Page 1 of 1
Military aircraft routinely operate at altitudes from 30,000 to 60,000 feet or more, including planes with sophisticated fly-by-wire circuitry and those used for airborne early warning and control (AWAC) and electronic countermeasures missions (Figure 1) that are filled with similarly sensitive avionics systems. The electronics within these aircraft are subjected to high levels of ionizing radiation, which can generate induced pulses or transients that cause operating errors that can affect system functions and data. While the impact of this radiation on memory circuits in avionics has been known since 1992, few engineers fully understand its impact on programmable logic, or how to specify FPGA technologies that mitigate the risks of single event effects (SEEs) caused by the high neutron flux at these cruising altitudes.
The EC-130H Compass Call is an airborne tactical weapon system using a heavily modified version of the C-130 Hercules airframe. The system uses electronic countermeasures to disrupt enemy command and control communications and limits adversary coordination essential for enemy force management.
There are several industry groups focusing on the impact of single event upsets (SEUs) caused by ionizing radiation from galactic cosmic rays (GCR). These groups include the Federal Aviation Administration (FAA) and its DO-254 standards for electronic airborne system safety, and the International Electrotechnical Commission (IEC), which has established a certification program for electronic components, processes and related materials as part of the IEC Quality Assessment System for Electronic Components (IECQ).
Military aircraft are particularly susceptible to SEUs because of the high concentration of electronics aboard. It has been estimated that as much as 20 percent of the cost of new commercial aircraft, and more for military aircraft, is represented by electronics, including systems for flight control, navigation, landing, engine and environment control, and communications. Military aircraft also include weapons, electronic protection systems, and additional sensitive circuitry. It is critical to understand how various FPGA technologies react to GCR in these system applications.
Radiation from Cosmic Rays
The earth’s atmosphere is constantly impacted by GCR comprised mostly of high-energy protons originating in space. These particles have enough energy to free nuclei when they collide with molecules in the earth’s atmosphere, which creates an air shower consisting of a wide range and high number of particles. The spallation products that are of most concern to avionics designers are neutrons and protons, in addition to remnant cosmic rays.
The flux of cosmic rays impacting the earth’s atmosphere is modulated by both the solar wind and the earth’s magnetic field. As a result, the greatest modulation occurs at the equator and when the solar wind is most active, which is also when solar flare activity is high. The flux generated from an air shower is modulated by the density of the atmosphere (expressed as depth). As a result, particle flux strength is a function of latitude, longitude, altitude and solar activity, with the greatest flux occurring at high altitudes over the poles during quiet periods of solar activity.
High Altitude Dangers
An observer in an aircraft flying at 40,000 feet, for example, over the poles during a period of moderate solar activity will experience more than 500 times the neutron flux as a terrestrial observer in New York City. While most commercial jetliners operate at a cruising altitude of approximately 30,000 to 45,000 feet above mean sea level, many military jet aircraft fly considerably higher, and future aircraft may fly at even greater altitudes. In general, GCR exposure approximately doubles with every 6,000 feet of increased altitude, and particle interactions reach their peak at approximately 60,000 feet.
There are additional sources of radiation, including the packaging materials used for integrated circuits. These materials contain trace amounts of uranium and thorium, which, as they decay, naturally emit alpha particles. Although these particles have low penetration depth and can be shielded by just a few centimeters of air, the proximity of packaging material to the silicon substrate makes them an issue for electronic circuits. The silicon substrate, itself, is yet another source of ionizing radiation. Large amounts of the element boron are used in polysilicon doping, substrate doping, or borophosoph-silicate glass (BPSG).
SEEs are of far greater concern to military avionics systems than total ionizing dose (TID). Studies on commercial air crew exposure provide valuable information about approximate lifetime dosage exposure on electronics. Assuming the maximum dosages are on long-haul flights, the aircraft receives twice the dosage as the air crew. Assuming a 20-year life for an avionics system, the maximum total dose received would be on the order of 1.1 sievert (Sv) or approximately 110 radiation absorbed dose (Rad). Since TID effects are not seen in electronic devices until tens of kilorads (Krad), the cumulative impact of ionizing radiation on avionics is not of concern.
How SEEs Impact FPGAs
Generally, any effects induced by a single radiation event on an electronic circuit (as opposed to effects due to collective dosage), whether transient or damaging, are collectively known as single event effects (SEEs). SEE subclasses include single event upsets (SEUs), single event functional interrupt (SEFIs), and single event transients (SETs). SEUs and SEFIs have the greatest impact on FPGAs depending on whether their configuration memory is constructed from static random access memory (SRAM) or flash cells, which also dictates how their logic modules are connected.
The impact of a high-energy particle in an SEU is shown in Figure 2. When a high-energy particle, such as a neutron, strikes the silicon substrate of an integrated circuit, it collides with atoms in the substrate, liberating a shower of charged particles that leave an ionization trail. For example, a neutron striking a silicon atom can release energy through elastic and inelastic scattering events or via spallation events that release magnesium and aluminum ions along with alpha particles and protons.
Shown here is the impact of a high-energy particle in an SEU. When a high-energy particle such as a neutron strikes the silicon substrate of an integrated circuit, it collides with atoms in the substrate.
If the impact of a high-energy particle or ion occurs at the depletion region of an N-P junction, charges can collect there and create voltage and current transients. SEUs can actually change how FPGAs function when the FPGA’s configuration memory is constructed from SRAM cells. Figure 3 shows a typical six-transistor SRAM cell with four transistors that form cross-coupled inverters to store the bit value. If there is an ion strike with sufficient energy near one of these transistors, it can flip the cell’s bit value.
This is a typical six-transistor SRAM cell with four transistors that form cross-coupled inverters to store the bit value. If an ion strike with sufficient energy occurs near one of these transistors, it can flip the cell’s bit value.
Cell Switching Speed Issues
Due to active feedback of the cross-coupled transistors, the “QCRIT” is also dependent upon the switching speed of the cell. QCRIT is the collected charge needed to change the bias and, thus, the state of the transistor. The slower the cell, the higher the QCRIT. At 65 nm, an SRAM operating at a nominal supply of 0.8V to 1.2V has been shown to be in the range of 2 fF to 3 fF. The decrease in QCRIT between a 65 nm and 45 nm process is estimated to be on the order of 30 percent less energy, further increasing the susceptibility of SRAM cells to temporary soft errors, in which only the data stored in the element is corrupted.
In contrast, the configuration of antifuse and flash-based FPGAs is immune to SEUs because of their non-volatile structure. Figure 4 shows the typical flash structure with a floating gate located between a control gate and the metal-oxide semiconductor field-effect transistor (MOSFET) structure below, encased in good dialectic. The bit value is stored as a charge on the floating gate. A charged gate represents a zero value for NOR flash cells.
Shown here is the typical flash structure with a floating gate located between a control gate and the metal-oxide semiconductor field-effect transistor (MOSFET) structure below, encased in good dialectic. The configuration of antifuse and flash-based FPGAs is immune to SEUs because of their non-volatile structure.
With this flash structure, an ion that strikes in or near the depletion region of the flash cell will still deposit a charge; however, the QCRIT of the flash cell is significantly larger than that of the SRAM cell. Also, the flash cells used for configuration are created with a far more robust construction than those used in bulk flash memory, which are optimized for speed and size. As a result, flash cells used for FPGA configuration are immune to GCR-induced SEU.
Flash vs. SRAM FPGAs
Like SEUs, SEFIs also have an adverse effect on SRAM-based FPGAs. A key difference between flash- and SRAM-based FPGAs is their fabric, and the exact structure of the logic modules and how these modules are interconnected or wired together. It is this interconnect that poses the greatest concern from an SEFI perspective. The vias used in all FPGAs are programmable—the basis of the entire technology.
In SRAM-based FPGAs, however, the basic programmable via is a single-bit SRAM cell. This via is programmed and erased the same way as any other SRAM memory cell. Although more robust than block SRAM, the SRAM via is still susceptible to upset. Possible SEFIs in an FPGA include breaking a routing connection or bridging two signals, shorting a signal to power or ground, changing the functionality of a logic module or embedded block, or changing the direction or standard of an I/O.
Regardless of the base technology of the FPGA, SEUs in block memory must be mitigated. Manufacturers of SRAM-based FPGAs recommend various techniques for mitigating SEUs. The easiest method is to clear any SEUs that have accumulated by reconfiguring the SRAM-based FPGA at regular intervals. Unfortunately, the FPGA is unavailable during the hundreds of milliseconds that it is being reconfigured. This downtime may be unacceptable in many applications.
More recently, SRAM-based devices have become available that feature a built-in error detection scheme in the configuration engine of SRAM-based devices. The CRC for each configuration frame is calculated and compared to a golden CRC using a configuration memory read-back feature. If a mismatch is detected, it means that an SEU has occurred and the application can reconfigure the entire FPGA. Alternately, the application can attempt to correct the error and rewrite the frame in background.
Even when the correction is made, however, errors will still have propagated. Error detection can only reduce the time-to-correction as compared to mitigation techniques that employ periodic whole-device reconfiguration. Millions of clock cycles can occur during the process of detecting and correcting errors, giving them ample time to propagate through even the most complex systems.
Regardless of the methodology, any mitigation techniques can only be used to correct errors and lessen their impact after they have occurred. In other words, mitigation should not be confused with immunity. Correction schemes can only handle single-bit errors within a configuration memory frame, so any multi-bit errors still require full device reconfiguration. Also, mitigation schemes require additional reliability analysis and engineering time to implement, and to fully assess the impact of errors that still propagate.
Assessing the Impact of SEEs
According to the FAA’s DO-254 specification, titled Design Assurance Guidance for Airborne Electronic Hardware, a hardware safety assessment (Section 2.3) must be performed for airborne electronic hardware (AEH) as part of the design process, to ensure safe operation. This assessment determines the criticality (design assurance level) for each functional block in the system and must identify potential functional failure paths (FFPs). For SRAM-based FPGAs, GCR-induced SEEs are considered as potential FFPs and require that an assessment be made of the risk of SEEs and a mitigation plan be developed.
Determining potential failures-in-time (FIT) rates for a given SRAM-based FPGA is fairly straightforward (1 FIT = 1 failure/109 hours). The first step is to determine the relative neutron flux rate for the worst-case flight conditions. JESD89A references neutron flux relative to New York City. The relative flux rate can either be derived via the equations found in Annex A of JESD89A or determined via a web-based calculator based on the standard located at www.seutest.com/cgi-bin/FluxCalculator.cgi.
Per-Megabit Upset Rate
The next step is to determine the per-megabit upset rate for the configuration memory of the target FPGA. Manufacturers publish quarterly reports of FIT rates derived from ongoing atmospheric tests of FPGA arrays. This atmospheric testing includes upsets from all particles, not just from atmospheric neutrons. Several studies have determined that the composition of GCR is fairly constant over altitude, allowing the relative neutron flux rate to be used as a scaling factor. The last data needed is the configuration memory size for the large FPGA. This data is also available in manufacturers’ reports. Airframes may use four or five FPGAs per each of as much as 20 line replaceable unit (LRUs), which increases the number of upsets per hour, accordingly.
Various memory elements within the electronic devices on military aircraft are susceptible to upset when impacted by high-energy particles within the earth’s atmosphere. In addition, other elements of a device may propagate induced pulses or transients that can result in functional errors. Given the high neutron flux found at typical cruising altitudes, military avionics designers must consider the impact of SEUs and SETs, especially on FPGA devices. It is important to choose FPGAs with a base technology that is fundamentally immune to upset, and to use appropriate mitigation techniques per industry guidelines.
Aliso Viejo, CA