EP1031997B1 - Electronic system for operating under radiation, method for designing such a system and implementing the same for driving a mobile robot - Google Patents

Description

Technical area

The present invention relates to a system electronic operating under irradiation, in particular X or gamma, a method of designing such a system, intended to operate this system under irradiation, while having components "Vulnerable", that is to say, intrinsically unfit for operate under this irradiation, and the application of this process to the control of a mobile robot.

Although the legal unit of measure for doses of radiation incorporated by the components either Gray (Gy), tradesmen and most reference documents express this magnitude in the old unit: the Rad. In the following we will use so this second unit. However, he is reminded that: 100 Rad = 1 Gy.

Vulnerable circuits are defined as electronic circuits that support only one or a few hundred kRad, typically in form of gamma or neutron irradiation as they are meeting in nuclear engineering. Generally, these circuits have a very high degree of integration (defined by the English term VLSI (Very Large Scale Integration ") and in CMOS technology, although these characteristics are not limiting.

These "vulnerable" circuits are the only ones can perform very complex functions. We can examples of microcontrollers, processors specialized in signal processing ("Digital Signal Processor"), ASICs ("Application Specific Integrated Circuits ") or big capacity. They are particularly adapted to the implementation of embedded control systems on high-technology or robot remote manipulators mobile.

The invention is therefore mainly developed for the design of control systems for nuclear environment, which are currently the most efficient electronic systems working in this environment. That's why they are taken as an example for the description of an achievement preferred. But we do not leave the framework of the invention by applying it to any other system electronics, since its complexity makes it advantageous the use of "vulnerable" components to ambient irradiation.

The term "control system" is not considered here in the very restricted sense often used in nuclear engineering, in particular because of very rudimentary performances allowed in known art, and some examples of which are provided below. In the following, control system is used in the broader sense that it has in automatic, to know: its purpose is to gather information on the system to be ordered, process them if necessary (eg by digital filtering, correction of non-linearity), apply to them one or more laws of digital control which may include modes of autonomous functioning capable of taking decision, manage the controls of the amplifiers power associated with the actuators, ensure Security functions and manage, in case of failure partial, degraded modes of operation. A such order may also be able to communicate with an information transmission device, according to the possibilities of various work configurations (multiplexing, wireless transmission, or any other way).

State of the art

In the known art, electronic systems, working under such irradiation and with such vulnerable components are essentially the control systems for mobile robots or machines remotely operated. They can be divided into two categories, depending on the radiation dose they support.

A first category includes systems of command that can match the definition above, but can not support in practice more than some kRad, exceptionally a few dozen kRad.

An example is the mobile robot intervention "Andros", built by Remotech, USA. Embedded electronics consists of a controller standard consisting of a microcontroller board and commercial dimmers. Orders are transmitted by an umbilical cord. The control system is conventional, close to industrial type controls, but its resistance to radiation does not exceed 1 to 10 kRad.

A second category includes systems of very simplified order, unable to match the definition above, but can support in practice dozens of kRad or more hundreds of kRad if they do not have of electronics and if their order is deported to the end of a wire-to-wire connection.

An example is the mobile robot "Oscar", for which all the signals are transmitted by wire to a wire large diameter umbilical in front of the dimensions of the robot, and whose length is necessarily limited.

Another example is the Assisted Remote Manipulator "RD 500" used on site of La Hague in the 1990s: all the signals of control are transmitted wire to wire by a cord umbilical, and the command itself is deported in non-irradiated area.

• acquérir une ou plusieurs mesures,
• éventuellement les traiter de façon rudimentaire par un filtrage analogique simple (du premier ordre), ou dans le meilleur des cas par une numérisation sous 8 bits avec des temps de conversion longs (supérieurs à 10µs),
• transmettre cette (ou ces) mesure(s) selon un protocole séquentiel figé, quand ce n'est pas directement fil à fil, ce qui pose alors le problème d'un cordon ombilical pénalisant par son diamètre, son poids, ou tout simplement son existence même (il rend impossible le franchissement d'un sas),
• envoyer des consignes vers les amplificateurs de puissance qui n'appartiennent pas à proprement parler au système de commande.

More generally, this second category of very simplified control systems only aims at:

• acquire one or more measures,
• possibly treat them in a rudimentary way by simple (first-order) analog filtering, or in the best case by an 8-bit digitization with long conversion times (greater than 10 μs),
• transmit this (or these) measure (s) according to a fixed sequential protocol, when it is not directly wire to wire, which poses then the problem of an umbilical cord penalizing by its diameter, its weight, or quite simply its existence itself (it makes impossible the crossing of an airlock),
• send instructions to power amplifiers that do not belong to the control system as such.

Systems of this second category can perform advanced, high-performance functions, nor be autonomous and secure, since the security presupposes the existence of degraded modes or redundancies, than the ability to operate autonomously.

There is currently no solution to operate under irradiation a control system as defined above. The proof has been provided in the referenced document [3] which mentions the project of a mobile robot intended to to intervene on the Chernobyl site. The notebook charges required a holding at 1 MRad and the solution retained corresponds to the second category mentioned above, in his most rudimentary expression: absence total on-board electronics, all electronics is deported wire to wire by an umbilical cord.

A - le blindage des composants ou de l'équipement,

B - le choix de la localisation de l'équipement,

C - l'utilisation d'un équipement tolérant aux radiations déjà disponible commercialement,

D - la mise au point d'un équipement tolérant aux radiations.

The response of those skilled in the art is described in the document referenced [4], in Chapter 4 devoted to the design strategy. It has only four solutions:

A - the shielding of components or equipment,

B - the choice of the location of the equipment,

C - the use of radiation tolerant equipment already commercially available,

D - the development of a radiation tolerant equipment.

In practice, it is usually limited to shielding or remote location of electronics. Below we will examine each of these solutions:

• solution A, concerning the shielding:

Some components have a housing designed for resist against ionizing radiation, but it This is a light armor against the SEUs ("Single Event Upsets ") encountered by the satellites, which are accidental collisions with particles extremely energetic, can cause destruction local microcomponent. Their effectiveness against gamma radiation is derisory, even if it is reinforced by an extra metal screen because the cumulative dose of gamma radiation that a satellite is relatively weak (about 100 kRad for its entire lifetime) and does not constitute a goal for the designer. The skilled person knows whereas, despite the common name of "radiations ionizing ", this is actually a different problem of those encountered in the nuclear industry.

In the field of the nuclear industry, the shielding against ionizing radiation is consisting of a thick heavy metal blanket (by example of lead or denial for radiation gamma), since the attenuation provided by this shielding depends on the atomic mass of the material. The curves attenuation show that the thickness must exceed several centimeters for the armor to be significant, and that this thickness increases very quickly as one increases the dose of permissible radiation. So, to shield with lead the control of a traveling crane in operation on a French industrial site (managed by a PLC Programmable Industrial), it was necessary to resort to a shielding about one tonne of lead, which required an expensive overdimensioning of the bridge structure. This shield has been calculated to allow the order to support 1 MRad. The order has, moreover, had to be replaced every year, imposing a capital the costly installation that the operator has given up this solution and installed a remote command in non-irradiated area, with wire to wire connection.

This shielding solution, which seems too heavy for heavy equipment, would be infinitely more for a mobile machine whose weight is always critical, especially if it is planned to make him climb a slatted staircase to intervene in a nuclear power plant at the same time. following a possible technical incident. In addition to its direct effect, the weight of a shield is also an unavoidable problem when considering the potential energy involved during a shock, a fall or the descent of a step. For example, a one-ton shield, which has been known to be insufficient, if the mobile machine suddenly descends a step of 10 cm, and the corresponding energy mgh is absorbed by an elastic stiffness device k , crashing by one cm, we can write: mgh = ½ Fx, where F = kx, with x = 10 ^-2 m and h = 10 ^-1 m, then: F = 2.10 ⁸ N, which corresponds to an acceleration of 2.10 ⁵ g.

It is clear that the suspension of a such mass (control system + shielding) placed on a mobile machine becomes an insoluble problem in convenient.

• Solution B, concerning the remote location of electronics:

By definition, it is contrary to the problem posed to operate a system of control under irradiation.

• Solution C, using commercially available radiation tolerant equipment:

By definition, it is contrary to the problem posed to operate under irradiation a real control system, in the defined sense above, while commercially available are far too rudimentary for to answer the problem.

• Solution D, aimed at designing a hardened control system:

Hardening is essentially about replace the MOS circuits with their equivalents, when they exist, in hardened technology (SOS, SOI, DMILL, etc ...). However the three technologies SOS, SOI and DMILL remain poorly distributed commercially, hence a supply of poor components, both in terms of product diversity in terms of performance. AT example for microcontrollers, products hardened currently available have features and performance corresponding to a technological delay of the order of 20 years compared to the components uncured: they do not have access memory random, and their features and instruction sets are hardly compatible with a system of command as defined above. Their dress the irradiation is about 300 kRad, ie one improvement by a factor of about 10 compared to a standard component, a bit more compared to a model particularly vulnerable. Only technology stands out DMILL that achieves 10 MRad. However, it does not allow the realization of memory rewritable. In addition, the commercial offer is extremely limited and requires, for its the development of ASICs, which imposes incompatible constraints in practice with the realization of a mobile robot control.

The hardening of the electronics is more in addition difficult to achieve as the dose irradiation to bear growing. In addition, as the shows the document [5], passed a threshold of about 1 kRad (low limit of conventional electronics under irradiation), the cost of hardening increases with dose rate in proportions that do not allow to consider reaching or exceeding 1 MRad.

To conclude, the current control systems therefore only offer rudimentary functions, performed at low speed, without possibility significantly improve neither their performance nor their reliability. The rate of acquisition of sensor information is so weak that it forbids any possibility of return of effort, which would be essential for the execution of certain tasks in teleoperation.

The level of autonomy conferred by such orders is very low: we can speak in practice teleoperated systems. But many applications can not be satisfied with teleoperation. For example, a radio-controlled machine must be able, in case of transmission problem, make a decision autonomous (eg return to the previous position loss of communication). Another well-known example consists in introducing, via an airlock, a mobile robot into a nuclear power plant after an accident that resulted in the leakage of nuclear material inside the building. We know how to introduce the robot, but respect of sealing forbids him to transmit the cable controls. The robot must then must move autonomously towards one of these points, which is currently impossible to achieve.

This state of the art can be summed up in the recent project to build a mobile robot "Pioneer" for intervention on the Chernobyl site. The notebook charges required to support a cumulative dose of 1 MRad. No industry, no research laboratory could not offer an embedded control system responding to the need. In the device currently at the study, all the instructions will be brought back to wire to a remote control station.

The present invention relates to a system electronic operating under irradiation, in particular X or gamma, a method of designing such a system and its preferential application to a control system mobile robot operating under this irradiation.

Presentation of the invention

I. énumérer l'ensemble des fonctions que doit réaliser le système.

II. déterminer les composants électroniques aptes à réaliser physiquement ces fonctions, en accordant la préférence aux modèles ayant le plus fort taux d'intégration.

III. déterminer le volume de composants qu'il est possible de protéger par des moyens de protection dénommés blindage, en tenant compte de la dose d'irradiation que doit supporter le système, du poids maximal admissible, du matériau choisi pour ce blindage, ainsi que de la distance à laquelle les composants sélectivement protégés par ce blindage pourront être des autres composants non blindés.

IV. établir une liste des composants les plus vulnérables en tenant compte d'abord de leur technologie, puis de leur degré d'intégration, en associant à chacun de ces composants les composants qui doivent être implantés à leur proximité immédiate, s'il en existe, et en plaçant en premier le composant le plus vulnérable, puis en second celui dont la vulnérabilité est un peu moins élevée, et ainsi de suite, éventuellement en plaçant plusieurs circuits de vulnérabilités identiques.

V. sélectionner à partir de la liste de l'étape précédente, un ensemble de composants, en commençant par les composants les plus vulnérables, en limitant cet ensemble aux composants qui peuvent, de par leurs dimensions, être implantés dans le volume défini lors de l'étape III.

VI. éxaminer si les composants de cet ensemble peuvent réaliser des fonctions cohérentes, et ne communiquer avec le reste du système que par un nombre raisonnable de fils, qui transmettent des signaux aptes à parcourir sans être altérés la distance prévue à l'étape III entre les composants sélectivement protégés et les autres composants ; si toutes ces conditions ne sont pas simultanément remplies, modifier par itération la liste des composants pour obtenir ce résultat, sans excéder le volume défini à l'étape III ; si toutes ces conditions sont simultanément remplies, aller à l'étape suivante, l'ensemble de composants ainsi obtenu étant dénommé "premier ensemble de premiers composants", et les autres composants étant dénommés "second ensemble de seconds composants".

VII. concevoir l'implantation physique du premier ensemble de premiers composants, concevoir le blindage, constitué d'au moins un matériau absorbant pour les rayonnements, disposé autour de ce premier ensemble de composants, et concevoir, entre le premier ensemble de composants et le second, des moyens de connexion agencés pour ne pas former de chemin de pénétration pour les rayonnements ambiants.

VIII. concevoir l'implantation physique du second ensemble de composants, évaluer la dose de rayonnements qu'ils auront effectivement à supporter, et si nécessaire, utiliser une technique complémentaire pour améliorer leur aptitude au fonctionnement sous irradiation par une technique autre que le blindage.

IX. évaluer si la solution au problème posé est obtenue ou non : si elle n'est pas obtenue, modifier les paramètres de l'étape III (poids et nature du matériau du blindage, dose maximale d'irradiation acceptable, distance entre le premier ensemble de composants et le second), et réitérer le processus à partir de cette étape III ; si oui considérer que la partie de conception pure est achevée, et éventuellement lancer la partie expérimentale de l'étape X.

X. valider la conception en réalisant un prototype conforme aux étapes de conception ci-dessus, au moins en ce qui concerne le premier ensemble de composants, mis en place dans ses moyens de protection (blindage), et effectuer des essais d'irradiation ; si ces essais ne sont pas conformes aux spécifications, modifier les paramètres de l'étape III (poids et nature du matériau du blindage, ou éventuellement dose maximale d'irradiation acceptable), et réitérer le processus à partir de cette étape III, cette étape X étant facultative.

The present invention relates to a method for designing electronic systems capable of operating under irradiation, which comprises the following steps:

I. list all the functions that the system must perform.

II. determine the electronic components capable of physically performing these functions, giving preference to the models having the highest integration rate.

III. determine the volume of components that can be protected by shielding means, taking into account the irradiation dose to be borne by the system, the maximum permissible weight, the material chosen for the shielding, and the distance at which the components selectively protected by this shielding may be other unshielded components.

IV. establish a list of the most vulnerable components, taking into account first of all their technology, then their degree of integration, by associating with each of these components the components that must be implanted in their immediate vicinity, if they exist, and by first placing the most vulnerable component, then second the vulnerability of which is a little lower, and so on, possibly by placing several identical vulnerability circuits.

V. select from the list of the previous step, a set of components, starting with the most vulnerable components, limiting this set to the components that can, by their dimensions, be implanted in the volume defined during step III.

VI. examine whether the components of this set can perform coherent functions, and communicate with the rest of the system only by a reasonable number of wires, which transmit signals able to travel without being altered the distance provided in step III between the components selectively protected and other components; if all these conditions are not simultaneously fulfilled, iteratively modifies the list of components to obtain this result, without exceeding the volume defined in step III; if all these conditions are simultaneously fulfilled, go to the next step, the set of components thus obtained being referred to as "first set of first components", and the other components being referred to as "second set of second components".

VII. designing the physical layout of the first set of first components, designing the shielding, consisting of at least one absorbent material for the radiation, arranged around this first set of components, and designing, between the first set of components and the second, connecting means arranged to not form a penetration path for ambient radiation.

VIII. conceive the physical implantation of the second set of components, evaluate the dose of radiation that they will actually have to bear, and if necessary, use a complementary technique to improve their ability to operate under irradiation by a technique other than shielding.

IX. evaluate whether the solution to the problem posed is obtained or not: if it is not obtained, modify the parameters of step III (weight and nature of the shielding material, acceptable maximum irradiation dose, distance between the first set of components and the second), and repeat the process from this step III; if yes consider that the pure design part is completed, and possibly start the experimental part of step X.

X. validate the design by producing a prototype in accordance with the design steps above, at least as regards the first set of components, installed in its shielding means, and perform irradiation tests; if these tests do not conform to the specifications, modify the parameters of step III (weight and nature of the shielding material, or possibly the maximum acceptable irradiation dose), and repeat the process from this step III, this step X being optional.

We do not leave the invention realizing some steps implicitly and more or less simultaneous, but in fact fulfilling the same function. This is particularly the case for steps IV, V, VI experienced person can perform "to judge" without necessarily cut his work into stages elementary, as it has been done here for the sake of clarity. Similarly, it is not beyond the scope of the invention if you do not do step X.

Step II, which leads to choose preferably functions that are functionally very rich, consequence of limiting the features to be ensured by the other components of the system. This facilitates use of techniques other than shielding for ensure their protection.

Step III involves the parameters that dimension the protection. The armor itself is carried out according to the state of the art, in particular with relates to the material that needs to be adapted to the nature radiation considered.

Step IV mentions a list of components the most vulnerable by first taking into account their technology, then their degree of integration. A experienced person or with the help of information from constructor, can establish a first hierarchy in the ability of the components to tolerate a certain dose irradiation. However, if one wants to be rigorous and take into account differences in the behavior of circuits according to the energy of the radiation, their intensity and their distribution over time, it is particularly advantageous to carry out tests.

Step V defines components for be selectively protected, which are components performing and rich of functions for which he is impossible to find, in the industrial ranges usual radiation-resistant equivalents. The typical example is a microcontroller in technology CMOS with very high integration (VLSI), including on a single "chip" semiconductor: CPU, memories, inputs / outputs, watchdog, etc. retains from the list in the previous paragraph that the components, starting with the most vulnerable, who can be implemented in the volume defined in paragraph III. The components that must be physically very close to these components, as example the clock quartz of a microcontroller or decoupling capacitor (s), are associated with them and are a priori retained in the same way. Nevertheless we does not depart from the scope of the invention by giving up protect these ancillary components.

• combiner ces composants par voie d'implantation ou d'« hybridation » (montage compact de puces électroniques) pour les protéger par un unique blindage,
• affecter à la protection contre le rayonnement plusieurs blindages renfermant des composants sélectivement protégés.

If it is imperative to protect more components than the shield can contain, there are two other possibilities that can be implemented while remaining in accordance with the invention:

• combine these components by implantation or "hybridization" (compact assembly of electronic chips) to protect them by a single shielding,
• assign to the radiation shield several shields containing selectively protected components.

There may be difficulties in evacuating the heat generated by the operation of these components. In this case, we do not leave the invention by incorporating between these components and the shielding a electrically insulating but thermally conductor, in order to evacuate the heat through the shielding.

Step VI constitutes a validation of components selected in the previous step, considering the constraints related to the functioning of electronics: in particular, the number and the band passing signals to circulate between components intended to be selectively protected by shielding and those intended not to be. However, we strive for these second components to improve their tolerance to radiation by any other as shielding (see step VIII).

Stage VII involves the realization of the means protection or shielding. A realization preferential shielding consists of two half-shells secured by screws, arranged so as to minimize their impact on the protection of components. Connections with the second set of components can advantageously be carried out by a flexible circuit board, which follows a chicane which is provided the shield at its entry / exit, to avoid the radiation penetration.

• mécaniquement par une suspension amortissante,
• électriquement par des connexions suffisamment souples pour prendre en compte les déplacements dus à cette suspension mécanique.

In an advantageous embodiment this shielding is connected to the rest of the system:

• mechanically by a damping suspension,
• electrically by sufficiently flexible connections to take into account the displacements due to this mechanical suspension.

Step VIII mentions techniques of other than shielding, for example methods of managing the operation of these components by redundancy and / or optimization of tensions as described in documents [1] and [2], allowing to significantly lengthen their lifetime. Another example is the use of chronograms of sequence of actions (in particularly at the logic level) whose temporal ranges are wide enough to make their operation tolerant towards temporal drifts that may result from irradiation.

Brief description of the drawings

• Figure 1 is a flowchart depicting the various steps of the process of the invention,
• Figure 2 schematically represents the electronic system of the invention,
• Figure 3 is a block diagram of the interface shown in Figure 2, which in the described embodiment has several cards mounted in a bay,
• Figures 4A and 4B show a implementation of all the first components,
• Figures 5A and 5B show two views in section of the armor, showing in profile all first components illustrated in FIGS. 4A and 4B,
• Figure 6 schematizes functionally the information exchange between components selectively shielded in the shield 22 and the rest of the system, via interface cards 33 and 37,
• FIGS. 7A and 7B illustrate a mode of mechanical realization of the invention; Figure 7A showing the general arrangement and Figure 7B showing a shock absorber mechanical mounting and / or vibrations for the armored part,
• Figure 8 shows the control system according to the invention in the overall context of its use.

Detailed presentation of a particular embodiment

In the rest of the description, we consider As an example, a privileged application of the invention constituted by a control system command for mobile robot able to operate in a irradiated medium, and having to support 1 MRad.

The application of the process of the invention, described below, is made in accordance with the flowchart in Figure 1, tracing the various steps of the design process. If this process succeeds after a first iteration to a result incompatible with the initial parameters, a second iteration is then undertaken after modification of these parameters.

First iteration Step I - Control System Functions

• acquisition de mesures capteur et traitement analogique ou numérique, par exemple :
  • six mesures analogiques de courant moteur,
  • deux mesures analogiques de température,
  • une mesure analogique de courant batterie,
  • une mesure analogique de mesure de référence de tension,
  • dix entrées TOR de conformité commande relais (TOR :Tout Ou Rien),
  • cinq entrées TOR divers ;
• envois de commandes, par exemple :
  • six commandes analogiques de moteur,
  • dix sorties TOR de commande de relais,
  • cinq sorties TOR annexes ;
• communication via un lien série « full duplex » avec le poste de commande :
  • interprétation des messages reçus,
  • émission de messages,
  • contrôle de la conformité des messages ;
• contrôle du fonctionnement du robot :
  • contrôle des actions du robot,
  • interprétation de la mesure des capteurs de sécurité,
  • gestion de modes de sécurité (thermique,
  sur courant moteur, dérives de mesure) ;
• gestion de mode dégradé ou de mode autonome (perte de communication, actions autonome...).

The list of functions to be performed for the proposed order includes the following five families:

• acquisition of sensor and analog or digital processing measurements, for example:
  • six analog motor current measurements,
  • two analog temperature measurements,
  • an analog battery current measurement,
  • an analog measurement of voltage reference measurement,
  • ten relay command compliant digital inputs (Discrete: All or Nothing),
  • five different digital inputs;
• shipments of orders, for example:
  • six analog motor controls,
  • ten relay control digital outputs,
  • five separate digital outputs;
• communication via a "full duplex" serial link with the control station:
  • interpretation of messages received,
  • sending messages,
  • checking the conformity of messages;
• control of the operation of the robot:
  • control of the actions of the robot,
  • interpretation of the measurement of the safety sensors,
  • management of security modes (thermal,
  motor current, measuring drifts);
• management of degraded mode or autonomous mode (loss of communication, autonomous actions ...).

Step II - Electronic Components of the System

• amplificateurs de ligne ("driver" en anglais), décodage d'adresse, logique trois états,
• convertisseur analogique/numérique, filtres analogiques, amplificateurs analogiques,
• convertisseurs numérique/analogique,
• composants logiques TOR, relais.

The functional analysis of the robot controller leads to search for components comprising:

• line amplifiers ("driver"), address decoding, three-state logic,
• analog / digital converter, analog filters, analog amplifiers,
• digital-to-analog converters,
• discrete logic components, relays.

• un contrôleur 40 (comportant le processeur, une mémoire de code, une mémoire RAM ("Random Access memory"), un circuit UART ("Universal Asynchronous Receiver Transmitter"), un gestionnaire de bus, un chien de garde, et des performances élevées en rapidité de calcul),
• un convertisseur analogique/numérique 43 (incluant référence de tension, échantillonneur/bloqueur, logique fonctionnant en mode trois états, signaux de contrôle, performances élevées en termes de résolution et de temps d'acquisition),
• des amplificateurs opérationnels (filtrage et amplification),
• des convertisseurs numérique/ analogiques incluant une référence de tension,
• des composants logiques TTL (amplificateurs de ligne, décodage d'adresse, logique trois états, composants logiques TOR) de type ALS,
• des composants passifs,
• des relais électromécaniques.

The choice of the actual electronic components is oriented towards the components with the highest possible integration rate, namely:

• a controller 40 (comprising the processor, a code memory, a RAM ("Random Access memory"), a UART ("Universal Asynchronous Receiver Transmitter") circuit, a bus manager, a watchdog, and high performance in speed of calculation),
• an analog / digital converter 43 (including voltage reference, sampler / blocker, logic operating in tri-state mode, control signals, high performance in terms of resolution and acquisition time),
• operational amplifiers (filtering and amplification),
• digital-to-analog converters including a voltage reference,
• TTL logic components (line amplifiers, address decoding, three-state logic, discrete logic components) of the ALS type,
• passive components,
• electromechanical relays.

The microcontroller and the converter analog / digital are in low CMOS technology consumption and low noise but their technology the makes it very fragile to radiation. These two components have no insensitive or insensitive equivalent to radiation.

For the other components, we retain in the possible components of technology bipolar or JFET capable of withstanding irradiation gamma.

• le niveau de dose tolérable reste inférieur à 300 kRad pour la plupart des composants durcis (donnée imposée par les besoins du marché spatial, sans intérêt pour le nucléaire), ce qui revient à dire que le problème posé ne pourrait être résolu ;
• même avec une durée de vie n'excédant pas le tiers de la durée de vie spécifiée, les performances générales du système seraient inférieures de plusieurs ordres de grandeur, c'est-à-dire de dix fois à plus de cent fois selon le paramètre considéré : puissance de calcul du processeur, taille de la mémoire, débit des liaisons séries, temps de cycle processeur, vitesse du bus.

The approach proposed in the process of the invention runs counter to that of those skilled in the art who would use unsophisticated components preferably hardened. In the invention, it is accepted to perform functions (related to the processor and its peripherals) that exist only in MOS technology, very sensitive to radiation. Those skilled in the art would best use hardened technology components (SOI, SOS) to perform these functions. However, there is no hardened industrial microcontroller having an integration level equivalent to those of conventional CMOS technologies, and which could provide all of these functions. The consequences would then be of several kinds:

• the tolerable dose level remains below 300 kRad for most hardened components (data dictated by the needs of the space market, with no interest for nuclear power), which means that the problem posed can not be solved;
• even with a service life not exceeding one-third of the specified life, the overall system performance would be several orders of magnitude less, ie, ten times to more than a hundred times depending on the parameter. considered: computing power of the processor, size of the memory, flow of the serial links, processor cycle time, bus speed.

Step III - Determining the available volume

• le poids maximal admissible pour le blindage : par exemple 10 kg ;
• le matériau : par exemple pour le rayonnement gamma considéré, on choisit le Dénal, alliage de tungstène ; lors de l'étape III le plomb et le Dénal sont envisagés pour apprécier l'intérêt du Dénal par rapport au plomb, mais on ne fera pas d'itération avec le plomb pour ne pas alourdir inutilement l'exposé ;
• la dose d'irradiation tolérable : par exemple 1 MRad ;
• la distance entre les deux ensembles de composants : par exemple moins de 2 dm.

For the determination of the useful volume, the parameters are:

• the maximum permissible weight for the shielding: for example 10 kg;
• the material: for example for the gamma radiation considered, the Denal, tungsten alloy is chosen; during step III lead and Denal are considered to appreciate the interest of the Dénal compared to lead, but it will not be iterated with lead so as not to unnecessarily burden the presentation;
• the tolerable irradiation dose: for example 1 MRad;
• the distance between the two sets of components: for example less than 2 dm.

For example, the possibility of protecting a volume limited to: (1 = 20 mm) × (L = 20 mm) × (h = 10 mm).

Step IV - Classification of components by vulnerability

• convertisseur analogique numérique : 20 kRad,
• microcontrôleur : environ 50 kRad,
• convertisseur numérique/analogique : >1 MRad,
• amplificateur opérationnel : >1MRad,
• composants logiques TTL : >1MRad en respectant des règles de mise en oeuvre (voir étape VIII),
• composants passifs : environ 100 MRad,
• relais : > 1MRad.

Theoretical knowledge, enriched by experience, led to the following list:

• analog digital converter: 20 kRad,
• microcontroller: about 50 kRad,
• digital-to-analog converter:> 1 MRad,
• operational amplifier:> 1MRad,
• TTL logical components:> 1MRad respecting implementation rules (see step VIII),
• passive components: about 100 MRad,
• relay:> 1MRad.

Step V - Components to be protected

The microcontroller and converters analog / digital must be protected. At these components should be added as additional elements to be located nearby, a clock quartz and decoupling capacitors.

Step VI - "First components" compatible with the volume

The volume available for protection is not enough to house the microcontroller and the analog / digital converters even using hybridization techniques.

The process starts again at stage II.

Second iteration Step II - Electronic Components of the System

We limit the number of converters analog / digital to a single component and we introduce an analog multiplexer, and a logic of selection which makes it possible to increase the number of acquisition channels analog. This choice is at the expense of time total acquisition of the measures but can be offset by a software mechanism of acquisition in masked time.

• un microcontrôleur de la Société Siemens,
• un convertisseur numérique/analogique,
• un multiplexeur analogique de la Société Analog Devices,
• des amplificateurs opérationnels (filtrage et amplification),
• six convertisseurs numérique/ analogiques,
• des composants logiques en technologie TTL (amplificateurs de ligne, décodage d'adresse, logique trois états, composants logiques TOR, logique de sélection),
• composants passifs,
• relais électromécaniques.

The new list of electronic components is as follows:

• a microcontroller from Siemens,
• a digital to analog converter,
• an analog multiplexer from Analog Devices,
• operational amplifiers (filtering and amplification),
• six digital to analog converters,
• logical components in TTL technology (line amplifiers, address decoding, three-state logic, discrete logic components, selection logic),
• passive components,
• electromechanical relays.

Step III - Determining the available volume

The result is identical to that of the previous iteration, ie: (1 = 20 mm) × (L = 20 mm) × (h = 10 mm).

Step IV - Classification of components by vulnerability

• microcontroller: about 50 kRad,
• analog digital converter: 20 kRad,
• analog multiplexer> 1 MRad,
• digital-to-analog converter:> 1 MRad,
• operational amplifier:> 1 MRad,
• TTL logical components:> 1 MRad in respecting the rules of implementation,
• passive components: about 100 MRad,
• relay:> 1 MRad.

Step V - Components to be protected

A microcontroller and a converter analog / digital, both encapsulated according to CMS technology, that is, components for surface mount. We associate them as elements a quartz and decoupling capacitors. The multiplexer is not included among the components protected.

Step VI - "First components" compatible with the volume

The microcontroller and the converter analog are each implanted on a circuit board multilayers. Each of these printed circuits is connected to unshielded components by a circuit board flexible, the other end of which is a card interface of an electronic bay.

• les alimentations,
• un bus multiplexé propre au microcontrôleur (0-5V, 20 MHz),
• les signaux de commandes et de données propres au convertisseur (0-5V, 20 MHz),
• le signal d'entrée analogique du convertisseur (+/-10V,300Hz max).

The signals flowing in these flexible printed circuits are:

• the power supplies,
• a multiplexed bus specific to the microcontroller (0-5V, 20 MHz),
• converter-specific command and data signals (0-5V, 20 MHz),
• the analog input signal of the converter (+/- 10V, 300Hz max).

Bandwidth and measurement sensitivity allow an offset of some decimetres first components with respect to the second components

The shield consists of two half-shells of Denal, weighing together 10kg, and whose shape exterior approaches a flattened sphere. Size shielding is calculated by making the ratio between the dose to be achieved (1 MRad) and withstand under irradiation the most vulnerable component. The report for the control system is a 50 factor of protection. We knows that 35 mm of lead brings a factor of 10 attenuation for cobalt 60 irradiation. gets the same result with 24 mm Denial. We retains a nearly spherical 10 kg armor having 60 mm lead radius, or 42 mm radius in Denial. This last value makes it possible to guarantee the first components to irradiation, with good safety margin.

Step VII - Realization of the protected ensemble

The first set of first components is implanted on two multilayer printed circuits, but it is not beyond the scope of the invention using a only printed circuit board. These two printed circuits communicate each with an interface card, belonging to the second set of components.

Step VIII - Realization of the electronics of the unprotected whole

• des chronogrammes d'enchaínement des actions (au niveau de la logique TTL) tolérants vis-à-vis de dérives temporelles,
• un fonctionnement dynamique de la logique TTL trois états géré par le microcontrôleur pour minimiser le courant de fuite en phase bloquée,
• une compensation logicielle de la dérive sous irradiation de la mesure du convertisseur analogique/numérique par mesure de tensions de référence connues.

This step uses other techniques to guarantee the resistance under irradiation of unprotected electronics, among which:

• timing sequences of actions (at the level of TTL logic) tolerant vis-à-vis temporal drifts,
• a dynamic operation of the three-state TTL logic managed by the microcontroller to minimize the phase-locked leakage current,
• a software compensation of the drift under irradiation of the measurement of the analog / digital converter by measurement of known reference voltages.

Step IX - System Compliance

The calculations in step VI and the experience with the implementation of techniques complementary measures mentioned in step VIII to check that the system is likely to meet the specifications.

Step X - Validation test

Validation tests under irradiation are first done on the first set of first components, with its shield. Then a test under irradiation of the complete system makes it possible to check the compliance of the entire system.

At the end of the various stages of the process of the invention illustrated on the flow diagram of the figure 1, we obtain for example the electronic system described below. It is assumed in the following that this is a mobile robot control system that is described as a preferred embodiment.

• d'un système d'interfaces 20 (comportant plusieurs cartes), équipé de composants résistants ou durcis ou tolérants,
• d'un module 21 comportant des composants industriels standards, protégé par un blindage 22, et relié au système d'interfaces 20 par un circuit imprimé souple 23, 25,
• d'une ligne 15 de transmission série de données,
• de connexions avec le robot 11 (commandes de moteurs, retour d'informations capteurs),
• d'une ligne 16 d'alimentation en énergie.

FIG. 2 illustrates the general architecture of an electronic system 10, which consists of:

• an interface system 20 (with several cards), equipped with resistant or hardened or tolerant components,
• a module 21 comprising standard industrial components, protected by a shield 22, and connected to the interface system 20 by a flexible printed circuit 23, 25,
• a serial data transmission line 15,
• connections with the robot 11 (motor commands, feedback of sensors),
• a power supply line 16.

Figure 3 schematizes the system 20, showing on the one hand the various electronic cards interfaces respectively with full or nothing 31, all-or-nothing outputs 32, inputs 33 analog (connected to the flexible printed circuit 25), of analog outputs 34, of the interface 35 (connected to serial data transmission line), and the bus processor management interface card 37 (connected to the flexible printed circuit 23), as well as arrows 38 in double line representing traffic information between these various cards. She shows also the power supply card 36 which provides the voltages required for the interfaces 31, 32, 33, 34, 35 and 37, as well as to module 21 via the circuits flexible prints 23 and 25.

FIG. 4A represents a microcontroller 40, a quartz 41 and a decoupling capacitor 42, mounted on a printed circuit 24 and connected by a flexible printed circuit 23 to the interface card 33, illustrated in Figure 3. The clock quartz 41 and the power decoupling capacitor 42 must be connected as close as possible to the microcontroller 40.

Figure 4B shows a converter analog / digital 43, a decoupling capacitor 44 and an external voltage reference 45, mounted on a printed circuit 26 and connected by a printed circuit flexible 25 to the interface card 37, illustrated on the Figure 3. The voltage reference circuit 45 and the supply decoupling capacitor 44 must be connected as close as possible to the analog / digital converter 43.

Figures 5A and 5B show an example of implementation of the shielding. 22. This consists of two half-shells 50 and 51, which provide the protection components 40, 41, 42, 43, 44, 45. These two half-shells constitute an armor, that one strives here to make isotropic for the attenuation of gamma rays. The passage of flexible printed circuits 23 and 25, in shield input / output, has a baffle 52 preventing radiation from reaching directly said components. Figure 5B shows schematically a top view of the two half-shells 50 and 51, held together by the screws 53, 54.

Figure 6 schematizes functionally the information exchange between components selectively shielded in the shield 22 and the rest of the system via interface cards 33 and 37.

• les alimentations 63,
• le bus d'adresses et de données 64 propre au microcontrôleur 40,
• les signaux de commande et de données 65 propres au convertisseur 43,
• le signal d'entrée analogique 66 du convertisseur 43.

The microcontroller 40 and the analog-to-digital converter 43 are mounted on specific printed circuits 24 and 26. They are connected to interfaces belonging to the second set of components by the flexible printed circuits 23 and 25 which convey:

• the power supplies 63,
• the address and data bus 64 specific to the microcontroller 40,
• the control signals and data 65 specific to the converter 43,
• the analog input signal 66 of the converter 43.

A logic implanted on the interface card 37, relays the data signals, address and order according to a conventional scheme for a man of art through a classic 38 processor bus (background of basket).

On this bus 38 is connected a logic 70 of address decoding and data exchange. This logic 70 controls the selection logic of a input among N of an analog multiplexer 72 of the type N: 1, connected to the N analog inputs via preamplifiers / conditioners 73, all made in technologies known as resistant. Via the bus processor 38 and the control logic 70, the microcontroller program 40 command successively the conversion of analog input signals, by successive selection of these by means of multiplexer 72, then retrieves the result of this analog / digital conversion via the same logic of command 70 and the processor bus 38.

FIGS. 7A and 7B show a mode of mechanical embodiment of the invention. On a frame 90, made by a metal plate, is attached a frame 91, which constitutes the physical support of the system 20, with a motherboard 92 whose circuit printed vehicle signals the bus 38 as well as the analog lines attacking the 73 conditioners, and supply lines from map 36. On the motherboard 92 are connected interface cards 37 of the processor bus, the card 33 which comprises the analog multiplexing assembly 70 to 73, and the other cards 31, 32, 34, 35 36 not detailed on this figure. 95 cards are command cards non-detailed engines.

The shield 22 consists of a kind of recessed sphere 100 in Denial, composed of two half-shells 50 and 51, from which the printed circuits emerge 23 and 25 connected to cards 33 and 37. This sphere 100 is held by two tori 98 in elastomer, made integral with a recessed plate 96 and four balusters 97. The chosen elastomer is polyurethane.

The sphere 100 is thus placed on a first torus 98 made of elastomer, whose inner radius is chosen so that it does not come in contact with the support plane where this first torus rests 98, even at its maximum crash. A second torus 98 identical is placed above the sphere 100. These two tori ensure the suspension mainly according to the vertical axis. To ensure also the suspension according to the other two orthogonal directions, two more Toroid sets can be added along these axes.

This damping system ensures the maintenance of the whole on the frame 90, while ensuring the damping of the movements of the sphere 100 in case shock (for example in the event of a fall) or vibrations in the direction perpendicular to the plane of the frame 90.

This realization thus makes it possible to avoid that within predetermined accelerating limits, the mass of the sphere does not transmit to the frame 90 and chassis efforts putting integrity at risk mechanics of the whole.

• une unité 10 localisée au voisinage immédiat du robot 11, et soumise au flux de radiations (milieu irradié 12),
• un ordinateur 13 au contact de l'opérateur 14, localisé en milieu non hostile.

FIG. 8 locates the control system according to the invention in the overall context of its use for controlling a mobile robot or a teleoperation device. The diagram represents a complete control system, divided into two sets:

• a unit 10 located in the immediate vicinity of the robot 11, and subjected to the flow of radiation (irradiated medium 12),
• a computer 13 in contact with the operator 14, located in a non-hostile environment.

This unit 10 and this computer 13 are interconnected by a fast link 15 of data transmission.

• la scrutation des différents capteurs du robot (positions, vitesses, retour d'efforts),
• l'envoi des données des capteurs à l'ordinateur 13,
• la réception des consignes calculées par l'ordinateur 13,
• la transmission pour exécution de ces consignes aux modules d'électronique de puissance reliés aux actionneurs du robot (moteurs).

The unit 10 makes it possible to ensure cyclically:

• the scanning of the various sensors of the robot (positions, speeds, force feedback),
• sending the data of the sensors to the computer 13,
• the reception of the instructions calculated by the computer 13,
• the transmission for executing these instructions to the power electronics modules connected to the actuators of the robot (motors).

In addition, unit 10 is expected to reflexes such as emergency stop in case anomalies such as an excess of current consumed by a engine, or degraded operating modes, or autonomous. The realization of such features, known to those skilled in the art, is not part of the invention.

More generally, the invention is applicable to any electronic system before operate under irradiation. We can mention, as systems other than controls, sensors intelligent or teletransmission systems.

REFERENCES

[1] FR-A-2 765 342 (CEA)

[2] FR-A-2,764,713 (CEA)

[3] Article from the "Los Angeles Times" entitled "The Cutting Edge "(March 13, 1998)

[4] "A Designer 's / User' s Guide For The Nuclear Power Industry »(Radiation Effects On Elecronic Equipment, Atomic Energy Authority (UK), AEA-D & W-0691, document 200 page 8, document 800 pages 9 to 14)

[5] "The Effects Of Radiation On Electronic Systems" of George C. Messenger and Miklton S. Ash (Second edition, figure 15-13, page 881)

Claims (11)

1. Process for designing an electronic system able to operate under irradiation, characterized in that it comprises the following stages:

   I. Enumerating all the functions to be implemented by the system;

   II. determining the electronic components able to physically implement these functions whilst giving preference to models having the larger scale integration;

   III. determining the volume of components which can be protected by protection means referred to as shielding, whilst taking account of the radiation dose to be withstood by the system, the maximum permitted weight of the material chosen for said shielding, as well as the distance at which components selectively protected by said shielding could be from other, unshielded components;

   IV. establishing a list of the most vulnerable components, whilst firstly taking account of their technology, then their degree of integration, whilst associating with each of these components the components which have to be installed in their immediate vicinity, if existing, and whilst firstly positioning the most vulnerable component, then that whose vulnerability is slightly less high and so on, optionally placing several identical vulnerability circuits;

   V. selecting on the basis of the list of the preceding stage, a group of components, commencing with the most vulnerable components and limiting said group to components which, by their very dimensions, can be installed in the volume defined in stage III;

   VI. examining whether the components in said system can implement coherent functions and only communicate with the remainder of the system by a reasonable number of wires, which transmit signals able to pass through without deterioration the distance stipulated in stage III between the selectively protected components and the other components; if all these conditions are not simultaneously fulfilled, codifying by iteration the list of components in order to obtain this result, but without exceeding the volume defined in stage III; if all these conditions are simultaneously fulfilled pass to the following stage, the group of components obtained in this way being called the "first group of first components" and the other components being called the "second group of second components";

   VII. designing the physical installation of the first group of first components, designing the shielding, constituted by at least one radiation-absorbing material, positioned around said first group of components, and designing between the first group of components and the second, connection means arranged so as not to form a penetration path for ambient radiation;

   VIII.designing the physical installation of the second group of components, evaluating the radiation dose which they have to withstand and, if necessary, using a complimentary procedure for improving their suitability for operating under irradiation by a technique other than shielding;

   IX. evaluating whether the solution to the set problem is in fact obtained; if it is not obtained, modifying the parameters of stage III and repeating the process as from stage III.
2. Process according to claim 1, comprising a subsequent stage:

   X. validating the design by producing a prototype in accordance with the preceding design stages, at least with regards to the first group of components, installed and fitted in its protection means, and performing irradiation tests; if said tests are not in accordance with the specifications, the parameters of stage III are modified and the procedure is repeated as from stage III.
3. Electronic system able to operate under irradiation, characterized in that it comprises:

   a first group of components incorporating components which are intrinsically very vulnerable to such radiation, and possibly a few associated elements which must be physically installed in their immediate vicinity, called the first group (21) of first components, protected against said radiation by protection means (22) known as shielding,

   a second group (20) of second components, which are less vulnerable than the first and not protected by shielding,

   connection means (23, 25) between said two assemblies arranged so as not to form a penetration path for ambient radiation.
4. System according to claim 3, wherein the shield (22) is constituted by two half-shells (50, 51) protecting said components (40, 41, 42, 43, 44, 45).
5. System according to claim 3, wherein the first group (21) of first components also incorporates at least one microcontroller (40) located within a shield (22).
6. System according to claim 3, wherein the first components located within a shield (22) are connected to an interface card (20) by a flexible printed circuit (23) along a baffle (52) provided at the input/output of the shield.
7. System according to claim 3, wherein the first group (21) of first components comprises a microcontroller (40) and an analog/digital converter (43) located within a shield (22) and connected to interfaces, across a baffle in the shield, via flexible integrated circuits carrying:

   supplies (63),

   a multiplexed bus (64) belonging to the microcontroller (40),

   control and data signals (65) belonging to the converter (43),

   the analog input signal (66) of the converter (43).
8. System according to claim 3, wherein the first group (21) of first components is mechanically connected to the remainder of the system by a mechanical suspension (96, 97, 98).
9. System according to claim 8, wherein said mechanical suspension is ensured by elastomer cores (98).
10. System according to any one of the claims 3 to 9, wherein between the first group of first components and the shield is incorporated an electrically insulating, but thermally conductive product, in order to remove via the shield the heat generated by the operation of the electronic components.
11. Application of the process according to claim 1 to the electronic control of a mobile robot.

Images