5 ms·

At the company I work for, we've been struggling with the fact that nobody has made a new-design CPU or SOC that's suitable for our safety-critical, "high integ

At the company I work for, we've been struggling with the fact that nobody has made a new-design CPU or SOC that's suitable for our safety-critical, "high integrity at the source" application with modest radiation exposure (avionics) for over ten years. We finally just gave up waiting and designed our own. We're told by our senior folks that they've received calls from their counterparts at several west coast companies (apple, qualcomm, etc.) expressing interest & best wishes for what we are doing.

photojosh 9y ago
Out of interest, which was the last CPU/SOC you're referring to? (Embedded/electronics engineer here, but totally not in the safety-critical market.)
laydn 9y ago
Well, a semiconductor company can design a general purpose processor and sell millions or billions of units. Or, it can design a safety critical and rad-hard chip and sell you maybe a couple thousand? :-) At least, there is now the option to get defense-grade FPGAs and throw some radiation hardening techniques (triple-modular-redundancy, scrubbing, etc) on it.
nickpsecurity 9y ago
Your chip is better than Gaisler's Leon4-FT? Or what reasons were it not good enough? European Space Agency funded Gaisler's stuff for their use. Not a hardware engineer but still collect info for others. Note: If speed isn't big deal, there's the formally-verified AAMP7G from Rockwell and the old 1802 ftom Intersil.
londons_explore 9y ago
I don't understand why you would radiation harden a chip...? Why not just have three exactly identical chips, run the exact same code on them, and compare results? If results ever differ, you power cycle the bad one, self test it, and you're good to go again. Sure you have to not use on-chip random number generators, and make sure you don't have any non-deterministic things in your silicon (eg. things that depend on PLL locking time), but that sounds pretty trivial.
- Nokinside 9y ago
  Redundant elements at the system or circuit level are usually part of radiation hardening. >Why not just The problem with 'just' is that it's usually not true. Hardening versus redundancy is typical safety engineering problem where details and balance between different requirements, verification and maintenance are important.
- planteen 9y ago
  Because there are two distinct types of radiation effects in space: ionizing and upsets. Multiple computers voting solves the upset problem, but not the ionizing one. Ionizing is a measure in krad of how much radiation a part can be exposed to in its life and keep working. Ionizing radiation changes semiconductors in fun ways (e.g., gate voltage thresholds shift). They are fabbed in exotic ways like silicon on sapphire. When you want a satellite to last 20 years at geostationary orbit, you account for this! For example, I believe the Juno probe to Jupiter's life will be limited by ionizing radiation.
  - pavanky 9y ago
    On a related note, would multiple computers voting also require a higher power draw compared to a radiation hardened chip?
    - jacquesm 9y ago
      Yes.
- sp332 9y ago
  Maybe you don't want to spend the space or power to run three chips. Maybe you don't want the 3x the maintenance headache as the chips fail over time.
- PaulKeeble 9y ago
  When I was doing this for military jets the concern was staying in the air during a nuclear explosion and the subsequent EM field that comes out of that. You could have 30 processors and they would all die at the same time, but the one with radiation hardening would still be chugging along.
moftz 9y ago
An FPGA running a soft core was out of the question? There are plenty of rad-hard FPGAs out there. Combine it with some rad-hard flash or eeprom and you've got what's flying in a lot of satellites these days.
planteen 9y ago
10 years isn't true. In the last few years, we have finally seen a successor to the RAD750, the RAD5500. And it's multi core finally. But rad hard technology does move at a glacial pace and is 10-20 years behind commercial. https://en.m.wikipedia.org/wiki/RAD5500 https://en.m.wikipedia.org/wiki/RAD5500 http://www.baesystems.com/en-us/our-company/inc-businesses/electronic-systems/product-sites/space-products-and-processing/processors http://www.baesystems.com/en-us/our-company/inc-businesses/e...
- Chaebixi 9y ago
  > 10 years isn't true...RAD5500 Maybe it is true for him. This isn't my area, but the Wikipedia article for the RAD5500 says it's for "high radiation environments experienced on board satellites and spacecraft," but the grandparent only a need for tolerance to "modest radiation exposure (avionics)." Maybe the RAD5500 is overkill for his application, and there actually hasn't been anything new (in his niche) for 10 years.
- danjayh 9y ago
  Our problem doesn't have to do with radiation hardening. In fact, we don't even need radiation hardened cores -- our problem is actually due to design decisions that have been made in modern cores that sacrifice determinism for speed.
phkahler 9y ago
For automotive they're starting to make interesting things like dual-core CPUs running in lock-step. The outputs are compared at each cycle and a fault is declared if they differ. The problem is that doesn't generally allow you to keep running (perhaps a reset if that helps). They still like to rely on fallbacks like manual steering and braking, and the fact that you can pull over to the side of the road when something quits working. None of that is relevant for fully autonomous self-driving cars where the driver may be reading a book and not ready to take over quickly.
- kpil 9y ago
  Railway signaling systems - the onboard kind - require separate software including operative system, and possibly also differentiated hardware. They do not run in lock step but if one of the machines detects a different output from it's peer than it's own, it just triggers an emergency brake.
- rasz 9y ago
  What do you mean starting? Bosch has been using Infineon TriCore's in ECU's for almost 10 years now. Friendly advice - stay away from Infineon offerings, they are still alive in automotive due to inertia and top down decision making, not because they are any good.
  - phkahler 9y ago
    >> What do you mean starting? Time flies I guess. To your comment on Infineon... I thought the TriCore was stupid, but my German boss at the time insisted. We're using one of their SoCs today, but it's actually very very good for what we're doing and it's fairly cheap. We could get cheaper but that would require the addition of other parts on the board. If we can secure the volumes we may go custom - and that's something I haven't seen in person in automotive (I'm beginning to hear about it though).

photojosh 9y ago

Out of interest, which was the last CPU/SOC you're referring to? (Embedded/electronics engineer here, but totally not in the safety-critical market.)

laydn 9y ago

Well, a semiconductor company can design a general purpose processor and sell millions or billions of units. Or, it can design a safety critical and rad-hard chip and sell you maybe a couple thousand? :-) At least, there is now the option to get defense-grade FPGAs and throw some radiation hardening techniques (triple-modular-redundancy, scrubbing, etc) on it.

nickpsecurity 9y ago

Your chip is better than Gaisler's Leon4-FT? Or what reasons were it not good enough? European Space Agency funded Gaisler's stuff for their use. Not a hardware engineer but still collect info for others. Note: If speed isn't big deal, there's the formally-verified AAMP7G from Rockwell and the old 1802 ftom Intersil.

londons_explore 9y ago

I don't understand why you would radiation harden a chip...? Why not just have three exactly identical chips, run the exact same code on them, and compare results? If results ever differ, you power cycle the bad one, self test it, and you're good to go again. Sure you have to not use on-chip random number generators, and make sure you don't have any non-deterministic things in your silicon (eg. things that depend on PLL locking time), but that sounds pretty trivial.

Nokinside 9y ago
Redundant elements at the system or circuit level are usually part of radiation hardening. >Why not just The problem with 'just' is that it's usually not true. Hardening versus redundancy is typical safety engineering problem where details and balance between different requirements, verification and maintenance are important.
planteen 9y ago
Because there are two distinct types of radiation effects in space: ionizing and upsets. Multiple computers voting solves the upset problem, but not the ionizing one. Ionizing is a measure in krad of how much radiation a part can be exposed to in its life and keep working. Ionizing radiation changes semiconductors in fun ways (e.g., gate voltage thresholds shift). They are fabbed in exotic ways like silicon on sapphire. When you want a satellite to last 20 years at geostationary orbit, you account for this! For example, I believe the Juno probe to Jupiter's life will be limited by ionizing radiation.
- pavanky 9y ago
  On a related note, would multiple computers voting also require a higher power draw compared to a radiation hardened chip?
  - jacquesm 9y ago
    Yes.
sp332 9y ago
Maybe you don't want to spend the space or power to run three chips. Maybe you don't want the 3x the maintenance headache as the chips fail over time.
PaulKeeble 9y ago
When I was doing this for military jets the concern was staying in the air during a nuclear explosion and the subsequent EM field that comes out of that. You could have 30 processors and they would all die at the same time, but the one with radiation hardening would still be chugging along.

moftz 9y ago

An FPGA running a soft core was out of the question? There are plenty of rad-hard FPGAs out there. Combine it with some rad-hard flash or eeprom and you've got what's flying in a lot of satellites these days.

planteen 9y ago

10 years isn't true. In the last few years, we have finally seen a successor to the RAD750, the RAD5500. And it's multi core finally. But rad hard technology does move at a glacial pace and is 10-20 years behind commercial. https://en.m.wikipedia.org/wiki/RAD5500 https://en.m.wikipedia.org/wiki/RAD5500 http://www.baesystems.com/en-us/our-company/inc-businesses/electronic-systems/product-sites/space-products-and-processing/processors http://www.baesystems.com/en-us/our-company/inc-businesses/e...

Chaebixi 9y ago
> 10 years isn't true...RAD5500 Maybe it is true for him. This isn't my area, but the Wikipedia article for the RAD5500 says it's for "high radiation environments experienced on board satellites and spacecraft," but the grandparent only a need for tolerance to "modest radiation exposure (avionics)." Maybe the RAD5500 is overkill for his application, and there actually hasn't been anything new (in his niche) for 10 years.
danjayh 9y ago
Our problem doesn't have to do with radiation hardening. In fact, we don't even need radiation hardened cores -- our problem is actually due to design decisions that have been made in modern cores that sacrifice determinism for speed.

phkahler 9y ago

For automotive they're starting to make interesting things like dual-core CPUs running in lock-step. The outputs are compared at each cycle and a fault is declared if they differ. The problem is that doesn't generally allow you to keep running (perhaps a reset if that helps). They still like to rely on fallbacks like manual steering and braking, and the fact that you can pull over to the side of the road when something quits working. None of that is relevant for fully autonomous self-driving cars where the driver may be reading a book and not ready to take over quickly.

kpil 9y ago
Railway signaling systems - the onboard kind - require separate software including operative system, and possibly also differentiated hardware. They do not run in lock step but if one of the machines detects a different output from it's peer than it's own, it just triggers an emergency brake.
rasz 9y ago
What do you mean starting? Bosch has been using Infineon TriCore's in ECU's for almost 10 years now. Friendly advice - stay away from Infineon offerings, they are still alive in automotive due to inertia and top down decision making, not because they are any good.
- phkahler 9y ago
  >> What do you mean starting? Time flies I guess. To your comment on Infineon... I thought the TriCore was stupid, but my German boss at the time insisted. We're using one of their SoCs today, but it's actually very very good for what we're doing and it's fairly cheap. We could get cheaper but that would require the addition of other parts on the board. If we can secure the volumes we may go custom - and that's something I haven't seen in person in automotive (I'm beginning to hear about it though).