We present a test methodology for estimating system error rates of Field Programmable Gate Arrays (FPGAs) mitigated with Triple Modular Redundancy (TMR). The test methodology is founded in a mathematical model, which is also presented. Accelerator data from 90 nm Xilinx Military/Aerospace grade FPGA are shown to fit the model. Fault injection (FI) results are discussed and related to the test data. Design implementation and the corresponding impact of multiple bit upset (MBU) are also discussed.

The basic functionality of the Xilinx Virtex-5QV Multi-Gigabit Transceivers (MGT) demonstrates a variety of single event effects (SEE) while interacting with heavy-ions. In this work, we have attempted to measure, characterize, and then evaluate the various manifestations that SEEs have on the MGT functionality. Experimental results demonstrate that the large majority of the symptoms observed can either have a very small impact to the MGT communication system functionality, only causing a few data bit-flips, or can be easily corrected by the communication channel's resynchronization protocol, which is an integral part of all communications standards that make use of Serialize/De-Serialize (SerDes) technology.

Recent heavy ion measurements of the single-event upset (SEU) cross section for 65 nm embedded block random access memory (Block RAM) are presented. Results of initial investigation into the on-chip Error Detection and Correction (EDAC) are also discussed.

Orbital, space-based, and extra-terrestrial applications are susceptible to the effects of high energy charged particles. Single-event upsets (SEUs) can alter the logic state of any static memory element (latch, flip-flop, or RAM cell) including the components of an embedded hard processor. These upsets are unavoidable but correctable for the logic around the processor in FPGA configuration memory. This application note describes mitigation techniques and corresponding design flow when using a Xilinx FPGA with an embedded processor (specifically the PowerPC ® 405 found in the Virtex™-4 FX family) in high-radiation environments. This example contains a block RAM scrubber example for block RAM blocks attached to the processor local bus (PLB) used for code execution. Since this technique cannot triplicate the PowerPC 405 (PPC405), the surrounding logic is mitigated as much as practically possible. Therefore, the user must determine if the system mitigation is sufficient for the target environment. Note: It is essential for the reader to have a basic understanding of the Xilinx tool flow using the Xilinx Platform Studio (XPS), triple-module-redundancy (TMR) techniques, the Xilinx TMRTool, and ISE™ software. An in-depth understanding of [Ref 1] is also essential. In addition, an understanding of VHDL design and practice is recommended.

Designers of space-based application must be concerned with the effect of single-event upsets (SEUs) on FPGA configuration memory. Changes to this memory can cause changes in the functionality and performance of the device. This application note describes the use of partial reconfiguration and readback in Virtex?-II FPGAs for the purpose of detecting and correcting single event upsets to the configuration memory array induced by cosmic rays.

Radiation Test Consortium (XRTC) single-event measurements for three of the latest generation of radiation-tolerant reconfigurable FPGAs from Xilinx (90 nm, copper- interconnected, thin-epitaxial CMOS) are presented. Results include proton and heavy-ion upset susceptibilities for unclocked memory elements, high-temperature latchup immunity and a low SEFI rate (e.g., ~one/device-century in geosynchronous orbit).

Heavy ion cross section data taken from a hardened-by-design circuit are presented which deviate from the traditional single sensitive volume or classical rectangular parallelepiped model of single event upset. TCAD and SPICE analysis demonstrate a SEU mechanism dominated by multiple node charge collection. Monte Carlo simulation is used to model the response and predict an on-orbit error rate.

In critical applications, charged particles coming from outer space may locally ionize IC structures. In the case of a memory, a change from 0 to 1 (or 1 to 0) occurs. To investigate the reliability of RAM based FPGAs, a pulsed laser is used to change memory bits. Each change may affect programming of the device thus changing its function. In this document, we will present a unique methodology consisting in the injection of localized SEUs in Xilinx Virtex II FPGAs for an optimal evaluation of the sensitivity of input/output blocks as well as the power on reset (POR) circuitry to SEUs. This methodology is based on an innovative combination of existing techniques: Radiation beam, software and laser fault injections we will describe how each technique complements the others to evaluate sensitivity of integrated circuits. (C) 2004 Elsevier Ltd. All rights reserved.

The speed, I/O count, and reconfigurability of SRAM-based FPGAs make them attractive for flight applications. However, critical designs require effective upset. Measurements of the effectiveness of configuration control and TMR during heavy-ion irradiation are reported. IN TRODUC TlON The increasingly advanced technologies of fieldprogrammable-gate arrays (FPGAs) in the commercial sector has resulted in higher speed and lower core voltages, improving both integration and allowing for better power consumption. In addition, the decreasing costs and development time needed to implement FPGAs compared to designs with discrete logic devices has made programmable logic devices favorable in space and avionic applications as well. They offer flexibility for changing requirements, in-system and on-orbit programmability as well as potential recovery of in-flight failures. The Xilinx Virtex II is a re-configurable SWM-based FPGA that also has the ability to conduct partial configuration or, write to the configuration memory post-configuration while in operation. However, while SRAM-based memory in the FPGA is useful for reconfiguration, the static memory elements and combinatorial logic paths are susceptible to upset from heavy-ion particles in interplanetary space. The Virtex I1 has been selected for the present study because several variations of the Virtex FPGA are currently or expect to be implemented in various missions. Many studies have been carried out on SRAMbased FPGAs [I]-[4]. They have also shown that with proper mitigation, SEU induced failures can be properly controlled [5]. Static test results on the configuration memory of the Virtex II XC2V1000 along with projected upset rates have been reported at MAPLD, 2002 [6]. These results are used as a comparison and baseline for data collected from two recent mitigated dynamic tests. A future test with an in-depth triple modular redundancy design will be conducted by the Xilinx Consortium, comprised of members from Xilinx, Aerospace Corp., Sandia National Labs, SEAKR Engineering and JPL. Final results will be analyzed and considered for implementation in future space based applications. EXPERIMENTAL D ETAlLS The device chosen for this study is the Virtex I1 XC2V1000. The device was procured in a commercial 256-pin wire-bond standard ball gate array (BGA) package. It is fabricated on a 0.15pm / 0.12pm CMOS &layer metal process and includes 40 block RAMS, 432 maximum I/Os, and 4.1M configuration bits. The XC2V1000 is ideal for SEU characterization as it is the only member of the Virtex II family that has a face-up die, suitable for heavy ion penetration. --__--The research in this paper was carried out at the Jet Propulsion Laboratory, California Institute of Technology, under contract with the National Aeronautics and Space Administration (NASA), under the NASA Electronic Parts and Packaging Program, Code AE Following the static tests on the configuration memory, two basic dynamic tests have been performed to study the behavior of the configuration memory cells while undergoing irradiation with heavy ions. The test vehicle and methodology of the two experiments are identical. Both continuously check for errors but the latter test includes a mechanism to correct the errors as they are detected. The design configured into the DUT is a shift register utilizing a “checkerboard” type pattern. The Virtex II XC2V1000 is chemically etched to expose the die and is situated on a Xilinx development board (Fig. 1). Alongside the XC2V1000 is another FPGA, the XCVlOO, an on-board service FPGA used to count SEUs and send them to the user interface. Errors in the configuration memory are detected and counted through the use of readback, a feature of Xilinx FPGAs that allow users to read from the memory post-configuration. The number of counts is then sent to a user interface titled Configuration Monitor; a custom Visual Basic program used to configure the DUT as well as record and display the configuration memory upsets as they occur. Once errors are detected, the second test proceeds to correct the upsets through partial re-configuration. This process, also known as “scrub”, will cause the configuration memory to be partially re-configured by reloading only the crucial segment of the configuration bitstream [7]. A custom C++ software application was also available at the end of each beam run to read back the number of errors that accumulated in the configuration logic block (CLB) frames, block RAM cells and configuration control registers. The custom software is named FlVlT for Fault Injection Verification Tool and communicates with the device-under-test via the SelectMap or JTAG interface. By combining the efforts and knowledge gained through these initial experiments, the next test will apply mitigation schemes such as triple module redundancy to determine the effectiveness and usage in space. Fig 1. Diagram of dynamic test setup. Configuration

The XQR18V04 was evaluated for single event upset rates using proton and heavy ions. The PROM was demonstrated to be immune to latch-up, as well as to static upset in the flash memory cells, to an LET > 125 MeV/mg/cmz (effective). The PROM was also tested in a dynamic mode, which revealed three distinct error modes: Read Bit Errors, Address Errors, and a Single Event Functional Interrupt (SEW which affected the data output drivers. Saturation cross-sections, and onset thresholds, for these errorinodes were measured at the heavy ion facility at Texas A&M University, and the proton facility at UC Davis. Additional testing was performed at UC Davis and . the Cobalt 60 source at McClellan Air Force Base to examine the effect to TID life as a function of power biasing. The PROM demonstrated a 100% improvement in total TID life with an 84% percent decrease in device usage.

A comprehensive Single Event Effects (SEE) characterization of advanced commercial technologies was conducted using the heavy-ion test facility at Texas A&M. The components evaluated included a 322,000 gate Virtex reprogrammable FPGA (XQVR300) from Xilinx, and several manufacturers versions of 4Meg Zero Burst Turnaround (ZBT ) SRAMs. The SRAMs all unfortunately latched-up at or below an LET of 60 MeV-cm/mg and no further testing was done. However, the Virtex FPGA was immune to single event latch-up up to an LET of 125 MeV-cm/mg. Detailed single event upset testing was then done in both static as well as dynamic operating conditions to be able to understand the upset modes and develop mitigation strategies for a space based reconfigurable computing application. The upset sensitivity and detection and mitigation techniques are discussed and the results indicate that the Virtex FPGA is a good candidate for satellite applications

SRAM based logic devices such as FPGAs have some susceptibility to SEU and functional interruption. This paper describes several reliable mitigation techniques for the Virtex series FPGA architecture, which will retain functional integrity while static upsets are detected and corrected. Additionally, this paper demonstrates how an SEU in an FPGA can be corrected in 3us without disrupting operation of the device, how to build hardened voting circuits, and that a single event has only 1 chance out of 3.25 million of causing a functional interrupt.