HIGH PERFORMANCE ELECTRONICS FOR THE NEW SPACE AGE

Transcription

1 APP18-01c APPLICATION NOTE NOVO SPACE HIGH PERFORMANCE ELECTRONICS FOR THE NEW SPACE AGE INTRODUCTION Most subsystem can be partially or fully implemented using one or more of Novo s components. This document presents the vision of the company on what is possible with current and future Novo s products. These applications can be grouped in three broad categories: 1. Payloads 2. Avionics 3. Avionics and payload combined This application note presents one example for each category. In the Annex, there is a brief general discussion on system reliability. This document is a draft. September 2018, Novo Space, - For more information contact info@novo.space 1

2 SYSTEM COMPONENTS Novo s products are well suited for high-bandwidth subsystems and payloads such as highresolution cameras, high-throughput video, avionics, communication payloads, and synthetic-aperture radars. These high-performance components will favor a higher level of integration, where complex tasks are performed not by different subsystems in individual boxes but in modules connected through a highthroughput backplane, to enable high levels of reliability and low SWaP (see case study 3). The SpaceVPX [1] ecosystem developed by Novo Space [7] includes SpaceVPX backplanes (motherboards), SpaceVPX daughterboards, and FMC [2] mezzanine cards: - Backplanes. The backplane provides fast interconnect through high-speed serial links. Novo s backplanes are designed for the specific needs of the mission, according to the level of reliability and number of SpaceVPX boards in the system. - SpaceVPX daughterboards. Novo developed three different daughterboards: one CPU [3] and two Signal Processors or Smart Carriers [4, 5]. Novo is planning to develop a SpaceVPX Switch in FMC mezzanine cards. FMC cards offer flexibility to add mission-specific hardware to the system. Novo Space is developing the following FMC boards: Solid-State Recorder (SSR) or mass memory [6] High-speed ADC and DAC High-throughput interfaces like Camera Link and SpaceWire. Low-speed control interfaces like MIL-STD-1553-B, UART, CAN, and more. In this application note, the SpaceVPX daughterboards and the FMC mezzanine cards are represented using blue and green circles respectively. Blue bubbles with a heavy dark outer line represent SpaceVPX CPUs and blue bubbles without the outer line represent SpaceVPX Smart Carriers. September 2018, Novo Space, - For more information contact info@novo.space 2

3 Figure 1: 3U SpaceVPX daughterboard and FMC Mezzanine card The SpaceVPX daughterboards are the core of the system. The CPU consumes very low power and supports multiple Operating Systems. It can be used to control the activity inside and outside the SpaceVPX box. On the other hand, the Smart Carriers are high-performance and power hungry processing systems. Refer to [3, 4, 5, 6] for more information on Novo s products. Table 1 presents the slot and module profiles applicable to both the Smart Carriers and the CPU. These profiles are described in detail in [1]. Table 1: Slot and module profiles supported by the CPU and Smart Carriers. September 2018, Novo Space, - For more information contact info@novo.space 3

4 These two slot profiles specify the way in which the 224 pins in the SpaceVPX connector are assigned to the different planes defined in the standard. The two profiles as implemented by both the CPU and the Smart Carrier are illustrated in Figure 2. Key Key Utility P0 Utility P0 DP0 (FP) DP0 (FP) DP1 (FP) DP1 (FP) NA CP08 (TP) CP07 (TP) CP06 (TP) CP05 (TP) CP04 (TP) CP03 (TP) CP02 (TP) CP01 (TP) Space UM Signals 1-4 Key User 4 SE NA User 8 DIFF CP02 (TP) CP01 (TP) Expansion User Defined 32 Pairs (DIFF) Key Utility Plane Data Plane Control Plane Expansion Plane User defined pins SpaceUM signals Figure 2: System Controller profile SLT3-CON-2F8T (left), payload profile SLT3-PAY-2F1Q2T (center), references (right). The SLT3-CON-2F8T profile has eight Thin Pipes (TP, four differential pairs) to control the activity in the subsystem through the Control Plane and the SLT3-PAY-2F1Q2T has only two pipes for redundancy. Both profiles have two Data Plane Fat Pipes (FP, eight differential pairs). In addition, the SLT3-CON-2F8T profile drives the signals that are connected to the Space Utility Management module (SpaceUM), such as clocks and resets. In 2019, Novo Space will develop a Switch consisting of six FPs and two TPs on the Data Plane and Control Plane respectively, as shown in Figure 3. September 2018, Novo Space, - For more information contact info@novo.space 4

5 Key Utility P0 DP0 (FP) DP1 (FP) DP2 (FP) DP3 (FP) DP4 (FP) User 8 SE DP5 (FP) User 8 DIFF CP02 (TP) CP01 (TP) Key Figure 3: Switch profile SLT3-SWH-6F2T September 2018, Novo Space, - For more information contact info@novo.space 5

6 APPLICATIONS CASE STUDY I: PAYLOAD SYNTHETIC APERTURE RADAR (SAR) This section presents a case study consisting of a 32-elements digital phased array radar. The raw data is processed onboard the satellite to reduce the amount of data downloaded to ground. Each Novo Space module has eight serial data interfaces routed between the FMC mezzanine card and the SpaceVPX board, supporting a 4 ADC / 4 DAC mezzanine card capable of synthesizing and sampling the baseband signals for four radiating elements of the antenna. Each SpaceVPX Smart Carrier acts on the amplitude and the phase at the four signals sent to and received from each radiating element in order to steer the beam in the desired angle. In the star configuration selected for this application, the data from the ADCs is preprocessed in the Smart Carriers and sent to the Formatter. The Formatter reroutes the data to the corresponding Smart Carrier to perform the next step in the processing chain. The Formatter is implemented using Novo s CPU working in System Controller configuration. The Smart Carriers are called DSP in this configuration due to the specific tasks implemented in these boards. The DDR3 memory on the Smart Carrier buffers the data transferred between the FMC and the SpaceVPX interface. If the duty cycle of the conversion windows used to sample the echo signal and the sampling frequency are high, then the serial data interface between each DSP module and the Formatter module will not support the data rate generated by the four ADCs on the FMC card. In that case, the unused serial data interfaces available on each DSP module can be used to connect the DSP modules to each other, resulting in a mesh topology with a distributed Data Switch. September 2018, Novo Space, - For more information contact info@novo.space 6

7 Figure 4: Synthetic-aperture radar with star topology backplane The Formatter module is in charge of the last processing layer, including image compression and storage. The SSR FMC securely stores formatted data, which are retrieved and sent to the downlink through the frontal SpaceWire (SpW) connectors in the CPU board when the satellite is in view of the ground station. Other interfaces can be implemented to support higher data rates. The SpaceVPX IO module is used to receive commands from and send telemetry data to the control and data handling (CDH) subsystem. The architecture described in this section can be implemented using the following Novo s components: 1 x SpaceVPX CPU 8 x SpaceVPX Smart Carrier 1 x SpaceVPX I/O board, custom design 1 x FMC SSR 8 x FMC 4xADC/4xDAC 1 x 10 slots SpaceVPX backplane with Power module and SpaceUM September 2018, Novo Space, - For more information contact info@novo.space 7

8 Fully digital phased array, 32-radiating elements 1 TB storage in SLC or 8 TB storage in MLC (*) Slant range resolution better than 5 meters High-performance processing system JTAG network (**) Ruggedized design Operational temperature: -25 C to +60 C Robust system diagnosis and control through IPMI Figure 5: Render of the SAR subsystem (*) Data protected with Reed-Solomon encoding and interleaving (**) All modules connected to the same network accessible from the side September 2018, Novo Space, - For more information contact info@novo.space 8

9 CASE STUDY II: AVIONICS FOR SMALL SATELLITES The avionics subsystem is critical to the mission since it controls the communications and attitude of the satellite, among other critical functions. Hence, the subsystem cannot fail, and even temporary failures could present a high risk to the mission. For this reason, a fully redundant system in mesh configuration is presented in this section. A mesh topology connects each slot directly to every other slot without the use of a centralized Switch slot, although a switch can be embedded in the Payload modules. In the application presented in this section, each component in the subsystem has its own redundancy with full cross-strapping connecting all the components and redundancies. In a full-mesh, the failure of one module does not affect the ability of any working module to communicate with any other module in the mesh. Figure 6: Fully redundant avionics subsystem with mesh topology backplane September 2018, Novo Space, - For more information contact info@novo.space 9

10 In this system designed for small satellites, the functionalities of both CDH and the Attitude and Orbit Control subsystem (AOCS) are combined in a single SpaceVPX module to reduce size, weight, and power (SWaP). The telemetry data generated in the SpaceVPX subsystem and the data received from external payloads are stored in the SSR. This information is downloaded to ground through the High- Data Rate Downlink when the ground station is in range. The avionics of a small satellite described in this subsection can be implemented with the following Novo s components: 2 x SpaceVPX CPU 2 x SpaceVPX Smart Carrier 2 x FMC SSR 2 x FMC High data rate modulator, not developed yet 1 x SpaceVPX I/O board custom design 1 x 5 slots SpaceVPX backplane custom design 1 x Power module 10 Gbps bandwidth between any two components 1 TB storage in SLC or 8 TB storage in MLC (*) Functional redundancy Mesh configuration JTAG network (**) External payload Optional 1553 interface Optional SpW interface Optional CAN interface Ruggedized design Operational temperature: -25 C to +60 C Robust system diagnosis and control through IPMI Figure 71: Render of the fully redundant avionics subsystem (*) Protected with Reed-Solomon encoding and Interleaving (**) All modules connected to the same network accessible from the side September 2018, Novo Space, - For more information contact info@novo.space 10

11 Figure 7 shows a render of the subsystem described in this subsection displaying only the nominal modules. The subsystem has no credible single points of failure. The spare modules can be powered on and off as needed and work in cold or hot backup configuration. The Data and Control Planes are dualredundant (point-to-point cross-strapped). September 2018, Novo Space, - For more information contact info@novo.space 11

12 CASE STUDY III: AVIONICS AND PAYLOAD IN THE SAME BOX In most not-so-small satellites, the AOCS and CDH subsystems are implemented in two different modules, enabling development teams to work independently and integrate the system later on. This level of modularity is also beneficial in reusing modules in multiple missions. When splitting the functionality in multiple modules, the two Data Planes Fat Pipes (eight differential pairs) per module defined in the standard are insufficient to connect all the electronic boards in a mesh. In this case, a Star topology can be used to connect the modules. A Star topology connects Payloads through a centralized Switch. In a Dual Star configuration, a second Switch is added to the system to increase the overall fault tolerance. Every Payload slot in the system is connected to both Switches. There is cross-strapping between the primary and redundant modules so that any one module can fail and the remaining modules can operate with any of the primary or redundant modules. September 2018, Novo Space, - For more information contact info@novo.space 12

13 Figure 8: Fully redundant avionics subsystem and payload with dual star topology backplane The two main disadvantages of the dual-star system are SWaP and cost. As described above, the SpaceVPX standard groups the eight data lanes in the Data Plane into two Fat Pipes, reducing the flexibility of the modules. A non-standard use of the serial data lanes gives the system a higher level of reliability in exchange for bandwidth. For example, a fully functional mesh can be implemented using the eight serial data lanes individually as depicted in Figure 9. September 2018, Novo Space, - For more information contact info@novo.space 13

14 SpaceVPX Modulator (Nominal) Solid State Recorder (Nominal) I/Os (Nominal) Sensors and Actuators Payload (Nominal) CDH (Nominal) AOCS (Nominal) Amplifier & Antenna Gimbals, gain control, etc High DR Downlink (Nominal) High DR Downlink (Redundant) I/Os (int. redundancy) Low DR Link Heaters and thermistors Modulator (Redundant) Payload (Redundant) CDH (Redundant) AOCS (Redundant) Solid State Recorder (Redundant) I/Os (Redundant) SpaceVPX Data plane SpaceVPX Control plane SpaceVPX Expansion plane SpaceVPX User defined FMC External interface Figure 9: Fully redundant avionics subsystem and payload with mesh topology backplane. The bold red line between CDH and the High-DR Downlink represents two serial data lines used to download high volumes of data stored in the SSR during periods of no visibility of the ground station. Figure 10 shows a render of the physical configuration of the subsystem described in this section displaying only the nominal modules. September 2018, Novo Space, - For more information contact info@novo.space 14

15 10 Gbps bandwidth between any two components 1 TB storage in SLC or 8 TB storage in MLC (*) Modular redundancy Double Star configuration Dynamic data routing JTAG network (**) Internal payload Optional 1553 and SpW interfaces Ruggedized design Operational temperature: -25 C to +60 C Robust system diagnosis and control through IPMI. Figure 10: Render of the fully redundant avionics subsystem and payload (*) Protected with Reed-Solomon encoding and Interleaving (**) All modules connected to the same network accessible from the side The subsystem has no credible single points of failure. The spare modules can be powered on and off as needed and work in cold or hot backup configuration. The Data and Control Planes are dualredundant (point-to-point cross-strapped). September 2018, Novo Space, - For more information contact info@novo.space 15

16 REFERENCES [1] ANSI/VITA SpaceVPX System, ANSI/VITA OpenVPX System Standard, April 2015 [2] ANSI/VITA 57.1 FPGA Mezzanine Card (FMC) Standard, Approved July 2008 (Revised February 2010) [3] Novo Space, 3U SpaceVPX SMART CPU Product Brief, August 2018 [4] Novo Space, 3U SpaceVPX SMART CARRIER I Product Brief, August 2018 [5] Novo Space, 3U SpaceVPX SMART CARRIER II Product Brief, August 2018 [6] Novo Space, FMC Mass Memory Unit Product Brief, August 2018 [7] Novo Space, 3U SpaceVPX Systems Overview, August 2018 September 2018, Novo Space, - For more information contact info@novo.space 16

17 ANNEX: SYSTEM RELIABILITY The reliability of a single component depends on the ambient and circumstances in which it will operate, the orbit and length of the mission. The following is a general discussion on how the architecture and configuration of the system can improve the reliability of the system. In general terms, the reliability of the system depends on the number of unique functions, the reliability of the components implementing those functions, and the level of redundancy for each component. In this section, we analyze the reliability of the SAR system presented in the first case study and the way in which the SpaceVPX standard allows to add modular functionality when needed. Figure 11 shows the reliability model for the SAR system. Figure 11: SAR system reliability model We assumed for this analysis that the IO board has no credible points of failure. The reliability of the SpaceUM module is also ignored in this analysis in order to simplify the model. Mathematically, the reliability of the system is given by: Reliability = p. p. p where p is the reliability of the Formatter and SSR combined, p is the reliability of the eight DSP and eight ADC/DAC FMC combined in series, and p is the reliability of the Power module composed of two redundant power supply sub-modules. The reliability of the set of modules performing different functions in the system can be evaluated using the binomial distribution considering the number of September 2018, Novo Space, - For more information contact info@novo.space 17

18 modules performing the same function and the number of redundancies. The probability of getting exactly k successes in n trials is given by the following probability mass function: f(k, n, p) = Pr(X = k) = n k p. (1 p) evaluating this function for each type of element in the system: where pf, pf, pf are the probability of failure of the Formatter, DSP, and Power module respectively, and p, p, p are the reliability of each set of modules performing identical functions. The reliability of the system can be expressed in terms of the individual probabilities of failure of each module: Reliability = (1 pf ). (1 pf ). 1 pf The reliability of the Power module increases due to the redundancy defined in the standard, whereas the DSP modules are the components contributing the most to the degradation of the system reliability because they are connected in series in the reliability model; in other words, eight modules out of eight must work for the system to work. Some systems have many elements performing similar functions, such as sonars, radars, wireless telecommunications equipment, and other multiple input multiple output (MIMO) systems. These systems can deliver value even when some of the elements do not work properly. In most modern systems, each element can be reprogrammed to cover the functionality of the missing element. For example, when the transmit/receive module (TRM) in a radar system fails, the antenna pattern is recalculated and the gain and phase shift of the remaining TRM modules are reprogrammed to obtain an antenna pattern similar to the original one using all the modules. In these cases, the operation under degraded functionality is accepted. Assuming the system shown in Figure 11 is capable of performing its function when at least seven out of the eight DSP modules are working, then the reliability can be calculated as follows: p = f(7, 8, p ) + f(8, 8, p ) = 8 (1 fp ) fp + (1 fp ) September 2018, Novo Space, - For more information contact info@novo.space 18

19 The degraded operation mode brings functional redundancy to the system. When this is accepted, only one out of two power supplies and seven out of eight DSP modules need to work properly for the system to work. In this case, the only single point of failure in the system is the Formatter module. If this is not an acceptable risk, a second Formatter can be added to increase the reliability of the system. Assuming equal reliability for every module, then the reliability of the system is: Reliability = (1 fp ). (8 (1 fp) fp + (1 fp) ) module. Figure 12 shows the reliability of the system assuming equal probability of failure for each Figure 12: System reliability As shown in Figure 12, the reliability of the original system with no modular or functional redundancy is low. Even for a probability of failure for each module below 2%, the reliability of the system is worse than 85% (blue line). Adding a second Formatter (red line) has almost no impact on the reliability of the system because the high risk of failure given by the eight DSP modules is not mitigated. When the degraded operation is accepted, the reliability increases (green line) to 97%. Adding a second Formatter to the system at this point has a more significant impact because its probability of failure has a higher contribution to the system reliability equation once the failure of one DSP module is accepted. The reliability increases up to 99% (black line) when a second Formatter is added and the contribution is higher when the probability of failure of each component increases. For September 2018, Novo Space, - For more information contact info@novo.space 19

20 example, for a probability of failure per module of 10%, the system reliability increases 7.3% adding a second Formatter. Figure 13 presents a system with redundant Formatter modules. Figure 13: Synthetic-aperture radar with star topology backplane and redundant controller In this configuration, CDH controls the active redundancy by means of a bi-level signal connected to the SpaceUM module. The SpaceUM module redirects the signals in the Utility Plane driven by the active Formatter to the DSP modules. The UM module also powers on and off the corresponding Formatter module according to the state of the same signal. September 2018, Novo Space, - For more information contact info@novo.space 20