PROGRAMMABLE TECHNOLOGIES WEB SITE

A scientific study of the problems of digital engineering for space flight systems,
with a view to their practical solution.


Single Event Effect Testing of the Intel 80386 Family and the 80486 Microprocessor

A. Moran1, K. LaBel1, M. Gates1, C. Seidleck2, R. McGraw3, M. Broida4, J. Firer4, S. Sprehn5

1. NASA/GSFC, Code 735.1, Greenbelt, MD 20771 USA
2. Hughes ST Systems, Greenbelt, MD 20771 USA
3. Jackson & Tull, Greenbelt, MD 20771 USA
4. Daedalian Systems Corp, Greenbelt, MD 20771 USA
5. Lystad Ltd., Crownsville, MD 21032 USA

Abstract

We present single event effect test results for the Intel 80386 microprocessor, the 80387 coprocessor, the 82380 peripheral device, and on the 80486 microprocessor. Both single event upset and latchup conditions were monitored.

I. INTRODUCTION

The 80386 and 80486 microprocessors hold several distinct advantages over radiation-hardened microprocessors. These include reducing both cost and design time for spaceflight missions. This is accomplished by being industry-standard as well as commercially available devices with many commercial off-the-shelf (COTS) software applications, development tools, and operating systems. The 80386 microprocessor is currently in use on several spaceflight projects, while the 80486 is being considered for other projects. In particular, the 80386 is currently flying on Hubble Space Telescope (HST) and Solar Anomalous Magnetospheric Particle Explorer (SAMPEX), and is baselined for utilization on Earth Observing Satellite (EOS-AM), X-ray Timing Explorer (XTE), and Tropical Rainforest Measurement Mission (TRMM). The 80486 is currently being considered as a candidate HST replacement processor as part of the HST servicing program. This appears to be a spaceflight trend: utilizing commercial-type devices and up-screening them as per mission requirements.

However, the use of these commercial parts in spaceflight raises the issue of vulnerability to single event effects (SEE). A single event upset (SEU - a transient or bit flip) in a microprocessor's control unit may "crash" (halt or cause improper operation) a spacecraft system or subsystem. Worse yet would be an uncorrected single event latchup (SEL - a high-current condition) that may permanently damage a device or an entire system. It is essential to determine how vulnerable these commercial devices are to such SEEs. These experiments were performed in an effort to understand the effect of SEEs on a microprocessor from a system level standpoint: to determine how the use of these technologies will affect the system as a whole. This is a key difference from traditional piecepart testing.

II. TEST DEVICES

All devices tested were manufactured by Intel Corporation. Two to three samples of each device were tested. This is a compromise between test costs and time versus statistical validity. Table 1 describes these integrated circuits (ICs).

Three device types from the 80386 microprocessor family were tested: the 80386, 80386, and 82380. The 80386 itself is a general purpose 32-bit microprocessor. Test samples had maximum operating clock frequencies of 20 and 25 MHz (see Table 1) that were derated to operate at 16 MHz. The 80386DX has been tested previously [1,2] by NASA/GSFC and JPL, but as results may vary between lots, several lots were tested for various spaceflight projects. The 80387 math coprocessor is an extension to the 80386 microprocessor. It dramatically increases processing speed of 80386 application software. The 82380 peripheral integrates numerous functions necessary in a 80386 operating environment; the device acts as DMA controller, interrupt controller, interval timer, wait state generator, DRAM refresh controller, and system reset logic.

The 80486 microprocessor incorporates significant enhancements over the 80386. By integrating the microprocessor with the 80387 math coprocessor, on-chip cache memory, a clock doubler, and RISC design, operational performance is greatly enhanced. Because of differences in the manufacturing process (CHMOS IV and V), both the 80486DX33 and the 80486DX2-66 required testing. Devices from three potential spaceflight lots of 80486DX2-66 were tested because of the possibility of variance between lots. Slight changes in manufacturing process may have great impact on the SEE sensitivity of a device.

Objectives of this series of tests were to determine several SEE experimental parameters. For heavy ion tests, the linear energy transfer (LET) threshold (LETth) is defined as the LET in MeV*cm2/mg where SEE is first observed during testing, at fluence 1E6 or 1E7 particles/cm2. All LETs discussed are in MeV*cm2/mg. Additionally, a device cross section or sensitivity versus tested LETs were noted. For proton SEE results, device cross section versus proton energy was determined.

III. TEST PROCEDURE

A. Test Facilities
1) Heavy Ion Test Facility

Heavy Ion SEE testing was performed at the Brookhaven National Laboratories' (BNL) Single Event Upset Test Facility (SEUTF).

Device Function Process
80386:
- MG80386DX-20/B
- 80386DX-25
32-bit Microprocessor 1.0um CHMOS IV [3]
MG80387-20/B Math Coprocessor for the 80386 1.0um CHMOS IV [4]
82380:
- MG82380-20/B
- 82380-16
Integrated Peripheral for the 80386 - direct memory access (DMA) controller, interrupt controller, interval timer, wait state generator, dynamic random access memory (DRAM) refresh controller, system reset logic 1.5um CHMOS III [5]
80486:
- 80486DX-33
- 80486DX2-66 (from 3 different lots)
32-bit Microprocessor - integrated 80387 math coprocessor, on-chip cache memory, clock doubler, RISC design 1.0um CHMOS IV [6]
- (80486DX-33)
0.8um CHMOSV
- (80486DX2-66)
Table 1 Test Devices

This setup utilizes a dual Tandem Van De Graaff acceleratorsuitable for providing ions and energies for SEU testing. Ions used are listed in Table 2. The SEUTF provides a computer interface that allows users to run the experiments.

Ion Energy (MeV) LET at normal beam incidence
F-19 139 3.4
Si-28 190 7.79
Ti-47 182 20.1
Ni-58 258 26.8
Br-75 285 37.2
I-127 311 59.6
Au-197 323 80.9
Table 2 Heavy Ions Used for Testing
Test boards containing the device-under-test (DUT) were mounted inside the SEUTF vacuum chamber. All test runs were performed with the ion beam held normal to the DUT; intermediate LETs were obtained by changing the energy of the beam. This was due to device packaging constraints not allowing angular beam incident testing to be performed. Tests were run with very low ion flux rates (1E3 to 2E4 particles/cm2/sec) in order that individual SEE events could be differentiated, typically with fluences of 1E6 or 1E7 particles/cm2 (1E6 particles/cm2 was often used to reduce the amount of total dose exposure of the DUT: we were worried about device failure and only had a limited number of samples). Devices were delidded to accommodate beam penetration limits.
2) Proton Test Facility

Proton SEE testing was performed at the University of California at Davis (UCD) Cyclotron facility. Proton flux was typically 1E8 particles/cm2/sec with a fluence of 1E10 particles/cm2 . The proton beam was tuned to the facility's maximum energy of 63 MeV, and degraded using Al shields to 38.2 MeV and 26.6 MeV, respectively. Energies and fluxes were measured as those incident on the DUT package.

B. Test Technique

All devices were tested both with input power supply voltages of Vcc ± 5%. Vcc for all devices was 5V. Temperature for testing was a nominal 25 deg C. Table 3 summarizes each test setup and SEU types observed.

SBC Test Method Types of SEUs Observed
80386 Compare device data and address lines with known values stored in a PC. Data - miscompare with stored data/address values;
Lockup - single event functional interrupts (SEFI) requiring a reset signal to the device (HW or SW) to return to normal operations.
80486 Lock-step comparison of two DUTs (data, address, and control lines). Non-compare - miscompare between DUT and reference device data/address/control lines;
Lockup - single event functional interrupts (SEFI) requiring removal of device power to return to normal operations.
Table 3 Test Setups
1) 80386 Family Techniques

The 80386, 80387, and 82380 were mounted on a custom-designed single-board computer (SBC) that was placed inside the BNL vacuum test chamber. Also included in the test system were a Personal Computer (PC) for SBC functional monitoring, power supply, SEU counter, and a PC­based tester - the Omnilab. The Omnilab monitored the DUT power supply for SEL via an IEEE 488 interface. A custom software operating system was developed to operate the DUTs.

Previous tests2 by NASA/JPL had been performed register by register: each register was loaded with known data, and its contents were monitored while irradiated the device. While this is a valid test method, providing useful data, it does not reflect normal operating conditions in most 80386 applications. Therefore, an active test was performed to simulate typical device operation: the microprocessor operated in protected mode, continuously performing a data write/read/check cycle.

The SEUs observed may be classified by the effects they had on the system: either data or operational errors (lockup). For the 80386, Data SEUs - incorrect data or addressing information - were detected in software. During the 80387 test, the DUT continuously performed a mathematical operation, and reported the result for a software check. Data SEUs, here, were defined as incorrect answers. The DMA function of the 82380 was tested by having the DUT perform DMA transfers continuously, while software monitored transfers for incorrect data. Data SEUs were defined as incorrect or incomplete data transfers. Additionally, all three devices experienced lockup SEUs, requiring a software-based reset or an external hardware reset signal to recover. Removal of device power (or a power reset) was not required to remove this condition. Lockup was most likely due to a hit to the control area, placing the device in an undefined state. Test runs were halted when lockup occurred. At higher LETs, immediate lockup prevented collecting of detailed SEU data. However, SEL tests were still performed. The power supply input current to the DUTs were set at levels just above maximum for the DUT during SEL testing. This is true for all device types tested.

2) 80486 Techniques

The 80486 DUT board is again custom-designed SBC, but in this case involving two microprocessors, a DUT and a reference device, operating synchronously or in lock­step. DUT and reference address, data and control lines are compared real-time by an on­board comparator. The test system also includes a power supply, SEU counter, and the Omnilab to monitor the power supply for SEL. Custom software provides the operating system and interface to the DUTs. Different software routines (system, paging, co­processor, external memory access, and software performance) exercised the 80486's many functions, including memory reads/writes, DMA operations, and interrupts. The "system" routine, reflecting a worst-case 80486 spaceflight application, was used for most test runs. 80486 tests were performed both with internal cache enabled and disabled.

A non-compare SEU was defined as mismatch between DUT and reference device address, data or control lines, upon which a reset signal was issued to the DUT to clear the condition. During a lockup SEU, both DUT and reference enter halt states, requiring a power reset to clear. This is theorized based on observed device behavior to be caused by the DUT entering an internal test mode.

3) All Test Devices

Two different types of latchup were encountered. Traditional or destructive SEL occurred when device current consumption (Icc) increased above the maximum specified for the device. During microlatchup, Icc may increase above the normal operating level, but not above the maximum specified for the device. Device operation halts, and a power reset is required to recover. A series of microlatch events in quick succession can mimic destructive SEL, so low flux rates are required to observe microlatch. This was noted in reference [1].

IV. TEST RESULTS

Several devices were tested with Vcc ± 5% ; no statistical difference was noted versus nominal Vcc. For 80486 testing, utilizing different software was only briefly explored: worst case system software was used for almost all test runs. It is expected that some variation (+/- 30%) from software to software would be seen, with more cache-intensive programs being more vulnerable to SEU when the cache is enabled.

Results are summarized in Table 4. Figure 1 illustrates the dataset described below for the 80386 devices.

Device SEU - Data/Non-compare SEU - Lockup SEL - Microlatchup SEL - Destructive
Heavy Ion Effects
MG80386DX-20/B LETth ~ 4.14 LETth ~ 4.14 LETth between 37.1 - 59.9 not detected
80386DX-25 not tested not tested LETth between 26.2 - 37.1 not detected
MG80387-20/B LETth 3.38 LETth between 12 and 26.2 not seen LETth between 37.1 - 59.9
MG82380-20/B LETth 4.14 LETth < 3.38 - LETth between 12.2 - 26.2
82380-16 not tested not tested not seen LETth < 12
80486DX-33 cache on: LETth < 3.53;
cache off: LETth between 3.83 - 8.27
not tested not seen LETth ~ 20
80486DX2-66 cache on or off: LETth between 4 - 7.79 LETth ~ 11.4 LETth~ 20 not detected
Proton Effects
- Cache on Cache off
80486DX-33 4E-10 cm2/device at 63 MeV 8E-11 cm2/device at 63 MeV
80486DX2-66 1.5E-10 cm2/device at 63 MeV 4E-11 cm2/device at 63 MeV
Table 4 Test Results

A) MG80386DX­20/B

Both data and lockup SEUs were first observed at an LET of 4.14. Above LETs of 11.4, devices were tested for SEL only, due to immediate device lockup during the test runs. Note that the lesson learned from this latter problem was to incorporate automatic device software resets into the test setup. We did this for the 80486 testing.

Destructive SEL was not detected during any test run. The LETth for microlatch, however, was noted to be between LETs of 37.1 and 59.9. A dwell test, where the DUT was placed into a microlatch condition and allowed to continue to draw current for a ten minute period, was performed to determine if the microlatch was destructive to the DUT. It was not; the DUT was fully operational after a reset. This, however, was not a statistically reliable test; detailed reliability analysis of localized (within the device) current consumption should be explored as well.

B) 80386DX­25

SEL: This device was tested for SEL only. Microlatch was the only condition detected, with a threshold between LET 26.2 and 37.1. Devices were tested at both 5V and 5.25V. Destructive SEL was not observed on any test run.

C) MG80387­20/B

Data from these devices is presented in Figure 2.

Data SEUs were detected starting at an LET of 3.38. A stuck bit, i.e. a register or data value that remains at a certain logic level (high or low) despite efforts to change the value, was detected twice during the test. This condition was removed both times by a software reset. Lockup was first observed at an LET of 26.2. Above an LET of 37.1, devices were tested for SEL only, due to immediate lockup during test runs.

The LETth for destructive SEL is between 37.1 and 59.9. No microlatch SEL was noted.

D) MG82380­20/B

Data from this device is presented in Figure 3. Data SEUs were first observed at an LET of 4.14. This device experienced lockup at all LET values tested, beginning at 3.38. At an LET of 11.4 and above, devices were tested for SEL only, due to immediate lockup during test runs.

The LETth for destructive SEL was noted to be between LET values of 12.2 and 26.2. The device also experienced a possible microlatch at LET values of greater than 26.2.

E) 82380­16

This device was tested for SEL only. Traditional latchup was observed at the lowest LET tested of 12. A dwell test was performed, allowing the DUT to operate for two minutes at a high current induced by SEL (850 mA, with specified device maximum of 300 mA). The 82380 recovered fully, following a power reset. This, however, was not a statistically reliable test; detailed reliability analysis should be explored as well.

During several tests, the 82380-16 operating current jumped above device rated limits. This condition was cleared completely by a reset pulse to the DUT; power reset was not required. Most likely the device entered an internal test mode. This may also be called a single event functional interrupt (SEFI).

In another test run, following SEL, the operating current decreased (by ~ 20 mA in 2 minutes) of its own accord. Device failure was not noted. No explanation is offered at this time.

F) 80486DX­33

Non-compare with cache enabled: SEUs were observed at the lowest LET tested of 3.53. The LETth appears to be around 3 based on curve fitting. This is illustrated in Figure 4.

Non-compare with cache disabled: SEUs were not detected at the lowest LET tested of 3.53. The LETth is between 3.83 and 8.27, and appears to be around 5-6. Figure 5 presents this data.

Lockup was not observed due to test setup limitation. The device was not retested.

Figure 5 also displays the SEL test results. This device entered traditional or destructive single event latchup starting at an LET of 20. Both test samples of this device failed after occurrence of SEL. Inspection under a microscope shows holes in the silicon formed by the high current destructive condition. Icc was removed after the occurrence of SEL within a 1 second time window.

Proton SEE testing was performed as well at a proton energy of 63 MeV. With a nominal Vcc of 5V and the internal device cache disabled, no SEUs were observed. When Vcc was reduced to 4.75V, a few sporadic errors were detected. With the internal cache enabled, the device was approximately an order of magnitude more sensitive to proton-induced SEUs. Device cross section was 4E-10cm2 with cache enabled and <8E-11cm2 with it disabled.

Proton SEE testing also may be used for total dose testing as well. Three device samples were tested thusly at the UCD facility. Two samples failed parametrically, but not functionally at total dose levels of 12-15 kRad(Si), while one sample failed functionally as well.

G) 80486DX2­66

Devices from three separate lots were tested, with varying SEE characteristics. Figure 6 represents the overall SEU data for two lots (Lots 1 and 2) that were tested. The third lot was tested more recently and will be talked about for general characteristics only. SEU data for lot 3 is consistent with those of lots 1 and 2.

From Figure 6, non-compare with cache enabled SEUs were not detected at the lowest tested LET of 4. The LETth , thus, is between LET values of 4 and 7.79 and would appear to be roughly 5-6. Non-compare with cache disabled SEUs were not observed at the lowest tested LET (4). Hence, the LETth is between 4 and 7.79 and appears approximately 5-6. Figure 7 compares the data results between having the internal cache enabled and disabled.

Lockup was observed starting at an LET of 11.4. Device cross-section at an LET of 37.2 was roughly 7E-6 cm2.

Two of the three lots (Lots 1 and 2) of the 80486DX2-66s experienced only microlatchup starting at an LET of 20. The most recent test did not observed microlatchup until an LET of 37.2. No destructive SEL was observed up to a maximum tested LET of 90. Cross section at an LET of 80 was < 1E-4 cm2. No device failures were seen following any SEL event. Figure 8 presents the SEL results for both the 80486DX-33 and lots 1 and 2 of the 80486DX2-66.

Proton SEE testing was also performed using the UCD facility. With a Vcc of 5V and the internal cache disabled, a few sporadic errors were observed (but not on every test run)at proton energies of 63 and 38.2 MeV, respectively. With the device cache enabled, the device was approximately an order of magnitude more sensitive to proton-induced SEUs. No SEUs were detected at an energy of 26.6 MeV.

Little variance was noted due to dropping supply voltage to 4.75V. Figure 9 illustrates the results for this device.

During proton SEE irradiation, test samples failed parametrically at total dose levels of 35-80 kRad(Si). None of the samples failed functionally. Recent total dose testing at NASA/GSFC has been performed on two of the candidate spaceflight lots using a Co-60 source. On lot 2, the data was consistent with the proton total dose results (parametric failure around 30 kRad(Si)). Lot 3 Co-60 testing has just been performed. Failure appears to be around 20-25 kRad(Si). The first failure this time was functional and not parametric.

V. IMPLICATIONS

Implications may be viewed from two sides: those that impact the spacecraft designer, and those that impact the SEE tester or IC designer.

From the spacecraft perspective, usability of the DUT is realistically all that is required. Are they able to utilize this device? Are there any concerns or stipulations? For all these devices, there are several. SEE testers and others also have several lessons that may be learned from this set of test data.

Spacecraft designers may be able to utilize these devices, but all would require care in their designs. All devices that were irradiated experienced some type of SEFI or device lockup. Occurrence of this condition could lead to a system problem during spaceflight. Therefore, a reliable detection/reset scheme is necessary in any spaceflight application. Items such as watchdog timers, parity checks, register copies, etc... may aid the designer in providing a dependable system.

Additionally, these devices have the potential for other types of SEU (data, address, or control errors) as well. Because these microprocessors and peripherals perform activities which coordinate system operation - such as interrupts, timers, memory transfers, etc. - any type of SEU may have wide-ranging system effects. Safeguards, again, are necessary wherever practical.

As one might expect on the 80486 devices, when the internal cache is enabled device cross section at a specific LET increased. Common sense agrees with this: more cells are now active in the device. For the DX-33 device, LETth also was affected: the device LETth decreased as well.

LaBel, et al... [1] have demonstrated that microlatchup may be mitigated by means of watchdog timers and power resets. For the 80486DX2-66 and the 80386DXs, this might prove useful. For the 80387, 82380, and 80486DX-33, all of which demonstrated destructive SEL, current limiting at the device level would be required as a minimum.

Devices from three different 80486DX2-66 lots were tested, with varying SEE characteristics. In particular, microlatchup LETth varied between LETs of 20 and 37.2. Slight variation in the manufacturing process may lead to significantly different single event effect sensitivity, especially without the strict process control of military-process parts. Because of this type of variability in commercial devices, lot screening is recommended strongly.

It also should be pointed out that devices on the same INTEL CHMOS IV process demonstrated different SEL characteristics; the 80386s noted only microlatchup, while the 80387 and 80486DX-33 saw destructive SEL. The implication here is straightforward; the SEL path within a device is design and process dependent. Simply relying on SEE test data from a different device on the same process does not guarantee the same SEE characteristics.

A last note is based on the limited total dose test dated presented on the 80486DX2-66. The variance between lots for failure mechanisms (parametric versus functional) is of future interest and shall be explored accordingly.

VI. CONCLUSION

With the increased use of commercial technology in spaceflight, designers must be concerned with the impact of radiation on the devices. We have presented SEE test data on select microprocessors and their associated peripheral devices. This data may aid in the selection of proper error mitigative techniques, and in predicting the impact that the use of commercial technology may have on future mission success.

VII. REFERENCES

1. LaBel, K.A., Stassinopoulos, E.G., Brucker, G.J., Staufffer, C.A., "SEU Tests of a 80386 Based Flight-Computer/Data-Handling System and of Discrete PROM and EEPROM Devices, and SEL Tests of Discrete 80386, 80387, PROM, EEPROM, and ASICs," IEEE Radiation Data Effects Workshop, 1992.

2. Watson, R.K., Schwartz, H.R., Nichols, D.K., "Test Report for Single Event Effects of the 80386DX Microprocessor" NASA/JPL Publication 93-12, February 15, 1993.

3. INTEL Corporation datasheet, 80386DX, September 1993.

4. INTEL Corporation datasheet, 80387, September 1993.

5. INTEL Corporation datasheet, 82380, September 1993.

6. INTEL Corporation datasheet, 80486, February 1995.


Home
Last Revised: February 03, 2010
Digital Engineering Institute
Web Grunt: Richard Katz