2004 Actel Confidential and ProprietaryMarch 2004 J.P.Bendekovic
Dir., WW Aerospace Sales 1 John P. Bendekovic John P. Bendekovic
Director, WW Aerospace Sales and Bus. Devt. (703) 669-3402 (Office)
(703) 801-6033 (Cell)[email protected] The Effect of
Neutrons on Programmable Digital Logic Devices In Avionics
Applications Slide 2 2004 Actel Confidential and ProprietaryMarch
2004 J.P.Bendekovic Dir., WW Aerospace Sales 2 Agenda Definition
and quantification -- Neutrons and avionics Programmable Logic --
Who uses it, why you should care Soft vs. firm errors -- Device
physics, and what happens Test approaches, data and system-level
impact Honeywell/LANL/FAA iRoC Competitive Conclusions and
recommendations Slide 3 2004 Actel Confidential and
ProprietaryMarch 2004 J.P.Bendekovic Dir., WW Aerospace Sales 3
Earth Atmospheric Single Event Effects Galactic cosmic rays and
solar rays hit the earths atmosphere, penetrate and produce
particle cascades Therefore Single Event Effects will also occur
within the Earths Atmosphere First recognized in 1980s Aircraft
Ground based systems The probability is a function of: Device
physics Physical Location of the device Altitude Latitude and
Longitude Source: IBM, Source: IBM, Journal of Research &
Development Terrestrial Cosmic Rays and Soft Errors Slide 4 2004
Actel Confidential and ProprietaryMarch 2004 J.P.Bendekovic Dir.,
WW Aerospace Sales 4 Neutron Models: Flux vs. Altitude Altitude (
Thousands of feet) 1-10 MeV Atmospheric Neutron Flux 1-10 MeV
Neutron Flux (n/cm 2 /s) Eugene Normand Boeing Company Commercial
Avionics Military Avionics Slide 5 2004 Actel Confidential and
ProprietaryMarch 2004 J.P.Bendekovic Dir., WW Aerospace Sales 5
FPGA Market Trends FPGAs continue to capture traditional ASIC
designs due to: No Expensive NREs Short Lead Times Need for
Flexibility Increased FPGA Density 17% 27% FPGAs are now the ASIC
of choice for moderate volume production runs or for rapid product
introductions. Actel is the Military & Aerospace Industrys
leading supplier of programmable logic Space Digital Logic,
MIL/Civ. Avionics, Strategic/Tactical Weapons systems commitment
continues. Source SemiCo 3/02 FPGA Share of Logic Market Slide 6
2004 Actel Confidential and ProprietaryMarch 2004 J.P.Bendekovic
Dir., WW Aerospace Sales 6 Comparing Secure 1 Million Gate
Reprogrammable FPGAs The SRAM Secure Solution The Actel Solution 1
SRAM FPGA 3 Boot PROMs (or on-board processor & ROM for code
storage) 2 Batteries (Primary & Backup- 5 yr. life) 1 CPLD
(Power up sequencing) or Actel 1 ProASIC PLUS OR 1 AntiFuse part 20
year data retention OR Unlimited (antifuse) Small form factor Live
at power up Low power Volatile Non-Volatile Slide 7 2004 Actel
Confidential and ProprietaryMarch 2004 J.P.Bendekovic Dir., WW
Aerospace Sales 7 Tactical MissilesCommercial AircraftMilitary
AircraftMilitary Ground Vehicles Military Systems AIM 9X
Sidewinder737F-22Bradley Fighting VehicleATACMS Hellfire747KC-135M1
AbramsTACMS Brimstone757ApacheTADS/PNVS Patriot767F-117WCM
PAC-3777CH-60Lantirn GBIDash-8 400 B1BIFCS THAADAirbus 319,
320,321,340, 380Lamps AITG MLRSNimRodESAF LongbowE2CALQ135
HarpoonF-16AAQ24 CommancheATIRCM JSFIDECM F-14 A-10 F-15 F-18 C-130
Military and Avionics Flight Heritage: Examples Slide 8 2004 Actel
Confidential and ProprietaryMarch 2004 J.P.Bendekovic Dir., WW
Aerospace Sales 8 SPACE Radiation-Hardened (MIL-PRF-38535 QML V/Q
RH1280, RH1020) Radiation-Tolerant (RT1020, RT14xxx, RT1280, RTSX,
RTSX-S, RTAX-S) Lot-specific TID Radiation Testing MIL883B and
S-Equivalent Actel E Flow Enhanced Screening
(883B+)MILITARY/AVIONICS MIL-STD 883B Flow devices, Hermetic
Packages QML Mil-Temp/Mil-Grade, Plastic Packages (100% Full Mil
Temp Tested) DIE SALES Mil-Temp sorted, RT and RH Actel Aerospace
FPGA Product Categories Slide 9 Firm Errors = Real Problems Neutron
Induced Errors in Programmable Devices Slide 10 2004 Actel
Confidential and ProprietaryMarch 2004 J.P.Bendekovic Dir., WW
Aerospace Sales 10 Soft & Firm Errors Soft errors are neutron
induced memory upsets, data is changed but the memory cell is not
damaged Firm errors are caused by neutrons striking FPGA
configuration memory cells SRAM and DRAM data-storage memory = Soft
Error SRAM-FPGA configuration memory = Firm Error Errors are Firm
because they are not transient errors; Error stays until detected
and cleared! DrainSource Oxide Insulation Gate P Substrate N+ High
Energy Neutron + Heavy Particles from Neutron Impact cause Trail of
Ionization + + + + + + - - - - - - - Depletion Region Charged
particles originate from a variety of sources including cosmic rays
and alpha particles from packaging contamination- they cannot be
eliminated! Actels Flash and Antifuse based FPGAS are immune to
firm errors Slide 11 2004 Actel Confidential and ProprietaryMarch
2004 J.P.Bendekovic Dir., WW Aerospace Sales 11 Firm Errors Have
Serious Impact on SRAM FPGA Logic LUT for OR 3 Logic 1111111 0 1 0
A B C Q Q A B C LUT Configuration SRAM 1111111 Neutron/Alpha A B C
LUT For tie to 1 Logic 1111111 1 1 0 Q Q A B C x x x Vdd LUT
Configuration SRAM Slide 12 2004 Actel Confidential and
ProprietaryMarch 2004 J.P.Bendekovic Dir., WW Aerospace Sales 12
SRAM Soft Errors vs. Firm Errors GRM CLB Block RAM Neutron or
Alpha-induced soft error causes transient data corruption in block
RAM. Can be corrected with EDAC Neutron or Alpha-induced firm error
causes configuration corruption Requires device reload or system-
level reset Block RAM GRM CLB Slide 13 2004 Actel Confidential and
ProprietaryMarch 2004 J.P.Bendekovic Dir., WW Aerospace Sales 13
Firm Errors Have Serious Impact on SRAM FPGA Routing GRM: General
Routing Matrix Incoming neutron or Alpha particle causes firm error
in GRM Firm error leads to... or missing signal misrouted signal
Slide 14 2004 Actel Confidential and ProprietaryMarch 2004
J.P.Bendekovic Dir., WW Aerospace Sales 14 Nanometer Processes
Increase Probability of Firm Errors Smaller SRAM Cell = Increased
Susceptibility to Firm Errors (M) (M 2 ) Smaller RAM cell with low
charge is easily upset by a random low energy particle Greater
percentage of neutrons can now generate sufficient energy to cause
a firm error SRAM Cell Size Continues to Scale 0.5 x per Generation
Slide 15 2004 Actel Confidential and ProprietaryMarch 2004
J.P.Bendekovic Dir., WW Aerospace Sales 15 How Serious are Firm
Errors? In SRAM-FPGAs, Firm Errors can potentially have serious
system impact At a minimum, the configuration data must be reloaded
to recover Can take many clock cycles before configuration loss is
discovered In many cases, the device must be power-cycled to clear
the logic error May involve a complete system reset High current
due to contentions in a mis- configured device may damage device or
board Simultaneously-enabled tie- offs to power and ground, bus
contention, etc. may occur Firm Errors are Much More Likely at
Nanometer Technologies! Source: SemiCo 2002 Slide 16 2004 Actel
Confidential and ProprietaryMarch 2004 J.P.Bendekovic Dir., WW
Aerospace Sales 16 Market Segment Impact of Neutron Induced Errors
Source:Semico 6/02 Neutron induced errors are now impacting a wide
market segment - No longer a space problem 90nm Relative System
Soft Error Rate Slide 17 2004 Actel Confidential and
ProprietaryMarch 2004 J.P.Bendekovic Dir., WW Aerospace Sales 17
Xilinxs Own Neutron Test Results Xilinx MAPLD 2003 Paper Presented
in Washington, DC in September 2003 Rosetta testing real-time,
real-world exposure of Xilinx parts to atmospheric neutrons Rosetta
details Three facilities: one at sea level, one at 5K ft, one at
12K ft Each with 100 units XC2V6000 Configuration read-back every 2
hours Total of 1.4M device-hours accumulated Observed total of 46
configuration errors for all facilities 24 config errors observed
after 208K device hours at 12K ft 18 config errors observed after
865K device hours at 5K ft 4 config errors observed after 325K
device hours at sea-level IMPORTANT--- Xilinx confirmed
configuration upsets with their own parts Not only at altitude but
also at sea-level! Slide 18 2004 Actel Confidential and
ProprietaryMarch 2004 J.P.Bendekovic Dir., WW Aerospace Sales 18
Xilinx Rosetta Test Slide 19 2004 Actel Confidential and
ProprietaryMarch 2004 J.P.Bendekovic Dir., WW Aerospace Sales 19
Actel Neutron Testing (FAA) Actel / Honeywell / Los Alamos National
Labs Testing completed October 20, 2003 Average neutron fluence per
device 3.2E+10 n/cm2 (>1.5MeV) 1.7E+10 n/cm2 (>10MeV) Fluence
per device equivalent to: 1.35E+5 years at Sea Level 932 years at
30,000 ft 207 years at 60,000 ft A54SX32A No configuration upsets
or latch-up observed APA750 No configuration upsets or latch-up
observed Formal report is available on Actel web site
http://www.actel.com/documents/LANSCETestReportWP.pdf Slide 20 2004
Actel Confidential and ProprietaryMarch 2004 J.P.Bendekovic Dir.,
WW Aerospace Sales 20 iRoC Test Program Methodology FPGAs filled
with combinatorial-only designs (eliminate data SEUs) Monitor
outputs for anomalous behaviour Periodically read back
configuration files and check for corruption (SRAM-FPGA only) Phase
1 Narrow spectrum (14MeV) testing at IRI, Delft, Holland Actel
AX1000, Actel APA1000, Xilinx XC2V3000 Testing completed December
19, 2003 JESD-89 compliant test methods Phase 2 Broad spectrum
(1MeV to 1000MeV) testing at LANL / LANSCE Actel AX1000, Actel
APA1000, Xilinx XC2V3000, Xilinx XC3S1000, Altera EP1C20 Testing
completed for February 2004 JESD-89 compliant test methods Slide 21
2004 Actel Confidential and ProprietaryMarch 2004 J.P.Bendekovic
Dir., WW Aerospace Sales 21 iRoC Phase 1 Results (Delft, Holland,
Dec 03) Actel AX1000 Each device tested to up to 1.83E+11 n/cm 2 at
14MeV 1.83E+11 n/cm 2 equivalent to 2,280 years at 60,000 ft No
device configuration upsets observed Actel APA1000 Each device
tested to up to 1.01E+11 n/cm 2 at 14MeV 1.01E+11 n/cm 2 equivalent
to 1,259 years at 60,000 ft No device configuration upsets observed
Xilinx XC2V3000 Each device tested to up to 1.5E+9 n/cm 2 at 14MeV
1.5E+9 n/cm 2 equivalent to 19.0 years at 60,000 ft or 83.0 years
at 30,000 ft 2920 configuration upsets detected by configuration
read-back 420 logic errors observed; 11 to 25 errors per device per
test run (4 test runs, 6 devices on each run) Equivalent logic
error FIT rates:Sea Level682 FITs 30,000 ft3,045 FITs 60,000
ft4.45E+5 FITs Also one instance where power cycle was needed to
reconfigure FPGA Slide 22 2004 Actel Confidential and
ProprietaryMarch 2004 J.P.Bendekovic Dir., WW Aerospace Sales 22
iRoC Phase 2 Results (Los Alamos, Feb 04) Preliminary results from
the neutron testing performed at Los Alamos by iRoC Technologies
are in. They are as follows: Axcelerator AX1000 - no neutron
induced configuration errors (as expected) ProASIC Plus APA1000 -
no neutron induced configuration errors (as expected) Virtex2 -
XC2V3000 - neutron induced logic errors detected, 1100 FITs
(normalized for sea level) Spartan3 - XC3S1000 - neutron induced
logic errors detected, 340 FITs (normalized for sea level) Cyclone
- EP1C20 - neutron induced logic errors detected, 450 FITs
(normalized for sea level) The FIT rates on Spartan3 and Cyclone
are lower than the Virtex2 FIT rate, which is to be expected
because the Virtex2 devices tested had significantly higher gate
count. FIT rate increases significantly as altitude increases - by
a factor of almost 700 at 60,000ft. Slide 23 2004 Actel
Confidential and ProprietaryMarch 2004 J.P.Bendekovic Dir., WW
Aerospace Sales 23 Example Using Xilinx Rosetta Data An avionics
system uses 4 Xilinx XC2V1000 FPGAs 4,000 systems are deployed (for
example: commercial airliner) One failure per XC2V6000 every 8,683
hours XC2V1000 (1MGates) uses 5.35 X fewer config bits than
XC2V6000 Results in one configuration upset per XC2V1000 every
46,456 hours Since 4 parts per system One config upset per system
every 11,614 hours Since 4000 systems to be deployed One config
upset every 2.9 hours Our data indicates that 1 in 7 config upsets
results in logic failure One logic failure every 20.3 hours But,
Xilinx only tested at 12K feet Neutron flux is ~11X stronger at 30K
ft (commercial aviation) than at 12K ft One field failure every 1.9
hours at 30K feet If every plane flies just two 4-hour flights per
day Thats 4.2 failures EVERY DAY! Slide 24 2004 Actel Confidential
and ProprietaryMarch 2004 J.P.Bendekovic Dir., WW Aerospace Sales
24 Example Using iRoC Data An avionics system uses 4 Xilinx
XC2V1000 FPGAs 4,000 systems are deployed (for example: commercial
airliner) iRoC testing equates to 108 device-years at 60,000 ft 484
device-years at 30,000 ft 70,250 device-years at sea level 420
logic failures over 484 device-years at 30,000 ft Failure rate per
XC2V3000 = 1 failure every 421 days XC2V1000 has 3.73 X fewer
config bits than XC2V3000 Results in one logic failure per XC2V1000
every 1570 days Since 4000 systems to be deployed, with 4 FPGAs per
system One field failure every 2.4 hours at 30,000 feet If every
plane flies just two 4-hour flights per day Thats 3 failures EVERY
DAY! Slide 25 2004 Actel Confidential and ProprietaryMarch 2004
J.P.Bendekovic Dir., WW Aerospace Sales 25 Do All Config Errors
Count? Xilinx argues that fewer than 1 in 10 config errors affect
logic Los Alamos / BYU refuted that claim at MAPLD 2003 Experiments
inject random errors into the Xilinx config bitstream, and then
measure whether config errors result in functional failures
Researchers identified multiple types of config bits which could
cause functional errors Researchers identified ways in which config
bits which are not part of the design can cause functional errors
if upset Some config errors can prevent successful config read-back
Example Neutron Single Event Upsets in SRAM Based FPGAs (Ohlsson,
Dyreklev, Johansson Saab Ericsson Space, Alfke - Xilinx) iRoC
testing shows 1 in 7 config errors affect logic 420 logic errors
out of 2940 configuration errors Do you want to take a chance that
when a neutron causes an upset, its going to be in a non-critical
cell? Slide 26 2004 Actel Confidential and ProprietaryMarch 2004
J.P.Bendekovic Dir., WW Aerospace Sales 26 SRAM FPGAs Vulnerable
Xilinx 0.15 / 0.13 product recall Solder used in flip-chip causing
configuration upsets Xilinx says flip-chip snags caused faulty
FPGAs SAN JOSE, Calif. Xilinx Inc. said it has discovered problems
with certain lots of its field-programmable gate array (FPGA)
products using flip-chip technology. The parts, including the
Virtex-II Pro and XC2V6000 products, "were manufactured using
improper solder material that may cause random upset of device
configuration," Xilinx said on Tuesday (Jan. 13). "This issue is
isolated to a limited number of parts assembled in calendar 2003,
using a packaging substrate from only one of our substrate
vendors," according to the company. "The issue has subsequently
been resolved and shipments with proper solder have resumed."
Xilinx is currently identifying and notifying customers and is
working on an individual basis with customers to address specific
problems. There will be no material impact on the December quarter
2003 or March quarter 2004 financial results, the company said. By
Mark LaPedusMark LaPedus EETimes Online, Jan 14, 2004 Slide 27 2004
Actel Confidential and ProprietaryMarch 2004 J.P.Bendekovic Dir.,
WW Aerospace Sales 27 Conclusion Recent test data from Xilinx,
Actel and independent third parties has validated Actels position
that Neutron- Induced Firm Errors are a major problem Xilinx
Rosetta test results published at MAPLD 2003 show multiple config
errors that increase with altitude Configuration errors persist
until they are detected and corrected Config errors can cause major
system level problems before they can be detected and corrected
Actel testing with Honeywell proves that Antifuse and Flash FPGAs
are immune to Neutron-Induced Firm Errors iRoC testing confirms:
Antifuse and Flash FPGAs are immune to Firm Errors SRAM-based FPGAs
are susceptible to Firm Errors High-reliability applications cannot
afford to take a chance on SRAM-based FPGAs Slide 28 2004 Actel
Confidential and ProprietaryMarch 2004 J.P.Bendekovic Dir., WW
Aerospace Sales 28 Firm Error Summary All devices with SRAM-based
memory are susceptible to errors from neutrons Data storage memory
corruption causes soft errors FPGA configuration memory corruption
causes firm errors This effect becomes very important at 130nm 90nm
is especially susceptible because of small cell size Detecting
/correcting firm errors in SRAM-FPGAs is difficult Firm errors in
configuration memory make SRAM-based FPGAs inherently unsuitable
for high-reliability applications Actel FPGAs are not susceptible
to firm errors and are an excellent solution for high-reliability
applications For more information visit
www.actel.com/softerrors
