Application Engineer’s View Brendan Bridgford Xilinx Aerospace and Defense

Avoiding Timing Problems in TMR Designs - 1 TMR systems in re-configurable devices have special timing needs 1. State machines: Voter insertion creates cross-domain timing paths

Non-TMR State Machine Timing Constraints The data path FROM synchronous elements TO synchronous elements … on the CLK net must be constrained NET clk TNM_NET = “CLK”; TIMESPEC “TS_CLK_IN” = PERIOD “CLOCK_IN” 10ns;

TMR State Machine Timing Constraints CLK_TR0 CLK_TR1 CLK_TR2 Now, the data paths FROM synchronous elements in EACH clock domain TO synchronous elements in EACH clock domain … must be constrained

TMR State Machine Timing Constraints CLK_TR0 PROBLEM: Three independent period constraints won’t cover cross-domain paths. NET CLK_TR0 TNM_NET = “CLK_TR0”; TIMESPEC “TS_CLK_TR0_IN” = PERIOD “CLK_TR0_IN” 10ns; NET CLK_TR1 TNM_NET = “CLK_TR1”; TIMESPEC “TS_CLK_TR1_IN” = PERIOD “CLK_TR1_IN” 10ns; NET CLK_TR2 TNM_NET = “CLK_TR2”; TIMESPEC “TS_CLK_TR2_IN” = PERIOD “CLK_TR2_IN” 10ns; CLK_TR1 CLK_TR2

TMR State Machine Timing Constraints CLK_TR0 SOLUTION: Use “related” PERIOD constraints NET “clk_TR0” TNM_NET = “clk_TR0”; TIMESPEC “TS_clk_TR0” = PERIOD “clk_TR0” 10ns; NET “clk_TR1” TNM_NET = “clk_TR1”; TIMESPEC “TS_clk_TR1” = PERIOD “clk_TR1” TS_clk_TR0 * 1.0; NET “clk_TR1” TNM_NET = “clk_TR2”; TIMESPEC “TS_clk_TR2” = PERIOD “clk_TR2” TS_clk_TR0 * 1.0; CLK_TR1 CLK_TR2

Avoiding Timing Problems in TMR Designs - 2 TMR systems in re-configurable devices have special timing needs 2. PCB-induced phase shift between clock domains must be minimized

Phase shift between Clock Domains - Description Clock Net FPGA Ideally, all clock domains are in perfect phase alignment In practice, clock domains can be phase shifted with respect to each other - due mainly to PCB layout – “external” factors - “internal” factors can only contribute a few picoseconds Clock Pulse (ideal) Clock Pulse (actual)

Phase Shift between Clock Domains - Consequences If clock domains are grossly out of phase, voter output will be momentarily incorrect for a portion of each clock cycle. -TMR State Machines may not operate correctly -Even if design operates correctly, SEU immunity will be reduced Clock Net FPGA Output VOTER

Phase Shift between Clock Domains - Solution -Ensure redundant clock traces are of equal length! -Signal Integrity simulation should be performed to ensure that clock arrivals are as close as possible. Clock Net FPGA Output VOTER