Insert Paper Title Here
Total Page:16
File Type:pdf, Size:1020Kb
RADIATION-TOLERANT SYSTEM-ON-CHIP (SOC) WITH DETERMINISTIC ETHERNET SWITCHING FOR SCALABLE MODULAR LAUNCHER AVIONICS Christian Fidi, Ivan Masar, Jean-Francois Dufour, Mirko Jakovljevic, TTTech Computertechnik AG, Vienna, Austria for long duration manned missions that cannot be Keywords supported or resupplied from earth. Next-Gen Launcher Avionics, Integrated Modular Furthermore, increasing levels of integration and Architectures, Mixed Criticality Systems, SoC, Cyber- IMA capabilities allows the optimization of a set of Physical Systems, SAE AS6802, AFDX, TTEthernet functions, and new considerations on system architecture. Abstract Space Industry and COTS In space applications with very demanding Space industry is a low-volume industry which environment for electronic components, dedicated devices requires costly high-integrity components designed for are needed to ensure the required reliability and special space environments and operation time of over 20 availability for different mission profiles. Therefore, a years. To reduce system costs, open software platform dedicated reconfigurable radiation-tolerant SoC (System- standards and COTS components are considered in On-Chip) with integrated computing and Ethernet different programs. switching supports the design of future modular As an example, since the Constellation program, architectures. This work presents the motivation for its NASA’s strategy for the design of future spacecraft introduction and describes key SoC properties and architectures (including launchers, landers, etc.) has advances in high performance networking and heavily prioritized the use of COTS technologies for the semiconductor technology for scalable next-generation purpose of reducing cost, minimizing the required amount space avionics systems. of additional development, and removing the schedule risk associated with the creation of custom hardware. Introduction However, many spacecraft subsystems require a high Modern spacecraft architectures are moving towards degree of reliability and fault tolerance (e.g. 10-9 adopting Integrated Modular Avionics (IMA) architecting failures/hour) not traditionally achievable without the use principles, with tighter payload and platform integration. of specially designed and proprietary solutions (e.g. IMA enables use of a smaller set of components and custom self-checking computers). Studies conducted modules which can be (re)used for different missions and during the Orion program showed that the application of in different topologies with minimal modifications. purely COTS designs to such systems would result in insufficient reliability and undue expense over the life of Typically, such integrated systems contain a number the program [2,3]. of real-time and hard real-time functions which share common computing, networking/wiring, IO, power supply, These problems are compounded by the IMA physical housing, and other physical embedded resources philosophy of leveraging the same hardware resources for lead to reduction in physical complexity. Such resource both critical and non-critical functions, and the resulting sharing reduces SWaP (Size, Weight and Power), or need for robust time and space partitioning within both the facilitate some other desirable architecture optimizations. computing platforms (e.g. memory space, computation The overall reduction in computing platforms, unique time) and the data network (e.g. bus access) [4]. sparing, connector count, reduction and harness mass in Nonetheless, advancements in COTS technologies (e.g. in more integrated spacecraft avionics potentially offers radiation tolerance) continue to make their incorporation significant cost and weight savings over federated design into architectures for human-rated spacecraft more feasible approaches [1]. The resulting increase in commonality, and attractive. Especially the components from both among the interfaces and hardware platforms commercial aerospace, defense or other critical themselves, supports reconfiguration and maintainability infrastructure applications, may use appropriate design assurance and robust internal architectures, can be Those issues can lead to system state explosion even attractive for integrated space systems [5]. with deterministic asynchronous communication, and the solution [11-12] is to have a verified synchronous operation model, robust global time, input synchronization, Integrated systems with Hard RT Performance at which are the cornerstones of TTA [9] model and SAE Reduced Complexity AS6802-based IMA systems. There are two types of complex integrated Deterministic modular controls and integrated architectures, as described in RTCA DO-297 [6]: architectures based on periodic TDMA communication • Complex IMA with fixed latency and strictly controlled jitter use TTA • Distributed IMA computing model. Early space systems, with MIL-1553 Complex IMA systems are designed around databuses operating in synchronous mode and triple/quad- ARINC653/ARINC664 [7] and L-TTA [8] redundant synchronous computers and networks fall into computing/communication model, while Distributed IMA the same category. This approach is attractive as it reduces can be built around ARINC653, TTA [9] or L-TTA logical complexity, simplifies resource sharing, and computing/communication model, and requires unambiguously determines all key system interfaces. synchronous or time-division multiplexing (TDM) Unfortunately with MIL-1553, low bandwidth and long- communication. Distributed IMA has been used in term obsolescence issues become more critical over time. different forms since 1980s, in avionics and modular Therefore, both the French R&T projects (Avionic-X [13]) aircraft control architectures for deterministic system and the Future Launcher Preparatory Programme (FLPP integration and minimized use of embedded resources. Period 2) trade-offs have concluded that the Ethernet based This approach was useful due to low computing and switched networks are the most promising option for the networking bandwidth. future, due to their capabilities, and broad cross-industry support (telecommunication, commercial aircraft and Since 2006, Time-Triggered Ethernet (standardized automotive) [14]. as SAE AS6802 [10]) has enabled synchronous Ethernet communication without traffic congestions, which enables Therefore, SAE AS6802 supports Ethernet-based the realization of complex IMA and Distributed IMA time-driven communication which enables specific properties in one integrated system. capabilities in architecture and embedded platform design, which cannot be fully or at all realized by asynchronous Switches with SAE AS6802 services, can support communication, such as: integration of asynchronous ARINC664 communication and best-effort Ethernet communication in one network, so System-level hard RT performance and virtualization that system architects can use the system integration for distributed functions approach, which meets their application constraints for Full decoupling of software function from controlled scalable determinism and functional integration. Both SAE object due to full QoS guarantees (fixed latency, µs- AS6802 and ARINC664 are complementary Layer2 jitter, hard RT communication) enhancements tailored to design a set of parameter-driven Integration of mixed criticality functions and critical architectures using different models of computation and functions in open systems communication such as TTA and L-TTA. Modifications do not change temporal behavior of The complexity issues with asynchronous system already integrated functions integration for IMA and advanced architectures and Complexity reduction for embedded platform and resulting complexity has been recognized by industry middleware with full separation of temporal and leaders [11]. Key challenges with asynchronous functional behavior communication are: Simplified sensor fusion and redundancy management Significantly reduced consumption of embedded • Jitter: Nodes execute at slightly varying times, and resources, as different function operates in synchrony messages arrive at slightly different times without excessive queue memories • Non-deterministic (or not fully deterministic) Simpler software and reduction in LOC (line-of-code) behavior: non-deterministic ordering of interactions count between nodes Reduction in system integration costs and effort • Race Conditions: Behavior dependent on order of interactions between nodes There are other issues related to design methodology, • Deadlock: Unanticipated execution sequences incremental certification and system upgrades. With SAE AS6802 latency/jitter bounds and constraints can be set • No Fault Found (NFF): Non-repeatable failures first, and then the configuration is calculated. With ARINC664, latency/jitter can be calculated using Network separate systems will not change how they operate. System Calculus (NC) only after all traffic and virtual links (VLs) functions will simply recognize loss of sensors or data, in in the system are known. Network calculus computes some parts of the system, but they will not change their bounds from network traffic configuration based on real-time behavior or subsystem synchronization. If periodicity and priority [15], and it does not start with configured so, the launcher can be integrated with ground latency and jitter constrains as design input. segments and controls and operate as one integrated real- Therefore, the jitter/latency fine tuning is time system until the launch. accomplished iteratively as performance of