Florian Rittner

Reliability of space-grade vs. COTS SRAM-based FPGA in N-modular redundancy

In this paper, we evaluate the suitability of different SRAM-based FPGAs for harsh radiation environments (e.g., space). In particular, we compare the space-grade and radiation-hardened by design Virtex-5QV (XQR5VFX130) with the commercial off-the-shelf Kintex-7 (KC7K325T) from Xilinx. The advantages of the latter device are: 2.5 times the resources of the space-grade FPGA, faster switching times, less power consumption, and the support of modern design tools. We focus on resource consumption as well as reliability in dependence of single event upset rates for a geostationary earth orbit satellite application, the Heinrich Hertz satellite mission. For this mission, we compare different modular redundancy schemes with different voter structures for the qualification of a digital communication receiver. A major drawback of the Kintex-7 are current-step single event latchups, which are a risk for space missions. If the use of an external voter is not possible, we suggest triple modular redundancy with one single voter at the end, whereby the Virtex-5QV in this configuration is about as reliable as the Kintex-7 in an N-modular redundancy configuration with an external high-reliable voter.

A Self-Adaptive SEU Mitigation System for FPGAs with an Internal Block RAM Radiation Particle Sensor

In this paper, we propose a self-adaptive FPGA-based, partially reconfigurable system for space missions in order to mitigate Single Event Upsets in the FPGA configuration and fabric. Dynamic reconfiguration is used here for an on-demand replication of modules in dependence of current and changing radiation levels. More precisely, the idea is to trigger a redundancy scheme such as Dual Modular Redundancy or Triple Modular Redundancy in response to a continuously monitored Single Event Upset rate measured inside the on-chip memories itself, e.g., any subset (even used) internal Block RAMs. Depending on the current radiation level, the minimal number of replicas is determined at runtime under the constraint that a required Safety Integrity Level for a module is ensured and configured accordingly. For signal processing applications it is shown that this autonomous adaption to the different solar conditions realizes a resource efficient mitigation. In our case study, we show that it is possible to triplicate the data throughput at the Solar Maximum condition (no flares) compared to a Triple Modular Redundancy implementation of a single module. We also show the decreasing Probability of Failures Per Hour by 2 × 104 at flare-enhanced conditions compared with a non-redundant system. Our work is a part of the In-Orbit Verification of the Heinrich Hertz communication satellite.

Reconfigurable high performance architectures: How much are they ready for safety-critical applications?

Reconfigurable architectures are increasingly employed in a large range of embedded applications, mainly due to their ability to provide high performance and high flexibility, combined with the possibility to be tuned according to the specific task they address. Reconfigurable systems are today used in several application areas, and are also suitable for systems employed in safety-critical environments. The actual development trend in this area is focused on the usage of the reconfigurable features to improve the fault tolerance and the self-test and the self-repair capabilities of the considered systems. The state-of-the-art of the reconfigurable systems is today represented by Very Long Instruction Word (VLIW) processors and reconfigurable systems based on partially reconfigurable SRAM-based FPGAs. In this paper, we present an overview and accurate analysis of these two type of reconfigurable systems. The content of the paper is focused on analyzing design features, fail-safe and reconfigurable features oriented to self-adaptive mitigation and redundancy approaches applied during the design phase. Experimental results reporting a clear status of the test data and fault tolerance robustness are detailed and commented.

Detection of solar particle events inside FPGAs

The intensity of radiation in space, which is affected by the sun, can differ over five orders of magnitude within a few days. This variation is caused by shocks of fast coronal mass ejections, which drive high-energy and long-duration particle events, named solar particle events. With the knowledge of the current solar condition, operators can take countermeasures. They can save unnecessary redundancy during relaxed periods or switch the system in a safe state during a harsh period. We propose the block RAM inside the FPGA as a single-event upset sensor to detect solar particle events. The user can still access these block RAMs because we only evaluate the error signals from the error-correcting code logic. We are developing a solar condition detector including a model for statistical classification. This is based on Petri nets and we perform static as well as transient analyses to check the plausibility and to determine the detection time. By combining the evaluation of the model with the results of the implemented FPGA design, we detect the significant June 2015 solar particle event after 13.1 min (784 s), using all 298 block RAMs of a Virtex-5QV. The duration of this solar particle event was 56 h and the peak particle flux occurred after 21.6 h as energetic storm particle. We conclude, that solar particle events cause a highly dynamic radiation environment, but the onset of such high-intensity events can be detected and a response can be organized in a timely manner.

Adaptive single-event effect mitigation for dependable processing systems

For application in radiation-harsh environments, designers apply mitigation techniques according the worst-case (solar) condition to achieve a dependable design. This results in a resource overhead, which is most of the time unnecessary. To overcome this problem, adaptive mitigation techniques are used. This technique is a trade-off between two parameters, such as performance and reliability, according to different operating modes by toggling between these modes. In this context, we propose an Adaptive Single-Event Effect Mitigation (ASEEM) method. It is based on adaptive reconfiguration of an FPGA between two modes, specifically a performance mode and a high reliability mode. The performance mode offers high processing power and thus higher signal processing throughput. We evaluate ASEEM by calculating results with particle data from 2010 until 2016 for one space-grade and two commercial-grade FPGAs. Based on radiation data, we calculate upset rates, availability, performance and performability. We discuss one realization of ASEEM in detail with fixed upset rates. The examples presented in this paper show a reduction of the upset rate form a sixth to a ninth (compared with the performance mode) and the availability of the high processing power over 90 % in the considered time interval. We conclude that the investigated ASEEM realization is optimal for moderate and long mean times to repair. In a processing case study, with a fixed mean time to repair of one hour, we obtain a performability improvement of 14% and an availability improvement of 21 % over the performance mode for an FPGA using the latest semiconductor technology.

Broadband FPGA payload processing in a harsh radiation environment

In this paper, we propose a concept for broadband Digital Signal Processing under consideration of mitigation schemes to increase the reliability. We take Single Event Upsets into account to guarantee a reliable operation during a In-Orbit-Verification. It will be performed on the Fraunhofer On-Board Processor, which is a dynamically reconfigurable On-Board Processor platform based on two space-grade Virtex-5QV FPGAs. A master and slave FPGA concept enables broadband Digital Signal Processing experiments, which are controlled and monitored by the high reliable master FPGA. Each FPGA processes a separated signal path of the Fraunhofer On-Board Processor. The first FPGA executes scrubbing of both FPGAs, measures the current radiation and observes the whole system with a fault management. The second FPGA realizes only the broadband Digital Signal Processing, which results in more usable resources. We analyze the impact of the radiation to point out the influence to the FPGAs. A case study demonstrates a Digital Down Converter for broadband Digital Signal Processing. This hardware verification evaluates a 306 Mbit/s broadband signal, modulated with Quadrature Phase-Shift Keying. It results in a Signal-to-Noise Ratio of 19.29 dB. Due to separation of mitigation schemes and broadband Digital Signal Processing the system operates reliable and the resources are used efficient.

Detection and Isolation of permanent faults in FPGAs with remote access

In this paper, we present a Fault Detection (FD) and Fault Isolation (FI) concept for permanent faults in SRAM-based FPGAs. Harsh environments, such as space, cause permanent faults, which results in defective hardware. Furthermore, physical inaccessible systems in such environments limit debugging capabilities. The proposed concept uses wireless remote debugging to access the remote device. The presumption of a permanent fault starts an extended hardware debugging procedure by performing off-line tests without user application. First, the FD process confirms the fault as permanent and reject temporary faults (known as static and transient). Afterwards, a fine-grain permanent FD and FI determines affected primitives in the FPGA and exclude this primitive from the FPGA design. This is realized with a customized recovery strategy for each primitive type, by blocking and bypassing these defective primitives. Focus of this paper is the feasibility of the concept.

Implementation of an initial-configuration based on self-reconfiguration for an on-board processor

Modern flexible space applications are based on an on-board processor in order to increase the overall system performance. Additionally, FPGA-based systems provide the advantage of reconfiguration during the satellite mission. The Fraunhofer On-Board Processor realizes a multi-FPGA platform for communication with four Virtex-5QV FPGAs. For this platform a high system reliability and an avoidance of single points of failure are required. In order to meet these requirements a new FPGA reconfiguration concept is necessary to guarantee a fail-safe reconfiguration. The focus of this paper is the implementation of the FPGA design which is based on an initial-configuration system and self-reconfiguration of the FPGAs. For this implementation the hardware platform of the Elegant Bread Board is used. The initial-configuration method is used in parallel with a regular one and results in an increase for the system reliability.

Adaptive single-event effect mitigation for dependable processing systems based on FPGAs

Abstract For FPGA-based applications in harsh radiation environments, designers apply mitigation techniques according the worst-case (solar) condition to achieve a dependable design. This results in a resource overhead, which is most of the time unnecessary. To overcome this problem, an adaptive mitigation technique is used, which is a trade-off between two parameters, such as performance and reliability. We propose an Adaptive Single-Event Effect Mitigation (ASEEM) method, based on FPGA reconfiguration between a performance mode and a reliability mode. The performance mode offers high processing power and the reliability mode offers a high dependability. We evaluate ASEEM by calculating results using particle flux data from 2010 until 2017 for one space-grade and two commercial-grade FPGAs. Based on radiation data, we calculate upset rates, availability, performance, and performability. We optimize the performability, which is the benchmark parameter, in dependence of the Mean Time to Repair (MTTR) and time configured in the performance mode. We conclude that the performability of ideal ASEEM (without implementation losses) maximizes with an improvement of 132% over the compared static modes (performance and reliability) at an MTTR of 19.8 h and 91% of the time in the performance mode for the space-grade FPGA. ASEEM is implemented as FPGA design to determine the implementation impact.

Automated test procedure to detect permanent faults inside SRAM-based FPGAs

Using commercial FPGAs in harsh environments such as space applications, enables high processing power. Temporary faults such as single-event upsets, which can be mitigated by well-known methods, are not as critical as permanent faults, since they may endanger the application in case of a defective FPGA. To overcome the impact of permanent faults, we introduce hardware fault detection, isolation, and recovery. In this paper we focus on the first step, the fault detection, performed by an automated test procedure. We separate the procedure in three subtasks: The source file generation, the build process, and the test process itself. With such a modular concept each subtask can be replaced by customized solutions. Each subtask runs autonomous and may be integrated into the automated test procedure. Moreover, our generic design strategy aims to achieve FPGA type and vendor independence, whereby we address SRAM-based FPGAs. We conduct a case study for a Xilinx Artix-7 to evaluate our implementation. In this first verification step, we only consider look-up tables as essential FPGA primitives. We achieve a fault coverage of approx. 96 % with only four bit files and an overall test process time of less than 20 s. The complete test procedure is based on tool command language scripting. Our frame-based fault injection confirms the successful detection of permanent faults within the covered region. Furthermore, we verify the procedure also for a Virtex-5QV.