Migrating FPGAs to structured ASICs in avionics to reduce SEU susceptibility

The use of FPGAs in many applications is rapidly increasing. With the attributes of reconfigurability and design-to-working part times much faster than those of ASICs, FPGAs offer avionics engineers advantages not available in mask-programmable silicon platforms. However, SRAM-based FPGAs are susceptible to particle-induced SEUs, which make their deployment in avionics problematic. The solution to this dilemma lies in the use of both FPGAs and a structured ASIC for complete system development, with a clear migration path using a single tool flow and suite. Using an FPGA to validate an initial design and then migrating from the FPGA to a structured ASIC reduces cost, power, and system susceptibility to SEUs.

Atmospheric-induced SEUs

The atmosphere is the source of several types of ionizing subatomic particles that can interfere with the normal operation of electronic components. These particles are the result of solar rays and galactic cosmic rays that collide with the oxygen and nitrogen atoms in the Earth’s atmosphere and produce high-energy protons and neutrons. Any of these particles have the potential to cause an SEU in an integrated circuit. NASA defines SEUs as "radiation-induced errors in microelectronic circuits caused when charged particles (usually from the radiation belts or from cosmic rays) lose energy by ionizing the medium through which they pass, leaving behind a wake of electron-hole pairs." (1) Figure 1 illustrates high-energy particles from space passing through silicon. They produce hole-electron pairs that can change the state of a memory cell or the configuration bit of an FPGA.

The density or flux of neutron particles peaks at several tens of thousands of feet above the ground, often at levels where avionic equipment operates. Other particles such as secondary protons are also present, but for SEU effects, neutrons have the highest probability of interfering with electronic system operation. The greatest density of these neutrons is at around 50,000 to 60,000 feet. Below that level, they are attenuated by the atmosphere, resulting in a much lower density at ground level. At 30,000 feet, a chip will have a Failure-In-Time (FIT) rate far higher than that at ground level.(2)

When a high-energy neutron impacts a transistor on a chip, potentially, the magnitude of the pulse may be sufficient to change the state of a logic node. This is called a soft error, since only data is affected, not the functionality of the circuitry. These errors are typically transient and are nondestructive when they occur in logic circuits. However, in a volatile memory circuit or latch, such as an SRAM cell, the neutron impact may change the state of the memory, which can have consequences on the operation of the chip containing the affected memory cell.

For military and commercial mission-critical avionics applications in jet aircraft and other high-altitude vehicles, there are concerns about using SRAM-based FPGAs, because of the possibility of neutron-induced SEUs. In many cases, designers are forced to use ASICs or One-Time Programmable (OTP) devices that have density or performance limitations.

Figure 1 (click graphic to zoom by 1.2x)

SRAM-based FPGA circuit

SRAM-based FPGAs have their functionality set by the bit pattern in an SRAM configuration memory. If an SEU upsets a configuration memory bit, the device's functionality can change, which may result in data corruption. The error, if not detected and corrected, can become a "hard" error. When an SEU-induced error is detected, the FPGA must be reconfigured, in some cases with the device's power turned off to clear the fault and then reapplied.

An FPGA's SRAM-based configuration memory, which controls the FPGA’s logic and routing, is the part of the FPGA sensitive to SEUs. SEU-based configuration memory problems include modifying the chip’s logic, disrupting interconnect paths, changing the global clocking, and modifying operation of the user I/O pins.

Configuration memory upsets can be detected and corrected using configuration feedback. This has led to different solutions at various cost levels, including making the SRAM cells more robust and introducing additional circuitry to support Error Correction Codes (ECCs), Triple Module Redundancy (TMR), and/or Cyclic Redundancy Code (CRC). Each of these has various pros and cons at the system level.

ECC support is provided by additional circuitry that stores the FPGA’s configuration in additional bits in the memory word and calculates a checksum for the contents. This checksum is periodically compared to the checksum for the FPGA’s configuration memory contents and, if a discrepancy is found, the FPGA is reconfigured. In a similar manner, extra circuitry can be used for CRC checking, to see if the configuration memory contents have changed. If they have, the FPGA is reconfigured, either partially or fully, to reproduce the correct configuration memory pattern. The additional circuitry for ECC and CRC costs chip complexity, area, and power and also produces latency between the Soft Error Rate (SER) detection and correction.

TMR provides embedded "majority voting" circuits in flip-flops that result in high levels of tolerance to SEUs. If an error is detected, the device must be reconfigured. TMR is hardwired into the design and results in significant additional silicon area, extra weight, additional power dissipation, and potentially reduced speed.

Migrating to a structured ASIC

Designers can customize SRAM-based FPGAs to application-specific algorithms for many high-altitude applications including flight control systems, displays, high-altitude electronic warfare systems, Unmanned Aerial Vehicles (UAVs), global positioning, seeker modules on missiles, and communications modules. FPGAs provide performance capabilities approaching those of ASICs and far beyond those offered by OTP devices such as UV EPROM, EEPROM, or antifuse-based devices. SRAM-based FPGA vendors are also hardening devices to be more SEU tolerant.

However, designers can further reduce their development risk and improve time to market by initiating their design-planning efforts using an SRAM-based FPGA, validating the design in-system and at-speed, and then migrating from the FPGA to a structured ASIC with lower power, SEU immunity, and a single chip.

In a structured ASIC, metal interconnects replace all the configuration RAM elements, dramatically reducing the probability of SEU-induced errors and the need for error mitigation for the configuration SRAM. Military applications need an ITAR tool flow to assure IP security during overseas manufacturing. Altera is in the process of supporting such an effort for overseas manufacturing. All metal lines are predefined and then programmed for a particular logic configuration using vias between the lines. A structured ASIC offers faster development and lower NRE costs than a standard-cell-based ASIC, as well as significantly lower unit cost and power, and often higher performance, compared to a high-end FPGA, as illustrated in Figure 2. A structured ASIC also eliminates the programming circuitry associated with an FPGA.

Figure 2 (click graphic to zoom by 1.2x)

Registers are needed in any logic design and, like any nonvolatile element, they are susceptible to SEUs. Some older FPGAs have similar registers or latch SERs to what is found in an ordinary ASIC. Structured ASICs have architectural features to eliminate this problem and to improve overall soft error rates[3] over an FPGA:

• Increasing feedback loop gate strength
• Isolating the master and slave stages with an inverter
• Improving node capacitance via programming
• Not creating an asynchronous load MUX if it is not needed

The schematic in Figure 3 shows Altera’s HardCopy II Structured ASICs implementation of logic features that are not available on an FPGA and how SEUs are reduced by adding logic to improve feedback loop gate strength.

These architectural features provide the highest level of DAL, Level A. Development Assurance Levels (DALs) are used within Aerospace Recommended Practices (ARPs) to classify system components based on their most severe failure condition associated with an aircraft-level function. DALs range from Level A - failure is catastrophic - to Level E, where failure has no safety effect. At a 130 nm process node and 1.5 V, the structured ASIC has a neutron SER cross-section (> 10 MeV, sea-level) of 7E-15. For 90 nm and 1.2 V, using hardened register design, the neutron SER cross-section (> 10 MeV, sea-level) drops below 1E-15.

A well-designed structured ASIC also significantly reduces dynamic and static core power over an equivalent FPGA. For example, there are several ways to reduce static power:

• Removing the programming circuit and configuration logic
• Powering on only the logic and memory that the actual circuit uses
• Powering down the unused logic and memory with via connections

Unlike cell-based ASICs, structured ASICs can be quickly and easily manufactured with short fabrication cycles and low NRE charges for each design iteration.

Realizing design benefits using structured ASICs and FPGAs

Developing your system with a structured ASIC and an FPGA can provide identical functionality and performance during the finalization of the design algorithms, as observed in the lab with the FPGA-based prototype. Designers can be certain that they'll get a lower power, single-chip SEU-immune device without the need for an external storage device, the latter feature improving system reliability and reducing board space by eliminating a chip. A further benefit is that designers can switch back to an FPGA if they need to modify the design to accommodate a design change or target the chip for a different application.

Figure 3

References

1. NASA Aerospace Science and Technology Dictionary, http://www.hq.nasa.gov/office/hqlibrary/aerospacedictionary/aerodictall/s.html.

2. Graham, Paul et al, "Consequences and Categories of SRAM FPGA Configuration SEUs", Los Alamos National Laboratory, Paper LA-UR-03-6122.

3. Euzent, Bruce et al, "Structured ASIC for SEU Mitigation of SRAM-based FPGAs", presented at the 2006 MAPLD International Conference, Washington DC, Sept. 26-28, 2006.

Amr El-Ashmawi is the senior marketing manager responsible for the military and aerospace business unit at Altera. He has more than 16 years of experience in semiconductor design, programmable logic, and working within the environment of the defense market. Prior to joining Altera, Amr was the director of marketing at SiliconExpert Technologies, where he was a founder with responsibilities in providing component management tools to the commercial and defense industries. He has also held marketing and engineering positions at Actel Corporation. He holds a BSEE and MSEM from Santa Clara University. To learn more, contact Amr at aelashma@altera.com.