Configurable Fault Tolerant Processor (CFTP) for Space ...
38
Naval Postgraduate School Configuration Memory Memory RLOS Configuration Memory Configuration Memory µP µP µP voter Status & I/O Error Interrupt Clock Control Interface/switching logic TMR PRLOS FPGA 2 FPGA 2 EDAC Memory Control Interface/switching (GLUE) logic PRLOS FPGA 1 FPGA 1 Configuration Control Command and Status Registers Bus Transceivers Presented by Naval Postgraduate School 777 Dyer Rd., Code (SP) Monterey, CA 93943 Capt Charles Hulme, USMC With Dr. Alan A. Ross Configurable Fault Tolerant Processor Configurable Fault Tolerant Processor (CFTP) for Space Based Applications (CFTP) for Space Based Applications
Transcript of Configurable Fault Tolerant Processor (CFTP) for Space ...
Microsoft PowerPoint - S_S_BRIEF_Hulme.pptMonterey, CA 93943
Configurable Fault Tolerant Processor Configurable Fault Tolerant Processor (CFTP) for Space Based Applications(CFTP) for Space Based Applications
Small Satellite Conference 214 August 2003
Agenda Introduction
CFTP Objective Design a fault-tolerant reconfigurable System-On-a-Chip (SOC) to mitigate bit errors in computation for evaluation on- orbit Evaluate techniques for configuration protection
Small Satellite Conference 414 August 2003
CFTP Concept CFTP is centered on a reconfigurable Triple Modular Redundant (TMR) SOC that will overcome transient errors without full system resets and the commensurate loss of data
The flexibility of this design will enable on-orbit reconfigurations to the on-board architecture supporting dynamic mission requirements
Reducing development time and cost Improving reliability in hardware Increasing flexibility and upgradeability
Small Satellite Conference 514 August 2003
Motivation Current processors require radiation hardened (RADHARD), custom built, inflexible systems.
RADHARD parts lag current technology and are years old by the time of launch
Space systems development times are long with designs frozen early in the process
Upgrading to newer technologies difficult Space systems are often replenished for years without significant design changes (e.g. GPS) CFTP can provide updateable architectures for backwards and forward compatibility between systems via reconfiguration
Small Satellite Conference 614 August 2003
Space Application Once a satellite is in orbit, hardware changes are expensive, if even possible.
If reconfigurable logic can be used instead, then changes can be made via command and control communications, vice a personal visit.
CFTP can be reconfigured on orbit to correct errors, meet dynamic mission requirements, upgrade, or serve as back-up devices to several on-board systems.
Small Satellite Conference 714 August 2003
Effects of Radiation Total Ionizing Dose (TID)
Single Event Effects (SEE) Single Event Latchup (SEL)
Can be destructive Single Event Upset (SEU)
Can be mitigated Many Others
Small Satellite Conference 814 August 2003
Conceptual framework FPGAFPGA implementation of TMR softcore microprocessors SOC designSOC design 16 16 oror 3232 bit softcore microprocessors Maximize use of COTS products
Or at least provide COTSCOTS--like functionalitylike functionality MaximizeMaximize system speed and reliabilityreliability Minimize component cost and power Minimize component cost and power consumptionconsumption Introduce real time onon--orbit reconfigurabilityorbit reconfigurability
Small Satellite Conference 914 August 2003
Physical Framework Size
PC/104 Reconfigurability
COTS hardware preferred COTS performance targeted
Low Power Target 11 Watts or less, max
PC-104 Bus
The CFTP Concept
Fault-Tolerant Architecture
CFTP Components SOC
661,111 system gates 228 pins (162 I/O pins)
Controller XQVR600-4 CB228 FPGA XQV600-4 CB228 FPGA
Small Satellite Conference 1314 August 2003
CFTP Components Configuration storage for both FPGAs
Flash Memory (EEPROM) – µProcessor Intel TE28F320C3
32 Mbit
Development
Flight
CFTP Components System Memory
256Mbit, 16.7M-word x 4bit x 4bank, 3.3 V
Small Satellite Conference 1514 August 2003
Putting it all together
Primary Data Paths
Small Satellite Conference 1714 August 2003
Additional Data Paths Theses paths exist for additional adhoc storage for the µProcessor
These paths exist for additional adhoc communications between FPGAs
Small Satellite Conference 1814 August 2003
Current Project Status
Midshipman Space Technologies Applications Research (MidSTAR-1) Naval Postgraduate School Satellite (NPSAT1)
Seeking High-Radiation Orbit
SPACE TEST PROGRAM (STPSPACE TEST PROGRAM (STP--1),1), ATLAS V LAUNCH VEHICLE,ATLAS V LAUNCH VEHICLE, EstEst Launch March 2006Launch March 2006
Small Satellite Conference 1914 August 2003
Required Tests Development Tests Hardware Functionality Tests Operational Tests Environmental Tests
Small Satellite Conference 2014 August 2003
Development Tests Verify
Small Satellite Conference 2114 August 2003
Hardware Functionality Tests Confirm Functionality
with FPGAs ROM RAM EEPROM PC104 Bus
M em
Operational Tests Evaluate missions Built-In Self Test
Triple Modular Redundancy
Environmental Tests Launch Environment Testing
Random Vibration Testing Simulates vibrations on Spacecraft due to Launch Vehicle
On-Orbit Environment Testing Thermal Vacuum Testing
Verifies proper operation of Spacecraft under simulated space vacuum and temperature
Radiation Tests Evaluate susceptibility to SEUs and Total Dose Tolerance
Small Satellite Conference 2414 August 2003
Conclusions The design provides maximum flexibility
Allows for redundant reconfiguration methods Provides for configuration error mitigation Provides numerous options for future configurations with multiple data paths through the configurable logic Provides a fault-tolerant architecture for SEU mitigation
Small Satellite Conference 2514 August 2003
Questions?Questions?
Monterey, CA 93943
BACKBACK--UP UP SLIDESSLIDES
Radiation Environment
Solar Protons &
Heavier Ions
Solar Wind
Small Satellite Conference 2814 August 2003
FPGA Description A Field Programmable Gate Array (FPGA) is a high density Programmable Logic Device (PLD)
Built of small logic blocks in a sea of interconnects
Each logic block can emulate a digital circuit
Small Satellite Conference 2914 August 2003
FPGA Description (cont) If the circuit is large, smaller portions are instantiated in separate logic blocks and interconnected This allows for implementation of complex digital circuits such as microprocessors An FPGA is reconfigurable, which means it can be erased and rewritten with new designs The configuration is data
Small Satellite Conference 3014 August 2003
Soft-Core Description A soft-core is a software expression in HDL of a hardware design
It is typically a slower design than the hardwired version
But it is not permanently wired
Small Satellite Conference 3114 August 2003
FPGA/Soft-core (cont) Combining these two technologies, (soft- core and FPGA), the capability exists to implement a soft-core processor in an environment where reconfiguring hardwired systems is difficult
Thus introducing COTS like performance in a non-COTS device
Small Satellite Conference 3214 August 2003
Design Considerations Radiation induced Errors
Can occur in the data as it is processed Can occur in the configuration of the FPGA Can occur in memory
Mitigation Strategies Avoid if possible
Parts selection If/when they occur, reduce their impact
Use of TMR Use of EDAC Use of background reconfiguration
Small Satellite Conference 3314 August 2003
Design Considerations Configuration errors
FPGAs can self-correct configuration errors Some errors may still slip through
CFTP design is intended for frequent reconfiguration,
correcting configuration errors is important. Configuration errors corrected in background through readback/reconfiguration process
I/O Errors FPGAs have a large number of I/O pins
Voting each input and output is costly and complex
Small Satellite Conference 3414 August 2003
Configuration Methods Master Slave Serial Mode
Default Load for the Configuration Controller
INIT2
CONFIG_CLK1
PROGRAM1
DONE1
DIN2
2 These standard configuration pins that revert to I/O pins post-configuration
MODE 0/1/21 0 0 0
CE
CCLK
CONFIG_CLK1
PROGRAM1
DONE1
DIN2DOUT/BUSY2
CF3
INIT1
3 CF specific to XC18V04 ISP PROMS. Red connection must be made during test and evaluation
MASTER
SLAVE
Configuration Methods SelectMAP Mode
Default for Configurable Processor
Configurable Processor
FPGA (X2)** 1 These are dedicated pins 2 These are user I/O pins configured to drive the SelectMAP mode
Configuration Control
FPGA (X1)**
MODE 0/1/21
** X1 or X2 can serve as the Flash memory and SelectMAP controller, as all required physical connections exist.
MODE 0/1/22
USER I/O_BUSY
USER I/O_INIT
USER I/O_DONE
USER I/O_CONFIG_CLK
USER I/O_CS
USER I/O_WRITE
PROGRAM1
OSCILLATOR
Configuration Methods JTAG/Boundary Scan
This layout uses inherent JTAG functionality to “waterfall” load, or selectively load (using the JTAG Header), the configurable components.
JTAG_TCK
JTAG_TMS1
JTAG_TCK1
JTAG_TCK1
TCK
TMS
X1_JTAG_TDI1
X2_JTAG_TDO1
JTAG_TMS1
JTAG_TMS
X1_JTAG_TDI
JTAG JUMPER
MODE 0/1/2
MODE 0/1/2
Small Satellite Conference 3714 August 2003
Configuration Methods Self-Scrubbing JTAG
JTAG_TCK2
X1_JTAG_TDI2
JTAG_TMS2
X1_JTAG_TDO2
1 These are dedicated pins 2 These are user I/O pins configured as JTAG controller pins
X1_MODE 0/1/22 1 0 1 MODE 0/1/21
Small Satellite Conference 3814 August 2003
Configuration Methods JTAG Loading the other FPGA
Configurable Processor FPGA (X2)
1 These are dedicated pins 2 These are user I/O pins configured to drive JTAG mode
JTAG_TCK1
X1_JTAG_TDI1
JTAG_TMS1
X1_JTAG_TDO1
X2_MODE 0/1/22 1 0 1 MODE 0/1/21
When JTAG daisy chain used, eliminate green connections and make blue connections
X1_MODE 0/1/22
Configurable Fault Tolerant Processor Configurable Fault Tolerant Processor (CFTP) for Space Based Applications(CFTP) for Space Based Applications
Small Satellite Conference 214 August 2003
Agenda Introduction
CFTP Objective Design a fault-tolerant reconfigurable System-On-a-Chip (SOC) to mitigate bit errors in computation for evaluation on- orbit Evaluate techniques for configuration protection
Small Satellite Conference 414 August 2003
CFTP Concept CFTP is centered on a reconfigurable Triple Modular Redundant (TMR) SOC that will overcome transient errors without full system resets and the commensurate loss of data
The flexibility of this design will enable on-orbit reconfigurations to the on-board architecture supporting dynamic mission requirements
Reducing development time and cost Improving reliability in hardware Increasing flexibility and upgradeability
Small Satellite Conference 514 August 2003
Motivation Current processors require radiation hardened (RADHARD), custom built, inflexible systems.
RADHARD parts lag current technology and are years old by the time of launch
Space systems development times are long with designs frozen early in the process
Upgrading to newer technologies difficult Space systems are often replenished for years without significant design changes (e.g. GPS) CFTP can provide updateable architectures for backwards and forward compatibility between systems via reconfiguration
Small Satellite Conference 614 August 2003
Space Application Once a satellite is in orbit, hardware changes are expensive, if even possible.
If reconfigurable logic can be used instead, then changes can be made via command and control communications, vice a personal visit.
CFTP can be reconfigured on orbit to correct errors, meet dynamic mission requirements, upgrade, or serve as back-up devices to several on-board systems.
Small Satellite Conference 714 August 2003
Effects of Radiation Total Ionizing Dose (TID)
Single Event Effects (SEE) Single Event Latchup (SEL)
Can be destructive Single Event Upset (SEU)
Can be mitigated Many Others
Small Satellite Conference 814 August 2003
Conceptual framework FPGAFPGA implementation of TMR softcore microprocessors SOC designSOC design 16 16 oror 3232 bit softcore microprocessors Maximize use of COTS products
Or at least provide COTSCOTS--like functionalitylike functionality MaximizeMaximize system speed and reliabilityreliability Minimize component cost and power Minimize component cost and power consumptionconsumption Introduce real time onon--orbit reconfigurabilityorbit reconfigurability
Small Satellite Conference 914 August 2003
Physical Framework Size
PC/104 Reconfigurability
COTS hardware preferred COTS performance targeted
Low Power Target 11 Watts or less, max
PC-104 Bus
The CFTP Concept
Fault-Tolerant Architecture
CFTP Components SOC
661,111 system gates 228 pins (162 I/O pins)
Controller XQVR600-4 CB228 FPGA XQV600-4 CB228 FPGA
Small Satellite Conference 1314 August 2003
CFTP Components Configuration storage for both FPGAs
Flash Memory (EEPROM) – µProcessor Intel TE28F320C3
32 Mbit
Development
Flight
CFTP Components System Memory
256Mbit, 16.7M-word x 4bit x 4bank, 3.3 V
Small Satellite Conference 1514 August 2003
Putting it all together
Primary Data Paths
Small Satellite Conference 1714 August 2003
Additional Data Paths Theses paths exist for additional adhoc storage for the µProcessor
These paths exist for additional adhoc communications between FPGAs
Small Satellite Conference 1814 August 2003
Current Project Status
Midshipman Space Technologies Applications Research (MidSTAR-1) Naval Postgraduate School Satellite (NPSAT1)
Seeking High-Radiation Orbit
SPACE TEST PROGRAM (STPSPACE TEST PROGRAM (STP--1),1), ATLAS V LAUNCH VEHICLE,ATLAS V LAUNCH VEHICLE, EstEst Launch March 2006Launch March 2006
Small Satellite Conference 1914 August 2003
Required Tests Development Tests Hardware Functionality Tests Operational Tests Environmental Tests
Small Satellite Conference 2014 August 2003
Development Tests Verify
Small Satellite Conference 2114 August 2003
Hardware Functionality Tests Confirm Functionality
with FPGAs ROM RAM EEPROM PC104 Bus
M em
Operational Tests Evaluate missions Built-In Self Test
Triple Modular Redundancy
Environmental Tests Launch Environment Testing
Random Vibration Testing Simulates vibrations on Spacecraft due to Launch Vehicle
On-Orbit Environment Testing Thermal Vacuum Testing
Verifies proper operation of Spacecraft under simulated space vacuum and temperature
Radiation Tests Evaluate susceptibility to SEUs and Total Dose Tolerance
Small Satellite Conference 2414 August 2003
Conclusions The design provides maximum flexibility
Allows for redundant reconfiguration methods Provides for configuration error mitigation Provides numerous options for future configurations with multiple data paths through the configurable logic Provides a fault-tolerant architecture for SEU mitigation
Small Satellite Conference 2514 August 2003
Questions?Questions?
Monterey, CA 93943
BACKBACK--UP UP SLIDESSLIDES
Radiation Environment
Solar Protons &
Heavier Ions
Solar Wind
Small Satellite Conference 2814 August 2003
FPGA Description A Field Programmable Gate Array (FPGA) is a high density Programmable Logic Device (PLD)
Built of small logic blocks in a sea of interconnects
Each logic block can emulate a digital circuit
Small Satellite Conference 2914 August 2003
FPGA Description (cont) If the circuit is large, smaller portions are instantiated in separate logic blocks and interconnected This allows for implementation of complex digital circuits such as microprocessors An FPGA is reconfigurable, which means it can be erased and rewritten with new designs The configuration is data
Small Satellite Conference 3014 August 2003
Soft-Core Description A soft-core is a software expression in HDL of a hardware design
It is typically a slower design than the hardwired version
But it is not permanently wired
Small Satellite Conference 3114 August 2003
FPGA/Soft-core (cont) Combining these two technologies, (soft- core and FPGA), the capability exists to implement a soft-core processor in an environment where reconfiguring hardwired systems is difficult
Thus introducing COTS like performance in a non-COTS device
Small Satellite Conference 3214 August 2003
Design Considerations Radiation induced Errors
Can occur in the data as it is processed Can occur in the configuration of the FPGA Can occur in memory
Mitigation Strategies Avoid if possible
Parts selection If/when they occur, reduce their impact
Use of TMR Use of EDAC Use of background reconfiguration
Small Satellite Conference 3314 August 2003
Design Considerations Configuration errors
FPGAs can self-correct configuration errors Some errors may still slip through
CFTP design is intended for frequent reconfiguration,
correcting configuration errors is important. Configuration errors corrected in background through readback/reconfiguration process
I/O Errors FPGAs have a large number of I/O pins
Voting each input and output is costly and complex
Small Satellite Conference 3414 August 2003
Configuration Methods Master Slave Serial Mode
Default Load for the Configuration Controller
INIT2
CONFIG_CLK1
PROGRAM1
DONE1
DIN2
2 These standard configuration pins that revert to I/O pins post-configuration
MODE 0/1/21 0 0 0
CE
CCLK
CONFIG_CLK1
PROGRAM1
DONE1
DIN2DOUT/BUSY2
CF3
INIT1
3 CF specific to XC18V04 ISP PROMS. Red connection must be made during test and evaluation
MASTER
SLAVE
Configuration Methods SelectMAP Mode
Default for Configurable Processor
Configurable Processor
FPGA (X2)** 1 These are dedicated pins 2 These are user I/O pins configured to drive the SelectMAP mode
Configuration Control
FPGA (X1)**
MODE 0/1/21
** X1 or X2 can serve as the Flash memory and SelectMAP controller, as all required physical connections exist.
MODE 0/1/22
USER I/O_BUSY
USER I/O_INIT
USER I/O_DONE
USER I/O_CONFIG_CLK
USER I/O_CS
USER I/O_WRITE
PROGRAM1
OSCILLATOR
Configuration Methods JTAG/Boundary Scan
This layout uses inherent JTAG functionality to “waterfall” load, or selectively load (using the JTAG Header), the configurable components.
JTAG_TCK
JTAG_TMS1
JTAG_TCK1
JTAG_TCK1
TCK
TMS
X1_JTAG_TDI1
X2_JTAG_TDO1
JTAG_TMS1
JTAG_TMS
X1_JTAG_TDI
JTAG JUMPER
MODE 0/1/2
MODE 0/1/2
Small Satellite Conference 3714 August 2003
Configuration Methods Self-Scrubbing JTAG
JTAG_TCK2
X1_JTAG_TDI2
JTAG_TMS2
X1_JTAG_TDO2
1 These are dedicated pins 2 These are user I/O pins configured as JTAG controller pins
X1_MODE 0/1/22 1 0 1 MODE 0/1/21
Small Satellite Conference 3814 August 2003
Configuration Methods JTAG Loading the other FPGA
Configurable Processor FPGA (X2)
1 These are dedicated pins 2 These are user I/O pins configured to drive JTAG mode
JTAG_TCK1
X1_JTAG_TDI1
JTAG_TMS1
X1_JTAG_TDO1
X2_MODE 0/1/22 1 0 1 MODE 0/1/21
When JTAG daisy chain used, eliminate green connections and make blue connections
X1_MODE 0/1/22
