Engineering topics
Publications and source records attributed to Rennels, D. A..
Microcontrollers provide very dense functionality for embedded applications ranging from telephones to automobiles.
Fault-tolerant-microcomputer concept based on enhancing "simple" computer with redundancy and self-checking logic circuits detect hardware faults. Interface and checking logic and redundant processors confer on 16-bit microcomputer ability to check itself for hardware faults. Checking circuitry also checks itself. Concept of self-checking complementary pairs (SCCP's) employed throughout ICL unit.
Memory-interface integrated circuit not only detects errors in data from other circuits but also detects errors within itself. Memory-interface chip encodes 16-bit words with Hamming code for single-error correction or double-error detection. Chip used in fault-tolerant computers under development by NASA.
A simple and general model of the interfaces and check circuits used for comparing and detecting faults in a pair of 16-bit processors is described, and problems encountered in the application of TI 9900 processors are discussed. The greatest incompatibility is found to lie between the rollback structures of the CPUs and the interface and check logic (ICL) model. The ICL model generates a reset when an error is detected, and a rollback is expected to occur when it is released. The TI 9900 requires a reset of minimum duration, and after release goes through an initialization cycle, obtains rollback parameters from fixed memory locations, and executes the rollback, consistent with the ICL. The ICL is relatively simple, having a complexity equivalent to fewer than 1000 gates.
A set of building block circuits is described which can be used with commercially available microprocessors and memories to implement fault tolerant distributed computer systems. Each building block circuit is intended for VLSI implementation as a single chip. Several building blocks and associated processor and memory chips form a self checking computer module with self contained input output and interfaces to redundant communications buses. Fault tolerance is achieved by connecting self checking computer modules into a redundant network in which backup buses and computer modules are provided to circumvent failures. The requirements and design methodology which led to the definition of the building block circuits are discussed.
More reliable computers could be assembled by connecting four proposed VSLI "building block" circuits with built-in error detection to standard microprocessors and memory devices to form self checking computer module. Each building block detects its own malfunctions and single bit errors found in memory.
This paper summarizes the results of a long-term research program in fault-tolerant computing for spacecraft on-board processing. In response to changing device technology this program has progressed from the design of a fault-tolerant uniprocessor to the development of fault-tolerant distributed computer systems. The unusual requirements of spacecraft computing are described along with the resulting real-time computer architectures. The following aspects of these designs are discussed: (1) architectural features to minimize complexity in the distributed computer system, (2) fault-detection and recovery, (3) techniques to enhance reliability and testability, and (4) design approaches for LSI implementation.
Ultra-reliable core computers are required for improving the reliability of complex military systems. Such computers can provide reliable fault diagnosis, failure circumvention, and, in some cases serve as an automated repairman for their host systems. A small set of building-block circuits which can be implemented as single very large integration devices, and which can be used with off-the-shelf microprocessors and memories to build self checking computer modules (SCCM) is described. Each SCCM is a microcomputer which is capable of detecting its own faults during normal operation and is described to communicate with other identical modules over one or more Mil Standard 1553A buses. Several SCCMs can be connected into a network with backup spares to provide fault-tolerant operation, i.e. automated recovery from faults. Alternative fault-tolerant SCCM configurations are discussed along with the cost and reliability associated with their implementation.
The core electronics subsystems on unmanned spacecraft, which have been sent over the last 20 years to investigate the moon, Mars, Venus, and Mercury, have progressed through an evolution from simple fixed controllers and analog computers in the 1960's to general-purpose digital computers in current designs. This evolution is now moving in the direction of distributed computer networks. Current Voyager spacecraft already use three on-board computers. One is used to store commands and provide overall spacecraft management. Another is used for instrument control and telemetry collection, and the third computer is used for attitude control and scientific instrument pointing. An examination of the control logic in the instruments shows that, for many, it is cost-effective to replace the sequencing logic with a microcomputer. The Unified Data System architecture considered consists of a set of standard microcomputers connected by several redundant buses. A typical self-checking computer module will contain 23 RAMs, two microprocessors, one memory interface, three bus interfaces, and one core building block.
This paper presents the results of a study that has established a standard set of four semiconductor VLSI building-block circuits. These circuits can be assembled with off-the-shelf microprocessors and semiconductor memory modules into fault-tolerant distributed computer configurations. The resulting multi-computer architecture uses self-checking computer modules backed up by a limited number of spares. A redundant bus system is employed for communication between computer modules.
The paper attempts to define and characterize a set of VLSI (very large scale integration) building-block circuits which can be used to combine existing microprocessors and memories into a wide variety of fault-tolerant computing systems. Such VLSI circuits would transform fault-tolerant computing into an off-the-shelf technology and enable its routine use for new applications. The self-checking computer module (SCCM) is the basic component out of which fault-tolerant computer systems are constructed. Several fault-tolerant configurations of SCCM are discussed, including the standby redundant uniprocessor, the voted/hybrid uniprocessor, and the distributed computer network.
The replacement of the driver with an automatic system which could perform the functions of guiding and routing a vehicle with a human's capability of responding to changing traffic demands was discussed. The problem was divided into four technological areas; guidance, routing, computing, and communications. It was determined that the latter three areas being developed independent of any need for fully automated urban traffic. A guidance system that would meet system requirements was not being developed but was technically feasible.
The specific requirements for spacecraft computing systems are considered. These requirements are partly related to the constraints of limited resources of power, weight, and volume. Another important factor is the requirement of extremely high reliability. These reliability requirements have led to introduction of automated redundancy techniques on board the spacecraft. The various redundant computers check each other and provide recovery procedures when a computer is found to have failed. Past and future capabilities are considered along with distributed processing requirements. System considerations are discussed, taking into account suboptimum computer throughput, sensitivity to software modifications, hierarchic timing, I/O granularity, restricted communications, synchronous functions, hierarchic control, and concurrent error detection. A description is presented of the Unified Data System (UDS), which consists of a set of standard microcomputers connected by several buses. Attention is also given to synchronization and timing, the executive control structure, the programming language, and the executive program.
This paper presents an approach to a microprocessor based computing system for a Mars Roving Vehicle. This represents a practical example in that it combines a breadboard robot (the Rover) with a distributed microprocessor computing system, both of which are under development at JPL and are being considered for a 1984 Mars Rover Mission. A summary of the Rover functions is presented, along with an approach of applying distributed computers. The Rover is then partitioned into its main subsystems (executive, locomotion, manipulation, and vision) and subsystem and system interfaces established. Computing requirements are discussed and a system diagram developed.
This paper presents the results obtained in a continuing investigation of real-time distributed processing systems which is being conducted at the Jet Propulsion Laboratory. A distributed processor architecture has been developed for control and data handling on a planetary spacecraft. This system, designated the Unified Data System, has been implemented in a feasibility breadboard. The following aspects of the Unified Data System are described: (1) standardized building block elements and their configuration into microprocessor modules, (2) a highly redundant bus structure which connects the various modules and facilitates intercommunications with minimal software support, (3) the structure of software within the individual modules and its coordination between modules, and (4) the mechanisms by which fault-tolerance can be implemented within the network. Through the attributes of multilevel standardization, simplicity, and flexibility, this system is expected to result in significant cost savings to future spacecraft missions.
This paper presents a description of redundancy techniques employed in the design of fault-tolerant computers, and a discussion of the effects of functional requirements, technology constraints, and cost considerations which enter into the choice of these techniques. The STAR computer, developed at the Jet Propulsion Laboratory for long-duration planetary spacecraft missions, is discussed along with several later fault-tolerant computer designs. The class of computers described in this paper employs dynamic redundancy, i.e., the machine is divided into a set of submodules, each with standby spares; a special hard core monitor unit detects and diagnoses faults, and effects automated recovery by replacing failed parts.
Results of fault-tolerance experiments performed using an experimental computer with dynamic (standby) redundancy, including replaceable subsystems and a 'program rollback' provision to eliminate transient-caused errors. After a brief review of the specification of fault-tolerance with respect to transient faults, including a description of the method of injection of transient faults in software and system tests, fault-tolerance experiments carried out with this computer with regard to the determination of fault classes, software verification, system verification, and recovery stability are summarized. A test and repair processor is described which constitutes a special monitor unit of the computer and is used to obtain information for fault detection in the other subsystems of the computer and to ensure that proper recovery occurs when a fault is detected.
Self testing and repairing /STAR/ aerospace computer for automatic maintenance of unmanned interplanetary spacecraft