1. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 1 Software for the ELMB Henk Boterenbrood ATLAS DCS

2. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 2 Outline ELMB Applications Implementation: ELMBio Measures against Radiation Effects Plans for new Features and Upgrades Conclusion

3. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 3 ELMB Applications Envisage many different monitoring & control applications  Limited only by processing power and resources (Flash, RAM, I/O) Common software features/requirements  CANopen communication  In-System-Programming via CAN-bus  Measures to counter effects of SEU  Configuration storage in EEPROM (incl. CRC)  Low-level control of on-board devices (ADC, CAN)  C, using a commercial development toolset

4. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 4 General-purpose  no specific I/O processing or features Demonstrator, example, framework  Ready-to-use (with ‘Motherboard’)  Binary, source code and documentation on the web I/O  64 analog inputs (16-bits)  64 analog outputs (12-bits, requires external ELMB-DAC module )  8 to 16 digital inputs  8 to 16 digital outputs ELMBio Application Firmware (1)

5. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 5 Communication: CANopen  Object Dictionary reading and writing using SDO messages ( Service Data Object )  I/O-data communication using PDO messages ( Process Data Object ) configurable: triggered by: SYNC, timer, Change-of-State  Network management (node ‘state’)  Lifeguarding, Nodeguarding, Heartbeat ELMBio Application Firmware (2) (underlined: CANopen message types and services)

6. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 6 ELMBio Application Firmware (3) Other features  Configuration options (e.g ADC, Comm, etc.; in the Object Dictionary )  Configuration/parameter storage in non-volatile memory (EEPROM)  Different application configurations possible using compile options for on-chip ADC some rad-tolerant features motherboards  To be used with ‘Slave’ processor application (also provided) Watchdog In-System-Programming-via-CAN-bus

7. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 7 Radiation Effects: SEU (1) Single Event Upset (SEU  ‘bit flip’) Flash memory (program code) appears to be unaffected EEPROM storage (configuration) appears to be unaffected RAM and registers (CPU, devices) are all affected by SEUs

8. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 8 Radiation Effects: SEU (2) SEE test at Louvain-la-Neuve very useful ! Standard ELMBio application with extensions doing memory checks (every 5 s)  Flash (program code CRC, pattern in unused space)  EEPROM, RAM (patterns in unused space)  CAN (unused registers), ADC (regs with known values) …but also: application ‘misbehaving’, crashes…  There is (almost) always some explanation !

9. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 9 Anti-SEU Measures in Software (1) Refresh of RAM and register content  Global variables (configuration) re-read from EEPROM before every use (option)  Microcontroller I/O-ports and Data-Direction Registers periodic refresh (value from flash)  CAN-controller message descriptor refresh when reading/writing message buffer (option) reset (full config refresh) at Lifeguarding time-out other problems detected by host and resolved e.g. by soft/hard reset  ADC configuration refresh before each channel scan (value from EEPROM & flash) full reset/recalibration/configuration refresh before each channel scan (configurable)

10. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 10 Anti-SEU Measures in Software (2) Other…  Dummy handlers installed for unused interrupts (in case of spurious interrupts; remove source of interrupt if any)  Explicitly check for 0-or-1 for ‘boolean’ variables (instead of =0 or  0)  Mask an index with maximum size, when known  CRC checksums on parameter storage in EEPROM on program code in Flash

11. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 11 Anti-SEU Measures in Software (3) 2 nd ELMB (‘Slave’) processor with dedicated task  Watchdog periodic ‘interrupt’ from Master to Slave, or else… non-functioning Slave is reported by Master  In-System-Programming via CAN-bus Master program reload or upgrade (or Slave) using CANopen (  does not interfere with other CAN comm!) …but not during radiation (made possible thanks to the ingeneous way in which the 2 processors on the ELMB are integrated, combined with some clever software !)

12. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 12 ADC periodic sampling  Channel upper and lower limit (window) check Scanning period, global enable (EEPROM) Limits per analog input channel (EEPROM) (Async) data transfer only in case of over/underlimit (crossing?)  Delta change (more SEU sensitive) Scanning period, global enable (EEPROM) Delta per analog input channel (or one Delta for all chans?) (EEPROM) (Async) data transfer only in case of a delta increase/decrease  Standard ADC read-out still possible ! New FeaturesPlanned (1)

13. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 13 New FeaturesPlanned (2) ADC calibration  Purpose: ADC read-out returns voltage values instead of raw ADC counts  Need to determine offset/gain  Permanent storage of calibration values onboard (EEPROM), also offline?

14. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 14 New FeaturesPlanned (3) DAC  Optionally (initial) DAC settings stored in EEPROM set at power-up  Optional periodic DAC output value refresh (EEPROM, anti-SEU, if radiation tests show DAC can be used !); in combination with ADC feedback ?  Set a 4-20 mA current output directly, e.g. using a  A value in the CAN-message (ELMB does the conversion to a DAC value)  Ramping function, e.g. to control a HV-supply End value and ramping speed

15. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 15 New FeaturesPlanned (4) CAN Message read-out under interrupt (and message buffer in RAM), because…  ADC or DAC operations are slow due to low-power opto-couplers used and…  async periodic ADC/DAC operations may cause message loss when a host sends multiple messages of the same ‘type’ (currently CAN-controller acts as a one-message/type buffer) (CAN-controller interrupt line now used in Master/Slave watchdog function  sw adjustment)

16. ATLAS DCS ATLAS DCS ELMB PRR, 4 Mar 2002, H.Boterenbrood 16 Conclusion Users of the general-purpose application ( ELMBio )  use as-is (flexibility: CANopen configuration, compile-time options)  further development on-going  functionality may be added on request Developers of custom applications  can/should use the general-purpose app as a framework  if required, should apply anti-SEU measures where possible  must use CANopen  must use Slave app for 2 nd processor (and add appropriate functionality to the Master app)