Wang-110 D/MAPLD SEU Mitigation Techniques for Xilinx Virtex-II Pro FPGA Mandy M. Wang JPL R&TD Mobility Avionics

Wang-110 D/MAPLD  Project Background  SEU Sensitive Areas and Mitigation Approaches  Design Details  Conclusion Agenda

Wang-110 D/MAPLD Project Objective Mobility Avionics project aims to develop an embedded platform for space flight instruments and systems that is scalable, configurable, and capable of withstanding low to medium radiation environments.

Wang-110 D/MAPLD Multi-Tiered Strategy Not Mission Critical Not Time Critical EDL Controller Micro-Mobility Controller Science Data Processor Image Processor Low to Medium Radiation Tolerance is Assumed Orbiter Command Data Handler Robust Strategy Simple Strategy Motor Control Science Data Processor Ground Support Equipment Always Available Strategy Time Critical Mission Critical

Wang-110 D/MAPLD Strategies Simple Strategy: A quick-and-dirty approach. It uses less than desirable techniques such as device reset and reconfiguration as a means of error correction. It may require an external computer for configuration check. Robust Strategy: A refinement of the simple strategy. It uses a SEU immune FPGA as a monitoring device for the system board base on Xilinx FPGA device. As a result, no external computer is needed.

Wang-110 D/MAPLD SEU Sensitive Areas Normalized Data – based on predicted upset rates (XC2VP20) Xilinx Virtex-II Pro SEU sensitive areas include:  PPC405 Core registers  Configuration Memory (LUT equation and Routing)  Data path Registers  User Memory (Block or Distributed RAMs)

Wang-110 D/MAPLD Mitigation Approaches

Wang-110 D/MAPLD System Design - Overview PPC405 1 PPC405 2 PLB ARB PLB2OPB Bridge OPB ARB C Crit. INTC Non-Crit INTC DDR SDRAM Cntl UARTs (External Devices) EXT MEM (128MB) OCM BRAM (8K) Serial Port Decoder (Injects fault Signals) FI EDC FI Status BRAMs (4K) PLB BRAMs (Firmware) (32K) EDC Controller FI EDC

Wang-110 D/MAPLD Dual-processor Comparator PPC 405 Block 1 Cache Units PLB Bus MMUCPU Timers and Debug PPC 405 Block 2 Cache Units MMUCPU Timers and Debug Arbiter DDR SDRAM Controller C PLB IPIF External SDRAM Note: Yellow lines: PLB master read / write signals for D-Cache Green Lines: PLB master read signals for I-Cache FI : Fault insertion point PC : Parity Check Off Chip Area FI PLB IPIF FI

Wang-110 D/MAPLD Dual-Processor Voting Simulation

Wang-110 D/MAPLD EDAC OCM BRAMs (Read/Write) Parity Encoder Error Detection Correction PPC405 #1 PPC405 #2 BRAMS (8KB) Glue Logic ENCIN DECOUT ERROR FORCE ERROR PARITY_OUT PARITY_IN ENOUT DECIN  Hamming Code [32,39]  Read-modified-write to support byte enable feature  Error information is stored in a separate memory space  Single-bit error triggers a CPU interrupt  Double-bit error triggers a CPU reset Xilinx XAPP645 Data Out (discard parity bits) ADDR EN W_EN[3:0] CLK

Wang-110 D/MAPLD EDAC PLB BRAMs (Read Only) Parity Encoder Error Detection Correction BRAMS (32KB + 8 KB) ENCIN DECOUT ERROR FORCE ERROR PARITY_OUT PARITY_IN ENOUT DECIN  Hamming Code [64,72]  Read-modified-write to support byte enable feature  Single-bit error is stored in a separate memory space  Single-bit error triggers a CPU interrupt  Double-bit error triggers a device reconfiguration Xilinx XAPP645 Data Out (discard parity bits) ADDR EN W_EN CLK Processor Local Bus 64 Glue Logic 2 2 PLB BRAM Controller PLB Interface

Wang-110 D/MAPLD EDAC DDR SDRAM  Hamming Code [64,72]  Read-modified-write to support byte enable and burst of 2-words features  Single error is stored in a separate memory space  Single error triggers a CPU interrupt  Double error triggers device reconfiguration Parity Encoder Error Detection Correction DDR SDRAM (128MB + 32MB) ENCIN DECOUT ERROR FORCE ERROR PARITY_IN DECIN Xilinx XAPP645 ADDR CLK Processor Local Bus 64 Glue Logic CLKn 4 4 DDR SDRAM Controller Mux Demux 64 8 PARITY_OUT ENOUT 8 64 Mux Data Out (discard parity bits) 32 PLB interface modules

Wang-110 D/MAPLD Self Configuration Checker ICAP Controller ICAP CRC Checker Frame Address Memory (BRAMS) 4 Bytes Read Back Commands ( 44 Bytes) Virtex-II Pro Implementation C script top.ll (contains frame address used for the design) Frame address data formatted for BRAMS (BRAMS) Digital Design top.bit This portion can be ported to a radiation-hardened FPGA in the case of robust strategy

Wang-110 D/MAPLD Self Configuration Checker Design Highlights  No External I/Os access required  Frame-by-frame read back required  32-bit CRC algorithm implemented. (A CRC signature is generated after device power up)  No SRL16 and Distributed SelectRAMs used in design

Wang-110 D/MAPLD Labview Fault Injection Panel Screenshot of fault injection emulator that interfaces with the prototype board. Fault Injection Error Counters Process Bus Fault Injection Buttons Processors Mismatch LED Indicator Fault location map Program counter resets to zero when a CPU reset occurs. ASCII Command Input window

Wang-110 D/MAPLD XC2VP20 Device Utilization (without TMR) Number of External IOBs 57 out of % Number of PPC405s 2 out of 2 100% Number of RAMB16s 30 out of 88 34% Number of SLICEs 4334 out of % Number of BUFGMUXs 6 out of 16 37% Number of DCMs 2 out of 8 25% Number of ICAPs 1 out of 1 100% Number of JTAGPPCs 1 out of 1 100%

Wang-110 D/MAPLD Slice Utilization (without TMR) Note: The shaded modules can be replaced by other approach.

Wang-110 D/MAPLD Mitigation State Machine 1) CPU mismatch 2) CPU watchdog timer 3) OCM EDC double-bit error CPU Reset System Reset 1) OPB Bus error 2) PLB Bus error 1) Configuration check fail 2) PLB EDC double-bit error 3) DDR SDRAM double-bit error FPGA Reconfiguration Mitigation Severity 1) OCM BRAM single-bit error 2) PLB BRAM single-bit error 3) DDR SDRAM single-bit error CPU Interrupt CPU reset counter == full System reset counter == full Normal

Wang-110 D/MAPLD Conclusion  Identified and categorized error prone regions on the Virtex-II Pro into four types  Developed mitigation strategies for each region.  Radiation test on the overall system is in progress.

Wang-110 D/MAPLD Acronyms SEU : Single Event Upset FPGA: Field Programmable Gate Array LUT: Look Up Table PLB: Processor Local Bus OPB: On-Chip Peripheral Bus OCM: On-Chip Memory EDAC: Error Detect-And-Correct ICAP: Internal Configuration Access Point