3.4 Error Handling
87
Another option that has been employed is to triplicate the modules containing
the registers that should be protected. This was used for the global- and channelconfiguration register modules, as all the registers needed protection and it made for
cleaner code in the core module. The drawback of the method is that all registers
need to exit the module to connect to the majority voter one level up, and then the
voted signal needs to go down into the core modules again. This amounts to a lot of
wiring and extra work connecting modules and signals together. It is also prone to
mistakes if register widths are changed or registers are added or removed.
To avoid that the synthesis tool simplifies the modules into one, a suffix
“_MODTMR” is added to the top module and the tool is told not to do any optimization/simplification in the module. The drawback is that this also prevents the
tool from doing beneficial simplifications to the other logic in these modules. The
SAMPA only uses this method for the global and channel register units, as they
contain mostly registers. It is also applied to the I
2 C slave module as the code was
supplied in this form by CERN.
3.4.2 Single Event Transient Handling
In a TMR protected design, there is still a possibility of having SETs that alter the
value of a signal interconnecting two registers. As this value will propagate to all
three registers of the TMR, the value will be latched by them all, and the state of the
system will have been changed to an incorrect one.
Normally SETs are mitigated by triplication of all the logic in the design, including
the clock and reset nets. This comes in addition to the triplication of the registers,
so there are effectively three separate versions of the design. Voting between the
designs is done as normal after each register. As the probability of getting SETs are
in general low, the amount of extra area that triplication of the full design would
require was not considered justified.
The design includes preventative measures to at least avoid that SETs create
functional errors by making sure all state machines return to an error state in case
invalid combinations of input signals are provided to the state machine. Data taking
for the channel will be halted until the next triggered time window is started.
3.4.3 Upsets in Data Memory
Since the design uses a separate memory for the header and payload data, and since
the length of the payload for a given header is encoded in the header, it is important
to protect the header memory against upsets. This is so that when it is time to read
out a packet from memory, the correct amount of words is read out from the data
memory. The header is therefore encoded with Hamming(50,43), including an extra
parity bit for SECDED, which protect the pointer from single errors. The header is
87
Another option that has been employed is to triplicate the modules containing
the registers that should be protected. This was used for the global- and channelconfiguration register modules, as all the registers needed protection and it made for
cleaner code in the core module. The drawback of the method is that all registers
need to exit the module to connect to the majority voter one level up, and then the
voted signal needs to go down into the core modules again. This amounts to a lot of
wiring and extra work connecting modules and signals together. It is also prone to
mistakes if register widths are changed or registers are added or removed.
To avoid that the synthesis tool simplifies the modules into one, a suffix
“_MODTMR” is added to the top module and the tool is told not to do any optimization/simplification in the module. The drawback is that this also prevents the
tool from doing beneficial simplifications to the other logic in these modules. The
SAMPA only uses this method for the global and channel register units, as they
contain mostly registers. It is also applied to the I
2 C slave module as the code was
supplied in this form by CERN.
3.4.2 Single Event Transient Handling
In a TMR protected design, there is still a possibility of having SETs that alter the
value of a signal interconnecting two registers. As this value will propagate to all
three registers of the TMR, the value will be latched by them all, and the state of the
system will have been changed to an incorrect one.
Normally SETs are mitigated by triplication of all the logic in the design, including
the clock and reset nets. This comes in addition to the triplication of the registers,
so there are effectively three separate versions of the design. Voting between the
designs is done as normal after each register. As the probability of getting SETs are
in general low, the amount of extra area that triplication of the full design would
require was not considered justified.
The design includes preventative measures to at least avoid that SETs create
functional errors by making sure all state machines return to an error state in case
invalid combinations of input signals are provided to the state machine. Data taking
for the channel will be halted until the next triggered time window is started.
3.4.3 Upsets in Data Memory
Since the design uses a separate memory for the header and payload data, and since
the length of the payload for a given header is encoded in the header, it is important
to protect the header memory against upsets. This is so that when it is time to read
out a packet from memory, the correct amount of words is read out from the data
memory. The header is therefore encoded with Hamming(50,43), including an extra
parity bit for SECDED, which protect the pointer from single errors. The header is