MAPLD 2005 Anthony Lai, Radiation Tolerant Computer Design

Lai MAPLD 2005/121-S 2 Overview Processing power available from today’s off-the-shelf boards far exceeds that available only two years ago. The requirements to survive the rough trip into space, and the incessant radiation of in-space service has often necessitated using legacy radiation-tolerant electronics. From process and design advancement, leading-edge components are finding their way into earth-orbiting and deep space missions. Silicon-On-Insulator (SOI) processors are available. Board-level design techniques such as redundancy and voting logic can be utilized to bring desktop performance to space applications. A careful design strategy – tailored to the end application can yield high performance with high radiation tolerance.

Lai MAPLD 2005/121-S 3 Key Design Attributes Performance – Computer with unparalleled processing power to handle complex tasks for challenging missions. Open architecture – Allow for modularity and flexibility for longer life cycle. Space Environment – Computer must evolve to offer various levels of radiation hardness to survive and operate missions in orbiting and terrestrial environments. Nuclear-powered vehicles – Computer must withstand close proximity to a nuclear reactor. Multi-system use/reuse – Computer must be compact in size and useable in multiple roles on the vehicle. Traveling in space requires a launch and a re-entry with possible intermediate docking in space – Computer must be able to survive and operate through the severe launch and re-entry environments for multiple missions.

Lai MAPLD 2005/121-S 4 Elements of a Radiation Tolerant Computer High Performance Processor with cache Radiation Tolerant, High-Performance System Controller Memory Controller Flash Controller PCI and CompactPCI bridges Timers and counters Watchdog supervisory logic Interrupt controller Triple-voted volatile memory Redundant non-volatile storage for boot firmware Non-volatile memory for multiple applications or configurations mitigated with ECC correction/detection Peripheral I/Os for software development Board Support Package available for Commercial Off-The- Shelf (COTS) real-time operating systems

Lai MAPLD 2005/121-S 5 Representative Functional Block Diagram Processor Core Processor DC/DC Power Supplies Local PCI Bus Memory Bus FPGAs Local Bus cPCI Bus DMA PCI Bridge Triple Voting SDRAM ROM Controller UART Logic FLAS H USER FLASH With ECC Memory ControllerTimers FIRMWARE BOOT FLASH cPCI Backplane Watchdog Clocks Bus Interface PMC SITE cPCI Bridge Serial Port Interface Specific I/O PMC

Lai MAPLD 2005/121-S 6 Center Processing Unit The microprocessor selected for space application must be low power (unless the spacecraft is powered by a nuclear reactor) – Watts per MIPS is as high as 3.5W per 1600 DMIPS with today’s processors The SOI process allows the operation of processors in space with high degree of SEL immunity With the addition of L1 and L2 on-die data and instruction cache along with dynamic branch prediction, dramatically increase processing power. In some cases, L1 cache is also protected with parity and L2 cache is protected with ECC (single-bit correction and multi- bit detection).

Lai MAPLD 2005/121-S 7 PowerPC™ System Controller The controller functions can be implemented with anti-fuse FPGA chipset. The system controller includes the following features: Flash controller for dual-redundant 16-bit boot flash Flash controller for 32-bit user flash with ECC Watchdog mechanism Reset circuitry Interrupt controller Timers Triple-voted SDRAM controller PCI bridge for local bus cPCI bridge for cPCI bus backplane master/slave access 60x local bus interfaces

Lai MAPLD 2005/121-S 8 Representative System Controller Diagram

Lai MAPLD 2005/121-S 9 SDRAM Volatile Memory SDRAM is triple redundant – three separate banks of SDRAM are distributed across the SBC. A voting mechanism is incorporated in a radiation tolerant FPGA. The SDRAM controller controls signals that are connected directly to 3 SDRAM banks (32bit bus).

Lai MAPLD 2005/121-S 10 Boot Flash The Boot Flash is used for storing the Startup firmware for execution after reset/power-up. There are two Boot Flash devices residing in parallel and controlled by the ROM/Flash Controller FPGA and rad-hard watchdog supervisor. They occupy the same address space (hard coded in the ROM/Flash Controller) and are selected through two different chip select signals generated by the ROM/Flash controller. The Boot Flash is 16-bit wide and may be accessed by read cycles of 8, 16 and 32-bit wide transactions, while write to the Boot Flash may be performed in 16-bit only cycles.

Lai MAPLD 2005/121-S 11 User Flash The user flash is implemented with three flash components. Each flash component has a 256 Mb or 32 MB capacity. The first two components are for data storage. The third component is designed to store 7 or 8 bits of ECC data for each 32-bit of data. User flash is 64 MB.

Lai MAPLD 2005/121-S 12 PCI and cPCI Bridges The 60x-PCI bridge interfaces the CPU 60x bus to PCI Bus. The design contains several major modules: PCI Core logic - supports (c)PCI master and (c)PCI target transactions. 60x core logic - supports 60x bus master and slave transactions. PCI arbiter – supports the PCI master devices (Ethernet, PMC) cPCI arbiter – supports the cPCI master devices 60x address and data arbiters – supports the S950 60x master devices (CPU, 60x-PCI Bridge and 60x-cPCI Bridge) Interrupt controller – controls all board’s external and internal interrupts through a set of registers.

Lai MAPLD 2005/121-S 13 Other FPGA Features RS422 UART – up to kbps Two serial ports is implemented as asynchronous UART interfaces. These serial ports incorporate control and status registers mapped into the processor’s memory space. Watchdog Supervisor Operate in conjunction with the onboard 1.6-second watchdog supervisory circuitry to issue a proper reset. Reset Mechanism The ROM/Flash Controller implements a reset mechanism that supports reset events from software-initiated reset, push-button reset, JTAG Reset and the circuit supervisor, watchdog timer reset and PFO (Power Fail Output) signals coming from the circuit supervisor. The reset mechanism also supports switching between the two dual redundant boot Flash devices in case one of them is corrupted and the boot up sequence is not completed. Only when the computer is used in the system slot, it will be able to generate a reset on the cPCI backplane.

Lai MAPLD 2005/121-S 14 Summary A radiation tolerant computer design is presented based on 3 generations of space computer development. In an instance of a design, radiation testing has been performed to characterize the board-level upset rates. Performance benchmarked for design was completed with operating system and board support package overhead. Variants using the same design (PCB with multiple foot prints) allow software compatibility and reusability for various short-term and long-term LEO missions, Mars/Lunar terrestrial exploration, CEV and other similar radiation environment. Typical applications: Mission computer with redundancy option Flight guidance and navigation computer Mission Data Recorder Video Recorder Robotic Controller