On the Model-centric Design and Development of an FPGA-based Spaceborne Downlink Board

1. On the Model-centric Design and Developmentof an FPGA-based Spaceborne Downlink Board Rob Jones, Roman Machan, Tahsin Lin, and Ed LeventhalASRC Aerospace Corp. 6303 Ivy Lane, Suite 800Greenbelt, MD 20770 {robert.jones, roman.machan, tahsin.lin, ed.leventhal}@akspace.com Jones

2. Outline • SMART Approach to Model-centric Engineering • Formal Modeling with Petri Nets • Application to an FPGA-based Downlink Design • Summary Jones

3. General Petri nets conflicts, decisions, concurrency, synchronization, … Modern Formalisms Finite automata(state machines) Marked graphs concurrency but no conflicts/decisions conflicts/decisions but no concurrency Data, control, process flow graphs & queuing networks Jones

4. p1 t1 p2 p3 t4 t2 t3 p4 p5 t5 Petri Net • Bipartite graph, PN = (P, T, m0) • Set of places, P= {p1, p2, p3, p4, p5} • Set of transitions, T = {t1, t2, t3, t4, t5} • ArcsPTTP connecting • Places to transitions • Transitions to places • Tokens mark places and defines the notion of state • Transitions fire when sufficient tokens are present (or absent) from input places, thereby removing tokens from input places and depositing them to output places Jones

5. Underlying State Machine p1 t1 p2p3 t2 t3 t4 t2t3 p4p3 p2p5 t4 t3 t2 p4p5 t5 Reachability Graph • The notion of time is introduced with firing delays • SPNs sojourn in markings for some amount of time before transitions fire, thus movingthe net to the next marking • Firing delays may be deterministic or randomvariables • Movement of the net among markings with the passage of time gives rise to a stochastic process, which can be analyzed Jones

6. Model Equivalents Multi-server Queue m Petri Net 1 n min(tk(p),m)·m l 2 l … p m l l l l l l l l … … n m+1 0 1 2 3 m mm mm m 2m 3m 4m mm mm Markov Chain Jones

7. The SMART Approach Stochastic Model-Checking Analyzer for Reliability and Timing (SMART) Capture – Well-defined system requirements and design specification Validation – Modeling the right system Verification – Modeling the system right Analysis – Performance tradeoffs Realization – Allocate functions to resources Testing – Cases, coverage, and acceptance Iteration – Repeat steps as necessary to refine modeling and design details Integration – Aided by well-defined interfacesand architecture Deployment – Preservation and maturation of models aid documentation, operation, and maintenance Requirements High-level Petri Net Validation Model Analysis and Testing Analytical Model Checking Simulation Intermediate SystemC VHDL FPGA Execution Low-level Integrate Jones

8. Exact state space analysis,verifies logical correctness to requirements specs Design function and form Fault-tolerance and coverage Insight to design alternatives Process scheduling, driven by data (control) flow and graphically embedded Exploits hidden concurrency Determines correct, sufficient synchronization and queuing Alternative schedules imposed via artificial dependencies Performability,measure of performance in the presence of faults (other “bad” events) Availability, dependability User-defined QoS Reward (cost) of operating the system over its mission time Schedulability, computes graph-theoretic performance bounds of “embedded” schedule Critical path  end2end delay Critical circuit  throughput Resource utilization Benefits from Model Analysis Qualitative Quantitative Jones

9. Downlink Dataflow and Queuing 32-bitInput Data from CompactPCI Bus Interrupt on Input Queue status or queuing errors High-speed Downlink Board Downlink Ready when Input Queue is at most 1/4 full USES Bypass OutputData 15 bits 80 Mb/s 20 MB/s 10 MB/s USES USESQueue VCDU Function OutputQueue CADUFunction LVDS DRVR Input Function SerialBit Stream 66 MW/s 20 MS/s(S=samples) 2K16 4K8 LSBsQueue InputQueue Reed-Solomon Encoder LSBs 4K8 1K32 Jones

10. VCDU Functional Dataflow VCDU Functionwithin FPGA Idle data 4Kx8 bits 16x8 bits LSBsQueue Level < 1/4 Input Function DataQueue mux (8) (8) 2Kx16 bits USES USESQueue OutputQueue Headers Control 4Kx8 bits 16x16 bits EOP AuxiliaryQueue (5) EndBits (1) Fill8 (10) 20 MHz clock 20 MB/s throughput Counter DataRdy Packet Word Length Jones

11. Input Arrival and Buffering Model Access Bus word (w) = 16 bits Transfers from Sensor Module Downlink Ready BurstArrival ¼Bi + 1 Block Buffer Write (32 bits) 1K DownlinkInput Queue Next Block 2 (words) 1 cycle 5 cycles 16 Mw/s burst10 Mw/s average Delay Preempt Active Transfer Done Other Use Busy UseBus Idle State of PCI Bus Resume Inactive Jones

12. Input Processing Model ¾Bu • Each 2 KB of data is encoded into a compressed sourcepacket for CCSDS transport • 16-bit words are unpacked from PCI input • LSBs removed, queued, and later rejoined with packet data within each Virtual Channel Data Unit (VCDU) UnpackInput Process begins with sufficient data Prevents USES Queue overflow Remove LSB Sample Data USES Queue Input Queue ¼Bi+1 20 Msamp/s USES 2 VCDU Function Word Data 2 cycles 8 10 Mw/s LSBs LSBsQueue 1 cycle Write LSBs 1 cycle Jones

13. Input Queuing Performance High Entropy Nominal Entropy Jones

14. Maximum Entropy Rate14.7 bits/word 5.9 bits/word mean 3.5 bits/word minimum Summary of Downlink Model Analysis 25 (1) Input Queue 20 15 Entropy Rate (bits per word)of IR data, 0.6 wave no. around ZPD (4) Output to transmitter Mean 10 (2) USES Queue 5 (3) Output Queue Jones

15. USES Entropy Encoding Model • Based on the Universal Source Encoder for Space (USES) • C(n) = (E(n) –1)J/16code words per nth packet • E(n) = mean entropy rate (bits/word) • J = block size (samples/block) USES Queue C(n) Encode Block Word Count Aux Queue J cycles tk C(n) tk tk ReadSample SampleData EvaluateBlock Packet Index Block Count n 64 J 1 cycle BlkRef·RefPac= 64 blocks/word J Next Sample 2J Jones

16. Detailed Functional Model of USES IDbits EndPac Rice Block EvaluateBlock N·(J - #(Ref)) #(EndPac) J Encoding Bit Info Begin Code Read BlkRef (b) Samples 16 #(Ref) (1-b) Output Reduce Insert Ref Block Count #(EndPac) Data Ready N #(Code) Reference Count Write Delay End Packet RefPac USES Queue cond(0 < #(Code) < 16, 1, 0) Jones

17. USES Queuing Performance High Entropy Nominal Entropy Jones

18. VCDUHeader PacketPrimaryHeader PacketSecondaryHeader Packet Data Space 8 bytes 6 bytes 1 byte 1,085 bytes VCDU Model ¾Bo WriteVCDUHeader 8 Data Queue 1cycle 16x8 bits StartNewVCDU WriteData OutputQueue Data Space Writing Packet PrimaryHeader Start NewPacket HeaderLength 1092 6 Complete(variable-length)Data Packet Create(variable-length)Data Packet 1cycle WriteHeader 8cycles State ofWritingPackets tk 2tk AuxQueue PacketLength tk Jones

19. Data Packet Creation Model AuxQueue # # WritePacketSecondaryHeader ¾Bd 1 cycle DataQueue 1 cycle First Complete(Compressed)Data Packet LSBsQueue ¾Bd 2 cycles WriteLSBs Second 2 USESQueue 128 WriteUSESPacket ¾Bd Third 2 StartNewPacket Packet Length tk(Packet Length) Last tk(Packet Length) Jones

20. Synchronous CADU Model Demands steady supply of VCDUs • Channel Access Data Units(CADUs) are RS protected, sync prefixed, and 1264 bytes long • Output Queueis demand drivenby synchronous CADUs to maintain80 Mb/s output bit-data stream VCDU Length (bytes) ReadVCDU 164 cycles WriteRS Code and ASM Output Queue 1100 10 MHz Adds 160 byte RS code 1 cycle per byte delay, 1100 + 160 cycles total 1 cycle 1100 Reed-SolomonEncoder Standard FIFO(4Kx8 bits) CADU Function VCDU Function OutputQueue 80 Mbps 80 MHz nom Data Clock 10 MHz 10 MBps input rate 80 Mbps output rate Adds 4 byte Attached Sync Marker 1264 clock cycles of work 20 MHz 20 MBps throughput Jones

21. Output Queuing Performance High Entropy Nominal Entropy Jones

22. Summary • Petri net modeling with the SMART tool provides a formal (mathematical and therefore unambiguous) description of a system throughout its development • The engineering process therefore benefits from • Ensuring precise requirements specification • Model checking to ensure logical correctness • Quantified QoS measures that facilitate trade studies • Rapid, model-based prototyping before committing to hardware or software • Successfully applied to an FPGA-based downlink system designed for space applications Jones