1. Wang-110 D/MAPLD 2004 1 SEU Mitigation Techniques for Xilinx Virtex-II Pro FPGA Mandy M. Wang JPL R&TD Mobility Avionics

2. Wang-110 D/MAPLD 2004 2  Project Background  SEU Sensitive Areas and Mitigation Approaches  Design Details  Conclusion Agenda

3. Wang-110 D/MAPLD 2004 3 Project Objective Mobility Avionics project aims to develop an embedded platform for space flight instruments and systems that is scalable, configurable, and capable of withstanding low to medium radiation environments.

4. Wang-110 D/MAPLD 2004 4 Multi-Tiered Strategy Not Mission Critical Not Time Critical EDL Controller Micro-Mobility Controller Science Data Processor Image Processor Low to Medium Radiation Tolerance is Assumed Orbiter Command Data Handler Robust Strategy Simple Strategy Motor Control Science Data Processor Ground Support Equipment Always Available Strategy Time Critical Mission Critical

5. Wang-110 D/MAPLD 2004 5 Strategies Simple Strategy: A quick-and-dirty approach. It uses less than desirable techniques such as device reset and reconfiguration as a means of error correction. It may require an external computer for configuration check. Robust Strategy: A refinement of the simple strategy. It uses a SEU immune FPGA as a monitoring device for the system board base on Xilinx FPGA device. As a result, no external computer is needed.

6. Wang-110 D/MAPLD 2004 6 SEU Sensitive Areas Normalized Data – based on predicted upset rates (XC2VP20) Xilinx Virtex-II Pro SEU sensitive areas include:  PPC405 Core registers  Configuration Memory (LUT equation and Routing)  Data path Registers  User Memory (Block or Distributed RAMs)

7. Wang-110 D/MAPLD 2004 7 Mitigation Approaches

8. Wang-110 D/MAPLD 2004 8 System Design - Overview PPC405 1 PPC405 2 PLB ARB PLB2OPB Bridge OPB ARB C Crit. INTC Non-Crit INTC DDR SDRAM Cntl UARTs (External Devices) EXT MEM (128MB) OCM BRAM (8K) Serial Port Decoder (Injects fault Signals) FI EDC FI Status BRAMs (4K) PLB BRAMs (Firmware) (32K) EDC Controller FI EDC

9. Wang-110 D/MAPLD 2004 9 Dual-processor Comparator PPC 405 Block 1 Cache Units PLB Bus MMUCPU Timers and Debug PPC 405 Block 2 Cache Units MMUCPU Timers and Debug Arbiter DDR SDRAM Controller C PLB IPIF External SDRAM Note: Yellow lines: PLB master read / write signals for D-Cache Green Lines: PLB master read signals for I-Cache FI : Fault insertion point PC : Parity Check Off Chip Area FI PLB IPIF FI

10. Wang-110 D/MAPLD 2004 10 Dual-Processor Voting Simulation

11. Wang-110 D/MAPLD 2004 11 EDAC OCM BRAMs (Read/Write) Parity Encoder Error Detection Correction PPC405 #1 PPC405 #2 BRAMS (8KB) Glue Logic ENCIN DECOUT ERROR FORCE ERROR PARITY_OUT PARITY_IN ENOUT DECIN  Hamming Code [32,39]  Read-modified-write to support byte enable feature  Error information is stored in a separate memory space  Single-bit error triggers a CPU interrupt  Double-bit error triggers a CPU reset Xilinx XAPP645 Data Out (discard parity bits) ADDR EN W_EN[3:0] CLK 32 7 7

12. Wang-110 D/MAPLD 2004 12 EDAC PLB BRAMs (Read Only) Parity Encoder Error Detection Correction BRAMS (32KB + 8 KB) ENCIN DECOUT ERROR FORCE ERROR PARITY_OUT PARITY_IN ENOUT DECIN  Hamming Code [64,72]  Read-modified-write to support byte enable feature  Single-bit error is stored in a separate memory space  Single-bit error triggers a CPU interrupt  Double-bit error triggers a device reconfiguration Xilinx XAPP645 Data Out (discard parity bits) ADDR EN W_EN CLK Processor Local Bus 64 Glue Logic 2 2 PLB BRAM Controller 64 8 8 PLB Interface

13. Wang-110 D/MAPLD 2004 13 EDAC DDR SDRAM  Hamming Code [64,72]  Read-modified-write to support byte enable and burst of 2-words features  Single error is stored in a separate memory space  Single error triggers a CPU interrupt  Double error triggers device reconfiguration Parity Encoder Error Detection Correction DDR SDRAM (128MB + 32MB) ENCIN DECOUT ERROR FORCE ERROR PARITY_IN DECIN Xilinx XAPP645 ADDR CLK Processor Local Bus 64 Glue Logic 2 2 32 CLKn 4 4 DDR SDRAM Controller Mux Demux 64 8 PARITY_OUT ENOUT 8 64 Mux Data Out (discard parity bits) 32 PLB interface modules

14. Wang-110 D/MAPLD 2004 14 Self Configuration Checker ICAP Controller ICAP CRC Checker Frame Address Memory (BRAMS) 4 Bytes Read Back Commands ( 44 Bytes) Virtex-II Pro Implementation C script top.ll (contains frame address used for the design) Frame address data formatted for BRAMS (BRAMS) Digital Design top.bit This portion can be ported to a radiation-hardened FPGA in the case of robust strategy

15. Wang-110 D/MAPLD 2004 15 Self Configuration Checker Design Highlights  No External I/Os access required  Frame-by-frame read back required  32-bit CRC algorithm implemented. (A CRC signature is generated after device power up)  No SRL16 and Distributed SelectRAMs used in design

16. Wang-110 D/MAPLD 2004 16 Labview Fault Injection Panel Screenshot of fault injection emulator that interfaces with the prototype board. Fault Injection Error Counters Process Bus Fault Injection Buttons Processors Mismatch LED Indicator Fault location map Program counter resets to zero when a CPU reset occurs. ASCII Command Input window

17. Wang-110 D/MAPLD 2004 17 XC2VP20 Device Utilization (without TMR) Number of External IOBs 57 out of 564 10% Number of PPC405s 2 out of 2 100% Number of RAMB16s 30 out of 88 34% Number of SLICEs 4334 out of 9280 46% Number of BUFGMUXs 6 out of 16 37% Number of DCMs 2 out of 8 25% Number of ICAPs 1 out of 1 100% Number of JTAGPPCs 1 out of 1 100%

18. Wang-110 D/MAPLD 2004 18 Slice Utilization (without TMR) Note: The shaded modules can be replaced by other approach.

19. Wang-110 D/MAPLD 2004 19 Mitigation State Machine 1) CPU mismatch 2) CPU watchdog timer 3) OCM EDC double-bit error CPU Reset System Reset 1) OPB Bus error 2) PLB Bus error 1) Configuration check fail 2) PLB EDC double-bit error 3) DDR SDRAM double-bit error FPGA Reconfiguration Mitigation Severity 1) OCM BRAM single-bit error 2) PLB BRAM single-bit error 3) DDR SDRAM single-bit error CPU Interrupt CPU reset counter == full System reset counter == full Normal

20. Wang-110 D/MAPLD 2004 20 Conclusion  Identified and categorized error prone regions on the Virtex-II Pro into four types  Developed mitigation strategies for each region.  Radiation test on the overall system is in progress.

21. Wang-110 D/MAPLD 2004 21 Acronyms SEU : Single Event Upset FPGA: Field Programmable Gate Array LUT: Look Up Table PLB: Processor Local Bus OPB: On-Chip Peripheral Bus OCM: On-Chip Memory EDAC: Error Detect-And-Correct ICAP: Internal Configuration Access Point