1. Final Presentation DigiSat Reliable Computer – Multiprocessor Control System, Part B. Niv Best, Shai Israeli Instructor: Oren Kerem, (Isaschar Walter) HS-DS Lab, Technion, Winter 2004 This presentation will probably involve audience discussion, which will create action items. Use PowerPoint to keep track of these action items during your presentation In Slide Show, click on the right mouse button Select “Meeting Minder” Select the “Action Items” tab Type in action items as they come up Click OK to dismiss this box This will automatically create an Action Item slide at the end of your presentation with your points entered.

2. Project Goals Design & implement a hardware mechanism for multiprocessor monitoring & control. Part of the DigiSat reliable computer project.

3. Part A Goals Familiarize ourselves with the PowerPC 405 core, Virtex II-pro development board. Study various lab tools available to us. Conceive a monitoring scheme for a multiprocessor system.

4. Part B Goals Find ways to monitor as many PowerPC & PLB signals as possible. Simulate a triple processor system. Develop an error simulation model. Implement the monitoring system. Test & debug.

5. The DigiSat Computer PowerPC based. Implemented upon the Virtex II-pro platform. Hardware redundancy throughout the entire system. Our project handles processor redundancy.

6. Description Satellites contain redundant hardware since servicing in space is not applicable. A monitoring system is required to identify & handle malfunctions. Must be implemented in hardware.

7. DigiSat Computer M1 M2 S1 S2 PLB PPC 1 PLB PPC 2 PLB PPC 3 PLB Comparator

8. Technology Virtex II-pro FPGA with embedded PowerPC cores.

9. PowerPC 405 32-bit RISC core. Low power consumption. Used in various system-on-chip (SoC) applications (PDAs, network routers, cellular phones…). Embedded within the Virtex II-pro platform.

10. Software Used

11. Triple Modular Redundancy 3 processors running in parallel. The processors’ signals are constantly monitored and compared. Errors are detected via a majority vote. Upon error detection an appropriate reset signal is sent to the faulty processor.

12. Triple Modular Redundancy After reset, The faulty processor is loaded with an image of the other 2 processors. Operation is resumed – 3 processors, identical in state, running in parallel. NOTE: PowerPC 405 does not support image loading & dumping. Our project focuses on error detection.

13. Triple Modular Redundancy PPC 1 PPC 2 PPC 3 Comparator “Brain” PLB 1 PLB 2 PLB 3 PLB

14. Actual Implementation Requires a development board with 3 processors. Available board contains only one. A 3 processor system needs to be simulated. Random errors are generated in order to test the system.

15. Actual Implementation PPC Comparator Brain PLB 1 PLB 2 PLB 3 PLB Bus Multiplier Random Error Generator Multiple Processor Simulation

16. Detailed System Diagram PPC PLB Arbiter Signal Collector Bus Multiplier Corrector Arc PLB Sigs Bus Collector Error Generator Bus 1 Bus 2 Bus 3 Comparator WD Output Bus Reset Resolver TMR Brain PPC Reset Signals WD Single Sampler Capturer

17. Signal Collection & Concatenation Unit NameSourceWidth Signal_Collector PowerPC23 Corrector_Arc PLB Arbiter133 X 3 PLB_Sigs Corrector_Arc133 Bus_Multiplier Signal_Collector23 X 3 Bus_Collector PLB_Sigs & Bus_Multiplier 156

18. Random Error Generator Receives the 3 identical busses from the “big bus” multipliers, and applies an error to one of the busses at random.

19. Comparator Compares the 3 buses and outputs the majority outcome of the 3. Also outputs a “comparison report”, which is the logical XOR of each bus with the majority vote. Comparison Formula: (in1 AND in2) OR (in2 AND in3) OR (in1 AND in3)

20. Single Sample Generates a very short error (one clock cycle). Relays the output signals from the comparator to the reset resolver as usual until a flag signal is asserted. Upon assertion continues relaying the signals for one more clock cycle and then zeros the signals as if there was no error at all.

21. Reset Resolver reads the Comparator’s error reports and checks them for errors. If one of the signals isn’t all ‘0’, a corresponding error signal is asserted, designating which processor must be reset.

22. Watchdog Units listens to bus activity and issues a “bark” signal if the bus becomes idle for an extended period of time. Issues 3 “warnings” before entering a final bark state. After 3 counting cycles of no bus activity, the watchdog issues a “big bark”, which requires handling before the watchdog can return to normal operation.

23. Watchdog Diagram

24. Watchdog Demonstration

25. TMR Brain Receives all the monitoring units’ outputs and is in charge of initiating the appropriate correctional activity.

26. Capturer Captures and displays short errors generated by the error generator. Regularly, displays the outputs of the “Brain”. Whenever a short error is detected, holds the corresponding error detection signals asserted until a reset occurs. Used for demonstration purposes only.

27. Error Generator Demonstration Comparator Processor 1 Processor 2 Processor 3

28. Identifying Faulty Processor ppc_1_rst ppc_2_rst rst1 rst2 rst_o1_obuf rst_o2_obuf capture Brain output reset signals Brain input reset signals Capturer output reset signals Error start Capture start Error end

29. Future Developments Core loading / dumping : Optional for other processors in the PowerPC family. Processor synchronizing : Optional for other processors in the PowerPC family. Software interrupts : allows better watchdog monitoring.

30. Project Advantages The system can detect single cycle errors, which are common in the cosmic environment. The system is NOT processor-specific: Changing processors requires only bus- width & signal name adjustments.