glast large area telescope: electronics, data acquisition & flight software system engineering

GLAST LAT Project DOE/NASA Peer Critical Design Review, March 19-20, 2003

G. Haller 4.1.7 Elex System Engineering V7 1

GLAST Large Area Telescope:GLAST Large Area Telescope:

Electronics, Data Acquisition & Flight Software System Engineering

Gunther HallerStanford Linear Accelerator CenterManager, Electronics, DAQ & FSWLAT Chief Electronics Engineer

[email protected](650) 926-4257

Gamma-ray Large Gamma-ray Large Area Space Area Space TelescopeTelescope



System Engineering OutlineSystem Engineering Outline

• System Overview• Changes since PDR• External Interfaces• Internal Interfaces• Technical Budget• Verification & Test• Risk• FMEA• Reliability Allocations• Parts and Spares Plan• Drawing Tree



Data-Acquisition (DAQ) System OverviewData-Acquisition (DAQ) System Overview

• Configuration, triggering, event-flow control and readout, monitoring, and supply of power to

– 16 Calorimeter and Tracker towers with a total of 850,000 tracker channels and 3,000 calorimeter channels

– 12 ACD front-ends with a total of 208 ACD channels

• Interface to spacecraft for control, data, monitoring, and power

• Trigger system (hardware selection of possibly interesting events)

• Event filtering• Housekeeping• Operational thermal control

CAL

TKR

ACD

ACD

ACD

0 1 11Tower 0

CAL

TKR

Tower 1

CAL

TKR

Tower 15

4.1.7 Data-Acquisiton

(DAQ) System

Spacecraft

LAT

VCHPHeaterControl



LAT Electronics HierarchyLAT Electronics Hierarchy

SIU

EventBuilder

GlobalTrigger

CommandResponse

Unit

TEM 0

CAL

TKR

TEM 1

CAL

TKR

TEM 15

CAL

TKR

ACD

ACD

ACD

ACD ElectronicsModule

GAS Unit

EPU 0 EPU 1

SCCommanding

SC ScienceData

0 1 11

• Tower Electronics Module– Interface to calorimeter and tracker on

each tower– Monitoring– Combination of sub-system trigger

signals to primitives– Event buffering

• GAS Unit– Command-response unit receives and

distributes command, clock, and data– Global trigger unit generates LAT-wide

readout decision signals based on trigger primitives from TEM’s and ACD

– Event-builder unit builds complete LAT events out of asynchronous event-fragments; Forward complete events to dynamically selected target EPU’s or spacecraft

– ACD electronics module tasks much like TEM for TKR/CAL

• EPU: Event processor unit runs filter algorithm to reduce 10kHz input event rate down to 30 Hz (with two EPU’s)

• SIU: Spacecraft interface unit controls LAT and interfaces to spacecraft

• Instrument software runs on EPU and SIU processors only

• Power system not shown



LAT Electronics PhysicalLAT Electronics Physical

16 Tower Electronics Modules– DAQ electronics module (DAQ-EM)– Power-supplies for tower electronics

* Primary & Secondary Units shown in one chassis

ACD

spare

EPU-3

EPU-2EPU-1

spare spare

Pwr Dist. Box

GASU

spare

spare

SIU-P SIU-R

3 Event-Processor Units (2+1 spare)

– Event processing CPU– LAT Communication Board– SIBSpacecraft Interface Unit

– Spacecraft Interface Board (SIB): Spacecraft interface for MIL1553 control & data

– LAT control CPU– LAT Communication

Board (LCB): LAT command and data interface

Power-Distribution Unit (PDU)*

– Spacecraft interface, power

– LAT power distribution

– LAT health monitoring

Global-Trigger/ACD-EM/Signal-Distribution Unit*

TKR

CAL

TKR Front-End Electronics (MCM)

ACD Front-End Electronics (FREE)

CAL Front-End Electronics (AFEE)



Changes since PDRChanges since PDR

• Spacecraft Selection and Meetings:– PDU was moved to opposite side of

SIU to match SC power/C&DH physical partitioning

– Signal levels (discretes, 1 PPS, Science Interface, GBM GRB signal) were officially changed to LVDS (before undefined or RS422), March 03

– Recently finalized power, analog monitoring, and discrete interface to SC

– Defined MIL1553 command set/interface

– Separated SIU prime and redundant into separate (and identical) crate assemblies since cross-connection to SC prime and redundant was solved on the SC-LAT interface level and lead to removal of direct SIU-SIU inter-connections

Before SC selection

After SC selection



Changes since PDR (Con’t)Changes since PDR (Con’t)

• Event-Builder was moved from CPU crates to GAS unit

– Reduced complexity of inter-connections– Reduced hardware from 3 event-builder

blocks to 2 (1 prime, 1 redundant), and power dissipation from two event-builder blocks to one

• SIU crate was modified to be the same as EPU crate

– Removes mechanical, thermal, electrical design effort for one assembly

– Moved SC science interface from Spacecraft Interface Board in SIU to event-builder in GASU

– Additional benefit that SIB board is almost identical to existing SECCI version (both boards are designed by NRL/Silver Engineering), major simplification

– Science interface on GASU is small change since GASU already transmits event data to LAT CPU’s, so additional target is incremental

– Added SIB board in each EPU crate to provide local EEPROM

• Simplification in software effort. • No remote booting code

development/testing required.

SIU

EventBuilder

GlobalTrigger

CommandResponse

Unit

TEM 0

CAL

TKR

TEM 1

CAL

TKR

TEM 15

CAL

TKR

ACD

ACD

ACD

ACD ElectronicsModule

GAS Unit

EPU 0 EPU 1

SCCommanding

SC ScienceData

0 1 11



External InterfacesExternal Interfaces

Interface Document Status

Calorimeter LAT-SS-00238 released

Tracker LAT-SS-00176 released

ACD LAT-SS-00363 released

Mechanical/Thermal LAT-SS-01794 in progress

Spacecraft GSFC-433-IRD in progress at GSFC but content stable

• All external DAQ interfaces released with the exception of spacecraft interface and mechanical/thermal interface (mainly to X-LAT plate)



Internal InterfacesInternal Interfaces

Interface Document Status

Tower Electronics Module LAT-TD-00605 finalizing

TEM Power-Supply Unit LAT-SS-01281 finalizing

GAS Unit LAT-SS-01544

LAT-TD-00639

LAT-TD-01545

LAT-TD-01546

LAT-TD-01547

finalizing

SIU/EPU LAT-SS-01539 finalizing

PDU LAT-SS-01542 finalizing

VCHP Control Unit LAT-SS-00715 finalizing

• All internal interfaces are final, documents are being updated, release before CDR



DAQ Technical Budget SummaryDAQ Technical Budget Summary

Technical Resources

• DAQ Mass– Sub-system allocation: 220 kg– Detailed estimate: 199.3 kg

• DAQ Power– Subsystem allocation: 318 W– Detailed estimate: 313.8 W

• CPU Cycles– Allocation: 2 CPU’s– Detailed estimate: < 1 CPU

• For detailed breakdown see Power/Mechanical/Software presentations



Verification & TestVerification & Test

• Hardware and software development closely integrated– Design of hardware versus software complexity optimized continuously– Software runs with LAT engineering model electronics– Continuous hardware versus software verification– Full system including sub-system electronics from and at other institutions– Independent verification process

• Exchange of hardware and software ->– ACD hardware, TKR hardware, CAL hardware– DAQ hardware– Flight software, I&T software– ACD Scripts, TKR scripts, CAL scripts, DAQ scripts

– No integration at flight- LAT integration stage of components which have not operating fully integrated in earlier stages

• Exception is spacecraft, since simulator is only simulating and is not real hardware/software

Model Development

DesignHardware Fab Test

Design/Develop Develop/Test Formal TestSoftware Release to I&T



Verification & Test (Con’t)Verification & Test (Con’t)

• Three development cycles– Engineering Model 1

• Single tower, single CPU– Engineering Model 2

• Multiple tower, single CPU– Flight Model

• Multiple towers, multiple CPU’s• Peer-Reviews after end of each development cycle• In addition regular LAT reviews (Manufacturing Readiness Review, etc)

Development Cycles

EM 1

EM2

Release to I&T

Release to I&T

Release to I&TFU

Release to sub-systems

Release to sub-systems



Verification Matrix (Doors Example Page)Verification Matrix (Doors Example Page)

ID TDF L3 Performance Specification VM Verif.

TDF3-7 The Level 1 Trigger (L1T) system shall be used to detect an interesting event and provide a signal to the detector subsystems to capture and read out the event data.

Demo

TDF3-105 The trigger (TRG) system shall determine whether the event is interesting based on trigger input signals received from the detector systems.

Demo

TDF3-9 The L1 trigger system shall accept trigger inputs from the ACD, TKR, CAL and dataflow subsystems.

Demo

TDF3-11 The L1 trigger system shall time-align trigger inputs from the ACD, TKR, CAL and dataflow subsystems to a precision better than 100 ns.

Test

TDF3-13 The L1 trigger system shall implement multiple overlapping triggers to allow cross-trigger monitoring.

Test

TDF3-15 The L1 trigger logic shall generate a trigger acknowledge signal (L1TACK) and a trigger type (e.g. CNO) for distribution to the subsystems.

Demo

TDF3-17 The L1 trigger logic shall generate the Trigger Acknowledge output with a latency of less than 1.3 mus.

Test

TDF3-106 The latency from the time the particle traverses the LAT to when the input signals need to be recorded at the earliest shall be 2 ms.

Test

TDF3-19The L1 trigger contribution to the overall trigger jitter shall be less than ± 50 ns.

Test

TDF3-107The overall trigger jitter for the LAT shall be ± 200 ns.

Test

TDF3-51The dataflow system shall reduce the event rate accepted by the L1T to an output rate commensurate with the spacecraft interface as specified in 433-IRD-0001, keeping events meeting the science objectives.

Demo



Hardware Mechanical Electrical Environmental/Other Comments

Ass

embl

y Le

vel

Component (ITEM) Qua

ntity

Uni

t T

ype

Sta

tic L

oad

Sin

e B

urst

Sin

e S

wee

p

Ran

dom

Vib

Aco

ustic

Pre

ssur

e P

rofil

e

Mas

s P

rope

rty

Inte

rfac

e V

erifi

catio

n

EM

I/E

MC

ES

D C

ompa

tibili

ty (

Grn

ding

)

Fun

ctio

nal/P

erfo

rman

ce

The

rmal

Vac

uum

The

rmal

Bal

ance

The

rmal

Cyc

le

Hum

idity

Bac

kout

Rad

iatio

n

Insp

ectio

n

C Board 1 E - - - - - - M TA - - TA - - TA M A A I

C Board 1 Q - - - - - - M TA - - TA - - TA M A A I

C Chassis 1 Q A A A A - - M TA - - TA - - TA M A A I

C Pow er Supply 1 Q - - - - - - M TA - - TA - - TA M A A I Buy-Tested at supplier

C Board 17 F - - - - - - M TA - - TA - - TA M A - I

C Chassis 17 F - - - - - - M TA - - TA - - TA M A - I

C Pow er Supply 17 F - - - - - - M TA - - TA - - TA M A - I Buy-Tested at supplier

S Box 1 Q TQ TQ TQ TQ A A M TQ TQ TQ TQ TQ A - M A - I

S Box 16 F TA - - TA - - M TA - - TA TA A - M A - I 4 cycle T/V

S Box 1 S TA - - TA - - M TA - - TA TA A - M A - I 8 cycle T/V

Assembly Level Unit Type Verification MethodS= Subsystem PF=Proto Flight T=Test QS=Qual by SimilarityC=Component F=Flight A=Analysis TQ=Test, Qual Levels

S=Spare M=Measurement TA=Test, Acceptance LevelsQ=Qual I=InspectionE=Engineering / Verif icationModel

Test MatrixTest Matrix

Applies to each board and assembly. In this slide the tests at each level are listed



Electrical & Environmental Test FlowElectrical & Environmental Test Flow

Qual•Elec•Sine Vibe•Random Vibe•Thermal Vac•EMI/EMC

Accept•Elec•Static Load•Random Vibe•Thermal Vac

TEM DAQ



TEM PS

Qual•Elec

TEM DAQ/PS

Accept•Elec



GASU

LAT

Qual•LAT Test

Accept•LAT Test

PDU

SIUEPU



RiskRisk

• No single DAQ system failure can degrade LAT Electronics capabilities below minimum science requirements

• Failure in SIU, PDU, or GASU can require use of the respective redundant unit

• Failure in one of the two EPU’s can require use of the redundant EPU unit. A second failure will reduce the available EPU CPU power by a factor of 2.

• Failure in TEM power-supply or TEM DAQ module can lead to– Loss of a full tower (most of the assembly is single string)– Loss of the calorimeter or parts of it– Loss of the tracker or parts of it



Electronics Risk SummaryElectronics Risk Summary

ID # Risk Rank Risk Description Risk Mitigation

Elec/224 Moderate

•Flight-Software schedule is tight

• Depends on execution of LAT software development approach.

• Delays in incremental review process may impact cost & schedule

•Detailed software development plan, schedule and review points established (3/24/03).

• Early integration of software to target hardware via EM plan (Sept 03)

• Extensive use of test bed (Feb 04 and beyond)

Elec/221 Moderate

• Tower Power Supplies Cost & Schedule depend on bids received in response to RFP

• Proposals may exceed allocated schedule & funding

• Bids expected 3/25/03

• Assess schedule problem

• Determine cost impact to maintain schedule

• Negotiate with vendor to minimize impact

• Develop minimum impact re-plan & pursue CCB approval



Electronics Risk SummaryElectronics Risk Summary

ID # Risk Rank Risk Description Risk Mitigation

Elec/223 Low

• Two types of Tower Electronics Module ASICs submitted 1/18/03.

• 3 month turn around results in late reaction required if flaw is found upon delivery and test resulting in schedule and cost impact

• Protect schedule for additional ASIC run.

• Evaluate work arounds to mitigate late delivery of flight ASICs and recover schedule margin.

• If untenable ASIC flaws occur, implement worst case backup (FPGAs)

Elec/222 Low

• Cost & Schedule of CPU Board depend on bids received in response to RFP to be sent out end of Mar-03. Bidding cycle 4-weeks

• For now NRL CPU board effort is stopped. If there is a problem with the BAE board, would revive the effort



Page 10 of 13

Rev 24,11 Mar. 2003

Tower Electronic Module Power Supply Fault Tree(L-TPS)

Tower Electronic Module Fault Tree(L-TEM)

Page 9 of 13

Rev 24,11 Mar. 2003

Spacecraft Interface Unit Fault Tree(L-SIU)

Rev 24,11 Mar. 2003

Page 7 of 13Power Distribution Unit/SC Power

Bus Fault Tree(L-PDU)

Rev 24,11 Mar. 2003

Page 6 of 13Global-Tirgger/ACD-EM/Signal Distribituion Unit

(GASU) Fault Tree(L-GAS)

Rev 24,11 Mar. 2003

Loss of GASU System FunctionC-12, GAS-INS

Page 5 of 13

Loss of EPU PowerLoss of EPU S/W Function

Software ContingencyReload Filter software

Electronic Processing Unit Fault Tree(L-EPU)

Rev 24,11 Mar. 2003

Loss of EPU Sytem FunctionC-5, EPU-INS

Loss of GASU/EPU Comm.C7, GAS-EPU

Loss of EPU Power FeedC-9, PDU-EPU

Loss of EMI ShieldingC-26, STR-EPU/SIU/GAS

Loss of EPU

EPU Malfunction

Page 4 of 13

Loss of Electronics Bay Cooling

C-33, TML1- PDU,SIU,GAS,EPU

PDU/EPU Power Feed Conn./Cable Failure (Short to ground/

signal) (EPU Redundant)L-EPU-08

EPU Backplane Failure (EPU Redundant - 2 of 3)

L-EPU-02

EPU SI Board Failure (EPU Redundant - 2 of 3)

L-EPU-03

EPU LC Board Failure (EPU Redundant - 2 of 3)

L-EPU-04

EPU RAD750 Board Failure (EPU Redundant - 2 of 3)

L-EPU-01

GASU/EPU Connector/CableFailure (Open)

L-EPU-05

GASU/EPU Connector/CableFailure (Short to ground/signal)

(EPU Redundant)L-EPU-06

EPU CodeFailure

L-EPU-07

PDU/EPU Power FeedConnector/Cable Failure (open)L-EPU-09

EPU/PS ConnectionFailure (Open)

L-EPU-11

EPU/PS Conn. Failure (Short toground/signal) (EPU Redundant)L-EPU-10

EPU Power-On Chip Failure (EPU Redundant - 2 of 3)

L-EPU-14

EPU 3.3V PS Failure (EPU Redundant - 2 of 3)

L-EPU-12

EPU/PS PolyFuse Failure(EPU Redundant)

L-EPU-15

EPU 5.0V PS Failure (EPU Redundant - 2 of 3)

L-EPU-13

Legend

- OR Gate

- SUM Gate

- AND Gate

Redundant Failure

Non-Redundant Failure

Graceful FailureConsequence

Failure Consequence(connection with other

FTA sheets)

Ground Contingency

Non-LAT Hardwarefailure

Non-Redundant Failurewithin Redundant System

Failure Consequence &Propagation

Failure ConsequenceRef. To: LAT-SS-00010 L-II(b)

• FTA’s completed on EPU’s, GASU’s, PDU’s, SIU’s, TEM’s, & TEM/PS’s

• No single point failures without ground contingency – (Software)

• Most components multiply redundant (More than one redundant component)

• Non-redundant with in redundant systems identified.

Fault Tree Analysis – LAT-TD-01757-01 (Draft)

Failure Mode & Effects Analysis - LAT-TD-00374-01 (Being Drafted)• Failure modes identified

• Effects analysis underway

• Probability being linked to component failure

• No criticality 1, or 2 failures

• Few 2R failures, mostly 2MR thru 5 failures

FMEAFMEA



Reliability AllocationReliability Allocation

Observatory85%

(Pf = .15)

Mission70%

(Pf = .3)

LAT85%

(Pf = .15)

DAQ96%

(Pf = .04)

Tower Electronics

TEM DAQ TEM PS

GASU PDU SIU

SIB LCB PSB CPU incl FSW

HarnessEPU

Back Plane



Parts ListsParts Lists

• Parts Lists– Electrical component list for DAQ submitted to Electrical

Parts Control Board and most parts are approved (see later presentation)

– Mechanical components list for DAQ submitted to Mechanical Parts Control Board



Spares PlanSpares Plan

Item Need for Flight

Qual Flight Spares

Spare

PCI boards

Tower DAQ Module Assembly 16 1 2* n/a

Tower Power Supply Module Assembly 16 1 1* n/a

GASU Assembly (contains prime and redundant unit) 1 1 0* n/a

PDU Assembly (contains prime and redundant unit) 1 1 0* n/a

SIU Assembly 2 1 0* CPU/SIU-SIB/PSB/LCB

EPU Assembly 3 0** 0* EPU-SIB

* Qualification Models are flight spares

** EPU does not have separate qualification since crate is the same as SIU crate



Technical Issues and StatusTechnical Issues and Status

• No known technical issues in respect to functionality and performance except potentially– TEM GTCC and GCCC ASIC (back from fabrication end of

3/03)– Reliability; Analysis in progress



Drawing Tree (Example)Drawing Tree (Example)

Tower ElectronicsModule DAQ

LAT-DS-01643

Tower ElectronicsModule

LAT-DS-01481

Circuit CardAssembly, TEM DAQ

LAT-DS-01646

Specification, TEMDAQ

LAT-DS-01644

Test Procedure, TEMDAQ

LAT-DS-01645

TEM Box Base

LAT-DS-00554

Specification, TEMDAQ CCA

LAT-DS-01647

Test Procedure, TEMDAQ CCA

LAT-DS-01648

Printed Wire Board,TEM DAQ CCA

LAT-DS-01649

Schematic Diagram,

LAT_DS_01650

TEM Box Lid

LAT-DS-00555

TEM Connector Plate

LAT-DS-01026

TEM Connector Pin

LAT-DS-01031

Flange Screw

LAT-DS-01487

Assembly, TEMPower Supply

LAT-DS-01482

Specification, TEMPower Supply Assy.

LAT-DS-01651

Box Base, PowerSupply Assy.

LAT-DS-00995

Bracket A

LAT-DS-01027

Bracket C

LAT-DS-01029

Specification, TEMPower Supply CCA.

LAT-DS-01537

Test procedure, TEMPower Supply Assy.

LAT-DS-01652

Box Lid, PowerSupply Assy.

LAT-DS-00996

Bracket B

LAT-DS-01028

Bracket D

LAT-DS-01030

Interface ControlDocument, Power

Supply CCA

LAT-DS-01281

2 3



SummarySummary

• Changes since PDR described• Interfaces documents released and under change control• Technical budget at CDR level with sufficient margin• Verification and test plans documented• Risks contained in LAT database with mitigations• FMEA and reliability well under way• Drawing tree well advanced• System engineering will be at CDR level by CDR time

– Main remaining item is completion of reliability analysis

glast large area telescope: electronics, data acquisition & flight software system engineering

Documents