Ionizing Radiation and error detection - Page 1
Forum section: electronics / general

author: nwvlab
author_rank: Regular Contributor
timestamp: February 09, 2016, 01:24:14 pm
content: Hi there!As the sizes scale down, single event effects, caused for instance by an alpha particle, could be an issue not only for military or space applications, but also on some consumer, automotive or industrial fields.Luckily some recent microcontrollers have embedded some sort of error detection in certain SRAM regions or in their cache. Such error detection techniques might mitigate the effects of radiation-induced single event upsets.However, I have not found yet any “consumer” microcontroller, which also features some error detection in the peripheral or MCU configuration registers (but maybe I missed some). I think that a bit flip in one of those registers might be as bad as a bit flip in a random SRAM location. By the way, peripheral configuration registers might be as many as some hundreds, amounting therefore for some kbits (i.e. the probability of a bit-flip in one register is not orders of magnitude smaller than the bit-flip probability in the SRAM).I’m wondering if anyone knows why the manufacturers do not implement some protection on these registers too: is it due to complexity/cost constraints, or maybe do the manufacturers rely on the user, which could implement his code so that the registers are periodically scrubbed? (Still this would not be as effective as hardware detection). Or maybe, these register are implemented at the transistor levels in a way so that they are intrinsically more immune to ionizing particles (larger MOSFET) ?Cheers!

author: Xenoamor
author_rank: Regular Contributor
timestamp: February 09, 2016, 01:31:54 pm
content: ... how is a 2 proton, 2 neutron atom going to hit an electronic device?Are you talking about helium atoms hitting ICs here?Like all decent software you should be using the watchdog to recover from any program stalls and you should have feedback from whatever you are controlling to check it's doing what you tell itPinging around the net I found:QuoteMost if not all devices have anti-latchup protection.https://en.wikipedia.org/wiki/Latch-upCheck what NASA has to say as well:http://nepp.nasa.gov/docuploads/31342D2C-05DD-4165-88EC472A3AB88B6A/SEU_Flash-97.pdfEDIT -I imagine checksums or some kind of RAID array of flash memory is used in space applications

author: coppice
author_rank: Super Contributor
timestamp: February 09, 2016, 02:00:48 pm
content: Quote from: nwvlab on February 09, 2016, 01:24:14 pmAlpha paricles was a problem around 1980, when alpha emissions from a ceramic package could corrupt the operation of the finest geometry chip of the time. This was particularly troublesome with DRAM devices. Die coatings were found, which protected the chips, and the problem went away. Why did you ask about alpha in particular? Its things like gamma which are the real problem, especially in space.Quote from: nwvlab on February 09, 2016, 01:24:14 pmDo automotive MCUs count as consumer? There are lock step redundant MCUs from several automotive suppliers, such as the TI Hercules ARM chips.

author: nwvlab
author_rank: Regular Contributor
timestamp: February 09, 2016, 02:25:35 pm
content: Quote from: coppice on February 09, 2016, 02:00:48 pmBecause I'm referring to the sea-level soft-error. Alpha particles are heavy enough to induce a single event effect, still being quite frequent, because, for instance, neutrons coming from cosmic rays can be captured by the atoms composing the chip or the package. These new isotopes can be radioactive and undergo in some radioactive decays, in particular, alpha decay.Gamma particles typically are a concern in terms of total ionizing dose, i.e. small amount of radioactivity, whose effects accumulate over time (charge loss in flash memory, charge trapping in the oxides, trap generation, etc).

author: coppice
author_rank: Super Contributor
timestamp: February 09, 2016, 03:29:35 pm
content: Quote from: nwvlab on February 09, 2016, 02:25:35 pmAlpha can't get through the package. The only time alpha was a problem was when it came from the package itself, right next to the chip. A thin film over the chip was sufficient to block it. Anything helium gas tight is helium nucleus tight.

author: nwvlab
author_rank: Regular Contributor
timestamp: February 09, 2016, 03:42:09 pm
content: Quote from: coppice on February 09, 2016, 03:29:35 pmright, an alpha particle cannot get through the package if it comes from the outside.However, if it comes from the inside of the chip, you can't do anything. How can it happen? By neutron capture, a stable isotope can become unstable and then decay. If you have a 5 MeV alpha particle, it can travel some tens of microns before it's stopped, and that is a very long distance if it originated "close enough" to sensitive nodes.

author: Daving
author_rank: Contributor
timestamp: February 09, 2016, 05:44:09 pm
content: From wikipedia:A sheet of paper or a few cm of air block alpha.A sheet of thin metal or a few meters of air block beta.X-Ray and Gamma takes much more material but don't have enough energy to flip bits in most MCUs with larger features than those found in consumer CPUs.Cosmic is what you need to be concerned about, but at sea level is not a substantial issue.Memory in many architectures is not linearly arranged. In other words, if you have byte 0 and byte 1 you don't have:Code:B0b0 B0b1 B0b2 B0b3 B0b4 B0b5 B0b6 B0b7B1b0 B0b1 B0b2 B0b3 B0b4 B0b5 B0b6 B0b7You typically end up with something more like this:Code:B0b0 | B1b1 | B2b2 | ...B1b0 | B2b1 | B0b2 | ...B2b0 | B0b1 | B1b2 | ...Actual arrangements very. This helps to prevent 2-bit errors in a single byte or word.Next many memory systems include some form of ECC. The simplest of which is a 2D parity check, which can correct any 1-bit error and detect any 2-bit error.Here's an example with 16 bits of data:The parity bit is the rightmost or bottommost bit in each row or column (on the other side of the line from all the other bits.The parity bit is a 1 if there are an ODD number of 1s in the row or column.The parity bit is a 0 if there are an EVEN number of 1s in the row or column.Code:0 1 1 0 | 01 0 0 0 | 11 0 1 0 | 00 0 1 1 | 0_______0 1 1 1If a single bit flips:Code:0 1 1 0 | 01 0 1 0 | 1 <-wrong row1 0 1 0 | 00 0 1 1 | 0_______0 1 1 1^ Wrong columnSo you kn0w the row and column of the error and can fix it.If 2-bits flipCode:0 1 1 0 | 01 1 0 0 | 1 <wrong row1 1 1 0 | 0 <also a wrong row0 0 1 1 | 0_______0 1 1 1^ This column looks correct.The error is detected, but cannot be corrected. Any of the rows could have the error.Of course, there are cases where multiple bits can be corrected, but it is guaranteed to work if any 1 bit is wrong.If 2 parity bits are in error, you will detect the error, but you may make a bad correction.There are other more robust ECC techniques.https://en.wikipedia.org/wiki/Forward_error_correction

author: nwvlab
author_rank: Regular Contributor
timestamp: February 09, 2016, 07:00:23 pm
content: Ok, this does not answer my initial question... Which was: why do they not implement the ECC (or at least a parity check) even on the peripheral and cpu config registers?Beside, cosmic rays at the sea level might be indeed an issue. Back to the 1996 IBM showed that in a 256-MB system you should expect about 1 soft error per month. That is not negligible!This means that if you have 1000 256-kB systems you should expect roughly the same error rate (i.e. one of these 1000 systems is likely to have a soft error in a month).Similarly, in 1 million 256-byte system, you are likely to have 1 error per month in at least one of these 1E6 systems.(IBM considered errors in DRAM, but SRAM has similar problems (plus there is also a positive feedback) and possibly higher soft error rates.

author: edavid
author_rank: Super Contributor
timestamp: February 09, 2016, 07:44:53 pm
content: Quote from: nwvlab on February 09, 2016, 07:00:23 pmBecause they are much larger than RAM cells, so they have lower (negligible) error rates.

author: Daving
author_rank: Contributor
timestamp: February 09, 2016, 08:55:10 pm
content: Quote from: edavid on February 09, 2016, 07:44:53 pmAlso, many microcontrollers in use have 256B rather than 256MB. The error rate is on the order of less than 1 soft error per millenia [citation needed].Most uC users don't need ECC, and those that do can implement it in software.

author: nwvlab
author_rank: Regular Contributor
timestamp: February 09, 2016, 09:32:09 pm
content: Quote from: Daving on February 09, 2016, 08:55:10 pmYep, but you must take into account that you have millions of devices. Therefore the number of "failing devices" in one year is relatively high.

author: RogerRowland
author_rank: Regular Contributor
timestamp: February 10, 2016, 06:33:44 am
content: Quote from: nwvlab on February 09, 2016, 09:32:09 pmThe pragmatic view is probably as simple as this: the reason manufacturers don't implement any protection is that it isn't considered a significant problem and it doesn't affect sales. If it ain't broke ....

author: coppice
author_rank: Super Contributor
timestamp: February 10, 2016, 06:42:09 am
content: Makers of medical devices, like blood glucose meters, are generally fairly unconcerned about device failures, but very very concerned about devices giving wrong results. They are, therefore, prepared to pay for self correcting memories and some other fault detection complexity in their MCUs. I haven't heard of them showing concern about alpha corruption.

author: nwvlab
author_rank: Regular Contributor
timestamp: February 10, 2016, 02:18:48 pm
content: Quote from: coppice on February 10, 2016, 06:42:09 amDon't focus on alpha. I wrote "for instance".Maybe they don't care because they are not aware of? And they think that every error is for sure due to a software bug or EMI or whatever ?I recall that many years ago,soft errors were considered only a minor topic of a larger "device and process" track at the IEEE International Reliability Physics Symphosium (IRPS). Since few years ago, they have a dedicated track.

author: Dago
author_rank: Frequent Contributor
timestamp: February 10, 2016, 02:20:19 pm
content: What do you mean by "consumer" exactly? There are plenty automotive/safety microcontrollers which have ECC ram and peripheral memory and lockstep cores such as TI TMS570http://www.ti.com/lsds/ti/microcontrollers_16-bit_32-bit/c2000_performance/safety/tms570/overview.page

author: Jeroen3
author_rank: Super Contributor
timestamp: February 10, 2016, 02:58:12 pm
content: Have you already tried to get an "consumer grade" chip in a faulty condition with a radiation source?

author: nwvlab
author_rank: Regular Contributor
timestamp: February 10, 2016, 03:50:12 pm
content: Quote from: Jeroen3 on February 10, 2016, 02:58:12 pmYep, memories.

author: Daving
author_rank: Contributor
timestamp: February 12, 2016, 04:33:15 pm
content: Quote from: coppice on February 10, 2016, 06:42:09 amYes, however you have medical developers and watch developers buying the same part. The watch developers don't need to pay for ECC memory that they don't need, when the medical folks can add the checks in software.I skydive, and the AADs (dave did a teardown of a cypress) do self check every time they're turned on.Self checks can cover a checksum or CRC of the flash.Then during operation, important state variables can be written as an ECC struct. Reads and writes would go through a function for the ECC API. It would be slower, but the safety is in place.