Non-Volatile and Reconfigurable Field Programmable Gate Arrays (FPGAs) present an attractive solution for high-level system integration in various aerospace and military applications. Commercially available Low-Power Flash-based FPGAs, 0.13-µm ProASIC3/L (A3PL) and its extended family product (A3PEL) are non-volatile while providing remote in-system reprogramming to support future design iterations and field upgrades. Flash-based technology provides them the advantage of being a secure, low-power, single-chip solution [Morris, 2006]. Unlike SRAM based-FPGAs, the configuration memories are not volatile and hence don’t require additional non-volatile memory to reload the device configuration data at system-power-up or due to radiation effects [Swift et al., 2004] in addition to Triple Module Redundancy (TMR) of its entire set of configuration bits [Carmichael, 2001]. This reduces cost, power, and initialization time and improves system reliability. However, despite the SEE immunity of their configuration memory, their Floating Gate (FG) switches and CMOS logic gates are susceptible to both effects of the Total Ioninzing Dose (TID) and the Single Event Effects (SEE).
For TID effects, the primary issue is the radiation-induced charge loss in the floating gate [Snyder et al., 1989, Cellere et al., 2004, Wang et al., 2004, Guertin et al., 2006], resulting in the change of the FPGA electrical performances (maximum speed, current, etc.). While for SEE, the primary concern resides in the upset of its registers (state of the flip-flop) due to a particle hit, resulting in the disruption of the normal operation of the FPGA-design [Rezgui et al., 2007a & 2007b]. The new Radiation-Tolerant ProASIC3 (RT ProASIC3 or RT3P), sharing the same silicon of the Low-Power A3PL FPGAs is hardened for TID and SEE by software means in a transparent manner to the user [Rezgui et al., 2008a]. The Single Event Transients (SET) tolerance is hardened by single or duplication filtering [Shuler et al., 2005& 2006, Balasubramanian et al., 2005, Baze et al., 2006, Mavis & Eaton, 2007, Rezgui et al., 2007a] and Single Event Upsets (SEU) are hardened by TMR or Error Detection and Correction (EDAC) to soft error rates less than 10-10 upsets/bit-day and LETth larger than 40 MeV•cm2/mg for clock frequency up to 100 MHz. While their TID limit is improved by simple reprogrammimg of the FPGA resulting in the restoration of the charge loss from their configuration FG swicthes.
This chapter describes the employed mitigation techniques for the A3P product family, to attain the radiation levels of the RT-product and presents the results issued from the TID and the SEE characterization of both of the A3P and the A3PL (the Low-Power version of ProASIC3). The SET characterization or mitigation will not be addressed in this chapter, but detailed analyses and measurements of SET cross-sections are provided in [Rezgui et al., 2007a, 2008b& 2009]. This chapter includes a brief description of the RT ProASIC3 FPGA from architectural and device perspectives as well as detailed analyses of the radiation test results issued from 1) the TID characterization, 2) the SEE characterization and 3) the TID Effects on the SEE Sensitivities.
2. New radiation-tolerant 0.13-µm flash-FPGAs
Based on its low-power capabilities and its increased IO features in the Extended (E) family product, the 0.13-µm ProASIC3EL (A3PEL) part is selected as the silicon foundation of the new Radiation-Tolerant Flash-based FPGA (RT ProASIC3). Additionally, RT ProASIC3 FPGAs are assembled in hermetically-sealed ceramic packages, which are available as either Column Grid Array (CG, with Six Sigma solder columns attached) or Land Grid Array (LG, no solder columns attached). Qualification, inspection, assembly, and testing are performed in accordance with MIL-STD-883 Class B [MIL-STD-883G]. In the following, a brief description of these products at the architectural and the device levels as well as of the differences between the A3P and A3PL product families are given.
2.1 The ProASIC3 internal architecture
The A3PEL product family has up to 3 million system gates, 504 kbits of true dual-port SRAM, 620 single-ended I/Os, and 300 differential I/O pairs. They also include 1 kbits of on-chip, programmable, non-volatile Flash-ROM (FROM) memory storage as well as up to 6 integrated phase locked loops (PLL). The FPGA core consists of logic tiles, called “VersaTiles”, and routing structures. Each logic tile is a combination of CMOS logic and flash switches and can be configured as a three-input logic function or as a D-flip-flop with an optional enable, or as a latch by programming the appropriate flash switch interconnections. The logic tiles are connected with each other through routing structures and FG switches. These flash switches are distributed throughout the device to provide reconfigurable programming to connect signal lines to the appropriate logic-tile inputs and outputs [ProAISC3 Handbook], as shown in Fig. 1. The Flash-FPGAs are reprogrammable through the JTAG port and contain programming control circuits composed of charge pumps, sense amplifiers, Digital to Analog Converters (DAC), CMOS logic, High-Voltage (HV) NMOS transistors and FG cells to store the factory parameters.
2.2 Floating gate device
As shown in Fig. 1 and detailed in [Wang et al., 2004a, 2006a& 2006b], the FPGA switch circuit is a set of two NMOS transistors: 1) Sense Transistor to program the floating gate and sense the current during the threshold voltage measurement and 2) Switch Transistor to turn ON or OFF a data-path in the FPGA. The two transistors share the same control gate and floating gate. The threshold voltage is determined by the stored charge in the FG. Fowler-Nordheim tunneling through the thin gate oxide (100 Å) is the mechanism that modulates the stored charge during program and erase of the FG. The FG switch is programmed to a low threshold voltage state to turn the switch ON and erased to a high threshold voltage state to turn it OFF. Fig. 2 shows the structure of the FG transistor: an NMOS transistor with a stacked gate. Between the silicon substrate and the floating gate is the tunnel oxide and between the FG and the control gate the inter-poly oxide-nitride-oxide (ONO) composite dielectric.
2.3 ProASIC3E and low-power ProASIC3EL
The Low-Power A3PEL parts although different at the process level from the A3PE are identical at the design and architectural levels and are pin to pin compatible with the A3PE, except for a new added feature called “flash-freeze”. This feature provides a low-power static mode that retains all SRAM and register information with rapid recovery to “active” (operating) mode, by simply asserting a single input. The device then enters a low-power mode in 1µs, in which case, clocks are frozen, I/Os are tri-stated, and core registers and memories maintain state. In this mode, external signals driving the FPGA I/Os and clocks can still be toggled without impact on the device power consumption. For instance, in the flash-freeze mode, the power consumption of the low-power FPGAs ranges in the tens of microwatts [ProASIC3 Handbook].
Furthermore and because of their basic process differences, resulting mainly in the increase of their threshold voltages, the A3PEL products have much lower power consumption than the A3PE part. For instance, the A3PEL operates at 40 percent lower dynamic power and 90 percent lower static power than the ProASIC3E FPGAs, and orders of magnitude lower power than the SRAM-based FPGAs, with up to 350 MHz operation. These process differences between the two product families (A3PE and A3PLE) are only induced in the CMOS transistors used to build the FPGA logic blocks but not in the FG transistors. Since the TID effects are much lower on the CMOS transistors than on the FG transistors, the same TID performance should be expected for both of the A3PE and A3PEL parts when both are operated at a 1.5 V core voltage. In addition and at the opposite of the A3PE FPGA which could operate only at 1.5V, the A3PEL can operate at all core voltages between 1.2 and 1.5V which allows more reduction in their power consumption when operated at 1.2V.
In the following sections, the test results issued from TID and SEE test experiments of the ProASIC3EL are reported and discussed along with additional suggestions on mitigation methodologies suitable for the target device. For these experiments, a few devices from the ProASIC3EL product family were selected for the TID characterization in x-rays and gamma-rays (the A3P250 and the A3PL600) and the SEE characterization in heavy-ions (HI) and protons beams (the A3P250 and the A3P1000). Since the A3P/E and the A3PL/E share the same FPGA core, the radiation test results are expected to be very similar.
3. TID characterization
This section covers the TID performance at the product level of the A3P and the Low-Power RT PRoASIC3 (A3PL) product families. Radiation tests for the selected products were performed in x-rays at ARACOR facility, in Sunnyvale, CA and in gamma-rays at the Defense MicroElectronics Activity (DMEA), in Sacramento, CA. The x-rays irradiation tests are performed by an ARACOR 4100 x-rays Irradiator. The TID test results are reported and discussed, along with additional suggestions on ways to extend the TID lifetime of the Flash-FPGAs.
The purpose of this characterization is to study the TID effects on 1) the FPGA core (CMOS logic and FG devices) and 2) the programming control circuit (FG devices, charge pumps, analog circuits and HV NMOS devices). TID irradiation tests for the selected features were performed in x-rays and in gamma-rays. Most of the results presented in this chapter are obtained in x-rays beams whose effects are estimated to be approximately 2.9 times less effective than those measured in Gamma rays [Wang et al., 2004]. This calibration factor between the x-rays and the Gamma-ray data was calculated experimentally using the same methodology previously applied in [Palkuti & LePage, 1982]. Additionally, all the x-rays irradiation tests were performed on the A3P parts (A3P250-PQ208) while Gamma test experiments at DMEA, were performed on the A3PL part (A3P600L-FG484), both when operated at 1.5V core voltage. During all x-rays and Gamma dose irradiations, except for the power pins, all the Device Under-Test (DUT) inputs are grounded; the ambient is at room temperature.
3.1 TID effects on floating gate transistors
Three radiation-induced mechanisms detailed in [Wang et al., 2004, Brown & Brewer, 2002] can affect the threshold voltage of the FG devices: 1) holes injected into the FG, 2) holes trapped into the oxides and 3) electrons emitted over the polysilicon/oxide barriers. Electron-hole pairs initiated from radiation test results in the injection of holes in the FG and the trapping of holes in the oxides. Hole injection and trapping have a similar effect since they both reduce the threshold voltage in the FG device. The third radiation phenomenon: electron-emission occurs mainly when radiation-induced photons possess an energy exceeding the potential barrier. The emitted electrons are then swept to the substrate or control gate by the electric field, which reduces the FG threshold voltage. Fig. 3 shows an example of threshold voltage (Vt) shift in both the program and erase distributions of the FG devices, when irradiated in x-rays.
The fundamental, consistent physical process of charge generation, separation and trapping in the dielectrics surrounding the floating gate will modulate the threshold voltage (Vt) of the floating gate (FG) device and subsequently the function of the FPGA. The major key TID-indicating electrical parameters on a given FPGA design are 1) the propagation delay, which is best measured on an inverter-string design and 2) the maximum allowed frequency of the circuit registers. In the following, TID-induced effects on a given design will be discussed for both of the DUTs mentioned above (A3P and A3PL).
3.2 TID performance of the FPGA core
3.2.1 Test design and test procedure
To measure the TID effects on the FPGA core, three A3P FPGAs were configured with three sub-designs: D1) an inverter-string with 1000 stages, D2) a shift register with 1000 D-flip-flops (DFF) running at 350 MHz and D3) a shift register with 310 DFFs combined with combinational logic (12 inverters) between each consecutive flip-flops running at 135 MHz. Before x-rays irradiation, at 0 Krad, both of the rising and falling edges of the D1 output signal are measured and on average are approximately 530 ns. The maximum attained frequency of the D2 design was 350 MHz, as stated in the [ProASIC3 Handbook], while the maximum frequency for D3 is about 135 MHz. For both of the D2 and the D3 test designs, the input-data are toggling at half of the clock frequency and at the positive edge of the clock-input, while their output-data are switching at the clock negative edge. After exposure to a certain dose, the rising and falling edges for the D1 output signal, and the maximum attained frequency for the D2 and the D3 sub-designs, were measured. A block diagram of the DUT design is given in Fig. 4.
The input signals for each sub-design are supplied from an off-chip pulse generator while the electrical parameters of the three output signals were observed and recorded on the scope off-beam after two minutes from each DUT irradiation. The same tests applied to the A3P part, combining combinational and sequential logic, have been repeated in gamma-rays for the A3PL600-FG484 FPGA at DMEA and the issued results are reported. The dose rate during these tests was varied between 4 and 25 Krad/min (67 and 461 rad/s), which is higher than the dose rate required by the TM1019.7 (50 rad/s) [MIL-STD-883G].
3.2.2 X-Rays test results
The test circuits were exposed continuously to TID until one of the three sub-design’s output state became unstable off beam and required annealing to recover normal operation. This instability in the output signals was always accompanied with an increase of the current in the FPGA core (from 1 to 33 mA in the worst observed case) and was mainly observed starting from an x-rays total dose of 175 Krad (60 Krad in Gamma Rays). The obtained results for the A3P FPGA, displayed in Fig. 5, show that for the A3P parts (DUT 3), the 10% degradation in the propagation delay was obtained at 66 Krad (22 Krad in gamma-rays).
Furthermore, as shown in Fig. 6, until a TID of 78 Krad, no differences in the maximum allowed frequency for the D2 was noticed, which means that all the DFFs can still operate at 350 MHz. This means that all the timing requirements (setup time, etc.) needed for the DFF were still valid. However, when combining both of the combinational and sequential logic in one single design (D3), the TID limit to observe a variation in the maximum frequency was reduced to 70 Krad as shown in Fig. 7. Indeed, the true maximum frequency of a DFF is about 2 GHz but because of the IOs and the internal FPGA’s routing, the maximum frequency is reduced to 350 MHz. Therefore, although an actual reduction in the maximum speed of a DFF has occurred during TID irradiation, it does not show much until a high TID, which means a high reduction in the maximum frequency.
In the following, the same test data will be compared to gamma-rays to calculate the circuits’ TID performances as well as to verify the 2.9 factor between the x-rays and the gamma radiations.
3.2.3 Gamma-rays test results
The A3PL600-FG484 was exposed to Gamma irradiation at the core voltage of 1.5V. Fig. 8 shows the measured degradation in the propagation delay in the inverter-string along with the extrapolated data from the previously obtained data in x-rays irradiation (Fig. 7) based on the 2.9 factor. The obtained results show that the measured and predicted TID limit correlate quite well confirming the correctness of the 2.9 factor between the Gamma and x-rays dose irradiations. However, as the only purpose of this comparison is the correlation
between both of the x-rays and the Gamma-ray radiation data, it is certainly not the objective to show which one has the higher TID effects. On the other hand, this data confirm that the TID limit of the A3PL part is around the 22 Krad relative to Gamma Rays. Additionally, and as shown in Fig. 9, the obtained data for the D2 show no degradation in the flip-flops maximum frequency till a TID of 28 Krad (the last tested value). This confirms the same x-rays test results, proving again that a degradation in the speed performances of a logic tile configured as a Flip-Flop is less observable than on a logic tile configured as an inverter.
However, as for the x-rays TID testing, the TID performance of Design 3, although slightly better (28 Krad), follows the trend of the TID performance of the Design 1 (the inverter-string). This is expected since Design 3 combines both sequential and combinational logic.
3.3 TID performance of the programming control circuit
The main function of this circuit is to erase, program and measure the threshold voltages (Vt) of each sense FG device. As a consequence, the test flow consists of reprogramming the part, which invokes erasing, reprogramming and verifying the correctness of the configured design by measuring the Vt of all the sense devices. For clarity purposes, the entire procedure will be called reprogramming or refreshing of the part. The test flow, applied on the A3P parts, consisted of reprogramming the part off-beam after its irradiation to a certain dose (10 Krad in x-rays in this case) until failure to reprogram was observed.
The test results showed that the maximum TID at which the programming procedure passed was 40 Krad, since it failed at 50 Krad, which suggests that the TID limit of this sub-circuit is between 40 and 50 Krad in x-rays. Note that all the three tested parts that were exposed to 50 Krad recovered the reprogramming capability at room temperature after few days. This means that this part is subject to annealing effects. The following section will show some of these effects. Also and as mentioned above, the TID limit in x-rays irradiation for the FPGA core was about 66 Krad, while for the programming control circuit, it is about 40 Krad. This difference in the TID limits could be due to the FG devices located in the programming control circuit, the thick-oxide HV devices, possibly the analog circuits or the charge pumps. Since the TID tests were done at the product level, it is not possible to conclude on the first failing part to TID in the programming control circuits.
3.4 FG refreshing & annealing effects on the product’s TID limit
3.4.1 Test procedure
As explained in [Wang et al., 2004 & 2006], the percentage of the degradation in the propagation delay is mainly due to the charge loss in the FG devices (whether in the erase or the program state). Therefore, a first TID mitigation solution would be to attempt to restore that charge to these FG cells. This refresh could simply be done by erasing and reprogramming the Flash-FPGA. However, since the previous results showed that the programming circuit is limited to 40 Krad in x-rays irradiation unless annealing effects are taken in account, the test flow consisted in reprogramming the part off-beam after having been irradiated to 10, 20, 30 and 40 Krad (x-rays). On the other hand, when starting from a much higher TID (85 Krad in x-rays), the measurements of the electrical parameters of the D1, D2 and D3 became variable with time, requiring longer time than 2 minutes to get a stable value of the output states. These electrical parameters improved with annealing time and were then recorded after 2, 15 and 30 minutes, starting from a TID of 85 Krad. Indeed, as shown in Fig. 10, three data points are displayed at 85, 95 and 105 Krad. An improvement of 10% was observed between each measurement taken at 2, 15 and 30 minutes at these three TID values, clearly showing the annealing impact on the FG devices.
3.4.2 Test results of the refreshing effects
The obtained results, shown in Fig. 11, demonstrate clearly the efficacy of the employed refresh technique in restoring the lost charge from the FG devices. They also show that at each refresh, the three sub-designs restore completely the original operational parameters (rising and falling times as well the maximum frequencies). Indeed, the maximum TID limit (based on 10% degradation in the propagation delay) was increased by 18 Krad, improving it from 22 to 40 Krad. This suggests that if the programming circuitry was more robust to TID effects, the overall TID lifetime of the FPGA core could be extended to higher than 40 Krad. Note, that the predicted data shown in Fig. 11 was extracted from the TID measurements during the DUT exposition to x-rays. Both of the x-rays and Gamma induced-radiation correlate again quite well and confirm the 2.9 factor. Furthermore, after each refresh cycle (10 Krad irradiation in x-rays), the threshold voltages were measured. The obtained Vt distributions, similarly to what has been shown in Fig. 3, prove that all the FG devices have regained their lost charge because of TID and shifted back to their original Vt whether on the program or the erase side.
Note that when employing the refresh techniques and except for the device de-rating aspects of it, the three sub-designs remained functional proving that no switching of the FG transistors from ON to OFF and vice versa has occurred, until a TID of 275 Krad in x-rays which should be equivalent to 95 Krad when exposed to gamma-rays. Furthermore, since the three sub-designs use 99% of the FPGA logic tiles, and remained fully-functional although with much lower timing performance, it is then clear that there are no stuck bits because of x-rays or gamma irradiations.
In summary, the obtained results showed TID sensitivity in the FPGA core and the programming control circuit of the FPGA. A degradation of 10% in the propagation delays was attained at 22 Krad and the part could not be reprogrammed after 16 Krad when exposed to gamma-rays. However, two phenomena to mitigate the TID effects on the FG devices have been observed: 1) the considerable annealing effects and 2) the impact of the FPGA refreshing to restore the FG-lost charge. Indeed, after each refresh of the FPGA core, the latter recovers the original electrical parameters, as if it has not been irradiated. Nevertheless and because of the low TID performance of the programming control circuit, the TID limit of the FPGA core could not be improved to higher than 40 Krad in gamma-rays. In the next section, the SEE characterization and mitigation of the 0.13-µm ProASIC3 FPGAs will be heavily addressed [Rezgui et al., 2007a, 2008b& 2009].
4. SEE characterization
The SEE characterization of the ProASIC3 FPGA was performed in HI and proton beam experiments. HI beam experiments were performed at the facility of Texas A&M University (TAMU) and at the Lawrence Berkeley National Laboratories (LBNL) while proton radiation experiments were conducted at the Crocker Nuclear Laboratory of California in Davis (CNL). HI beam experiments were performed with a wide ion-cocktail (Neon, Argon, Copper, Krypton and Xenon) at normal incidences and two additional tilt angles (30 and 45 ). No testing with rolling angles was performed nor is differentiation in the data between the data collected at normal incidence or tilt angles is provided in this chapter.
Radiation tests targeted primarily the five programmable architectures in the ProASIC3: 1) FPGA Core, 2) Clock Network and PLL, 3) Flash-ROM (non-volatile memory) and 4) SRAM. The schemes of the DUT designs for the testing of these programmable blocks as well as the derived beam test results showing some SEE sensitivity in most of the programmable architectural features of the FPGA except in the FROM, are described and discussed in the following.
4.1 Devices under-test & experimental test setup
For the beam test experiments, two devices from the ProASIC3 product family were selected: the A3P250 and the A3P1000. Each selected part is mounted in a PQ208 package. Table 1 shows the features of the two selected parts. The test primarily targets the circuitry used for the DUT erase and programming depicted in the bottom of Fig. 1 as the block for “Charge Pumps” as well as the 5 configurable architectures in the A3P FPGA, as shown also in Fig. 1: 1) the FPGA Core, 2) the Clock Network and the PLL, 3) the FROM and 4) the SRAM.
|Secure (AES) ISP||Yes||Yes|
|Differential I/O Pairs||34||35|
A new test setup was built for the A3P radiation testing. As shown in Fig. 12, it includes two boards: 1) a “master” board for the monitoring and control of the DUT operation in-beam and 2) a “slave” board for the communication between the host PC and the master board through two USB ports. The “master” board includes an A3P1000-FG484, called “master” FPGA, and a DUT (A3P-PQ208). IO “channels” of an input (SE or LVDS) routed immediately to a nearby output are also added between the “master” FPGA and the DUT. There are 38 SE and 13 LVDS I/O channels on both FPGAs. This board architecture allows the implementation of several separate designs on the same DUT to be tested simultaneously. The slave board includes an A3P1000-PQ208; it allows the data acquisition and data transfer to the host PC.
For communication with the host PC, a generic user interface was designed to communicate with the slave board. The communication protocol between the slave board and the host PC remains always the same for easy and fast implementation of any new SEE test experiment. Indeed, there are always a maximum of 64 display counters available to the designer, which names are adjustable according to the running experiments. These counters are usually used for display of number of SEE events among other indicators of the operation of the DUT design. In addition, this user interface allows the self-monitoring of the test system itself, by testing each board and FPGA individually as shown in the “Mode” knob on the top left of Fig. 13. Among other features, it also allows the pattern selection to be accomplished by the “pattern” knob (all zeroes, all ones, checkerboard or inversion of checkerboard) exercised on the DUT inputs and the frequency at which the DUT design is running by using the “Frequency” knob.
4.3 Test designs and experimental results
4.3.1 FPGA core SEE characterization (flip-flops)
The purpose of this testing is to determine the SEE cross-section of an A3P logic tile configured as a DFF. This should lead to the highest possible upset cross-section of a logic tile. The basic test design is a shift register (SR) using 86 logic tiles with each one of them configured as a DFF and one global clock signal but no reset signal. Note that if the SR design was using a reset line, this signal would be a global and using a global IO pad in the same way as any other global clock signal, whose cross-section will be given below.
On the other hand, since this is a 0.13-μm technology, the part might be sensitive to Multiple Bit Upsets (MBU) [Quinn et al., 2005], which in some cases cannot be mitigated effectively by TMR. For instance, if the MBU affects two TMR paths out of three, the output TMR result
will be wrong. Therefore using TMR as a test methodology constitutes a good approach to detect some of the MBU or SEE on the FPGA’s global signals. Note that the design should be using at least 99% of the FPGA resources and the three paths of a TMR circuit should be as close as possible to simulate the worst case of a TMR implementation. Hence in addition to the version (D1) having SR without mitigation, two versions of the TMR’d design have been implemented on the same DUT: 1) D2: TMR’d SR using one single global clock, where voters and IOs are also tripled and 2) D3: TMR’d SR where every I/O signal is tripled, including the global clock signal. All three flip-flops of a TMR’d DFF are always placed directly next to each other.
22.214.171.124 Test Design
Among the 37 Single-Ended (SE) channels, the non-mitigated test design D1 uses 28 SE channels of the DUT. Between each input/output of these 28 channels, a shift register (86 DFF) is inserted. In total, the D1 design uses 28 Input/Output and 2408 (8628) DFF. D2 uses three copies of a TMR’d SR with no triplication of the clock signal, i.e. nine SE channels and one global clock, while D3 uses 4 copies of the TMR’d SR, i.e. 12 LVDS IO channels and 3 global clocks. D1 and D2 use 2 SE IO banks and D3 uses two LVDS IO Banks. The three versions of the design occupy 98% of the A3P250-PQ208. A detailed block diagram of these 3 design implementations, D1, D2 and D3, is given in Fig. 14. The testing was performed at the clock frequency of 2, 16 and 50 MHz.
Note that implementing the same design D1, D2 or D3 on several channels will help check the repeatability and the consistency of the tests for its non-dependency of different tested channels. Moreover, it allows checking for SEE on common global signals other than the user global clock and reset signals. For example, an SEE in global signals that link an IO bank can cause a simultaneous soft error in every channel using the same IO bank [Rezgui et al., 2007a]. Indeed, a transient event was observed on all the IO channels belonging to a single IO bank with a cross-section of 2.3710-6 cm2 per IO-bank. The threshold LET of this event is around 7 MeV•mg/cm2. This suggests that if a design is using all the tripled IOs in the same bank, its cross-section will be no less than 2.3710-6 cm2 per IO-bank.
126.96.36.199 HI and Protons Beam Test Results
For the Design D1, the obtained HI results showed three types of errors: 1) single error on one channel, 2) multiple errors on one single or few channels, and 3) single or multiple errors on all the IO channels associated to a common IO bank. All errors were transient and did not require any reconfiguration or power cycle of the FPGA. Type 1 was most likely due to an SEU in the DFF or to an SET in the clock signal associated to this DFF. Type 2 could be due to the clock signal or to another global signal besides the IOs since we didn’t see all the IO channels disrupted at the same time. Type 3 was most likely due to the aforementioned event for the IO testing and observed in a single IO bank. Fig. 15 shows the single DFF cross-sections at three different frequencies obtained from D1-test data. There was no dependency of cross sections on the frequency; this was expected for soft errors in the flip-flops when the static SEU rate dominates. Note that for better visibility, WEIBULL curves in Fig. 15 (also in Fig. 16 and 17) have been drawn only for the 50MHz data.
Although not visible in Fig. 15, these data include global error cross-sections due to the IO bank or clock global signals; this subject will be discussed in detail in the following section. The global-error cross-sections are dependent on the clock frequency because they are due to the SET in the IO bank or clock global signals. It is well known that SET induced errors have a strong dependence on the clock frequency [Berg et al., 2006]. For the design D2, only errors type 2 and 3 have been observed, while for D3 only errors type 3 have been observed, which means that each SEE observed on the TMR’d design (D3) always affected an entire IO bank. To compare the SEE response of the three test designs and to validate the efficacy of the increase of mitigation level, TMR of the DFF and the triplication of the global clock signal, the SEE cross-sections were averaged on three channels for each design, since D2 was using only three channels. These cross-sections are given in Fig. 16. It is clear that increasing the frequency increases the SEE cross-sections of D2 and D3.
Fig. 16 shows a clear reduction in the SEE cross-sections from D1 to D2 and finally to D3 with the increase of the level of mitigation. In addition, the results show that each observed error on the design D3, where all the resources have been TMR’d, always originates from an SET which affects an entire IO bank. The cross-section of the TMR’d design (410-6 cm2 per design) in D3 is very close to twice the IO-bank SET cross-section deduced from SET errors in designs D1 and D2. This is expected because D3 uses the banks 1 and 3 for the differential IOs while D1 or D2 only uses the bank 2 for single-ended IOs. The IO-bank-SET is suspected to be due to SET occurring on the enable signal of a single IO bank. To accomplish complete SEE immunity, all the tripled IOs have to be separated on three different IO banks; this had been fully demonstrated in [Rezgui et al., 2007 a].
Furthermore, if we increase the number of usage of the FPGA core of D2 and D3, the SEE cross-sections should not increase because they are are dominated by SET on the global signals, i.e. Clock or IO bank enable signals. These cross-sections depend on the number of used global clock signals (18 maximum), the used IO banks (4 maximum for the A3P and 8 for the A3PE) or the operation frequency. On the other hands, if the usage of resources of D1 should increase, its cross-section should increase linearly. Note that for the design D1, the events where all the disrupted IO channels are not counted for this comparison. Fig. 17 shows the clock global cross-section; it is acquired simply by measuring the difference between the designs D2 and D3.
On the other side, proton-beam test experiments showed very little SEE sensitivity at proton energy of 63.5 MeV and when running the design at 50 MHz. Indeed, the DFF SEU cross-section was measured at 5.18x10-14 cm2/DFF. Note also that at this energy and for a fluence of 6.49x1012 of proton particles, no SET in the configuration logic tiles, on the enable signal of the IO banks, on the IOs themselves or the global clock signal was observed. Because of such low SEU cross-section, the DFF design was not tested at lower energies, although it is advised to measure the threshold energy for the A3P DFF in future experiments. No errors were observed on the TMR’d channels, proving the efficacy of the TMR technique in fully mitigating SEUs. Automated software SEU mitigation, a user-selected TMR for the design’s registers, is offered for the RT3P FPGAs.
4.3.2 PLL SEE characterization
A PLL macro uses the CLKA input to drive its reference clock. It uses the GLA and optionally the GLB and GLC global outputs to drive the global networks (Fig. 18). A PLL macro can also drive the YB and YC regular core outputs, but if the GLB (or GLC) global output is used, the YB (or YC) output [ProASIC3 Handbook] cannot be reused. The purpose of this test design is the identification of all the PLL error modes due to beam irradiation.
188.8.131.52 Test Design
The test design uses a PLL whose output (GLA) clocks a triple DFF. Its input signal CLKA is using the 33MHz oscillator output and its GLA signal is running at 50 MHz. The three DFFs have three different inputs and three different outputs. The only common point between the three of them is the PLL output clock signal (DUTCLK). On the master FPGA, the three outputs of the DUT DFF are voted and their output is compared continuously with the DFF input provided from the master FPGA, which is clocked at 16 MHz. Any mismatch between the DFF voted value and the expected value (the input value), is counted as an error.
The test design allows also the monitoring of the PLL LOCK signal. This signal should always be high indicating that the PLL is working properly; if it goes low then the PLL is unlocked and this will also be counted as an error. The objective of these radiation tests is the classification of the detected error types and the test of the efficiency of self-correction through the PLL POWERDOWN signals (Fig. 18) without having to power-cycle the entire FPGA.
The test design is implemented so six types of errors, called error-type 1 to error-type 6 summarized in Table 2, can be detected during the beam test experiments. In the case of a mismatch between the Din and Dout signals of Fig. 18, the error would be counted as an error-type 1, which is similar to an SET event on the PLL clock signal if the error does not persist. However, if the error persists for longer than two clock cycles but less than 100 cycles, it will be counted instead as error-type 2. If the same error persists for longer than 100 clock cycles, it will be considered as error-type 3 and the master FPGA will then power cycle the PLL through the POWERDOWN signal and restart normal operation.
Simultaneously, the master FPGA is continuously checking for the status of the PLL LOCK signal. If this signal goes low, the master FPGA counts it as an SET on the LOCK signal (error type 4) and waits for 2 clock cycles. If the LOCK signal remains at ‘0’ logic for less than 100 clock cycles and the PLL recovers by itself then the error is counted as a PLL lock case and considered instead an error-type 5. In the case where an error-type 5 would last longer than 100 cycles, it will be considered as an error-type 6 and the master FPGA would then power cycle the DUT PLL through the POWERDOWN signal. The block diagram of this test design is given in Fig. 18. Note that the actually implemented test design runs the DUT design at 50 MHz while the error checking on the master side is at 16 MHz.
184.108.40.206 HI and Protons Beam Test Results
The MSTCLK was exercised at two frequencies (2 and 16 MHz). In both cases, among the six expected types of errors, only two have been observed: errors from type 2 and 6. The latter was always combined with a difference between the Din and Dout signals lasting for more than 100 clock cycles. Only toggling the PLL POWERDOWN signal could restart the operation of the PLL in that case. As shown in Fig. 19, the test results indicate little variation between the cross-sections of error-type 6 obtained at both test frequencies (2 and 16 MHz). Error type 2 has been observed only at 16 MHz (frequency of the master FPGA). The LETth
for this type of errors is shown in Fig. 19 to be around 32 MeV-cm2/mg. This value might seem high if the SET on the clock signal generated from the PLL occurred on the FG switches that links this signal to the tripled DFF. However, it might be expected if it is related to the internal PLL circuit. Only collecting more data could clarify this point. The saturation cross-section of the PLL in LOCK mode is 10-5 cm2.
Finally, no SEE was observed on the PLL during beam irradiation tests for a fluence of 9x1010 of proton particles having energy of 63.5 MEV, which was expected considering the low sensitivity of the FPGA core itself.
4.3.3 Flash-ROM (FROM) memory SEE characterization
220.127.116.11 Test Design
ProASIC3 devices have 1 kbits of on-chip nonvolatile Flash memory that can be read from the FPGA core fabric. The Flash ROM is arranged in 8 banks of 128 bits during programming. The 128 bits in each bank are addressable as 16 bytes during the read back of the FROM from the FPGA core. The FROM will be configured initially with a pattern that reflects the byte address and the master FPGA will be simply checking its content. The frequency of the FROM read was varied between 2 and 16 MHz to check the speed effects and quantify the number of SETs that had occurred during the beam testing. The FROM was read during and after irradiation. In beam, each FROM address was read 3 times successively to avoid counting SEE on the peripheral gates (7 DFF automatically connected to FROM address bus, 8 DFF connected at the data outputs, routing switches and active regions of the IO pads).
18.104.22.168 HI and Protons Beam Test Results
The data showed no observable SEE sensitivity on the FROM during beam irradiation tests for LET < 83 MeV•cm2/mg (Fig. 20) and for a fluence of 9x1010 of proton particles having an energy of 63.5 MeV. This demonstrates the SEE hardness of the embedded FROM and opens its possibilities for space applications; for example it can be used as a boot memory for the embedded processors in the A3P FPGA.
4.3.4 SRAM memory SEE characterization
The selected ProASIC3 devices (A3P250 and A3P1000) have embedded SRAM blocks along the north and south sides of the devices. To meet the needs of high-performance designs, the memory blocks operate strictly in synchronous mode for both read and write operations. The read and write clocks are completely independent and each may operate at any desired frequency up to 350 MHz. To have better statistics, an A3P1000 was used as the DUT, which has 144 Kbits of SRAM bits, four times more than that in an A3P250.
During beam-test experiments, the “master” FPGA initially writes a checkerboard pattern into the embedded SRAM and continuously checks its contents. When an upset is detected in the SRAM bits, the upset counter is incremented and the memory content is flipped back. Note that for ease of implementation, only one organization of SRAM was used: “RAM512x9”. In the DUT design, all the logic used to interface with the SRAM, such as IOs, address decoder, read and write signals of the 32 SRAM blocks, are TMR’d and therefore mitigated to SEE. This means also that only SEE on the SRAM will be counted. This should avoid the overestimation of the SRAM SEE cross-section due to the SEE sensitivity of other programmable circuits used in the DUT test design. In this test, the maximum SRAM frequency is 16 MHz. The block diagram of the test design is given in Fig. 21.
The test results show no SRAM SEE cross-section dependence on the frequency, indicating that most of the SET effects on the peripheral combinational logic are filtered out and only SEU on the SRAM blocks are counted. Also, no MBU were observed in the SRAM bits. Measured SEU cross-sections are given in Fig. 22. The saturation cross-section is approximately 4.2210-8 cm2/SRAM-bit.
The LET threshold is around 0.5 MeV-cm2/mg, which is considered very low, but correlate well with the published SEU cross-sections of the Virtex-II configuration bits from Xilinx, since they are also based 0.13-µm SRAM bits [Rezgui et al., 2004]. It should be mentioned also that additional testing should be done to find out about MBU in the SRAM blocks. Static tests should be used where the SRAM is read at the end of each run preferably irradiated at low fluxes to avoid hiding some of the bit-errors because of multiple hits. SEE mitigation solutions for the SRAM, based mainly on EDAC approach such as the one employed for the SRAM of the RTAX-S FPGAs [Wang et al., 04b] have been implemented and are ready to use for the RT3P products.
Finally, in comparison with the other FPGA resources, the embedded SRAM blocks when operated at 16 MHz, showed an SEU cross-section in protons beams, for a cocktail of energies of 63.5, 30, 19.5 and 16.5 MEV. The obtained results are shown in Fig. 23. Additional tests shall be performed to establish the threshold proton energy to induce upsets in the SRAM bits.
5. Preliminary studies of TID effects on SEE sensitivities
5.1 Proton characterization of the programming and erase circuitry
One major advantage of the Flash-based FPGAs compared to the previous generation of ACTEL FPGAs, based on the Antifuse technology, is the re-programmability feature. However, during erase and reprogramming of the part, high voltages are applied (±17.5 V) and one might think that there is a risk of permanent damage on the FG cells or other overhead circuitry if an ion hit during that mode. Therefore, radiation test experiments during the erase and the programming of this part are required to measure the SEE sensitivity of this specific part of the FPGA (charge pumps) and the overall consequences from an ion hit.
Ten A3P250-PQ208 circuits have been exercised in proton beams during the erase, reprogramming and verification of the programmed FG cells. The shift register design using 98% of the FPGA logic tiles (A3P250-PQ208) was used as a reference design. For each beam run, consecutive erase, reprogramming and verify cycles are launched and the functionality of the design is always checked at the end of each run. At least four full cycles of erase, program and verify cycle are executed during each beam run; each cycle requires 41 seconds. Each run exposes a new DUT to a dose of 13.4 Krad due to proton beam exposition and uses a fluence of 1011 of proton particles. Table 3 summarizes the obtained results.
Three types of behavior have been observed during the proton irradiation testing, as summarized in Table 3. Type 1 is showing the case where four erase, programming and verifying cycles have been performed without any failure including the design’s operation. Type 2 shows the one case where only one verifying failure has been observed (second cycle), which could be due to the programming of false information in the FG cells (ON state instead of OFF state and vice versa). This type of errors was easily mitigated by running a second cycle of erase, reprogramming and verifying of the FG cells allowing the DUT to recover normal operation and has a cross-section of 10-12 cm2/FPGA. Type 3 is the one where a fifth cycle was started and did fail because we reached a dose of 13.4 Krad, which is considered high for the normal operation of the charge pump circuit, according to TID tests in gamma-rays at DMEA, shown above in the Section 3 and also considering the high dose rate exercised in this case (58 rad/s).
During all these runs, there was no permanent damage on the circuit and all errors that have been observed during these test cycles disappeared after annealing. Indeed, the two parts that have failed programming on the 5th time recovered functionality after annealing of the DUT at room temperatures for many days. Although these preliminary results are encouraging and since the annealing effects on the floating gates are still under study, it is well-advised to avoid erasing and reprogramming the DUT in or off-beam after its exposure to a dose higher than 16 Krad. This statement is valid only if the applied dose rate from heavy ions, protons or gamma is around 50 rad/s as required by the JEDEC test standards [MIL-STD-883G, TM1019.7]. In the case of the actual protons testing, the dose rate was around 58 rad/s, which might explain the observation of some failures on the 5th cycle of erase and programming at 13.4 Krad. Also the cross-section of writing wrong information (10-12 cm2/FPGA) could be fundamentally due to the very little SEE sensitivity to protons of the A3P FPGA. Heavy ion data is hence required to confirm that no catastrophic failures could result from programming and erasing in beam since the FPGA’s SEE sensitivities under HI irradiation are much higher relative to the proton sensitivity.
5.2 Testing beyond the TID limit
Most of the collected data for the measurements of the SEE cross-sections in this chapter has been obtained for TID less than 25 Krad in gamma-rays. Data provided in the Section 3, showed the TID performance of this device to be 16 Krad for the programming and erase circuitry and 22 Krad for the FPGA core itself (the FG cells). For the latter, the TID performance was mainly obtained when a degradation of 10% in the propagation delay of the logic tiles configured as a chain of buffers is attained, but no permanent damage on the FPGA was noted.
The purpose of this new specific test is to check the designs’ functionality and their SEE performance for TID higher than 25 Krad as well as the maximum TID to which the design is still functional. The SRAM test design was selected for this study, since it uses various resources of the FPGA: 8.24 % of the FPGA logic tiles (configured as combinational or sequential logic), 100 % of the embedded SRAM memories, the embedded PLL and FROM and 44 % of the IOs. This design was also selected because of the SRAM high SEE sensitivity compared to the other FPGA resources, which could help monitoring the functionality and the SEE cross-sections if they do increase.
The DUT was exposed to beam for 5 consecutive runs, each at a fluence of 4x1010 of 16.5 MeV proton particles. This corresponds approximately to a TID of 15 Krad per run, and to a total of 75 Krad for the five runs. During all these runs, the DUT design was functional and the error cross-section per run was consistent without any noticeable increase in the SEE sensitivities as shown in Table 4. It should also be noted that for all of the five runs, the detection of errors stops with the end of the beam time. This confirms that the FG cells are still functional upon a TID of 75 Krad. However, upon the start of the 6th run, the design stopped functioning, which could be due to a high charge loss in the FG cells. After four months of annealing in room temperature, the design did recover functionality but not the reprogramming capability. Time is needed to check if more annealing time will allow the recovering of the full operation of the charge pumps needed for the FPGA re-programming.
It should also be stated that an accurate estimation of the TID effects on the SEE cross-sections requires a better measurement of the accumulated dose. Indeed, until today, only gamma rays could provide an accurate measurement of the exposed dose and therefore it would be advised to expose the part to a certain dose in gamma rays and then measure the SEE cross-sections, within 2 hours or few days if transported in dry ice to avoid annealing effects.
In addition, it should be mentioned also that among the 60 parts, tested in all the HI experiments, 59 of them have recovered the DUT programming and erasing capabilities after many months of annealing in room temperature and did never loose functionalities in or off-beam. The TID for the 59 parts varied between 5 and 40 Krad. The only DUT that did not recover yet the programming capability was exposed to a TID of 41.5 Krad. Knowing that after annealing, we could erase this part led us to assume that we might need more time to be able to reprogram it again. On the other side, all of the 24 parts that have been tested in protons could be erased but seven of them could not be reprogrammed. Time is needed to make sure that the seven remaining parts will recover this feature.
The main conclusion from these test experiments is that most of the tested parts did recover the programming and erase features after annealing in room temperature for many months. None of them lost functionality for dose that approximate 40 Krad even at the highest LET (83 MeV-cm2/mg) or 63.5 MeV in protons. It is clear though that the recovering of the erase functionality is much quicker than the recovering of the programming capability. This is certainly not a quantitative study but rather qualitative to make sure that there is no permanent damage from HI or protons on the part due to TID. Additional testing is hence mandatory to calculate accurately the annealing effects on the FG cells and the circuitry used for the erase and the reprogramming of the FPGA. More work has been done since to show and explain the annealing effects on the Flash-memories [Bagatin et al., 09].
This chapter detailed the extensive radiation tests of the new Radiation-Tolerant Flash based-FPGAs (RT ProASIC3) to determine its sensitivities to TID and SEE as well as some suitable methodologies for its mitigation to these effects. Based on the measurements of the degradation in the propagation delay of an inverter-string, the TID performance of the RT3P was characterized to be 22 Krad. However, if programming in space is allowed then the TID limit of this part can be improved to 40 Krad. Note that safe reprogramming of the RT3P FPGAs is allowed only till 16 Krad because of the TID effects on the programming control circuits.
Furthermore, the obtained results from the SEE characterization showed some radiation sensitivity in most of the programmable architectural features of the FPGA; the exception is the embedded FROM, which is very radiation hard. If mitigation solutions of TMR and SET filtering are adopted for the logic and clock in A3P FPGA, the only remaining cross-section would be due to the transient event on the IO banks used for SE or LVDS IOs observable mostly at high frequencies. On the other hand, if a complete SEE immunity is required at high frequencies (50 MHz and above), triplication of IOs is mandatory in addition to their separation on three different IO banks. Finally, as expected for a non-volatile FPGA, no observed error-event required a reconfiguration of the Flash-based FPGA nor were there any destructive SEE events even during the erase, the programming and the verifying of the FPGA. SEU mitigation by software user-selective-TMR and software Intellectual Property (IP) to implement EDAC for the embedded SRAMs are available to the user of the Radiation-Tolerant Flash-based FPGAs, guaranteeing its full-immunity to SEUs.