1. Melanie Berg MEI Technologies/NASA GSFC Melanie.D.Berg@NASA.gov
TMR Schemes
Melanie Berg
MEI Technologies/NASA GSFC

2. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
Overview
Premise: Why do various FPGAs require separate mitigation strategies?
Radiation Effects in FPGA devices
Mitigation and Actel Anti-fuse Devices
Mitigation and Xilinx Virtex Devices
Tools
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

3. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
Radiation Effects in FPGA devices
Single Event Transients (SETs)
Single Event Upsets (SEUs)
Single Event Functional Interrupts (SEFIs)
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

4. Single Event Effects (SEEs) and IC System Error
SEUs or SETs can occur in:
Combinatorial Logic
Sequential Logic
Configuration Memory Cells
Depending on the Device and the design, each fault type will:
Have a probability of occurrence
Either have a significant or insignificant contribution to system error
Every Device has different Error Responses – We must understand the differences and design appropriately
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

5. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
Combinatorial Logic Blocks and Potential Upsets… SETs in Anti-fuse FPGAs
Anti-fuse
FPGA
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

6. Basic Combinatorial Logic Blocks and Potential Upsets
SRAM-Based
FPGA
TRANSIENT
PSET
Your desing is no longer your design blah blah we will get into more detail later.
STUCK UNTIL OVERWRITTEN
Probability of Configuration Fault
PConfiguration
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

7. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
DFF’s: SEUs and SEFIs
Probability of SEU
Strike Caught in Loop
PDFFSEU
DFF 1
D Q
reset
CLK
Clock
Tree
Probability of SEFI
PSEFI
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

8. Transient Capture on A DFF Data Input Pin (SET→SEU)
tp = 1/fs
clock
P(fs)SET→SEU
Tpulse
fs : System Frequency
T(fs)pulse : SET Pulse Width
P(fs)SETgen : Probability SET generated with sufficient amplitude
P(fs)SETprop : Probability SET can propagate with sufficient amplitude
PDFFEn : Probability DFF is enabled (active)
P(fs)SET→SEU : Probability SET can be caught by clock edge
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

9. Frequency Effects and Conventional DFF Upset Theory
Composite Cross Section
DFF Upsets:
PDFF(fs)error
sDFFerror
Static Component
PDFFSEU & PDFFMBU
Dynamic Component
P(fs) SET→SEU
Frequency ~0
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

10. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
Summary: Most Significant Factors of System Error Probability P(fs)error
Configuration
DFFs
SEFIs
SRAM Based FPGAs
STATIC
SEU
Dynamic
SET→SEU
Clocks & Resets
Inaccessible control circuitry
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

11. Reducing System Error: Common Mitigation Techniques
Mitigation can be:
Embedded: built into the device library cells
User does not verify the mitigation – manufacturer does
User inserted: part of the actual design process
User must verify mitigation… Complexity is a RISK!!!!!!!!
Common Mitigation Types:
Local Triple Modular Redundancy (LTMR)
Global Triple Modular Redundancy (GTMR)
Want to reduce as many terms as possible:
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

12. Example Mitigation Schemes will use Majority Voting
Majority Voter 1
Best 2 out of 3
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

13. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
Mitigation and Actel Anti-fuse Devices
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

14. ACTEL RTAX-S Architecture Basics
Super Cluster:
Combinatorial Cells: C CELLS
DFF Cells: R Cells
Source: RTAX-S/SL RadTolerant FPGAs 2009 Actel.com
Embedded RHBD:
Hardened Global Clocks and Resets
Antifuse Configuration is SEU immune
Embedded Localized TMR (LTMR) at each DFF (RCELL)
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

15. Local Triple Modular Redundancy (LTMR): Smallest Area & Power
Non-Mitigated
Mitigated
Triple Each DFF + Vote…
Data paths are not redundant – can only have one voter
Unprotected:
Clocks and Resets… SEFI
Transients (SET->SEU)
Internal/hidden device logic: SEFI
Low
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

16. ACTEL RTAX-S Embedded Mitigation… LTMR and SETs
Combinatorial logic: C-CELL
Super Cluster C R RX TX B C
Combinatorial logic C-CELL
Sequential logic R-CELL X TX RX
Combinatorial logic C-CELL R C C
Embedded LTMR
In Library Cell
ERROR if caught
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

17. RTAX Example: Probability of Error Reduction
LTMR
Hardened
Clocks + ~0
Low
Error Probability is Per DFF bit
Error Rate must reflect frequency of operation
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

18. Upper-Bound Error Prediction RHBD Anti-fuse FPGA
DFF (near) Static Error Bit Rate no CCells PDFFSEU:
15MHz to 120MHz: Dynamic Error Bit Rate with 8 levels of CCells P(fs)SET→SEU:
Source: Actel
GEO
Source: NASA Goddard
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

19. Upper-Bound Error Prediction Actel RHBD Anti-fuse FPGA
With embedded LTMR Mitigation + Hardened Clocks:
Years-
Decades
GEO
Thousands of years in LEO !!!!!
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

20. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
Mitigation and Xilinx Virtex Devices
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

21. Xilinx XQR4VSX55: Radiation Test Data
Xilinx Consortium: VIRTEX-4VQ STATIC SEU CHARACTERIZATION SUMMARY: April/2008
Probability
Error Rate
LEO
GEO
Configuration Memory: XQR4VSX55
Pconfiguration
7.43
4.2
Combined SEFIs per device
PSEFI
7.5x10-5
2.7x10-5
For non-mitigated designs the most significant upset factor is:
M Berg, Trading ASIC and FPGA Considerations for System Insertion; IEEE Nuclear Science Radiation Effects Conference 2009
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

22. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
Global Triple Modular Redundancy (GTMR): Largest Area → Greatest Complexity
Non-Mitigated
Mitigated
Triple Entire Design
Triple I/O and Voters
Unprotected – hidden device logic SEFIs
Can not be an embedded strategy: Complex to verify
Xilinx offers XTMR
Low
Low
Low
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

23. XTMR – Capturing Asynchronous Input data
Async_data_tr0
Dynamic Analysis:
One domain leads the other two
Async_data_tr1
Async_data_tr2
INPUT
SKEW
EDGE DETECT TIMING
WAVEFORM
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

24. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
Time Domain Considerations: XTMR Single Bit Failures …Not Detected by Static Node Analysis
CONFIGURATION
BIT HIT
NO EDGE DETECTION
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

25. Voters and Asynchronous Signal Capture
Place voter after metastability filters
It satisfies skew constraints because voter is anchored at DFF control points V O T E R
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

26. Upper-Bound Error Prediction: Xilinx FPGA XTMR
PConfiguration ???
SEUs are insignificant
MBUs may be insignificant (still under investigation)
Assumes proper scrubbing
Assumes Unmitigated SEFIs are the most predominant source:
GEO
Decades-
Centuries
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

27. European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg
Tools
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

28. Mitigation and Actel Tools
Mentor Graphics has offered LTMR for anti-fuse devices
There is a desire to employ LTMR to Actel Flash Based products
DTMR is another approach (GTMR with no clock redundancy)
Flash
Assist with SETs in Anti-fuse Device
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg

29. Mitigation and Xilinx Tools
Currently XTMR is commercially available from Xilinx
NASA REAG has identified some issues:
Asynchronous domain crossings
Verification of XTMR insertion
Mentor is now evaluating GTMR with Formal Checking
NASA REAG is expecting to use Mentor GTMR (preliminary version) for V5 radiation testing
European Space Agency FPGA Tool Workshop. Noordwijk, NL; Melanie Berg