Giuseppe De Robertis - INFN Sez. di Bari 1 SEU – SET test structures

Giuseppe De Robertis - INFN Sez. di Bari 2 The SEU/SET problem Red flash symbols are for SEU Blue flash symbols are for SET

Not only SEU Giuseppe De Robertis - INFN Sez. di Bari 3

4 Generic combinatorial logic x y z x F(x,y,z) F f clk y z A generic synchronus logic to make function F(x,y,z) Input registers Combinatory logicOutput register

Giuseppe De Robertis - INFN Sez. di Bari 5 SEU protection – Hamming code x y z F(x,y,z) Ff clk Input register Hamming coded Combinatorial logic Output register Hamming coded Error correction clk Encoding Error correction clk Encoding Full protection on Single bit error in each register No SET protection

Giuseppe De Robertis - INFN Sez. di Bari 6 SEU+SET protection – TMR(1)

Giuseppe De Robertis - INFN Sez. di Bari 7 SEU+SET protection – TMR(2) Full protection from SEU and SET but Need to replicate ALL register and combinatorial logic three times Need to triplicate all signals No SET protection for primary inputs

Giuseppe De Robertis - INFN Sez. di Bari 8 SEU+SET protection – TTR(1) Clock delay > FF setup+hold + Transient_max_time

Giuseppe De Robertis - INFN Sez. di Bari 9 SEU+SET protection – TTR(2) Full protection from SEU and SET Full SET protection for primary inputs Insertion can be automatized! but Need to know Transient_max_time Need to triplicate ALL register Additional delay block are needed to meet the hold time

Giuseppe De Robertis - INFN Sez. di Bari 10 Sensitive nets - CLOCK A single clock signal driving all Flip-Flops is a critical net. A transient on this net can corrupt more than one bit of a register We can use large clock drivers to minimize transient… but is not 100% safe In TTR we need in any case three indipendent clock trees In TMR we can triplicate the clock tree: a transient on one clock net will corrupt only one of the three register Flip-Flops

Giuseppe De Robertis - INFN Sez. di Bari 11 Sensitive nets - RESET A transient on global reset can corrupt more than one bit of a register We can use large buffers to minimize tansient… but is not 100% safe In TMR and TTR we can triplicate the reset signal: a transient on one reset net will corrupt only one of the three register Flip-Flops

Giuseppe De Robertis - INFN Sez. di Bari 12 Scan path In redundant circuits a single permanent fault is not detectable because it is masked from redundance. It is mandatory to use scan path to make the device factory testable Scan Enable is a critical net for SET: a transient can corrupt a lot of Flip-Flops In TMR and TTR we can use three indipendent scan chain with three Scan-Enable signals

Giuseppe De Robertis - INFN Sez. di Bari 13 TMR implementation /* Standard version */ module counter8(en, clk, resetnn); input en; input clk; input resetnn; reg [7:0] Counter; resetnn or posedge clk) if (!resetnn) Counter <= 0; else if (en) Counter <= Counter+1; endmodule // counter8 /* TMR version */ `include "tmr.v" // majority function definition // single module module counter_X(out, CounterA, CounterB, CounterC, enA, enB, enC, clk, resetnn); output [7:0] out; input [7:0] CounterA, CounterB, CounterC; input enA, enB, enC; input clk, resetnn; reg [7:0] out; // generate corrected inputs wire en; assign en = `MAJ(enA, enB, enC); wire [7:0] Counter; assign Counter = `MAJ(CounterA, CounterB, CounterC); resetnn or posedge clk) if (!resetnn) out <= 0; else if (en) out <= Counter+1; else out <= Counter; endmodule // TMR module module TMR_counter8(outA, outB, outC, enA, enB, enC, clkA, clkB, clkC, resetnnA, resetnnB, resetnnC); output [7:0] outA, outB, outC; input enA, enB, enC; input clkA, clkB, clkC; input resetnnA, resetnnB, resetnnC; // three instances counter_X CounterA(outA, outA, outB, outC, enA, enB, enC, clkA, resetnnA); counter_X CounterB(outB, outA, outB, outC, enA, enB, enC, clkB, resetnnB); counter_X CounterC(outC, outA, outB, outC, enA, enB, enC, clkC, resetnnC); endmodule // counter Source code needs a complete rewrite! This is ERROR-PRONE

Giuseppe De Robertis - INFN Sez. di Bari 14 Hamming implementation Verilog description Clock tree synthesis using only maximum size buffers

Giuseppe De Robertis - INFN Sez. di Bari 15 TTR implementation A TCL script has been used to implement TTR protection during synthesis. It performs the following tasks: 1.Replace each register with three registers using three different clocks and Resets; 2.Add the majority logic at registers outputs; 3.Modify hierarchical structure to triplicate clock and reset 4.Add at top level a clock generator and a reset generator 5.Add three scan chains with three scan-enable signals clk clkA clkB clkC reset resetA resetB resetC X X > X X

Giuseppe De Robertis - INFN Sez. di Bari 16 STRURED Blocks TTR Test HAMMING Test TMR Test In[7:0] CLK Out_TTR[7:0] Out_TMR[7:0] Out_HAM[7:0] SHIFT REGISTER [256 bits] In[0] Out_SR

Giuseppe De Robertis - INFN Sez. di Bari 17 XOR Matrix Test Block diagram Out[7:0] Control FSM In[7:0] 7:0 15:8 23:16 63:56 7:0 15:8 23:16 63:56 KEY 64 Matrix element Matrix have 26 rows of 64 bits Matrix row

Giuseppe De Robertis - INFN Sez. di Bari 18 XOR Matrix element {Key[62:0],Key[63]} Clk In[63:0] Clk KeyOut[63:0] 8 XOR cells Out[63:0]

Giuseppe De Robertis - INFN Sez. di Bari 19 Implementation comparison Protection Active area [um 2 ] GatesCells Hamming TTR TMR

Giuseppe De Robertis - INFN Sez. di Bari 20 Implementation comparison (2)

Giuseppe De Robertis - INFN Sez. di Bari 21 STRUctures for REDuntance chip TTR TMR Hamming

Test beam setup Giuseppe De Robertis - INFN Sez. di Bari 22 High energy heavy ions at the SIRAD irradiation facility of the INFN National Laboratories of Legnaro (Padova, Italy)

Measure results Giuseppe De Robertis - INFN Sez. di Bari 23 Internal stages Input registers Sat LET 0

Result summary Giuseppe De Robertis - INFN Sez. di Bari 24 UNPROTECT ED S HIFT R EGISTER H AMMING TMRTTR Sat (cm 2 /bit) 65.5· · · · LET 0 (MeV·cm 2 /mg) Internal stages