Analyzing the Effects of TID in an Embedded System Running in a Flash-Based FPGA

IEEE TRANSACTIONS ON NUCLEAR SCIENCE, VOL. 58, NO. 6, DECEMBER 2011 2855

Analyzing the Effects of TID in an EmbeddedSystem Running in a Flash-Based FPGA

Jimmy Tarrillo, José Rodrigo Azambuja, Fernanda Lima Kastensmidt, Evaldo Carlos Pereira Fonseca,Rafael Galhardo, and Odair Goncalez, Member, IEEE

Abstract—This work analyzes the behavior of a designedembedded system composed of microprocessor, memories andSpaceWire (SpW) links under Total Ionizing Dose (TID) synthe-sized into a commercial flash-based FPGA from Actel. Two testswere performed: one the FPGA is configured just once at the be-ginning of the irradiation and the other the FPGA is reconfiguredevery 5 krad (Si). Results evaluate power supply current (Icc),temperature, function operation and performance degradation.

Index Terms—Embedded system, Flash-based FPGA, radiationeffects, system on chip, total ionizing dose.

I. INTRODUCTION

T HE use of field programmable gate arrays (FPGAs) is at-tractive for space applications due to its high flexibility

and reprogrammability, high performance, lower cost and re-duced development time in comparison with ASICs circuit. Inaddition, due to the high density of modern FPGAs, an entireSystem-on-Chip (SoC) composed of microprocessors, memo-ries and communication links can be implemented inside theprogrammable architecture helping with system integration andreducing board complexity.It is well known that FPGAs operating in a space environ-

ment can be affected by cumulative long term ionizing damage,known as total ionizing dose (TID); and transient ionization,known as single event effects (SEE), due to interaction withprotons, electrons and heavy ions with the integrated circuit.The TID effects are transistor voltage threshold (Vth) shifts,leakage current, timing skew and functional failures [1], [2].While SEE effects are bit-flip in memory elements or transientvoltage pulses in the combinational logic. When thinking ofsatellite applications in Low Earth Orbit (LEO), typical doserates due to trapped Van Allen electrons and protons are up to10 krad(Si)/year [3], [4], and SEE error rate may vary from

Manuscript received July 22, 2011; revised September 08, 2011, September25, 2011; accepted September 25, 2011. Date of publicationNovember 10, 2011;date of current version December 14, 2011. This work was supported in part bythe Brazilian Agencies CNPq and CAPES.J. Tarrillo, J. R. Azambuja and F. L. Kastensmidt are with the Instituto

de Informática, PPGC, PGMICRO, Universidade Federal do Rio Grandedo Sul (UFRGS), Porto Alegre, Brazil (e-mail: [email protected];[email protected]; [email protected]).E. C. P. Fonseca, R. Galhardo, and O. Goncalez are with Instituto de Es-

tudos Avançados (IEAv), Departamento de Ciência e Tecnologia Aeroespacial(DCTA), São José dos Campos, Brazil (e-mail: [email protected]).Color versions of one or more of the figures in this paper are available online

at http://ieeexplore.ieee.org.Digital Object Identifier 10.1109/TNS.2011.2170855

few errors per hour or day or even lower rates according tothe process technology of the integrated circuit and the envi-ronment. These numbers may allow in many cases the use ofcommercial off-the-shelf (COTS) circuits with some fault-tol-erant protected technique designed at logic or system level. Butit is important to qualify those circuits under radiation for thespecific target system to analyze its robustness.In this work, we designed a embedded system composed

of a MIPS microprocessor [5] hardened with fault-toleranttechniques [6], an embedded SRAM memory, two SpW links[7] and embedded phase-locked loop (PLL) clock module. Theobjective is to characterize a commercial Flash-based FPGAProASIC3E family from Actel under accumulative dose. Thesystem has been designed to have fault detection and diagnosecapability. The idea is to help identify the module that maypresent errors during irradiation. This detailed analysis canhelp designers to identify the most sensitive parts of the chip.For TID effect detection, PLL degradation can be periodicallymonitored to help analyze the degradation of the entire FPGAfabric.Previous works [8]–[10] in the ProASIC3 family have shown

degradation in the propagation delay of 10% from 20 to 22 kradand functional failures at 30 and 40 krad [10]. In [11], authorshave analyzed the effects of TID up to 76 krad(Si) for chains ofdifferent logic gate and placements, a frequency divider and aTMR circuit composed of counters and multipliers. Accordingto the circuit, propagation-delay degradations could vary from400% to 1100% before functional failure. And some circuitsoperated well until 76 krad(Si).However, related works are all about simple circuits and non-

complex systems. TID analysis of system applications using dif-ferent features of a flash-based FPGA has not been published.Structures such as embedded memories, PLL circuit and morecomplex designs must be tested in order to have a better eval-uation of the use of commercial Flash-based FPGAs in spaceapplications such as low orbit satellites.The entire system was implemented in a commercial flash-

based FPGA part A3P 130-nm ProASIC3 family. We exposedthis part to gamma rays from Cobalt-60 source at a dose rate of2 krad(Si)/h (0.55 rad(Si)/s), reaching an accumulated dose of68 krad(Si). Two tests were performed: one the FPGA is config-ured just once at the beginning of the irradiation and the otherthe FPGA is reconfigured every 5 krad(Si). Results evaluatepower supply current (Icc), temperature, function operation andperformance degradation.

0018-9499/$26.00 © 2011 IEEE

2856 IEEE TRANSACTIONS ON NUCLEAR SCIENCE, VOL. 58, NO. 6, DECEMBER 2011

Fig. 1. Block diagram of the designed SoC.

II. THE DEVELOPED SYSTEM ON CHIP FOR SEE AND TIDEFFECTS CHARACTERIZATION

System-on-chip (SoC) can be composed of different micro-processors, memories and network communications. Many pay-load satellite applications use microprocessor based on RISCarchitecture and communication protocol based on SpaceWire(SpW) router to provide the communication between differentcomponents in the satellite. SpW is a standard protocol—ECSS-E50-12C [1], which compliant with high data rate transmissionand fault tolerance features required in on-board spacecraft sys-tems. It is a well-known protocol communication developed toworks in airspace craft application, because its fault tolerancefeatures and high bit transmission rates.In this paper, a case-studied SoC was developed with fault-

tolerant detection and diagnosis capability. The system is com-posed of four sub-circuits: a hardened microprocessor based onMIPS architecture, embedded SRAM memories, a SpW block,and a PLL module. Fig. 1 shows the main blocks diagrams. Theobjective is to exercise the main modules of the FPGA: largeamount of the FPGA configurable blocks (VersaTile), PLL andembedded SRAM memory.The software application is simple because for testing pur-

pose the memory was fully implemented in the embeddedmemory of the ProAsic3 FPGA. The microprocessor executes,in a loop, a bit count algorithm (loaded in memory), whichgenerates 50 constant numbers and counts the quantity of 1’sgenerated. Therefore, the bit count always results in the samevalue. At the end of each program loop, the result is saved in theSRAM memory and sent out of the system through two SpWlinks. The PLL module is used to divide the external oscillatorfrom 40 MHz to 20 MHz.The mode selector input signal allows switching the system

between two operation modes: load data mode and normalmode. In the first mode, the code program is sent from anexternal device to SRAM memory through the load data businput signal. A dedicated circuit was developed to initialize theSRAM memory with the program code. In normal mode, thehardened microprocessor executes the program and sends outthe result as described previously.

A. SEE Hardened Microprocessor

The chosen microprocessor is a 32-bit five-stage pipeline mi-croprocessor called miniMIPS, which is based on the MIPS ar-chitecture, but with a reduced instruction set [12]. This pro-cessor is composed of a register bank with 32 registers of 32 bitseach with two independent read and write modes.The miniMIPS was hardened using a hybrid fault-tolerant

technique able to detect transient faults [6]. This technique de-tects soft errors in microprocessors by protecting the softwarewith duplication of variables techniques [13] and signatures forthe control-flow. In addition, it has a non-intrusive hardwaremodule composed of watchdog and a self-checking module todecode the signatures from software to improve the faults detec-tion coverage. This technique can detect data and control flowerrors.The control-flow signatures technique protects the system

against wrong jumps to the beginning of any basic block (BB)of the program, and incorrect jumps in the same BB. In thefirst case, every BB is assigned with two identifiers: the BlockIDentifier (BID) represents each BB with a unique primenumber and the Control-Flow IDentifier (CFID) represents thecontrol-flow, by storing the multiplication product of the nextBBs’ BIDs. Since the BIDs are composed of prime numbers,the operation remainder of division between a CFID and aBID will always return zero, unless a wrong. Incorrect jumpsto the same BB require intra-block control and therefore eachinstruction within a BB must be considered. In order to detectsuch faults, the technique computes each BB signature byXOR’ing all instructions inside a BB both during runtime andprogram code construction (compilation). Error verificationprocess (division and XOR operations) are performed in theSelf-checking and watchdog module.In the non-intrusive hardware module, the watchdog is used

to detect incorrect jumps to unused memory addresses and con-trol flow loops, while the decoder spoofs data and address busesand the read/write signal between the microprocessor and thememory in order to perform the instructions sent by the soft-ware-based transformation rules. The decoder spoofs the busessearching for two instructions: 1) Reset XOR, which resets theinternal module’s register that store the current XOR value and2) Check XOR, which performs a consistency check, by veri-fying the value in the data bus with the internal module’s regis-ters storing the current XOR value.The benchmark program implements a bit count algorithm,

which original code uses 55 32-bits words, while the hardenedversion uses 192 32-bits words. The result of each execu-tion is 0x00000C07, and it is saved in the memory address0x000000B8. This simple code was chosen due to the limi-tations of the embedded SRAM memory in the FPGA. If anexternal memory is used, any code that occupies up to 32-bitaddresses can be used.In order to monitor the behavior of the hardened micropro-

cessor during test experiments, some internal signals are de-fined as outputs. These signals were specially generated to helpfault detection diagnosis. The Program counter bus is drivenby the signal PC mips (6-bits). Actel out bus signalizes anyerror detected inside the system. This bus is provided by the

TARRILLO et al.: ANALYZING THE EFFECTS OF TID IN AN EMBEDDED SYSTEM RUNNING IN A FLASH-BASED FPGA 2857

Fig. 2. Block diagram of the SpW sub-circuit.

Self-checking and watchdog module. It has 13 bits. Bit 0 in-dicates that the run time period has overload (watchdog detec-tion). Bit 1 indicates that the software-based technique has de-tected an error (data error detection). Bit 2 indicates that theself-checking module has detected an error (control-flow errordetection). Bit 3 is set at one each time the program reaches theend or any error has occurred (what come first). The other ninebits (bit 13 to bit 4) are ‘1’ when a right result is obtained, orthey indicate the low sensitive bits of the address memory ofthe last correct execution.

B. SpW Block

The SpW block is composed of two SpW links and a Controlcircuit to manage both links, as shown in Fig. 2. The controlcircuit decodes the address bus to detect the end of program.Then, the value of the data bus is sent out through SpW Link 1and SpW Link 2. SpW links sends 8-bit packets, and MIPS databus is of 32 bits, so SpW link needs four packets to send entiredata bus value. During this process SpW Busy flag is set. Whenthe entire 32-bits value is transmitted, the value is loaded inSpW Data output, SpW Busy flag is cleared and SpW Ready flagis set to 1 during one clock cycle. SpW error flag bus signalizeseach error detected by the SpW protocol in each link: time-out,parity mismatch or flow control.SpW is a full-duplex, point-to-point bi-directional and se-

rial data communication standard. The standard covers the fol-lowing protocol levels: physical level, signal level, characterlevel, exchange level, packet level, and network level. The phys-ical level defines signal encoding, voltage levels, noise margins,and data signaling rates. Data-Strobe (DS) is the signal encodingused by the SpW standard.Character level defines two types of character: Data and Con-

trol character. The first one is the information that a node wantsto transmit, and the last one is used to control the communi-cation. In both cases odd parity is used to detect one bit errorduring characters transmission.

The exchange level defines the Link interface block (encoder-decoder), the process of link initialization and the data flowacross the link. Fig. 2 shows the main blocks of the Link:• Transmitter, which sends the TX Data received from hostand the control characters according to the State Machine;

• Receiver, which decodes the characters incoming, detectsparity, disconnection and flow control errors, and stores thedata received in a buffer;

• State Machine, that controls the link initialization processand the flow control during the communication.

In packet level is defined how the information data is split upinto packets for transmission over an SpW link. The networklevel defines the basic elements of a routing switch (router),which is comprised by SpaceWire link interfaces (encoder/de-coders) and a switch routing matrix.The mechanisms for error detection in the SpW protocol are

defined in the protocol as parity bits implemented in the receiverof the Link and in the control of the switch matrix. The firstgroup is composed of:• Error parity checker: in each character transmitted;• Disconnect detection: after 850 ns from the last transitionon the D or S lines;

• Control data errors: SpW protocol is able to detect errorsin sequence of control characters and in buffer receptionmanagement.

III. SYSTEM-ON-CHIP VALIDATION IN PROASIC3 FPGA

The case study embedded system was implemented in aProAsic3 FLASH-FPGA. The chosen part A3P250-PQ208 has6 144 VersaTiles, which can implement approximately 250,000equivalent logic gates, 36 kbits embedded SRAM, 1 kbits userflash ROM, and one PLL module.The entire system has an occupation of 5,365 core cells

(87.32% of FPGA), where 1,051 equivalent flip-flops and theremaining 4,314 are combinational circuits. Also it uses six4,608-bit SRAM blocks (75% of SRAM blocks available) and


Fig. 3. Placement of the designed SoC in the A3P250-PQ208.

151 IO cells (70% of the FPGA IO). The floorplanning andplacement is illustrated on Fig. 3. The maximum frequency ofthe microprocessor synthesized into the FPGA is 36 MHz. Themaximum frequency of the SpW links are 92 MHz. Conse-quently, the entire system can run to a maximum frequency of36 MHz.

A. Using Embedded SRAM Memory Inside the FPGA

The chosen FPGA has an unhardened embedded SRAMmemory of 36 Kb split in eight 4,608-bit blocks. Each blockcan be configured as a 256 18, 512 9, 1 k 4, 2 k 2, or4 k 1 bits memory. Blocks of dual port or two-port memorycan be performed using the basic 4,608-bit blocks. Dual portmemory allows fully independent reads and writes in the twoports at different frequencies. So, it is possible to both readfrom two different addresses and to write to two differentaddresses simultaneously. Two-port memory allows the SRAMto read from one port and write to the other using a commonclock or independent read and write clocks. Dual port memoryis performed by using four basic memory blocks, and two-portsby using two basic memory blocks.The MIPS microprocessor’s register bank (32 registers of

32 bits) was implemented using two two-port memories (four4,608-bit blocks), and the program and data memory was im-plemented using one two-port memory (two 4,608-bit blocks).The hardened program uses 192 words of 32 bits, as describedpreviously.In order to load the program code into SRAM blocks of the

A3P250 FPGA, an especial module named memory initializa-tion was developed. This block allows to store the code programcoming from an external device (Data loader board, in Fig. 4),and to control the data and SRAM memory address bus.The Reception control block (RCB) manages the data trans-

mission and writing in the memory blocks. A similar block,named Transmission control block (TCB) is implemented inData load board. Load data bus is composed of data (1-bit), wr,ack, start, load and mode signals.The designed SoC works in two modes: load mode and

normal mode, according to mode signal value. In load mode,the data and address memory bus receives its values fromTransmission control block, so, the hardened microprocessoris not connected to the memory SRAM. When the process ofmemory load ends, hardened microprocessor is able to accessto memory SRAM by switching the mode signal value. Theprocess of loading is composed of the following steps:1) User select mode “load mode” and load signal ‘1’.

2) RCB starts the process with TCB.3) TCB reads the first bit unread from program code and putit in data signal. Then, signal is set.

4) When ‘1’, RCB reads data signal and saves it in ainternal 32-bit register. Then, signal is set.

5) When ‘1’, TCB cleared signal. Then, when RCBreads ‘0’, TCB clears signal.

6) Steps 3, 4, and 5 are repeated 32 times, so a complete wordis transmitted. Then, RCB writes the 32-bit register intoMemory SRAM.

7) Steps 3, 4, 5, and 6 are repeated 192 times, so the com-plete program code is transmitted. Then, “transmission ok”signal is set. If any error happens in any step, error signalis set and the whole process must be restarted. A watchdogcircuit was implemented in TCB.

The ProASIC3 family allows the use of hamming code intheir embedded memories. However, for the case-study system,there was no enough embedded memory if the hamming codeimplementation was selected. So, the memory has not been pro-tected for SEE. As the output of the system and the memorybuses (Ram addr, Ram data and Ram RW) are constantly com-pared to the expected values, any error of this kind could bedetected during the experiment. For future experiments in SEE,others solutions to self-detect bit-flips in the embedded memo-ries will need to be implemented.

B. PLL Clock Divider

A3P250 FPGA has PLL with programmable dividers and de-lays hardware module. ProsASIC3/E Evaluation Board has a40-MHz oscillator. The designed embedded system runs to afrequency up to 36 MHz. The PLL output divides the inputclock by two. The 20 MHz is used in all modules of the em-bedded system, and it can be monitored through Pll out signalduring irradiation. The Pll out signal is periodically comparedto the input clock from the board oscillator to detect perfor-mance degradation.

C. Simulation Results

In order to validate the proposed SoC before irradiation,logical simulation was performed by Modelsim. The testbenchstarts with the initialization of the embedded SRAM memories,which takes 61,116 clock cycles. The initialization is performedonly when the FPGA is configured. Then, each loop of theprogram is executed in 201 495 clock cycles, which means10.07 ms.Fig. 5 shows the final cycles of the program. Notes that when

Ram addr is 0x000000B8 and Ram rw is ‘1’, the0x00000C07, which means that this value is the program resultthat is written in the memory.After some cycles, the three less significant bits of Actel out

are ‘0’, whichmeans that no error occurred. Bit 4 fromActel outbus is set to one many cycles later, not shown in the figure. Inthe same figure, it is shown the moment when SpW busy is setto one, which means that SpW link 1 started to send data.The simulation of the SpW transmission is shown in Fig. 6.

The rectangular borders in the figure mark the main behaviorsteps. The first is when the control of the SpW block detects thatmicroprocessor is storing the result in memory. So, SpW busy is


Fig. 4. Initialization of FPGA embedded SRAM memory blocks.

Fig. 5. Simulation: End loop program.

Fig. 6. Simulation: SpW link transmission. In 1 SpW link 1starts to send the 32-bit result in four packets. In 2, 3, 4, and 5, each packet is sent from SpW link 2.

set to one and SpW link 1 starts to send the 32-bits result to SpWlink 2, in 8-bits packets. The next four rectangular show the mo-ment when 0x07, 0x0C, 0x00, and 0x00 are ready in SpW dataoutput, respectively. This process is realized in 444 clock cycles.During the TID experiment, it is projected that the described

signals provide the correct results until a certain amount of ac-cumulated dose. The degradation performance in the VersaTiles

is expected to occur, but it maybe masked by the sequential be-havior of the application at the given clock.

IV. TEST SETUP AND PROCEDURE

The test setup is composed of two boards. One has the designunder test (DUT) and the other has an Embedded MemoryInitialization System. The DUT board [14] has a commercial


Fig. 7. Experimental setup diagram.

ProASIC3 FPGA among other main components. It has a40-MHz oscillator, eight LEDs (driven by outputs from thedevice), two mono-stable pulse generator switches (“global”and “reset”), four switches (provide input to the device) and alarge LCD alphanumeric display. The tested FPGA part is anA3PE1500-PQ208 fabricated in a 130-nm Flash-based CMOSprocess that retains programmed design when powered off. Thepart operates at 3.3 V in the IO pins and 1.5 V at the core.The electrical parameters of the output signals were ob-

served and recorded on the scope on-beam during DUTirradiation by a logical analyzer (Fig. 6). Functional measure-ments were taken with a 2-GHz logic analyzer to observesignals: Ram RW, Ram addr, Ram data, Actel out (triplicate),SpW error, SpW Ready, SpW busy and SpW data and a 1-GHzoscilloscope to observe signals PC mips, 40-MHz clock input,and PLL out.The core current and noise were continuously measured

with a digital multimeter and the superficial temperature ofthe FPGA was measured using a thermostat probe (Fig. 7).The control of the entire experiment, including the acquisitionand data storage, was made remotely. All the data was storedin archives .txt for posterior analyses in the logical analyzer.Fig. 8 shows the setup boards in front of the beam.Two different experiments were performed in order to

analyze TID effects in the Ionizing Radiation Laboratoryof the Institute of Advanced Studies (Instituto de EstudosAvançados—IEAv) as described below: one with no FPGA re-configuration and one with reconfiguration at every 5 krad(Si).

Fig. 8. Experimental setup hardware.

A. TID Effect in Flash-Based FPGA With No Reconfiguration

The aim of the first experiment was to analyze the TID effectson the SoC embedded in A3P250 FPGA under accumulateddose. The device was irradiated with a collimated gamma-raybeam up to 68 krad(Si) with a dose rate of 2 krad per hour(0.555 rad/s) at room temperature (24.5 0,5 C) using IEAv’sCo-60 source.Data acquisitions were carried through at intervals of 30 min-

utes, corresponding to a step of 1 krad(Si) between acquisitions,


Fig. 9. Failure dose for each of the signals outputs.

until the first functional failure at 47 krad(Si). After the firstfunctional failure, data acquisitions were performed at intervalsof 15 minutes, corresponding to a 0.5 krad(Si) acquisition step.Data was stored in text archives for posterior analyses.The electrical parameters of the output signals were observed

and recorded on the scope on-beam during DUT irradiation.

B. TID Effect in Flash-Based FPGA With ReconfigurationEvery 5 Krad(Si)

The aim of the second experiment was to analyze the TIDeffects on the SoC embedded in A3P250 FPGA in gamma-raypresence, reconfiguring the FPGA every 5 Krad.The device was irradiated with a collimated gamma-ray beam

with a dose rate of 2.5 krad per hour (0.694 rad/s) at room tem-perature (23.8 0,5 C) using IEAv’s Co-60 source.Data acquisitions were carried through at intervals of 5 min-

utes, corresponding to a step of 0.208 krad(Si) between acquisi-tions. Each 2 hours (5 Krad), the radiation was stopped and theSoC reloaded.Data was stored in text archives for posterior analyses. The

electrical parameters of the output signals were observed andrecorded on the scope on-beam during DUT irradiation.After every experiment, anneal process was performed. Ac-

cording to MIL-STD-883H standard, DUT was stored at roomtemperature and biased. Then it was baked at 80 C for 168hours.

V. TID EXPERIMENTAL RESULTS

A. TID Effect in Flash-Based FPGA With No Reconfiguration

Fig. 9 shows the activity of the observed signals (black whenactive), according to the amount of accumulated dose. By ana-lyzing this graphic, one can deduce the maximum accumulateddose in which each module of the circuit stops working. At 47krad(Si), the signals SpW Ready, SpW Busy and SpW Data outstopped their activity, while the SpW error flag bus stoppedits activity at a dose of 66 krad(Si). The first error showed bySpW error flag was at 49 krad(Si), when signalized a time-outerror detected in the link 2.In the case of the embedded SRAM memory, it was noticed

that the microprocessor kept writing in the memory until47 krad(Si) (through signal RAM WR) and accessing it until

63 krad(Si), through signals RAM data and RAM addr. Thefault detection HW module worked properly until 55 krad(Si),when it stopped its activity, as one can see through signalActel out. However, this module also was not able to detectany degradation in the propagation delay, as this module isalso used to tolerate transient faults. The PLL module andthe microprocessor’s PC were the last parts of the embeddedsystem to stop their activities, at 65 krad(Si), through signalsPLL Out and PC mips, respectively.Error detection flags in the protected microprocessor and

SpW links helped to determine the system is no workingproperly. This information can be used by a higher level of thesystem to take some corrective action.The power supply current (Icc) was measured during radia-

tion. Fig. 10 shows Icc and Temperature. As shown, Icc startedto change after 45 krad(Si), close to the moment when somemodules stopping working. Note also that the current increasespromptly and reaches 1.5 times the original current just before65 krad(Si). Temperature and current drop abruptly when themajority of the modules fail around 65 krad(Si).The PLL output was measured in terms of frequency, duty

cycle and delay compared to the board clock of 40 MHz. Fig. 8shows the main degradations. It important to notice that the PLLmaintained the clock output frequency up to 65 krad(Si). After65 krad(Si), many glitch pulses were observed in the PLL clockoutput.

B. TID Effect in Flash-Based FPGA With ReconfigurationEvery 5 krad(Si)

The system works free of faults until the fifth reconfigura-tion, consequently until 25 krads(Si). After that, the configura-tion bitstream could not be load in FPGA. The following errorwas received from the configuration tool:

programmer ‘53083’ : EXPORT ERROR CODE [16]805a Error: programmer ‘53083’: Executing action PRO-GRAM FAILED, EXIT 11, refer to FlashPro online help fordetails.

This could be due to the degradation of the reconfigurationcircuit mechanisms that is composed of a charge pump and a setof floating gate transistors that also had their behavior degradeddue to radiation.

VI. CONCLUSION

TID radiation results have shown the efficiency of usingthe embedded system in the commercial FPGA for up to47 krads(Si). These results agree well with previous results [9]composed of chains of logic gates, where degradations in thepropagation delay rises significantly at 47 krad(Si) and beyond.There are twomainmechanisms that can be tried to extend the

lifetime of the system in the FPGA under accumulated dose: oneis the FPGA reconfiguration rate and the other is the reductionof the system frequency. Although the reconfiguration of theFPGA could be performed at every 5 krad(Si) up to an accumu-lated dose of 25 krad(Si) the presented experiment, this numbercan vary among experiments. In heavy ions experiments, it wasreported that around 8 krad(Si) it was not possible any more toreconfigure the FPGA [15]. Consequently, the use of reconfigu-ration does not necessary ensure that lifetime of the SoC insidethe FPGA will be extended.


Fig. 10. Measured current and temperature.

Fig. 11. PLL clock output measurements: frequency, duty cycle and delay compared to the external 40-MHz clock.

Future experiments will perform reconfiguration up to20 krads and below to attempt to analyze the behavior ofthe signals until 65 krad(Si). More experiments changing thefrequency will also be performed in order to increase the clockperiod slack, which can allow higher performance degradationsin the circuit, and consequently to extend the lifetime of thesystem. On the other hand, future work also compromisesthe test of the designed SoC under heavy ions to analyze thesensitivity to SEE under the same FPGA, and the design ofmitigation techniques at system level.

REFERENCES

[1] T. R. Oldham and F. B. McLean, “Total ionizing dose effects inMOS oxides and devices,” IEEE Trans. Nucl. Sci., vol. 50, no. 3, pp.483–498, 2003.

[2] H. J. Barnaby, “Total-ionizing-dose effects in modern CMOS technolo-gies,” IEEE Trans. Nucl. Sci., vol. 53, no. 6, pp. 3103–3121, 2006.

[3] J. Barth, “Radiation environment,” in IEEE Nuclear and Space Radia-tion Effects Conf. Short Course, NSREC, Snowmass, CO, 1997.

[4] E. G. Stassinopoulos, “Radiation environment in space,” presented atthe IEEE NSREC Short Course, Reno, NV, 1990.

[5] L. Hangout and S. Jan, The Minimips Project, 2011 [Online]. Avail-able: http://www.opencores.org/projects.cgi/web/minimips/overview

[6] J. R. Azambuja, A. Lapolli, L. Rosa, and F. L. Kastensmidt, “DetectingSEEs in microprocessors through a non-intrusive hybrid technique,”IEEE Trans. Nucl. Sci., vol. 58, no. 3, pp. 993–1000, 2011.

[7] Space Engineering, Spacewire—Links, Nodes, Routers and Networks,European Space Agency, ECSS-E-ST-50-12C, Jul. 31, 2008.

[8] S. Rezgui, J. J. Wang, Y. Sun, B. Cronquist, and J. McCollum, “TIDcharacterization of 0.13- m flash-based FPGAs,” presented at theRADECS Workshop, Jyvaskyla, Finland, 2008.

[9] S. Rezgui, J. J. Wang, Y. Sun, B. Cronquist, and J. McCollum, “Newreprogrammable and non-volatile radiation tolerant FPGA: RTA3P,” inProc. IEEE Aerospace Conf., 2008, pp. 1–11.

[10] G. Allen, S. McClure, S. Rezgui, and J. J. Wang, “TID characterizationresults of Actel ProASIC3, ProASIC3E, and IGLOO flash-based fieldprogrammable gate arrays,” Military and Aerospace ProgrammableLogic Devices, MAPLD, 2008.

[11] F. L. Kastensmidt, R. Chipana, G. Wirth, E. Junior, E. Galhardo, andO. Goncalez, “TID in flash-based FPGA: Power supply-current riseand logic function mapping effects in propagation-delay degradation,”IEEE Trans. Nucl. Sci., vol. 58, no. 4, pt. 2, pp. 1927–1934, 2011.

[12] L. Hangout and S. Jan, The Minimips Project, 2009 [Online]. Avail-able: http://www.opencores.org/projects.cgi/web/min-imips/overview

[13] J. R. Azambuja, A. Lapolli, L. Rosa, and F. L. Kastensmidt, “Evalu-ating the efficiency of data-flow software-based techniques to detectSEEs in microprocessors,” in Proc. IEEE Latin-American Test Work-shop, Porto de Galinhas, PE, Brazil, 2011.

[14] ProASIC3/E Starter Kit User’s Guide and Tutorial, Actel [Online].Available: www.actel.com/documents/PA3_Startkit_UG.pdf

[15] M. Berg, H. Kim, M. Friendlich, C. Perez, C. Seidleck, and K.LaBel, “Incorporating probability models of complex test structures toperform technology independent FPGA single event upset analysis,”presented at the IEEE Nuclear and Space Radiation Effects Conf.(NSREC), Las Vegas, NV, 2011.

Analyzing the Effects of TID in an Embedded System Running in a Flash-Based FPGA

Documents

Transcript of Analyzing the Effects of TID in an Embedded System Running in a Flash-Based FPGA