Click to edit Master Title

1
The Effect of Neutrons on Programmable Digital
Logic Devices In Avionics Applications
John P. Bendekovic Director, WW
Aerospace Sales and Bus. Devt.
[phone] (Office) [phone]
(Cell) john.bendekovic_at_actel.com
2
Agenda

• Definition and quantification -- Neutrons and
  avionics
• Programmable Logic -- Who uses it, why you
  should care
• Soft vs. firm errors -- Device physics,
  and what happens
• Test approaches, data and system-level impact
• Honeywell/LANL/FAA
• iRoC
• Competitive
• Conclusions and recommendations

3
Earth AtmosphericSingle Event Effects

• Galactic cosmic rays and solar rays hit the
  earths atmosphere, penetrate and produce
  particle cascades
• Therefore Single Event Effects will also occur
  within the Earths Atmosphere
• First recognized in 1980s
• Aircraft
• Ground based systems
• The probability is a function of
• Device physics
• Physical Location of the device
• Altitude
• Latitude and Longitude

Source IBM, Journal of Research
Development Terrestrial Cosmic Rays and Soft
Errors
4
Neutron Models Flux vs. Altitude
1-10 MeV Atmospheric Neutron Flux
Military Avionics
Commercial
Commercial Avionics
1-10 MeV Neutron Flux (n/cm2/s)
Eugene Normand Boeing Company
Altitude ( Thousands of feet)
5
FPGA Market Trends

• FPGAs continue to capture traditional ASIC
  designs due to
• No Expensive NREs
• Short Lead Times
• Need for Flexibility
• Increased FPGA Density

27
17
FPGA Share of Logic Market
Source SemiCo 3/02
FPGAs are now the ASIC of choice for moderate
volume production runs or for rapid product
introductions. Actel is the Military Aerospace
Industrys leading supplier of programmable logic
Space Digital Logic, MIL/Civ. Avionics,
Strategic/Tactical Weapons
systems commitment continues.
6
Comparing Secure 1 Million Gate
Reprogrammable FPGAs
Volatile
Non-Volatile
The SRAM Secure Solution
The Actel Solution

• 1 ProASICPLUS
• OR 1 AntiFuse part
• 20 year data retention
• OR Unlimited (antifuse)
• Small form factor
• Live at power up
• Low power

• 1 SRAM FPGA
• 3 Boot PROMs (or on-board processor ROM
  for code storage)
• 2 Batteries (Primary Backup- 5 yr. life)
• 1 CPLD (Power up sequencing) or Actel

7
Military and Avionics Flight Heritage Examples
Tactical Missiles Commercial Aircraft Military
Aircraft Military Ground Vehicles Military
Systems AIM 9X Sidewinder 737 F-22 Bradley
Fighting Vehicle ATACMS Hellfire 747 KC-135 M1
Abrams TACMS Brimstone 757 Apache TADS/PNVS
Patriot 767 F-117 WCM PAC-3 777 CH-60 La
ntirn GBI Dash-8 400 B1B IFCS THAAD Airbus
319, 320,321,340, 380 Lamps AITG MLRS NimRo
d ESAF Longbow E2C ALQ135 Harpoon F-16
AAQ24 Commanche ATIRCM JSF IDECM
F-14 A-10 F-15 F-18 C-130
8
Actel Aerospace FPGA Product Categories
SPACE Radiation-Hardened (MIL-PRF-38535 QML V/Q
RH1280, RH1020) Radiation-Tolerant (RT1020,
RT14xxx, RT1280, RTSX, RTSX-S, RTAX-S) Lot-speci
fic TID Radiation Testing MIL883B and
S-Equivalent Actel E Flow Enhanced Screening
(883B) MILITARY/AVIONICS MIL-STD 883B Flow
devices, Hermetic Packages QML
Mil-Temp/Mil-Grade, Plastic Packages (100 Full
Mil Temp Tested) DIE SALES Mil-Temp
sorted, RT and RH

9
Firm Errors Real Problems

• Neutron Induced Errors in Programmable Devices

10
Soft Firm Errors

• Soft errors are neutron induced memory upsets,
  data is changed but the memory cell is not
  damaged
• Firm errors are caused by neutrons striking
  FPGA configuration memory cells
• SRAM and DRAM data-storage memory Soft Error
• SRAM-FPGA configuration memory Firm Error
• Errors are Firm because they are not transient
  errors Error stays until detected and cleared!

High Energy Neutron
Oxide Insulation
Gate
Drain
Source
N
N
-
-

-

-


-

-
P Substrate

-

Heavy Particles from Neutron Impact cause Trail
of Ionization
Depletion Region
Actels Flash and Antifuse based FPGAS are immune
to firm errors
Charged particles originate from a variety of
sources including cosmic rays and alpha particles
from packaging contamination- they cannot be
eliminated!
11
Firm Errors Have Serious Impact on SRAM FPGA Logic
LUT Configuration SRAM
LUT for OR 3 Logic
1
1
1
1
1
1
1
0
A
A
1 0
1 0
1 0
1 0
B
B
1 0
1 0
C
C
Neutron/Alpha
1 0
Configuration SRAM
1
1
1
1
1
1
1
Q
A
B
Q
C
12
SRAM Soft Errors vs. Firm Errors
GRM
Neutron or Alpha-induced soft error causes
transient data corruption in block RAM. Can be
corrected with EDAC
Block RAM
CLB
Neutron or Alpha-induced firm error causes
configuration corruption Requires device reload
or system-level reset
GRM
Block RAM
CLB
13
Firm Errors Have Serious Impact on SRAM FPGA
Routing
Incoming neutron or Alpha particle causes firm
error in GRM
Firm error leads to . . .
GRM General Routing Matrix
or missing signal
misrouted signal
14
Nanometer Processes Increase Probability of Firm
Errors
SRAM Cell Size Continues to Scale ?0.5 x per
Generation
Smaller RAM cell with low charge is easily upset
by a random low energy particle Greater
percentage of neutrons can now generate
sufficient energy to cause a firm error
(µM2)
(µM)
Smaller SRAM Cell Increased Susceptibility to
Firm Errors
15
How Serious are Firm Errors?

• In SRAM-FPGAs, Firm Errors can potentially have
  serious system impact
• At a minimum, the configuration data must be
  reloaded to recover
• Can take many clock cycles before configuration
  loss is discovered
• In many cases, the device must be power-cycled to
  clear the logic error
• May involve a complete system reset
• High current due to contentions in a
  mis-configured device may damage device or board
• Simultaneously-enabled tie-offs to power and
  ground, bus contention, etc. may occur

Firm Errors are Much More Likely at Nanometer
Technologies!
Source SemiCo 2002
16
Market Segment Impact of Neutron Induced Errors
90nm
Relative System Soft Error Rate
Neutron induced errors are now impacting a wide
market segment - No longer a space problem
SourceSemico 6/02
17
Xilinxs Own Neutron Test Results

• Xilinx MAPLD 2003 Paper
• Presented in Washington, DC in September 2003
• Rosetta testing real-time, real-world
  exposure of Xilinx parts to atmospheric neutrons
• Rosetta details
• Three facilities one at sea level, one at 5K ft,
  one at 12K ft
• Each with 100 units XC2V6000
• Configuration read-back every 2 hours
• Total of 1.4M device-hours accumulated
• Observed total of 46 configuration errors for all
  facilities
• 24 config errors observed after 208K device hours
  at 12K ft
• 18 config errors observed after 865K device hours
  at 5K ft
• 4 config errors observed after 325K device hours
  at sea-level
• IMPORTANT---
• Xilinx confirmed configuration upsets with their
  own parts
• Not only at altitude but also at sea-level!

18
Xilinx Rosetta Test
19
Actel Neutron Testing (FAA)

• Actel / Honeywell / Los Alamos National Labs
• Testing completed October 20, 2003
• Average neutron fluence per device
• 3.2E10 n/cm2 (gt1.5MeV)
• 1.7E10 n/cm2 (gt10MeV)
• Fluence per device equivalent to
• 1.35E5 years at Sea Level
• 932 years at 30,000 ft
• 207 years at 60,000 ft
• A54SX32A
• No configuration upsets or latch-up observed
• APA750
• No configuration upsets or latch-up observed
• Formal report is available on Actel web site
• http//www.actel.com/documents/LANSCETestReportWP.
  pdf

20
iRoC Test Program

• Methodology
• FPGAs filled with combinatorial-only designs
  (eliminate data SEUs)
• Monitor outputs for anomalous behaviour
• Periodically read back configuration files and
  check for corruption (SRAM-FPGA only)
• Phase 1
• Narrow spectrum (14MeV) testing at IRI, Delft,
  Holland
• Actel AX1000, Actel APA1000, Xilinx XC2V3000
• Testing completed December 19, 2003
• JESD-89 compliant test methods
• Phase 2
• Broad spectrum (1MeV to 1000MeV) testing at LANL
  / LANSCE
• Actel AX1000, Actel APA1000, Xilinx XC2V3000,
  Xilinx XC3S1000, Altera EP1C20
• Testing completed for February 2004
• JESD-89 compliant test methods

21
iRoC Phase 1 Results (Delft, Holland, Dec 03)

• Actel AX1000
• Each device tested to up to 1.83E11 n/cm2 at
  14MeV
• 1.83E11 n/cm2 equivalent to 2,280 years at
  60,000 ft
• No device configuration upsets observed
• Actel APA1000
• Each device tested to up to 1.01E11 n/cm2 at
  14MeV
• 1.01E11 n/cm2 equivalent to 1,259 years at
  60,000 ft
• No device configuration upsets observed
• Xilinx XC2V3000
• Each device tested to up to 1.5E9 n/cm2 at 14MeV
• 1.5E9 n/cm2 equivalent to 19.0 years at 60,000
  ft or 83.0 years at 30,000 ft
• 2920 configuration upsets detected by
  configuration read-back
• 420 logic errors observed 11 to 25 errors per
  device per test run (4 test runs, 6 devices on
  each run)
• Equivalent logic error FIT rates Sea Level 682
  FITs 30,000 ft 3,045 FITs 60,000
  ft 4.45E5 FITs
• Also one instance where power cycle was needed to
  reconfigure FPGA

22
iRoC Phase 2 Results(Los Alamos, Feb 04)

• Preliminary results from the neutron testing
  performed at Los Alamos by iRoC Technologies are
  in. They are as follows
• Axcelerator AX1000 - no neutron induced
  configuration errors
• (as expected)
• ProASIC Plus APA1000 - no neutron induced
  configuration errors
• (as expected)
• Virtex2 - XC2V3000 - neutron induced logic
  errors detected, 1100 FITs (normalized for
  sea level)
• Spartan3 - XC3S1000 - neutron induced logic
  errors detected, 340 FITs (normalized for
  sea level)
• Cyclone - EP1C20 - neutron induced logic errors
  detected, 450 FITs (normalized for sea
  level)
• The FIT rates on Spartan3 and Cyclone are lower
  than the Virtex2 FIT rate, which is to be
  expected because the Virtex2 devices tested had
  significantly higher gate count.
• FIT rate increases significantly as altitude
  increases - by a factor of almost 700 at 60,000ft.

23
Example Using Xilinx Rosetta Data

• An avionics system uses 4 Xilinx XC2V1000 FPGAs
• 4,000 systems are deployed (for example
  commercial airliner)
• One failure per XC2V6000 every 8,683 hours
• XC2V1000 (1MGates) uses 5.35 X fewer config bits
  than XC2V6000
• Results in one configuration upset per XC2V1000
  every 46,456 hours
• Since 4 parts per system
• One config upset per system every 11,614 hours
• Since 4000 systems to be deployed
• One config upset every 2.9 hours
• Our data indicates that 1 in 7 config upsets
  results in logic failure
• One logic failure every 20.3 hours
• But, Xilinx only tested at 12K feet
• Neutron flux is 11X stronger at 30K ft
  (commercial aviation) than at 12K ft
• One field failure every 1.9 hours at 30K feet
• If every plane flies just two 4-hour flights per
  day
• Thats 4.2 failures EVERY DAY!

24
Example Using iRoC Data

• An avionics system uses 4 Xilinx XC2V1000 FPGAs
• 4,000 systems are deployed (for example
  commercial airliner)
• iRoC testing equates to
• 108 device-years at 60,000 ft
• 484 device-years at 30,000 ft
• 70,250 device-years at sea level
• 420 logic failures over 484 device-years at
  30,000 ft
• Failure rate per XC2V3000 1 failure every 421
  days
• XC2V1000 has 3.73 X fewer config bits than
  XC2V3000
• Results in one logic failure per XC2V1000 every
  1570 days
• Since 4000 systems to be deployed, with 4 FPGAs
  per system
• One field failure every 2.4 hours at 30,000 feet
• If every plane flies just two 4-hour flights per
  day
• Thats 3 failures EVERY DAY!

25
Do All Config Errors Count?

• Xilinx argues that fewer than 1 in 10 config
  errors affect logic
• Los Alamos / BYU refuted that claim at MAPLD 2003
• Experiments inject random errors into the
  Xilinx config bitstream, and then measure whether
  config errors result in functional failures
• Researchers identified multiple types of config
  bits which could cause functional errors
• Researchers identified ways in which config bits
  which are not part of the design can cause
  functional errors if upset
• Some config errors can prevent successful config
  read-back
• Example Neutron Single Event Upsets in SRAM
  Based FPGAs (Ohlsson, Dyreklev, Johansson Saab
  Ericsson Space, Alfke - Xilinx)
• iRoC testing shows 1 in 7 config errors affect
  logic
• 420 logic errors out of 2940 configuration errors
• Do you want to take a chance that when a neutron
  causes an upset, its going to be in a
  non-critical cell?

26
SRAM FPGAs Vulnerable

• Xilinx 0.15µ / 0.13µ product recall
• Solder used in flip-chip causing configuration
  upsets

EETimes Online, Jan 14, 2004
27
Conclusion

• Recent test data from Xilinx, Actel and
  independent third parties has validated Actels
  position that Neutron-Induced Firm Errors are a
  major problem
• Xilinx Rosetta test results published at MAPLD
  2003 show multiple config errors that increase
  with altitude
• Configuration errors persist until they are
  detected and corrected
• Config errors can cause major system level
  problems before they can be detected and
  corrected
• Actel testing with Honeywell proves that Antifuse
  and Flash FPGAs are immune to Neutron-Induced
  Firm Errors
• iRoC testing confirms
• Antifuse and Flash FPGAs are immune to Firm
  Errors
• SRAM-based FPGAs are susceptible to Firm Errors
• High-reliability applications cannot afford to
  take a chance on SRAM-based FPGAs

28
Firm Error Summary

• All devices with SRAM-based memory are
  susceptible to errors from neutrons
• Data storage memory corruption causes soft errors
• FPGA configuration memory corruption causes firm
  errors
• This effect becomes very important at ?130nm
• 90nm is especially susceptible because of small
  cell size
• Detecting /correcting firm errors in SRAM-FPGAs
  is difficult
• Firm errors in configuration memory make
  SRAM-based FPGAs inherently unsuitable for
  high-reliability applications
• Actel FPGAs are not susceptible to firm errors
  and are an excellent solution for
  high-reliability applications
• For more information visit www.actel.com/softerror
  s