RTL and Synthesis Design Approach to Radiation-Tolerant and Fail-Safe Targeted Applications Buu Huynh & Roger Do Mentor Graphics Corp.

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep Fail-Safe and Radiation Applications Have Comparable Digital Design Challenges n Radiation-Harden Design — Corner-cases design coverage — Account for adverse SEE in radiation environment n Voltage supply spikes n Clock signal spikes n Single Event Upsets (SEU) n Fault-Tolerant Design — Detect error conditions — Contain error — Recovery from error n n Fail-Safe Application Design — — Corner-cases design coverage — — Account for adverse operating environment n n Voltage supply spikes n n Multi-Clock Domain issues n n Soft Error Rates (SER) n n Fault-Tolerant Design — — Detect error conditions — — Contain error — — Recovery from error Indistinguishable Design Requirements for RTL Design Code

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep Meeting Timing Requirements at RTL n Design margin requirements — Cover corner-cases — Account for adverse effects (e.g. voltage supply, operating temperatures, extreme bandwidth scenarios, etc.) n How does a design margin requirement effect RTL design? n Check for poor RTL code which jeopardizes hardware performance — Long logic snake paths — Deep logic nesting — Combinatorial vs. registered outputs Laboratory Conditions Environmental Chamber Testing

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep n n Problem: Noisy power supply environment — — Can cause registers to change state — — Device may lock up n n Solution: Implement global reset in RTL to support system initiated device “soft reset” for fault recovery Adverse Conditions Example: Noisy Power Supply Environment Code Example: status_registers_proc: process (clk, rst_n) begin if (rst_n = '0') then -- Clear Registers, to safe state, xmitting_reg <= '0';-- when global RST is asserted done_xmitting_reg <= '0'; rcving_reg <= '0'; done_rcving_reg <= '0'; elsif rising_edge(clk) then if (xmit_flag = '1') then...

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep Adverse Conditions Example: Extreme Environments n n Problem: Extreme environment conditions n n Can cause FSM to enter error states n n Device may lock up n n Solution: Use RTL code supporting FSM synthesis which can recover from undefined states*, to support fault recovery n n Code Example: case current_state is when idle => if (rd_req = ‘1’ and pre = ‘0’) then -- read request & no precharge next_state <= READ;... when read =>... when precharge =>... when others => -- other states, including error states next_state <= ALARM; -- transition to a safe recovery state end case; * Be sure to use “safe FSM” option in the synthesis tool to keep FSM error state recovery transitions from being removed during synthesis optimizations

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep Radiation & Fail-Safe Challenge Example: Fault-Tolerant Digital Design n n Problem: SEU induced input errors into control logic n n Incomplete conditional branch code will not resolve in a predictable, controlled behavior n n Undefined conditional input state will resolve in an unknown manner, and can be synthesis run dependent n n Solution: Disallow incomplete case statement n n Code Example: case altitude_in is when GROUND => if (t_minus = FOUR_SEC) then -- run start sequence fuel_valve_cmd_s <= OPEN_SEQ;... when ELV_8K => -- throttle-down... when ELV_40K => -- throttle-up... when others => -- trap error conditions fuel_valve_cmd_s <= fuel_valve_cmd_r; end case;

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep Human Factor & Value of Coding Guidelines n Consistent quality across team members and projects n Leverages amassed knowledge base n Industry n RMM, RTL Essentials, etc n Your organization n Senior engineers, lessons learned from previous programs, etc APPRAISAL & TRAINING OPTIMIZE “Like having an expert watch over your code”

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep n Option 1: Manual HDL code reviews — Required when design specific or “topic-expert” knowledge must be applied during code review — Extremely labor intensive — Inconsistent and error-prone n Option 2: Automated HDL design checking (Linting) — Enforces standard quality level per organization’s guidelines — Standardize RTL code quality & design reuse cost metric — Reduce RTL synthesis errors — Run rules interactively throughout development — Automatically capture results as process artifact — Machine checks can not cover all design guidelines n Option 3: Combination of Automated & Manual — Leverage the strength in both methodology Assessing RTL Code Quality

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep Tool Introduction: HDL Designer A Team Development Environment for Design Assurance RTL Entry & Visualization Assurance MandatesHDL Designer Provides the Solution   10 editor types including text, graphical, and code generation, also automated visualization of RTL   Assurance provided with design integrity checks, quality assessment, and automated visualization   Automated scoring based on industry standards or company-defined coding guidelines   Synchronizes design and all associated data, linking to popular version management systems   Creates design review website with all design and associated data in exported HTML directory   Integration with ReqTracer to link the RTL implementation back to requirements Reuse Assessment Code Checking Version Mgmt Design Reviews Requirement Tracing

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep What is Synthesis? n Transformation of HDL code to gate-level implementation — RTL code input n VHDL, Verilog, SystemVerilog — Inferencing and mapping of architectural features — Structural netlist output n Default operation focuses on logic optimization n Fail Safe design considerations must be weighed against performance optimizations Program Device SYNTHESIS Place & Route RTL Design

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep Safe FSM Operation n Radiation may change one bit → invalid state n FSM must be designed with error detection & correction — Unused/unreachable states are not pruned — Safe FSM ensures valid transition to default state — FSM Implements all possible states TYPE fsm_state IS (S0, S1, S2, S3); SIGNAL current_state :fsm_state; SIGNAL next_state:fsm_state; … IF (RST=‘1’) THEN current_state=S0; … PROCESS (S0, S1, S2, S3) BEGIN CASE current_state IS CASE current_state IS WHEN S0 => next_state next_state <= S1 … WHEN S1 => next_state next_state <= S2 … WHEN S2 => next_state next_state <= S0 … WHEN others => next_state next_state <= S3; END PROCESS; Safe FSM. Transition to Default state ?? (0101) Invalid State Default S3 (1000) State defined for error reporting S0 (0001) S1 (0010) S2 (0100) States defined for normal FSM operation Reset

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep Redundancy Methods n Redundancy mitigates effects of a circuit failure n Uses replication and voting mechanism n 3 Methods Available 1. Combinatorial-Combinatorial (C-C) mapping n Combines two combinatorial cells with feedback as opposed to using flip-flop 2. Triple Module Redundancy (TMR) 3. Triple Module Redundancy & C-C mapping

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep TMR Example Before TMR After TMR Supports design assurance but produces dramatically larger circuits (goes against optimization goals)!

BH/RD, MAPLD 2009 – RTL & Synthesis for Rad-Hard & Fail-Safe App, Sep Tool Introduction: Precision ™ Synthesis Vendor Independent FPGA Synthesis for Fail Safe Design Meet Performance Requirements n Mixed language support for VHDL, Verilog, SystemVerilog, and EDIF n Advanced logic inferencing & optimization n Physical synthesis Design Analysis n Interactive static timing analysis n Design debugging and cross-probing Increasing Productivity n Incremental design flows n Resource management Fail Safe Design Considerations n Safe state machines n TMR support n Radiation-hardened device support n Verifiable results n Deterministic netlist for repeatable results FPGA Vendor Independent Concept Design RTL Design SYNTHESIS Place & Route Program Device Requirements Planning Debug Hardware Verification