[meekrohprocess]

Neat! If I'm reading the repository right, it looks like the avionics firmware ran on a TMS570 Cortex-R microcontroller made by TI:

https://processors.wiki.ti.com/index.php/Category:TMS570

I'm pleasantly surprised to see that instead of a big Cortex-A or x86/64 chip. It's cool to read well-funded code for a small realtime SoC.

you don't see them too often outside of things like memory controllers and safety-critical products, but Cortex-R chips can have some cool features like ECC memories and mirrored CPUs:

https://developer.arm.com/ip-products/processors/cortex-r/co...

Apparently the next generation Cortex-R82s will also have 64-bit options with an MMU, which should make it easy to run a "real" OS.

Too bad that the company didn't work out, but it was nice of them to publish this stuff.

[elromulous]

Not entirely true. The actual autopilot (the controller + estimator) runs on an imx6. The tms570 are the sensor / actuator nodes.

Edit: just to add some detail. The autopilot and aio (avionics io, i.e. the tmd570s) communicate over a ring ethernet topology.

[meekrohprocess]

Oh, that makes sense. It did seem like a lot for such a small processor to handle.

Still, that sounds even cooler; a reference for how to set up a local network of MCUs controlled by a big processor? Awesome.

[sjburt]

This topology is very common. Hard real-time sensor nodes feeding softer real-time big iron that does the estimation and control.

[sgtnoodle]

The TMS570 has a decent amount of computing power on it for a microcontroller. The CPU core itself seems pretty solid. Unfortunately, the peripheral set is incredibly painful to develop for because it's riddled with poorly thought out registers and silicon bugs.

For low volume stuff, the chance of a detectable miscalculation occuring in the field is low, while the chance of a firmware bug causing a failure is high. Using a TMS570 for a hobby project would be a very poor choice. With a sufficiently high volume project, though, the development pain can be worth it.

The redundant cross checked CPU cores gives you piece of mind that the thing will self-diagnose a miscalculation and report it, rather than go off into the weeds. It enables you to responsibly design safety critical fault tolerant systems based on explicit handoff from one MCU to another. Without the cross checking, you can't trust a single MCU to act rationally; in designs like that, you typically need more than two MCUs with majority voting circuitry. So the TMS570 can help reduce total system complexity at the cost of lower level firmware pain.