WO2011121414A2

WO2011121414A2 - A method for mitigating single event upsets in sequential electronic circuits

Info

Publication number: WO2011121414A2
Application number: PCT/IB2011/000640
Authority: WO
Inventors: Farouk Smith
Original assignee: Nelson Mandela Metropolitan University
Priority date: 2010-03-29
Filing date: 2011-03-25
Publication date: 2011-10-06
Also published as: WO2011121414A3; ZA201206115B

Abstract

A method for mitigating the effects of single event upsets in sequential electronic circuits is disclosed. The method includes providing a sequential circuit that has next-state logic (A, B, X) with a number of outputs (101) each forming an input (D) for a state memory latch element such as a flip-flop (102), providing a second identical modular redundant circuit (Α', Β', Χ') which has the same number of next-state logic outputs (101 "), comparing each output of the sequential circuit with the corresponding output of the redundant sequential circuit and generating a voter output (106) for each pair of compared outputs (101, 101') which indicates the presence of a single event upset if the two outputs (101, 101 ') are not identical. The voter outputs (106) are then all compared by a multiple input voter circuit (108) and, if any one or more of the voter outputs indicate the presence of a single event upset, the flip flops (102) are all disabled until the presence of the single event upset has disappeared. In this way, the circuit "freezes" for the duration of the single event upset, so that the next-state logic outputs (101) are not latched into state memory while the single event upset is present.

Description

A METHOD FOR MITIGATING SINGLE EVENT UPSETS IN SEQUENTIAL

ELECTRONIC CIRCUITS

FIELD OF THE INVENTION

This invention relates to a method for mitigating single event upsets in sequential electronic circuits, and in particular to a method for mitigating the effects of single event upsets in programmable sequential electronic circuits such as, but not limited to, field programmable gate arrays.

BACKGROUND TO THE INVENTION

There is increasing interest in the use of field programmable gate arrays (FPGAs) for many space-based computing operations. Although FPGAs are generally slower than their application-specific integrated circuit (ASIC) counterparts, cannot handle as complex a design and draw more power, they do offer several important advantages. These include a shorter time to market, ability to re-program in the field to correct errors and lower engineering costs. Since this is ideal for spacecraft applications, the space community has actively evaluated radiation effects for most new FPGAs being introduced. Unfortunately, while FPGAs offer several benefits for space-based electronics, they are generally sensitive to Single Event Effects (SEE).

Single Event Effects (SEE) are caused by ionization as a consequence of the impact of a heavy ion (cosmic ray) or proton. The ionization induces a current pulse in a p-n junction. Single Event Effects include those effects which permanently damage circuitry, such as Single Event Latch-Up (SEL), Single Event Gate Rupture (SEGR), or Single Event Burnout (SEB), as well as "soft errors" referred to as Single Event Upsets (SEU), which do not permanently damage circuitry.

In the case of single event upsets, a current pulse may non-destructively change the state of a bi-stable element. In a satellite computer, for example, a bit-flip could randomly change critical data, randomly change the program, or confuse the processor to the point that it crashes. Single event upsets in an FPGA may affect the user design flip-flops, the FPGA configuration bitstream, as well as any hidden FPGA registers, latches, or internal state.

Configuration bitstream upsets are especially problematic because such upsets affect both the state and operation of the design. Configuration upsets may perturb the routing resources and logic functions in a way that changes the operation of the circuit. The effects of single event upsets in the device configuration memory are not limited to modifications in the memory elements, but they may also produce modifications in the interconnections inside Configurable Logic Blocks (CLB) and among different CLBs, thus giving rise to totally different circuits from those intended. SEUs can become Single Event Functional Interrupts (SEFI) when they upset control circuits, such as state machines, placing the device into an undefined state, a test mode, or a halt, which would then need a reset or a power cycle to recover. From the above it is apparent that some kind of single event upset mitigation scheme is crucial for the successful deployment of FPGA's for space-based applications.

Double Modular Redundancy (DMR) solutions rely on duplication of the sequential circuit and a comparison of the outputs of the duplicated circuits. DMR solutions, however, are only able to detect SEUs and not mask or correct them.

The most common mitigation scheme for correcting SEU errors in Static Random Access Memory (SRAM) FPGAs in orbit is Triple Modular Redundancy (TMR) plus scrubbing. Any single event upsets will be removed through scrubbing and the bad state will be masked or fixed by the triple modular redundancy (depending on the implementation). TMR is often exploited for hardening digital logic against single event upsets in safety- critical applications. As an instance, TMR is often exploited to design fault- tolerant memory elements to be employed in sequential digital logic. The main disadvantage of TMR is the excessive area overhead. The hardened design has 200% more area and power consumption than the original circuit, which limits its usage to reliability-critical applications. Radiation tolerant FPGAs for space and military applications are available, but these tend to be orders of magnitude more expansive than their off-the- shelf counterparts. Furthermore, while radiation tolerant FPGAs are capable of masking the effects of single event upsets in the configuration memory, triple modular redundancy is generally still required in the user logic circuitry for critical applications.

It would be advantageous to have a means for mitigating the effects of single event upsets in sequential electronic circuits that did not have the excessive circuit area requirements of triple modular redundancy, did not require expensive radiation tolerant circuitry, but which nevertheless offered substantial immunity against the errors caused by single event upsets.

OBJECT OF THE INVENTION It is an object of this invention to provide a method and a circuit structure for mitigating single event upsets in sequential electronic circuits which requires less power and surface area than triple modular redundancy solutions but which facilitates substantial immunity of the electronic circuits against errors resulting from single event upsets. SUMMARY OF THE INVENTION

In accordance with the invention there is provided a method for mitigating the effects of single event upsets in sequential electronic circuits, the method comprising providing a sequential circuit that includes next-state logic with a number of outputs each forming an input for a state memory latch element, providing a second identical redundant circuit which has the same number of next-state logic outputs, comparing each output of the sequential circuit with the corresponding output of the redundant sequential circuit, generating a voter output for each pair of compared outputs which indicates the presence of a single event upset if the two outputs are not identical, comparing all the voter outputs to determine whether any voter outputs indicate the presence of a single event upset and, if any one or more of the voter outputs indicate the presence of a single event upset, disabling all of the state memory latch elements until the presence of the single event upset has disappeared, so that the next-state logic outputs are not latched into state memory while the single event upset is present.

Further features of the invention provide for the latch elements to be flip-flops that are driven by a clock signal and which include an enable input by means of which they can be enabled or disabled.

Still further features of the invention provide for the voter outputs to be generated by voter circuits that output logic 1 if their inputs are the same and logic 0 if there is a difference between their inputs; for the voter circuits to be tri-state buffers that are resistant to single event upsets; and for all of the voter outputs to be compared by a single multiple-input voter that generates a single output of logic 1 if all its inputs are the same and 0 if there is a difference between any of its inputs.

Yet further features of the invention provide for the output of the multiple- input voter to be connected to the enable inputs of all of the flip-flops so that the flip-flops are all disabled for as long as the output of the multiple-input voter is at logic 0.

Further features of the invention provide for the method to include the step of identifying configuration memory single event upset errors by monitoring whether the flip-flops remain disabled for more than a pre-determined period; and, if this is the case, reconfiguring the configuration memory.

Still further features of the invention provide for the sequential electronic circuit to be a Field Programmable Gate Array (FPGA).

The invention extends to a sequential circuit structure capable of mitigating the effects of single event upsets, the circuit structure comprising a sequential circuit that has next-state logic with a number of outputs each forming an input for a state memory latch element, a second identical redundant sequential circuit with identical next-state logic and which has the same number of next-state logic outputs, a number of two-input voter circuits into which corresponding pairs of outputs from the sequential circuit and the redundant sequential circuit are input and which generate an output indicating the presence of a single event upset if the two outputs are not identical, and a multiple-input voter circuit which has as its input the output of each of the two-input voter circuits and which generates an output that indicates if any one or more of the two-input voter circuits indicate the presence of a single event upset, the output of the multiple-input voter being connected to an enable/disable input on all of the latch elements so that the latch elements are disabled while a single upset error is present, thereby preventing the next-state logic outputs from being latched into state memory while a single event upset is present.

Still further features of the invention provide for the two-input voter circuits to output logic 1 if their inputs are the same and logic 0 if there is a difference between their inputs, and for the multiple-input voter circuit to generate a single output of logic 1 if all its inputs are the same and 0 if there is a difference between any of its inputs.

Yet further features of the invention provide for the sequential electronic circuit to be a Field Programmable Gate Array (FPGA); for the FPGA to be an SRAM-based FPGA; and for the two-input voter circuits to include tri-state buffers and the multiple-input voter circuit to include a series of tri-state buffers. BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings:-

Figure 1 is a circuit diagram of a tri-state buffer voter for indicating whether two input signals differ from each other;

Figure 2 is a circuit diagram of a multiple input voter circuit for indicting whether any of its input signals differ from each other;

Figure 3 is a circuit diagram of a sequential circuit structure capable of mitigating the effects of single upset errors according to the invention;

Figure 4 is a circuit diagram of a simple 2-bit counter circuit;

Figure 5 a simulated trace of the normal operation of the counter circuit shown in Figure 4;

Figure 6 is a simulation trace of the outputs of the counter circuit of

Figure 4 in which a simulated single upset error has been introduced;

Figure 7 is a circuit diagram of a hardened counter circuit that implements the method of the invention;

Figure 8 is a simulation trace of the outputs of the circuit of Figure 7;

and

Figure 9 is a circuit diagram of an experimental setup for testing the circuit and method of the invention.

LIST OF ABBREVIATIONS

The following is a list of the acronyms and abbreviations used in this specification and their meanings:

ASIC: Application-Specific Integrated Circuit

BUF: Tri-state Buffer

CLB: Configurable Logic Block

DMR: Double Modular Redundancy EDIF: Electronic Design Interchange Format

FE: Functional Error

FPGA: Field Programmable Gate Array

FSM: Free State Machine

LUT: Look Up Table

SEB: Single Event Burnout

SEE: Single Event Effect

SEFI: Single Event Functional Interrupts

SEGR: Single Event Gate Rupture

SEL Single Event Latch-Up

SEU: Single Event Upset

SRAM: Static Random Access Memory

TMR: Triple Modular Redundancy

VHDL: Very high speed integrated circuit Hardware Description

Language

DETAILED DESCRIPTION WITH REFERENCE TO THE DRAWINGS

For a single event upset (SEU) particle strike to result in a soft error in a sequential circuit, three conditions have to be satisfied: (1) an active path must exist between the afflicted node and the output of the circuit; (2) the pulse must be wide enough to avoid inertial delay filtration through subsequent gates and survive electrical attenuation along the active path; and (3) the pulse should arrive within the setup and hold time of a latch element, such as a flip-flop, to be captured and cause a soft fault.

A sequential circuit operates by transitioning from one state to the next, generating different output signals. The part of a sequential circuit that is responsible for determining the next state is called the next-state-logic circuit. Based on the current state of the system (the state memory flip-flops) and any input signals, the next-state-logic will determine the next state of the system. The next-state-logic is just a combinational circuit that takes as its inputs the current system state as well as any input signals. The outputs of the next-state-logic logic are used to change the contents of the state memory flop flops. The circuit changes state when the contents of the state memory change, and this happens at the active edge of every clock cycle. Double Modular Redundancy, as the name suggests, provides an identical circuit to the original, with a comparator (voter) at the outputs in order to detect a difference. A difference recorded by the comparator indicates that a single upset error has been detected. This can easily be accomplished in an SRAM based FPGA by making use of the tri-state buffer voter (10) illustrated in Figure 1 , or could be accomplished by making use of an XNOR gate in the case of a Flash-based FPGA such as an Actel Flash FPGA.

As shown in Figure 1 , module A (12) is a combinational circuit that is duplicated at A'. Two cross-connective active high enabled buffers (14) function to implement an XNOR function, the logical equality function. The output n (16) will be logic 1 as long as inputs A and A' are the same. Should inputs A and A' differ due to an SEU having occurred in one of the combinational circuits, the voter output n will output logic 0. Most SRAM based logic would have to implement this voter circuit (10) in SRAM cells just as any other Boolean function would be, which would make the voter circuit itself equally susceptible to single event upsets. However, the Xilinx Virtex FPGA architecture provides tri-state buffer voters (BUFs) that are actually a hard-wired AND-OR logic structures, and therefore the voters built from these BUFs have a high tolerance to SEUs when compared to voter circuits implemented using SRAM cells. This architecture is described in C. Carmichael, "Triple Modular Redundancy Design Techniques for Virtex FPGAs," Xilinx, xapp197 (v0.4) edition, 2001. When making use of a Flash based FPGA such as the Actel ProASIC range of FPGA, SEUs in the configuration memory would not be as much of a problem as its configuration memory consists of FLASH memory which is resistant to SEUs. The same holds true for anti-fuse based FPGAs such as the Actel range of Antifuse FPGAs, with configuration memory consisting of antifuse cells that are resistant to SEUs. In Flash based and anti-fuse based FPGAs, therefore, the two-input voter circuits will typically be implemented directly by using XNOR gates, while the multiple-input voter circuit will be implemented by using a multiple input AND gate as a voter.

It will be readily apparent that while the simple Double Modular Redundancy arrangement described above enables the presence of an single event upset to be detected, it cannot correct or mask the effects since there is no way of knowing which of the two circuits (A or A') has given the correct (or incorrect) output.

Figure 3 shows a diagram of a sequential circuit structure (100) capable of mitigating the effects of single upset errors according to the method of this invention. As shown in Figure 3, double modular redundancy is applied to a particular sequential circuit so that all gates within the next state logic of the sequential circuit are duplicated (A, B, X). Two-input voter circuits (104) compare each of the outputs (101) of the duplicated combinational next-state-logic circuits, just before the input to the state memory flip-flops (102). The reason for placing the voter circuits at this location in the circuit is because the only single upset errors of interest are those that propagate to the flip-flops.

Upon detection of an SEU at the input of the 2-input voters (104), the output (106) of that voter becomes logic 0. The outputs of each of the 2-input voters are then input into a multiple input voter circuit (108) which functions in an identical manner to the two input voter circuit in that it produces a single output (110) which will be logic 0 when any of its inputs (106) differ from one another. One such possible multiple input voter circuit (108) is illustrated in Figure 2, and comprises a series of cross-connected active high enabled buffers (14) that, in the case of the Xiling Virtex FPGA architecture, are exactly the same as the buffers in Figure 1. In the case of Flash-based or anti-fuse FPGAs, the two-input voters (104) will be XNOR gates.

Under normal operating conditions, all the inputs to the multiple input voter (108) will be logic 1 , and hence its output will be logic 1. In this situation, the sequential circuit will operate as normal with state changes at the active edge of each clock cycle. However, with the detection of an SEU, one of the inputs will become logic 0, and the output (110) will therefore become logic 0. Therefore, the output of the multiple input voter circuit is logic 0 whenever there is an SEU detected by any one or more of the 2-input voters.

The output of the multiple input voter circuit (110) is connected to the enable inputs (E) of all of the state memory flip-flops in the sequential circuit. Hence, whenever an SEU is detected by any of the circuit's two-input voters, the flip- flops are disabled. Since all of the flip-flops are disabled, the error introduced by the SEU will not be latched into the flip-flop memory at the active edge of the next clock cycle. The sequential circuit structure of Figure 3 therefore operates to "freeze" the sequential circuit at a particular state as soon as an SEU is detected by the voters at the input of any of the state memory flip- flops. As soon as the transient pulse disappears, the circuit is "unfrozen" so that it can continue where it left off. Since the flip-flops are disabled during the time that the SEU occurs, no errors are latched into the state memory flip-flops. Since the transient pulse that causes an SEU is a momentary signal, the output of the multiple input voter will become logic 1 again as soon as the transient disappears, enabling the state memory flip-flops so that the sequential circuit can continue where it left off without a loss of state. The only penalty introduced is a time delay. However, depending on the speed of the circuit clock frequency compared to the SEU lifetime, this delay penalty could be as little as one clock period.

The speed at which the sequential circuit sequences through its states is determined by the speed of the clock signal. Under normal conditions, at each active edge of the clock signal the state memory register is enabled and the next-state value is stored into the state memory flip-flops. The limiting factor for the clock speed is in the time that it takes to perform all the data operations assigned to a particular state. All data operations assigned to a state must finish their operations within one clock period so that the results can be written into the registers at the next active clock edge. The same can be said when an SEU is detected and the state of the circuit is frozen. If the SEU length is less than one clock period, which it normally is, the delay penalty will only be one clock period.

When the circuit illustrated in Figure 3 is mapped to an FPGA, it is the configuration memory that determines the operation of the circuit. Configuration bitstream upsets are especially important because such upsets affect both the state and operation of the design. Configuration upsets may perturb the routing resources and logic functions in a way that changes the operation of the circuit.

Should the SEU strike the configuration memory of an SRAM based FPGA and result in a configuration memory error, the sequential circuit will remain frozen in its current state since this type of error will remain until the FPGA is reconfigured. Configuration memory SEU errors can therefore easily be detected by assuming that if the circuit is "frozen" for more than a predetermined number of clock periods, then the error is due to configuration memory corruption, and the FPGA can thus be reconfigured. By making use of the Partial Reconfiguration feature of the Virtex series FPGAs, the SEU correction procedure could be speeded by partially reconfiguring the SEU affected part of the configuration memory. As a result only the corrupted data can be reloaded, effectively reducing the correction time to about 3ps.

Illustrative Simulation

An illustrative comparative simulation was done by using a simple 2 bit counter circuit (200) shown in Figure 4. The counter circuit (200) includes two flip-flops (202) and implements a 2-bit counter that counts from 0 to 3 and then repeats. The VHDL code of the circuit was compiled and simulated in the ModelSim Simulation software and a simulated trace of the normal operation of the counter circuit is shown in Figure 5.

Single event upsets were then introduced into the circuit (200) at the output of the next-state-logic circuit, just before the inputs (D) to the flip-flops. The SEU simulator temporarily inverts the value of the inputs when an SEU is introduced. As discussed previously, it is only necessary to introduce SEUs at the flip-flop inputs, since only those SEUs that propagate to the flip-flops are of interest. Figure 6 shows the effect of the SEU on the sequential circuit (200) in that it transits into an incorrect state. Instead of moving from state 2 to 3, the sequential circuit transits from state 2 to state 1. State 1 therefore represents an incorrect state transition (202). If state 1 was an undefined state, a test mode, or a halt, the circuit would need a reset or power cycle to recover.

Figure 7 illustrates a hardened counter circuit (300) which implements the method of the invention. Double modular redundancy has been applied to the counter circuit of Figure 5, with all of the gates and flip-flops duplicated. The hardened circuit has two 2-input voters (302) at the output of the next-state- logic and a multiple input (in this case also 2-input) voter (304). The voters can be implemented using either LUTs or tri-state buffers. For SRAM FPGAs they are preferably implemented using tri-state buffers as they are resistant to SEUs. As previously mentioned, for Flash-based and anti-fuse FPGAs, the 2-input voters (302) are implemented by the XNOR gate using LUTs, while the multiple input voter (304) is implemented by a multiple input AND gate using LUTs.

An SEU is again introduced into the circuit of Figure 7 at the output of the next-state-logic, just before the input of the flip-flops. Figure 8 shows a simulation trace of the outputs Q1 and Q0 of the circuit of Figure 7. As can clearly be seen at reference numeral (306), the SEU causes the circuit to "freeze" in state 2 for one clock period longer than it would have otherwise, after which it correctly transitions to state 3.

Experimental Results

The SEU mitigation scheme of the invention was tested on the sequential circuits of the ITC99 benchmark suite. The netlists which were in EDIF (Electronic Design Interchange Format) were converted into structural VHDL (Very high speed integrated circuit Hardware Description Language) format. This ensured that the generated VHDL file could be fed into the manufacturer design software to map the designs onto the relevant FPGAs.

The sequential circuit structure for implementing the method of the invention was then coded in "C" language. The generated VHDL netlist from the EDIF was then fed into the compiled "C" code to create the DMR circuit which was also in a structural VHDL code. Finally, an SEU simulator was built that was able to inject faults into the circuit for testing. To achieve this, the VHDL simulator outputs were directly connected to the flip-flop inputs, since only faults that propagate to the flip- flops are of interest. Since the flip-flops are driven by two sources, the original input and the simulator output, a VHDL resolution function was created in order to resolve the two signals driving one output. Figure 9 shows an example of the experimental setup in which the single upset errors are introduced by means of a VHDL simulator (400).

The method of the invention was tested on various benchmark circuits chosen from the ITC99 Benchmark Suite. Each benchmark circuit was first synthesized into structural VHDL code using Synopsis FPGA Compiler II. The generated VHDL netlist was then fed into the DMR compiled code to create the DMR circuit which was also in structural VHDL code. Fault simulation was then performed on the hardened circuit using the VHDL simulator ModelSim, which introduces upsets on each of the output lines of the next-state-logic circuit. Thus, if there were 10 flip-flops in the circuit, the simulator inserted 10 single event upsets, one for each flip-flop. In order to facilitate comparison, the original circuit, a Triple Modular Redundancy circuit, and the DMR circuit of the invention were tested side-by-side.

Each benchmark circuit was tested using a 1000 input vector sequence. The sequence was randomly generated with each input vector duration being equal to one clock period. The original, DMR as well as the TMR circuits were tested with the same set of test vectors.

The output of the DMR circuit and that of the original could not be compared directly by XOR-ing them. Unlike a combinational circuit, a sequential circuit will follow an unknown sequence once the SEU is latched into the state memory flip-flops. In the case of the DMR circuit, a one clock period delay will be introduced. If the outputs of two sequential circuits (DMR and original) are compared, and an SEU is inserted into the DMR circuit, only the first SEU will be correctly detected. Afterwards the Free State Machine (FSM) of the DMR circuit will follow a delayed sequence compared to that of the original circuit. Any further comparison will give unequal output values. To overcome this problem, the output of the multiple input voter of the DMR circuit was also connected to the enable inputs of the state memory flip-flops in the original circuit. Consequently the original circuit was also delayed in order to facilitate comparison to the DMR circuit. In addition to the state memory flip- flops enable inputs, the output of the multiple input voter was also connected to a counter. This enabled the counting of the number of clock period delays due to SEUs. The counter's clock was synchronized to that of the DMR circuit; therefore, only SEUs that appeared at the active edge of the clock signal was counted.

ITC'99 TMR

Benchmark

Functional Circuit Circuit

Errors Area delays

b01 0 126 0 b02 0 78 0 b03 0 423 0 b04 0 1758 0 b05 0 2736 0 b06 0 156 0 b07 0 1257 0

b08 0 474 0

Table 1 : Comparison of the Experimental Results for ITC99 Benchmark

Circuits Table 1 shows the experimental results for the ITC'99 benchmark circuits b01 to b08. As can be seen, there are no functional errors in the DMR circuit of the invention. The only difference in terms of delay between the DMR circuit and the TMR circuit is one clock cycle delay per SEU. Depending on the frequency of operation, this could translate into a negligible delay in practical circuits.

The next phase of the experiment was to test the DMR method of the invention on the ITC99 benchmarks in a more realistic scenario. The SEUs were simulated to occur randomly on any line of the circuit and introduce a fault on a line at a random time. The simulator subjects the circuit to this condition by randomly injecting a fault on any one signal. An SEU can occur during the input transitions or at any instance during the application of inputs.

The benchmarks were tested using 1000 SEUs, one per each test vector. The input test vector sequence was randomly generated with each vector duration equal to one clock period. This is equivalent to simulating the circuit in an actual radiation environment for a period of about 1000 days. This is assumed based on empirical data that shows that approximately 10^~5 bit- upsets per day can be expected in circuit elements, which can be approximated to one SEU per day in the circuit. Furthermore, the duration of an SEU upsetting the device was chosen to be less than 200 ps.

Table 2 below shows the test results for the ITC99 benchmarks under these more realistic simulated conditions. ITC'99 Original DMR

Benchmark

SEUs FEs Circuit Circuit SEUs FEs Circuit Circuit

Area Delays Area delays b01 5 5 42 0 68 0 84 68 b02 4 4 26 0 58 0 52 58 b03 30 30 141 0 83 0 282 83 b04 66 66 586 0 62 0 1172 62 b05 34 34 912 0 65 0 1824 65 b06 9 9 52 0 59 0 104 59 b07 49 49 419 0 67 0 838 67 b08 21 21 158 0 58 0 316 58 b09 28 28 158 0 64 0 316 64 b10 17 17 178 0 45 0 356 45 b12 121 121 1031 0 76 0 2062 76 b13 53 53 328 0 91 0 656 91

ITC'99 TMR

Benchmark

FEs Circuit Circuit

Area delays

b01 0 126 0

b02 0 78 0

b03 0 423 0

b04 0 1758 0

b05 0 2736 0

b06 0 156 0

b07 0 1257 0

b08 0 474 0

b09 0 474 0 b10 0 534 0

b12 0 3093 0

b13 0 984 0

Table 2: Comparison of the Experimental Results for ITC99 Benchmark

Circuits under More Realistic Simulation Conditions In Table 2, the SEU column indicates the number of SEUs that propagate to the flip flop inputs at the active edge of a clock signal. FE's are the Functional Errors that occur due to the SEUs. The Circuit Area column is the number of circuit elements - namely, the number of gates plus the number of flip-flops. The Circuit Delays are expressed in number of clock periods.

The SEU sensitivity (the number of SEUs that propagate to the flip-flops at the active edge of the clock) in the DMR circuits of the invention is between 45 and 91 when it receives simulated SEU inducing particles over an equivalent period of 1000 days. However, no errors are introduced into the circuit. Only one clock period delay per SEU is observed. In a practical circuit with a clock period of 20ns, this would mean that the delay introduced into the DMR circuits of the invention would only be between 0.9με and 1.82ps over a period of approximately 3 years, which is of course negligible. The area of the DMR design is exactly twice that of the original circuit, compared with TMR which is three times more for the same design. Hence, the DMR method of the invention is a powerful SEU mitigation technique for sequential circuits. It will be noted that the number of voter circuits required for the DMR circuit is very high when compared to the TMR circuit. However, when used in an SRAM FPGA, the DMR method can be used on a device which has abundant tri-state buffers such as the Xilinx Virtex FPGA.

The invention therefore provides a powerful, simple and effective technique for mitigating the effects of single event upsets in sequential circuits that have been mapped to FPGAs. The area of the design is exactly twice that of the original circuit (excluding the area of the voting circuits), compared with triple modular redundancy solutions which have three times more area and power consumption than the original circuit for the same design. The invention facilitates substantial immunity against all single event upset errors, at a small penalty of typically no more than one clock cycle of lost processing time per SEU. It will be appreciated that the invention is not limited to the described embodiment and that many variations may be made which fall within the scope of the invention. For example, the sequential circuit structure of the invention could be implemented in any sequential circuit hardware, including flash-based FPGA's, anti-fuse FPGA's or even SRAM circuits. While it is expected that the method and circuit structure of the invention will be most suited to space-based applications which require hardening against SEUs, it can be used in any sequential circuit application including high-end space- based applications in which radiation-tolerant circuits are used, military applications, or safety-critical terrestrial civilian applications.

Claims

A method for mitigating the effects of single event upsets in sequential electronic circuits, the method comprising providing a sequential circuit that includes next-state logic (A, B, X) with a number of outputs (101 ) each forming an input (D) for a state memory latch element (102), providing a second identical redundant circuit with identical next state logic (Α', Β', Χ') and the same number of next-state logic outputs (101'), comparing each output of the sequential circuit (101) with the corresponding output of the redundant sequential circuit (101 '), generating a voter output (106) for each pair of compared outputs (101 , 101 ') which indicates the presence of a single event upset if the two outputs are not identical, comparing all the voter outputs (106) to determine whether any voter outputs indicate the presence of a single event upset and, if any one or more of the voter outputs indicate the presence of a single event upset, disabling all of the state memory latch elements (102) until the presence of the single event upset has disappeared, so that the next-state logic outputs (101) are not latched into state memory while the single event upset is present.

The method as claimed in claim 1 in which the latch elements (102) are flip-flops that are driven by a clock signal and which include an enable input (E) by means of which they can be enabled or disabled.

The method as claimed in claim 1 or claim 2 in which the voter outputs (106) are generated by voter circuits (104) that output logic 1 if their inputs are the same and logic 0 if there is a difference between their inputs.

The method as claimed in claim 3 in which the voter circuits are tri- state buffers (104) that are resistant to single event upsets. The method as claimed in any one of the preceding claims in which all of the voter outputs (106) are compared by a single multiple-input voter circuit (108) that generates a single output (110) of logic 1 if all its inputs are the same and 0 if there is a difference between any of its inputs.

The method as claimed in claim 5 in which the latch elements (102) are flip-flops that are driven by a clock signal and which include an enable input (E) by means of which they can be enabled or disabled, and in which the output (110) of the multiple-input voter circuit (108) is connected to the enable inputs (E) of all of the flip-flops (102) so that the flip-flops are all disabled for as long as the output of the multiple- input voter circuit is at logic 0.

The method as claimed in any one of claims 2 to 6 which includes the step of identifying configuration memory single event upset errors by monitoring whether the flip-flops (102) remain disabled for more than a pre-determined period; and, if this is the case, reconfiguring the configuration memory.

The method as claimed in any one of the preceding claims in which the sequential circuit (100) is a Field Programmable Gate Array (FPGA).

A sequential circuit structure (100) capable of mitigating the effects of single event upsets, the circuit structure comprising a sequential circuit that has next-state logic (A, B, X) with a number of outputs (101) each forming an input (D) for a state memory latch element (102), a second identical redundant sequential circuit with identical next-state logic (Α', Β', Χ') and which has the same number of next-state logic outputs (10 ), a number of two-input voter circuits (104) into which corresponding pairs of outputs (101 , 101 ') from the sequential circuit and the redundant sequential circuit are input and which generate an output (106) indicating the presence of a single event upset if the two outputs (101 , 101 ') are not identical, and a multiple-input voter circuit

(108) which has as its input the output (106) of each of the two-input voter circuits and which generates an output (110) that indicates if any one or more of the two-input voter circuits indicates the presence of a single event upset, the output (110) of the multiple-input voter circuit being connected to an enable/disable input (E) on all of the latch elements (102) so that the latch elements are disabled while a single upset error is present, thereby preventing the next-state logic outputs (101) from being latched into state memory while a single event upset is present.

10. The sequential circuit structure as claimed in claim 9 in which the latch elements (102) are flip-flops that are driven by a clock signal and which include an enable input (E) by means of which they can be enabled or disabled.

11. The sequential circuit structure as claimed in claim 10 in which the two-input voter circuits (104) are output logic 1 if their inputs are the same and logic 0 if there is a difference between their inputs, and the multiple-input voter circuit (108) generates a single output of logic 1 if all its inputs are the same and 0 if there is a difference between any of its inputs.

12. The sequential circuit structure as claimed in any one of claims 9 to 11 in which the sequential electronic circuit (100) is a Field Programmable Gate Array (FPGA).

13. The sequential circuit structure as claimed in claim 12 in which the sequential electronic circuit (100) is an SRAM-based FPGA, the two- input voter circuits include tri-state buffers and the multiple-input voter circuit includes a series of tri-state buffers.