GLAST LAT Project Gamma-ray Large Area Space Telescope DOE/NASA Peer Critical Design Review, March 19-20, 2003 GLAST Large Area Telescope: Electronics, Data Acquisition & Flight Software System Engineering Gunther Haller Stanford Linear Accelerator Center Manager, Electronics, DAQ & FSW LAT Chief Electronics Engineer haller@slac.stanford.edu (650) 926-4257 G. Haller 4.1.7 Elex System Engineering V7 1 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 System Engineering Outline • • • • • • • • • • • System Overview Changes since PDR External Interfaces Internal Interfaces Technical Budget Verification & Test Risk FMEA Reliability Allocations Parts and Spares Plan Drawing Tree G. Haller 4.1.7 Elex System Engineering V7 2 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Data-Acquisition (DAQ) System Overview • • • • • • Configuration, triggering, event-flow control and readout, monitoring, and supply of power to – 16 Calorimeter and Tracker towers with a total of 850,000 tracker channels and 3,000 calorimeter channels – 12 ACD front-ends with a total of 208 ACD channels Interface to spacecraft for control, data, monitoring, and power Trigger system (hardware selection of possibly interesting events) Event filtering Housekeeping Operational thermal control G. Haller Spacecraft LAT VCHP Heater Control 4.1.7 DataAcquisiton (DAQ) System C A L T K R Tower 0 C A L T K R Tower 1 C A L T K R Tower 15 A C D A C D A C D 0 1 11 4.1.7 Elex System Engineering V7 3 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 LAT Electronics Hierarchy • • • • • • Tower Electronics Module – Interface to calorimeter and tracker on each tower – Monitoring – Combination of sub-system trigger signals to primitives – Event buffering GAS Unit – Command-response unit receives and distributes command, clock, and data – Global trigger unit generates LAT-wide readout decision signals based on trigger primitives from TEM’s and ACD – Event-builder unit builds complete LAT events out of asynchronous event-fragments; Forward complete events to dynamically selected target EPU’s or spacecraft – ACD electronics module tasks much like TEM for TKR/CAL EPU: Event processor unit runs filter algorithm to reduce 10kHz input event rate down to 30 Hz (with two EPU’s) SIU: Spacecraft interface unit controls LAT and interfaces to spacecraft Instrument software runs on EPU and SIU processors only Power system not shown G. Haller SC SC Science Commanding Data EPU 0 EPU 1 SIU GAS Unit Event Builder TEM 0 C A L T K R Command Response Unit Global Trigger TEM 1 C A L T K R TEM 15 C A L T K R ACD Electronics Module A C D A C D A C D 0 1 11 4.1.7 Elex System Engineering V7 4 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 LAT Electronics Physical TKR Front-End Electronics (MCM) ACD ACD Front-End Electronics (FREE) TKR CAL Front-End Electronics (AFEE) CAL 16 Tower Electronics Modules – DAQ electronics module (DAQ-EM) – Power-supplies for tower electronics Global-Trigger/ACD-EM/Signal-Distribution Unit* Spacecraft Interface Unit – Spacecraft Interface Board (SIB): Spacecraft interface for MIL1553 control & data – LAT control CPU – LAT Communication Board (LCB): LAT command and data interface 3 Event-Processor Units (2+1 spare) – Event processing CPU – LAT Communication Board – SIB EPU-1 EPU-2 Pw r Dist. Box spare spare GASU spare spare spare SIU-P SIU-R EPU-3 Power-Distribution Unit (PDU)* – Spacecraft interface, power – LAT power distribution – LAT health monitoring * Primary & Secondary Units shown in one chassis G. Haller 4.1.7 Elex System Engineering V7 5 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Changes since PDR • Spacecraft Selection and Meetings: – PDU was moved to opposite side of SIU to match SC power/C&DH physical partitioning – Signal levels (discretes, 1 PPS, Science Interface, GBM GRB signal) were officially changed to LVDS (before undefined or RS422), March 03 – Recently finalized power, analog monitoring, and discrete interface to SC – Defined MIL1553 command set/interface – Separated SIU prime and redundant into separate (and identical) crate assemblies since cross-connection to SC prime and redundant was solved on the SCLAT interface level and lead to removal of direct SIU-SIU interconnections G. Haller Before SC selection spare EPU-1 EPU-2 EPU-3 spare spare GASU spare spare SIU P/R Pwr Dist. Box P/R After SC selection EPU-1 EPU-2 Pwr Dist. Box spare spare GASU spare spare spare SIU-P SIU-R EPU-3 4.1.7 Elex System Engineering V7 6 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Changes since PDR (Con’t) • • Event-Builder was moved from CPU crates to GAS unit – Reduced complexity of inter-connections – Reduced hardware from 3 event-builder blocks to 2 (1 prime, 1 redundant), and power dissipation from two event-builder blocks to one SIU crate was modified to be the same as EPU crate – Removes mechanical, thermal, electrical design effort for one assembly – Moved SC science interface from Spacecraft Interface Board in SIU to event-builder in GASU – Additional benefit that SIB board is almost identical to existing SECCI version (both boards are designed by NRL/Silver Engineering), major simplification – Science interface on GASU is small change since GASU already transmits event data to LAT CPU’s, so additional target is incremental – Added SIB board in each EPU crate to provide local EEPROM • Simplification in software effort. • No remote booting code development/testing required. G. Haller SC SC Science Commanding Data EPU 0 EPU 1 SIU GAS Unit Event Builder TEM 0 C A L T K R Command Response Unit Global Trigger TEM 1 C A L TEM 15 T K R C A L T K R ACD Electronics Module A C D A C D A C D 0 1 11 4.1.7 Elex System Engineering V7 7 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 External Interfaces • All external DAQ interfaces released with the exception of spacecraft interface and mechanical/thermal interface (mainly to X-LAT plate) G. Haller Interface Document Status Calorimeter LAT-SS-00238 released Tracker LAT-SS-00176 released ACD LAT-SS-00363 released Mechanical/Thermal LAT-SS-01794 in progress Spacecraft GSFC-433-IRD in progress at GSFC but content stable 4.1.7 Elex System Engineering V7 8 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Internal Interfaces • All internal interfaces are final, documents are being updated, release before CDR G. Haller Interface Document Status Tower Electronics Module LAT-TD-00605 finalizing TEM Power-Supply Unit LAT-SS-01281 finalizing GAS Unit LAT-SS-01544 LAT-TD-00639 LAT-TD-01545 LAT-TD-01546 LAT-TD-01547 finalizing SIU/EPU LAT-SS-01539 finalizing PDU LAT-SS-01542 finalizing VCHP Control Unit LAT-SS-00715 finalizing 4.1.7 Elex System Engineering V7 9 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 DAQ Technical Budget Summary Technical Resources • DAQ Mass – Sub-system allocation: 220 kg – Detailed estimate: 199.3 kg • DAQ Power – Subsystem allocation: 318 W – Detailed estimate: 313.8 W • CPU Cycles – Allocation: 2 CPU’s – Detailed estimate: < 1 CPU • For detailed breakdown see Power/Mechanical/Software presentations G. Haller 4.1.7 Elex System Engineering V7 10 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Verification & Test Model Development Hardware Design Software Design/Develop • Fab Test Develop/Test Formal Test Release to I&T Hardware and software development closely integrated – Design of hardware versus software complexity optimized continuously – Software runs with LAT engineering model electronics – Continuous hardware versus software verification – Full system including sub-system electronics from and at other institutions – Independent verification process • Exchange of hardware and software -> – – – – – G. Haller ACD hardware, TKR hardware, CAL hardware DAQ hardware Flight software, I&T software ACD Scripts, TKR scripts, CAL scripts, DAQ scripts No integration at flight- LAT integration stage of components which have not operating fully integrated in earlier stages • Exception is spacecraft, since simulator is only simulating and is not real hardware/software 4.1.7 Elex System Engineering V7 11 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Verification & Test (Con’t) Development Cycles EM 1 Release to I&T EM2 Release to I&T FU • • • Release to sub-systems Release to sub-systems Release to I&T Three development cycles – Engineering Model 1 • Single tower, single CPU – Engineering Model 2 • Multiple tower, single CPU – Flight Model • Multiple towers, multiple CPU’s Peer-Reviews after end of each development cycle In addition regular LAT reviews (Manufacturing Readiness Review, etc) G. Haller 4.1.7 Elex System Engineering V7 12 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Verification Matrix (Doors Example Page) ID VM TDF3-7 The Level 1 Trigger (L1T) system shall be used to detect an interesting event and provide a signal to the detector subsystems to capture and read out the event data. Demo TDF3-105 The trigger (TRG) system shall determine whether the event is interesting based on trigger input signals received from the detector systems. Demo TDF3-9 The L1 trigger system shall accept trigger inputs from the ACD, TKR, CAL and dataflow subsystems. Demo TDF3-11 The L1 trigger system shall time-align trigger inputs from the ACD, TKR, CAL and dataflow subsystems to a precision better than 100 ns. Test TDF3-13 The L1 trigger system shall implement multiple overlapping triggers to allow cross-trigger monitoring. Test TDF3-15 The L1 trigger logic shall generate a trigger acknowledge signal (L1TACK) and a trigger type (e.g. CNO) for distribution to the subsystems. Demo TDF3-17 The L1 trigger logic shall generate the Trigger Acknowledge output with a latency of less than 1.3 mus. Test TDF3-106 The latency from the time the particle traverses the LAT to when the input signals need to be recorded at the earliest shall be 2 ms. Test TDF3-19 The L1 trigger contribution to the overall trigger jitter shall be less than ± 50 ns. Test TDF3-107 The overall trigger jitter for the LAT shall be ± 200 ns. Test TDF3-51 G. Haller TDF L3 Performance Specification The dataflow system shall reduce the event rate accepted by the L1T to an output rate commensurate with the spacecraft interface as specified in 433-IRD-0001, keeping events meeting the science objectives. Verif. Demo 4.1.7 Elex System Engineering V7 13 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Test Matrix Applies to each board and assembly. In this slide the tests at each level are listed Sine Sweep Random Vib Acoustic Pressure Profile Mass Property Interface Verification EMI/EMC ESD Compatibility (Grnding) Functional/Performance Thermal Vacuum Thermal Balance Thermal Cycle Humidity Backout Radiation Inspection Comments Sine Burst Environmental/Other - - - - - - M TA - - TA - - TA M A A I C Board 1 E C Board 1 Q - - C Chassis 1 Q A A C Pow er Supply 1 Q - - C Board 17 F - C Chassis 17 F - C Pow er Supply 17 F S Box 1 S Box 16 S Box 1 - - - - M TA - - TA - - TA M A A I A A - - M TA - - TA - - TA M A A I - - - - M TA - - TA - - TA M A A I - - - - - M TA - - TA - - TA M A - I - - - - - M TA - - TA - - TA M A - I - - - - - - M TA - - TA - - TA M A - I Q TQ TQ TQ TQ A A M TQ TQ TQ TQ TQ A - M A - I F TA - - TA - - M TA - - TA TA A - M A - I 4 cycle T/V S TA - - TA - - M TA - - TA TA A - M A - I 8 cycle T/V Assem bly Level S= Subsystem C=Component G. Haller Electrical Static Load Unit Type Component (ITEM) Mechanical Quantity Assembly Level Hardware Unit Type PF=Proto Flight F=Flight S=Spare Q=Qual E=Engineering / VerificationModel Verification Method T=Test A=Analysis M=Measurement I=Inspection Buy-Tested at supplier Buy-Tested at supplier QS=Qual by Similarity TQ=Test, Qual Levels TA=Test, Acceptance Levels 4.1.7 Elex System Engineering V7 14 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Electrical & Environmental Test Flow LAT Qual Accept •LAT Test •LAT Test TEM DAQ/PS Qual Accept •Elec •Elec PDU EPU SIU TEM DAQ GASU TEM PS Qual Accept Qual Accept Qual Accept •Elec •Sine Vibe •Random Vibe •Thermal Vac •EMI/EMC •Elec •Static Load •Random Vibe •Thermal Vac •Elec •Sine Vibe •Random Vibe •Thermal Vac •EMI/EMC •Elec •Static Load •Random Vibe •Thermal Vac •Elec •Sine Vibe •Random Vibe •Thermal Vac •EMI/EMC •Elec •Static Load •Random Vibe •Thermal Vac G. Haller 4.1.7 Elex System Engineering V7 15 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Risk • No single DAQ system failure can degrade LAT Electronics capabilities below minimum science requirements • Failure in SIU, PDU, or GASU can require use of the respective redundant unit • Failure in one of the two EPU’s can require use of the redundant EPU unit. A second failure will reduce the available EPU CPU power by a factor of 2. • Failure in TEM power-supply or TEM DAQ module can lead to – Loss of a full tower (most of the assembly is single string) – Loss of the calorimeter or parts of it – Loss of the tracker or parts of it G. Haller 4.1.7 Elex System Engineering V7 16 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Electronics Risk Summary ID # Risk Rank Risk Description •Flight-Software schedule is tight • Depends on execution of LAT software development approach. Elec/224 Moderate • Delays in incremental review process may impact cost & schedule Risk Mitigation •Detailed software development plan, schedule and review points established (3/24/03). • Early integration of software to target hardware via EM plan (Sept 03) • Extensive use of test bed (Feb 04 and beyond) • Tower Power Supplies Cost & Schedule depend on bids received in response to RFP • Proposals may exceed allocated schedule & funding Elec/221 Moderate • Bids expected 3/25/03 • Assess schedule problem • Determine cost impact to maintain schedule • Negotiate with vendor to minimize impact • Develop minimum impact re-plan & pursue CCB approval G. Haller 4.1.7 Elex System Engineering V7 17 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Electronics Risk Summary ID # Elec/223 Risk Rank Low Risk Description • Two types of Tower Electronics Module ASICs submitted 1/18/03. • 3 month turn around results in late reaction required if flaw is found upon delivery and test resulting in schedule and cost impact Risk Mitigation • Protect schedule for additional ASIC run. • Evaluate work arounds to mitigate late delivery of flight ASICs and recover schedule margin. • If untenable ASIC flaws occur, implement worst case backup (FPGAs) • Cost & Schedule of CPU Board depend on bids received in response to RFP to be sent out end of Mar-03. Bidding cycle 4-weeks Elec/222 G. Haller • For now NRL CPU board effort is stopped. If there is a problem with the BAE board, would revive the effort Low 4.1.7 Elex System Engineering V7 18 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 FMEA Fault Tree Analysis – LAT-TD-01757-01 (Draft) • FTA’s completed on EPU’s, GASU’s, PDU’s, SIU’s, TEM’s, & TEM/PS’s Rev 24, Tower Electronic Module Power Supply Fault Tree (L-TPS) 11 Mar. 2003 Page 10 of 13 Rev 24, Tower Electronic Module Fault Tree 11 Mar. 2003 (L-TEM) Page 9 of 13 Rev 24, Spacecraft Interface Unit Fault Tree 11 Mar. 2003 (L-SIU) Page 7 of 13 • Most components multiply redundant (More than one redundant component) Power Distribution Unit/SC Power Bus Fault Tree Rev 24, 11 Mar. 2003 Page 6 of 13 Rev 24, 11 Mar. 2003 • No single point failures without ground contingency – (Software) (L-PDU) Global-Tirgger/ACD-EM/Signal Distribituion Unit (GASU) Fault Tree Page 5 of 13 (L-GAS) Rev 24, 11 Mar. 2003 Loss of GASU System Function C-12, GAS-INS Electronic Processing Unit Fault Tree Page 4 of 13 (L-EPU) Loss of EPU Sytem Function C-5, EPU-INS • Non-redundant with in redundant systems identified. Loss of EPU Loss of EMI Shielding Loss of EPU S/W Function Loss of GASU/EPU Comm. C-26, STR-EPU/SIU/GAS EPU Malfunction L-EPU-07 EPU RAD750 Board Failure (EPU Redundant - 2 of 3) L-EPU-01 EPU Backplane Failure (EPU Redundant - 2 of 3) L-EPU-02 EPU SI Board Failure (EPU Redundant - 2 of 3) L-EPU-03 Loss of Electronics Bay Cooling C-33, TML1- PDU,SIU,GAS,EPU GASU/EPU Connector/Cable Failure (Open) L-EPU-05 EPU LC Board Failure (EPU Redundant - 2 of 3) L-EPU-04 Loss of EPU Power C7, GAS-EPU EPU Code Failure Software Contingency Reload Filter software EPU Power-On Chip Failure (EPU Redundant - 2 of 3) GASU/EPU Connector/Cable Failure (Short to ground/signal) (EPU Redundant) L-EPU-14 L-EPU-06 Loss of EPU Power Feed C-9, PDU-EPU Failure Mode & Effects Analysis LAT-TD-00374-01 (Being Drafted) PDU/EPU Power Feed Connector/Cable Failure (open) L-EPU-09 PDU/EPU Power Feed Conn./ Cable Failure (Short to ground/ signal) (EPU Redundant) L-EPU-08 Legend - OR Gate - SUM Gate - AND Gate • Failure modes identified Failure Consequence (connection with other FTA sheets) Ground Contingency EPU/PS PolyFuse Failure (EPU Redundant) L-EPU-15 EPU/PS Connection Failure (Open) L-EPU-11 EPU 5.0V PS Failure (EPU Redundant - 2 of 3) L-EPU-13 EPU 3.3V PS Failure (EPU Redundant - 2 of 3) L-EPU-12 EPU/PS Conn. Failure (Short to ground/signal) (EPU Redundant) L-EPU-10 Non-Redundant Failure Non-Redundant Failure within Redundant System Redundant Failure Non-LAT Hardware failure Failure Consequence Ref. To: LAT-SS-00010 L-II(b) Graceful Failure Consequence Failure Consequence & Propagation • Effects analysis underway • Probability being linked to component failure • No criticality 1, or 2 failures • Few 2R failures, mostly 2MR thru 5 failures G. Haller 4.1.7 Elex System Engineering V7 19 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Reliability Allocation Mission 70% (Pf = .3) Observatory 85% (Pf = .15) LAT 85% (Pf = .15) DAQ 96% (Pf = .04) Tower Electronics TEM DAQ G. Haller TEM PS GASU PDU SIB SIU LCB EPU PSB CPU incl FSW Harness Back Plane 4.1.7 Elex System Engineering V7 20 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Parts Lists • Parts Lists – Electrical component list for DAQ submitted to Electrical Parts Control Board and most parts are approved (see later presentation) – Mechanical components list for DAQ submitted to Mechanical Parts Control Board G. Haller 4.1.7 Elex System Engineering V7 21 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Spares Plan Item Need for Flight Qual Flight Spares Spare PCI boards Tower DAQ Module Assembly 16 1 2* n/a Tower Power Supply Module Assembly 16 1 1* n/a GASU Assembly (contains prime and redundant unit) 1 1 0* n/a PDU Assembly (contains prime and redundant unit) 1 1 0* n/a SIU Assembly 2 1 0* CPU/SIUSIB/PSB/LCB EPU Assembly 3 0** 0* EPU-SIB * Qualification Models are flight spares ** EPU does not have separate qualification since crate is the same as SIU crate G. Haller 4.1.7 Elex System Engineering V7 22 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Technical Issues and Status • No known technical issues in respect to functionality and performance except potentially – TEM GTCC and GCCC ASIC (back from fabrication end of 3/03) – Reliability; Analysis in progress G. Haller 4.1.7 Elex System Engineering V7 23 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Drawing Tree (Example) 2 3 Tower Electronics Module LAT-DS-01481 Tower Electronics Module DAQ Assembly, TEM Power Supply LAT-DS-01643 LAT-DS-01482 TEM Box Base Specification, TEM Power Supply Assy. LAT-DS-00554 LAT-DS-01651 TEM Box Lid TEM Connector Plate Box Base, Power Supply Assy. Box Lid, Power Supply Assy. LAT-DS-00555 LAT-DS-01026 LAT-DS-00995 LAT-DS-00996 TEM Connector Pin Flange Screw Bracket A Bracket B LAT-DS-01031 LAT-DS-01487 LAT-DS-01027 LAT-DS-01028 Bracket C Bracket D LAT-DS-01029 LAT-DS-01030 Specification, TEM Power Supply CCA. Interface Control Document, Power Supply CCA Circuit Card Assembly, TEM DAQ Specification, TEM DAQ Test Procedure, TEM DAQ LAT-DS-01646 LAT-DS-01644 LAT-DS-01645 Specification, TEM DAQ CCA LAT-DS-01647 Test procedure, TEM Power Supply Assy. LAT-DS-01652 Test Procedure, TEM DAQ CCA LAT-DS-01648 Printed Wire Board, TEM DAQ CCA LAT-DS-01649 Schematic Diagram, LAT_DS_01650 LAT-DS-01537 LAT-DS-01281 G. Haller 4.1.7 Elex System Engineering V7 24 GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003 Summary • • • • • • • • Changes since PDR described Interfaces documents released and under change control Technical budget at CDR level with sufficient margin Verification and test plans documented Risks contained in LAT database with mitigations FMEA and reliability well under way Drawing tree well advanced System engineering will be at CDR level by CDR time – Main remaining item is completion of reliability analysis G. Haller 4.1.7 Elex System Engineering V7 25