[Script Info]
Title: 
[Events]
Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text
Dialogue: 0,0:00:00.00,0:00:18.41,Default,,0000,0000,0000,,{\i1}36C3 Intro musik{\i0}
Dialogue: 0,0:00:18.41,0:00:22.64,Default,,0000,0000,0000,,Herald: The next talk will be titled 'How\Nto Design Highly Reliable Digital
Dialogue: 0,0:00:22.64,0:00:26.47,Default,,0000,0000,0000,,Electronics', and it will be delivered to\Nyou by Szymon and Stefan. Warm Applause
Dialogue: 0,0:00:26.47,0:00:30.20,Default,,0000,0000,0000,,for them.
Dialogue: 0,0:00:30.20,0:00:36.36,Default,,0000,0000,0000,,{\i1}applause{\i0}
Dialogue: 0,0:00:36.36,0:00:41.36,Default,,0000,0000,0000,,Stefan: All right. Good morning, Congress.\NSo perhaps every one of you in the room
Dialogue: 0,0:00:41.36,0:00:45.60,Default,,0000,0000,0000,,here has at one point or another in their\Nlives witnessed their computer behaving
Dialogue: 0,0:00:45.60,0:00:50.32,Default,,0000,0000,0000,,weirdly and doing things that it was not\Nsupposed to do or what you didn't
Dialogue: 0,0:00:50.32,0:00:54.40,Default,,0000,0000,0000,,anticipate it to do. And well, typically\Nthat would have probably been the result
Dialogue: 0,0:00:54.40,0:01:00.00,Default,,0000,0000,0000,,of a software bug of some sort somewhere\Ninside the huge software stack your PC is
Dialogue: 0,0:01:00.00,0:01:04.72,Default,,0000,0000,0000,,running on. Have you ever considered what\Nthe probability of this weird behavior
Dialogue: 0,0:01:04.72,0:01:09.12,Default,,0000,0000,0000,,being caused by a bit flipped somewhere in\Nyour memory of your computer might have
Dialogue: 0,0:01:09.12,0:01:16.24,Default,,0000,0000,0000,,been? So what you can see in this video on\Nthe screen now is a physics experiment
Dialogue: 0,0:01:16.24,0:01:20.72,Default,,0000,0000,0000,,called a cloud chamber. It's a very simple\Nexperiment that is actually able to
Dialogue: 0,0:01:20.72,0:01:26.56,Default,,0000,0000,0000,,visualize and make apparent all the\Nconstant stream of background radiation we
Dialogue: 0,0:01:26.56,0:01:32.64,Default,,0000,0000,0000,,all are constantly exposed to. So what's\Nhappening here is that highly energetic
Dialogue: 0,0:01:32.64,0:01:39.04,Default,,0000,0000,0000,,particles, for example, from space they\Ntrace through gaseous alcohol and they
Dialogue: 0,0:01:39.04,0:01:42.16,Default,,0000,0000,0000,,collide with alcohol molecules and they\Nform in this process a trail of
Dialogue: 0,0:01:42.16,0:01:48.24,Default,,0000,0000,0000,,condensation while they do that. And if\Nyou think about your computer, a typical
Dialogue: 0,0:01:48.24,0:01:53.20,Default,,0000,0000,0000,,cell of RAM, of which you might have, I\Ndon't know, 4, 8, 10 gigabytes in your
Dialogue: 0,0:01:53.20,0:01:58.40,Default,,0000,0000,0000,,machine is as big as only 80 nanometers\Nwide. So it's very, very tiny. And you
Dialogue: 0,0:01:58.40,0:02:02.56,Default,,0000,0000,0000,,probably are able to appreciate the small\Namount of energy that is needed or that is
Dialogue: 0,0:02:02.56,0:02:08.48,Default,,0000,0000,0000,,used to store the information inside each\Nof those bits. And the sheer amount of of
Dialogue: 0,0:02:08.48,0:02:12.56,Default,,0000,0000,0000,,those bits you have in your RAM and your\Ncomputer. So a couple of years ago, there
Dialogue: 0,0:02:12.56,0:02:17.60,Default,,0000,0000,0000,,was a study that concluded that in a\Ncomputer with about four gigabytes of RAM,
Dialogue: 0,0:02:17.60,0:02:23.60,Default,,0000,0000,0000,,a bit flip, um, caused by such an event by\Ncosmic background radiation can occur
Dialogue: 0,0:02:23.60,0:02:29.20,Default,,0000,0000,0000,,about once every 33 hours. So a\Nbit less than than one per day. In an
Dialogue: 0,0:02:29.20,0:02:34.96,Default,,0000,0000,0000,,incident in 2008, a Quantas Airlines\Nflight actually nearly crashed, and the
Dialogue: 0,0:02:34.96,0:02:40.08,Default,,0000,0000,0000,,reason for this crash was traced back to\Nbe very likely caused by a bit flipped
Dialogue: 0,0:02:40.08,0:02:44.40,Default,,0000,0000,0000,,somewhere in one of the CPUs of the\Navionics system and nearly caused the
Dialogue: 0,0:02:44.40,0:02:50.48,Default,,0000,0000,0000,,death of a lot of passengers on this\Nplane. In 2003, in Belgium, a small
Dialogue: 0,0:02:50.48,0:02:56.88,Default,,0000,0000,0000,,municipal vote actually had a weird hiccup\Nin which one of the candidates in this
Dialogue: 0,0:02:56.88,0:03:02.15,Default,,0000,0000,0000,,election actually got 4096 more votes added in a single instance.
Dialogue: 0,0:03:02.15,0:03:06.48,Default,,0000,0000,0000,,And that was traced back to be very likely\Ncaused by cosmic background radiation,
Dialogue: 0,0:03:06.48,0:03:10.00,Default,,0000,0000,0000,,flipping a memory cell somewhere that\Nstored the vote count. And it was only
Dialogue: 0,0:03:10.00,0:03:14.56,Default,,0000,0000,0000,,discovered that this happened because this\Nnumber of votes for this particular
Dialogue: 0,0:03:14.56,0:03:18.88,Default,,0000,0000,0000,,candidate was considered unreasonable, but\Notherwise would have gotten away probably
Dialogue: 0,0:03:18.88,0:03:27.36,Default,,0000,0000,0000,,without being detected. So a few words\Nabout us: Szymon and I, we both work at
Dialogue: 0,0:03:27.36,0:03:32.48,Default,,0000,0000,0000,,CERN in the microelectronics section and\Nwe both develop electronics that need to
Dialogue: 0,0:03:32.48,0:03:37.36,Default,,0000,0000,0000,,be tolerant to these sorts of effects. So\Nwe develop radiation tolerant electronics
Dialogue: 0,0:03:37.36,0:03:42.85,Default,,0000,0000,0000,,for the experiments at CERN, at the LHC.\NAmong a lot of other applications, you can
Dialogue: 0,0:03:42.85,0:03:48.33,Default,,0000,0000,0000,,meet the two of us at the Lötlabor Jena\Nassembly if you are interested in what we
Dialogue: 0,0:03:48.33,0:03:55.85,Default,,0000,0000,0000,,are talking about today. And we will also\Ngive a small talk or a small workshop
Dialogue: 0,0:03:55.85,0:03:59.19,Default,,0000,0000,0000,,about radiation detection tomorrow, in one\Nof the seminar rooms. So feel free to pass
Dialogue: 0,0:03:59.19,0:04:02.54,Default,,0000,0000,0000,,by there, it will be a quick introduction.\NTo give you a small idea of what kind of
Dialogue: 0,0:04:02.54,0:04:08.54,Default,,0000,0000,0000,,environment we are working for: So if you\Nwould use one of your default intel i7
Dialogue: 0,0:04:08.54,0:04:14.29,Default,,0000,0000,0000,,CPUs from your notebook and would put it\Nanywhere where we operate our electronics,
Dialogue: 0,0:04:14.29,0:04:19.63,Default,,0000,0000,0000,,it would very shortly die in a matter of\Nprobably one or two minutes and it would
Dialogue: 0,0:04:19.63,0:04:24.63,Default,,0000,0000,0000,,die for more than just one reason, which\Nis rather interesting and compelling. So
Dialogue: 0,0:04:24.63,0:04:30.98,Default,,0000,0000,0000,,the idea for today's talk is to give you\Nall an insight into all the things that
Dialogue: 0,0:04:30.98,0:04:34.58,Default,,0000,0000,0000,,need to be taken into account when you\Ndesign electronics for radiation
Dialogue: 0,0:04:34.58,0:04:39.15,Default,,0000,0000,0000,,environments. What kinds of different\Nchallenges come when you try to do that.
Dialogue: 0,0:04:39.15,0:04:43.12,Default,,0000,0000,0000,,We classify and explain the different\Ntypes of radiation effects that exist. And
Dialogue: 0,0:04:43.12,0:04:47.62,Default,,0000,0000,0000,,then we also present what you can do to\Nmitigate these effects and also validate
Dialogue: 0,0:04:47.62,0:04:52.12,Default,,0000,0000,0000,,that what you did to care for them or\Nprotect your circuits actually worked. And
Dialogue: 0,0:04:52.12,0:04:57.48,Default,,0000,0000,0000,,of course, as we do that, we'll try to\Ngive our view on how we develop radiation
Dialogue: 0,0:04:57.48,0:05:03.26,Default,,0000,0000,0000,,tolerant electronics at CERN and how our\Nworkflow looks like to make sure this
Dialogue: 0,0:05:03.26,0:05:08.27,Default,,0000,0000,0000,,works. So let's first maybe take a step\Nback and have a look at what we mean when
Dialogue: 0,0:05:08.27,0:05:12.100,Default,,0000,0000,0000,,we say radiation environments. The first\None that you probably have in mind right
Dialogue: 0,0:05:12.100,0:05:19.04,Default,,0000,0000,0000,,now when you think about radiation is\Nspace. So, this interstellar space is
Dialogue: 0,0:05:19.04,0:05:24.29,Default,,0000,0000,0000,,basically filled with, very high speed,\Nhighly energetic electrons and protons and
Dialogue: 0,0:05:24.29,0:05:28.72,Default,,0000,0000,0000,,all sorts of high energy particles. And\Nwhile they, for example, traverse close to
Dialogue: 0,0:05:28.72,0:05:34.51,Default,,0000,0000,0000,,planets as our Earth - these planets\Nsometimes do have a magnetic field and the
Dialogue: 0,0:05:34.51,0:05:39.32,Default,,0000,0000,0000,,highly energetic particles are actually\Ndeflected by these magnetic fields and
Dialogue: 0,0:05:39.32,0:05:43.82,Default,,0000,0000,0000,,they can protect the planets as our\Nplanet, for example, from this highly
Dialogue: 0,0:05:43.82,0:05:47.99,Default,,0000,0000,0000,,energetic radiation. But in the process,\Nthere around these planets sometimes they
Dialogue: 0,0:05:47.99,0:05:52.11,Default,,0000,0000,0000,,form these radiation belts - known as the\NVan Allen belts after the guy who
Dialogue: 0,0:05:52.11,0:05:56.04,Default,,0000,0000,0000,,discovered this effect a long time ago.\NAnd a satellite in space as it orbits
Dialogue: 0,0:05:56.04,0:06:01.62,Default,,0000,0000,0000,,around the Earth might, depending on what\Norbit is chosen, sometimes go through
Dialogue: 0,0:06:01.62,0:06:05.65,Default,,0000,0000,0000,,these belts of highly intense radiation.\NThat, of course, then needs to be taken
Dialogue: 0,0:06:05.65,0:06:11.55,Default,,0000,0000,0000,,into account when designing electronics\Nfor such a satellite. And if Earth itself
Dialogue: 0,0:06:11.55,0:06:17.19,Default,,0000,0000,0000,,is not able to give you enough radiation,\Nyou may think of the very famous Juno
Dialogue: 0,0:06:17.19,0:06:22.87,Default,,0000,0000,0000,,Jupiter mission that has become famous\Nabout a year ago. They actually in the
Dialogue: 0,0:06:22.87,0:06:28.29,Default,,0000,0000,0000,,environment of Jupiter they anticipated so\Nmuch radiation that they actually decided
Dialogue: 0,0:06:28.29,0:06:33.41,Default,,0000,0000,0000,,to put all the electronics of the\Nsatellite inside a one centimeter thick
Dialogue: 0,0:06:33.41,0:06:39.83,Default,,0000,0000,0000,,cube of titanium, which is famously known\Nas the Juno Radiation Vault. But not only
Dialogue: 0,0:06:39.83,0:06:43.87,Default,,0000,0000,0000,,space offers radiation environments.\NAnother form of radiation you probably all
Dialogue: 0,0:06:43.87,0:06:48.29,Default,,0000,0000,0000,,recognize this when I show you this\Npicture, which is an X-ray image of a
Dialogue: 0,0:06:48.29,0:06:54.94,Default,,0000,0000,0000,,hand. And X-ray is also considered a form\Nof radiation. And while, of course, the
Dialogue: 0,0:06:54.94,0:07:01.32,Default,,0000,0000,0000,,doses or amounts of radiation any patient\Nis exposed to while doing diagnosis or
Dialogue: 0,0:07:01.32,0:07:05.80,Default,,0000,0000,0000,,treatment of some disease, that might not\Nbe the full story when it comes to medical
Dialogue: 0,0:07:05.80,0:07:10.22,Default,,0000,0000,0000,,applications. So this is a medical\Nparticle accelerator which is used for
Dialogue: 0,0:07:10.22,0:07:15.29,Default,,0000,0000,0000,,cancer treatment. And in these sorts of\Naccelerators, typically carbon ions or
Dialogue: 0,0:07:15.29,0:07:20.39,Default,,0000,0000,0000,,protons are accelerated and then focused\Nand used to treat and selectively destroy
Dialogue: 0,0:07:20.39,0:07:25.30,Default,,0000,0000,0000,,cancer cells in the body. And this comes\Nalready relatively close to the
Dialogue: 0,0:07:25.30,0:07:29.70,Default,,0000,0000,0000,,environment we are working in and working\Nfor. So Szymon and I are working, for
Dialogue: 0,0:07:29.70,0:07:36.62,Default,,0000,0000,0000,,example, on electronics, for the CMS\Ndetector inside the LHC or which we build
Dialogue: 0,0:07:36.62,0:07:43.91,Default,,0000,0000,0000,,dedicated, radiation tolerant, integrated\Ncircuits which have to withstand very,
Dialogue: 0,0:07:43.91,0:07:49.37,Default,,0000,0000,0000,,very large amounts and doses of short\Nlived radiation in order to function
Dialogue: 0,0:07:49.37,0:07:54.41,Default,,0000,0000,0000,,correctly. And if we didn't specifically\Ndesign electronics for that, basically the
Dialogue: 0,0:07:54.41,0:08:01.89,Default,,0000,0000,0000,,whole system would never be able to work.\NTo illustrate a bit how you can imagine
Dialogue: 0,0:08:01.89,0:08:06.06,Default,,0000,0000,0000,,the scale of this environment: This is a\Nsingle plot of a collision event that was
Dialogue: 0,0:08:06.06,0:08:11.16,Default,,0000,0000,0000,,recorded in the ATLAS experiment. And each\Nof those tiny little traces you can make
Dialogue: 0,0:08:11.16,0:08:15.100,Default,,0000,0000,0000,,out in this diagram is actually either one\Nor multiple secondary particles that were
Dialogue: 0,0:08:15.100,0:08:22.17,Default,,0000,0000,0000,,created in the initial collision of two\Nproton bunches inside the experiment. And
Dialogue: 0,0:08:22.17,0:08:27.50,Default,,0000,0000,0000,,in each of those, of course, races around\Nthe detector electronics, which make these
Dialogue: 0,0:08:27.50,0:08:32.82,Default,,0000,0000,0000,,traces visible. Itself, then decaying into\Nmultiple other secondary particles which
Dialogue: 0,0:08:32.82,0:08:37.86,Default,,0000,0000,0000,,all go through our electronics. And if\Nthat doesn't sound, let's say, bad enough
Dialogue: 0,0:08:37.86,0:08:42.58,Default,,0000,0000,0000,,for digital electronics, these collisions\Nhappen about 40 million times a second. Of
Dialogue: 0,0:08:42.58,0:08:47.61,Default,,0000,0000,0000,,course, multiplying the number of events\Nor problems they can cause in our
Dialogue: 0,0:08:47.61,0:08:54.61,Default,,0000,0000,0000,,circuits. So we now want to introduce all\Nthe things that can happen, the different
Dialogue: 0,0:08:54.61,0:08:59.57,Default,,0000,0000,0000,,radiation effects. But first, probably we\Ntake a step back and look at what we mean
Dialogue: 0,0:08:59.57,0:09:05.80,Default,,0000,0000,0000,,when we say digital electronics or digital\Nlogic, which we want to focus on today. So
Dialogue: 0,0:09:05.80,0:09:11.06,Default,,0000,0000,0000,,from your university lectures or your\Nreading, you probably know the first class
Dialogue: 0,0:09:11.06,0:09:14.58,Default,,0000,0000,0000,,of digital logic, which is the\Ncombinatorial logic. So this is typically
Dialogue: 0,0:09:14.58,0:09:19.22,Default,,0000,0000,0000,,logic that just does a simple linear\Nrelation of the inputs of a circuit and
Dialogue: 0,0:09:19.22,0:09:23.96,Default,,0000,0000,0000,,produces an output as exemplified with\Nthese AND and OR, NAND, XOR gates that you
Dialogue: 0,0:09:23.96,0:09:28.83,Default,,0000,0000,0000,,see here. But if you want to build - I\Nmean even though we use those everywhere
Dialogue: 0,0:09:28.83,0:09:32.78,Default,,0000,0000,0000,,in our circuits - you probably also want\Nto store state in a more complex circuit,
Dialogue: 0,0:09:32.78,0:09:37.86,Default,,0000,0000,0000,,for example, in the registers of your CPU\Nthey store some sort of internal
Dialogue: 0,0:09:37.86,0:09:41.74,Default,,0000,0000,0000,,information. And for that we use the other\Nclass of logic, which is called the
Dialogue: 0,0:09:41.74,0:09:44.73,Default,,0000,0000,0000,,sequential logic. So this is typically\Nclocked with some system clock frequency
Dialogue: 0,0:09:44.73,0:09:50.88,Default,,0000,0000,0000,,and it changes its output with relation to\Nthe inputs whenever this clock signal changes.
Dialogue: 0,0:09:50.88,0:09:54.26,Default,,0000,0000,0000,,And now if we look at how all\Nthese different logic functionalities are
Dialogue: 0,0:09:54.26,0:09:58.29,Default,,0000,0000,0000,,implemented. So typically nowadays for\Nthat you may know that we use CMOS
Dialogue: 0,0:09:58.29,0:10:02.34,Default,,0000,0000,0000,,technologies and basically represent all\Nthis logic functionality as digital gates
Dialogue: 0,0:10:02.34,0:10:10.56,Default,,0000,0000,0000,,using small P-MOS and N-MOS MOSFET\Ntransistors in CMOS technologies. And if
Dialogue: 0,0:10:10.56,0:10:16.41,Default,,0000,0000,0000,,we kind of try to build a model for more\Ncomplex digital circuits, we typically use
Dialogue: 0,0:10:16.41,0:10:21.81,Default,,0000,0000,0000,,something we call the finite state machine\Nmodel, in which we use a model that
Dialogue: 0,0:10:21.81,0:10:25.82,Default,,0000,0000,0000,,consists of a combinatorial and a\Nsequential part. And you can see that the
Dialogue: 0,0:10:25.82,0:10:31.03,Default,,0000,0000,0000,,output of the circuit depends both on the\Ninternal state inside the register as well
Dialogue: 0,0:10:31.03,0:10:35.33,Default,,0000,0000,0000,,as also the input to the combinatorial\Nlogic. And accordingly, also the state
Dialogue: 0,0:10:35.33,0:10:40.92,Default,,0000,0000,0000,,that is internal is always changed by the\Ninputs as well as the current state. So
Dialogue: 0,0:10:40.92,0:10:44.60,Default,,0000,0000,0000,,this is kind of the simple model for more\Ncomplex systems that can be used to model
Dialogue: 0,0:10:44.60,0:10:50.21,Default,,0000,0000,0000,,different effects. Um, now let's try to\Nactually look at what the radiation can do
Dialogue: 0,0:10:50.21,0:10:53.95,Default,,0000,0000,0000,,to transistors. And for that we are going\Nto have a quick recap at what the
Dialogue: 0,0:10:53.95,0:10:57.90,Default,,0000,0000,0000,,transistor actually is and how it looks\Nlike. As you may perhaps know is that in
Dialogue: 0,0:10:57.90,0:11:03.74,Default,,0000,0000,0000,,CMOS technologies, transistors are built\Non wafers of high purity silicon. So this
Dialogue: 0,0:11:03.74,0:11:09.07,Default,,0000,0000,0000,,is a crystalline, very regularly organized\Nlattice of silicon atoms. And what we do
Dialogue: 0,0:11:09.07,0:11:14.09,Default,,0000,0000,0000,,to form a transistor on such a wafer is\Nthat we add dopants. So in order to form
Dialogue: 0,0:11:14.09,0:11:19.63,Default,,0000,0000,0000,,diffusion regions, which later will become\Nthe source and drain of our transistors.
Dialogue: 0,0:11:19.63,0:11:24.47,Default,,0000,0000,0000,,And then on top of that we grow a layer of\Ninsulating oxide. And on top of that we
Dialogue: 0,0:11:24.47,0:11:28.71,Default,,0000,0000,0000,,put polysilicon, which forms the gate\Nterminal of the transistor. And in the end
Dialogue: 0,0:11:28.71,0:11:32.81,Default,,0000,0000,0000,,we end up with an equivalent circuit a bit\Nlike that. And now to put things back into
Dialogue: 0,0:11:32.81,0:11:37.67,Default,,0000,0000,0000,,perspective - you may also note that the\Ndimension of these structures are very
Dialogue: 0,0:11:37.67,0:11:42.54,Default,,0000,0000,0000,,tiny. So we talk about tens of nanometers\Nfor some of the dimensions I've outlined
Dialogue: 0,0:11:42.54,0:11:47.96,Default,,0000,0000,0000,,here. And as the technologies shrink,\Nthese become smaller and smaller and
Dialogue: 0,0:11:47.96,0:11:52.28,Default,,0000,0000,0000,,therefore you'll probably also realize or\Nare able to appreciate the small amount of
Dialogue: 0,0:11:52.28,0:11:56.56,Default,,0000,0000,0000,,energy that are used to store information\Ninside these digital circuits, which makes
Dialogue: 0,0:11:56.56,0:12:02.39,Default,,0000,0000,0000,,them perhaps more sensitive to radiation.\NSo let's take a look. What different types
Dialogue: 0,0:12:02.39,0:12:08.38,Default,,0000,0000,0000,,of radiation effects exist? We typically\Nin this case, differentiate them into two
Dialogue: 0,0:12:08.38,0:12:13.27,Default,,0000,0000,0000,,main classes of events. The first one\Nwould be the cumulative effects, which are
Dialogue: 0,0:12:13.27,0:12:17.36,Default,,0000,0000,0000,,effects that, as the name implies,\Naccumulate over time. So as the circuit is
Dialogue: 0,0:12:17.36,0:12:22.13,Default,,0000,0000,0000,,placed inside some radiation environment,\Nover time it accumulates more and more
Dialogue: 0,0:12:22.13,0:12:26.97,Default,,0000,0000,0000,,dose and therefore worsens its performance\Nor changes how it operates. And on the
Dialogue: 0,0:12:26.97,0:12:30.55,Default,,0000,0000,0000,,other side, we have the Single Event\NEffects, which are always events that
Dialogue: 0,0:12:30.55,0:12:35.08,Default,,0000,0000,0000,,happen at some instantaneous point in\Ntime, and then suddenly, without being
Dialogue: 0,0:12:35.08,0:12:39.32,Default,,0000,0000,0000,,predictable, change how the circuit\Noperates or how it functions or if it
Dialogue: 0,0:12:39.32,0:12:43.93,Default,,0000,0000,0000,,works in the first place or not. So I'm\Ngoing to first go into the class of
Dialogue: 0,0:12:43.93,0:12:47.68,Default,,0000,0000,0000,,cumulative effects and then later on,\NSzymon will go into the other class of the
Dialogue: 0,0:12:47.68,0:12:53.17,Default,,0000,0000,0000,,Single Event Effects. So in terms of these\Naccumulating effects, we basically have
Dialogue: 0,0:12:53.17,0:12:57.58,Default,,0000,0000,0000,,two main subclasses: The first one being\Nionization or TID effects, for Total
Dialogue: 0,0:12:57.58,0:13:02.03,Default,,0000,0000,0000,,Ionizing Dose - and the second one being\Ndisplacement damages. So displacement
Dialogue: 0,0:13:02.03,0:13:07.14,Default,,0000,0000,0000,,damages do exactly what they sound like.\NIt is all the effects that happen when an
Dialogue: 0,0:13:07.14,0:13:11.25,Default,,0000,0000,0000,,atom in the silicon lattice is actually\Ndisplaced, so removed from its lattice
Dialogue: 0,0:13:11.25,0:13:15.27,Default,,0000,0000,0000,,position and actually changes the\Nstructure of the semiconductor. But
Dialogue: 0,0:13:15.27,0:13:19.55,Default,,0000,0000,0000,,luckily, these effects don't have a big\Nimpact in the CMOS digital circuits that
Dialogue: 0,0:13:19.55,0:13:23.16,Default,,0000,0000,0000,,we are looking at today. So we will\Ndisregard them for the moment and we'll be
Dialogue: 0,0:13:23.16,0:13:28.12,Default,,0000,0000,0000,,looking more at the ionization damage, or\NTID. So ionization - as a quick recap - is
Dialogue: 0,0:13:28.12,0:13:35.90,Default,,0000,0000,0000,,whenever electrons are removed or added to\Nan atom, effectively transforming it into
Dialogue: 0,0:13:35.90,0:13:42.75,Default,,0000,0000,0000,,an ion. And these effects are especially\Ncritical for the circuits we are building
Dialogue: 0,0:13:42.75,0:13:46.32,Default,,0000,0000,0000,,because of what they do is that they\Nchange the behavior of the transistors.
Dialogue: 0,0:13:46.32,0:13:50.23,Default,,0000,0000,0000,,And without looking too much into the\Nsemiconductor details, I just want to show
Dialogue: 0,0:13:50.23,0:13:55.73,Default,,0000,0000,0000,,their typical effect that we are concerned\Nabout in this very simple circuit here. So
Dialogue: 0,0:13:55.73,0:14:00.35,Default,,0000,0000,0000,,this is just an inverter circuit\Nconsisting of two transistors here and
Dialogue: 0,0:14:00.35,0:14:05.81,Default,,0000,0000,0000,,there. And what the circuit does in normal\Noperation is it just takes an input signal
Dialogue: 0,0:14:05.81,0:14:10.06,Default,,0000,0000,0000,,and inverts and basically gives the\Ninverted signal at the output. And as the
Dialogue: 0,0:14:10.06,0:14:15.55,Default,,0000,0000,0000,,transistors are irradiated and accumulate\Ndose, you can see that the edges of the
Dialogue: 0,0:14:15.55,0:14:20.39,Default,,0000,0000,0000,,output signal get slower. So the\Ntransistor takes longer to turn on and off.
Dialogue: 0,0:14:20.39,0:14:24.57,Default,,0000,0000,0000,,And what that does in turn is that it\Nlimits the maximum operation frequency of
Dialogue: 0,0:14:24.57,0:14:28.80,Default,,0000,0000,0000,,your circuit. And of course, that is not\Nsomething you want to do. You want your
Dialogue: 0,0:14:28.80,0:14:31.72,Default,,0000,0000,0000,,circuit to operate at some frequency in\Nyour final system. And if the maximum
Dialogue: 0,0:14:31.72,0:14:35.60,Default,,0000,0000,0000,,frequency it can work at degrades over\Ntime, at some point it will fail as the
Dialogue: 0,0:14:35.60,0:14:39.28,Default,,0000,0000,0000,,maximum frequency is just too low. So\Nlet's have a look at what we can do to
Dialogue: 0,0:14:39.28,0:14:44.40,Default,,0000,0000,0000,,mitigate these effects. The first one and\NI already mentioned it when talking about
Dialogue: 0,0:14:44.40,0:14:48.49,Default,,0000,0000,0000,,the Juno mission, is shielding. So if you\Ncan actually put a box around your
Dialogue: 0,0:14:48.49,0:14:52.59,Default,,0000,0000,0000,,electronics and shield any radiation from\Nactually hitting your transistors, it is
Dialogue: 0,0:14:52.59,0:14:56.90,Default,,0000,0000,0000,,obvious that they will last longer and\Nwill suffer less from the radiation damage
Dialogue: 0,0:14:56.90,0:15:01.24,Default,,0000,0000,0000,,that it would otherwise do. So this\Napproach is very often used in space
Dialogue: 0,0:15:01.24,0:15:04.99,Default,,0000,0000,0000,,applications like on satellites, but it's\Nnot very useful if you are actually trying
Dialogue: 0,0:15:04.99,0:15:08.21,Default,,0000,0000,0000,,to measure the radiation with your\Ncircuits as we do, for example, in the
Dialogue: 0,0:15:08.21,0:15:12.42,Default,,0000,0000,0000,,particle accelerators we build integrated\Ncircuits for. So there first of all, we
Dialogue: 0,0:15:12.42,0:15:16.34,Default,,0000,0000,0000,,want to measure the radiation so we cannot\Nshield our detectors from the radiation.
Dialogue: 0,0:15:16.34,0:15:20.59,Default,,0000,0000,0000,,And also, we don't want to influence the\Ntracks of these secondary collision
Dialogue: 0,0:15:20.59,0:15:24.16,Default,,0000,0000,0000,,products with any shielding material that\Nwould be in the way. So this is not very
Dialogue: 0,0:15:24.16,0:15:28.32,Default,,0000,0000,0000,,useful in a particle accelerator\Nenvironment, let's say. So we have to
Dialogue: 0,0:15:28.32,0:15:33.88,Default,,0000,0000,0000,,resort to different methods. So as I said,\Nwe do have to design our own integrated
Dialogue: 0,0:15:33.88,0:15:38.83,Default,,0000,0000,0000,,circuits in the first place. So we have\Nsome freedom in what we call transistor
Dialogue: 0,0:15:38.83,0:15:45.24,Default,,0000,0000,0000,,level design. So we can actually alter the\Ndimensions of the transistors. We can make
Dialogue: 0,0:15:45.24,0:15:50.06,Default,,0000,0000,0000,,them larger to withstand larger doses of\Nradiation and we can use special
Dialogue: 0,0:15:50.06,0:15:54.35,Default,,0000,0000,0000,,techniques in terms of layout that we can\Nexperimentally verifiy to be more
Dialogue: 0,0:15:54.35,0:15:59.27,Default,,0000,0000,0000,,resistant to radiation effects. And as a\Nthird measure, which is probably the most
Dialogue: 0,0:15:59.27,0:16:03.49,Default,,0000,0000,0000,,important one for us, is what we call\Nmodeling. So we actually are able to
Dialogue: 0,0:16:03.49,0:16:08.36,Default,,0000,0000,0000,,characterize all the effects that\Nradiation will have on a transistor. And
Dialogue: 0,0:16:08.36,0:16:12.44,Default,,0000,0000,0000,,if we can do that, if we will know: 'If I\Nput it into a radiation environment for a
Dialogue: 0,0:16:12.44,0:16:17.00,Default,,0000,0000,0000,,year, how much slower will it become?'\NThen it is of course easy to say: 'OK, I
Dialogue: 0,0:16:17.00,0:16:20.65,Default,,0000,0000,0000,,can just over-design my circuit and make\Nit a bit more simple, maybe have less functionality,
Dialogue: 0,0:16:20.65,0:16:24.46,Default,,0000,0000,0000,,but be able to operate at a\Nhigher frequency and therefore withstand
Dialogue: 0,0:16:24.46,0:16:30.24,Default,,0000,0000,0000,,the radiation effects for a longer time\Nwhile still working sufficiently well at
Dialogue: 0,0:16:30.24,0:16:35.12,Default,,0000,0000,0000,,the end of its expected lifetime.' So\Nthat's more or less what we can do about
Dialogue: 0,0:16:35.12,0:16:38.25,Default,,0000,0000,0000,,these effects. And I'll hand over to\NSzymon for the second class.
Dialogue: 0,0:16:38.25,0:16:42.66,Default,,0000,0000,0000,,Szymon: Contrary to the cumulative effects\Npresented by Stefan, the other group are
Dialogue: 0,0:16:42.66,0:16:46.42,Default,,0000,0000,0000,,Single Event Effects which are caused by\Nhigh energy deposits, which are caused by
Dialogue: 0,0:16:46.42,0:16:52.14,Default,,0000,0000,0000,,a single particle or shower of particles.\NAnd they can happen at any time, even
Dialogue: 0,0:16:52.14,0:16:57.09,Default,,0000,0000,0000,,seconds after irradiation is started. It\Nmeans that if your circuit is vulnerable
Dialogue: 0,0:16:57.09,0:17:01.67,Default,,0000,0000,0000,,to this class of effects, it can fail\Nimmediately after radiation is present.
Dialogue: 0,0:17:01.67,0:17:06.31,Default,,0000,0000,0000,,And here we also classify these effects\Ninto several groups. The first are hard,
Dialogue: 0,0:17:06.31,0:17:11.45,Default,,0000,0000,0000,,or permanent, errors, which as the name\Nindicates can permanently destroy your
Dialogue: 0,0:17:11.45,0:17:20.26,Default,,0000,0000,0000,,circuit. And this type of errors are\Ntypically critical for power devices where
Dialogue: 0,0:17:20.26,0:17:24.34,Default,,0000,0000,0000,,you have large power densities and they\Nare not so much of a problem for digital
Dialogue: 0,0:17:24.34,0:17:30.10,Default,,0000,0000,0000,,circuits. In the other class of effects\Nare soft errors. And here we distinguish
Dialogue: 0,0:17:30.10,0:17:34.10,Default,,0000,0000,0000,,transient, or Single Event Transient\Nerrors, which are spurious signals
Dialogue: 0,0:17:34.10,0:17:41.22,Default,,0000,0000,0000,,propagating in your circuit as a result of\Na gate being hit by a particle and they
Dialogue: 0,0:17:41.22,0:17:45.70,Default,,0000,0000,0000,,are especially problematic for analog\Ncircuits or asynchronous digital circuits,
Dialogue: 0,0:17:45.70,0:17:51.46,Default,,0000,0000,0000,,but under some circumstances they can be\Nalso problematic for synchronous systems.
Dialogue: 0,0:17:51.46,0:17:56.42,Default,,0000,0000,0000,,And the other class of problems are\Nstatic, or Single Event Upset problems,
Dialogue: 0,0:17:56.42,0:18:01.22,Default,,0000,0000,0000,,which basically means that your memory\Nelement like a register gets flipped. And
Dialogue: 0,0:18:01.22,0:18:05.06,Default,,0000,0000,0000,,then of course, if your system is not\Ndesigned to handle this type of errors
Dialogue: 0,0:18:05.06,0:18:09.62,Default,,0000,0000,0000,,properly, it can lead to a failure. So in\Nthe following part of the presentation
Dialogue: 0,0:18:09.62,0:18:15.30,Default,,0000,0000,0000,,we'll focus mostly on soft errors. So\Nlet's try to understand what is the origin
Dialogue: 0,0:18:15.30,0:18:20.82,Default,,0000,0000,0000,,of this type of problem. So as Stefan\Nmentioned, the typical transistor is built
Dialogue: 0,0:18:20.82,0:18:25.23,Default,,0000,0000,0000,,out of diffusions, gate and channel. So\Nhere you can see one diffusion. Let's
Dialogue: 0,0:18:25.23,0:18:29.23,Default,,0000,0000,0000,,assume that it is a drain diffusion. And\Nthen when a particle goes through and
Dialogue: 0,0:18:29.23,0:18:36.70,Default,,0000,0000,0000,,deposits charge, it creates free electron and\Nhole pairs, which then in the presence of
Dialogue: 0,0:18:36.70,0:18:43.32,Default,,0000,0000,0000,,electric fields, they get collected by\Nmeans of drift, which results in a large
Dialogue: 0,0:18:43.32,0:18:46.93,Default,,0000,0000,0000,,current spike, which is very short. And\Nthen the rest of the charge could be
Dialogue: 0,0:18:46.93,0:18:50.94,Default,,0000,0000,0000,,collected by diffusion which is a much\Nslower process and therefore also the
Dialogue: 0,0:18:50.94,0:18:56.39,Default,,0000,0000,0000,,amplitude of the event is much, much\Nsmaller. So let's try to understand what
Dialogue: 0,0:18:56.39,0:19:01.23,Default,,0000,0000,0000,,could happen in a typical memory cell. So\Non this schematic, you can see the
Dialogue: 0,0:19:01.23,0:19:05.74,Default,,0000,0000,0000,,simplest memory cell, which is composed of\Ntwo back-to-back inverters. And let's
Dialogue: 0,0:19:05.74,0:19:12.81,Default,,0000,0000,0000,,assume that node A is at high and node B\Nis at low potential initially. And then we
Dialogue: 0,0:19:12.81,0:19:17.21,Default,,0000,0000,0000,,have a particle hitting the drain of\Ntransistor M1 which creates a short
Dialogue: 0,0:19:17.21,0:19:22.59,Default,,0000,0000,0000,,circuit current between drain and ground,\Nbringing the drain of transistor M1 to low
Dialogue: 0,0:19:22.59,0:19:29.87,Default,,0000,0000,0000,,potential, which also acts on the gates of\Nsecond inverter, temporarily changing its
Dialogue: 0,0:19:29.87,0:19:38.73,Default,,0000,0000,0000,,state from low to high, which reinforces\Nthe wrong state in the first inverter. And
Dialogue: 0,0:19:38.73,0:19:45.34,Default,,0000,0000,0000,,at this time the error is locked in your\Nmemory cell and you basically lost your
Dialogue: 0,0:19:45.34,0:19:49.65,Default,,0000,0000,0000,,information. So you may be asking\Nyourself: 'How much charge is needed
Dialogue: 0,0:19:49.65,0:19:54.28,Default,,0000,0000,0000,,really to flip a state of a memory cell?'.\NAnd you can get this number from either
Dialogue: 0,0:19:54.28,0:19:59.95,Default,,0000,0000,0000,,simulations or from measurements. So let's\Nassume that what we could do, we could try
Dialogue: 0,0:19:59.95,0:20:04.60,Default,,0000,0000,0000,,to inject some current into the sensitive\Nnode, for example, drain of transistor M1.
Dialogue: 0,0:20:04.60,0:20:08.79,Default,,0000,0000,0000,,And here what I will show is that on the\Ntop plot you will have current as a function
Dialogue: 0,0:20:08.79,0:20:13.48,Default,,0000,0000,0000,,of time. On the second plot you will have\Noutput voltage. So voltage at node B as a
Dialogue: 0,0:20:13.48,0:20:19.12,Default,,0000,0000,0000,,function of time and at the lowest plot you\Nwill see a probability of having a bit
Dialogue: 0,0:20:19.12,0:20:23.10,Default,,0000,0000,0000,,flip. So if you inject very little\Ncurrent, of course nothing changes at the
Dialogue: 0,0:20:23.10,0:20:27.67,Default,,0000,0000,0000,,output, but once you start increasing the\Namount of current you are injecting, you
Dialogue: 0,0:20:27.67,0:20:33.31,Default,,0000,0000,0000,,see that something appears at the output\Nand at some point the output will toggle,
Dialogue: 0,0:20:33.31,0:20:39.75,Default,,0000,0000,0000,,so it will switch to the other state. And\Nat this point, if you really calculate
Dialogue: 0,0:20:39.75,0:20:46.37,Default,,0000,0000,0000,,what is the area under the current curve\Nyou can find what is the critical charge
Dialogue: 0,0:20:46.37,0:20:53.50,Default,,0000,0000,0000,,needed to flip the memory cell. And if you\Ngo further, if you start injecting even
Dialogue: 0,0:20:53.50,0:21:00.70,Default,,0000,0000,0000,,more current, you will not see that much\Ndifference in the output voltage waveform.
Dialogue: 0,0:21:00.70,0:21:05.11,Default,,0000,0000,0000,,It could become only slightly faster. And\Nat this point, you also can notice that
Dialogue: 0,0:21:05.11,0:21:09.53,Default,,0000,0000,0000,,the probability now jumped to one, which\Nmeans that any time you inject so much
Dialogue: 0,0:21:09.53,0:21:17.43,Default,,0000,0000,0000,,current there is a fault in your circuit.\NSo for now, we just found what is the
Dialogue: 0,0:21:17.43,0:21:23.41,Default,,0000,0000,0000,,probability of having a bit-flip from 0 to\N1 in node B. Of course we should also
Dialogue: 0,0:21:23.41,0:21:27.90,Default,,0000,0000,0000,,calculate the same for the other\Ndirection, so from 1 to zero. And usually
Dialogue: 0,0:21:27.90,0:21:32.38,Default,,0000,0000,0000,,it is slightly different. And then of\Ncourse we should inject in all the other
Dialogue: 0,0:21:32.38,0:21:37.82,Default,,0000,0000,0000,,nodes, for example node B and also should\Nstudy all possible transitions. And then
Dialogue: 0,0:21:37.82,0:21:43.49,Default,,0000,0000,0000,,at the end, if you calculate the\Nsuperposition of these effects and you
Dialogue: 0,0:21:43.49,0:21:48.66,Default,,0000,0000,0000,,multiply them by the active area of each\Nnode, you will end up with what we call
Dialogue: 0,0:21:48.66,0:21:52.42,Default,,0000,0000,0000,,the cross section, which has a dimension\Nof centimeters squared, which will tell
Dialogue: 0,0:21:52.42,0:21:57.36,Default,,0000,0000,0000,,you how sensitive your circuit is to this\Ntype of effects. And then knowing the
Dialogue: 0,0:21:57.36,0:22:03.76,Default,,0000,0000,0000,,radiation profile of your environment, you\Ncan calculate the expected upset rate in
Dialogue: 0,0:22:03.76,0:22:10.10,Default,,0000,0000,0000,,the final application. So now, having\Ncovered the basic of the single event
Dialogue: 0,0:22:10.10,0:22:16.52,Default,,0000,0000,0000,,effects, let's try to check how we can\Nmitigate them. And here also technology
Dialogue: 0,0:22:16.52,0:22:20.88,Default,,0000,0000,0000,,plays a significant role. So of course,\Nnewer technologies offer us much smaller
Dialogue: 0,0:22:20.88,0:22:26.69,Default,,0000,0000,0000,,devices. And together with that, what\Nfollows is that usually supply voltages
Dialogue: 0,0:22:26.69,0:22:31.05,Default,,0000,0000,0000,,are getting smaller and smaller as well as\Nthe node capacitance, which means that for
Dialogue: 0,0:22:31.05,0:22:35.56,Default,,0000,0000,0000,,our Single Event Upsets it is very bad\Nbecause the critical charge which is
Dialogue: 0,0:22:35.56,0:22:40.21,Default,,0000,0000,0000,,required to flip our bit is getting less\Nand less. But at the end, at the same
Dialogue: 0,0:22:40.21,0:22:44.14,Default,,0000,0000,0000,,time, physical dimensions of our\Ntransistors are getting smaller, which
Dialogue: 0,0:22:44.14,0:22:48.10,Default,,0000,0000,0000,,means that the cross section for them\Nbeing hit is also getting smaller. So
Dialogue: 0,0:22:48.10,0:22:52.50,Default,,0000,0000,0000,,overall, the effects really depend on the\Ncircuit topology and the radiation
Dialogue: 0,0:22:52.50,0:22:59.18,Default,,0000,0000,0000,,environment. So another protection method\Ncould be introduced on the cell level. And
Dialogue: 0,0:22:59.18,0:23:04.91,Default,,0000,0000,0000,,here we could imagine increasing the\Ncritical charge. And that could be done in
Dialogue: 0,0:23:04.91,0:23:10.82,Default,,0000,0000,0000,,the easiest way by just increasing the\Nnode capacitance by, for example, putting
Dialogue: 0,0:23:10.82,0:23:16.10,Default,,0000,0000,0000,,larger transistors. But of course, this\Nalso increases the collection electrode,
Dialogue: 0,0:23:16.10,0:23:22.66,Default,,0000,0000,0000,,which is not nice. And another way could\Nbe just increase the capacitance by adding
Dialogue: 0,0:23:22.66,0:23:28.34,Default,,0000,0000,0000,,some extra metal capacitance, but it, of\Ncourse, slows down the circuit. Another
Dialogue: 0,0:23:28.34,0:23:33.62,Default,,0000,0000,0000,,approach could be to try to store the\Ninformation on more than two nodes. So I
Dialogue: 0,0:23:33.62,0:23:38.38,Default,,0000,0000,0000,,showed you that on a simple SRAM cell we\Nstore information only on two nodes, so
Dialogue: 0,0:23:38.38,0:23:43.10,Default,,0000,0000,0000,,you could try to come up with some other\Ncells, for example, like that one in which
Dialogue: 0,0:23:43.10,0:23:47.41,Default,,0000,0000,0000,,the information you stored on four nodes.\NSo you can see that the architecture is
Dialogue: 0,0:23:47.41,0:23:53.80,Default,,0000,0000,0000,,very similar to the basic SRAM cell. But\Nyou should be careful always to very
Dialogue: 0,0:23:53.80,0:23:59.00,Default,,0000,0000,0000,,carefully simulate your design, because if\Nwe analyze this circuit, you will quickly
Dialogue: 0,0:23:59.00,0:24:02.94,Default,,0000,0000,0000,,realize that this circuit, even though the\Ninformation is stored in four different
Dialogue: 0,0:24:02.94,0:24:09.87,Default,,0000,0000,0000,,nodes, the same type of loop exists as in\Nthe basic circuit. Meaning that at the end
Dialogue: 0,0:24:09.87,0:24:15.23,Default,,0000,0000,0000,,the circuit offers basically no hardening\Nwith respect to the previous cell. So
Dialogue: 0,0:24:15.23,0:24:21.07,Default,,0000,0000,0000,,actually we can do it better. So here you\Ncan see a typical dual interlocked cell.
Dialogue: 0,0:24:21.07,0:24:26.44,Default,,0000,0000,0000,,So the amount of transistors is exactly\Nthe same as in the previous example, but
Dialogue: 0,0:24:26.44,0:24:30.82,Default,,0000,0000,0000,,now they are interconnected slightly\Ndifferently. And here you can see that
Dialogue: 0,0:24:30.82,0:24:36.26,Default,,0000,0000,0000,,this cell has also two stable configurations. \NBut this time data can propagate, the low
Dialogue: 0,0:24:36.26,0:24:40.59,Default,,0000,0000,0000,,level from a given node can propagate\Nonly to the left hand side, while high
Dialogue: 0,0:24:40.59,0:24:47.87,Default,,0000,0000,0000,,level can propagate to the right hand\Nside. And each stage being inverting means
Dialogue: 0,0:24:47.87,0:24:54.92,Default,,0000,0000,0000,,that the fault can not propagate for more\Nthan one node. Of course, this cell has
Dialogue: 0,0:24:54.92,0:25:00.38,Default,,0000,0000,0000,,some drawbacks: It consumes more area than\Na simple SRAM cell and also write access
Dialogue: 0,0:25:00.38,0:25:04.24,Default,,0000,0000,0000,,requires accessing at least two nodes at\Nthe same time to really change the state
Dialogue: 0,0:25:04.24,0:25:09.80,Default,,0000,0000,0000,,of the cell. And so you may ask yourself,\Nhow effective is this cell? So here I will
Dialogue: 0,0:25:09.80,0:25:13.71,Default,,0000,0000,0000,,show you a cross section plot. So it is\Nthe probability of having an error as a
Dialogue: 0,0:25:13.71,0:25:18.88,Default,,0000,0000,0000,,function of injected energy. And as a\Nreference, you can see a pink curve on the
Dialogue: 0,0:25:18.88,0:25:25.65,Default,,0000,0000,0000,,top, which is for a normal, not protected\Ncell. And on the green you can see the
Dialogue: 0,0:25:25.65,0:25:31.40,Default,,0000,0000,0000,,cross section for the error in the DICE\Ncell. So as you can see, it is one order
Dialogue: 0,0:25:31.40,0:25:36.93,Default,,0000,0000,0000,,of magnitude better than the normal cell.\NBut still, the cross section is far from
Dialogue: 0,0:25:36.93,0:25:41.43,Default,,0000,0000,0000,,being negligible, So, the problem was\Nidentified: So it was identified that the
Dialogue: 0,0:25:41.43,0:25:45.68,Default,,0000,0000,0000,,problem was caused by the fact that some\Nsensitive nodes were very close together
Dialogue: 0,0:25:45.68,0:25:50.81,Default,,0000,0000,0000,,on the layout and therefore they could be\Nupset by the same particle. Because as we
Dialogue: 0,0:25:50.81,0:25:54.72,Default,,0000,0000,0000,,mentioned, that single devices, they are very\Nsmall. We are talking about dimensions
Dialogue: 0,0:25:54.72,0:25:59.68,Default,,0000,0000,0000,,below a micron. So after realizing that,\Nwe designed another cell in which we
Dialogue: 0,0:25:59.68,0:26:04.80,Default,,0000,0000,0000,,separated more sensitive nodes and we\Nended up with the blue curve, and as you
Dialogue: 0,0:26:04.80,0:26:08.91,Default,,0000,0000,0000,,can see the cross section was reduced by\Ntwo more orders of magnitude and the
Dialogue: 0,0:26:08.91,0:26:14.20,Default,,0000,0000,0000,,threshold was increased significantly. So\Nif you don't want to redesign your
Dialogue: 0,0:26:14.20,0:26:18.77,Default,,0000,0000,0000,,standard cells, you could also apply some\Nmitigation techniques on block level. So
Dialogue: 0,0:26:18.77,0:26:24.72,Default,,0000,0000,0000,,here we can use some encoding to encode\Nour state better. And as an example, I
Dialogue: 0,0:26:24.72,0:26:31.54,Default,,0000,0000,0000,,will show you a typical Hamming code. So\Nto protect four bits, we have to add three
Dialogue: 0,0:26:31.54,0:26:38.05,Default,,0000,0000,0000,,additional party bits which are calculated\Naccording to this formula. And then once
Dialogue: 0,0:26:38.05,0:26:44.13,Default,,0000,0000,0000,,you calculate the parity bits, you can use\Nthose to check the state integrity of your
Dialogue: 0,0:26:44.13,0:26:50.36,Default,,0000,0000,0000,,internal state. And if any of their parity\Nbits is not equal to zero, then the bits
Dialogue: 0,0:26:50.36,0:26:55.38,Default,,0000,0000,0000,,instantaneously become syndromes,\Nindicating where the error happened. And
Dialogue: 0,0:26:55.38,0:26:59.92,Default,,0000,0000,0000,,you can use these information to correct\Nthe error. Of course, in this case, the
Dialogue: 0,0:26:59.92,0:27:06.53,Default,,0000,0000,0000,,efficiency is not really nice because we\Nneed three additional bits to protect only
Dialogue: 0,0:27:06.53,0:27:11.83,Default,,0000,0000,0000,,four bits of information. But as the state\Nlength increases the protection also is
Dialogue: 0,0:27:11.83,0:27:18.86,Default,,0000,0000,0000,,more efficient. Another approach would be\Nto do even less. Meaning that instead of
Dialogue: 0,0:27:18.86,0:27:23.97,Default,,0000,0000,0000,,changing anything you need in your design,\Nyou can just triplicate your design or
Dialogue: 0,0:27:23.97,0:27:30.19,Default,,0000,0000,0000,,multiply it many times and just vote,\Nwhich state is correct? So this concept is
Dialogue: 0,0:27:30.19,0:27:35.05,Default,,0000,0000,0000,,called tripple modular redudancy and it is\Nbased around a voter cell. So it is a
Dialogue: 0,0:27:35.05,0:27:40.21,Default,,0000,0000,0000,,cell which has odd number of\Ninputs and output is always equal to
Dialogue: 0,0:27:40.21,0:27:45.04,Default,,0000,0000,0000,,majority of its input. And as I mentioned\Nthat the idea is that you have, for
Dialogue: 0,0:27:45.04,0:27:49.29,Default,,0000,0000,0000,,example, three circuits: A, B and C, and\Nduring normal operation, when they are
Dialogue: 0,0:27:49.29,0:27:54.47,Default,,0000,0000,0000,,identical, the output is also the same.\NHowever, when there is a problem, for
Dialogue: 0,0:27:54.47,0:28:00.96,Default,,0000,0000,0000,,example, in logic, part B, the output\Nis affected. So this problem is
Dialogue: 0,0:28:00.96,0:28:05.51,Default,,0000,0000,0000,,effectively masked by the voter cell\Nand it is not visible from outside of the
Dialogue: 0,0:28:05.51,0:28:10.38,Default,,0000,0000,0000,,circuit. But you have to be careful not to\Ntake this picture as a as a design
Dialogue: 0,0:28:10.38,0:28:15.50,Default,,0000,0000,0000,,template. So let's try to analyze what\Nwould happen with a state machine
Dialogue: 0,0:28:15.50,0:28:20.33,Default,,0000,0000,0000,,similar to what Stephan introduced. If you\Nwere to just use this concept. So here you
Dialogue: 0,0:28:20.33,0:28:24.86,Default,,0000,0000,0000,,can see three state machines and\Na voter on the output. And as we can see,
Dialogue: 0,0:28:24.86,0:28:29.48,Default,,0000,0000,0000,,if you have an upside in, for example, the\Nstate register A, then the state is
Dialogue: 0,0:28:29.48,0:28:36.68,Default,,0000,0000,0000,,broken. But still the output of the\Ncircuit, which is indicated by letter s is
Dialogue: 0,0:28:36.68,0:28:42.36,Default,,0000,0000,0000,,correct because the B and C registers are\Nstill fine. But what happens if some time
Dialogue: 0,0:28:42.36,0:28:49.28,Default,,0000,0000,0000,,later we have an upset in memory element B\Nor C? Then of course the state
Dialogue: 0,0:28:49.28,0:28:56.03,Default,,0000,0000,0000,,of our system is broken and we can not\Nrecover it. So you can ask yourself what
Dialogue: 0,0:28:56.03,0:29:02.20,Default,,0000,0000,0000,,can we do better in order to avoid this\Nsituation? So that just to be sure. Please
Dialogue: 0,0:29:02.20,0:29:06.65,Default,,0000,0000,0000,,do not use this technique to protect your\Ncircuits. So the easiest mitigation could
Dialogue: 0,0:29:06.65,0:29:13.20,Default,,0000,0000,0000,,be to use as an input to your logic to use\Nthe output of the voter cell itself.
Dialogue: 0,0:29:13.20,0:29:18.49,Default,,0000,0000,0000,,What it offers us is that now whenever you\Nhave an upset in one of the memory
Dialogue: 0,0:29:18.49,0:29:22.93,Default,,0000,0000,0000,,elements for the next computation, for the\Nnext stage, we always use the voter
Dialogue: 0,0:29:22.93,0:29:27.63,Default,,0000,0000,0000,,output, which ensures that the signal\Nwill be removed one clock cycle later. So
Dialogue: 0,0:29:27.63,0:29:32.73,Default,,0000,0000,0000,,you will have another hit sometime later,\Nbasically, it will not affect our state.
Dialogue: 0,0:29:32.73,0:29:39.76,Default,,0000,0000,0000,,Until now we consider only upsets in our\Nregisters but what happens if we have
Dialogue: 0,0:29:39.76,0:29:45.88,Default,,0000,0000,0000,,charge in our voter? So you see that\Nif there is no state change, basically the
Dialogue: 0,0:29:45.88,0:29:50.98,Default,,0000,0000,0000,,transient in the voter doesn't impact\Nour system. But if you are really unlucky
Dialogue: 0,0:29:50.98,0:29:55.78,Default,,0000,0000,0000,,and the transient happens when the clock\Ntransition happens, so when whenever we
Dialogue: 0,0:29:55.78,0:30:01.18,Default,,0000,0000,0000,,enlarge the data, we can corrupt the state\Nin three registers at the same time, which
Dialogue: 0,0:30:01.18,0:30:05.60,Default,,0000,0000,0000,,is less than ideal. So to overcome this\Nlimitation, you can consider skewing our
Dialogue: 0,0:30:05.60,0:30:11.10,Default,,0000,0000,0000,,clocks by some time, which is larger than\Nthe maximum charge in time. And now,
Dialogue: 0,0:30:11.10,0:30:18.05,Default,,0000,0000,0000,,because with each register samples the\Noutput of the voter a slightly different
Dialogue: 0,0:30:18.05,0:30:23.45,Default,,0000,0000,0000,,time, we can corrupt only one flip-flop\Nat the time. So of course, if you are
Dialogue: 0,0:30:23.45,0:30:28.78,Default,,0000,0000,0000,,unlucky, we can have problematic\Nsituations in which one register is
Dialogue: 0,0:30:28.78,0:30:33.65,Default,,0000,0000,0000,,already in your state. The other register\Nis still in the old state. And then it
Dialogue: 0,0:30:33.65,0:30:39.73,Default,,0000,0000,0000,,can lead to undetermenistic result. So it\Nis better, but still not ideal. So as a
Dialogue: 0,0:30:39.73,0:30:46.58,Default,,0000,0000,0000,,general theme, you have seen that we were\Nadding and adding more resources so you
Dialogue: 0,0:30:46.58,0:30:50.42,Default,,0000,0000,0000,,can ask yourself what would happen if we\Ntripplicate everything. So in this case,
Dialogue: 0,0:30:50.42,0:30:54.26,Default,,0000,0000,0000,,we tripplicated registers, we\Ntripplicate our logic and our voters. And
Dialogue: 0,0:30:54.26,0:30:59.14,Default,,0000,0000,0000,,now you can see that whenever we have an\Nupset in our register, it can only affect
Dialogue: 0,0:30:59.14,0:31:04.51,Default,,0000,0000,0000,,one register at the time and the error\Nwill be removed from the system one clock
Dialogue: 0,0:31:04.51,0:31:08.91,Default,,0000,0000,0000,,cycle later. Also, if we have an upset\Nin the voter or in their logic it can be
Dialogue: 0,0:31:08.91,0:31:13.37,Default,,0000,0000,0000,,larged only to one register, which means\Nthat in principle we create that system
Dialogue: 0,0:31:13.37,0:31:17.88,Default,,0000,0000,0000,,which is really robust. Unfortunately,\Nnothing is for free. So here I compare a
Dialogue: 0,0:31:17.88,0:31:22.82,Default,,0000,0000,0000,,different tripplication environments and\Nas you can see that the more protection
Dialogue: 0,0:31:22.82,0:31:26.33,Default,,0000,0000,0000,,you want to have, the more you have to pay\Nin terms of resources being power in the
Dialogue: 0,0:31:26.33,0:31:31.37,Default,,0000,0000,0000,,area. And also usual, you pay small\Npenalty in terms of maximum operational
Dialogue: 0,0:31:31.37,0:31:37.60,Default,,0000,0000,0000,,speed. So which flavor of protection you\Nuse depends really on
Dialogue: 0,0:31:37.60,0:31:42.42,Default,,0000,0000,0000,,application. So for most sensitive\Ncircuits, you probably you want to use
Dialogue: 0,0:31:42.42,0:31:48.49,Default,,0000,0000,0000,,full TMR and you may leave some other\Nbits of logic unprotected. So another, if
Dialogue: 0,0:31:48.49,0:31:54.75,Default,,0000,0000,0000,,your system is not mission critical and\Nyou can tolerate some downtime, you can
Dialogue: 0,0:31:54.75,0:32:00.29,Default,,0000,0000,0000,,consider scrubbing, which means periodically \Nchecking the state of your system and refreshing it
Dialogue: 0,0:32:00.29,0:32:05.12,Default,,0000,0000,0000,,if necessary if an error is detected using\Nsome parity bits or copy of the data in
Dialogue: 0,0:32:05.12,0:32:10.39,Default,,0000,0000,0000,,a safe space. Or you can have a\Nwatchdog which will find out that
Dialogue: 0,0:32:10.39,0:32:13.95,Default,,0000,0000,0000,,something went wrong and it will just\Nreinitialize the whole system. So now,
Dialogue: 0,0:32:13.95,0:32:20.01,Default,,0000,0000,0000,,having covered the basics of all the effects\Nwe will have to face, we would like
Dialogue: 0,0:32:20.01,0:32:24.29,Default,,0000,0000,0000,,to show you the basic flow which we follow\Nduring designing our radiation hardened
Dialogue: 0,0:32:24.29,0:32:29.75,Default,,0000,0000,0000,,circuits. So of course we always start\Nwith specifications. So we try to
Dialogue: 0,0:32:29.75,0:32:34.23,Default,,0000,0000,0000,,understand our radiation environment in\Nwhich the circuit is meant to operate. So
Dialogue: 0,0:32:34.23,0:32:38.75,Default,,0000,0000,0000,,we come up with some specifications for\Ntotal dose which could be accumulated and
Dialogue: 0,0:32:38.75,0:32:45.35,Default,,0000,0000,0000,,for the rate of single event upsets. And\Nat this moment, it is also not very rare
Dialogue: 0,0:32:45.35,0:32:49.70,Default,,0000,0000,0000,,that we have to decide to move some\Nfunctionality out of our detector volume,
Dialogue: 0,0:32:49.70,0:32:56.13,Default,,0000,0000,0000,,outside, where we can use of the sort of\Ncommercial equipment to do number
Dialogue: 0,0:32:56.13,0:33:04.82,Default,,0000,0000,0000,,crunching. But let's assume that we would\Ngo with our ASIC. So having the
Dialogue: 0,0:33:04.82,0:33:09.22,Default,,0000,0000,0000,,specifications, of course we proceed with\Nfunctional implementation. This we
Dialogue: 0,0:33:09.22,0:33:14.26,Default,,0000,0000,0000,,typically do with hardware describtion\Nlanguages, so verilog or VHDL which you may
Dialogue: 0,0:33:14.26,0:33:18.90,Default,,0000,0000,0000,,know from typical FPGA flow. And of course\Nwe write a lot of simulations to
Dialogue: 0,0:33:18.90,0:33:24.20,Default,,0000,0000,0000,,understand whether we are meeting our\Nfunctional goals or whether our circuit
Dialogue: 0,0:33:24.20,0:33:30.66,Default,,0000,0000,0000,,behaves as expected. And then we\Nselectively select some parts of the
Dialogue: 0,0:33:30.66,0:33:36.32,Default,,0000,0000,0000,,circuits which we want to protect from\Nradiation effects. So, for example, we can
Dialogue: 0,0:33:36.32,0:33:42.29,Default,,0000,0000,0000,,decide to use triplication or some other\Nmethods. So these days we typically use
Dialogue: 0,0:33:42.29,0:33:46.64,Default,,0000,0000,0000,,triplication as the most straightforward\Nand very effective method. So you can ask
Dialogue: 0,0:33:46.64,0:33:50.75,Default,,0000,0000,0000,,yourself how do we triplicate the logic?\NSo the simplest could be: Just copy
Dialogue: 0,0:33:50.75,0:33:55.10,Default,,0000,0000,0000,,and paste the code three times at some\Npostfixes like A, B and C and you are
Dialogue: 0,0:33:55.10,0:34:01.65,Default,,0000,0000,0000,,done. But of course this solution has some\Ndrawbacks. So it is time consuming and it
Dialogue: 0,0:34:01.65,0:34:05.96,Default,,0000,0000,0000,,is very error prone. So maybe you have\Nnoticed that I had a typo there. So of
Dialogue: 0,0:34:05.96,0:34:10.22,Default,,0000,0000,0000,,course we don't want to do that. So we\Ndeveloped our own tool, which we called
Dialogue: 0,0:34:10.22,0:34:16.92,Default,,0000,0000,0000,,TMRG, which automatizes the process of\Ntriplication and eliminates the two main
Dialogue: 0,0:34:16.92,0:34:22.49,Default,,0000,0000,0000,,drawbacks, which I just described. So\Nafter we have our code triplicated and of
Dialogue: 0,0:34:22.49,0:34:27.08,Default,,0000,0000,0000,,course, not before rerunning all the\Nsimulations to make sure that everything
Dialogue: 0,0:34:27.08,0:34:34.23,Default,,0000,0000,0000,,went as expected. We then proceed to the\Nsynthesis process in which we convert our
Dialogue: 0,0:34:34.23,0:34:41.09,Default,,0000,0000,0000,,high level hardware description languages\Nto gate level netlists, in which all the functions
Dialogue: 0,0:34:41.09,0:34:46.19,Default,,0000,0000,0000,,are mapped to gates, which were introduced\Nby Stefan, so both combinatorial and
Dialogue: 0,0:34:46.19,0:34:53.63,Default,,0000,0000,0000,,sequential. And here we also have to be\Ncareful because modern CAD tools have a
Dialogue: 0,0:34:53.63,0:34:59.02,Default,,0000,0000,0000,,tendency, of course, to optimise the logic\Nas much as possible. And our logic in most
Dialogue: 0,0:34:59.02,0:35:03.81,Default,,0000,0000,0000,,of the cases is really redundant. So it is\Nvery easy; So, it should be removed. So we
Dialogue: 0,0:35:03.81,0:35:08.63,Default,,0000,0000,0000,,really have to make sure that it is not\Nremoved. That's why our tool also provides
Dialogue: 0,0:35:08.63,0:35:13.63,Default,,0000,0000,0000,,some constraints for the synthesizer to\Nmake sure that our design intent is
Dialogue: 0,0:35:13.63,0:35:20.90,Default,,0000,0000,0000,,clearly and well understood by the tool.\NAnd once we have the output netlist, we
Dialogue: 0,0:35:20.90,0:35:26.98,Default,,0000,0000,0000,,proceed to place and route process where\Nthis kind of netlist representation is
Dialogue: 0,0:35:26.98,0:35:32.58,Default,,0000,0000,0000,,mapped to a layout of what will become\Nsoon our digital chip where we placed all
Dialogue: 0,0:35:32.58,0:35:36.62,Default,,0000,0000,0000,,the cells and we route connections between\Nthem and here there is
Dialogue: 0,0:35:36.62,0:35:40.91,Default,,0000,0000,0000,,another danger which I mentioned already,\Nit's that in modern technologies the cells
Dialogue: 0,0:35:40.91,0:35:45.60,Default,,0000,0000,0000,,are so small that they could be easily\Naffected by a single particle at the same
Dialogue: 0,0:35:45.60,0:35:51.89,Default,,0000,0000,0000,,time. So we have to really space out\Nthe big cells which are responsible for
Dialogue: 0,0:35:51.89,0:35:56.98,Default,,0000,0000,0000,,keeping the information about the state to\Nmake sure that a single particle cannot
Dialogue: 0,0:35:56.98,0:36:04.98,Default,,0000,0000,0000,,upset A and B, for example, registered\Nfrom the same register. And then in the
Dialogue: 0,0:36:04.98,0:36:09.54,Default,,0000,0000,0000,,last step, of course, we'll have to verify\Nthat everything, what we have done, is
Dialogue: 0,0:36:09.54,0:36:13.93,Default,,0000,0000,0000,,correct. And at this level, we also try to\Nintroduce some single event effects in our
Dialogue: 0,0:36:13.93,0:36:19.97,Default,,0000,0000,0000,,simulations. So we could randomly flip\Nbits in our system. We can also inject
Dialogue: 0,0:36:19.97,0:36:26.09,Default,,0000,0000,0000,,transients. And typically we used to do\Nthat on the netlist level, which works
Dialogue: 0,0:36:26.09,0:36:31.42,Default,,0000,0000,0000,,very fine. And it is very nice. But the\Nproblem with this approach is that we can
Dialogue: 0,0:36:31.42,0:36:37.64,Default,,0000,0000,0000,,perform these actions very late in the\Ndesign cycle, which is less than ideal.
Dialogue: 0,0:36:37.64,0:36:43.08,Default,,0000,0000,0000,,And also that if we find that there is\Nproblem in our simulation, typical netlist
Dialogue: 0,0:36:43.08,0:36:48.44,Default,,0000,0000,0000,,at this level has probably few orders of\Nmagnitude more lines than our initial RTL
Dialogue: 0,0:36:48.44,0:36:52.99,Default,,0000,0000,0000,,code. So to trace back what is the\Nproblematic line of code is not so
Dialogue: 0,0:36:52.99,0:36:57.53,Default,,0000,0000,0000,,straightforward. At this time. So you can\Nask yourself why not to try to inject
Dialogue: 0,0:36:57.53,0:37:05.46,Default,,0000,0000,0000,,errors in the RTL design? And the answer\Nwas, the answer is that it is not so
Dialogue: 0,0:37:05.46,0:37:10.67,Default,,0000,0000,0000,,trivially to map the hardware description\Nlanguage's high level constructs to
Dialogue: 0,0:37:10.67,0:37:15.58,Default,,0000,0000,0000,,what will become combinatorial or\Nsequential logic. So in order to eliminate
Dialogue: 0,0:37:15.58,0:37:20.98,Default,,0000,0000,0000,,this problem, we also develop another open\Nsource tool, which allows us to...
Dialogue: 0,0:37:20.98,0:37:27.86,Default,,0000,0000,0000,,So we decided to use Yosys open\Nsource synthesis tool from clifford, which
Dialogue: 0,0:37:27.86,0:37:31.53,Default,,0000,0000,0000,,was presented in the Congress several\Nyears ago. So we use this tool to make a
Dialogue: 0,0:37:31.53,0:37:35.68,Default,,0000,0000,0000,,first pass through our RTL code to\Nunderstand which elements will be mapped
Dialogue: 0,0:37:35.68,0:37:40.68,Default,,0000,0000,0000,,to sequential and combinatorial. And then\Nhaving this information, we will use
Dialogue: 0,0:37:40.68,0:37:45.95,Default,,0000,0000,0000,,cocotb, another python verification\Nframework, which allows us programmatic
Dialogue: 0,0:37:45.95,0:37:51.84,Default,,0000,0000,0000,,access to these nodes and we can\Neffectively inject the errors in our
Dialogue: 0,0:37:51.84,0:37:56.66,Default,,0000,0000,0000,,simulations. And I forgot to mention that\Nthe TMRG tool is also open source. So if
Dialogue: 0,0:37:56.66,0:38:03.84,Default,,0000,0000,0000,,you are interested in one of the tools,\Nplease feel free to contact us. And of
Dialogue: 0,0:38:03.84,0:38:10.50,Default,,0000,0000,0000,,course, after our simulation is done, then in\Nthe next step we would really tape out. And
Dialogue: 0,0:38:10.50,0:38:14.64,Default,,0000,0000,0000,,so we submit our chip to manufacturing and\Nhopefully a few months later we receive
Dialogue: 0,0:38:14.64,0:38:18.10,Default,,0000,0000,0000,,our chip back.\NStefan: All right. So after patiently
Dialogue: 0,0:38:18.10,0:38:23.55,Default,,0000,0000,0000,,waiting then for a couple of months while\Nyour chip is in manufacturing and you're
Dialogue: 0,0:38:23.55,0:38:28.24,Default,,0000,0000,0000,,spending time on preparing a test set up\Nand preparing yourself to actually test if
Dialogue: 0,0:38:28.24,0:38:33.77,Default,,0000,0000,0000,,your chip works as you expected to. Now,\Nit's probably also a good time to think
Dialogue: 0,0:38:33.77,0:38:38.31,Default,,0000,0000,0000,,about how to actually validate or test if\Nall the measures that you've taken to
Dialogue: 0,0:38:38.31,0:38:41.39,Default,,0000,0000,0000,,protect your circuit from radiation\Neffects actually are effective or if they
Dialogue: 0,0:38:41.39,0:38:46.20,Default,,0000,0000,0000,,are not. And so again, we will split this\Nin two parts. So you will probably want to
Dialogue: 0,0:38:46.20,0:38:50.02,Default,,0000,0000,0000,,start with testing for the total ionizing\Ndose effects. So for the cumulative effect
Dialogue: 0,0:38:50.02,0:38:54.55,Default,,0000,0000,0000,,and for that, you typically use x ray\Nradiation relatively similar to the one
Dialogue: 0,0:38:54.55,0:38:59.00,Default,,0000,0000,0000,,used in medical treatment. So this\Nradiation is relatively low, energetic,
Dialogue: 0,0:38:59.00,0:39:03.34,Default,,0000,0000,0000,,which has the upside of not producing any\Nsingle event effects, but you can really
Dialogue: 0,0:39:03.34,0:39:07.46,Default,,0000,0000,0000,,only accumulate radiation dose and focus\Non the accumulating effects. And typically
Dialogue: 0,0:39:07.46,0:39:11.60,Default,,0000,0000,0000,,you would use a machine that looks\Nsomewhat like this, a relatively compact
Dialogue: 0,0:39:11.60,0:39:16.84,Default,,0000,0000,0000,,thing. You can have in your laboratory and\Nyou can use that to really accumulate
Dialogue: 0,0:39:16.84,0:39:21.52,Default,,0000,0000,0000,,large amounts of radiation dose on your\Ncircuit. And then you need some sort of
Dialogue: 0,0:39:21.52,0:39:26.64,Default,,0000,0000,0000,,mechanism to verify or to quantify how\Nmuch your circuit slows down due to this
Dialogue: 0,0:39:26.64,0:39:31.28,Default,,0000,0000,0000,,radiation dose. And if you do that, you\Ntypically end up with a graphic such as
Dialogue: 0,0:39:31.28,0:39:36.57,Default,,0000,0000,0000,,this one, where in the x axis you have the\Nradiation dose your circuit was exposed
Dialogue: 0,0:39:36.57,0:39:40.64,Default,,0000,0000,0000,,to. And on the y axis, you see that the\Nfrequency has gone down over time and you
Dialogue: 0,0:39:40.64,0:39:44.54,Default,,0000,0000,0000,,can use this information to say:\N"OK, my final application, I expect this
Dialogue: 0,0:39:44.54,0:39:49.32,Default,,0000,0000,0000,,level of radiation dose. I mean, I can\Nstill see that my circuit will work fine
Dialogue: 0,0:39:49.32,0:39:53.56,Default,,0000,0000,0000,,under some given environmental condition\Nor some operation condition." So this is
Dialogue: 0,0:39:53.56,0:39:58.28,Default,,0000,0000,0000,,the test for the first class of effects.\NAnd the test for the second class of
Dialogue: 0,0:39:58.28,0:40:02.32,Default,,0000,0000,0000,,effects for the single event effect is a\Nbit more involved. So there what you would
Dialogue: 0,0:40:02.32,0:40:07.16,Default,,0000,0000,0000,,typically start to do is go for a heavy\Nion test campaign. So you would go to a
Dialogue: 0,0:40:07.16,0:40:12.76,Default,,0000,0000,0000,,specialized, relatively rare facility. We\Nhave a couple of those in Europe and would
Dialogue: 0,0:40:12.76,0:40:16.53,Default,,0000,0000,0000,,look perhaps somewhat like this. So it's a\Nsmall particle accelerator somewhere.
Dialogue: 0,0:40:16.53,0:40:20.79,Default,,0000,0000,0000,,They typically have\Ndifferent types of heavy ions at their
Dialogue: 0,0:40:20.79,0:40:26.31,Default,,0000,0000,0000,,disposal that they can accelerate and then\Nshoot at your chip that you can place in a
Dialogue: 0,0:40:26.31,0:40:32.39,Default,,0000,0000,0000,,vacuum chamber and these ions can deposit\Nvery well known amounts of energy in your
Dialogue: 0,0:40:32.39,0:40:36.82,Default,,0000,0000,0000,,circuit and you can use that information\Nto characterize your circuit. The downside
Dialogue: 0,0:40:36.82,0:40:41.21,Default,,0000,0000,0000,,is a bit that these facilities tend to be\Nrelatively expensive to access and also a
Dialogue: 0,0:40:41.21,0:40:45.16,Default,,0000,0000,0000,,bit hard to access. So typically you need\Nto book them a lot of time in advance and
Dialogue: 0,0:40:45.16,0:40:50.35,Default,,0000,0000,0000,,that's sometimes not very easy. But what\Nit offers you, you can use different types
Dialogue: 0,0:40:50.35,0:40:55.24,Default,,0000,0000,0000,,of ions with different energies. You can\Nreally make a very well-defined
Dialogue: 0,0:40:55.24,0:41:00.19,Default,,0000,0000,0000,,sensitivity curve similar to the one that\NSzymon has described. You can get from
Dialogue: 0,0:41:00.19,0:41:04.05,Default,,0000,0000,0000,,simulations and really characterize your\Ncircuit for how often, any single event
Dialogue: 0,0:41:04.05,0:41:09.03,Default,,0000,0000,0000,,effects will appear in the final\Napplication if there is any remaining
Dialogue: 0,0:41:09.03,0:41:12.83,Default,,0000,0000,0000,,effects left. If you have left something\Nunprotected. The problem here is that
Dialogue: 0,0:41:12.83,0:41:18.19,Default,,0000,0000,0000,,these particle accelerators typically just\Nbombard your circuit with like thousands
Dialogue: 0,0:41:18.19,0:41:23.31,Default,,0000,0000,0000,,of particles per second and they hit\Nbasically the whole area in a random
Dialogue: 0,0:41:23.31,0:41:26.94,Default,,0000,0000,0000,,fashion. So you don't really have a way of\Nsteering those or measuring the position
Dialogue: 0,0:41:26.94,0:41:30.96,Default,,0000,0000,0000,,of these particles. So typically you are a\Nbit in the dark and really have to really
Dialogue: 0,0:41:30.96,0:41:34.88,Default,,0000,0000,0000,,carefully know the behavior of your\Ncircuit and all the quirks it has even
Dialogue: 0,0:41:34.88,0:41:39.48,Default,,0000,0000,0000,,without the radiation to instantly notice\Nwhen something has gone wrong. And
Dialogue: 0,0:41:39.48,0:41:44.09,Default,,0000,0000,0000,,this is typically not very easy\Nand you can kind of compare it with having
Dialogue: 0,0:41:44.09,0:41:47.37,Default,,0000,0000,0000,,some weird crash somewhere in your\Nsoftware stack and then having to have
Dialogue: 0,0:41:47.37,0:41:51.80,Default,,0000,0000,0000,,first take a look and see what actually\Nhas happened. Typically
Dialogue: 0,0:41:51.80,0:41:57.06,Default,,0000,0000,0000,,you find something that has not been\Nproperly protected and you see some weird
Dialogue: 0,0:41:57.06,0:42:01.85,Default,,0000,0000,0000,,effect on your circuit and then you try to\Nget a better idea of where that problem
Dialogue: 0,0:42:01.85,0:42:06.26,Default,,0000,0000,0000,,actually is located. And the answer for\Nthese types of problems involving position
Dialogue: 0,0:42:06.26,0:42:11.38,Default,,0000,0000,0000,,is, of course, always lasers. So we have\Ntwo types of laser experiments available
Dialogue: 0,0:42:11.38,0:42:15.80,Default,,0000,0000,0000,,that can be used to more selectively probe\Nyour circuit for these problems. The first
Dialogue: 0,0:42:15.80,0:42:19.69,Default,,0000,0000,0000,,one being the single photon absorption\Nlaser. And it sounds this relatively
Dialogue: 0,0:42:19.69,0:42:24.71,Default,,0000,0000,0000,,simple in terms of setup. You just use a\Nsingle laser beam that shoots straight up
Dialogue: 0,0:42:24.71,0:42:29.88,Default,,0000,0000,0000,,at your circuit from the back. And while\Nit does that, it deposits energy all along
Dialogue: 0,0:42:29.88,0:42:34.18,Default,,0000,0000,0000,,the silicon and also in the diffusions of\Nyour transistors and is therefore also
Dialogue: 0,0:42:34.18,0:42:38.39,Default,,0000,0000,0000,,able to inject energy there, potentially\Nupsetting a bit of memory or exposing
Dialogue: 0,0:42:38.39,0:42:43.05,Default,,0000,0000,0000,,whatever other single event effects you\Nhave. And of course, you can steer this
Dialogue: 0,0:42:43.05,0:42:46.88,Default,,0000,0000,0000,,beam across the surface of your chip or\Nwhatever circuit you are testing and then
Dialogue: 0,0:42:46.88,0:42:51.33,Default,,0000,0000,0000,,find the sensitive location. The problem\Nhere is that the amount of energy that is
Dialogue: 0,0:42:51.33,0:42:55.24,Default,,0000,0000,0000,,deposited is really large due to the fact\Nthat it has to go through the whole
Dialogue: 0,0:42:55.24,0:42:59.05,Default,,0000,0000,0000,,silicon until it reaches the transistor.\NAnd therefore it's mostly used to find
Dialogue: 0,0:42:59.05,0:43:02.58,Default,,0000,0000,0000,,these destructive effects that really\Nbreak something in your circuit. The more
Dialogue: 0,0:43:02.58,0:43:07.97,Default,,0000,0000,0000,,clever and somehow beautiful experiment is\Nthe two photon absorption laser experiment
Dialogue: 0,0:43:07.97,0:43:12.62,Default,,0000,0000,0000,,in which you use two laser beams of a\Ndifferent wavelength. And these actually
Dialogue: 0,0:43:12.62,0:43:18.37,Default,,0000,0000,0000,,do not have enough energy to cause any\Neffect in your silicon. If only one of the
Dialogue: 0,0:43:18.37,0:43:22.17,Default,,0000,0000,0000,,laser beams is present, but only in the\Nsmall location where the two beams
Dialogue: 0,0:43:22.17,0:43:26.87,Default,,0000,0000,0000,,intersect, the energy is actually large\Nenough to produce the effect. And this
Dialogue: 0,0:43:26.87,0:43:30.66,Default,,0000,0000,0000,,allows you to very selectively and only on\Na very small volume induce charge and
Dialogue: 0,0:43:30.66,0:43:37.82,Default,,0000,0000,0000,,cause an effect in your circuit. And when\Nyou do that now, you can systematically
Dialogue: 0,0:43:37.82,0:43:41.96,Default,,0000,0000,0000,,scan both the X and Y directions across\Nyour chip and also the Z direction and can
Dialogue: 0,0:43:41.96,0:43:46.37,Default,,0000,0000,0000,,really measure the volume of sensitive\Narea. And this is what you would typically
Dialogue: 0,0:43:46.37,0:43:50.80,Default,,0000,0000,0000,,get of such an experiment. So in black and\Nwhite in the back, you'll see an infrared
Dialogue: 0,0:43:50.80,0:43:54.62,Default,,0000,0000,0000,,image of your chip where you can really\Nmake out the individual, say structural
Dialogue: 0,0:43:54.62,0:43:59.41,Default,,0000,0000,0000,,components. And then overlaid in blue, you\Ncan basically highlight all the sensitive
Dialogue: 0,0:43:59.41,0:44:03.90,Default,,0000,0000,0000,,points that made you measure something you\Ndidn't expect, some weird bit flip in a
Dialogue: 0,0:44:03.90,0:44:08.34,Default,,0000,0000,0000,,register or something. And you can really\Nthen go to your layout software and find
Dialogue: 0,0:44:08.34,0:44:13.64,Default,,0000,0000,0000,,what is the the register or the gate in\Nyour netlist that is responsible for
Dialogue: 0,0:44:13.64,0:44:17.46,Default,,0000,0000,0000,,this. And then it's more like operating a\Ndebugger in a software environment.
Dialogue: 0,0:44:17.46,0:44:22.89,Default,,0000,0000,0000,,Tracing back from there what the line of\Ncode responsible for this bug is. And
Dialogue: 0,0:44:22.89,0:44:31.26,Default,,0000,0000,0000,,to close out, it is always best to learn\Nfrom mistakes. And we offer our mistakes
Dialogue: 0,0:44:31.26,0:44:35.90,Default,,0000,0000,0000,,as a guideline for if you ever feel\Nyourself the need to design radiation
Dialogue: 0,0:44:35.90,0:44:40.70,Default,,0000,0000,0000,,tolerant circuits. So we want to present\Ntwo or three small issues we had and
Dialogue: 0,0:44:40.70,0:44:45.30,Default,,0000,0000,0000,,circuits where we were convinced it should\Nhave been working fine. So the first one
Dialogue: 0,0:44:45.30,0:44:50.02,Default,,0000,0000,0000,,this you will probably recognize is this\Nfull triple modular redundancy scheme that
Dialogue: 0,0:44:50.02,0:44:55.28,Default,,0000,0000,0000,,Szymon has presented. So we made sure to\Ntriplicate everything and we were relatively
Dialogue: 0,0:44:55.28,0:44:59.10,Default,,0000,0000,0000,,sure that everything should be fine. The\Nonly modification we did is that to all
Dialogue: 0,0:44:59.10,0:45:03.51,Default,,0000,0000,0000,,those registers in our design, we've added\Na reset, because we wanted to initialize
Dialogue: 0,0:45:03.51,0:45:07.71,Default,,0000,0000,0000,,the system to some known state when we\Nstarted up, which is a very obvious thing
Dialogue: 0,0:45:07.71,0:45:12.33,Default,,0000,0000,0000,,to do. Every CPU has a reset. But of\Ncourse, what we didn't think about here
Dialogue: 0,0:45:12.33,0:45:16.58,Default,,0000,0000,0000,,was that at some point there's a buffer\Ndriving this reset line somewhere. And if
Dialogue: 0,0:45:16.58,0:45:20.36,Default,,0000,0000,0000,,there's only a single buffer. What happens\Nif this buffer experiences a small
Dialogue: 0,0:45:20.36,0:45:24.50,Default,,0000,0000,0000,,transient event? Of course, the obvious\Nthing that happened is that as soon as
Dialogue: 0,0:45:24.50,0:45:28.25,Default,,0000,0000,0000,,that happened, all the registers were\Nupset at the same time and were basically
Dialogue: 0,0:45:28.25,0:45:32.20,Default,,0000,0000,0000,,cleared and all our fancy protection was\Ninvalidated. So next time we decided,
Dialogue: 0,0:45:32.20,0:45:37.68,Default,,0000,0000,0000,,let's be smarter this time. And of course,\Nwe triplicate all the logic and all the
Dialogue: 0,0:45:37.68,0:45:40.63,Default,,0000,0000,0000,,voters and all the registers. So let's\Nalso triplicate the reset lines. And while
Dialogue: 0,0:45:40.63,0:45:44.96,Default,,0000,0000,0000,,the designer of that block probably had\Nvery good intentions, it turned out
Dialogue: 0,0:45:44.96,0:45:49.27,Default,,0000,0000,0000,,that later than when we manufactured the\Nchip, it still sometimes showed a complete
Dialogue: 0,0:45:49.27,0:45:54.57,Default,,0000,0000,0000,,reset without any good explanation for\Nthat. And what was left out of the the
Dialogue: 0,0:45:54.57,0:45:59.98,Default,,0000,0000,0000,,scope of thinking here was that this reset\Nactually was connected to the system reset
Dialogue: 0,0:45:59.98,0:46:05.03,Default,,0000,0000,0000,,of the chip that we had. And typically\Npins are on the chip or something that is
Dialogue: 0,0:46:05.03,0:46:09.00,Default,,0000,0000,0000,,not available in huge quantities. So you\Ntypically don't want to spend three pins
Dialogue: 0,0:46:09.00,0:46:13.13,Default,,0000,0000,0000,,of your chip just for a stupid reset that\Nyou don't use ninety nine percent of the
Dialogue: 0,0:46:13.13,0:46:17.90,Default,,0000,0000,0000,,time. So what we did at some point we just\Nconnected again the reset lines to a
Dialogue: 0,0:46:17.90,0:46:21.97,Default,,0000,0000,0000,,single input buffer. That was then\Nconnected to a pin of the chip. And of
Dialogue: 0,0:46:21.97,0:46:25.59,Default,,0000,0000,0000,,course, this also represented a small\Nsensitive area in the chip. And again,
Dialogue: 0,0:46:25.59,0:46:30.22,Default,,0000,0000,0000,,a single upset here was able to destroy\Nall three of our flip flops. All right.
Dialogue: 0,0:46:30.22,0:46:35.13,Default,,0000,0000,0000,,And the last lesson I'm bringing or the\Nlast thing that goes back to the
Dialogue: 0,0:46:35.13,0:46:38.93,Default,,0000,0000,0000,,implementation details that Szymon has\Nmentioned. So this time, really simple
Dialogue: 0,0:46:38.93,0:46:42.53,Default,,0000,0000,0000,,circuit. We were absolutely convinced it\Nmust work because it was basically the
Dialogue: 0,0:46:42.53,0:46:46.07,Default,,0000,0000,0000,,textbook example that Szymon was\Npresenting. And the code was so
Dialogue: 0,0:46:46.07,0:46:49.82,Default,,0000,0000,0000,,small we were able to inspect everything\Nand were very much sure that nothing
Dialogue: 0,0:46:49.82,0:46:54.69,Default,,0000,0000,0000,,should have happened. And what we saw when\Nwe went for this laser testing experiment,
Dialogue: 0,0:46:54.69,0:46:59.77,Default,,0000,0000,0000,,in simplified form is basically that\Nonly this first voter. And when this was
Dialogue: 0,0:46:59.77,0:47:04.41,Default,,0000,0000,0000,,hit, always all our register was \Nupset while the other ones were
Dialogue: 0,0:47:04.41,0:47:09.16,Default,,0000,0000,0000,,never manifested to show anything strange.\NAnd it took us quite a while to actually
Dialogue: 0,0:47:09.16,0:47:13.56,Default,,0000,0000,0000,,look at the layout later on and figure out\Nthat what was in the chip was rather this.
Dialogue: 0,0:47:13.56,0:47:17.25,Default,,0000,0000,0000,,So two of the voters were actually not\Nthere. And Szymon mentioned the reason for
Dialogue: 0,0:47:17.25,0:47:21.21,Default,,0000,0000,0000,,that. So synthesis tool these days are\Nreally clever at identifying redundant
Dialogue: 0,0:47:21.21,0:47:26.10,Default,,0000,0000,0000,,logic and because we forgot to tell it to\Nnot optimize these redundant pieces of
Dialogue: 0,0:47:26.10,0:47:30.25,Default,,0000,0000,0000,,logic, which the voters really are. It\Njust merged them into one. And that
Dialogue: 0,0:47:30.25,0:47:34.39,Default,,0000,0000,0000,,explains why we only saw this one voter\Nbeing the sensitive one. And of course, if
Dialogue: 0,0:47:34.39,0:47:38.26,Default,,0000,0000,0000,,you have a transient event there, then you\Nsuddenly upset all your registers and that
Dialogue: 0,0:47:38.26,0:47:41.87,Default,,0000,0000,0000,,without even knowing it and with being\Nsure, having looked at every single line
Dialogue: 0,0:47:41.87,0:47:45.65,Default,,0000,0000,0000,,of verilog code and being very sure,\Neverything should have been fine. But that
Dialogue: 0,0:47:45.65,0:47:51.80,Default,,0000,0000,0000,,seems to be how this business goes. So we\Nhope we had been we had the chance and you
Dialogue: 0,0:47:51.80,0:47:56.65,Default,,0000,0000,0000,,were able to get some insight in in what\Nwe do to make sure the experiments at the
Dialogue: 0,0:47:56.65,0:48:01.97,Default,,0000,0000,0000,,LHC work fine. What you can do to\Nmake sure the satellite you are working on
Dialogue: 0,0:48:01.97,0:48:06.39,Default,,0000,0000,0000,,might be working OK. Even before launching\Nit into space, if you're interested into
Dialogue: 0,0:48:06.39,0:48:10.72,Default,,0000,0000,0000,,some more information on this topic, feel\Nfree to pass by at the assembly I
Dialogue: 0,0:48:10.72,0:48:15.01,Default,,0000,0000,0000,,mentioned at the beginning or just meet us\Nafter the talk and otherwise thank you
Dialogue: 0,0:48:15.01,0:48:22.29,Default,,0000,0000,0000,,very much.\N{\i1}Applause{\i0}
Dialogue: 0,0:48:22.29,0:48:27.04,Default,,0000,0000,0000,,Herald: Thank you very much indeed.\NThere's about 10 minutes left for Q and A,
Dialogue: 0,0:48:27.04,0:48:31.87,Default,,0000,0000,0000,,so if you have any questions go to a\Nmicrophone. And as a cautious reminder,
Dialogue: 0,0:48:31.87,0:48:38.30,Default,,0000,0000,0000,,questions are short sentences with. That\Nstarts with a question. Well, ends with a
Dialogue: 0,0:48:38.30,0:48:42.55,Default,,0000,0000,0000,,question mark and the first question goes\Nto the Internet.
Dialogue: 0,0:48:42.55,0:48:46.43,Default,,0000,0000,0000,,Internet: Well, hello. Um, do you also\Nincorporate radiation as the source for
Dialogue: 0,0:48:46.43,0:48:50.60,Default,,0000,0000,0000,,randomness when that's needed?\NStefan: So we personally don't. So in our
Dialogue: 0,0:48:50.60,0:48:56.88,Default,,0000,0000,0000,,designs we don't. But it is done indeed\Nfor a random number generator. This is
Dialogue: 0,0:48:56.88,0:49:01.08,Default,,0000,0000,0000,,sometimes done that they use radioactive\Ndecay as a source for randomness. So this
Dialogue: 0,0:49:01.08,0:49:03.99,Default,,0000,0000,0000,,is done, but we don't do it in our\Nexperiments.
Dialogue: 0,0:49:03.99,0:49:06.80,Default,,0000,0000,0000,,We rather want deterministic data out of\Nthe things we built.
Dialogue: 0,0:49:06.80,0:49:10.93,Default,,0000,0000,0000,,Herald: Okay. Next question goes to\Nmicrophone number four.
Dialogue: 0,0:49:10.93,0:49:16.71,Default,,0000,0000,0000,,Mic 4: Do you do your tripplication before\Nor after elaboration?
Dialogue: 0,0:49:16.71,0:49:21.00,Default,,0000,0000,0000,,Szymon: So currently we do it before\Nelaboration. So we decided that our tool
Dialogue: 0,0:49:21.00,0:49:25.76,Default,,0000,0000,0000,,works on verilog input and it produces\Nverilog output because it offers much more
Dialogue: 0,0:49:25.76,0:49:30.50,Default,,0000,0000,0000,,flexibility in the way how you can\Nincorporate different tripplication
Dialogue: 0,0:49:30.50,0:49:34.42,Default,,0000,0000,0000,,schemes. If you were to apply to only\Nafter elaboration, then of course doing a
Dialogue: 0,0:49:34.42,0:49:38.45,Default,,0000,0000,0000,,full tripplication might be easy. But then\Nyou - to having a really precise control
Dialogue: 0,0:49:38.45,0:49:43.44,Default,,0000,0000,0000,,or on types of tripplication on different\Nlevels is much more difficult.
Dialogue: 0,0:49:43.44,0:49:47.30,Default,,0000,0000,0000,,Herald: Next question from microphone\Nnumber two.
Dialogue: 0,0:49:47.30,0:49:50.84,Default,,0000,0000,0000,,Mic 2: Is it possible to use DCDC\Nconverters or switch mode power supplies
Dialogue: 0,0:49:50.84,0:49:54.63,Default,,0000,0000,0000,,within the radiation environment to power\Nyour logic? Or you use only linear power?
Dialogue: 0,0:49:54.63,0:49:59.87,Default,,0000,0000,0000,,Szymon: Yes, alternatively we also have a\Ndedicated program which develops radiation
Dialogue: 0,0:49:59.87,0:50:05.37,Default,,0000,0000,0000,,hardened DCDC converters who operate\Nin our environments. So they are available
Dialogue: 0,0:50:05.37,0:50:10.99,Default,,0000,0000,0000,,also for space applications, as far as I'm\Naware. And they are hardened against total
Dialogue: 0,0:50:10.99,0:50:16.03,Default,,0000,0000,0000,,ionizing dose as well as single event\Nupsets.
Dialogue: 0,0:50:16.03,0:50:19.67,Default,,0000,0000,0000,,Herald: Okay next question goes to\Nmicrophone number one.
Dialogue: 0,0:50:19.67,0:50:22.61,Default,,0000,0000,0000,,Mic 1: Thank you very much for the great\Ntalk. I'm just wondering, would it be
Dialogue: 0,0:50:22.61,0:50:27.44,Default,,0000,0000,0000,,possible to hook up every logic gate in\Nevery water in a way of mesh network? And
Dialogue: 0,0:50:27.44,0:50:31.87,Default,,0000,0000,0000,,what are the pitfalls and limitations for\Nthat?
Dialogue: 0,0:50:31.87,0:50:36.73,Default,,0000,0000,0000,,Stefan: So that is not something I'm aware\Nof, of being done. So typically: No. I
Dialogue: 0,0:50:36.73,0:50:41.47,Default,,0000,0000,0000,,wouldn't say that that's something we\Nwould do.
Dialogue: 0,0:50:41.47,0:50:43.43,Default,,0000,0000,0000,,Szymon: I'm not really sure if I\Nunderstood the question.
Dialogue: 0,0:50:43.43,0:50:46.40,Default,,0000,0000,0000,,Stefan: So maybe you can rephrase what\Nyour idea is?
Dialogue: 0,0:50:46.40,0:50:52.61,Default,,0000,0000,0000,,Mic 1: On the last slide, there were a\Nlesson learned.
Dialogue: 0,0:50:52.61,0:50:56.25,Default,,0000,0000,0000,,Stefan: Yes. One of those?\NMic 1: In here. Yeah. Would you be able to
Dialogue: 0,0:50:56.25,0:51:00.31,Default,,0000,0000,0000,,connect everything interchangeably in a\Nmesh network?
Dialogue: 0,0:51:00.31,0:51:04.03,Default,,0000,0000,0000,,Szymon: So what you are probably asking\Nabout is whether we can build our own
Dialogue: 0,0:51:04.03,0:51:08.17,Default,,0000,0000,0000,,FPGA, like programable logic device.\NMic 1: Probably.
Dialogue: 0,0:51:08.17,0:51:11.07,Default,,0000,0000,0000,,Szymon: Yeah. And so this we typically\Ndon't do, because in our experiments, our
Dialogue: 0,0:51:11.07,0:51:15.86,Default,,0000,0000,0000,,power budget is also very limited, so we\Ncannot really afford this level of
Dialogue: 0,0:51:15.86,0:51:20.90,Default,,0000,0000,0000,,complexity. So of course you can make your\NFPGA design radiation hard, but this is
Dialogue: 0,0:51:20.90,0:51:24.89,Default,,0000,0000,0000,,not what we will typically do in our\Nexperiments.
Dialogue: 0,0:51:24.89,0:51:28.63,Default,,0000,0000,0000,,Herald: Next question goes to microphone\Nnumber two.
Dialogue: 0,0:51:28.63,0:51:32.06,Default,,0000,0000,0000,,Mic 2: Hi, I would like to ask if the\Norientation of your transistors and your
Dialogue: 0,0:51:32.06,0:51:38.03,Default,,0000,0000,0000,,chip is part of your design. So mostly you\Nhave something like a bounding box around
Dialogue: 0,0:51:38.03,0:51:42.92,Default,,0000,0000,0000,,your design and with an attack surface in\Ndifferent sizes. So do you use this
Dialogue: 0,0:51:42.92,0:51:48.35,Default,,0000,0000,0000,,orientation to minimize the attack surface\Nof the radiation on chips, if you know
Dialogue: 0,0:51:48.35,0:51:52.62,Default,,0000,0000,0000,,the source of the radiation?\NSzymon: No. So I don't think we'd do that.
Dialogue: 0,0:51:52.62,0:51:58.52,Default,,0000,0000,0000,,So, of course, we control our orientation\Nof transistors during the design phase.
Dialogue: 0,0:51:58.52,0:52:02.65,Default,,0000,0000,0000,,But usually in our experiment, the\Nradiation is really perpendicular to the
Dialogue: 0,0:52:02.65,0:52:07.98,Default,,0000,0000,0000,,chip area, which means that if you rotate\Nit by 90 degrees, you don't really gain
Dialogue: 0,0:52:07.98,0:52:12.08,Default,,0000,0000,0000,,that much. And moreover, our chips,\Nusually they are mounted in a bigger
Dialogue: 0,0:52:12.08,0:52:16.62,Default,,0000,0000,0000,,system where we don't control how they are\Noriented.
Dialogue: 0,0:52:16.62,0:52:24.42,Default,,0000,0000,0000,,Herald: Again, microphone number two.\NMic 2: Do you take meta stability into
Dialogue: 0,0:52:24.42,0:52:33.14,Default,,0000,0000,0000,,account when designing voters?\NSzymon: The voter itself is combinatorial.
Dialogue: 0,0:52:33.14,0:52:38.82,Default,,0000,0000,0000,,So ... -\NMic 2: Yeah, but if the state of the rest
Dialogue: 0,0:52:38.82,0:52:45.30,Default,,0000,0000,0000,,can change in any time that then the\Nvoters can have like glitches, yeah?
Dialogue: 0,0:52:45.30,0:52:51.14,Default,,0000,0000,0000,,Szymon: Correct. So that's why - so to\Navoid this, we don't take it into account
Dialogue: 0,0:52:51.14,0:52:55.06,Default,,0000,0000,0000,,during the design phase. But if we use\Nthat scheme which is just displayed here,
Dialogue: 0,0:52:55.06,0:52:58.98,Default,,0000,0000,0000,,we avoid this problem altogether, right?\NBecause even if you have meta stability in
Dialogue: 0,0:52:58.98,0:53:05.30,Default,,0000,0000,0000,,one of the blocks like A, B or C, then it\Nwill be fixed in the next clock cycle.
Dialogue: 0,0:53:05.30,0:53:09.94,Default,,0000,0000,0000,,Because usually our systems operate on\Nclocks with low frequencies, hundreds of
Dialogue: 0,0:53:09.94,0:53:13.24,Default,,0000,0000,0000,,megahertz, which means that any meta\Nstability should be resolved by the next
Dialogue: 0,0:53:13.24,0:53:15.06,Default,,0000,0000,0000,,clock cycle.\NMic 2: Thank you.
Dialogue: 0,0:53:15.06,0:53:19.14,Default,,0000,0000,0000,,Herald: Next question microphone number\None.
Dialogue: 0,0:53:19.14,0:53:23.01,Default,,0000,0000,0000,,Mic 1: How do you handle the register\Nduplication that can be performed by a
Dialogue: 0,0:53:23.01,0:53:27.95,Default,,0000,0000,0000,,synthesis and pleasant route? So the tools\Nwill try to optimize timing sometimes by
Dialogue: 0,0:53:27.95,0:53:32.38,Default,,0000,0000,0000,,adding registers. And these registers are\Nnot trippled.
Dialogue: 0,0:53:32.38,0:53:35.78,Default,,0000,0000,0000,,Stefan: Yes. So what we do is that I mean,\Nin a typical, let's say, standard ASIC
Dialogue: 0,0:53:35.78,0:53:40.40,Default,,0000,0000,0000,,design flaw, this is not what happens. So\Nyou have to actually instruct a tool to do
Dialogue: 0,0:53:40.40,0:53:44.58,Default,,0000,0000,0000,,that, to do re timing and add additional\Nregisters. But for what we are doing, we
Dialogue: 0,0:53:44.58,0:53:48.17,Default,,0000,0000,0000,,have to - let's say not do this\Noptimization and instruct a tool to keep
Dialogue: 0,0:53:48.17,0:53:52.82,Default,,0000,0000,0000,,all the registers we described in our RTL\Ncode to keep them until the very end. And
Dialogue: 0,0:53:52.82,0:53:56.91,Default,,0000,0000,0000,,we realy also constrain them to always\Nkeep their associated logic tripplicated.
Dialogue: 0,0:53:56.91,0:54:01.76,Default,,0000,0000,0000,,Herald: The next question is from the\Ninternet.
Dialogue: 0,0:54:01.76,0:54:07.89,Default,,0000,0000,0000,,Internet: Do you have some simple tips for\Nimproving radiation tolerance?
Dialogue: 0,0:54:07.89,0:54:12.02,Default,,0000,0000,0000,,Stefan: Simple tips? Ahhhm...\NSzymon: Put your electronics inside a
Dialogue: 0,0:54:12.02,0:54:12.82,Default,,0000,0000,0000,,box.\NStefan: Yes.
Dialogue: 0,0:54:12.82,0:54:17.38,Default,,0000,0000,0000,,{\i1}some laughter{\i0}\NThere's there's just no
Dialogue: 0,0:54:17.38,0:54:22.98,Default,,0000,0000,0000,,single one size fits all textbook recipe\Nfor this as it really always comes down to
Dialogue: 0,0:54:22.98,0:54:28.02,Default,,0000,0000,0000,,analyzing your environment, really getting\Nan awareness first of what rate and what
Dialogue: 0,0:54:28.02,0:54:31.94,Default,,0000,0000,0000,,number of events you are looking at, what\Ntype of particles cause them, and then
Dialogue: 0,0:54:31.94,0:54:36.42,Default,,0000,0000,0000,,take the appropriate measures to mitigate\Nthem. So there is no one size fits all
Dialogue: 0,0:54:36.42,0:54:38.10,Default,,0000,0000,0000,,thing I say.\NHerald: Next question goes from mycrophone
Dialogue: 0,0:54:38.10,0:54:41.62,Default,,0000,0000,0000,,number two.\NMic 2: Hi. Thanks for the talk. How much
Dialogue: 0,0:54:41.62,0:54:47.61,Default,,0000,0000,0000,,of your software used to design is\Nactually open source? I only know a super
Dialogue: 0,0:54:47.61,0:54:54.50,Default,,0000,0000,0000,,expensive chip design software.\NStefan: You write the core of all the
Dialogue: 0,0:54:54.50,0:55:00.60,Default,,0000,0000,0000,,implementation tools like the synthesis\Nand place and route stage for the ASICS,
Dialogue: 0,0:55:00.60,0:55:04.99,Default,,0000,0000,0000,,that we design is actually a commercial\Nclosed source tools. And if
Dialogue: 0,0:55:04.99,0:55:10.44,Default,,0000,0000,0000,,you're asking for the fraction, that's a\Nbit hard to answer. I cannot give a
Dialogue: 0,0:55:10.44,0:55:14.52,Default,,0000,0000,0000,,statement about the size of the commercial\Nclosed tools. But we tried to do
Dialogue: 0,0:55:14.52,0:55:18.64,Default,,0000,0000,0000,,everything we develop, tried to make it\Navailable to the widest possible audience
Dialogue: 0,0:55:18.64,0:55:22.35,Default,,0000,0000,0000,,and therefore decided to make the\Nextensions to this design flaw available
Dialogue: 0,0:55:22.35,0:55:26.24,Default,,0000,0000,0000,,in public form. And that's why these\Ntools that we develop and share among the
Dialogue: 0,0:55:26.24,0:55:30.54,Default,,0000,0000,0000,,community of ASIC designers and this\Nenvironment are open source.
Dialogue: 0,0:55:30.54,0:55:35.20,Default,,0000,0000,0000,,Herald: Microphone number four.\NMic 4: Have you ever tried using steered
Dialogue: 0,0:55:35.20,0:55:41.10,Default,,0000,0000,0000,,iron beams for more localized, radiation\Ningress testing?
Dialogue: 0,0:55:41.10,0:55:44.50,Default,,0000,0000,0000,,Stefan: Yes, indeed! And the picture I\Nshowed actually, uh, didn't disclaimer
Dialogue: 0,0:55:44.50,0:55:49.31,Default,,0000,0000,0000,,that, but the facility you saw here is\Nactually a facility in Darmstadt in
Dialogue: 0,0:55:49.31,0:55:53.37,Default,,0000,0000,0000,,Germany and is actually a micro beam\Nfacility. So it's a facility that allows
Dialogue: 0,0:55:53.37,0:55:58.40,Default,,0000,0000,0000,,steering a heavy ion beam really on a\Nsingle position with less than a
Dialogue: 0,0:55:58.40,0:56:01.81,Default,,0000,0000,0000,,micrometer accuracy. So it provides\Nprobably exactly what you were asking for.
Dialogue: 0,0:56:01.81,0:56:05.85,Default,,0000,0000,0000,,But that's not the typical case. That is\Nreally a special thing. And it's probably
Dialogue: 0,0:56:05.85,0:56:09.40,Default,,0000,0000,0000,,also the only facility in Europe that can\Ndo that.
Dialogue: 0,0:56:09.40,0:56:13.32,Default,,0000,0000,0000,,Herald: Microphone number one.\NMic 1: Was very good very good talk. Thank
Dialogue: 0,0:56:13.32,0:56:19.28,Default,,0000,0000,0000,,you very much. My question is, did you\Ncompare what you did to what is done for
Dialogue: 0,0:56:19.28,0:56:25.38,Default,,0000,0000,0000,,securing secret chips? You know, when you\Nhave credit card chips, you can make fault
Dialogue: 0,0:56:25.38,0:56:29.95,Default,,0000,0000,0000,,attacks into them so you can make them\Nmalfunction and extract the cryptographic
Dialogue: 0,0:56:29.95,0:56:33.83,Default,,0000,0000,0000,,key for example from the banking card.\NThere are techniques here to harden these
Dialogue: 0,0:56:33.83,0:56:38.21,Default,,0000,0000,0000,,chips against fault attacks. So which are\Nlike voluntary faults while you have like
Dialogue: 0,0:56:38.21,0:56:43.12,Default,,0000,0000,0000,,random less faults due to like involatility\Nattacks. You know what? Can you explain if
Dialogue: 0,0:56:43.12,0:56:47.29,Default,,0000,0000,0000,,you compared in a way what you did to\Nthis?
Dialogue: 0,0:56:47.29,0:56:50.86,Default,,0000,0000,0000,,Stefan: Um, so no, we didn't explicitly\Ncompared it, but it is right that the
Dialogue: 0,0:56:50.86,0:56:54.43,Default,,0000,0000,0000,,techniques we present can also be used in\Na variety of different contexts. So one
Dialogue: 0,0:56:54.43,0:56:59.13,Default,,0000,0000,0000,,thing that's not exactly what you are\Nreferring to, but relatively on a similar
Dialogue: 0,0:56:59.13,0:57:03.51,Default,,0000,0000,0000,,scale is that currently in very small\Ntechnologies you get two problems with the
Dialogue: 0,0:57:03.51,0:57:07.86,Default,,0000,0000,0000,,reliability and yield of the manufacturing\Nprocess itself, meaning that sometimes
Dialogue: 0,0:57:07.86,0:57:11.72,Default,,0000,0000,0000,,just the metal interconnection between two\Ngates and your circuit might be broken
Dialogue: 0,0:57:11.72,0:57:16.30,Default,,0000,0000,0000,,after manufacturing and then adding the\Nsort of redundancy with the same kinds of
Dialogue: 0,0:57:16.30,0:57:20.58,Default,,0000,0000,0000,,techniques can be used to make, to\Nproduce more working chips out of a
Dialogue: 0,0:57:20.58,0:57:24.72,Default,,0000,0000,0000,,manufacturing run. So in this sort of\Ncontext, these sorts of techniques are
Dialogue: 0,0:57:24.72,0:57:30.67,Default,,0000,0000,0000,,used very often these days. But, um, I'm\Nand I'm pretty sure they can be applied to
Dialogue: 0,0:57:30.67,0:57:34.95,Default,,0000,0000,0000,,these sorts of, uh, security fault attack\Nscenarios as well.
Dialogue: 0,0:57:34.95,0:57:39.70,Default,,0000,0000,0000,,Herald: Next question from microphone\Nnumber two.
Dialogue: 0,0:57:39.70,0:57:44.13,Default,,0000,0000,0000,,Mic 2: Hi, you briefly also mentioned the\Nmitigation techniques on the cell level
Dialogue: 0,0:57:44.13,0:57:52.43,Default,,0000,0000,0000,,and yesterday there was a very nice talk\Nfrom the Libre Silicon people and they
Dialogue: 0,0:57:52.43,0:57:55.91,Default,,0000,0000,0000,,are trying to build a standard cell\Nlibrary, uh, open source standard cell
Dialogue: 0,0:57:55.91,0:58:00.02,Default,,0000,0000,0000,,library. So are you in contact with them\Nor maybe you could help them to improve
Dialogue: 0,0:58:00.02,0:58:03.98,Default,,0000,0000,0000,,their design and then the radiation\Nhardness?
Dialogue: 0,0:58:03.98,0:58:07.43,Default,,0000,0000,0000,,Stefan: No. We also saw the talk\Nyesterday, but we are not yet in
Dialogue: 0,0:58:07.43,0:58:14.18,Default,,0000,0000,0000,,contact with them. No.\NHerald: Does the Internet have questions?
Dialogue: 0,0:58:14.18,0:58:21.38,Default,,0000,0000,0000,,Internet: Yes, I do. Um, two in fact.\NFirst one would be would TTL or other BJT
Dialogue: 0,0:58:21.38,0:58:26.74,Default,,0000,0000,0000,,based logic be more resistant?\NSzymon: Uh, yeah. So depending on which
Dialogue: 0,0:58:26.74,0:58:31.13,Default,,0000,0000,0000,,type of errors we are considering. So BJT\Ntransistors, they have ...
Dialogue: 0,0:58:31.13,0:58:35.92,Default,,0000,0000,0000,,Stefan in his part mentioned that\Ndisplacement damage is not a problem for
Dialogue: 0,0:58:35.92,0:58:40.30,Default,,0000,0000,0000,,seamless devices, but it is not the case\Nfor BJT devices. So when they are exposed
Dialogue: 0,0:58:40.30,0:58:47.07,Default,,0000,0000,0000,,to high energy hadrons or protons,\Nthey degrade a lot. So that's why we don't
Dialogue: 0,0:58:47.07,0:58:52.39,Default,,0000,0000,0000,,use them in really our environment. They\Ncould be probably much more robust to
Dialogue: 0,0:58:52.39,0:58:57.37,Default,,0000,0000,0000,,single event effects because their\Nresistance everywhere is much lower. But
Dialogue: 0,0:58:57.37,0:59:01.63,Default,,0000,0000,0000,,they would have other problems. And also\Nanother problem which is worth
Dialogue: 0,0:59:01.63,0:59:06.20,Default,,0000,0000,0000,,mentioning is that for those devices, they\Nconsume much, much, much more power, which
Dialogue: 0,0:59:06.20,0:59:13.04,Default,,0000,0000,0000,,we cannot afford in our applications.\NInternet: And the last one would be how do
Dialogue: 0,0:59:13.04,0:59:19.40,Default,,0000,0000,0000,,I use the output of the full TMR setup? Is\Nit still three signals? How do I know
Dialogue: 0,0:59:19.40,0:59:26.26,Default,,0000,0000,0000,,which one to use and to trust?\NStefan: Um, yes. So with this, um,
Dialogue: 0,0:59:26.26,0:59:30.05,Default,,0000,0000,0000,,architecture, what you could either do is\Nreally do the full triplication scheme
Dialogue: 0,0:59:30.05,0:59:34.80,Default,,0000,0000,0000,,to your whole logic tree basically and\Nreally triplicate everything or, and
Dialogue: 0,0:59:34.80,0:59:38.90,Default,,0000,0000,0000,,that's going in the direction of one of\Nthe lessons learned I had, at some point
Dialogue: 0,0:59:38.90,0:59:43.26,Default,,0000,0000,0000,,of course you have an interface to your\Nchip, so you have pins left and right that
Dialogue: 0,0:59:43.26,0:59:46.63,Default,,0000,0000,0000,,are inputs and outputs. And then you have\Nto decide either you want to spend the
Dialogue: 0,0:59:46.63,0:59:51.02,Default,,0000,0000,0000,,effort and also have three dedicated input\Npins for each of the signals, or you at
Dialogue: 0,0:59:51.02,0:59:54.26,Default,,0000,0000,0000,,some point have the voter and say, okay.\NAt this point, all these signals are
Dialogue: 0,0:59:54.26,0:59:58.20,Default,,0000,0000,0000,,combined. But I was able to reduce the\Namount of sensitive area in my chip
Dialogue: 0,0:59:58.20,1:00:03.78,Default,,0000,0000,0000,,significantly and can live with the very\Nsmall remaining sensitive area that just
Dialogue: 0,1:00:03.78,1:00:07.46,Default,,0000,0000,0000,,the input and output pins provide.\NSzymon: So maybe I will add one more thing
Dialogue: 0,1:00:07.46,1:00:11.78,Default,,0000,0000,0000,,is that typically in our systems, of\Ncourse we triplicate our logic internally,
Dialogue: 0,1:00:11.78,1:00:15.30,Default,,0000,0000,0000,,but when we interface with external\Nworld, we can apply another protection
Dialogue: 0,1:00:15.30,1:00:20.34,Default,,0000,0000,0000,,mechanism. So for example, for our high\Nspeed serialisers, we will use different types
Dialogue: 0,1:00:20.34,1:00:23.73,Default,,0000,0000,0000,,of encoding to add protect..., \Nto add like forward error correction
Dialogue: 0,1:00:23.73,1:00:30.34,Default,,0000,0000,0000,,codes which would allow us to recover these\Ntype of faults in the backend later on.
Dialogue: 0,1:00:30.34,1:00:36.52,Default,,0000,0000,0000,,Herald: Okay. If ...if we keep this very,\Nvery short. Last question goes to
Dialogue: 0,1:00:36.52,1:00:41.40,Default,,0000,0000,0000,,microphone number two.\NMic 2: I don't know much about physics. So
Dialogue: 0,1:00:41.40,1:00:47.37,Default,,0000,0000,0000,,just the question, how important is the\Nphysical testing after the chip is
Dialogue: 0,1:00:47.37,1:00:51.90,Default,,0000,0000,0000,,manufactured? Isn't the simulation, the\Ncomputer simulation enough if you just
Dialogue: 0,1:00:51.90,1:00:56.33,Default,,0000,0000,0000,,shoot particles at it?\NStefan: Yes and no. So in principle, of
Dialogue: 0,1:00:56.33,1:01:01.27,Default,,0000,0000,0000,,course, you are right that you should be\Nable to simulate all the effects we look
Dialogue: 0,1:01:01.27,1:01:06.53,Default,,0000,0000,0000,,at. The problem is that as the designs\Ngrow big and they do grow bigger as the
Dialogue: 0,1:01:06.53,1:01:10.89,Default,,0000,0000,0000,,technologies shrink, so\Nthis final net list that you end up with
Dialogue: 0,1:01:10.89,1:01:15.18,Default,,0000,0000,0000,,can have millions or billions of nodes and\Nit just is not feasible anymore to
Dialogue: 0,1:01:15.18,1:01:19.56,Default,,0000,0000,0000,,simulate it exhaustively because you have\Nto have so many dimensions. You have to
Dialogue: 0,1:01:19.56,1:01:25.85,Default,,0000,0000,0000,,change when you inject. For example, bit\Nflips or transients in your design in any
Dialogue: 0,1:01:25.85,1:01:30.74,Default,,0000,0000,0000,,of those nodes for varying time offsets.\NAnd it's just the state space the circuit
Dialogue: 0,1:01:30.74,1:01:34.55,Default,,0000,0000,0000,,can be in is just too huge to capture in a\Nin a full simulation. So it's not possible
Dialogue: 0,1:01:34.55,1:01:38.80,Default,,0000,0000,0000,,to exhaustively test it in simulation. And\Nso typically you end up with having missed
Dialogue: 0,1:01:38.80,1:01:43.05,Default,,0000,0000,0000,,something that you discover only in the\Nphysical testing afterwards, which you
Dialogue: 0,1:01:43.05,1:01:47.31,Default,,0000,0000,0000,,always want to do before you put your, uh,\Nyour chip into final experiment or on your
Dialogue: 0,1:01:47.31,1:01:50.93,Default,,0000,0000,0000,,satellite and then realise it's it's not\Nworking as intended. So it has a big
Dialogue: 0,1:01:50.93,1:01:55.54,Default,,0000,0000,0000,,importance as well.\NHerald: Okay. Thank you. Time is up. All
Dialogue: 0,1:01:55.54,1:01:58.58,Default,,0000,0000,0000,,right. Thank you all very much.
Dialogue: 0,1:01:58.58,1:02:04.60,Default,,0000,0000,0000,,{\i1}applause{\i0}
Dialogue: 0,1:02:04.60,1:02:09.60,Default,,0000,0000,0000,,{\i1}36c3 postroll music{\i0}
Dialogue: 0,1:02:09.60,1:02:32.10,Default,,0000,0000,0000,,Subtitles created by c3subtitles.de\Nin the year 2021. Join, and help us!