3.5 EL AUTOCONSUMO COMO ALTERNATIVA
3.5.1 Autoconsumo en España
The effect of an SEU depends on the memory cell affected. Some bits are more important than others, for example in global configuration. Different circuits and methods exist to protect against SET and SEU. The protection comes with an increase in the area and power consumption. Depending on the application on or the other might be more suited. Some of the methods are described below.
De-glitching logic
SET can be seen as glitches in the logic path. De-glitching methods prevent these tran- sients from propagating, for example by adding filters. However, filters reduce the work- ing speed of the logic.
Another method would be to duplicate the critical paths. If only one of the paths is affected by an SET, the other still holds the correct value and can correct the upset signal.
3.2 Radiation hard circuits
(a)
(b)
Figure 3.8: Standard (a) and protected (b) latch [67].
Figure 3.9: Schematic of a DICE memory cell with two interleaved latches [70].
Protected latch
A capacitance is added in the feedback loop of the latch as described in Figure 3.8, similar to adding filters in the logic path. The added capacitance prevents an SEU from happening because the glitch caused in one inverter is less likely propagated and stored. The cell can still flip, but a much higher charge is required [61, 66]. The drawback of this method is a slightly larger footprint, lower speed and higher power depending on the capacitance size.
A protected latch was used in the token bit manager chip for the CMS experiment. They measured a cross-section of 2 × 10−15cm2 for the protected latch which is a factor
100 better than the standard latch in the same technology [67]. DICE latch
Another memory structure with increased radiation hardness was proposed by [68]. The dual interlocked storage cell (DICE) is similar to the normal SRAM cell of a bistable latch. The latch was duplicated and interleaved as shown in Figure 3.9. With this new design at least two nodes have to be upset to flip the cell.
[69] measured with optimized transistor sizes and interleaved layout design a gain of 26 compared to a standard latch. Though the area increase is almost a factor 2, the DICE cell is still small enough to be integrated in larger memory structures. This allows the usage e.g. in the pixel matrix of FE chips [69, 70].
Chapter 3 Design of radiation hard ASICs Development of a DCS Chip out clk error FF A Combinational
Logic majorityvoter
in FF A FF A (a) Combinational Logic outB clkC inA errB majority voter FF C FF B FF A Combinational
Logic majorityvoter
majority voter outA outC errC errA Combinational Logic inB inC clkB clkA (b)
Figure 3.10: Schematic for the triplication of logic with different levels of the TMR imple- mentation. a) only memory triplicated (simple TMR), while in b) everything is triplicated (full TMR).
Triple modular redundancy
A very effective way to make logic almost immune to SEEs is by triplicating the logic, also known as triple modular redundancy (TMR). The easiest method here is to just triplicate each register and adding a majority voter logic at the output. Figure 3.10 shows a schematic for possible implementations.
The voter implements the majority decision according to the following Boolean equa- tions:
O = (A · B) + (A · C) + (B · C) (3.4)
E = A · B + B · C + C · A (3.5)
Where A, B and C are the three register states and O is the voted output. The signal E is the error output which indicates if there is a minority, i.e. a bit flip. This could be used to trigger a reset of the register, count observed SEUs or flag a warning that something happened.
As represented in Figure 3.10 different schemes exist. Triplicating the combinational logic can also protect against SET. If a transient occurs in the combinational logic of the simple TMR, it could propagate to all registers and upset all three at the same time. In full triplication, three combinational paths exist and a transient in one path upsets at most one register. The other two still hold the correct value.
Triplication should be implemented before synthesis. It is important to include the triplicated design in the synthesis because voters add additional delays in the combina- tional path. These should be considered for a correct timing analysis by the synthesis tools. However, constraints are required to protect the TMR signals. The synthesis tool will remove them during the triplication otherwise.
The designer needs to be careful, that all required signals are triplicated and also that the voter output is used to generate the next state of a register. Else, the protection could be useless. The tool TMRG [71] helps to generate triplicated designs. After the
3.2 Radiation hard circuits
logic is developed and tested, the TMRG tool creates a new file with added triplication. By adding special syntax to the Verilog2 code, one can control which signal should be
triplicated and where a voter has to be added. A constraint file is also created to protect the triplicated signals.
The full TMR approach was used in this work for protecting the logic (see section 5.5). This was done with the TMRG tool mentioned above. The efficiency of the protection implemented was tested in a proton beam as described in section 6.3.4.
The added protection comes with the cost of a larger area required and higher power consumption. For the synthesized logic developed during this work, an area increase of 4.8 was observed. The size increases by more than a factor three on one side due to the additional logic from the voters, but also because less optimization can be performed to respect constraints protecting triplicated nets.
A triple redundant latch was implemented by [70] for usage in a memory block. An SEU tolerance improvement by a factor of 170 was measured for this latch. In their design, they applied the simple method where only the memories were triplicated as shown in Figure 3.10a on the preceding page. [69] further improved the triple redundant latch design by triplicating the load logic and interleaving the layout. A cross-section of 6.8 × 10−18cm2 was measured for the updated design, which is a gain of 3920 compared
to a standard data flip flop with a cross-section of 2.8 × 10−14cm2. This triple redundant
latch has an area 12 times larger than a standard latch. The additional increase might be explained by the fact, that also the voter is included in the latch.
Theoretical cross-section of the TMR protected logic can be estimated using proba- bility calculations. Some hypotheses are made for this:
1. The three registers observe SEUs independent from each other. 2. The registers are refreshed in an interval ∆t.
3. ∆t is small enough that two SEUs in the same register are insignificant.
4. p is the SEU probability in a single register and is smaller than 0.5, defined in equation 3.2.
The probability for one flip in a triplicated register is defined in equation 3.6, which can be found using a probability tree [72].
pT M R = p3+ 3p2(1 − p) = p2(3 − 2p) (3.6)
Assuming that the cross-section for a TMR register follows equation 3.2, the TMR cross-section can be calculated with
σT M R=
pT M R
Φ∆t = σ
2Φ∆t (3 − 2σΦ∆t) (3.7)
Chapter 3 Design of radiation hard ASICs Development of a DCS Chip
When applying these calculations to the results from [69], quite a discrepancy is ob- served. From the above equation, the triple redundant latch should have a cross-section 10 decades smaller than the standard latch. Some assumptions had to be made for the calculation: 1.9 × 1010cm−2s−1 was used for the particle flux3 and ∆t was assumed as
100 ns given that the latch reloads the voter output as soon an error is detected. The triple redundant latch is not refreshed with a constant clock, but with a load signal. This load signal comes either from an external source to set the latch, or from the error output of the majority voter. The time interval is the propagation delay of the load signal. Hypothesis 3 should be fulfilled.
On the other hand hypothesis 1 is not guaranteed. Multiple latches could be upset together as discussed in section 3.1.2. Further, an SET created outside the latch or in the load signals renders the TMR protection useless if the signal goes to all three latches. Some of these effects are reported by [69].
They implemented several versions of the latch. The triplication of the reload logic improved the cross-section by 5, compared to the simple triplication. This indicated that SETs have a large effect. Further were two fully triplicated latches interleaved in the layout to increase the distance between two bits. This reduced the cross-section by another factor 4 compared to the non-interleaved layout. Therefore also spatial spacing helps to reduce MBUs.
Studies regarding the SEU tolerance were also made in this work and are documented in sections 6.3.3 and 6.3.4.