This application note describes the implementation of Intel^® Intel^® Arria^® 10 single event upset (SEU) detection and recovery features by presenting the following information:

• Error detection and correction feature architecture in Intel^® Arria^® 10 devices.
• General implementation guidelines for error detection cyclic redundancy check (EDCRC) and error correction feature.
• General implementation guidelines for embedded memory error correction code (ECC) feature.
• Intel^® Arria^® 10 EDCRC reference design with detailed development flow.

In user mode, the contents of the configured configuration RAM (CRAM) bits can be affected by soft errors. These soft errors, which are caused by an ionizing particle, are not common in Intel FPGA devices. However, high-reliability applications that require error-free device operation may require your design to consider these errors.

The hardened on-chip EDCRC circuitry allows you to perform the following operations without any impact on the fitting or performance of the device:

• Auto-detection of cyclic redundancy check (CRC) errors during configuration.
• Optional soft errors (SEU and multiple bit upset) detection and identification in user mode.
• Fast soft error detection. The error detection speed is improved.
• Two types of check-bits:
  • Frame-based check-bits—stored in CRAM and used to verify the integrity of the frame.
  • Column-based check-bits—stored in registers and used to protect integrity of all frames.

During error detection in user mode, a number of EDCRC engines run in parallel for Intel^® Arria^® 10 devices. The number of error detection CRC engines depends on the frame length—total bits in a frame.

Each column-based error detection CRC engine reads 128 bits from each frame and processes within four cycles. To detect errors, the error detection CRC engine needs to read back all frames.

Intel^® Arria^® 10 devices support the internal scrubbing capability. The internal scrubbing feature corrects correctable CRAM upsets automatically when an upset is detected. However, internal scrubbing can not fix the FPGA to a known good state. The time between the error and completion of scrubbing can be tens of millisecond. This duration represents thousands of clock cycles in which the corrupted data was written to memory or status registers. It is a good practice to always follow any SEU event with a soft-reset to bring the FPGA operation to a known good state.

If a soft-reset is unable to bring the FPGA to a known good state, you can reconfigure the device to rewrite the CRAM and reinitialize the design registers. The system that hosts the Intel^® Arria^® 10 device must control the device reconfiguration. When reconfiguration completes successfully, the Intel^® Arria^® 10 device operates as intended.

ECC allows you to detect and correct data errors at the output of the memory. ECC can perform single-error correction, double-adjacent-error correction, and triple-adjacent-error detection in a 32-bit word. However, ECC cannot detect four or more errors.

The M20K blocks have built-in support for ECC when in x32-wide simple dual-port mode:

• The M20K runs slower than non-ECC simple-dual port mode when ECC is engaged. However, you can enable optional ECC pipeline registers before the output decoder to achieve higher performance compared to non-pipeline ECC mode at the expense of one cycle of latency.
• The M20K ECC status is communicated with two ECC status flag signals—e (error) and ue (uncorrectable error). The status flags are part of the regular output from the memory block. When ECC is engaged, you cannot access two of the parity bits because the ECC status flag replaces them.

There are two methods to turn on Intel^® Arria^® 10 error detection CRC feature based on your application needs.

• If your design detects and reads the EMR using user logic, you need to instantiate the EMR Unloader IP core which will automatically turn the EDCRC feature on.
• If you want to monitor SEU with the external host and do not need to read the EMR from user logic, you can turn on EDCRC feature by enabling CRC_ERROR pin in your Intel^® Quartus^® Prime project.

To enable the CRC_ERROR pin for external host monitoring purpose, perform the following steps:

1. On the Assignments menu, click Device.
2. Click Device and Pin Options and select the Error Detection CRC at the left panel.
3. Check the Enable Error Detection CRC_ERROR pin.
4. Select the EDCRC clock divisor from the list of Divide error check frequency by.
   Note: This option provides you with a flexibility to run the EDCRC at a slower speed. However, Intel recommends you to set to the smallest EDCRC clock divisor. Setting a high divisor can impact the error detection time performance. Refer to Arria 10 Handbook SEU Mitigation chapter of the Arria 10 handbook for detection time specification.
5. Check the Enable open drain on CRC_ERROR pin if you have an external pull up resistor on your board.
6. Click OK.

You can instantiate the EMR Unloader IP core to detect SEU and unload EMR content in user logic. The EDCRC feature will be turned on automatically when the EMR Unloader IP core is instantiated. EMR Unloader IP core helps you to read the EMR whenever there is an SEU event by:

• Unloading the EMR via core logic
• Accessing the hard CRC Block
• Providing access to the user logic to read the EMR data

The FPGA Manager in the HPS has the ability to monitor the CRC_ERROR status pin and to retrieve the error symptom, location and type. You can choose to enable the CRC error interrupt from the FPGA Manager, followed by CRC error information extraction from respective registers.

To unload the contents of the EMR using a JTAG port, use the SHIFT_EDERROR_REG JTAG instruction. This JTAG instruction connects the EMR to the JTAG pin in the error detection block between the TDI and TDO pins. You can execute the instruction whenever the CRC_ERROR pin goes high. You must unload the contents of the EMR before the register is overwritten by the information of the next CRC error.

The following shows the Jam™ Standard Test and Programming Language (STAPL) Format File (.jam) used to execute the SHIFT_EDERROR_REG JTAG instruction to unload the contents of the EMR.

ACTION UNLOAD_EMR = EXECUTE;
DATA EMR_DATA;
BOOLEAN out[78];
ENDDATA;
PROCEDURE EXECUTE USES EMR_DATA;
DRSTOP IDLE;
IRSTOP IDLE;
STATE IDLE;
IRSCAN 10, $017;
WAIT IDLE, 10 CYCLES, 1 USEC, IDLE;
DRSCAN 78,$0, CAPTURE out[77..0];
WAIT IDLE, 10 CYCLES, 25 USEC, IDLE;
PRINT " ";
PRINT "Data read out from the ";

PRINT "EMR_Register :"	, out[77], out[76], out[75], out[74], out[73], out[72], out[71], out[70], out[69], out[68], out[67], out[66], out[65], out[64], out[63],out[62], " ", out[61], out[60], " ", out[59], out[58], out[57], out[56], out[55], " ", out[54], out[53], out[52], " ", out[51], out[50], out[49], out[48], out[47], out[46], out[45], out[44], out[43], out[42], out[41], out[40], out[39], out[38], out[37], out[36], out[35], out[34], out[33], out[32], out[31], out[30], out[29], out[28], out[27], out[26], out[25], out[24], out[23], out[22], out[21], out[20], " ", out[19], out[18], out[17], out[16], out[15], out[14], out[13], out[12], out[11], out[10], " ", out[9] , out[8], out[7], out[6], out[5], " ", out[4], out[3], out[2], " ", out[1], " ", out[0];

'PRINT " ";

PRINT "Frame Address :", out[77], out[76], out[75], out[74], out[73], out[72], out[71], out[70], out[69], out[68], out[67], out[66], out[65], out[64], out[63], out[62];
PRINT "Column-Based Double Word Location :", out[61], out[60];
PRINT "Column-Based Bit :", out[59], out[58], out[57], out[56], out[55];
PRINT "Column-Based Type :", out[54], out[53], out[52];
PRINT "Frame-Based Syndrome :" , out[51], out[50], out[49], out[48], out[47], out[46], out[45], out[44], out[43], out[42], out[41], out[40], out[39], out[38], out[37], out[36], out[35], out[34], out[33], out[32], out[31], out[30], out[29], out[28], out[27], out[26], out[25], out[24], out[23], out[22], out[21], out[20];
PRINT "Frame-Based Double Word Location :", out[19], out[18], out[17], out[16], out[15], out[14], out[13], out[12], out[11], out[10];
PRINT "Frame-Based Bit :", out[9] , out[8], out[7], out[6], out[5];
PRINT "Frame-Based Type :", out[4], out[3], out[2];
PRINT "Reserved bit :", out[1];
PRINT "Column-based EDCRC Check Bits Update:", out[0];
STATE IDLE;

EXIT 0;
ENDPROC;

It is important to determine the error type when an SEU is detected. This section explains the CRC_ERROR pin behavior and how to interpret whether the error type is correctable or uncorrectable.

The Intel^® Arria^® 10 fast EDCRC feature runs all the column-based check-bits engine in parallel. When an SEU is detected, the column-based check-bits asserts the CRC_ERROR, the detected frame location is then passed to the frame-based check-bits to further localize the affected bit. This process causes the CRC_ERROR pin to assert twice. Column-based check-bits assert the first CRC_ERROR pulse and followed by the frame-based check-bits asserting the second pulse.

In Intel^® Arria^® 10, as soon as an SEU is detected, the CRC_ERROR is asserted high and remains high until the EMR is ready to be read. You can unload the EMR data as soon as the CRC_ERROR pin goes low. Once EMR data is unloaded, can determine the error type and the affected location. With these information you can decide how your system should respond to the specific SEU event.

In the rare event of an uncorrectable and un-locatable error, the CRC_ERROR signal is asserted only once. There is no second pulse assertion by frame-based check-bits due to the uncorrectable error location cannot be located. The statistical likelihood of uncorrectable multi-bit SEU is less than one in 10,000 years for a device in typical environmental conditions.

When an SEU is detected, you can read the EMR data to determine whether the error is correctable or uncorrectable. Intel recommends you to use Altera EMR Unloader IP core in your design. The Altera EMR Unloader IP core interprets the error and reports it at the output.

The Intel^® Stratix^® 10 and Intel^® Arria^® 10 FIFO Intel^® FPGA IP cores support embedded memory ECC for M20K memory blocks. The built-in ECC feature in Intel^® Stratix^® 10 and Intel^® Arria^® 10 devices can perform:

• Single-error detection and correction
• Double-adjacent-error detection and correction
• Triple-adjacent-error detection

You can turn on FIFO Embedded ECC feature by enabling enable_ecc parameter in the FIFO Intel^® FPGA IP GUI.

When you enable the ECC feature, a 2-bit wide error correction status port (eccstatus[1:0]) will be created in the generated FIFO entity. These status bits indicate whether the data that is read from the memory has an error in single-bit with correction, fatal error with no correction, or no error bit.

• 00: No error
• 01: Illegal
• 10: A correctable error occurred and the error has been corrected at the outputs; however, the memory array has not been updated.
• 11: An uncorrectable error occurred and uncorrectable data appears at the output

The EDCRC reference design demonstrates the following main SEU detection and recovery for Intel^® Arria^® 10:

• Instantiating various SEU-related IP cores such as EMR Unloader IP core, Advanced SEU Detection IP core, and Fault Injection IP core
• Demonstrating how the Advanced SEU Detection IP core retrieves the SMH information from the EPCQ-L with Serial Flash Controller IP core²
• Integrating the reference design into your system and characterize your system response to the SEU event with the Intel Fault Injection feature.

This reference design is targeted for the following hardware and software:

• Intel^® Arria^® 10 development kit that is using 10AX115S2F45I2SG device.
• Intel^® Quartus^® Prime software version 16.0
  Note: You must have a licensed version of the Intel^® Quartus^® Prime software to generate SMH files.

The a10-seu.zip reference design consists of:

• a10_seu.qar—the project archive file
• top.v—the top level module of the project
• top.sdc—the timing constraint file
• top.stp—the Signal Tap file

In this design, you will use Platform Designer (Standard) to connect the Intel SEU-related IP cores together. IP core to be connected are EMR Unloader IP core, Fault Injection IP core and Advanced SEU Detection IP core. Some other IP cores are also needed to make the design complete, which are Altera IOPLL IP core, AVST Splitter and Serial Flash Controller IP core.

To complete the reference design, you must perform the following tasks:

• Generate In-System Source and Probe (ISSP) IP core
• Intel^® Quartus^® Prime project setting and add the following files (provided in download package) to the project:
  • Top.v—instantiate the Qsys system module and connect all other IP cores
  • Top.stp—monitor some key signals with Signal Tap tool
  • Top.sdc—timing constraint
• Assign ASD regions to up counter and down counter
• Assign FPGA device and pin locations
• Compile the project

The following are the main steps to test your reference design:

1. Convert .sof file and .smh file to .jic file.
2. Program .jic file to EPCQ-L.
3. Launch Signal Tap Logic Analyzer and Fault Inject Debugger.
4. Configure the .sof to Arria 10 and reading .smh file with Fault Injection Debugger.
5. Start Signal Tap to monitor the signal and injecting an error with Fault Injection Debugger.
6. Observe the Signal Tap output.

This section will go through some simple steps to inject faults to the CRAM. For more information about the Fault Injection Debugger, refer to Fault Injection Debugger User Guide.

The ROM with ECC feature design consists of the following modules:

• ROM with ECC
• Read address

In the design, the ROM content is initiated in the .mif file with the associated address shown in the following table.

The design is implemented using the 10AX115S3F45E2SGE3 device on the Intel^® Arria^® 10 ES Development Kit Board. You can implement this design using any Intel^® Arria^® 10 device.

To enable the ECC feature, you must instantiate a RAM:2-PORT IP core with following settings:

• Set Operation mode to Simple Dual Port (with one read port and one write port)
• Set Ram block type to M20K
• Enable Same-width port feature
• Disable Byte-enable feature
• Enable ECC Checking feature
• Initiate RAM content with a .mif or a .hex file

Additionally, you must connect the wren, wraddress and datain signals of the design to GND.

The ROM content has been purposely injected with a faulty bit with single bit error and 3 adjacent bits error after device configuration. If the ROM content is free from bit-flip, the ECC status port(eccstatus[1:0]) shows 2b’00. The Signal Tap logic analyzer waveforms indicate that there are two cycles latency of the output with respect to the associated read address.

After the device configuration, the ROM content of the address 1Fh is injected with 50h where it is initiated with 51h. The ECC status signal shows 2b’10 which indicates single error bit detected at the ROM content of the address 1Fh and the error has been corrected at the output.

After the device configuration, the ROM content of the address 1Fh is injected with 56h where it is initiated with 51h. The ECC status signal shows 2b’11 which indicates 3 adjacent bits error detected at the ROM content of the address 1Fh and uncorrectable data appears at the output.