Part 1 of this mini-series covering single event upset (SEU) challenges in FPGA architectures examined radiation particles and related SEU challenges for FPGA applications that require robustness and predictability in ground-based and terrestrial applications.
Part 2 of the mini-series will cover SEU detection, recovery, and validation for FPGAs used in mission-critical systems such as aerospace, defense, telecommunications, and industrial applications.
Detection and recovery from SEUs require a layered strategy that addresses the distinct vulnerabilities of configuration RAM (CRAM), user logic, and embedded data storage. No single technique provides comprehensive coverage across all FPGA resource types. Instead, an effective approach combines complementary methods, each targeting a specific failure mode, with recovery mechanisms that are tightly coupled to the detection events that trigger them.
The following sections describe the detection techniques and their associated recovery strategies, from configuration-layer monitoring to logic-level redundancy to system-level behavioral observation.
CRAM readback and scrubbing
CRAM readback is the most basic detection technique for SEUs in CRAM. The system calculates a cyclic redundancy check (CRC) for the bitstream. An internal hardened configuration block in the FPGA reads back the CRAM contents and compares the calculated CRC to the expected result. If the results don’t match, the system can set a status flag to alert the user, for example via an internal interrupt to a soft processor or an external pin to a system-level board controller.
If the system flags an SEU error, the user can take action, for example:
- Stop the FPGA application and reload the bitstream, overwriting the CRAM to fix the flipped bit.
- Wait for an accumulation of SEUs before halting the application and reloading the bitstream.
- In some applications, it may be acceptable to power cycle the board and thereby the FPGA, which automatically reloads the bitstream upon power-up.
SEU scrubbing is another SEU recovery technique. Some FPGAs contain blind scrubbing circuits that run in the background and can periodically rewrite the entire bitstream regardless of whether the system detects an error. It’s easy to implement blind scrubbing because it does not require comparison logic; the downside is that blind scrubbing cannot give diagnostics on error rates and specific locations of SEU.
You can schedule scrubbing continuously or for a fixed period, depending on the application and trade-offs on additional power utilization. At terrestrial levels, you can usually set scrubbing intervals further apart, while at higher elevations, given the higher probability of radiation particles, intervals should be shorter.
More advanced SEU readback scrubbing circuits can detect and fix SEUs and report multiple upsets within a bitstream frame. Recent FPGA architectures have bitstreams that have frames that program subsets of the CRAM. Each frame is protected with single error correction and double error detection (SECDED). The SEU readback scrubbing circuit reads the contents of the CRAM and compares the calculated error correction code (ECC) for each frame with a known good ECC for that frame.
If the comparison fails, the circuit can locate the single bit failure based on the ECC mismatch signature and re-write the bitstream frame with the incorrect bit corrected. The SEU readback circuit is more complex and can give better diagnostics for error rates and failure locations. If the readback detects multiple uncorrectable errors however, you may need to reload the entire bitstream or power cycle the FPGA.
Error detection and correction for block RAM
Block RAM upsets require a dedicated detection and correction strategy because the stored data changes dynamically during operation and cannot be protected by static configuration scrubbing. Data written to RAM is wider by a certain number of bits, depending on the data width and encoding used for protection.
If you use an ECC encoder when writing data to RAM, you can use an ECC decoder when reading from RAM to detect corruption. ECC encoders and decoders can detect and correct single- and double-bit errors. From a system design perspective, using ECC to protect block RAM adds latency for encoding and decoding.
Some FPGAs have in-silicon ECC encoders for writing to the RAM and ECC decoders for reading from the RAM to detect and correct corrupted bits. These hardware-based encoders/decoders use more silicon area, have higher power, and have additional output delays. Implementing ECC encoding and decoding in your RTL design is a good option if few block RAMs are used for critical functions such as soft processor program memory, high integrity data paths, or state machine storage.
Triple modular redundancy (TMR)
TMR is the most robust mitigation strategy to guard against SEU errors. TMR requires three independent copies of a circuit to produce the same output. Each circuit has its own copy of combinational and sequential logic. The system compares the result from all three circuits, and two out of the three must match. This method provides a correct result even if one circuit is corrupted.
TMR provides continuous cycle-to-cycle error masking without any detection latency, and is very effective for protecting state machines, control logic, and safety-critical signal paths. However, TMR requires very strict architectural implementation to guarantee that none of the circuits share logic or routing with each other.
Although robust, TMR comes with a large trade-off in terms of FPGA resource usage and power. You need to use at least three times the resources to accommodate the triple redundancy and plan on higher power requirements as a result. Additionally, TMR cannot self-correct a bit error. A bit flip in one of the circuits continues to be corrupt until CRAM scrubbing can address the corruption.
Measuring SEU rates in FPGAs
Quantifying the reliability of an FPGA’s exposure to SEU can be done with specific testing using particle beam accelerators in specialized facilities. The standard figure of merit for terrestrial SEU rate is the soft error rate (SER) expressed in failures in time (FIT), where one FIT equals one failure per 10⁹ device hours.
Most FPGA manufacturers that support SEU detection and scrubbing reserve time at reputable facilities that can provide high energy beams of heavy ions, neutrons, protons, and alpha particles. Facilities can be found in the U.S., Canada, Switzerland, and Japan. This ground-based approach for accelerated testing helps to characterize the FPGA family’s radiation sensitivity. FIT data from the testing helps predict upset rates in target environments.
Ground-based testing and analytical modeling provide pre-deployment FIT rate estimates, but operational monitoring during deployment in the application environment provides the most accurate characterization of device behavior. CRAM detection and scrubbing circuits can log time, location, and frequency of detected SEUs, which you can compare to pre-deployment predictions.
If you observe rates that differ from pre-deployment predictions, you can redesign critical circuits, change scrubbing intervals, and/or change operational range. Most FPGA users work closely with their FPGA vendor to understand measured ground-based FIT rates from beam testing within a specific family and compare it to the application environment testing results.
FPGAs with SEU capabilities
Take the case of Efinix’s Titanium and Topaz families that are built on TSMC’s 16-nm FinFET process. These FPGAs benefit from the inherent SEU sensitivity advantages of the FinFET geometry relative to planar 2D transistor architectures at equivalent geometry.
These FPGas have characterized SEU behavior through independent testing conducted per JEDEC Std. JESD89A for alpha particles and per STd. JESD89 and JESD89-A for neutron particles, providing design engineers with measured FIT data from which you can determine system-level reliability.
The company’s Titanium FPGAs have CRAM SEU detection that lets design engineers monitor configuration integrity and respond to detected upsets through external recovery actions. Efinix also provides data on the FIT contribution from SEU events (transient failure rate) in a soft-error rate (SER) report.
Design engineers can use this data to determine whether on-chip mitigation features are required to achieve target Probabilistic Metric for random Hardware Failures (PMHF) values under ISO 26262-5 for their specific ASIL level.
Next, Titanium Edge FPGAs pair SEU detection capability with hardware scrubbing. The scrubbing architecture implements SECDED on a per-frame basis, operating at clock rates up to 80 MHz. SECDED enables automatic single-bit error correction without an external processor, and it flags uncorrectable double-bit errors for system-level response.
The SEU detection is configurable to meet different application needs. Automatic detection cycles through CRAM frames without user intervention, providing the lowest mean time to detection and the highest assurance of configuration integrity. Manual monitoring allows you to initiate a scrub cycle on demand.
Similarly, you can set detection and correction triggering as automatic, manual, or fixed-rate operation, tailoring the scrubbing interval to your deployment environment’s potential SEU rate. To support design validation and test system robustness, Titanium Edge FPGAs include a hardware error injection capability that can inject a single-bit error at any location within the CRAM array.
Finally, Topaz FPGAs have similar SEU detection capabilities as the Titanium family, but they don’t have the Titanium Edge scrubbing architecture overhead. System designers can monitor detected SEU errors and recover from them via an external action. This family is targeted at high-volume applications such as machine vision, industrial robotics, and broadcast imaging and controls.
Why SEU detection is critical
Radiation-induced SEUs represent a reliability challenge in modern FPGA design and technology. SEUs can silently flip bits that corrupt configuration memory, embedded memory, routing, and logic, thereby negatively impacting system behavior.
The threat to smaller process geometry FPGAs affects terrestrial applications as well as ground-based applications where thousands of FPGAs may be deployed in a system. Ground-based FIT rates may be low for a single FPGA, but when thousands are deployed, the probability of SEU impacting system behavior may increase to a level that requires detection and recovery.
Packaging technology advancements to reduce trace radioactive impurities and alpha particle emission have helped FPGA vendors reduce FIT rates. However, heavy ions, protons, and neutrons continue to expose FPGA vulnerabilities and require heavy beam testing to quantify the sensitivity to SEU and resulting FIT rates.
Detecting SEUs and scrubbing FPGA CRAM are critical to quantify an accumulation of errors that may require a reconfiguration or power cycle. Similarly, quantifying SEU errors within a specific altitude profile can guide systems on scrubbing cycle time by analyzing system power trade-offs versus expected error rates.
You must also analyze the trade-offs when planning for embedded block RAM protection. Error detection and correction require a lot of logic resources that could be soft or hardened in silicon. If you don’t need to detect and correct errors in all block RAM, a soft implementation for mission-critical block RAM can save power and resource utilization.
The most comprehensive strategy to protect against critical control and data path errors is TMR, but with a heavy cost of three times the resources and additional power. Alternatively, some applications may use a mix of TMR, block RAM ECC, and CRAM SEU detection and scrubbing.
No matter which method you choose for mitigating SEU exposure, it’s important to work with the FPGA vendor to understand their testing methodology and resulting FIT rate data. The FPGA FIT rate data can then be extrapolated to understand and compare actual measurements with the application profile.
Mik Ichiba is principal field applications engineer at Efinix. He is a seasoned semiconductor and embedded systems professional with more than 30 years of experience spanning hardware architecture, PCB design, ASIC development, FPGA architecture, and system-level engineering. Throughout his career, Mik has worked across the hardware design lifecycle, helping organizations translate complex technical requirements into practical, high-performance solutions.
Editor’s Note
This is Part 2 of the mini-series about SEU challenges in FPGA architectures. Part 1 covered SEU radiation particles and related SEU challenges for FPGA applications that require robustness and predictability in ground-based and terrestrial applications.
Related Content
- Using FPGAs in mission-critical systems
- Rethinking the Logic-Routing Tradeoff in FPGAs
- Understanding Single Event Effects (SEEs) in FPGAs
- Enhancing robust SEU mitigation with 28-nm FPGAs
- Learn about SEU Immunity in Terrestrial FPGA Applications
The post FPGA architecture: SEU detection and recovery strategies appeared first on EDN.