Watchdog-Based Logic Partitioning for Single Event Effect Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Commercial off-the-shelf processors, used in safety-critical systems like aircraft and gas turbine engines, are susceptible to single event effects such as single event upsets (SEUs) and latch-ups (SELS) due to their small geometries, which can lead to safety concerns and require power cycling for recovery, limiting their design assurance level.
Innovation Solution
A multi-logic device system is implemented with a resilient watchdog timer in a primary logic device to detect and mitigate faults in secondary logic devices, including power supply protection and radiation hardening of the primary device, allowing for effective detection and reset of SEUs and SELs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If commercial off-the-shelf processors with small geometries are used to meet computational demand, then processing performance is improved, but susceptibility to single event effects increases
Solution Approach 1:
The system divides processing functions between primary logic devices (radiation-hardened) and secondary logic devices (commercial off-the-shelf). The watchdog timer functionality is segmented and placed in the primary logic device, allowing it to monitor and mitigate faults in secondary devices while maintaining high computational performance in the secondary devices.
Solution Approach 2:
The watchdog timer acts as an intermediary monitoring mechanism placed in the primary logic device. It detects single event effects in secondary logic devices and triggers mitigation actions, serving as a bridge between the radiation-hardened primary devices and the vulnerable but high-performance secondary devices.
2Productivity
If higher performance commercial processors are used, then computational demand is met, but design assurance level decreases
Solution Approach 1:
The system segments critical safety functions into the primary logic device with high design assurance level, while non-critical high-performance functions remain in secondary logic devices. The watchdog timer in the primary device monitors and mitigates faults in secondary devices, ensuring the overall system meets required design assurance levels while utilizing high-performance commercial processors.
3Reliability
If radiation-hardened processors are used, then resistance to single event effects is improved, but device complexity and cost increase
Solution Approach 1:
Instead of hardening all processors, the system applies radiation hardening locally only to the primary logic device that contains the watchdog timer functionality. This localized approach provides the necessary radiation tolerance for fault detection and mitigation while keeping the majority of the system using simpler, less expensive commercial off-the-shelf processors.
Data Source
Figure 1
Figure 2
AI summary
A multi-logic device system, an electronic engine controller, and a method of operating the multi-logic device system. The multi-logic device system includes a primary logic device which is more resilient to single event effects, and one or more secondary logic devices, each secondary logic device being powered by a respective power supply unit and being more susceptible to single event effects. The primary logic device is configured to run, for each secondary logic device, a respective watchdog timer. Each watchdog timer is restarted upon receipt of a restart signal from the respective secondary logic device. The primary logic device is also configured, in response to a watchdog timer timing out, to identify and reset the secondary logic device corresponding to the timed out watchdog timer.