs, and 3 pulse outputs for gyro control. The computer had special instructions to support the various inputs and outputs.10 For example, to integrate pulse signals from the stable platform, the computer had instructions to enter and exit "Fine Countdown" mode, which caused two special registers to operate as digital integrators, in parallel with regular computation (details).

The D-37 computer

For the Minuteman II missile, Autonetics built the D-37 computer, one of the earliest integrated circuit computers. By using integrated circuits, the guidance computer was dramatically shrunk, increasing range, functionality, and accuracy. The photo below compares the size of the older D-17B computer (half-cylinder) with the D-37B (held by the engineer).

The Minuteman D-17B computer (cylinder) and D-37B computer (being held). From Microcomputer comes off the line, Electronics, Nov 1, 1963. Using modern definitions, the computer was a minicomputer, not a microcomputer.

Although the main task of the computer is guidance, with the increased capacity of the D-37, the computer took over many of the tasks formerly performed by ground support equipment. The D-37 managed "ground control and checkout, monitoring, communication coding and decoding, as well as the airborne tasks of navigation, guidance, steering, and control" (link).

The D-37 had several models. The D-37A was the prototype system, while the D-37B was deployed in the first 60 Minuteman II missiles. The Air Force soon realized that nuclear radiation posed a threat to the computer, so they developed the radiation-hardened D-37C.11 The Minuteman III used the D-37D, an improved and slightly larger version. Even with additional disk space, program memory was so tight that software features were dropped to save just 47 words.

As far as architecture and performance, the D-37 computer is almost the same as the D-17B, but extended. Most importantly, the D-37 kept the serial architecture of the D-17B, so it had the same slow instruction speed. The D-37 kept the instruction set of the D-17B, with additional instructions such as division, logical OR, bit rotates, and more I/O, giving it 58 instructions versus 39 in the older computer. It expanded the hard disk storage, but with a double-sided disk providing 7222 words of storage in the D37-C.12 The D-37 included division implemented in hardware (which the D-17B didn't have), along with a faster hardware implementation of multiplication, improving the speed of those instructions.13 The D-37C added more I/O lines, as well as radio input and 32 analog voltage inputs.

The diagram below shows the D-37C computer, used in the Minuteman II. At the left is the hard disk that provides the computer's memory. Most of the computer is occupied by complex circuit boards covered with flat-pack integrated circuits. At the right is the advanced switching power supply, generating numerous voltages for the computer (±3, 6, 9, 12, 18, and 24 volts). The connectors at the top provide the interface between the computer and the rest of the system. Because the computer has so many digital (discrete) and analog signals, it uses multiple 61-pin connectors (details).

The D-37C computer. Image courtesy Martin Miller, www.martin-miller.us.

The D-37C computer was built from 22 different integrated circuits, custom-built by Texas Instruments for the Minuteman project. These chips ranged from digital functions such as NAND gates and a flip-flop to linear amplifiers to specialized functions such as a demodulator/chopper. Texas Instruments sold the Minuteman series integrated circuits on the open market, but the chips were spectacularly expensive ($55 for a flip-flop, over $500 in current dollars) and not as popular as TI's general-purpose integrated circuits.14 The circuit boards were very complex for the time, with 10 interconnected layers. Each board was about 4 × 5½ inches and held about 150 flatpack integrated circuits, with components on both sides.

The growth of the integrated circuit industry owes a lot to the Minuteman computer and the Apollo Guidance Computer, both developed during the early days of the integrated circuit. These projects bought integrated circuits by the hundreds of thousands, helping the IC industry move from low-volume prototypes to mass-produced commodities, both by providing demand and by motivating companies to fix yield problems. Moreover, both computers required high-reliability integrated circuits, forcing the industry to improve its manufacturing processes. Finally, Minuteman and Apollo gave integrated circuits credibility, showing that ICs were a practical design choice.

The Minuteman III used the D-37D computer, which had about twice the disk capacity, 14,137 words. The layout is similar to the D-37C above, with the disk drive on the left and the power supply on the right. Since the computer is mounted "upside down", the boards are not visible inside, blocked by the interconnect board.15 Note the use of flexible PCBs, advanced technology for the time, soldered with low-melting-point indium/tin solder.

The D-37D computer. Image from National Air and Space Museum.

By 1970, the D-37 computer had made the cylindrical D-17B obsolete. The government gave away surplus D-17B computers to universities and other organizations for use as general-purpose microcomputers. Dozens of organizations, from Harvard to the Center for Disease Control to Tektronix jumped at the chance to obtain a free computer, even if it was slow and difficult to use, forming a large users group to share programming tips.

The P92 amplifier

The amplifier provides the interface between the computer and the rest of the missile. The amplifier sends control signals to the missile's four stages, controlling the engines and steering. (The electronic circuitry from the Minuteman I's nozzle control units was moved to the amplifier, simplifying maintenance.) Moreover, the Minuteman has explosive ordnance in many places, ranging from small squibs that activate valves to explosives that separate the missile stages. The amplifier sends the high-current (30 amp) signals to detonate the ordnance, while monitoring the current to detect faults.16 The amplifier acts as a safety device for the ordnance, blocking signals unless the amplifier has been armed with the proper code. The amplifier sends control signals to the reentry system (i.e. the warheads) as well as the chaff dispenser, which emits clouds of wires to jam enemy radar. The amplifier also sends and receives signals through the umbilical cable from the ground equipment.

The PS 92A amplifier. Image from National Air and Space Museum. Click this (or any other image) for a higher-resolution version.

The photo above shows the amplifier with its cover removed. The amplifier is constructed as two stacks of six circuit boards, on top of a double-width power supply board. At the top and bottom of each board, connectors with thick cables connect the boards to the rest of the system. Each board is a multi-layer printed-circuit board built on a thick magnesium frame for cooling. The amplifier has five power switching boards, a valve driver board, three servo amplifier boards, and an ACTR control board (whatever that is). The system board is visible on the left, with large capacitors and precision 0.01% resistors. To its right is the decoder board, presumably decoding computer commands to select a particular I/O device. Note the extensive use of Texas Instruments flat-pack integrated circuits on this board, the tiny white rectangles.

Missile Guidance Set Control

The Missile Guidance Set Control (MGSC) contains the electronics to power and run the inertial measurement unit (IMU), providing the interface to the computer. The MGSC handles the platform servo loop, accelerometer server loops, gyroscope torquing, gyrocompass torquing and slew, and accelerometer temperature control.17 One unexpected function of the MGSC is powering the computer's hard disk, supplying 400 Hz, 3-phase power at 27.25 volts (source).

The Missile Guidance Set Control with the modules labeled. Original image from National Air and Space Museum.

The MGSC is constructed from hinged metal modules, each with a particular function, shown above. The modules are constructed around printed circuit boards. Two large connectors at the right of the MGSC provide electrical connectivity with the IMU and computer. At the top and bottom of the MGSC are connections for coolant. The MGSC is roughly equivalent to the top half of the Minuteman I's cylindrical guidance system, opposite the computer half. The MGSC is unchanged between the Minuteman II and Minuteman III. The MGSC is normally covered with a metal cover that provides radiation protection, but the cover is missing in the photo above.

Battery

The battery in the Minuteman Guidance System is very unusual, since it is a "reserve battery", completely inert until activated. It is a silver/zinc battery with the electrolyte stored separately, giving the battery an essentially infinite shelf life. To power up the battery during a launch, a gas generator inside the battery is ignited by a squib. The gas pressure forces the potassium hydroxide electrolyte out of a tank and into the battery, energizing the battery in under a second. The battery can only be used once, of course, and you can't test it. The battery was built by Delco-Remy (a division of General Motors) (details). It provides 28 volts at 14.5 Amp-hours, powering the guidance system and most of the missile; a separate battery powers the first-stage rocket.

The battery inside the Minuteman III. Original image from National Air and Space Museum.

The photo above shows the battery mounted inside the guidance system. Note the two thin wires attached to the posts on the left front of the battery to enable the battery, and the thick power wires bolted to the posts on the right. Above these posts is an "electrolyte vent port"; I'm not sure what prevents caustic electrolyte from spraying out under high pressure.

The photo below shows the construction of a Minuteman I battery, similar but with two independent battery blocks. The two round gas generators on the front of the electrolyte tube force the electrolyte into the battery sections.

Inside the remotely-activated SE12G battery. (source)

Squib-activated switch

Another unusual component is the squib-activated switch. This switch is activated by a small explosive squib; when fired, the squib forces the switch to change positions. This switch may seem excessively dramatic, but it has a few advantages over, say, an electromagnetic relay. The squib-activated switch will switch solidly, while the contacts on a relay may "chatter" or bounce before settling into their new positions. An electromagnetic relay may require more current to switch, especially if it has large contacts or many contacts. However, like the battery, the squib-activated switch can only be used once.

The squib-activated switch, next to a coolant line. The manufacturer of this part is Boeing, as indicated by the Cage Code 94756 on the part. Image from National Air and Space Museum.

The purpose of the switch is to disconnect important signals, known as critical leads, during launch. The Minuteman missile has an umbilical connection that provides power, cooling, and signals while the missile is in the silo. Just before the umbilical cable is disconnected, the switch severs the connections for the master reset signal along with an enable and disable signal. Presumably, these control signals are cleanly disconnected to avoid stray signals or electrical noise that could cause problems when the umbilical connection is pulled off.

The photo below shows the umbilical cable connected to a Minuteman II missile in its silo. Also note the window in the side of the missile to allow the light beam from the autocollimator to reflect off the guidance platform for alignment.

A Minuteman II missile in its silo. Photo by Kelly Michals, CC BY-NC 2.0.

Cooling

The guidance system is water-cooled while in the silo, using a solution of sodium chromate to inhibit corrosion. After launch, the guidance system operated for just a few minutes before releasing the warheads, so it operated without water cooling. (The stable platform has a fan and heat exchanger to keep it cool during flight.) The diagram below highlights the cooling lines. Coolant is provided from the ground support equipment through the umbilical connector in the upper right. It flows through the computer, diode assembly, MGSC, and stable platform. Finally, the coolant exits through the umbilical connector.

Original image from National Air and Space Museum.

Diode assembly

In the middle of the guidance system, the diode assembly consists of seven power diodes. These diodes control the power flow when switching from ground power to battery power. The photo below shows the diode assembly, with coolant connections at the top and bottom. The thick gray wire in the center of the diode assembly receives power from the battery just to the left.

The diode assembly. Image from National Air and Space Museum.

Permutation plug

The Permutation plug (or P-plug) was the key cryptographic element of the guidance system, defining the launch codes for a particular missile. The P-plug looked similar to a hockey puck and plugged into a 55-pin socket attached to the amplifier. The retaining bar held the P-plug in place.

The connector that receives the Permutation plug. Image from National Air and Space Museum.

Because the security of the missile hinged on the P-plug, the P-plug was handled in a highly ritualized way, transported by a two-person team, an airman and an officer, both armed (source). After the guidance system underwent maintenance, the P-plug team would ensure that the plug was properly installed, just before the missile was bolted back together. There was also a lot of ritual around the disk memory, since it held security codes and targeting information.18 Before anyone could work on the computer, a special team would come to the silo and erase the memory. Afterward, another team would load up the computer from a magnetic tape (in the case of Minuteman III) or punched tape (earlier).19

The missile launch codes are said to be split between the hard disk and the permutation plug. In particular, the missile software holds a two-word code for each of the five launch control facilities.22 The launch code in an Execute Launch Command (ELC) must match the combination of the P-plug value and the site-specific value on disk.23 Thus, the launch code is unique to each launch control site and each missile.24 As another security feature, a launch requires messages from two launch control sites, unless only one was available.25

Transient current detector

A nuclear blast has many bad effects on semiconductors and can cause transient errors. A rather brute-force approach was used to minimize this risk in the D-37C and D-37D computers: if a nuclear blast is detected, the computer stops writing to disk until the burst of radiation passes by. When the radiation level drops, the computer carries on from where it left off, extrapolating to make up for the lost time26 to minimize the error. Since all data is stored on the hard disk, the system doesn't need to worry about memory corruption as could happen with semiconductor RAM.

The Minuteman documents euphemistically refer to "operating in a hostile environment" for the ability to handle large pulses of radiation from a nearby nuclear explosion. Another euphemism is "seismic environment", when a nuclear blast near a silo could disturb the missile's targeting alignment. To get an idea of the expected forces, note that the launch officers were strapped into their seats with four-point harnesses to protect against the seismic environment.27

The Transient Current Detector. Image from National Air and Space Museum.

The "transient current detector" above detects dangerous levels of radiation. I couldn't find any details, but I suspect that it contains a semiconductor and detects transient current through the semiconductor induced by radiation. It would make sense to use a semiconductor similar to the ones in the computer so the detector's response matches the response of the computer, perhaps a matching Texas Instruments IC.

The Minuteman III also has two "field detectors" mounted on the outside of the guidance ring. These presumably detect large fluctuations in the electromagnetic field, indicating an electromagnetic pulse (EMP), different from the ionizing radiation picked up by the Transient Current Detector.

Conclusions

The Minuteman guidance system is full of innovative technologies. Among other things, Minuteman I used an early transistorized computer, and Minuteman II used one of the first integrated circuit computers. The Minuteman missile isn't just something from the past, though. There are currently 400 Minuteman missiles in the United States, ready to launch at a moment's notice and create global devastation. Thus, its technical achievements can't be glorified without reflecting on the negativity of its underlying purpose. On the other hand, Minuteman has succeeded (so far) in its purpose of deterrence, so it can also be viewed in a positive, peacekeeping role. In any case, the Minuteman technology is morally ambiguous, compared to, say, the Apollo Guidance Computer.

I plan to write more about the role of Minuteman and Apollo in the IC industry, so follow me on Mastodon as @[email protected] or RSS for updates. Probably the best overview of Minuteman is Minuteman weapon system history and description. The book Minuteman: A technical history has thorough information. For information on the missile targeting and alignment process, see Association of Air Force Missileers Newsletter, December 2006. The Minuteman guidance system is described in detail in The evolution of Minuteman guidance and control. Much of the imagery in this article is from the National Air and Space Museum. Thanks to Martin Miller for providing a detailed D-37C photo. He has taken amazing photos of nuclear equipment, published in his book Weapons of Mass Destruction: Specters of the Nuclear Age, so check it out.

Notes and references

1. The Minuteman missile was introduced in 1962, followed by the improved Minuteman II in 1965 and the Minuteman III in 1970. From 1966 to 1985, the US had 1000 Minuteman missiles fielded, but the number has been reduced since then due to various arms control agreements. At present, there are 400 active Minuteman III missiles spread among 450 launch sites. The Minuteman guidance system was updated in the early 2000s to a platform called the NS-50, using a computer based on a MIL-STD-1750A microprocessor. I'm not discussing that system in this post for reasons of space.

   Although the Minuteman has undergone modernization projects, it is reaching the end of its life and is scheduled to be replaced by the Sentinel missile. The Sentinel program is encountering delays and is over budget by 80%, raising the risk of cancellation but the Sentinel program is proceeding as of July 2024. ↩

2. Disclaimer: This information is all from published sources. There's nothing secret, and it's mostly obsolete from 60 years ago. I don't have access to a Minuteman system (unlike the Titan), so this post is based on publications and photos, rather than hands-on experience. I've tried to be accurate, but I'm sure there are errors. ↩

3. Different guidance algorithms can be used, such as Q-guidance, delta guidance, explicit guidance, and numerical integration; the more advanced algorithms require better computers but provide easier targeting, better accuracy, and more ability to correct for course deviations (see Present and Advanced Guidance Techniques). Q-guidance uses a precomputed "Q matrix" to constantly determine the direction in which velocity needs to be gained, while delta guidance attempts to keep the missile along a precomputed trajectory by using polynomials. In explicit guidance, the equations of motion are solved to determine the steering direction. Minuteman used delta guidance at first, but moved to "hybrid explicit" guidance when the computer became more advanced. See Minuteman: A technical history, page 234 for more on targeting algorithms. ↩

4. On Minuteman I, the three stages were steered by changing the direction of the rocket nozzles. Minuteman II, however, used a single fixed nozzle on the second stage but injected fluid into the exhaust to steer the missile, a technique called liquid injection thrust vector control. The Minuteman III used this technique on the third stage as well, injecting a strontium perchlorate solution. (Small nozzles powered by a gas generator are used for roll control, since directing the exhaust won't produce roll motion.) The thrust control liquid was Freon 114B2, which turned out to be harmful to the ozone layer, so it was replaced in the 1990s with perfluorohexane. ↩

5. Strictly speaking, the launch azimuth wasn't aimed at the target. Because the Earth rotated during the missile's flight, the launch azimuth was aimed at where the target would be when the warhead landed. Another factor was the Minuteman I had a limited ability to steer off the launch azimuth, about 10°, allowing the missile to switch between two targets at launch time. ↩

6. The Minuteman guidance system is designed to achieve as much accuracy as possible. One problem is that the gyroscopes and accelerometers aren't perfect, but have small errors due to friction and other factors. Moreover, the construction of the stable platform isn't exact; components that should be parallel or perpendicular will have tiny angle errors. To deal with these problems, the missile performs periodic calibrations ranging from some every 15 minutes to some every few months.

   To assist with calibration, the guidance platform contains electrolytic bubble levels, similar to an ordinary carpentry level, but extremely sensitive. Each bubble level contains wires positioned partially in the bubble and partially in the conductive electrolyte fluid. As the bubble shifts, the amount of wire in the fluid changes, changing the measured resistance. These levels are so sensitive that The levels allow the stable platform to be rotated to known positions relative to gravity for calibration.

   The top of the gyrocompass has two mirrors for calibration, allowing the missile platform to rotate exactly 180° relative to the autocollimator. Every 15 minutes, the platform would flip over to measure the gyroscope and accelerometer signals in the opposite orientation. This allowed much better calibration, canceling out errors and improving the missile accuracy. Other calibrations were performed less frequently, such as checking each accelerometer in the up and down positions. Every 90 days, a calibration called PSAT (Perturbation Self-Alignment Technique) pitched the platform by 90° and then slowly rotated the gyrocompass around the vertical to simulate the Earth's rotation (details).

   Another alignment measurement checks the angle between the two mirrors. The two mirrors on the alignment block are supposed to be parallel, but they won't be exactly parallel. The guidance platform periodically rotates the mirror assembly to check one mirror and the other against the autocollimator to compute the angle between the mirrors, called zeta. (See Software Validation Study, page A-94.)

   These calibrations permitted the measurement of small biases and imperfections in the gyroscopes and accelerometers; this data was fed into the guidance calculations to squeeze out as much accuracy as possible. These measurements also provided statistical tracking of the devices so they could be replaced if their performance started to deteriorate. ↩

7. Inconveniently, I found contradictory sources about the Minuteman coordinate system. Most sources specify Z as the roll axis, but one detailed paper swaps the X and Z axes, maybe to match simulation software. Examining Figure 5 closely shows that the new axis names were drawn in by hand. ↩

8. The flight time of Minuteman depended on the distance and trajectory. The Minuteman's range is said to be 13,000 km. For a closer target, there are two possible trajectories: a high path and a low path. Being direct, the low path could take about 25 minutes, while the high path would reach over 1500 nautical miles (almost 3000 km, seven times the altitude of the ISS) and take 45 minutes. See A simulation of Minuteman Trajectories. ↩

9. The disk holds a timing track, which provides the timing for the computer, giving it a 345.6 kHz clock speed. Note that all operations in the computer are synchronized to the disk, rather than a clock inside the computer. One consequence of this is that the processor speed depends on the disk speed, so it isn't as precise as most computers, which generate the clock from a quartz crystal. The processor timing is very important for a guidance computer, since its calculations of positions depend on the time step. If the processor is running fast or slow, the position will be correspondingly wrong. The solution is that the computer calculates a parameter "tau", the ratio between processor time and wall clock time. The computer receives an interrupt exactly once per second; by counting the number of instructions executed between interrupts, the computer can compute tau and ensure that the calculations are accurate. ↩

10. The computer has 8-bit analog-to-digital converters. The D-37C supports 32 analog inputs with a range of +/- 10 volts (source). It also has four digital-to-analog outputs with 8-bit accuracy, also +/- 10 volts.

    In the D-17B, nine analog outputs control the rocket steering, providing roll, pitch, and yaw to the three stages, while three analog outputs go to the stable platform, probably positioning the gimbals. ↩

11. The housing for the stable platform provides radiation shielding; it is one of the few parts of the guidance system that is officially secret, but is said to be tantalum sheeting (see Minuteman: A technical history page 224). Although the computer is also said to have radiation shielding, it is curiously not on the secret list. ↩

12. Sources give different memory capacities. The reason is that in addition to the regular memory, part of the disk is used for special purposes including registers and rapid access loops. The problem with the regular memory is that the processor may need to wait for an entire disk revolution to access a particular word. The solution is rapid access loops: by putting the write head just upstream of the read head, the data can be accessed more rapidly. For instance, if the write head is positioned one word length upstream, the word can be read (and rewritten) every cycle, providing immediate access to a single word. Putting the write head further upstream allows storage of longer values, with a corresponding longer wait. The D-37C has ten rapid-access channels of one to 16 words (source). The regular memory in the D-37C consists of 56 channels (i.e. tracks) of 128 words, totaling 7168 words. Counting the loops and registers yields the higher memory capacity of 7222 words. ↩

13. The differences between the D-17B and D-37C instruction sets are described here. ↩

14. The schematic for the Minuteman's flip-flop IC is shown below. This is a complex circuit for the time, with six transistors along with numerous resistors, diodes, and capacitors.

    

    Flip-flop schematic. From Integrated circuits go operational, Electronics, Feb 15, 1963.

     ↩

15. The diagram below shows an exploded view of the D-37D computer (rotated 180° from the earlier photo).

    

    Exploded view of the D-37D computer. Modified and fixed from Minuteman weapon system history and description.

     ↩

16. The danger of these explosives is illustrated by a bizarre accident summarized by "The warhead is no longer on top of the missile." At 3:00 pm on December 5, 1964, two airmen were in the missile silo, troubleshooting a fault in the security system. One airman removed a fuse, triggering a loud explosion and the nuclear warhead fell off the missile, falling 75 feet to the floor of the silo. Nobody was injured and the warhead was hoisted out a few days later without incident.

    The problem was that the airmen used an "unauthorized tool" (a screwdriver) to remove the fuse, briefly shorting power to ground. This caused a current on a ground line connected to the missile through an umbilical cable. Inside the missile, the retrorocket for the warhead had an igniter, but a short on its connector caused another connection to ground. This ground went out through a second umbilical, closing the circuit. (Apparently, the resistance between the two grounds was high enough that the path through the two shorts had enough current to ignite the igniter.) The force of the retrorocket flung the warhead off the rocket.

    More details are in this report and this report. (This incident is not the 1980 Damascus Titan incident, where a dropped 8-pound wrench socket led to the explosion of the missile, killing one person and injuring 21 others, while flinging the warhead out of the silo. The very interesting book Command and Control discusses the Damascus incident and other mishaps with nuclear weapons.) ↩

17. The functional diagram below shows the interactions between the stable platform and the guidance set. Shaded circuits are mounted on the stable platform, while others are in the control set. This diagram is for the later NS-50 platform, but it should be mostly relevant to the NS-20 used in Minuteman III earlier. At the top are the feedback loops for the PIGA accelerometers (top). The torque motors (TM) in the middle provide feedback through the gimbals for the gyroscopes. Below that, the gyrocompass has a a feedback loop with its internal torquer. The torque motor at the bottom rotates the gyrocompass and mirrors with feedback through the optical resolver.

    

    Platform Control Functional Diagram. From Technical Reference Handbook, SELECT WS133A, D2-27524-5, Fig. 3-12, page 3-68.

     ↩

18. The Air Force was especially concerned with keeping the targeting information secret; the people launching the missiles had no idea what the targets were. It occurs to me, though, that since the Minuteman I missile had to be physically rotated in its silo to exactly line up with the target, one presumably could draw an azimuth line on the map and know the target was along the line. ↩

19. The Minuteman computer has a conditional fill mode, where the computer can't be loaded with a new program unless the first four words match the first four words in memory channel 12. This ensures that the computer can't be loaded with unauthorized software. This four-word code must be different from the P-plug value for two reasons. First, the P-plug value is not allowed to be stored in memory. Second, the filling code is four words, while the P-plug value is two words.

    The P-plug held two hardwired code words that could be read by the processor.20 For security, the two words were not allowed to be in memory (i.e. the hard drive) at the same time. I assume it is called a Permutation Plug for historical reasons; the Saturn V booster used in Apollo used a security plug that provided a permutation of the 21-character code.21 (That is, it mapped 21 inputs to 21 outputs as a permutation.) ↩

20. The processor read the P-plug code words by first triggering the discrete output #25 with the DOB 25 instruction (Discrete Output B) and then reading the value (twice for reliability). The process was repeated with output #6. Finally, the discretes were cleared with DOB 0 (reference). ↩

21. The Apollo flights used "code plugs" to protect the Range Safety system from unauthorized access, since this system was capable of blowing up the Saturn V rockets (details). Signals were transmitted in a 21-symbol "alphabet" (encoded by 2 tones out of 7). The code plug permuted the 21 symbols in an arbitrary way. This wasn't a lot of security, just a simple substitution cipher, but it was sufficient for its role. A command consisted of 11 characters (9 for the address and 2 for the command), so the odds were low of hitting a valid message by chance. ↩

22. One feature of the Minuteman missile is that the missile sites themselves are uncrewed; the missile officers who launch the missiles work remotely, handling multiple missiles to reduce the personnel required. Specifically, each group of 10 missiles (called a "flight") is controlled by an underground launch control center. A squadron consists of 50 missiles. A "wing" is the largest grouping, handling 150 to 200 missiles, and attached to a particular Air Force base. At its peak, Minuteman had 1000 missiles divided among six wings in Missouri, Montana, North Dakota, South Dakota, and Wyoming, with missiles spilling across the Wyoming border into Colorado and Nebraska. ↩

23. Information on the launch code mechanism is from Technical Reference Handbook D2-27524-5, "System Engineering Level Evaluation Correction Team, WS133A", chapter 2. ↩

24. The Command Signals Decoder provides another layer of security. It is an electromechanical stepping decoder that blocks the first-stage rocket from igniting unless it receives the proper 27-bit code as part of an Enable command. (The Enable command (ENC) happens before the Execute Launch command (ELC); see the state diagram below.) Its operation is murky; my hypothesis is that the decoder acts much like a combination lock, with the 27 code posts raised or lowered by the input bits. If all the posts are in the proper position, the inner wheel is released, allowing it to rotate to the armed position and close the electrical firing circuit for the motor igniters. Specifically, the 27 posts have a high notch on one side and a low notch on the other, so the device is programmed by rotating each pin so the desired notch faces inward. When the device receives code bits, the wheel rotates one position for each bit and a solenoid raises or lowers the pin, depending on if it is a zero or one. If all pins are in the correct positions, the inner wheel can rotate through the notches, but if any pins are incorrect, the inner wheel will bind on that pin. The 27 bits are the "CSD(M) secure code", probably consisting of 24 code bits and three padding bits. Another Command Signals Decoder on the ground "CSD(G)" provides an interlock for ground ordnance.

    

    The Command Signals Decoder, from Evolution of ordnance subsystems and components design in Air Force strategic missile systems.

    I think there are two motivations behind this complicated device. First, they want an interlock that is mechanical rather than electronic, since an electronic device can be affected unpredictably by radiation, power surges, component failure, programming errors, etc. Second, they want an interlock that physically disconnects the firing circuit so there is no path that can be triggered by stray current, lightning, EMP, etc.

    The Minuteman's P92 amplifier assembly also blocks ordnance unless armed with a code. It's unclear if this is the same enable code as the Comand Signals Decoder or a different code.

    The earlier Titan missile also had a code mechanism to prevent an unauthorized launch by blocking the engine. The Titan had a butterfly valve in the fuel line with a 6-digit code. If you don't enter the right code, the fuel line stays shut and the missile simply can't take off (video). ↩

25. A missile launch normally requires an Execute Launch Command (ELC) from two launch control sites, moving the missile to the "Launch in Process" mode. However, that raises the concern that there could only be one surviving site. The solution is that after receiving a single launch command, the missile starts a timer. If the "one-vote launch time" passes uneventfully, the missile is launched. However, another site can cancel a rogue launch during that time by sending an Inhibit Command (INC) message. The sites have a complex system to detect which sites are active and to determine the primary and secondary sites controlling each missile. (This is reminiscent of the Byzantine generals problem.)

    

    The state machine for Minuteman missile status. From Technical Reference Handbook D2-27524-5, page 2-25.

     ↩

26. After detecting a nuclear blast, the Minuteman computer shuts down for an integral number of disk revolutions. When it comes back up, it double-counts the accelerometer pulses for the same number of disk revolutions to make up for the missed time (see Minuteman: A technical history pages 220 and 223). As long as not much changed during the lost time, the accuracy loss is small. Of course, this counter would need to be outside the part of the computer that gets shut down. ↩

27. Missiles were aligned to such accuracy that even running a diesel generator nearby could shift the silo enough to cause alignment problems, as happened with a Titan site. (See Association of Air Force Missileers Newsletter, March 2007, page 6.) A "seismic event" could also be an earthquake; the enormous 1964 Alaska earthquake—9.2 on the Richter scale—caused Minuteman guidance systems to lose alignment with the autocollimator (See Minuteman: A technical history page 221). ↩