CN110209547B - SRAM type FPGA single event upset reinforcement timing refresh frequency determination method and system - Google Patents

Abstract

A method and a system for determining the single event upset reinforcement timing refresh frequency of an SRAM type FPGA (field programmable gate array) need to verify and evaluate reinforcement measures applied to the SRAM type FPGA, utilize fault injection as a verification means, observe the running state of the FPGA application to determine the validity of the single event upset design applied by injecting upset into a configuration area of the FPGA, solve the problem that the prior art cannot quantitatively evaluate the inherent validity of the FPGA application, and can determine the refresh frequency value range of the FPGA.

Description

A kind of SRAM type FPGA single-event flip plus fixed-time refresh frequency determination method and system

technical field

The invention relates to a method and a system for determining the refresh frequency of a SRAM type FPGA single event flipping and fixing, and belongs to the field of FPGA application fault-tolerant design.

Background technique

In recent years, space missions have put forward higher requirements for on-orbit data processing, and stricter restrictions on the volume, weight, and power consumption of electronic equipment. At the same time, the application of satellites is developing in the direction of miniaturization and integration. The need for development is also more urgent. Commercial SRAM (static random access memory type) FPGA (Field Programmable Logic Gate Array) has the advantages of high integration, low development cost, high performance, low power consumption and online reconfiguration, and has become a popular choice in the field of space applications. Focus on hot spots and gradually get applied in the aerospace field. At the same time, SRAM-type FPGAs are prone to single-event upsets, that is, SEU situations. Therefore, when SRAM-type FPGAs are used in space, targeted protection design for SEU problems is required to ensure that the application of FPGAs can meet the on-orbit stable operation requirements of the mission.

Redundancy technology, including error detection and correction, triple-mode redundancy technology, and scheduled refresh are common anti-single event reversal reinforcement methods. Engineering practice shows that using redundancy or refreshing alone cannot achieve the desired reinforcement effect, and the two need to be combined. In space applications, the reinforcement of SRAM-based FPGAs generally requires both redundancy and refresh. The hardening of FPGA applications is not always effective. If the hardening method is not appropriate, system resources will be consumed and the expected hardening goals will not be achieved. At present, there is no mature SRAM-type FPGA single-event flip hardening verification method in engineering. Currently available methods include:

Heavy ion irradiation test: Heavy ion irradiation is the most direct and accurate means of evaluating the effectiveness of reinforcement, but the irradiation source machine time is limited, the test design, related technologies are complicated, and special test circuits need to be prepared, so it is mostly used for Research and technical verification are not suitable as an evaluation method for FPGA design in engineering.

Simulation fault injection: At present, there are many simulation and analysis methods to predict the error rate. The cost is small, but the accuracy is not enough. Simultaneously, fault injection simulation requires a specific design of the FPGA and a certain degree of knowledge in the field of probability. Therefore, this method is suitable for stand-alone designers to check the FPGA reinforcement design, but it is not an ideal assessment method.

Fault injection is a direct and easy-to-use verification method between radiation test and simulation analysis. By injecting flips into the FPGA and observing the running status of the FPGA application, the effectiveness of the anti-single event flipping design of the application is determined. At present, fault injection can be divided into two types: dynamic fault injection and static fault injection. The dynamic method is relatively straightforward, but the system design is more complicated. The static fault injection is simple to implement and has good versatility, but the test results cannot be directly applied to systems with refresh strategies. circuit design.

Contents of the invention

The technical problem solved by the present invention is: in view of the current prior art, when quantitatively evaluating the effectiveness of FPGA application single-particle flipping reinforcement, there is a lack of good versatility and easy implementation in engineering, and a method based on static fault injection is proposed. The evaluation method of SRAM-type FPGA single event flip hardening measures can quantitatively obtain the on-rail flip rate of FPGA application circuits, and help designers choose the timing refresh frequency of the application.

The present invention solves the problems of the technologies described above and is achieved through the following technical solutions:

A method for determining refresh frequency when SRAM type FPGA single event flips and is fixed, the specific steps are as follows:

(1) Reinforce the design of the FPGA circuit, analyze the on-orbit static inversion rate of the FPGA circuit according to the space radiation environment and the static inversion cross-section curve of the FPGA circuit, and obtain the on-orbit static inversion rate u of the FPGA circuit;

(2) rewrite the configuration file of the FPGA circuit in the initial state, randomly write N bits to flip, run the FPGA circuit, record the number of trials of output errors or functional interruptions under different flip digits, and Calculate the error ratio λ _N of FPGA circuit operation;

(3) gradually increase the number of digits N flipped in the configuration file of the FPGA circuit, when the error ratio λ _N of FPGA operation was greater than 50%, stop the fault injection test, and record the error ratio λ _N ;

(4) According to the recorded data in step (3), calculate the average sensitive bit ratio r _N under N-bit flipping, and judge that when N increases, the average sensitive bit ratio r _N under N-bit flipping increases with the number of flipping bits N. Whether it is greater than the change threshold K, if so, enter step (5) to judge the minimum on-orbit turnover rate; otherwise, stop the test and return to step (1) to re-reinforce the design of the FPGA circuit;

(5) Calculate the minimum on-orbit turnover rate E _min of the current reinforcement design, and judge whether the minimum on-orbit turnover rate E _min is less than the circuit error rate E ₀ set by the model task. If E _min is not less than E ₀ , then the reinforced If the anti-radiation performance of the FPGA circuit is insufficient, return to step (1) to re-reinforce the design of the FPGA circuit; if E _min is greater than E ₀ , the reinforcement design is valid and proceed to step (6);

(6) Carry out timing refresh to the effective FPGA circuit of reinforcement design, calculate the relationship between FPGA circuit error rate and timing refresh frequency f;

(7) Select the refresh frequency f arbitrarily within the allowable range of the model task, calculate the FPGA circuit error rate E _f at the current refresh frequency, and compare it with the circuit error rate E ₀ set by the model task, if E _f is less than E ₀ , If the current refresh rate is available, otherwise the current refresh rate is too low, increase the scheduled refresh rate and recalculate the error rate of the FPGA circuit at this refresh rate;

Record the value of the timing refresh frequency and FPGA application error error rate E _f at the corresponding refresh frequency f that meets the screening conditions in step (7), and repeat step (7) to obtain E _f -f within the refresh frequency range permitted by the model task Curves for users to choose the refresh rate by themselves.

In the described step (2), under the initial state, the number of digits N injected into the reversal is equal to 1, and the error ratio λ _N of the FPGA circuit operation is, the number of times that the FPGA circuit outputs errors or function interruptions and the total number of tests M under the observable state The ratio of , where the setting conditions for the total number of tests M are as follows:

Continue to test until 50 or more output errors or functional interruptions are observed; if there is a limit to the test time, the number of observed output errors or functional interruptions can be reduced to 20 times.

The initial number of flipped N bits is 1, and the number of flipped bits increases exponentially in M trials.

When the occurrence of errors and functional interruptions cannot be observed when the FPGA circuit is running, the fault injection test can be ended after [16u/E ₀ ] trials, and the upper limit of the error ratio under the 95% confidence level E ₀ /4u is used as the Trial error ratio λ _N .

In the step (5), the calculation method of the average sensitive bit ratio r _N under N bit flipping is as follows:

The change threshold K is an increase multiple of r _N , that is, when the maximum value of the flipping digit N is taken as N _max , the average sensitive bit ratio is r _{N_max} :

K=r _{N_max} /r ₁ .

If the change threshold K>5, the reinforcement design is effective, otherwise it is determined that the radiation resistance performance of the reinforced FPGA circuit is insufficient, and return to step (1) to re-reinforce the design of the FPGA circuit.

In the step (5), the calculation formula of the minimum on-orbit turnover rate _Emin is:

E _min =λ ₁ u.

In described step (6), the relational expression of error rate E _f and timing refresh period f is as follows:

P(N)=u ^N f ^-N e ^-u/f /N!

In the formula, P(N) is the probability of N-bit flips occurring within a refresh cycle, u is the on-track static flip rate of the FPGA configuration area, and E _f is the on-track error rate of the FPGA circuit at f as the refresh frequency.

A SRAM-type FPGA anti-single-event flip plus fixed-time refresh frequency determination system, including a fault injection module, an operating error ratio judgment module, an on-orbit flip rate judgment module, a circuit error rate calculation module, and a refresh frequency selection module, wherein:

Fault injection module: rewrite the configuration file of the FPGA circuit in the initial state, randomly write N-bit flips, run the FPGA circuit, and record the number of tests with output errors or functional interruptions in the case of different flip bits in M tests; At the same time, gradually increase the number of flipped digits N, repeat the test and record the experimental data;

Operation error ratio judgment module: According to the test data recorded by the fault injection module, calculate the error ratio λ _N of FPGA circuit operation under different flipping digits N, and send it to the fault injection module when the error ratio λ _N is greater than 50%. Stop the test command and record the error ratio λ _N ;

On-orbit flipping rate judgment module: According to the error ratio λ _N recorded under different flipping digits N obtained by running the error ratio judging module, calculate the average sensitive bit ratio r _N under N-bit flipping respectively, and judge that when N increases, Whether the average sensitive bit ratio r _N under N-bit flipping is greater than the change threshold K with the increase of the flipping number N, if so, then judge the circuit error rate; otherwise, stop the test and re-reinforce the design of the FPGA circuit;

Circuit error rate calculation module: Calculate the minimum on-orbit turnover rate E _min of the current reinforcement design, and judge whether the minimum on-orbit turnover rate E _min is less than the circuit error rate E ₀ set by the model task. If E _min is not less than E ₀ , then The radiation resistance performance of the reinforced FPGA circuit is insufficient, and the FPGA circuit is re-reinforced and designed; if E _min is greater than E ₀ , the reinforced design is valid, and the refresh frequency is selected;

Refresh frequency selection module: regularly refresh the FPGA circuit with effective reinforcement design, calculate the relationship between the FPGA circuit error rate and the timing refresh frequency f, select the refresh frequency f arbitrarily within the allowable range of the model task, and calculate the FPGA circuit error at the current refresh frequency rate E _f , and compare it with the circuit error rate E ₀ set by the model task, if E _f is less than E ₀ , the current refresh rate is available, otherwise the current refresh rate is too low, increase the timing refresh rate and recalculate the refresh rate Lower the FPGA circuit error rate until the model task requirements are met.

The advantage of the present invention compared with prior art is:

(1) A method for determining the timing refresh frequency of a SRAM type FPGA anti-monadle example flipping reinforcement measure provided by the present invention, combined with the track environment analysis and fault injection method, can quantitatively predict the on-orbit error rate of the SRAM type FPGA, and solve the current problem In engineering, there is no quantitative assessment problem in the application of anti-single event flip reinforcement measures in FPGA. At the same time, by measuring the curve of error ratio λ _N and flip digit N, this method can directly identify whether there is redundancy in the circuit. For no redundancy/low redundancy For redundant circuits, the timing refresh strategy is invalid, and a new reinforcement design is required;

(2) The present invention can guide the determination of the timing refresh frequency, considering that the occurrence of SEU events satisfies the Poisson distribution, combined with the device on-orbit static flip rate and task requirements, the relationship between the refresh frequency and the FPGA application on-orbit error rate is obtained, helping designers Select the refresh strategy and use the static fault injection method at the same time, only need to randomly inject and modify the FPGA configuration file, and do not need specific design files for FPGA applications during the assessment. It is easy to implement and can be applied to different types of SRAM FPGAs.

Description of drawings

Fig. 1 is the flow chart of the frequency determination method provided by the invention;

Fig. 2 is the change trend diagram of the average sensitive bit ratio r _N and the number of flipped bits N provided by the invention under N-bit flipping;

Figure 3 shows the relationship between the refresh frequency of circuit B provided by the invention and the predicted result of the on-track error rate;

Detailed ways

A kind of SRAM type FPGA anti-single-event-flip plus fixed refresh frequency determination method, as shown in Figure 1, the specific steps are as follows:

(1) Reinforce the design of the FPGA circuit. The reinforcement design of the circuit generally includes redundant design of hardware integration, program error correction, and timing refresh. Orbit parameters, mission requirements, and combined with the space radiation environment, analyze the static flip rate u of the reinforced FPGA circuit on the space orbit;

Among them, the mission orbit parameters need to provide the perigee, apogee and inclination of the mission orbit. The model mission requirements generally include the requirements for the interruption rate of FPGA on-orbit functions and the on-orbit error rate requirements for various types of errors. In the present invention, the error rate E ₀ is used to replace various errors required by the task.

(2) Randomly inject N-bit faults into the configuration file of the FPGA circuit device configuration area in the initial state, obtain an FPGA circuit with N-bit inversion, and run the circuit, wherein the fault injection method is as follows:

(2a) Randomly write N errors into the configuration file of the application;

(2b) Configure the configuration file with errors to the application circuit;

(2c) Operate the circuit, and detect whether the circuit has output errors or function interruptions, and record the number of trials where errors and abnormal conditions occur;

(2d) If the abnormality still cannot be observed within the specified time, stop this test, calculate the error ratio λ _N of the FPGA circuit operation, if necessary, continue the wrong configuration injection test, start the next fault injection, and repeat the above steps ; Among them, the specified time setting needs to be determined according to the specific application. In principle, it is necessary to ensure that the time is sufficient to allow errors in FPGA applications to be observed;

At the same time, M times of trials are carried out, and when enough error events are observed, the error ratio λ _N of the FPGA application design with different N-bit flips in each trial is calculated respectively, where the error ratio is equal to the number of observed errors divided by Take the number of trials λ _N = #Error/#Test;

Among them, in the M trials, the number of trials with error events should not be less than 50, and the trials will continue until 50 or more output errors or functional interruptions are observed; if there is a limit to the trial time, the observed The number of received output errors or function interruptions is reduced to 20 times;

And if the circuit error ratio λ _N is extremely low, and the occurrence of errors and functional interruptions cannot be observed when the FPGA circuit is running, the maximum number of trials can be set as the total number of trials M, and then the test is stopped after reaching the maximum number of trials. The maximum number of trials It should be determined according to the reliability requirements of the circuit. For example, the system requires that the circuit error rate is not higher than E ₀ , and the corresponding circuit error ratio should not be greater than E ₀ /u. Here, the fault test accuracy is required to reach E ₀ /4u, and the recommended number of tests is not is less than [16u/E ₀ ], in this case, even if no error is observed, the upper limit of circuit error ratio λ N can be replaced by the upper limit of circuit error ratio λ _N with 95% confidence level as the upper limit of error ratio of FPGA application design use;

(3) Gradually increase the flipping number N injected into the FPGA configuration area to obtain the relationship between the error ratio λ _N and the flipping number N, where:

When the number of flipping bits is large, the circuit error ratio λ _N does not change significantly with the increase of N. It is recommended to gradually increase N in an exponential form. For example, the selection of the number of flipping bits for injection can be: 1,2,4,6, 10,20,40,60,100,200,…

When the error rate ratio λ _N reaches more than 50%, the fault injection test can be ended;

(4) To judge the validity of the circuit reinforcement design, calculate the average sensitive bit ratio r _N under N-bit flipping according to the recorded data in step (3), and judge that when N increases, the average sensitive bit ratio r _N under N-bit flipping increases with Whether the change value of the fault turnover number N is greater than the change threshold K, if so, enter step (5) to judge the minimum on-orbit turnover rate; otherwise, stop the test and redesign the FPGA circuit after reinforcement, where:

The calculation formula of the average sensitive bit ratio under the N-bit flipping is as follows:

The threshold value K refers to the increase multiple of r _N , that is, the ratio of the average sensitive bit ratio r _{N_max} to r ₁ when the maximum value of the number of flipped digits N is N _max :

K＝r _{N_max} /r ₁

When K<5, it can be considered that the circuit redundancy is insufficient, and the timing refresh measure cannot reduce the on-orbit turnover rate, and can only be used as an abnormal recovery measure. In this case, a new reinforcement design is required; if the change threshold K>5, then The reinforcement design is effective, otherwise it is determined that the radiation resistance of the reinforced FPGA circuit is insufficient, and the reinforcement design is re-designed;

(5) In the case of calculating the number of current fault flips, the minimum on-rail flip rate E _min of the FPGA circuit after reinforcement is the product of the error ratio λ ₁ of judging injected N-bit flips and the on-rail static flip rate u of the device, which will be calculated by The minimum on-orbit turnover rate λ ₁ u that can be achieved by the timing refresh strategy circuit is compared with the circuit error rate E ₀ set by the model task. If λ ₁ u≥E ₀ , it indicates that the circuit’s anti-SEU performance is insufficient, no matter how large the refresh rate is. At frequency f, the fault tolerance requirements for SEU cannot be met, and redesign is required; if λ ₁ u<E ₀ , the circuit reinforcement design is valid, and you can enter the next step to refresh the frequency analysis;

The calculation formula of the minimum on-orbit turnover rate E _min is:

E _min =λ ₁ u;

(6) Perform timing refresh on the FPGA circuit with effective reinforcement design, determine the relationship between the error rate of the FPGA circuit and the timing refresh frequency f, and calculate according to the on-orbit static flip rate u and the current fault flip number N obtained in step (1). When is the timing refresh frequency, apply the relational expression between the error rate and the timing refresh cycle f;

According to the flip rate u of the FPGA configuration area calculated in step (1), according to the Poisson distribution, it can be obtained that within a refresh cycle 1/f, the calculation formula for the N-bit flip probability P(N) in the FPGA configuration area is:

P(N)=u ^N f ^-N e ^-u/f /N! ,

Then, within a refresh period 1/f, the calculation formula for the error probability E of the FPGA application circuit is:

Correspondingly, after adopting the timing refresh strategy with f as the refresh frequency, the relationship between the application error rate E _f of the FPGA circuit after reinforcement and the timing refresh cycle f is as follows:

Usually the circuit error probability E in a refresh cycle is a data much smaller than 1, the above formula can also be approximated and simplified as

At this time, select the refresh frequency f within the allowable range of the model task, and calculate it according to the above formula. Correspondingly, compare it with the circuit error rate E ₀ required by the design. If E _f is less than E ₀ , the current refresh frequency is available, otherwise the current Refresh frequency is insufficient, reselect the scheduled refresh frequency and recalculate the refresh frequency, apply the reinforcement design error rate until the requirements are met;

(8) Record the value of the timing refresh frequency and FPGA application error error rate E _f under the corresponding refresh frequency f that meets the screening conditions in step (7), and repeat step (7) to obtain E within the refresh frequency range of the model task license _f -f curve, for users to choose the refresh frequency by themselves.

At the same time, in conjunction with the above method, a SRAM-type FPGA anti-single event flip plus fixed-time refresh frequency determination system is designed, including a fault injection module, an operation error ratio judgment module, an on-orbit flip rate judgment module, a circuit error rate calculation module, and a refresh rate module. Frequency selection module, wherein:

Fault injection module: rewrite the configuration file of the FPGA circuit in the initial state, randomly write N-bit flips, run the FPGA circuit, and record the number of tests with output errors or functional interruptions in the case of different flip bits in M tests; At the same time, gradually increase the number of flipped digits N, repeat the test and record the experimental data;

Operation error ratio judgment module: According to the test data recorded by the fault injection module, calculate the error ratio λ _N of FPGA circuit operation under different flipping digits N, and send it to the fault injection module when the error ratio λ _N is greater than 50%. Stop the test command and record the error ratio λ _N ;

On-orbit flipping rate judgment module: According to the error ratio λ _N recorded under different flipping digits N obtained by running the error ratio judging module, calculate the average sensitive bit ratio r _N under N-bit flipping respectively, and judge that when N increases, Whether the average sensitive bit ratio r _N under N-bit flipping is greater than the change threshold K with the increase of the flipping number N, if so, then judge the circuit error rate; otherwise, stop the test and re-reinforce the design of the FPGA circuit;

Circuit error rate calculation module: Calculate the minimum on-orbit turnover rate E _min of the current reinforcement design, and judge whether the minimum on-orbit turnover rate E _min is less than the circuit error rate E ₀ set by the model task. If E _min is not less than E ₀ , then The radiation resistance performance of the reinforced FPGA circuit is insufficient, and the FPGA circuit is re-reinforced and designed; if E _min is greater than E ₀ , the reinforced design is valid, and the refresh frequency is selected;

Refresh frequency selection module: regularly refresh the FPGA circuit with effective reinforcement design, calculate the relationship between the FPGA circuit error rate and the timing refresh frequency f, select the refresh frequency f arbitrarily within the allowable range of the model task, and calculate the FPGA circuit error at the current refresh frequency rate E _f , and compare it with the circuit error rate E ₀ set by the model task, if E _f is less than E ₀ , the current refresh rate is available, otherwise the current refresh rate is too low, increase the timing refresh rate and recalculate the refresh rate Lower the FPGA circuit error rate until the model task requirements are met.

Further explanation is carried out below in conjunction with specific embodiment:

The invention proposes a method for determining the timing refresh frequency of FPGA circuit applications based on static fault injection, which can be used for determining the timing refresh frequency of SRAM FPGAs and quantitatively assessing the on-track error rate of FPGA applications.

The first step is to predict the on-orbit turnover rate of the device according to the orbit, the static cross-section of the device, and space weather constraints. For the specific method, please refer to the document "SEU rate analysis method for triple-mode redundant technology protection structure" (The 11th National Radiation Resistance Electronics and Electromagnetic Pulse Academic Annual Conference). Taking the Xilinx V2 series 3 million gate FPGA as an example, its on-orbit static flip rate is shown in the table below.

Assume that a certain model requires that the device can withstand the worst one-day environment, and the task requires that the FPGA application error rate should not be higher than E ₀ =1 time/week under the worst one-day environment.

According to the device flipping 1.94×10 ^-2 times per second on average, 11,733 bit flips will occur on average in one week, and the three effective figures are about 1.2×10 ⁴ flips. It is necessary to ensure that the probability of error caused by each bit flipping is less than 1/1.2×10 ⁴ ＝8.3×10 ^-5 , here it should be noted that 8.3×10 ^-5 does not correspond to the error ratio when a fault is injected into a bit flip. Generally speaking, as the number of flips starts to accumulate in the FPGA configuration area, the SEU The error probability caused by time will increase. Under the timing refresh strategy, the average error probability of each flip is related to the refresh frequency.

The second step is to perform fault injection. No less than 50 errors need to be observed here. If the circuit reinforcement performance is ideal and no errors are observed after 1.2×10 ⁴ ×16=19.2×10 ⁴ tests, the test can be stopped , and according to the 95% confidence level, the upper limit of the confidence interval of the circuit error rate is 2.05×10 ^-5 to evaluate/predict the application on-orbit error rate.

The third step is to change the number of flipping bits N injected into, and obtain the curve of the error rate λ _N and the flipping bits N, if the error rate of the circuit is higher than 50%, you can stop the test and go to the next step.

The fourth step is to analyze whether the circuit reinforcement is effective. Assuming two circuits A and B, the fault injection test results are shown in the table below.

Here the error ratio λ _N of the circuit has been calculated, and r _N is also calculated correspondingly. The relationship between r _N and N is shown in Figure 2.

With the increase of N, the average sensitive bit ratio r _N is almost unchanged under the flipping of N bits in the configuration area corresponding to the increase of N. This type of circuit is a typical non-redundant circuit without protection measures, and regular refresh cannot reduce its on-track error rate. . Its on-orbit error rate is uλ ₁ , here the worst day’s turnover rate u is taken as 1.94×10 ^-2 times/s, the circuit error ratio λ ₁ is about 2.0×10 ^-4 , and the minimum on-orbit error rate of circuit A is E _min It is 2.3 times/week, which does not meet the requirement that the error rate should not be higher than E ₀ =1 time/week.

The r _N corresponding to circuit B increases with the increase of N. This is a typical phenomenon after the circuit is redundantly reinforced. The on-orbit error rate of this type of circuit can be reduced by timing refresh, and the minimum can be reduced to λ ₁ u. If the product λ ₁ u of circuit B corresponding to one-bit inversion error ratio and device inversion rate is greater than E ₀ , in this example E ₀ = 1 time/cycle, the static inversion rate u is 1.94×10 ^-2 times/s, which can be calculated It is obtained that if the corresponding λ ₁ >8.3×10 ^-5 , no matter how frequently the circuit is refreshed, it cannot meet the anti-single event upset performance requirements, and needs to be re-reinforced; otherwise, it means that an appropriate refresh frequency can meet the task requirements.

The fifth step is to determine the timing refresh frequency. The purpose of timing refresh is to minimize the accumulation of SEU in the configuration area and reduce the frequency of errors. Here we take circuit B as an example for analysis.

Before performing precise calculations, the refresh frequency can be roughly estimated, the refresh frequency f, the average number of flips in a refresh cycle n=[u/f] (brackets indicate rounding), and r _n u can be used to simply judge Error probability within a refresh cycle, and use E _f =r _n u to make a simple estimate of the error probability. It should be noted that the above method can only be used for preliminary estimation, which helps to quickly determine the approximate refresh frequency range, and is not suitable as the final analysis result. The preliminary analysis results are shown in the table below.

According to the results in the above table and the requirement that the error rate is not greater than 1 time/week, it can be preliminarily determined that the refresh cycle should be selected between 5.2 and 8.6 minutes.

① Select the refresh cycle as 6 minutes, and meet the requirement that the error rate is not greater than 1 time per week with a relatively low refresh rate. The calculation process is shown in the table below. In this calculation example, the probability of flipping over 20 bits in one cycle is already very low. Here, the error ratio of flipping over 20 bits is regarded as 100% to estimate the upper limit of the circuit error rate.

From the table, it can be obtained that the total probability of circuit errors due to SEU within a refresh period of 360s is 5.68×10 ^-4 , and the error rate per unit time is E _f =E*f=1.578×10 ^-6 times/second=0.95 times /week, which can meet the task requirements.

②Choose the refresh period as 60 seconds to improve the best protection performance of the circuit. In this calculation example, the probability of flipping digits greater than 10 digits in one cycle is already very low. Here, the error ratio of flipping digits exceeding 10 digits is regarded as 100%. The calculation process is shown in the table below.

From the table, it can be obtained that the error probability of the circuit due to SEU within a refresh period of 60s is 3.35×10 ^-5 , and the error rate per unit time is E _f =E*f=5.58×10 ^-7 times/second=0.34 times/ Zhou, compared with the refresh cycle of 360 seconds, the error rate is only 36% of the original. After increasing the refresh rate, the circuit’s anti-single event upset performance has increased by 180%, which is a more obvious improvement.

③The circuit has the best anti-single event upset performance

Here we will discuss the best anti-SEU protection performance that the circuit can achieve after increasing the refresh rate. The most ideal situation that can be achieved by timing refresh is that due to the adoption of the refresh strategy, the flipping of the FPGA configuration area is quickly corrected and cannot be accumulated. But the simultaneous flush strategy does not protect against errors caused by a single configuration bit flip. Therefore, when almost only a single bit flips in a refresh cycle, it means that the circuit has reached the best protection effect, and the error rate of the circuit is equal to u*λ ₁ . Theoretically, circuit B can achieve the lowest flip rate of 0.211 times per week after timing refresh.

In this calculation example, we calculated the circuit error rate at multiple refresh frequencies, and the specific results are shown in Figure 3. It can be seen that with the decrease of the refresh period and the increase of the refresh frequency, the error rate of the circuit gradually approaches the theoretical minimum error rate u*λ ₁ of the circuit.

In practical applications, the higher the refresh rate, the higher the consumption of circuit resources. Therefore, it is not advisable to increase the refresh rate indefinitely in order to achieve the maximum protection performance. In this example, the task requires that the error rate is not greater than 1 time per week, and 6 minutes is selected. One refresh cycle can already meet the requirements, and the refresh frequency of 6 minutes is the minimum refresh frequency to meet the task requirements; considering improving the anti-SEU performance, choosing a refresh cycle of 1 minute, the error rate can be reduced to 0.34 times/week, which is more appropriate; and 10 Refresh frequency once per second can further reduce the error rate to 0.22 times per week. Compared with SEU hardening performance, the improvement is not much, but the price is high. It is better to consider improving the circuit redundancy design to improve SEU hardening performance.

The above description is only the best specific implementation mode of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of changes or modifications within the technical scope disclosed in the present invention. Replacement should be covered within the protection scope of the present invention.

The content that is not described in detail in the specification of the present invention belongs to the well-known technology of those skilled in the art.

Claims (1)

1. A method for determining the timing refresh frequency of single event upset reinforcement of SRAM type FPGA is characterized by comprising the following steps:

(1) Performing reinforcement design on the FPGA circuit, and performing on-orbit static flip rate analysis on the FPGA circuit according to a space radiation environment and a static flip section curve of the FPGA circuit to obtain an on-orbit static flip rate u of the FPGA circuit;

(2) Rewriting configuration files of the FPGA circuit in an initial state, randomly writing N-bit overturn, operating the FPGA circuit, recording test times of output errors or function interruption under different overturn bit numbers in M tests, and calculating the operation error proportion lambda of the FPGA circuit _N ；

(3) Gradually increasing the number N of turnover bits in the configuration file of the FPGA circuit, and when the FPGA operates in the error proportion lambda _N If the error rate is greater than 50%, stopping the fault injection test and recording the error rate lambda _N ；

(4) Calculating the average sensitive bit proportion r under N-bit overturn according to the recorded data in the step (3) _N Judging the average sensitive bit proportion r under N bit overturn when N is increased _N If the increase multiple of the number of turning bits N is larger than a change threshold K, the step (5) is entered to judge the minimum on-orbit turning rate; otherwise, stopping the test, and returning to the step (1) to carry out re-reinforcement design on the FPGA circuit;

(5) Calculating the minimum on-orbit roll-over rate E of the current reinforcement design _min And judging the minimum on-orbit turnover rate E _min Whether or not it is smaller than the circuit error rate E of the model task setting ₀ If E _min Not less than E ₀ The reinforced FPGA circuit has insufficient radiation resistance, and the method returns to the step (1) to carry out re-reinforcement design on the FPGA circuit; if E _min Greater than E ₀ The reinforcement design is effective, and the step (6) is entered;

(6) Performing timing refreshing on the FPGA circuit with the effective reinforcement design, and calculating the relation between the error rate of the FPGA circuit and the timing refreshing frequency f;

(7) The refresh frequency f is arbitrarily selected in the allowable range of the model task, and the FPGA circuit error rate E under the current refresh frequency is calculated _f And is set with the model task to the circuit error rate E ₀ Compare, if E _f Less than E ₀ If the current refresh frequency is too low, increasing the timing refresh frequency and recalculating the FPGA circuit error rate under the refresh frequency;

recording the timing refresh frequency meeting the screening condition in the step (7) and the error rate E of the FPGA application error under the corresponding refresh frequency f _f E in the refresh frequency range permitted by the model task obtained by repeating the step (7) _f -f curve for user to select refresh frequency by himself;

in the step (2), the bit number N of injection inversion in the initial state is equal to 1, and the error proportion lambda of the operation of the FPGA circuit _N In order to observe the ratio of the number of output errors or functional interruption of the FPGA circuit to the total test number M, the setting condition of the total test number M is as follows:

continuing the test until 50 or more output errors or functional interruptions are observed; if the test time is limited, the number of observed output errors or functional interruption can be reduced to 20;

the number of the initial turning bits of the N bits is 1, and in M times of experiments, the number of the turning bits is increased in an exponential form;

when the FPGA circuit runs, the occurrence of errors and functional interruption cannot be observed, and the error and the functional interruption can be detected after the operation of [16u/E ] ₀ ]Ending the fault injection test after the secondary test, and simultaneouslyUpper error proportion limit E at 95% confidence ₀ Error ratio lambda of the test of 4u _N ；

In the step (5), the average sensitive bit proportion r under N-bit inversion _N The calculation method of (2) is as follows:

the change threshold K is r _N The increase multiple of (2), i.e. the maximum value of the number N of the flip bits is N _max When the average sensitive bit proportion is r _{N_max} ：

K＝r _{N_max} /r ₁ ；

If the variation threshold K is more than 5, the reinforcement design is effective, otherwise, the reinforced FPGA circuit is determined to have insufficient radiation resistance, and the step (1) is returned to carry out the reinforcement design again on the FPGA circuit;

in the step (5), the minimum on-orbit roll-over rate E _min The calculation formula of (2) is as follows:

E _min ＝λ ₁ u；

in the step (6), the error rate E _f The relationship with the timed refresh period f is as follows:

P(N)＝u ^N f ^-N e ^-u/f /N！

wherein P (N) is the probability of N-bit overturn in one refresh period, u is the static overturn rate of the FPGA configuration area in orbit, E _f F is taken as the on-orbit error rate of the FPGA circuit under the refresh frequency;

the SRAM type FPGA anti-single event upset reinforcement timing refresh frequency determining system for realizing the SRAM type FPGA single event upset reinforcement timing refresh frequency determining method comprises a fault injection module, an operation error proportion judging module, an on-track upset rate judging module, a circuit error rate calculating module and a refresh frequency selecting module, wherein:

and a fault injection module: the configuration file of the FPGA circuit in the initial state is rewritten, N-bit overturn is randomly written, the FPGA circuit is operated, and the test times of output errors or function interruption under the condition of different overturn bits in M times of tests are recorded; meanwhile, gradually increasing the number N of turnover bits, performing repeated experiments and recording experimental data;

and an operation error proportion judging module: according to test data recorded by the fault injection module, calculating the error proportion lambda of the operation of the FPGA circuit under the condition of different turnover bit numbers N _N When the error ratio lambda _N When the error rate is greater than 50%, a test stopping instruction is sent to the fault injection module, and the error rate lambda is recorded _N ；

On-orbit turnover rate judging module: error proportion lambda recorded under the condition of different turnover digits N obtained by the operation error proportion judging module _N Calculating average sensitive bit proportion r under N-bit overturn _N Judging the average sensitive bit proportion r under N bit overturn when N is increased _N Judging whether the increase multiple of the turnover bit number N is larger than a change threshold K or not, if so, judging the circuit error rate; otherwise stopping the test, and re-reinforcing the FPGA circuit;

a circuit error rate calculation module: calculating the minimum on-orbit roll-over rate E of the current reinforcement design _min And judging the minimum on-orbit turnover rate E _min Whether or not it is smaller than the circuit error rate E of the model task setting ₀ If E _min Not less than E ₀ The radiation resistance of the reinforced FPGA circuit is insufficient, and the FPGA circuit is re-reinforced; if E _min Greater than E ₀ The reinforcement design is effective, and refresh frequency selection is performed;

the refresh frequency selection module: the method comprises the steps of regularly refreshing an FPGA circuit with an effective reinforcement design, calculating the relation between the error rate of the FPGA circuit and the regular refresh frequency f, randomly selecting the refresh frequency f within the allowable range of model tasks, and calculating the error rate E of the FPGA circuit under the current refresh frequency _f And is set with the model task to the circuit error rate E ₀ Compare, if E _f Less than E ₀ The current refresh frequency is available, otherwise the current refresh frequencyThe rate is too low, the timing refreshing frequency is increased, and the FPGA circuit error rate under the refreshing frequency is recalculated until the model task requirement is met;

the method comprises the steps of analyzing the on-orbit static turnover rate of an FPGA circuit according to a space radiation environment and a static turnover section curve of the FPGA circuit, and determining the turnover rate related to refresh frequency;

in the fault injection process, estimating the test times of output errors or function interruption;

recording error proportion parameters after stopping fault injection test by adjusting the number of the turning bits, and setting error proportion judgment parameters;

setting a change threshold K, and judging the average sensitive bit proportion r _N Whether the increase multiple of the flip bit number N is larger than a change threshold K is determined to be required to carry out re-reinforcement design on the FPGA circuit;

and judging whether reinforcement is effective or not by calculating the minimum on-track turnover rate, and determining the timing refresh frequency to reduce the occurrence frequency of errors.

Images