System for preventing radiation failures in programmable logic devices

A radiation-tolerant logic circuit includes three similarly configured SRAM-based PLDs. These PLDs work in parallel to provide identical logic functions. To guard against data corruption that can result from radiation-induced upsets, the logic circuit includes a state-comparison circuit that periodically performs a bitwise comparison of the configuration and user data from each of the PLDs; if a bit from one PLD differs from the corresponding bit from the others, the state-comparison circuit sets a flag that indicates that the differing PLD is in error. The erroneous PLD is then reprogrammed using error-free state data. In one embodiment, the error-free state data is read from an error-free PLD.

FIELD OF THE INVENTION 
This invention relates generally to programmable logic circuits for 
aerospace applications, and in particular to redundant systems that 
tolerate radiation-induced errors. 
BACKGROUND 
Latches and flip-flops that work perfectly well in terrestrial applications 
can nevertheless fail in aerospace application. Such failures are often 
radiation-induced upsets that occur when high-energy radiation changes the 
state of a latch or flip-flop. Radiation-induced upsets are sometimes 
called "soft" errors because they do not physically damage the circuit. 
FIG. 1 depicts a conventional radiation-tolerant logic circuit 100 
connected between an input bus IN and a destination circuit 105. Logic 
circuit 100 receives logic signals on input bus IN and provides some 
desired logical results from those signals to destination circuit 105. 
Circuit 100, typically an integrated circuit, includes combinational logic 
110 connected via a line 120 and a clock line CLK to a triple-redundant 
storage element 130. Triple-redundant storage element 130 includes three 
flip-flops 132, 134, and 136, each of which includes a "D" input connected 
to line 120, a clock input connected to the common clock line CLK, and a 
"Q" output. Flip-flops 132, 134, and 136 function identically to capture 
the output data from combinational logic 110 upon receipt of a clock edge 
on clock line CLK. For terrestrial application, where soft errors are 
extremely rare, only one flip-flop (e.g., flip-flop 132) is required. 
However, because aerospace applications are subject to occasional soft 
errors, redundant flip-flops are provided to accommodate the occasional 
radiation-induced upset. 
The "Q" outputs of flip-flops 132, 134, and 136 are connected to a voting 
circuit 140 that outputs a signal on a line Q that represents the majority 
logic: provided by flip-flops 132, 134, and 136 on respective lines Q1, 
Q2, and Q3. Output line Q of voting circuit 140 will therefore correctly 
represent the output of combinational logic 110 so long as no more than 
one of flip-flops 132, 134, and 136 is in error. Any soft errors are 
corrected upon the arrival of a subsequent rising clock edge on line CLK. 
The likelihood of a radiation-induced upset disrupting one of flip-flops 
132, 134, and 136 during a given clock cycle is remote; the likelihood of 
radiation-induced upsets affecting more than one of flip-flops 132, 134, 
and 136 during a given clock cycle is even more so. Circuit 100 therefore 
offers improved radiation resistance over similar circuits without triple 
redundancy. 
The trouble with circuit 100 is that it does nothing about soft errors that 
might occur within combinational logic 110. Thus, combinational logic 110 
and voting circuit 140 are typically limited to circuit types that are 
relatively resistant to radiation. Such circuits include antifuse-based 
programmable logic devices (PLDs). However, antifuse-based PLDs are 
one-time-programmable, and thereofore cannot later be reprogrammed to 
provide different functionality. In contrast, SRAM-based PLDs can be 
reprogrammed, but include very large numbers of latches and flip-flops 
that might be sensitive to radiation. Radiation-resistant reprogrammable 
PLDs might be manufactured using special semiconductor processes, but such 
PLDs would be very expensive relative to PLDs manufactured using standard 
processes. There is therefore a need for reprogrammable, 
radiation-tolerant PLDs that can be manufactured using standard 
semiconductor processes. 
SUMMARY 
The present invention satisfies the need for radiation-tolerant, SRAM-based 
PLDs that can be manufactured using standard semiconductor processes. A 
radiation-tolerant logic circuit in accordance with one embodiment of the 
invention includes three similarly or identically configured SRAM-based 
PLDs. These PLDs work in parallel to provide identical logic functions. 
These logic functions are conventionally defined by configuration data 
that is loaded into flip-flops and latches in each PLD. Other flip-flops 
and latches store "user" data, which can change state during PLD 
operation. 
The inventive logic circuit includes a configurable-logic modification 
(CLM) circuit and a state-comparison circuit, each of which is connected 
to the three redundant PLDs. The CLM circuit periodically reads state data 
from each PLD as a serial bit stream. This bit stream, or "readback data," 
includes a collection of configuration and user data stored in each PLD. 
The state-comparison circuit then performs a bit-by-bit comparison of the 
readback data to determine which PLD, if any, includes a readback bit that 
differs from the corresponding readback bits in the remaining two PLDs. 
The state-comparison circuit flags any such PLDs as having an error. 
Any PLD or PLDs flagged as erroneous is disabled and reprogrammed. If at 
least one of the three PLDs is error free, then the readback data from 
that PLD can be used to reconfigure any erroneous PLDs. The present 
invention thus guards against data corruption that can result from 
radiation-induced upsets. All three PLDs can also be reconfigured from a 
common configuration memory in the rare event that they all include 
errors; however, a reconfiguration from configuration memory may result in 
a loss of user data.

DETAILED DESCRIPTION 
FIG. 2 depicts a system of radiation-tolerant configurable logic 200 in 
accordance with the invention. Configurable logic 200 receives logic 
signals on an input bus IN and provides some desired logical results from 
those signals to a destination circuit 202 on an output line OUT. Three 
similarly configured SRAM-based PLDs 210A-C define the logical operation 
of configurable logic 200. Being SRAM-based devices, PLDs 210A-C may be 
sensitive to radiation-induced upsets that alter their "states," which ire 
defined by data stored in a collection of configuration and 
user-accessible latches and flip-flops in each PLD. Configurable logic 200 
therefore includes a state-comparison circuit 220 that periodically 
compares the state data from a each of PLDs 210A-C to determine whether 
the state of one differs from the states of the other two, indicating an 
error. If one of PLDs 210A-C is found to include an error, the erroneous 
PLD is deactivated and reprogrammed using error-free state data. 
Configuring PLDs 210A-C conventionally includes loading specific sets of 
state data into the PLDs;. This configuration process is controlled by a 
configurable-logic modification (CLM) circuit 222, which reads state data 
from either a configuration memory (not shown) or from one or more of PLDs 
210A-C. CLM 222 then conveys the state data to one or more of PLDs 210A-C 
on configuration lines 224. The configuration operations performed by CLM 
222 are accomplished by conventional means that are well within the skill 
of those familiar with configuring PLDS. PLDs 210A-C are, in one 
embodiment, XC4000.TM. series FPGAs available from Xilinx, Inc., of San 
Jose, Calif. CLM circuit 222 may be a radiation-resistant PLD programmed 
to perform the function described below in connection with FIG. 3. 
PLDs 210A-C are similarly configured and connected in parallel (having 
common input and output pins) so that they perform the same logic 
functions. The output pins of two PLDs are tri-stated (electrically 
disconnected) so that only one PLD (e.g., PLD 210A) drives output line OUT 
to destination circuit 202. In another embodiment, each of PLDs 210A-C has 
active output pins connected to destination circuit 202 through a 
radiation-resistant voting circuit similar to voting circuit 140 of FIG. 
1. 
PLDs 210A-C connect to comparison circuit 220 via respective readback lines 
RB.sub.A, RB.sub.B, and RB.sub.C. PLDs 210A-C conventionally respond to a 
readback command from CLM 222 by outputting a bit stream (the readback 
data) that includes the configuration data and, optionally, the user data 
within each PLD. PLDs 210A-C can be read back at any time after 
configuration without interfering with device operation. During readback, 
the readback data is transferred out of the PLDs on readback lines 
RB.sub.A, RB.sub.B, and RB.sub.C. For more information relating to 
readback operations on Xilinx XC4000.TM. series FPGAs, see Xilinx, Inc., 
"The Programmable Logic Data Book" (1998), pp. 4-56 to 4-59, and Wolfgang 
Hoflich, "Using the XC4000.TM. Readback Capability," XAPP 015.000, pp. 
8-37 to 8-44 (1993). Both of these documents are available from Xilinx, 
Inc., of San Jose, Calif., and are incorporated herein by reference. 
State-comparison circuit 220 includes a voting section 225 and a 
ones-catcher section 230. Each section includes three elements, one for 
each of PLDs 210A-C, as designated by the last character in each 
alphanumeric element designation. State-comparison circuit 220 is 
preferably radiation-resistant, and may be incorporated into CLM 222. 
Voting section 225 includes three error-identification circuits 240A-C that 
compare the bit streams on readback lines RB.sub.A, RB.sub.B, and 
RB.sub.C. If a readback bit from PLD 210A does not match the corresponding 
bits from PLDs 210B and 210C, then error-identification circuit 240A 
outputs a logic one. Similarly, circuit 240B outputs a logic one if a bit 
on line RB.sub.B differs from the corresponding bits on lines RB.sub.A and 
RB.sub.C, and circuit 240C outputs a logic one if the signal on line 
RB.sub.C differs from the signals on lines RB.sub.A and RB.sub.B. 
Ones-catcher section 230 includes three identical ones-catchers, the first 
of which includes an OR gate 242A having an output terminal connected to 
the "D" input of a flip-flop 245A. OR gate 242A includes two inputs, the 
first of which is connected to the output of error-identification circuit 
240A, and the second of which is connected to the "Q" output of flip-flop 
245A. Flip-flop 245A also includes a clock terminal connected to a 
readback clock via a line RCLK and a reset terminal (not shown). The 
readback clock synchronizes the readback bitstreams on readback lines 
RB.sub.A, RB.sub.B, and RB.sub.C ; flip-flop 245A use the same readback 
clock to synchronize the output of circuits 240A with the readback 
bitstreams. The reset terminal is used to reset flip-flops 245A-C prior to 
performing a readback comparison. 
As discussed above, error-detection circuit 240A outputs a logic one if a 
configuration bit of PLD 210A does not match the corresponding 
configuration bits of PLDs 210B and C. Ones-catcher section 230 captures 
this logic one in flip-flop 245A and conveys the logic one, via a line FA 
(for "flag A") to CLM 222. Circuits 240B and 240C function similarly to 
circuit 240A; an explanation of those circuits is therefore omitted for 
brevity. 
Each time a readback cycle is initiated, state-comparison circuit 220 
determines which, if any, of PLDs 210A-C includes an error. Should an 
error occur, the Q output terminal of the one of flip-flops 245A-C 
corresponding to the erroneous PLD will transition to a logic one. For 
example, if a bit on readback line RB.sub.A does not match the 
corresponding bits on readback lines RB.sub.B and RB.sub.C, then the Q 
output of flip-flop 245A will transition to a logic one during the 
readback cycle. This logic one is transferred to CLM 222 via line FA. 
Flip-flop 245A will then remain set, indicating a state error in PLD 210A. 
FIG. 3 is a flowchart 300 illustrating the process of detecting and 
correcting soft errors in PLDs 210A-C. Beginning with step 305, CLM 222 
identically configures each of PLDs 210A-C from a configuration memory 
using well-known methods. PLDs 210A-C are then activated (step 310) to 
perform the logic function for which they were configured. 
CLM 222 automatically moves to step 320 once PLDs 210A-C are operational. 
As discussed above in connection with FIG. 2, comparison circuit 220 
compares the respective readback bit streams from PLDs 210A-C. If none of 
ones-catcher flip-flops 245A-C flags an error, then the process returns to 
step 320 and begins another readback cycle. If an error is flagged, CLM 
222 determines whether any of PLDs 210A-C are error free (step 335). In 
the unlikely event that all of flip-flops 245A-C flag errors, than none of 
PLDs 210A-C can be trusted to include correct state data. Thus, CLM 222 
returns to step 305, in which PLDs 210A-C are once again identically 
configured from configuration memory. In this scenario, any user data in 
PLDs 210A-C is lost. 
Soft errors are sufficiently infrequent that all three of PLDs 210A-C will 
rarely include errors during a given readback cycle. If even one of PLDs 
210A-C is deemed error-free, then the process moves to step 340, in which 
CLM 222 determines whether the active PLD includes an error. Recall that 
the outputs from PLDs 210B and 210C are tristated and the outputs from PLD 
210A are connected to destination circuit 202. If PLD 210A does not 
include an error, then destination circuit 202 has been receiving 
error-free data. This being the case, it is not necessary to interrupt the 
operation of configurable logic 200. The process therefore moves to step 
360, in which CLM 222 waits for a logical stopping point (e.g., a pause in 
operation) before attempting to correct the error. If, on the other hand, 
PLD 210A includes an error, then destination circuit 202 may be receiving 
incorrect data. CLM 222 therefore immediately changes the active device 
from PLD 210A to an error-free PLD (step 350). The process then moves to 
step 360 to wait for a logical stopping point before beginning the 
correction process. CLM can be configured to perform additional readback 
comparisons while waiting for the logical stopping point. 
Step 370 marks the beginning of the correction process. CLM 222 reads back 
the state data from an error-free PLD, ignoring the output of 
state-comparison circuit 220. Then, using the readback data from the 
error-free PLD, CLM 222 reconfigures the erroneous PLD or PLDs (step 380). 
Steps 370 and 380 overlap, so that the erroneous PLD is reconfigured as 
the error-free state data is read back from the good PLD. 
Some embodiments of the invention include PLDs for which the readback data 
is formatted differently than the state data. CLM 222 is therefore 
configured to convert the readback data into appropriate state data. For 
example, readback data is inverted with respect to state data in the 
XC3000.TM. families of FPGA available from Xilinx, Inc. The readback data 
must therefore be inverted to create a configuration bit stream for 
XC3000.TM. FPGAs. 
Once all of the state data from the "good" PLD is loaded into the remaining 
PLD or PLDS, all three of PLDs 210A-C once again have identical states. 
Further, the user data in each PLD is timely, because the source of the 
user data was an error-free PLD. The three identical PLDs are then 
reactivated (step 310) and flip-flops 245A-C are reset to prepare them for 
a subsequent readback sequence. 
While the present invention has been described in connection with specific 
embodiments, variations of these embodiments will be obvious to those of 
ordinary skill in the art. For example, more then three PLDs can be 
connected in parallel to improve radiation resistance. Moreover, some 
components are shown directly connected to one another while others are 
shown connected via intermediate components. In each instance the method 
of interconnection establishes some desired electrical communication 
between two or more circuit nodes (e.g., lines or terminals). Such 
communication may often be accomplished using a number of circuit 
configurations, as will be understood by those of skill in the art. 
Therefore, the spirit and scope of the appended claims should not be 
limited to the foregoing description.