EP4052338A1 - Method for updating the reference threshold of at least one operational parameter, protection unit for the mitigation of a single event latchup (sel) in an electronic device using the reference threshold and arrangement for the mitigation of a single event latchup (sel) in an array - Google Patents

Method for updating the reference threshold of at least one operational parameter, protection unit for the mitigation of a single event latchup (sel) in an electronic device using the reference threshold and arrangement for the mitigation of a single event latchup (sel) in an array

Info

Publication number
EP4052338A1
EP4052338A1 EP20807674.5A EP20807674A EP4052338A1 EP 4052338 A1 EP4052338 A1 EP 4052338A1 EP 20807674 A EP20807674 A EP 20807674A EP 4052338 A1 EP4052338 A1 EP 4052338A1
Authority
EP
European Patent Office
Prior art keywords
threshold
sel
protected device
supply current
mitigation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
EP20807674.5A
Other languages
German (de)
French (fr)
Inventor
Roberto Manuel CIBILS
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alter Technology Ventures SL
Original Assignee
Alter Technology Ventures SL
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alter Technology Ventures SL filed Critical Alter Technology Ventures SL
Publication of EP4052338A1 publication Critical patent/EP4052338A1/en
Withdrawn legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
    • H02H—EMERGENCY PROTECTIVE CIRCUIT ARRANGEMENTS
    • H02H3/00—Emergency protective circuit arrangements for automatic disconnection directly responsive to an undesired change from normal electric working condition with or without subsequent reconnection ; integrated protection
    • H02H3/08—Emergency protective circuit arrangements for automatic disconnection directly responsive to an undesired change from normal electric working condition with or without subsequent reconnection ; integrated protection responsive to excess current
    • H02H3/10—Emergency protective circuit arrangements for automatic disconnection directly responsive to an undesired change from normal electric working condition with or without subsequent reconnection ; integrated protection responsive to excess current additionally responsive to some other abnormal electrical conditions
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C29/00—Checking stores for correct operation ; Subsequent repair; Testing stores during standby or offline operation
    • G11C29/02—Detection or location of defective auxiliary circuits, e.g. defective refresh counters
    • G11C29/028—Detection or location of defective auxiliary circuits, e.g. defective refresh counters with adaption or trimming of parameters
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C29/00—Checking stores for correct operation ; Subsequent repair; Testing stores during standby or offline operation
    • G11C29/04—Detection or location of defective memory elements, e.g. cell constructio details, timing of test signals
    • G11C29/50—Marginal testing, e.g. race, voltage or current testing
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C5/00—Details of stores covered by group G11C11/00
    • G11C5/005—Circuit means for protection against loss of information of semiconductor storage devices
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C7/00—Arrangements for writing information into, or reading information out from, a digital store
    • G11C7/04—Arrangements for writing information into, or reading information out from, a digital store with means for avoiding disturbances due to temperature effects
    • H—ELECTRICITY
    • H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
    • H02H—EMERGENCY PROTECTIVE CIRCUIT ARRANGEMENTS
    • H02H5/00—Emergency protective circuit arrangements for automatic disconnection directly responsive to an undesired change from normal non-electric working conditions with or without subsequent reconnection
    • H02H5/005—Emergency protective circuit arrangements for automatic disconnection directly responsive to an undesired change from normal non-electric working conditions with or without subsequent reconnection responsive to ionising radiation; Nuclear-radiation circumvention circuits
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C29/00—Checking stores for correct operation ; Subsequent repair; Testing stores during standby or offline operation
    • G11C29/04—Detection or location of defective memory elements, e.g. cell constructio details, timing of test signals
    • G11C2029/0409—Online test
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C29/00—Checking stores for correct operation ; Subsequent repair; Testing stores during standby or offline operation
    • G11C29/04—Detection or location of defective memory elements, e.g. cell constructio details, timing of test signals
    • G11C29/50—Marginal testing, e.g. race, voltage or current testing
    • G11C2029/5002—Characteristic

Definitions

  • the present invention for which a patent is applied, has as its main object a method for the generation of an optimal supply current threshold for the protection of integrated circuits against the effect called Single Event Latchup (SEL) and the devices and arrangement that use it.
  • SEL Single Event Latchup
  • the present invention refers to a method for the determination of an optimum threshold for the protected device supply current, which maximizes the probability of real SEL detection and minimizes the probability of spurious mitigations actions triggering and the devices and the arrangement which use said method to avoid destruction by overcurrent upon the occurrence of SEL in the susceptible elements of an electronic equipment.
  • This method predicts the limit value of the supply current to be used for deciding to interrupt the supply of power to the protected devices, using sample values of its supply current acquired from each of them, the level of the radiation flux and the temperature of the environment.
  • the present invention has practical and industrial application in electronic devices, such as integrated circuits, used in environments susceptible to suffer from ionizing radiation, such as geostationary satellites and remote sensing low orbit satellites.
  • parasitic structures normally present a high impedance to the supply voltage; but when the values of the current gains (b) of the parasitic bipolar transistors that compose them are high enough, a small charge induced by a particle of radiation in the sensitive region of the transistors is enough to make them suffer a transition to a very low impedance condition short circuiting the power supply.
  • a redundant system with monitoring is used. As soon as the supervisor detects that the system that is active in nominal operation stops working according to the initial specifications, it switch to the redundant module, as can be seen in US patent 10,048,997 B2 granted to Hamilton Sundstrand Corporation in 2018. This is done to protect the integrity of the higher level functional entity by disconnecting the faulted unit and replacing it with its redundancy to prevent the fault propagation to a higher level and not to prevent the destruction of the affected electronic component. It is important to remark here that a SEL event always originates at the component level and not at the system level.
  • the damage produced by SEL depends on the energy delivered by the power supply circuit to the point in the integrated circuit where the effect occurs and the magnitude of that energy will depend on the amount of time during which the power supply continues delivering its power. It is estimated that if this time is less than a minimum value, the damage is negligible. This implies very fast speed of response if the damage is to be avoided by interrupting the power supply. Furthermore, once this SEL phenomenon has occurred, the only way to return to normal Operating condition is to extend the interruption for the period required to achieve the extinction of the effect.
  • Limiting the power delivered during the event is a valid alternative to achieve such mitigation when the other alternatives described above cannot or should not be used.
  • One way to implement the limitation is through the use of a high internal impedance of the power supply as can be seen in US patent 9,391,448 B2 granted to The Boeing Company in the year 2016.
  • the impedance becomes high only at the time the event occurs. If this power control is performed at a very high level in a system, the current monitored for triggering the power interruption will be the sum of all the supply currents from the components. Its value will always be much higher than the peak current produced in the SEL affected component. In these circumstances the protection performance for detecting the variation in power consumption produced by the occurrence of a SEL in an integrated circuit is poor and the speed of response is slow.
  • Event detection can be done in several ways.
  • One possible way was presented in the patent applications: CN 103762558 A filed in the year 2014 and CN108494240A/CN208401733U filed in the year 2018.
  • the characteristic parameter used to detect the presence of a SEL is the growth rate of the supply current of the device to be protected.
  • the event can also be detected by measuring the sudden temperature change in the component that undergoes SEL as proposed by US patent 9,793,899 B1 granted to Xilinx in 2017.
  • This strategy can only be applied if the power breaking mechanism and the temperature measurement are implemented within the same chip. This should be so because of the need to avoid the delays that would occur if the process was performed by an external element. Because of this we must discard its use for the protection of integrated circuits intended for mass market products, which are not designed to contain this type of mechanism.
  • the most frequently used mechanism to detect SEL events is to monitor the magnitude of the supply current consumed by the protected device. It has been used for specific cases by the main space agencies and several integrated circuit manufacturers provide specific products for that purpose. This mechanism is present in the patent CA1,287,103C granted to Microsemi Semiconductor in 1986 where the detection is made from the peak of supply current demanded by the load during a SEL event. This particular case uses a mechanism external to the device to be protected, but is restricted to those cases where switching type regulators are used to keep the voltage level on the device.
  • two different criteria can be used: a) switch off the power when the value of the supply current is exactly below the minimum current produced by SEL or b) switch off the power when the value of the supply current is exactly above the highest value acceptable as normal consumption.
  • the guarantee of having cancelled the risk of destructive SEL is achieved.
  • the devices of interest microcontrollers, memories, programmable logic, etc.
  • the devices of interest are extremely complex and therefore a great diversity of SEL modes can be expected. It is because there can be many types of sensitive points within each device and each of them can present different sensitivities and different values of intrinsic current limitation during the SEL occurrence.
  • the first is that a radiation test is required for any device of interest in order to determine the protection threshold to be applied for each case. The cost and time involved in the preparation and execution of such tests would considerably reduce the advantages of using these components.
  • the second is that the accumulated damage produced by total radiation dose (TID) increases the average value of the supply current during the lifetime, causing the fixed protection threshold originally established to become less effective.
  • TID total radiation dose
  • diodes that most integrated circuits use internally to protect themselves from the electrostatic discharge that they frequently suffer during handling.
  • these diodes act as an alternative path for the power supply. They sustain the SEL condition even when the power from the supply circuit has been completely cut off. In this case, the supply of power through the inputs is avoided by limiting the parasitic supply currents by means of series resistors.
  • the normality or abnormality of the event is determined by setting a protection threshold value that separates the two conditions. All of them require the setting of a permanent protection threshold during the design stage or eventually the choosing between two fixed levels during the operation phase.
  • a very original proposal has been recently made by the company HARRIS Corporation whose patent US 9,960,593 B2, granted in 2018, for a device that could solve these limitations. It includes a controller which creates a database with signature vectors components that allow the identification of normal and abnormal power consumption profiles. These vectors not only include data profiles of the supply current consumption but also its correlation with the operating states of the protected device and the equipment in which it is operating.
  • One of the main drawbacks of this proposal is that the generation of such a database implies an exhaustive process of tests under nominal and anomalous conditions whose result will be specific to each particular application. Because of this its cost may be equivalent to that of testing the device to be protected to determine its tolerance to the radiation environment conditions it will have to withstand.
  • the method of comparison with a supply current threshold would be superior for its simplicity and speed of action if it were possible to solve the problem of the evolution of power consumption in all circumstances of the lifetime without over-dimensioning the protection threshold at the beginning of it. This is impossible if a fixed threshold is established a priori because it must always be higher than the worst peak of supply current expected throughout the lifetime of the protected device. Therefore, in most cases it will be well above the actual power consumption of the device at the beginning of its life, increasing the risk of destruction.
  • This protection threshold is taken as a reference for initiating a mitigation process. This is performed by applying a self-adjustment of the threshold along the protected device lifetime.
  • a variable reference threshold it is possible to minimize the risk of spurious mitigation and maximize the level of protection of the device.
  • the determination of this reference threshold was made under conditions of high uncertainty since there is no certainty that, among the data used to calculate it, there is any erroneous data produced by having been acquired during a SEL.
  • the strategy proposed here is based on the fact that, throughout the lifetime of the protected device, the ambient radiation conditions fluctuate through high and low levels and, therefore, the levels of risk of using a SEL current peak as an input for the calculation of the threshold also fluctuate.
  • the method consists of determining in real time the protection threshold from the instantaneous values of the supply current of the protected device (or other equally relevant parameter for the purpose), when the measurement conditions are safe, i.e. when the probability of a SEL event is negligible because the radiation level to which it is exposed is very low. In addition, it suspends such determination when the radiation levels are so high that the probability of SEL occurrence exceeds a certain risk level.
  • FIG. 1 The figure shows a typical CMOS integrated circuit supply current profile during normal operation and its evolution due to environmental radiation damage along its lifetime. It includes a fixed reference threshold for detection of possible SEL events.
  • FIG. 2 The figure shows an idealization of the statistical distributions of supply current consumption as a percentage of the total operating time.
  • the supply currents considered here are the current consumption of the individual integrated circuit, the current consumption of the electronic printed circuit board or equipment on which the individual integrated circuit operates and the different currents demanded by the integrated circuit in different SEL events in the same device.
  • FIG. 3a Flow chart of the operating mode determination process.
  • FIG. 3b Flow chart of the processes executed by the Protection Unit according to the determined operating mode.
  • FIG. 4 Block diagram of a possible implementation of the Protection Arrangement against a SEL event using the proposed method.
  • FIG. 5 Block diagram of a possible implementation of the Protection Unit against a SEL event using the proposed method.
  • FIG 6 The figure shows a typical supply current consumption profile of a CMOS integrated circuit in normal operation and its evolution due to radiation damage during its lifetime, together with an optimal reference threshold estimated by the proposed device for protection against the occurrence of a SEL event.
  • FIG 1 shows the effect of the aging produced by the radiation through the representation of the evolution of the supply current consumption of the protected device.
  • the threshold imposed (100) to protect the device against a SEL until the end of its lifetime.
  • the need to achieve this objective forces the over-dimension (102) of the protection threshold during most of its lifetime. This is due to the fact that to avoid spurious mitigations, the supply current threshold (100) must be set very far (102) from the normal consumption values (101) which causes a certain number of possible destructive SEL current peaks to be undetected because they are below the threshold.
  • the statistical distributions of the values of: (a) the supply current consumed by the protected device (200), (b) the supply current consumed by the electronic board or equipment in which it is used (202) and (c) the different possible currents that can be produced by a SEL (204) are ideally represented; assuming that they follow a normal distribution.
  • the purpose of this diagram is to show more clearly the different effectiveness that results from applying the method of interrupting the supply current of a whole piece of equipment or electronics board and of an individual integrated circuit that undergoes the SEL. Note that the mean (208) and standard deviation (210) of the supply current distribution of the equipment containing it (202) is much higher than the mean (207) and standard deviation (209) of the protected integrated circuit (200).
  • this average (208) is composed by the sum of the averages of all the currents of all the components operating on the board or equipment and its standard deviation (210) is a function that depends on the accumulation of all the standard deviations of all those devices. Therefore, to avoid spurious actions, the protection thresholds (201 and 203) must be located to the right of the average current of the protected element (207 and 208) whatever it is, at certain distance of it. The more these thresholds are shifted to the right, the more the probability of false negatives (205) increases, i.e. destructive conditions that will not be detected. Note how it is much more likely that the supply currents of the equipment or board will overlap with the values of the SEL currents (205 and 206) than the latter will overlap with the supply currents consumed by the integrated circuit to be protected.
  • This strategy relies on defining as the optimal threshold that which is as low as the value of the maximum peak of supply current consumed by the protected device without producing any spurious mitigation action.
  • the method presented here calculates a real-time estimate of the protection threshold to be used in the following instant. It is based on the measurement of the value of the supply current of the protected device during its normal operation. It is processed by means of an estimation algorithm such as a function of the maximum value of the type:
  • I(t) is the instantaneous value of the supply current in time t.
  • / is the average value of the supply current consumed by the device of interest.
  • s is the standard deviation of the supply current consumed by the device of interest.
  • n is an experimentally determined factor that in some implementations can be a function of temperature.
  • the radiation flux to which they are exposed is highly variable.
  • the amplitude of this fluctuation can be as much as five or six orders of magnitude and its fluctuation period of an hour, aproximately.
  • a preferred implementation of the proposed method is based on the execution of three processes: a) the mode determination process, b) the protection threshold calculation and refreshing process, and c) the power interruption process.
  • a Flow chart showing the Mode Determination Process is shown in FIG 3a.
  • the Radiation Flux Meter measures periodically (it could be between every two seconds or every two minutes) the flux of ionizing radiation from the environment in which it is operating (302).
  • the Radiation Flux Comparator compares the level of ionizing radiation flux measured (304) with the threshold set in the Radiation Flux Reference level. If the level guarantee that the probability of a SEL is low enough, the Radiation Flux Measurement Unit will determine that the mode will be Learning (303). Otherwise, it will be Protection (301).
  • the magnitude of the Reference Threshold for the Radiation Flux could be recorded permanently at the factory in a ROM memory or could be changed by commands from the ground station; using a rewritable, non-volatile and radiation-tolerant memory.
  • the process shown in Fig. 3a is carried out using a radiation detector and its associated circuitry exposed to ionizing radiation, to produce a status signal defining the Operation Mode shared by all the protected devices on the satellite electronics.
  • FIG 3b shows a flowchart for the processes associated to each protected electronic device carried out in each Protection Unit(s) as a function of the Operation Mode and the measured parameter on the electronic device.
  • the initial conditions are set up (305) and a delay occurs (306) to avoid acquiring the transient values of the in-rush current from the protected device and its power filter.
  • the Current Sensor measures (308) the value of the supply current consumed by the device of interest and check (307) the status of the mode signal.
  • the protection unit starts the process of calculating and refreshing the protection threshold.
  • the Optimum Threshold Calculation unit (513 - shown in Fig. 5 below) acquires the supply current values and, from them, calculates the new threshold (310) and stores it (311) in the Reference Register.
  • the mode indicated by the external signal switches to the Protection mode (307).
  • the calculation/updating operations of the supply current values used to calculate the protection threshold are suspended, and the device goes on to permanently check whether a SEL has been produced.
  • the mode of operation is Protection
  • the Protection Unit goes on to execute the interruption mitigation process upon the occurrence of a SEL.
  • the acquired value is compared (316) with that of the protection threshold. If the measured supply current value is lower than the value of the reference threshold, the measurement (308) and comparison (316) process is repeated indefinitely. If, on the other hand, the supply current consumed is above this threshold, the protection device turns the power supply off immediately (317).
  • the power supply is kept off (318) for the minimum time necessary to ensure the total extinction of the SEL.
  • the device automatically reconnects the power (319) repeating the whole process from the beginning (300).
  • FIG. 4 a block diagram can be seen representing a preferred realization of the layout using the method by a series of Protection Units (405) for the different protected devices.
  • These Protection Units (405) are very small integrated circuits located externally very close to the corresponding protected electronic device (407). They all share the same information on the state of the ambient ionizing radiation flux but calculate different optimal protective current thresholds for each case.
  • the Radiation Flux Meter (402) periodically measures the ambient radiation flux within which the arrangement operates.
  • the Radiation Flux Comparator module (403) compares radiation flux level measured periodically by the Radiation Flux Meter
  • FIG 5 shows a block diagram of the Protection Unit (405), which allows to execute a SEL mitigation process using the optimal current reference value for each case.
  • This unit is composed of two modules: the Optimal Current Threshold Calculation Unit (513) and the Power Supply Control Unit (514). The operation of both is conditioned by the radiation flux level indicated by the mode signal status (503).
  • the Reference Calculator (501) receives periodically samples of the supply current that also feeds the Supply Current Comparator (506). While in this mode the module calculates the optimal current threshold and updates it on the Reference Register (502) according to the evolution of the supply current. For the calculation, you can use one of the algorithms mentioned above, such as the maximum value function or the statistical function based on the calculation of the average and standard deviation of the current samples, to estimate the value of the protection threshold with which you update the corresponding register in real time.
  • the Reference Calculator block (501) stops calculating and refreshing the optimal current threshold in the Reference Register
  • Each Protection Unit (405) is connected in series between the VDC power supply (504) and the protected device (407) so that the supply current can be quickly interrupted by an electronic switch (508) in case a SEL is detected. This detection is achieved by continuously comparing the instantaneous value of the supply current of the protected device (407) with the value of the current Reference Register (502), using the Supply Current Comparator (506).
  • a parallel switch (508) is also included with the protected circuit in order to provide a low impedance path for the parasitic currents entering through the inputs so that they are not able to sustain the SEL.
  • a Timer (507) extends the power interruption long enough (e.g. 50-100 microseconds) to ensure that the SEL effect is extinguished and switch the power supply back on once this process has been completed.
  • a summary of the operations performed in the different modes can be seen in TABLE 1.
  • this table shows the operations performed by the Protection Unit (405).
  • this unit dedicates all its time to estimate the optimum threshold and refresh the reference (502). If the measured supply current exceeds the value of the protection threshold, this value is adjusted without interrupting the power supply of the protected device. If the radiation level is high (Protection mode) then the Reference Calculator module (501) stops estimating the new threshold and stops refreshing the Reference Register (502). At the same time, the Supply Current Comparator (506) verifies that the supply current consumed by the protected device (407) does not exceed the previously established threshold value. If this happens, i.e. if a SEL occurs in these conditions, the Protection Unit (405) switchs off the protected device power supply until the undesirable condition becomes extinguished.
  • Learning mode this unit dedicates all its time to estimate the optimum threshold and refresh the reference (502). If the measured supply current exceeds the value of the protection threshold, this value is adjusted without interrupting the power supply of the protected device. If the radiation level is high (Protection mode) then the Reference Calculator module (
  • An example of the many possible preferred implementations of the Protection Unit (405) consists of an integrated circuit that requires no more than a few pins (let's say six, approximately) to perform its function. Two are connected in series between the power supply (504) and the protected device (510), one reads the operating mode signal (503), one inform the rest of the equipment if a mitigation is taking place (512) and the fifth connects to ground (509).
  • This integrated circuit uses analog and digital technologies. The analog one performs the measurements (505), the comparison with the reference threshold (506) and the power interruption (508) for a limited period of time (507). It also uses digital technology including the Reference Calculator (501) and the Reference Register
  • CMOS image sensor as a radiation detector (402) with associated logic for operation.
  • This implementation is extremely useful because in addition to its low cost it has the ability to detect protons and heavy ions that are the main type of particles that can produce SEL in these applications.
  • the protection arrangement (406) in Fig. 4 includes one or more Ambient Temperature Measurement Units (not illustrated) connected to one or more of the SEL Protection Units (405) in Fig. 5.
  • the Temperature Measurement Unit consists of a temperature sensor configured to operate within the range of ambient temperatures in which the protected devices (407) have to operate. It provides them with a signal that is representative of the ambient temperature that the Protection Unit (405) uses to estimate the protection threshold for the next instant. For example, it can be used as an extra factor in any of the proposed algorithms whose value will be modulated by thermal cycles that occur inside the satellite when switching from the full sun exposition to the eclipse condition.
  • FIG 6 shows the effect of aging by radiation through the representation of the evolution of the supply current consumption of the protected device. It can be seen here how none of the supply current peaks in normal operation (601) reaches the threshold imposed (800) to protect the device against a SEL occurrence.
  • the threshold is permanently adjusted avoiding spurious mitigations, independently of the consumption fluctuations derived from the thermal cycles of the environment and independently of the total ionizing radiation aging of the protected device.
  • SEL Single Event Latchup, is an undesirable effect that can occur in CMOS technology devices by which a low internal impedance between the power terminals causes the device destruction.
  • SEL Mitigation is the process by which the destructive consequences of SEL are avoided.
  • Spurious Mitigation Rate is the percentage of mitigation processes that are executed without a SEL having occurred.
  • Protected Device is the SEL-susceptible CMOS technology device whose possible destruction is to be avoided through the mitigation process.
  • Destruction Risk Level is the probability that there is a destructive SEL current value that is not detected because it is below the protection current threshold used to initiate a SEL mitigation process.
  • Protection Current Threshold is the value of the supply current consumed by the protected device taken as a reference to identify a SEL and initiate a mitigation process. The definition of the value of this threshold determines the rate of spurious mitigations and the level of risk of destruction. It is not always possible to zero both figures simultaneously and the relationship between them is inverse, i.e. the higher the spurious mitigation rate, the lower the risk of destruction.
  • Optimum Protection Current Threshold is the value of the Protection Current Threshold that simultaneously minimizes the Spurious Mitigation Rate and the Risk of Destruction. This value is immediately above the maximum value of the supply current consumed by the protected device and evolves as it ages due to the effect of accumulated damage from the radiation received.

Landscapes

  • Physics & Mathematics (AREA)
  • High Energy & Nuclear Physics (AREA)
  • Power Sources (AREA)
  • Emergency Protection Circuit Devices (AREA)

Abstract

An adaptive strategy is developed to optimize a current threshold that is taken as a reference to initiate a mitigation process, applying a self-adjustment throughout the lifetime of an electronic device (407) to protect against SEL phenomena in environments susceptible to ionizing radiation, such as satellites in terrestrial orbits. To calculate the current threshold, the method enters a Learning mode within time segments where the radiation flux is less than a predetermined radiation threshold. When the radiation flux exceeds the radiation threshold, the method enters a Protection mode during which the current threshold update is suspended and the last current threshold calculated above is used for the detection of a SEL event, in which case a mitigation process is triggered (317). Each device to be protected is equipped with a Protection Unit (405) which estimates (310) and updates (311) its own current threshold independently and in parallel with the others. An arrangement (406) that includes a set of devices to protect stores the Radiation Flux threshold value (401) and includes a Radiation Flux Meter (402) and a Radiation Flux Comparator (403) that provides a signal to each Protection Unit (405) indicating the relationship between the measured flux and the stored threshold.

Description

METHOD FOR UPDATING THE REFERENCE THRESHOLD OF AT LEAST ONE OPERATIONAL PARAMETER, PROTECTION UNIT FOR THE MITIGATION OF A SINGLE EVENT LATCHUP (SEL) IN AN ELECTRONIC DEVICE USING THE REFERENCE THRESHOLD AND ARRANGEMENT FOR THE MITIGATION OF A SINGLE EVENT LATCHUP (SEL) IN AN ARRAY
DESCRIPTIVE MEMORY TECHNICAL FIELD OF THE INVENTION
The present invention, for which a patent is applied, has as its main object a method for the generation of an optimal supply current threshold for the protection of integrated circuits against the effect called Single Event Latchup (SEL) and the devices and arrangement that use it.
More specifically, the present invention refers to a method for the determination of an optimum threshold for the protected device supply current, which maximizes the probability of real SEL detection and minimizes the probability of spurious mitigations actions triggering and the devices and the arrangement which use said method to avoid destruction by overcurrent upon the occurrence of SEL in the susceptible elements of an electronic equipment.
This method predicts the limit value of the supply current to be used for deciding to interrupt the supply of power to the protected devices, using sample values of its supply current acquired from each of them, the level of the radiation flux and the temperature of the environment.
The present invention has practical and industrial application in electronic devices, such as integrated circuits, used in environments susceptible to suffer from ionizing radiation, such as geostationary satellites and remote sensing low orbit satellites.
STATE OF THE ART AND PROBLEMS TO BE SOLVED There are so many advanced electronic components developed for mass market appliances that a technological revolution would take place if they could be used in hostile environments without having to apply slow and expensive processes. One of the main weakness that these devices can have when operating in a radiation environment is the destructive process called SEL. It is well known that this phenomenon is produced in CMOS integrated circuits due to the parasitic structures that are formed during their manufacturing process. These parasitic structures normally present a high impedance to the supply voltage; but when the values of the current gains (b) of the parasitic bipolar transistors that compose them are high enough, a small charge induced by a particle of radiation in the sensitive region of the transistors is enough to make them suffer a transition to a very low impedance condition short circuiting the power supply.
It is obvious that, without limiting the current flowing, this phenomenon ends with the destruction of the integrated circuit by the formation of an extremely hot point inside it, which destroys semiconductor junctions and conduction paths. This limitation can occur unintentionally in the integrated circuit itself or in its external circuit. When the limitation occurs inside the integrated circuit this phenomenon is called micro-latchup. Generally the internal limitation causes that the current peak produced by the micro-latchup to be within the range of the normal consumption. This produce a non-destructive effect that only impacts negatively in stored data. From now on, only destructive events will be considered when reference is made to SEL.
There are several possible strategies to make the use of integrated circuits viable in environmental conditions with high levels of radiation. On the one hand, it is possible to do so by means of special modifications to the technology used for their manufacture, as can be seen in the patents EP 725,442 B1 granted to STMicroelectronics S.r.I in 2002, US 5,828.110 granted to Advanced Micro Devices Inc in 1998, US 6,028,341 granted to United Microelectronics Corp in 2000, US 8,891,215 B2 granted to Global Fondries Singapore Pty Ltd in 2014 and US 8,896,978 B2 granted to Texas Instruments Inc in 2014. US 10,204,906 B2 awarded to Intel Corporation in 2019 and JP6296636B2 awarded to Freescale Semiconductors in 2019.
It is not possible to think of mitigation by modification of its technology or by design in the case of integrated circuits that are designed and manufactured for mass consumption applications because they are not "a priori" designed to operate in aggressive radiation environments.
Another way to achieve the same objective is by applying the upscreening process. This consists of subjecting them to a qualification and selection process in the hope that a production lot subset with sufficient tolerance to radiation will emerge. According to several authors, including M. Pignol in his paper "COTS in Space: Constraints, Limitation and Disruptive Capability" presented at the SERESSA 2015 international meeting held in Puebla, Mexico in 2015, this process is more expensive, slower and riskier than the standard quality process for components to be used in aggressive environments. It therefore lacks the main advantage of devices intended for mass market products, which are their low cost and prompt supply. As a consequence its use is exceptionally justified because of the technological superiority that some state-of-the-art components may present (higher speed, lower power consumption, lower volume and mass, etc.).
In many cases where there is no alternative to using a SEL-prone component, a redundant system with monitoring is used. As soon as the supervisor detects that the system that is active in nominal operation stops working according to the initial specifications, it switch to the redundant module, as can be seen in US patent 10,048,997 B2 granted to Hamilton Sundstrand Corporation in 2018. This is done to protect the integrity of the higher level functional entity by disconnecting the faulted unit and replacing it with its redundancy to prevent the fault propagation to a higher level and not to prevent the destruction of the affected electronic component. It is important to remark here that a SEL event always originates at the component level and not at the system level.
Now, if the component integrity is to be preserved, protection must be implemented at that level and not at a higher one. The damage produced by SEL depends on the energy delivered by the power supply circuit to the point in the integrated circuit where the effect occurs and the magnitude of that energy will depend on the amount of time during which the power supply continues delivering its power. It is estimated that if this time is less than a minimum value, the damage is negligible. This implies very fast speed of response if the damage is to be avoided by interrupting the power supply. Furthermore, once this SEL phenomenon has occurred, the only way to return to normal Operating condition is to extend the interruption for the period required to achieve the extinction of the effect.
Limiting the power delivered during the event is a valid alternative to achieve such mitigation when the other alternatives described above cannot or should not be used. One way to implement the limitation is through the use of a high internal impedance of the power supply as can be seen in US patent 9,391,448 B2 granted to The Boeing Company in the year 2016.
This strategy has the disadvantage that its scope is very limited because the higher the impedance, the worse the regulation of the power supply voltage against the load variations.
This can be solved if the impedance becomes high only at the time the event occurs. If this power control is performed at a very high level in a system, the current monitored for triggering the power interruption will be the sum of all the supply currents from the components. Its value will always be much higher than the peak current produced in the SEL affected component. In these circumstances the protection performance for detecting the variation in power consumption produced by the occurrence of a SEL in an integrated circuit is poor and the speed of response is slow.
Event detection can be done in several ways. One possible way was presented in the patent applications: CN 103762558 A filed in the year 2014 and CN108494240A/CN208401733U filed in the year 2018. Here the characteristic parameter used to detect the presence of a SEL is the growth rate of the supply current of the device to be protected.
Unfortunately, many of the most interesting state-of-the-art devices have very fast normal consumption fluctuations so this mechanism is not a guarantee of low spurious action rate; which significantly restricts the amount of applications in which it can be used.
The event can also be detected by measuring the sudden temperature change in the component that undergoes SEL as proposed by US patent 9,793,899 B1 granted to Xilinx in 2017. This strategy can only be applied if the power breaking mechanism and the temperature measurement are implemented within the same chip. This should be so because of the need to avoid the delays that would occur if the process was performed by an external element. Because of this we must discard its use for the protection of integrated circuits intended for mass market products, which are not designed to contain this type of mechanism.
The most frequently used mechanism to detect SEL events is to monitor the magnitude of the supply current consumed by the protected device. It has been used for specific cases by the main space agencies and several integrated circuit manufacturers provide specific products for that purpose. This mechanism is present in the patent CA1,287,103C granted to Microsemi Semiconductor in 1986 where the detection is made from the peak of supply current demanded by the load during a SEL event. This particular case uses a mechanism external to the device to be protected, but is restricted to those cases where switching type regulators are used to keep the voltage level on the device. To protect a device of interest from the over-current produced by SEL by interrupting its power supply two different criteria can be used: a) switch off the power when the value of the supply current is exactly below the minimum current produced by SEL or b) switch off the power when the value of the supply current is exactly above the highest value acceptable as normal consumption.
In the first case, the guarantee of having cancelled the risk of destructive SEL is achieved. However, the devices of interest (microcontrollers, memories, programmable logic, etc.) are extremely complex and therefore a great diversity of SEL modes can be expected. It is because there can be many types of sensitive points within each device and each of them can present different sensitivities and different values of intrinsic current limitation during the SEL occurrence.
This means that for the same device there is a great diversity of possible current values triggered by a destructive SEL. All possible cases must be evaluated. This makes complex and expensive the testing of the lowest possible SEL current value for each protected device in the radioactive environment. If the test is not comprehensive, there remains some uncertainty as to where the mitigation threshold should be located. If a safety margin is then applied that reduces the threshold value, the possibility that normal consumption peaks may produce spurious mitigations is increased.
In the second case (threshold greater than the highest supply current value), complete assurance is achieved that the risk of spurious mitigations has been cancelled. However, some uncertainty still remains about the possibility that some SEL events will not be detected. The great advantage of using this criterion is that neither expensive particle accelerators nor overly complex processes are required to perform the tests involved.
This type of protection could be implemented using the mechanism shown in US patents 5,212,616 granted in 1996, US 6,064,555 granted in 2000 and US 7,907,378 B2 granted in 2011 and, in addition, in the Chinese applications CN 103701087A and Japanese JP 2006/350, 425A and the Chinese patents CN 101910973A, CN 107134758A. However, this mechanism that seems to be so simple presents a high number of implementation problems.
According to the analysis contained in the paper "Single Event Latchup Protection of Integrated Circuits" presented at RADECS 97, Fourth European Conference on Radiation and its Effects on Components and Systems by P. J. Layton and others in 1997, there are several relevant criticisms of the method of limiting the power delivered to the device by interrupting the supply current.
The first is that a radiation test is required for any device of interest in order to determine the protection threshold to be applied for each case. The cost and time involved in the preparation and execution of such tests would considerably reduce the advantages of using these components. The second is that the accumulated damage produced by total radiation dose (TID) increases the average value of the supply current during the lifetime, causing the fixed protection threshold originally established to become less effective.
Another factor that makes difficult the use of this type of protection are the diodes that most integrated circuits use internally to protect themselves from the electrostatic discharge that they frequently suffer during handling. When the supply voltage falls to a minimum value during a latchup event, these diodes act as an alternative path for the power supply. They sustain the SEL condition even when the power from the supply circuit has been completely cut off. In this case, the supply of power through the inputs is avoided by limiting the parasitic supply currents by means of series resistors.
A more effective way to solve the problem of power supply by the inputs than the simple use of series resistors is described in the US patent 5,672,918 granted to The United States Department of Energy in 1997. In this case the device uses transistors in series and in parallel with the power input as switches. The parasitic currents supplied through the inputs finds a preferential path through the shunt transistor. So the SEL cannot be sustained. Another innovation presented by this proposal is the detection of SEL events from the coincidence of the measurement of a supply current peak simultaneously with the measurement of a pulse produced by the incidence of the ionizing radiation particle that produces these peak. Unfortunately, it is practically impossible to implement a radiation detector with 100% efficiency. Therefore, it is very likely that SEL events will be produced that are never detected by the radiation detector. On the other hand, there will be coincidences of independent events that initiate unnecessary mitigation processes.
In conclusion, although the device proposed here effectively solves the problem of power supply through the input signals, it continues to suffer from the other limitations already described. Many semiconductor manufacturers have developed integrated circuits that interrupt the power supply in case of an abnormal power demand peak (e.g.: 3DPLUS - 3DPM0168-2, Analog Devices - LTC 1153, ST - RHRPMICLl A, TI
- TPS22946). In all cases, the normality or abnormality of the event is determined by setting a protection threshold value that separates the two conditions. All of them require the setting of a permanent protection threshold during the design stage or eventually the choosing between two fixed levels during the operation phase.
It is possible to dispense with the costly process of characterizing the vulnerable device in terms of radiation if, instead of using the criterion of setting the protection threshold exactly below the value of the minimum supply current produced by SEL, it is set just above the maximum value of the supply current that the device will consume under the worst operating conditions. The difficulties in achieving this objective are: a) that this current is a function of the operating states of the protected device and the equipment in which it operates, b) that the ambient temperature is not constant and significantly influences the value of this current and c) that while the device ages due to the effects of TID the average value of the supply current increases significantly.
The US patent 10,289,178 B1 granted in 2019 to Xilinx Inc. allows solving the problem of power consumption variable with the operating temperature but leaves the evolution of the supply current due to aging by radiation unresolved.
A very original proposal has been recently made by the company HARRIS Corporation whose patent US 9,960,593 B2, granted in 2018, for a device that could solve these limitations. It includes a controller which creates a database with signature vectors components that allow the identification of normal and abnormal power consumption profiles. These vectors not only include data profiles of the supply current consumption but also its correlation with the operating states of the protected device and the equipment in which it is operating. One of the main drawbacks of this proposal is that the generation of such a database implies an exhaustive process of tests under nominal and anomalous conditions whose result will be specific to each particular application. Because of this its cost may be equivalent to that of testing the device to be protected to determine its tolerance to the radiation environment conditions it will have to withstand. This technique, while calling itself adaptive, cannot learn to differentiate between normal and destructive conditions without having experienced both, and this cannot be done under normal operating conditions. This being the case, it is not possible to automatically update the signature vectors periodically and therefore there is no guarantee that they will not become outdated throughout the lifetime of the device to be protected due to the degradation that the radiation produces during it.
Thus, the method of comparison with a supply current threshold would be superior for its simplicity and speed of action if it were possible to solve the problem of the evolution of power consumption in all circumstances of the lifetime without over-dimensioning the protection threshold at the beginning of it. This is impossible if a fixed threshold is established a priori because it must always be higher than the worst peak of supply current expected throughout the lifetime of the protected device. Therefore, in most cases it will be well above the actual power consumption of the device at the beginning of its life, increasing the risk of destruction.
The patent application US 2017/237,250 A1 filed by Nanyang Technological University attempts to solve this problem by using thresholds for the supply current of the protected device and for its derivative. Such thresholds are determined automatically by an estimate of the maximum operating range.
The problem that remains to be solved here is how this mechanism determines whether the data used for such estimation correspond to values in normal operation or operating under SEL event conditions. Lacking such capacity, it could take the consumption value during such an event as a normal operation condition and tolerate a destructive situation. If, in the best case, such an event does not result in the destruction of the device, the value determined for the new threshold will be so high that it will expose the device to new destructive events.
BRIEF DESCRIPTION OF THE INVENTION
The method and the arrangement that uses it, both presented here, proposes an adaptive strategy for updating the maximum allowable threshold for the supply current. This protection threshold is taken as a reference for initiating a mitigation process. This is performed by applying a self-adjustment of the threshold along the protected device lifetime. By using a variable reference threshold it is possible to minimize the risk of spurious mitigation and maximize the level of protection of the device. Previously, the determination of this reference threshold was made under conditions of high uncertainty since there is no certainty that, among the data used to calculate it, there is any erroneous data produced by having been acquired during a SEL. The strategy proposed here is based on the fact that, throughout the lifetime of the protected device, the ambient radiation conditions fluctuate through high and low levels and, therefore, the levels of risk of using a SEL current peak as an input for the calculation of the threshold also fluctuate.
The method consists of determining in real time the protection threshold from the instantaneous values of the supply current of the protected device (or other equally relevant parameter for the purpose), when the measurement conditions are safe, i.e. when the probability of a SEL event is negligible because the radiation level to which it is exposed is very low. In addition, it suspends such determination when the radiation levels are so high that the probability of SEL occurrence exceeds a certain risk level.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1: The figure shows a typical CMOS integrated circuit supply current profile during normal operation and its evolution due to environmental radiation damage along its lifetime. It includes a fixed reference threshold for detection of possible SEL events.
FIG. 2: The figure shows an idealization of the statistical distributions of supply current consumption as a percentage of the total operating time. The supply currents considered here are the current consumption of the individual integrated circuit, the current consumption of the electronic printed circuit board or equipment on which the individual integrated circuit operates and the different currents demanded by the integrated circuit in different SEL events in the same device.
FIG. 3a: Flow chart of the operating mode determination process.
FIG. 3b Flow chart of the processes executed by the Protection Unit according to the determined operating mode.
FIG. 4: Block diagram of a possible implementation of the Protection Arrangement against a SEL event using the proposed method.
FIG. 5: Block diagram of a possible implementation of the Protection Unit against a SEL event using the proposed method.
FIG 6: The figure shows a typical supply current consumption profile of a CMOS integrated circuit in normal operation and its evolution due to radiation damage during its lifetime, together with an optimal reference threshold estimated by the proposed device for protection against the occurrence of a SEL event.
DETAILED DESCRIPTION OF A PREFERRED EXAMPLE OF REALIZATION
The previous art techniques provide very limited protection to the integrated circuits susceptible to the current overload produced by SEL because they use a fixed protection current threshold. This impossibility arises from the fact that the value of the current consumed by the devices of interest increases over their lifetime due to the degradation caused by the total accumulated radiation dose.
FIG 1 shows the effect of the aging produced by the radiation through the representation of the evolution of the supply current consumption of the protected device. Here it can be seen how none of the supply current peaks consumed by the protected device reaches the threshold imposed (100) to protect the device against a SEL until the end of its lifetime. It can also be seen how the need to achieve this objective forces the over-dimension (102) of the protection threshold during most of its lifetime. This is due to the fact that to avoid spurious mitigations, the supply current threshold (100) must be set very far (102) from the normal consumption values (101) which causes a certain number of possible destructive SEL current peaks to be undetected because they are below the threshold.
In FIG. 2, the statistical distributions of the values of: (a) the supply current consumed by the protected device (200), (b) the supply current consumed by the electronic board or equipment in which it is used (202) and (c) the different possible currents that can be produced by a SEL (204) are ideally represented; assuming that they follow a normal distribution. The purpose of this diagram is to show more clearly the different effectiveness that results from applying the method of interrupting the supply current of a whole piece of equipment or electronics board and of an individual integrated circuit that undergoes the SEL. Note that the mean (208) and standard deviation (210) of the supply current distribution of the equipment containing it (202) is much higher than the mean (207) and standard deviation (209) of the protected integrated circuit (200). This is because this average (208) is composed by the sum of the averages of all the currents of all the components operating on the board or equipment and its standard deviation (210) is a function that depends on the accumulation of all the standard deviations of all those devices. Therefore, to avoid spurious actions, the protection thresholds (201 and 203) must be located to the right of the average current of the protected element (207 and 208) whatever it is, at certain distance of it. The more these thresholds are shifted to the right, the more the probability of false negatives (205) increases, i.e. destructive conditions that will not be detected. Note how it is much more likely that the supply currents of the equipment or board will overlap with the values of the SEL currents (205 and 206) than the latter will overlap with the supply currents consumed by the integrated circuit to be protected. This indicates a higher probability of unwanted (spurious) mitigations and undetected SEL events when the protected element is an equipment or board instead of an integrated circuit. This can be understood more clearly if one observes that in both cases the false positive (spurious mitigations) rate is the area under the current curve to the right of the board protection threshold (206) and the false negative (undetected SEL events) rate is the area under the SEL current curve to the left of the same threshold (205).
The main limitations of this type of devices come from the need to determine a protection threshold that minimizes the probability of spurious mitigations. It shall be permanently updated according to the changes that occur in the protected device, mainly due to its aging. Fortunately, the radiation levels supported by the device to be protected are variable within wide ranges during its lifetime. Then an adaptive strategy with self-adjustment can be used.
This strategy relies on defining as the optimal threshold that which is as low as the value of the maximum peak of supply current consumed by the protected device without producing any spurious mitigation action.
The method presented here calculates a real-time estimate of the protection threshold to be used in the following instant. It is based on the measurement of the value of the supply current of the protected device during its normal operation. It is processed by means of an estimation algorithm such as a function of the maximum value of the type:
I (t + \) = n I (t) si I (t) > I (t - 1) or a statistical function based on the calculation of the mean and standard deviation of the values of the supply current consumed by the device of interest over time such as: I (i + 1 ") = I + n £7 where:
I(t): is the instantaneous value of the supply current in time t.
/ : is the average value of the supply current consumed by the device of interest.. s: is the standard deviation of the supply current consumed by the device of interest. n: is an experimentally determined factor that in some implementations can be a function of temperature.
These elements used in the threshold prediction algorithm that involve not only the mean but also the variance and/or the standard deviation are known as "statistical moments". Other methods for calculating the protection current threshold are also possible, such as using a function of the different harmonic components of the frequency spectrum of the supply current consumed by the protected device.
The problem that arises with this concept is that an extremely high value of the reference threshold could be calculated if during the continuous process of updating the protection threshold a SEL is produced. In that case, the threshold would take such high value that it would not provide any possible protection.
Fortunately, in the vast majority of applications cases, the radiation flux to which they are exposed is highly variable. In particular, when used on low-earth orbit (LEO) satellites, the amplitude of this fluctuation can be as much as five or six orders of magnitude and its fluctuation period of an hour, aproximately.
Taking this into account it is possible to think of a methodology where the next value of the protection threshold is calculated only within the time segment in which the radiation flux is low enough. This threshold will be applied at a later time, when the radiation flux reaches important risk levels. It is possible to associate these two conditions to two different operating modes: the Learning Mode and the Protection Mode respectively.
A preferred implementation of the proposed method is based on the execution of three processes: a) the mode determination process, b) the protection threshold calculation and refreshing process, and c) the power interruption process. A Flow chart showing the Mode Determination Process is shown in FIG 3a. The Radiation Flux Meter measures periodically (it could be between every two seconds or every two minutes) the flux of ionizing radiation from the environment in which it is operating (302).
Simultaneously, the Radiation Flux Comparator compares the level of ionizing radiation flux measured (304) with the threshold set in the Radiation Flux Reference level. If the level guarantee that the probability of a SEL is low enough, the Radiation Flux Measurement Unit will determine that the mode will be Learning (303). Otherwise, it will be Protection (301). The magnitude of the Reference Threshold for the Radiation Flux could be recorded permanently at the factory in a ROM memory or could be changed by commands from the ground station; using a rewritable, non-volatile and radiation-tolerant memory. The process shown in Fig. 3a is carried out using a radiation detector and its associated circuitry exposed to ionizing radiation, to produce a status signal defining the Operation Mode shared by all the protected devices on the satellite electronics.
FIG 3b shows a flowchart for the processes associated to each protected electronic device carried out in each Protection Unit(s) as a function of the Operation Mode and the measured parameter on the electronic device. Either immediately after the power-up, when the protected device is energized, or immediately after the execution of a SEL mitigation, the initial conditions are set up (305) and a delay occurs (306) to avoid acquiring the transient values of the in-rush current from the protected device and its power filter. At the end of the initial transient, the Current Sensor measures (308) the value of the supply current consumed by the device of interest and check (307) the status of the mode signal.
If the mode is Learning, the protection unit starts the process of calculating and refreshing the protection threshold. In this process, the Optimum Threshold Calculation unit (513 - shown in Fig. 5 below) acquires the supply current values and, from them, calculates the new threshold (310) and stores it (311) in the Reference Register. When the ambient radiation level exceeds the preset radiation threshold the mode indicated by the external signal switches to the Protection mode (307).
The calculation/updating operations of the supply current values used to calculate the protection threshold are suspended, and the device goes on to permanently check whether a SEL has been produced. When the mode of operation is Protection, the Protection Unit goes on to execute the interruption mitigation process upon the occurrence of a SEL. The acquired value is compared (316) with that of the protection threshold. If the measured supply current value is lower than the value of the reference threshold, the measurement (308) and comparison (316) process is repeated indefinitely. If, on the other hand, the supply current consumed is above this threshold, the protection device turns the power supply off immediately (317). The power supply is kept off (318) for the minimum time necessary to ensure the total extinction of the SEL.
At the end of this period, the device automatically reconnects the power (319) repeating the whole process from the beginning (300).
In FIG. 4 a block diagram can be seen representing a preferred realization of the layout using the method by a series of Protection Units (405) for the different protected devices. These Protection Units (405) are very small integrated circuits located externally very close to the corresponding protected electronic device (407). They all share the same information on the state of the ambient ionizing radiation flux but calculate different optimal protective current thresholds for each case. In the Radiation Flux Measurement Unit (404), the Radiation Flux Meter (402) periodically measures the ambient radiation flux within which the arrangement operates. In turn, the Radiation Flux Comparator module (403) compares radiation flux level measured periodically by the Radiation Flux Meter
(402) with the fixed level preset in the Radiation Flux Reference (401) and transmits the radiation flux status to each of the Protection Units (405). If the flux level is below the threshold preset by design, the Protection Units (405) will operate in the Learning mode. Otherwise they will operate in the Protection mode.
FIG 5 shows a block diagram of the Protection Unit (405), which allows to execute a SEL mitigation process using the optimal current reference value for each case. This unit is composed of two modules: the Optimal Current Threshold Calculation Unit (513) and the Power Supply Control Unit (514). The operation of both is conditioned by the radiation flux level indicated by the mode signal status (503).
During the Learning mode, the Reference Calculator (501) receives periodically samples of the supply current that also feeds the Supply Current Comparator (506). While in this mode the module calculates the optimal current threshold and updates it on the Reference Register (502) according to the evolution of the supply current. For the calculation, you can use one of the algorithms mentioned above, such as the maximum value function or the statistical function based on the calculation of the average and standard deviation of the current samples, to estimate the value of the protection threshold with which you update the corresponding register in real time.
If, instead, the mode is Protection, the Reference Calculator block (501) stops calculating and refreshing the optimal current threshold in the Reference Register
(502) and the Protection Unit (405) remains awaiting the occurrence of a SEL until the mode is changed again. Each Protection Unit (405) is connected in series between the VDC power supply (504) and the protected device (407) so that the supply current can be quickly interrupted by an electronic switch (508) in case a SEL is detected. This detection is achieved by continuously comparing the instantaneous value of the supply current of the protected device (407) with the value of the current Reference Register (502), using the Supply Current Comparator (506). In many implementations, a parallel switch (508) is also included with the protected circuit in order to provide a low impedance path for the parasitic currents entering through the inputs so that they are not able to sustain the SEL. A Timer (507) extends the power interruption long enough (e.g. 50-100 microseconds) to ensure that the SEL effect is extinguished and switch the power supply back on once this process has been completed. A summary of the operations performed in the different modes can be seen in TABLE 1.
TABLE 1
For clarity purposes, this table shows the operations performed by the Protection Unit (405). In low-radioactive environmental conditions (Learning mode) this unit dedicates all its time to estimate the optimum threshold and refresh the reference (502). If the measured supply current exceeds the value of the protection threshold, this value is adjusted without interrupting the power supply of the protected device. If the radiation level is high (Protection mode) then the Reference Calculator module (501) stops estimating the new threshold and stops refreshing the Reference Register (502). At the same time, the Supply Current Comparator (506) verifies that the supply current consumed by the protected device (407) does not exceed the previously established threshold value. If this happens, i.e. if a SEL occurs in these conditions, the Protection Unit (405) switchs off the protected device power supply until the undesirable condition becomes extinguished.
An example of the many possible preferred implementations of the Protection Unit (405) consists of an integrated circuit that requires no more than a few pins (let's say six, approximately) to perform its function. Two are connected in series between the power supply (504) and the protected device (510), one reads the operating mode signal (503), one inform the rest of the equipment if a mitigation is taking place (512) and the fifth connects to ground (509). This integrated circuit uses analog and digital technologies. The analog one performs the measurements (505), the comparison with the reference threshold (506) and the power interruption (508) for a limited period of time (507). It also uses digital technology including the Reference Calculator (501) and the Reference Register
(502) which will perform the operations for determining the optimum threshold from the measured data of the supply current history.
An example of the many possible implementations of the Radiation Measurement Unit (404) is the use of a CMOS image sensor as a radiation detector (402) with associated logic for operation. This implementation is extremely useful because in addition to its low cost it has the ability to detect protons and heavy ions that are the main type of particles that can produce SEL in these applications.
The protection arrangement (406) in Fig. 4 includes one or more Ambient Temperature Measurement Units (not illustrated) connected to one or more of the SEL Protection Units (405) in Fig. 5. The Temperature Measurement Unit consists of a temperature sensor configured to operate within the range of ambient temperatures in which the protected devices (407) have to operate. It provides them with a signal that is representative of the ambient temperature that the Protection Unit (405) uses to estimate the protection threshold for the next instant. For example, it can be used as an extra factor in any of the proposed algorithms whose value will be modulated by thermal cycles that occur inside the satellite when switching from the full sun exposition to the eclipse condition.
FIG 6 shows the effect of aging by radiation through the representation of the evolution of the supply current consumption of the protected device. It can be seen here how none of the supply current peaks in normal operation (601) reaches the threshold imposed (800) to protect the device against a SEL occurrence.
However in this case the threshold is permanently adjusted avoiding spurious mitigations, independently of the consumption fluctuations derived from the thermal cycles of the environment and independently of the total ionizing radiation aging of the protected device.
DEFINITIONS
SEL: Single Event Latchup, is an undesirable effect that can occur in CMOS technology devices by which a low internal impedance between the power terminals causes the device destruction.
SEL Mitigation: is the process by which the destructive consequences of SEL are avoided.
Spurious Mitigation Rate: is the percentage of mitigation processes that are executed without a SEL having occurred.
Protected Device: is the SEL-susceptible CMOS technology device whose possible destruction is to be avoided through the mitigation process.
Destruction Risk Level: is the probability that there is a destructive SEL current value that is not detected because it is below the protection current threshold used to initiate a SEL mitigation process.
Protection Current Threshold: is the value of the supply current consumed by the protected device taken as a reference to identify a SEL and initiate a mitigation process. The definition of the value of this threshold determines the rate of spurious mitigations and the level of risk of destruction. It is not always possible to zero both figures simultaneously and the relationship between them is inverse, i.e. the higher the spurious mitigation rate, the lower the risk of destruction. Optimum Protection Current Threshold: is the value of the Protection Current Threshold that simultaneously minimizes the Spurious Mitigation Rate and the Risk of Destruction. This value is immediately above the maximum value of the supply current consumed by the protected device and evolves as it ages due to the effect of accumulated damage from the radiation received.

Claims

1. A method for updating the reference threshold of at least one operating parameter which is taken for use in a process of mitigating a single event latchup (SEL) in a protected electronic device (integrated circuit), in particular where the operating parameter is the supply current consumed by the protected device, comprising the method of updating the steps of: measuring the flux of ionizing radiation in the environment in which the protected device is operating; detect whether the flux of ionizing radiation exceeds a radiation limit set by design; characterized by, in response to the non-exceeding of the ionizing radiation limit, performing a process of measuring and updating the characteristic values of the operating parameters of the protected device, which comprises the steps of: measuring the characteristic values of the operating parameters of the protected device and processing the measured values, updating the reference threshold of the operating parameter on the basis of the processed values.
2. The method according to claim 1, characterized by, in response to the exceeding of the ionizing radiation limit, execute a process of: a) monitoring the operating parameters of the protected device, b) detection of the SEL occurrence and, in response to the positive detection of the SEL: c) SEL mitigation.
3. The method according toclaim 2, characterized because the process of monitoring, detection and mitigation of SEL consists of: periodically measuring the supply current consumed by the protected device; detecting if the supply current consumed by the device of interest exceeds the reference threshold of the operating parameter established to protect it; and in response to exceeding the reference threshold of the operating parameter: disconnecting power to the device of interest during a pre-defmed time period.
4. The method according to any of the claims 2 or 3, characterized by the inclusion of a standby stage during which the supply current threshold is not calculated or at least not updated during the consumption peak that occurs immediately after the initial power up or immediately after the execution of a mitigation.
5. The method according to any of the previous claims, characterized by the fact that the process of measuring and updating the characteristic values of the operating parameters of the protected device comprises the steps of: periodically measuring the supply current consumed by the protected device; and calculating and periodically updating, on the basis of the previous step, the reference threshold of the operating parameter.
6. The method according to claim 5, characterized by using as an algorithm to calculate the protection threshold a function of the maximum value of the supply current consumed by the protected device.
7. The method according to claim 5, characterized by using as an algorithm to calculate the protection threshold the statistical mean of the measured values of the supply current consumed by the protected device plus a function of their standard deviation.
8. The method according to claim 5, characterized by using as an algorithm to calculate the protection threshold a function of the different harmonic components of the frequency spectrum of the supply current consumed by the protected device.
9. The method according to any of the claims 4 to 8, characterized by adjusting the calculation of the protection threshold according to a function of the operating ambient temperature value.
10. The method according to any of the previous claims, characterized by the fact that the step of processing the measured values and updating the reference threshold of the operating parameter involves calculating the reference threshold using a Reference Calculator unit (501) and storing it in a Reference Register (502).
11. A Protection Unit (405) for the mitigation of a single event latchup (SEL) in a protected electronic device (407), using an optimal threshold, characterized bycomprising: a Reference Calculator unit (501) configured to receive a signal representative of the level of the ionizing radiation flux, conditionally updating a reference threshold of consumption of the protected device according to the method of one of the preceding claims, and a Power Control Unit (514) of the protected device conditioned by the level of the ionizing radiation flux to interrupt or at least limit the current supplied to the protected device during the mitigation process defined in Claim 2; 3 or 4.
12. The protection Unit according to claim 11, characterized because the Optimum Threshold Calculation Unit, conditioned by the ionizing radiation flux level, comprises: a Supply Current Sensor (505) configured for measuring periodic samples of the protected device supply current; a Reference Calculator (501) configured to:
(a) receive data on the supply current consumed by the protected device and on the level of the ambient radiation flux,
(b) calculate the protective current limit and
(c) update it periodically whenever the level of the ambient ionizing radiation flux is below the radiation reference limit; and a Reference Register (502) configured to store the current reference each time the calculator updates it.
13. The Protection Unit according to claim 12, characterized by the fact that the Power Control unit, conditioned by the level of the ionizing radiation flux, comprises: a Supply Current Comparator (506) configured to compare the values of the supply current, consumed by the protected device, with the current limit protection value and to determine with this operation the existence of a SEL whenever the level of the ambient ionizing radiation flux is above the radiation reference limit; at least one Switch (508) connected in series with the power supply of the protected device, set to interrupt the power supply when a SEL is detected; and a Timer (507) set to reconnect the protected device to power after the period preset by design to produce extinction of the SEL effects.
14. The Protection Unit according to claim 13, characterized by at least one Switch connected in parallel with the power supply of the protected device and configured to discharge any parasitic current entering through the inputs of the protected device during the mitigation process.
15. The Protection Unit according to any of the claims 11 to 14, characterized because it is located externally and close to the corresponding protected electronic device.
16. An arrangement for the mitigation of a single event latchup (SEL) in a set of at least one protectable electronic device, using a reference threshold updated by the method of any of the claims 1 to 10, characterized by comprising: a Radiation Flux Measurement unit (404) which comprises: an Ionizing Radiation Flux Meter (402) configured to acquire periodic samples of the value of the ionizing radiation flux in the environment in which the protected device is to be operated, a Data Register (401) configured to contain the Radiation Flux Reference limit (determined by design), and a Radiation Flux Comparator (403) configured to compare the radiation flux values measured by the Ionizing Radiation Flux Meter and the Reference Radiation Flux limit stored in the Data Register; and a Protection Unit (405) according to any of the claims 11 to 15 for each protectable electronic device (407) in the array.
17. The arrangement according to claim 16, characterized by also comprising at least one Ambient Temperature Measuring Unit connected to the multiplicity of SEL mitigation devices, which comprises a temperature sensor, configured to operate within the range of ambient temperatures in which the protected device operates, by providing a signal proportional to those temperatures.
18. The arrangement according to any of the claims 16 or 17, characterized by including a Central Processing Unit (CPU) connected in series between the Radiation Flux Measurement Unit and the multiple SEL mitigation devices.
19. The arrangement according to any of the claims 17 and 18, characterized by the fact that the Ambient Temperature Measurement Unit is connected to the Central Processing Unit (CPU).
20. The arrangement according to any of the claims 16 to 19, characterized by the fact that the Data Register (401) comprises a ROM with the radiation threshold reference recorded.
21. The arrangement according to any of the claims 16 to 19, characterized by the fact that the Data Register (401) comprises a memory which stores the radiation threshold reference so that it can be changed by a remote command from a ground station.
EP20807674.5A 2019-10-31 2020-10-30 Method for updating the reference threshold of at least one operational parameter, protection unit for the mitigation of a single event latchup (sel) in an electronic device using the reference threshold and arrangement for the mitigation of a single event latchup (sel) in an array Withdrawn EP4052338A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
ARP190103158A AR116929A1 (en) 2019-10-31 2019-10-31 METHOD TO UPDATE THE REFERENCE THRESHOLD OF AT LEAST ONE OPERATING PARAMETER, PROTECTION UNIT FOR THE MITIGATION OF A SIMPLE LATCHUP EVENT (SEL) IN AN ELECTRONIC DEVICE USING THE REFERENCE THRESHOLD AND ARRANGEMENT FOR THE SIMPLE LATCHUP EVENT SEL) IN A SET
PCT/EP2020/080518 WO2021084073A1 (en) 2019-10-31 2020-10-30 Method for updating the reference threshold of at least one operational parameter, protection unit for the mitigation of a single event latchup (sel) in an electronic device using the reference threshold and arrangement for the mitigation of a single event latchup (sel) in an array

Publications (1)

Publication Number Publication Date
EP4052338A1 true EP4052338A1 (en) 2022-09-07

Family

ID=73452160

Family Applications (1)

Application Number Title Priority Date Filing Date
EP20807674.5A Withdrawn EP4052338A1 (en) 2019-10-31 2020-10-30 Method for updating the reference threshold of at least one operational parameter, protection unit for the mitigation of a single event latchup (sel) in an electronic device using the reference threshold and arrangement for the mitigation of a single event latchup (sel) in an array

Country Status (3)

Country Link
EP (1) EP4052338A1 (en)
AR (1) AR116929A1 (en)
WO (1) WO2021084073A1 (en)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023006501A2 (en) * 2021-07-30 2023-02-02 Airbus Defence And Space Sas Electronic spatial system
LU102862B1 (en) * 2021-09-30 2023-04-03 OroraTech GmbH Dynamic latch-up protection
WO2024189601A1 (en) * 2023-03-16 2024-09-19 Zero-Error Systems Pte. Ltd. A circuit apparatus and method for detection of or detection and protection against circuit anomaly

Family Cites Families (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA1287103C (en) 1986-04-22 1991-07-30 Jim Pinard Cmos latch-up recovery circuit
US5212616A (en) 1991-10-23 1993-05-18 International Business Machines Corporation Voltage regulation and latch-up protection circuits
US5672918A (en) 1994-08-18 1997-09-30 The United States Of America As Represented By The United States Department Of Energy System level latchup mitigation for single event and transient radiation effects on electronics
DE69528958T2 (en) 1995-01-31 2003-09-11 Stmicroelectronics S.R.L., Agrate Brianza Monolithic output stage with self-shielding against latch-up phenomena
US5828110A (en) 1995-06-05 1998-10-27 Advanced Micro Devices, Inc. Latchup-proof I/O circuit implementation
US6064555A (en) 1997-02-25 2000-05-16 Czajkowski; David Radiation induced single event latchup protection and recovery of integrated circuits
US6028341A (en) 1998-03-09 2000-02-22 United Microelectronics Corp. Latch up protection and yield improvement device for IC array
JP2006350425A (en) 2005-06-13 2006-12-28 Japan Aerospace Exploration Agency Single-event compensation circuit of semiconductor device
US7907378B2 (en) 2005-10-20 2011-03-15 Microchip Technology Incorporated Automatic detection of a CMOS device in latch-up and cycling of power thereto
US8896978B2 (en) * 2012-06-15 2014-11-25 Texas Instruments Incorporated Integrated circuit with automatic deactivation upon exceeding a specific ion linear energy transfer (LET) value
US8685800B2 (en) 2012-07-27 2014-04-01 Freescale Semiconductor, Inc. Single event latch-up prevention techniques for a semiconductor device
US8891215B2 (en) 2012-12-11 2014-11-18 Globalfoundries Singapore Pte. Ltd. High noise immunity with latch-up free ESD clamp
US9391448B2 (en) 2013-09-17 2016-07-12 The Boeing Company High current event mitigation circuit
CN103701087A (en) 2013-11-28 2014-04-02 兰州空间技术物理研究所 On-track monitoring method for space single event latchup effect
CN103762558A (en) 2014-01-21 2014-04-30 北京航空航天大学 Recoverable power interface circuit resistant to single event latchup
WO2016080909A1 (en) 2014-11-19 2016-05-26 Nanyang Technological University Electronic circuit for single-event latch-up detection and protection
US9960593B2 (en) * 2015-07-31 2018-05-01 Harris Corporation Single event latchup (SEL) current surge mitigation
US10886723B2 (en) * 2015-07-31 2021-01-05 Harris Corporation Adaptive single event latchup (SEL) current surge mitigation
US10048997B2 (en) 2016-05-04 2018-08-14 Hamilton Sundstrand Corporation Single event latch up mitigation in solid state power controllers
US10204906B2 (en) 2016-12-16 2019-02-12 Intel Corporation Memory with single-event latchup prevention circuitry
US9793899B1 (en) 2016-12-16 2017-10-17 Xilinx, Inc. Mitigation of single event latchup
US10289178B1 (en) 2017-04-04 2019-05-14 Xilinx, Inc. Configurable single event latch-up (SEL) and electrical overvoltage stress (EOS) detection circuit
CN107134758B (en) 2017-05-08 2019-02-22 哈尔滨工业大学 Cmos device single event latch-up effect protective device under a kind of space environment
CN208401733U (en) 2018-04-28 2019-01-18 北京鹏宇思睿科技有限公司 A kind of circuit module of on-board equipment Anti-surging and anti-single event latch-up
CN108494240B (en) 2018-04-28 2023-10-24 北京鹏宇思睿科技有限公司 Circuit module for preventing surge and single event latch for on-board equipment

Also Published As

Publication number Publication date
WO2021084073A1 (en) 2021-05-06
AR116929A1 (en) 2021-06-30

Similar Documents

Publication Publication Date Title
WO2021084073A1 (en) Method for updating the reference threshold of at least one operational parameter, protection unit for the mitigation of a single event latchup (sel) in an electronic device using the reference threshold and arrangement for the mitigation of a single event latchup (sel) in an array
KR101515849B1 (en) Automatic detection of a cmos device in a latch-up and cycling of a power thereto
EP3739349B1 (en) Fault tolerant fail-safe link comprising parallel branches
US9367118B2 (en) Computer system and operating method thereof
EP3254366B1 (en) Method for detecting a failing rectifier or rectifier source in a ups
US20100042344A1 (en) System and method for detecting an electrical short across a static switch of an uninterruptible power supply
EP2843836A1 (en) Solid state power controller and method for monitoring a solid state power controller
US20070091527A1 (en) Automatic detection of a CMOS circuit device in latch-up and reset of power thereto
WO2016059853A1 (en) Power control device and power control system provided with same
JP5511599B2 (en) Commutation type shut-off device
US6297661B1 (en) Semiconductor switch fault detection
JP2009194980A (en) Secondary battery device
EP3534485B1 (en) Battery pack, battery management system, and method therefor
KR100940313B1 (en) Digital protection relay having self observing function and method for preventing misoperation thterof
KR101291767B1 (en) Switchboards with standby power cut off functions
CN107181235A (en) Fault control for high-current pulse power supply
US20150333505A1 (en) Method and Apparatus Relating to Surge Protection
KR102110378B1 (en) Differential protective apparatus and method to prevent malfunction by digital protection relay's internal computation error
US20130289922A1 (en) Power supply built-in testing
KR101760203B1 (en) Operating device of thermocouple for measuring temperature of exhaust gas of gas turbine and method thereof
US20240364342A1 (en) System having single-event latch-up detection and mitigation
EP4160841A1 (en) Dynamic latch-up protection
US20240186784A1 (en) Residual overcurrent protection
US20230402661A1 (en) Battery protection methods and systems
KR20210056759A (en) Electric shock protection apparatus for high voltage water softener and method thereof

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20220511

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN

18D Application deemed to be withdrawn

Effective date: 20230503