Military Embedded Systems Spring 2005 Volume 1 Number 1

Hardware
fore have the same inherent radiation characteristics as the processor.
The internal L2 cache has a capacity of 512 KB and utilizes
an eight-bit Error Correction Code (ECC) for every 64-bit word
in memory. The ECC logic is used to correct a majority of single
bit errors and detect multiple bit errors. The L2 tags also support
parity and by-way locking. The L1 cache has a 32 KB Instruction
Cache and 32 KB data cache; both types of cache are eight-way
set associative and the L1 cache tags support parity, as well.
Non-volatile ROM
Similar to the protection scheme for RAM, the integrity of extensive
firmware utilities stored in boot Flash can also be guaranteed
by dual redundancy (two independent banks of boot Flash) in
combination with a watchdog mechanism. Software-independent
radiation-hardened circuitry is the key component of this
watchdog mechanism and the design expects a periodic service
generated by the firmware or the flight software application. The
redundancy scheme maximizes an opportunity to boot successfully
after an initiated or environment-induced reset (software
reset, or a power cycle reset, or a SEE).
The dual-redundant scheme works as follows: upon power up, the
radiation-tolerant module must successfully start the flight software,
and any one defective boot Flash can be overwritten by the
contents of the intact boot Flash to provide two identical copies
for future start up operations. A hardware register can be added
to provide a status if such overwritten operations were performed
during the last reset. For further assurance against soft errors,
MILITARY EMBEDDED SYSTEMS Resource Guide
the control logic to implement the watchdog timer and the overwritten
operations are also implemented in an anti-fuse FPGA.
Dual-redundant boot Flash is controlled by a radiation-hardened
watchdog supervisor function (see Figure 2). The redundant
Flash is used to boot up if the watchdog expires without an initial
service from the boot-up firmware and subsequent service by the
flight application.
Figure 2
Besides boot Flash, additional non-volatile user memory is
required to store the user’s application and data such as digital
filter coefficients or static data tables. The user Flash is often
NOR Flash to provide best performance in random access
scenarios. It is further enhanced with an ECC correction algorithm
integrated with the Flash memory controller inside an
anti-fuse FPGA. As shown in Figure 3, the user Flash controller
calculates and writes ECC syndromes to the third Flash
bank while data is written in 32-bit mode to the other two user
Flash banks. The ECC mechanism corrects single-bit errors
and detects multi-bit errors. When the processor initiates a read
request to the user Flash, a CRC checksum is calculated and
compared against the stored value. If the two checksums are
different, a single-bit correction will be attempted or the flight
software will be notified with a multi-bit error in the Flash.
Similar to the intent of dual redundant boot Flash, the ECCprotected
user Flash is also designed to mitigate SEE.
Figure 3
RSC# 24 @www.mil-embedded.com/rsc
System-level functions
As shown in Table 2, there is more to a radiation-tolerant system
processor besides the CPU and memory subsystems. A local
expansion slot is an attractive feature because it enables additional
mission or application specific I/O interfaces to be inserted into
a single-slot solution and maintains the same system processor
as a building block. This feature is particularly important when
a system has a high-speed I/O interface and the high bandwidth
24 / 2005 MILITARY EMBEDDED SYSTEMS Resource Guide