Multi/many core in Avionics Systems 4th TORRENTS Workshop December, 13 th 2013 Presented by Jean-Claude LAPERCHE - AIRBUS
Agenda Introduction Processors Evolution/Market Aircraft needs Multi/Many-core Drawbacks & Possible ways Other challenges for multi-core in avionics system Conclusion Page 2
Introduction Improvement of Aircraft (A/C) Safety over last 50 years, Many factors : Training, Regulation rules,... Annual Accident Rate (per millions departures) 70 60 50 40 30 20 10 0 1959 2010 New A/C, New functions (Fly-by-wire,...), Safety Improvement is the result of the COTS use and above all COTS µps allowing more and more A/C functions. Page 3
Processors Evolution From 1970 to 200x : Mono-core architecture Processing power by frequency, Cache but thermal dissipation limit. In 2005, Intel stops the Ghz race for the new "performance per watt" race. Objective: consumption 10 by using Electronic integration Multi-Core Processor (MCP) architecture INTEL Roadmap Page 4
Processors Market All µp/fpga Manufacturers offer Multi-core µprocessor products Consumer Market and Telecom, Automotive, Medical markets Low power consumption multicore boosted by Tablet, Smartphone, movable device (medical, military..) Page 5
Processors Market Avionics does not lead the processors market Other targeted markets do not have the same constraints Only few multi-core COTS are eligible for avionics COTS internal architectures are in constant evolution o o Towards Systems-On-Chip Increase of power computing multi-core many-core Page 6
Aircraft trends New functions for navigation optimization, Synthetic visualization, Data transmission, Increased software size, High Speed Communication Buses(1Ghz Network 10000 A429 (100Kb/s)) Security Data management, Integration: incorporate more and more functions in one computer (less weight, volume, watts,.), Obsolescence management, Multi/Many-cores could : Be an answer for these needs, Help Aircraft Manufacturer to continue improving Safety Page 7
Multi/Many-core Drawbacks & Possible ways External Memory Controller 2 Core 1 Cache L1/L2 Core 2 Cache L1/L2... Core n Cache L1/L2 Memory Controller 1 External Memory Cache L3 I/O 1 Interconnect... I/O n Cache L3 Memory Timing variability Shared Cache (L3), Memory controllers: accesses slowed down if simultaneous requests from I/O controllers. Possible ways Limit functional usage domain (same as mono-core µp) of the Multicore SoC to decrease demonstration efforts, Find an adequate execution model to meet our predictability requirements, Determine how to support robust partitioning (temporal, space, I/Os). Page 8 WCET: Worst case Execution Time
Multi-core processor for Avionics - Draft3 November 013 Multi/Many-core Drawbacks & Possible ways Self-reconfiguration: - Frequency self modification in case of overheat, - ARM Big/Little Architecture: Self selection of the appropriate Core with no indication to the software Possible ways: - to deactivate these functions if possible, - To use these functions under software management (with a complete behavior change) Page 9
Multi/Many-core Drawbacks & Possible ways Software Integration: Lack of observability & Verification Means, Possible ways: Simulation, Instrumentation/monitoring, internal debug features, SEU/MBU (cosmic radiation) management If SEU rate should be stable, the ratio SEU/MBU ratio could increase. Analysis more complex, SEU/MBU effect on common features? Possible Ways: Duplication/Triplication of application to detect/correct impact of SEU/MBU Impact on processing power, time variability, etc Easier with many-cores than with multi-cores? Page 10 SEU: Single Event Upset MBU: Multiple Bit Upset
Multi/Many-core Drawbacks & Possible ways Reliability & Life Time: Multi/Many-core first components using electronic integration. Failure rate Life time Delivery Avionics system need Infant Mortality Random Failure Phase Impact on: Phase Reliability Infant mortality phase: failures during Final Assembly Line Reliability: MTBF ; Wear Out Phase: DMC(DirectMaintenanceCost), Prediction models? Possible ways System Architecture (Redundancy/ Backup ) Possibility to increase Reliability/Life time with a specific use : - cores switch off/on, cyclic use, lower voltage, lower frequency? New screening method to improve Infant Mortality Phase Wear out Phase Time Page 11
Multi/Many-core Drawbacks & Possible ways Safety demonstration: Quantitative analysis: Today based on constant failure rates. Tomorrow need to take into account wear-out phase (mean failure rate, Weibull law, )? Multi/many-core not developed according to aeronautical standards (as usual for COTS component), Safety analysis depends on erroneous behaviour detection coverage Possible ways Set up mitigation means to limit the Multi/Many-Core COTS undesired effects impacts (Architecture mitigation): At equipment level, At function/system level. Page 12
Multi/Many-core Drawbacks & Possible ways Mitigation means at equipment level: Example of monitoring on mono-core SOC: Not linked with A/C function Mono-Core µp CPU Core (DO178 Zone) Complex Peripheral Zone DO254 or DO178 µp Zone ( Clock, Power Supply) Equipment Inputs / Outputs Validation of ALL exchanged Data (CRC ) Global behaviors monitoring (watchdog, ) Page 13 DO178: Software considerations in airborne systems and equipment certification DO254: Design Assurance Guidance for Airborne Electronic hardware
Multi/Many-core Drawbacks & Possible ways Mitigation means at equipment level: For Multi-core : same principle with cross-check between cores and 1 final check by an external proven component. External Memory Controller 2 Core 1 Cache L1/L2 Core 2 Cache L1/L2... Core n Cache L1/L2 Memory Controller 1 External Memory Cache L3 I/O 1 Interconnect... I/O n Cache L3 Memory DO254 or DO178 µp Zone ( Clock, Power Supply) Page 14
Multi/Many-core Drawbacks & Possible ways Mitigation means at Function - AC Level: Example of monitoring on mono-core SOC COTS Computer 1 ² F F: Function MF: Monitoring Function Computer 2 Servo- Control MF CPU zone Complex Peripheral Zone Page 15
Multi/Many-core Drawbacks & Possible ways Mitigation means at Function - AC Level: Example of monitoring on mono-core SOC COTS Computer 1 F F 1 Computer 2 Servo- Control F1 : Monitoring of COTS behavior => data known, same spatial and timing that functional data linked with safety objectives. Check MF F1 CPU zone Complex Peripheral Zone Monitoring could be adapted to Multicore/manycore Page 16
Other challenges for multi/many-core in avionics Fault Tolerance concept [For safety critical system (as FlightByWire)] Multi/many cores could integrate more and more A/C functions Total Component failure: simultaneous system reconfigurations! Partial component failure (1 or more cores) or fault due to SEU : reconfiguration to another core, should be done without impact at computer/aircraft level Because, in case of failure, System Designer has to master Computers/A/C functions reconfiguration, impact on hydraulic or electric networks, A/C zonal analysis, Crew alerting. With no or limited impact on aircraft flight Internal reconfiguration of Multi/Many-core could be set up only to reach reliability/safety objectives at component/equipment level. Page 17
Other challenges for multi/many-core in avionics System Architecture o Multi-core COTS could have significant impact on system architecture: To be adapted to multi-core: WCET demonstration, parallel programming, Due to Architecture Mitigation Dissimilarity? New Monitoring? Fault tolerant architecture Certification aspects: o Mainly derived from technical aspects and ways to use the COTS (confidence in COTS is based on experience) o Airworthiness authorities could request more justifications Page 18
Other challenges for multi/many-core in avionics Industrial aspect: o Faultless support of component manufacturer (access to design data) o To design «long lasting» solutions by limiting adherence to internal COTS architectures o To Maintain competence during 30-50years o Avoid only one multi/many-core manufacturer for avionics, Page 19
Conclusion Multi/many-Core Processor : Normal evolution for avionics systems, Complexity will continue to increase, Complex/long studies to develop skills/solution/certification justifications, Potential impact on system architecture, Multi/Many-cores could : propose opportunity for new A/C functions, Help Aircraft Manufacturer to continue improving Safety. Page 20
Thank You AIRBUS S.A.S. All rights reserved. Confidential and proprietary document. This document and all information contained herein is the sole property of AIRBUS S.A.S. No intellectual property rights are granted by the delivery of this document or the disclosure of its content. This document shall not be reproduced or disclosed to a third party without the express written consent of AIRBUS S.A.S. This document and its content shall not be used for any purpose other than that for which it is supplied. The statements made herein do not constitute an offer. They are based on the mentioned assumptions and are expressed in good faith. Where the supporting grounds for these statements are not shown, AIRBUS S.A.S. will be pleased to explain the basis thereof. AIRBUS, its logo, A300, A310, A318, A319, A320, A321, A330, A340, A350, A380, A400M are registered trademarks. Page 21