FPGAs in radiation-harsh environments

Transcription

1 FPGAs in radiation-harsh environments 1

2 Application examples AFDX Used on new commercial aircrafts from Boeing and Airbus Main communication interface Safety level up to DAL-A Mission computers Used on all aircrafts e.g. freight control system for Airbus A400M Safety level up to DAL-A

3 The old Style: ARINC-429 ARINC-429 commonly found in aircrafts of the 80s Mono directional bus 1 transmitter, n 20 receivers Dedicated wiring for each connection 100s km cabling per aircraft Transmission rates: 100kbit/s and 14.5kbit/s (low critical) 3

4 Nowadays: AFDX Technology Based on IEEE802.3 Ethernet 100Mbit/s Ethernet Full duplex Switched Full static configuration, no ARP, no DNS, Provides Reliable Data Transport Known latency High availability through redundancy Network A AFDX Switch LRU Transmitter AFDX Endsystem AFDX Endsystem LRU Receiver AFDX Switch Network B Redundant Network Architecture

5 AFDX Virtual Links replace ARINC-429 Avionics communications are based on multicast One transmitter One or several receivers App B App A Partition 1 1 Partition E/S E/S App C App D, E Partition 1 (RAM, CPU) Partition 2 (RAM, CPU) 1 2 E/S 5 Virtual links provide similar properties as ARINC-429

6 Airbus A380: AFDX Network A380 AFDX network 100Mbit/s Ethernet Redundant networks (A&B) AFDX switches (2 x 9) #of ports on each switch (20 24) Up to 80 AFDX endsystems Engines Fuel&LG SFCC1 COM MON EEC1 EEC2 IOM A B B A FW1 FCDC1 AESU1 LG,TP&BS COM MON IRDO ADIRU1 IOM SPDB FCSC1 FCGC1 COM MON COM MON SCI Fuel COM MON VSC FM1 CPIOM-A-1&2 PWCU S_1_1 Cockpit ACR1 S_2_1 S_3_1 S_4_1 L1 ATC1 ELM CBM SB24 ADIRU3 L2 DSMC1&2 Flight Control FCGC3 FCSC3 COM MON COM MON HSM AIC? ECB CIDS IPCU L3 S_1_3 C1 C2 CDAM Energy ext lights ctrl Cabin CIDS FCGC2 FCSC2 COM MON COM MON FM3 R2 ACR2 opt ELM CBM HSM SB24 AIC? PESC DSMC3 S_1_2 FM1 ATC2 SCI Fuel COM MON IPCU CPIOM-B-1&2 CPIOM-A-3&4 CPIOM-B-3&4 R3 R1 S_2_2 S_3_2 S_4_2 ADIRU1 B A A B FW2 FCDC2 AESU2 IOM SFCC2 COM MON LG,TP&BS COM MON SPDB IOM EEC3 EEC4 IRDO 6

7 AFDX Ethernet for Mission-Critical Applications AFDX interface Certifiable FPGA implementation Available on PMC P520 Full-featured AFDX protocol engine Interoperable with Airbus and Boeing

8 Airbus A400M Freight System

9 Mission Computer with FPGA Architecture CPU1 CPU2 CPU3 Triple redundancy on board FPGA VOTER DDR_ CTRL RAM_1 RAM_2 3x redundant PowerPC 750 CPU with up to 800 MHz (Lockstep) Redundant memory RAM_3 Onboard data transfers paths realized with FPGAs FRAM AFDX_PMC PCI_AFDX MISC MEM_ CTRL PCI_ MSTR FPGA MEM_ CTRL MEM_ CTRL FLASH Bank 1 FLASH Bank 2 Voting done inside FPGA Compliant with DO-254 up to DAL-A GFX_PMC PCI_GFX PCI_ MSTR

10 Challenge: Single Event Upsets/Multi Bit Upsets Aircrafts are exposed to radiation environment Neutrons (Secondary Cosmic Ray Particles) may cause SEUs and MBUs in electronics equipment Particle flux varies with altitude - max. flux at ft. 10

11 SEU/MBU Effects Components susceptible to SEU/MBU bit flips SRAMs SDRAMs Microprocessors Register Caches Internal buffers/fifos FPGAs Cell configuration Logic cell state... 11

12 FPGA Issues FPGA configuration must be SEU hardened FPGAs with RAM based configuration need mitigation strategy FPGAs with FLASH based configuration are SEU/MBU immune But Registers and RAM within FPGAs still not SEU immune! Other mitigation techniques required 12

13 SEU/MBU RAM Sensitivity Failure probability 10-7 / flight-hour (DAL B) Only one safety relevant failure in 10 Mio. flight hours! Error probability increases with number of bits Examples 512MByte SDRAM at ft. (no ECC) Fails after 10 hours! 32kByte cache Fails after 3.5 month Safe airplanes would not be possible 13

14 Architectural Solutions Register and logic protection strategies All FPGA registers subject to SEUs Critical sections use 2oo3 voting logic Majority voter overrules faulty register value D Q c Triple modular redundancy (TMR) is expensive Requires more than 3 times regular logic Slows down timing up to 20% D D Q b Q a b c Voter a TMR significantly lowers the probability of SEU induced failures in the FPGA logic Safe airplanes are possible 14

15 Verification of TMR Technology Architectural mitigation strategy can be verified by proton beam experiments DUT is exposed to particle beam with density equivalent to high altitude radiation DUT is running in test to demonstrate operability 15 1/28/2013 Source:

16 Thank you for your attention! Embedded Solutions Rugged Computer Boards and Systems for Harsh, Mobile and Mission-Critical Environments As a member of the UN Global Compact Initiative, MEN is committed to follow the principles of human rights, labour, environment and anticorruption as defined by this organization. 16