1. Reprogrammable Flash-based FPGA on EUCLID mission
11/04/2018 SEFUW
Reprogrammable Flash-based FPGA on EUCLID mission
Raoul Grimoldi (OHB-I)
Luca Sterpone (POLITO)

2. EUCLID spacecraft will host 2 instruments:
Euclid mission overview
EUCLID is a cosmology mission part of Cosmic Vision whose prime objective is to study the geometry and the nature of the dark Universe (dark matter, dark energy).
The mission will investigate the distance-redshift relationship and the evolution of the cosmic structures by measuring shapes and redshifts of distant galaxies.
EUCLID space segment will be a spacecraft placed into an orbit around L2 with a coverage of 15,000 deg2 in 6.25 years with step and stare observation strategy. Launch is planned for 2020.
EUCLID spacecraft will host 2 instruments:
NISP (Near Infrared Spectrometer Photometer)
VIS (VISble imager)

3. Euclid mission : Instruments Data Processing Units
OHB-I is in charge of the design of the Data Processing Units HW for both NISP and VIS as part of the Italian contribution to EUCLID mission
1 CDPU unit for VIS
2 DPU/DCU units for NISP
NISP DPU/DCU units
VIS CDPU unit

4. FPGA devices
Both units make large use of functions implemented in FPGA devices
Unit
FPGA devices
Types
CPDU 10
RTAX2000S
DPU/DCU
(single unit) 8
RT3PE3000L

5. SEL immune up to 117MeV/cm2/mg TID better than 200Krad F/F with TMR
FPGA devices
Microsemi RTAX-S FPGAs are based on anti-fuse technology, widely used in space application in both NASA and ESA mission because of the high level of immunity to radiation effects :
SEL immune up to 117MeV/cm2/mg
TID better than 200Krad
F/F with TMR
Logic SEU better than 1E-10 upset/bit/day on GEO
Microsemi RT3PE3000L FPGAs are based on commercial flash technology that exhibit lower level of radiation effects immunity but is reprogrammable :
SEL immune up to 68MeV/cm2/mg
TID better than 30Krad (10% increase of propagation delay)
No SEU effects on configuration cell
D type F/Fs : Threshold 6 MeV-cm2/mg, saturated x-section 2E-7 cm2 per flip-flop

6. EDAC on the internal SRAM in order to correct single errors
Design Flow for RTAX-S
Radiation Hardening of FPGA design in RTAX-S for mission like EUCLID requires very limited effort
EDAC on the internal SRAM in order to correct single errors
Internal memory scrubbing for long term storage memory area
Safe state machine
The design flow adopted in CGS is based on tailored ECSS-Q-ST-60-02C with the following steps

7. Design Flow for RTAX-S

8. Design Flow for RTAX-S

9. Design Flow for RT PROASIC
Each DPU/DCU unit hosts 8 DCU boards, each board with 1 FPGA that implement
Reception of data stream on 8x parallel lines and pixel de-serialization
Buffering of the complete packet and CRC check
Extraction of TLM from scientific data
Coo-adding of pixels
Averaging and formatting of the coo- added frames before transmission to the memory board

10. Request of “maximum flexibility” from the science team
Design Flow for RT PROASIC
On EUCLID mission, for the FPGA implementing the interface with the detectors system, the use of a reprogrammable FPGA has been preferred for the following reasons:
Request of “maximum flexibility” from the science team
Lack of knowledge of the real behavior of the interface of the SIDECAR : unexpected behavior may require mitigation in the FPGA not known at the time of design specification
Risk of late modifications required on the FPGA design :
in case of use of RTAX FPGA, 16 identical FPGAs mounted on the 2 DPU/DCU could be impacted with high schedule/cost impact
RTPROASIC will allow the modification of the design via JTAG without opening the DPU/DCU unit and changing the device

11. EDAC on the internal SRAM in order to correct single errors
Design Flow for RT PROASIC
Radiation Hardening of FPGA design in RT PROASIC requires not negligible effort
EDAC on the internal SRAM in order to correct single errors
Internal memory scrubbing for long term storage memory area
Safe state machine
Radiation Hardening at RTL level
Radiation Hardening of the I/Os
TMR of F/Fs
SET effect evaluation
Gard Gates introduction for SET filtering

12. Implementation of independent controls for critical I/Os
Design Flow for RT PROASIC
The standard FPGA design flow is modified with the introduction of Radiation Mitigation activities
At RTL level
Implementation of local reset for the different functional blocks that can be reset before use by the SW or by the internal FPGA logic avoiding error accumulation
Implementation of independent controls for critical I/Os
Duplication of critical I/Os

13. Radiation Hardening of the I/Os
Design Flow for RT PROASIC
Radiation Hardening of the I/Os
Identification of the criticality of the I/Os of the FPGA and need for mitigation
Estimation of the probability of error due to radiation effects on the I/Os in EUCLID environment
Mitigation definition : duplication or triplication of the I/O in different banks, external filtering, …
Compatibility with Signal integrity on the board
Compatibility with the available free pins on the FPGA

14. Design Flow for RT PROASIC
The analysis has been performed with CREME using the cross sections derived from “New methodologies for SET characterization and mitigation of Flash based FPGAs”, TNS R2.  
Type of error
Error signature
Remarks
Type 1 : SET on the IO channel
Transient on the output or input
SET generated internally that is able to propagate up to the FPGA output. Will be analyzed by POLITO with SETA on the actual FPGA netlist
Type 2 : SET observed for short time involving an entire (and only one) IO bank
IO bank disabled for few ns
The IO bank has a global enable signal that is driven by combinatorial logic + latch. If the SET involves the combinatorial logic, the bank is disabled for few ns
Type 3 : SET observed for long time involving an entire (and only one) IO bank
IO bank disabled for about 250 ns
The SET involves the latch. The circuit that disables the I/Os during power-on in order to avoid high inrush current is triggered and the entire bank stay disabled for about 250 ns.
Predicted error rate due to the I/Os on EUCLID mission considering 16 FPGAs and implementation of the mitigation is

15. Before CDR Radiation Hardening on netlist is implemented
Design Flow for RT PROASIC
Before CDR Radiation Hardening on netlist is implemented

16. Preliminary steps for RH are :
Design Flow for RT PROASIC
Preliminary steps for RH are :
TMR on the F/Fs is implemented starting from the VHDL with synthesis tool Synplify
Place & Route of the FPGA is performed with Microsemi Designer
Static Timing Analysis
Functional verification with testbench on the post-layout netlist
Then the design database is provided to Politecnico of Torino for
SET analysis and GG insertion

17. Static Timing Analysis
SET mitigation flow on RT-PROASIC3
DCU VHDL netlist
Synthesis
Synplify
TMR on all the FFs is implemented starting from the VHDL with synthesis tool Synplify as baseline
Place & Route of the FPGA is performed with Microsemi Designer
Static Timing Analysis
Functional verification with test-bench on the post-layout netlist
Place and Route
Microsemi Libero SoC 11.8
Bitstream
Static Timing Analysis
Functional
Verification

18. DCU Guard Gate mitigated netlist
SET mitigation flow on RT-PROASIC3
DCU VHDL netlist
Politecnico di Torino
SEE-aware design flow
Synthesis
Synplify
Verilog
PDC
DCU Guard Gate mitigated netlist
Guard Gate
mitigation
Place and Route
Radiation Profile
Microsemi Libero SoC 11.8
SETA tool
SET report
AFL
PDC
Verilog
Bitstream
Static Timing Analysis
SET analysis performed on the original netlist
Radiation mission profile includes SETs between 0.42 and 0.49 ns
Radiation exposure during the mission is estimated as 4 Krad
Guard gate mitigation is applied selectively at the input of TMR FFs
Functional
Verification

19. The SET analysis is performed by the SETA tool
SET analysis tool and Guard Gate mitigation
The SET analysis is performed by the SETA tool
SETA is an EDA software tool that evaluates the impact of SETs on the circuit functionality
It calculates the SET propagation in all the circuit nodes
It identifies the maximal SET pulse width at the input of each Flip-Flop
0.436ns
0.4 ns
0.952 ns

20. The filtering delay is generated on the basis of the SET report
SET analysis tool and Guard Gate mitigation
Guard Gate mitigation is a software tool (named PDTmite) that automatically inserts a guard gate structure at the input of a Flip-Flop candidate to SET filtering
The filtering delay is generated on the basis of the SET report
Designer can tune the filtering capabilities
0.9 ns SET filter

21. SETA analisys and evaluation of the SET pulse report
SET mitigation flow on RT-PROASIC3 - Summary
Resource and static timing analysis of the EQM_TMR original netlist with TMRed Flip-Flops (by OHB Italia)
SETA analisys and evaluation of the SET pulse report
(I) Guard Gate mitigation insertion with 1.4 ns maximal broadening reduction
Area over-head around 8% - Timing closure failed on 30 MHz clock domain
(II) Guard Gate mitigation insertion with 1.2 ns maximal broadening reduction
Area over-head around 3.8% - Timing closure failed on 30 MHz clock domain
(III) Guard Gate mitigation insertion with 1.0 ns maximal broadening reduction
Area over-head around 1.4% - Timing closure successful.
SET analysis and evaluation of the EQM_TMR_GG netlist with guard-gate mitigation
SET maximal pulse width reduction from 3.2 ns to 1.9 ns
Functional verification successful (by OHB Italia)

22. SPW_CTRL0/space_wire1/c_rx/clk_rx SPW_CTRL1/space_wire1/c_rx/clk_rx
SET mitigation flow on RT-PROASIC3 - Step 1
Original netlist EQM_TMR with TMRed Flip-Flops
Type
Core Tiles [#]
Circuit Combinational gates
30,190
Sequential
17,718
Used resource area on the A3P3000RT is 63.65%
Static timing analysis of the EQM_TMR netlist at 4 Krad of radiation exposure
Resource Name
Frequency [MHz]
Requirement
[MHz]
Time Margin
CLK_60M
62.228
60.00
2.228
CLK_20M
32.961
20.00
2.961
SPW_CTRL0/space_wire1/c_rx/clk_rx
81.156
21.156
SPW_CTRL1/space_wire1/c_rx/clk_rx
89.791
29.791
clk_60M_buff
clk_30M
30.199
30.00
0.199

23. Single Event Transient Analysis of the EQM_TMR netlist
SET mitigation flow on RT-PROASIC3 – Step 2
Single Event Transient Analysis of the EQM_TMR netlist
Propagation of source SET pulse from all the circuit sensitive nodes
Storage of SET pulse width at the input of each Flip-Flop
Comparison of the maximal SET pulse width of each FF versus the source SET
Source SET [ns]
Totally Filtered
[#]
Partially Filtered
Broadened
0,519
11,130
6,542
0,488
0,462
0,437
11,162
6,510

24. Maximal SET pulse width [ns]
SET mitigation flow on RT-PROASIC3 – Step 2
Maximal pulse with per FF
Maximal SET pulse width [ns]
0.43ns SET Pulses are not broadened but partially filtered
Flip-Flop [#]
Original not mitigated (guard gate) SET distribution
SET pulse width has a broadening effect between 0.5 and 3.2 ns

25. SET mitigation flow on RT-PROASIC3 – Steps 3, 4 and 5
Exhaustive filtering mitigation requires 45,261 tiles which exceeds available area
Filtering of 1.4ns on most critical Flip-Flops as reasonable point to achieve area and timing closure
Three iterations of the guard gate mitigation tool, implementation and timing analisys have been made
Guard Gate Delay Coefficient
1.4ns
1.2ns
1.0ns
Frequency 4Krad
CLK_60M
69.845
68.304
69.793
CLK_20M
36.430
32.234
35.045
SPW_CTRL0/space_wire1/c_rx/clk_rx
76.840
74.435
79.764
SPW_CTRL1/space_wire1/c_rx/clk_rx
81.832
80.024
83.043
clk_60M_buff
61.430
64.780
clk_30M
27.640
29.550
31.248
Mitigated netlist EQM_TMR_PDT with TMRed Flip-Flops and Guard Gate (1.4% area overhead)
Type
Core Tiles [#]
Circuit Combinational gates
31,294
Sequential
17,718

26. Single Event Transient Analysis of the EQM_TMR_PDT netlist
SET mitigation flow on RT-PROASIC3 – Step 6
Single Event Transient Analysis of the EQM_TMR_PDT netlist
Maximal SET pulse width has been reduced to 1.9 ns
Application of placement constraints for the selected FFs guard gates
Overall reduction of SET pulse width to 0.2 and 1.9ns maximal SET pulse width
Source SET [ns]
Totally Filtered
[#]
Partially Filtered
Broadened
0,519
13,945
2,487
1,240
0,488
15,075
1,845
752
0,462
16,706
841
125
0,437
17,524
148

27. Maximal SET pulse width [ns]
SET mitigation flow on RT-PROASIC3 – Step 6
Relevant to the EUCLID space mission radiation environment
Maximal SET pulse width [ns]
Flip-Flop element
SET pulses below 0.4 ns will be electrically filtered by the FF inputs

28. Removal of 97% of the broadened SETs
SET mitigation flow on RT-PROASIC3 – Step 6
Single Event Transient mitigation comparisons between pre-filtered netlist EQM_TMR and the guard-gate filtered netlist EQM_TMR_PDT relevant for the mission profile
Removal of 97% of the broadened SETs
Remaining 3% have reduced pulse width
3.2 ns versus 1.9 ns max SET width
70% of the EQM_TMR broadened SET pulses became totally filtered

29. SET filtering methods requires timing margin
Conclusions
SEE-aware tool flow including the Single Even Transient analyzer (SETA) and the Guard- Gate mitigation (PDTmite) has been effectively applied
Nowadays a version is available with a user friendly Graphic User Interface
Results show an effective reduction of the SET phenomena but limited by the design timing closure
Mitigation of the SETs were flexibly tuned with respect of the design timing characteristics
However, a complete SET mitigation was not applicable due to timing closure
SET filtering methods requires timing margin
Further study of SET filtering methods not including delay penalty are requested
OHB Italia S.p.A. / Title of the presentation / Date

30. Conclusions
Thank you!
OHB Italia S.p.A. / Title of the presentation / Date

31. SET comparison Spare slides
OHB Italia S.p.A. / Title of the presentation / Date

32. Radiation Hardening of the I/Os
Design Flow for RT PROASIC
Radiation Hardening of the I/Os
Identification of the criticality of the I/Os of the FPGA and need for mitigation
Estimation of the probability of error due to radiation effects on the I/Os in EUCLID environment
Mitigation definition : duplication or triplication of the I/O in different banks, external filtering, …
Compatibility with Signal integrity on the board
Compatibility with the available free pins on the FPGA