Analysis of the SEU Tolerance of an FPGA-Based Time-to-Digital Converter Using Emulation-Based Fault Injection

Abstract

In application domains where severe environmental conditions are unavoidable, including high-energy physics and nuclear power plants, accurate and dependable time-to-digital converters (TDCs) are essential components. Single-event upsets (SEUs) associated with the configuration memory of field-programmable gate array (FPGA)-based implementations are becoming common sources of performance degradation even in terrestrial areas. Hence, the need to test and mitigate the effects of SEUs on FPGA-based TDCs is crucial to ensure that the design achieves reliable performance under critical conditions. The TMR SEM IP provides real-time fault injection, and dynamic SEU monitoring and correction in safety critical conditions without intervening with the functionality of the system, unlike traditional fault injection methods. This paper presents a scalable and fast fault emulation framework that tests the effects of SEUs on the configuration memory of a 5.7 ps-resolution TDC implemented on ZedBoard. The experimental results demonstrate that the standard deviation in mean bin width is 2.4964 ps for the golden TDC, but a 0.8% degradation in the deviation is observed when 3 million SEUs are injected, which corresponds to a 0.02 ps increment. Moreover, as the number of SEUs increases, the degradation in the RMS integral non-linearity (INL) of the TDC also increases, which shows 0.04 LSB (6.8%) and 0.05 LSB (8.8%) increments for 1 million and 3 million SEUs injected, respectively. The RMS differential non-linearity (DNL) of the faulty TDC with 3 million SEUs injected shows a 0.035 LSB (0.8%) increase compared to the golden TDC.

1. Introduction

The time difference between two events (start and stop events) is measured by time-to-digital converters (TDCs), which then translate the data into a digital output [1,2,3]. In fields where radiation impacts are inevitable, such as nuclear reactors [4], high-energy physics [5], and positron emission tomography (PET) [6,7], high-precision time-to-digital converters are greatly desired. The dependability and fault tolerance of the TDC are important considerations in the design process, in addition to the resolution, area, power consumption, and linearity, in these conditions.

Technological advancements in complementary metal oxide semiconductor (CMOS) devices led to reduced gate-oxide thickness and increased doping densities, which in turn increased the tolerance against total ionizing dose (TID) effects. However, scaling of device dimensions and increased operating speed led to amplified vulnerability to short-term radiation effects called single-event effects (SEEs) [8]. Smaller transistors have lower charge thresholds, which increase their sensitivity to SEEs. Moreover, scaling of CMOS devices and the trend of higher integration of smaller transistors in a single chip increases the number of vulnerable nodes. Hence, as technology scales, the effects of single-event upsets (SEUs) on devices become significant. The motivation of this paper is to assess the sensitivity of FPGA-based TDCs to SEUs and mitigate errors to ensure its reliability and safety in critical environments.

An SEE is caused when a high-energy particle strikes a CMOS device and generates an electrical charge in the device depending on the amount of energy the high-energy particle transfers [9]. SEEs are classified as nonrecoverable and permanent errors, also called hard errors, and transient or soft errors that may occur as changes in signal or bit flips in routing resources, logic modules, I/Os, or memories.

SRAM-based field-programmable gate arrays (FPGAs) have two layers, application and configuration layers. The application layer constitutes the memories, user logics, and input/output resources. The configuration memory and its associated ports and control unit make up the configuration layer. SRAM-based FPGAs are especially affected by soft errors such as single-bit upsets (SBUs) or multi-bit upsets (MBUs) in the configuration memory [9,10]. This is due to the fact that the FPGA’s configuration memory has a higher cross-section compared to the user logic. For example, Xilinx FPGAs have 27.7 Mb of configuration memory. The configuration memory specifies the circuitry of the design, and more than 90% of the bits determine the routing architecture, such as muxes, buffers, and programmable interconnect points (PIPs). The effect of errors in the configuration memory leads to permanent recoverable errors [11]. The effect can be a modification in the routing or a change in the Boolean expression of a look-up table (LUT), which in turn may alter the functionality of the design and lead to data corruption or fatal errors [12]. In addition, the consequences of SEUs may be open-net or wrong input selection of muxes, a wrong connection or disconnection between nets, an output net wrongly driven or left open, or wrong function inputs and outputs on LUTs or control bits.

There are various SEU mitigation strategies for the configuration memory of SRAM-based FPGAs. The most frequently used technique is to use hardware redundancy [13]. This method either duplicates (dual modular redundancy (DMR)) or triplicates (triple modular redundancy (TMR)) the components for fault tolerance. TMR has more than double the size and power overhead, even though it renders a device resilient to single-event disruptions of control and data processing blocks through a voting mechanism [14,15,16]. DMR [17,18] uses two redundant circuits and, as a result, has a lesser cost compared to TMR and uses less complicated logic for voting; however, it is only used for fault detection, while TMR is used for fault masking.

Even though TMR is capable of masking a fault, it cannot remove it from the configuration memory. Therefore, reconfiguration is necessary to correct faults. The authors in Refs. [19,20] used scrubbing to detect and repair faults. Scrubbing is a post-configuration write operation into the configuration memory intended to recover the initial state of the system. Scrubbing can be done internally, where the scrubber is inside the FPGA, or externally, where the scrubber is implemented outside the FPGA [21]. Internal scrubbing uses the internal configuration access port (ICAP) to access configuration memory; however, it is also susceptible to SEUs. External scrubbing needs an auxiliary radiation-hardened device to implement the scrubber, but it has high efficiency of SEU mitigation. The external scrubber uses JTAG or SelectMAP to access configuration memory. Moreover, a combination of redundancy and scrubbing are implemented to improve reliability [22,23]. Although scrubbing can avoid the accumulation of errors, it has higher complexity compared to reconfiguration. Reconfiguration is a post-configuration memory write operation that can be carried out by fully replacing the configuration memory or just part of it. Compared to the partial reconfiguration [24,25], full reconfiguration has more time and resource overhead. Partial reconfiguration can be further classified as static or dynamic. Static partial reconfiguration is performed while the FPGA is non-operational. On the contrary, dynamic partial reconfiguration is done while the FPGA is active and operational. Reconfiguration cannot detect faults by itself but has to be combined with error correction codes (ECCs) or redundancy techniques for fault detection and correction [26]. A comprehensive review of SEU mitigation techniques for configuration memory of FPGAs can be found in Ref. [26].

To test the fault tolerance of FPGA-based design, different approaches have been used. Fault injection is a commonly used technique to test which areas of a design are vulnerable to radiation-induced faults and investigate its tolerance against radiation effects.

Fault injection can be performed on hardware by exposing the device under test (DUT) to a radiation environment. Although it gives realistic results, it is expensive, needs a controlled environment, and has a high risk of permanent damage. Due to this, physical fault injection is limited for circuit characterization but not for early verification of a design [27]. Other ways of fault injection are based on software or simulation that allows verification in the early design stage, but it is time- and power-consuming. Alternatively, an emulation-based fault injection approach based on FPGA allows for robust fault injection, is less expensive, and requires less computing power while allowing for verification at early design stages. However, the FPGA-based emulation techniques presented in Refs. [28,29] interrupt the normal functioning of the DUT for fault injection, which may limit its application. Emulation-based fault injection using the Triple Modular Redundancy Soft Error Mitigation Intellectual Property (TMR SEM IP) provided by Xilinx is implemented in Ref. [10]. The TMR SEM IP uses partial dynamic reconfiguration to inject several faults into the configuration memory of FPGAs in real time and without interrupting application-layer system functionality. This method also provides real-time error classification and correction ability that mitigates the accumulation of SEUs, ensuring the long-term reliability, safety, and performance of the DUT. A survey of fault injection methods and their pros and cons is summarized in Ref. [30]. In this paper, we integrated the TMR SEM IP into 5.7 ps-resolution TDC [31] to evaluate its sensitivity to the accumulation of SEUs at an early design stage. A fast fault emulation framework and a discussion of the effects of SEUs on the functionality of the TDC is presented in the paper.

The rest of the paper is organized as follows: Section 2 discusses state-of-the-art fault injection methodologies, their pros and cons, and prior fault analysis methods for TDCs; Section 3 discusses the components that make up the fault emulation framework and the methodology followed for fault injection; Section 4 presents the experimental test setup, the resource and power overhead, the sensitivity of the TDC for SEUs, and a comparison with other works; and a summary of the findings and suggestions for next research are provided in Section 5.

2. Related Work

The sensitivity of digital devices to SEEs is becoming a common issue as device size is scaling. As a result, testing and verifying the radiation hardness and sensitivity of FPGA-based designs is important at the early design stage. Fault injection was a strategy commonly used by researchers to achieve this. Fault injection can be done by directly exposing the DUT to a controlled radiation environment, by simulation using SystemC or hardware description languages (HDL) such as VHDL or Verilog, or by using fault emulation frameworks. Each method has its own advantages and drawbacks.

The authors in Refs. [32,33,34] used the physical fault injection methodology to characterize the DUT under a radiation environment. Although it gives realistic results, this approach is overly expensive and the risk of damage is high. Moreover, it is not suitable for early design stage verification.

A simulation-based fault injection strategy is reported in Refs. [35,36]. Simulation-based fault injection can be carried out on the register transfer level by modifying the hardware description of the system to include components for fault injection, as in Ref. [37], or at the netlist level by modifying post-synthesis and post-implementation netlist to simulate faults [38,39]. Although simulating faults gives the advantage of early-on verification of a design to SEUs, the execution time can be high for complex designs, and it needs high computing power to inject faults.

An alternative to simulation-based fault injection is to use FPGA-based fault emulation platforms. Fault emulation can be carried out by circuit instrumentation, where part of the DUT is substituted by its instrumented cells prototyped on FPGA. This way, faults can be injected externally and their effects can be observed. Autonomous instrumentation-based fault injection is reported in Refs. [40,41]. The authors in Ref. [40] claim that both SEU and single-event transient (SET) effects can be modeled by combining register-level and gate-level fault injection based on autonomous fault emulation. This approach is not only time efficient but also allows for early design-stage verification. However, the emulation framework requires modification of the hardware model of the DUT to support fault injection.

Another way of fault injection through emulation is to reconfigure the configuration memory bits. Some FPGA families, such as Xilinx and Virtex FPGAs, have a partial reconfiguration feature that allows for fault injection without the need to modify the hardware model of the DUT. This non-intrusive fault injection approach is used in Refs. [42,43,44] by altering the bitstream loaded to the FPGA. This methodology of fault injection is time-efficient and cheap, allows for early-on design verification, and does not require modification of the hardware description of the DUT. However, the fault injection targets all the configuration memory bits, even if they are not related to the functionality of the DUT. This is a bottleneck because it affects the execution time as the number of faults injected becomes large. Most FPGA-based fault emulation frameworks only allow fault injection to the configuration layer. However, in Ref. [45], the FREtZ framework is implemented with two Zedoard FPGAs, one for fault injection and the other as a target device, to inject faults both into the configuration bits and to user registers via the JTAG interface. However, the fault injection time takes 720 ms per fault, of which 35 ms is devoted to executing the benchmark.

For Xilinx FPGA families, the TMR SEM IP uses ICAP to inject faults into the configuration memory by partial dynamic reconfiguration and without the need to modify the hardware model of the DUT. The TMR SEM IP can classify configuration bits as essential and non-essential. Essential bits are the configuration memory bits that determine the functionality and routing of the DUT. Xilinx TMR SEM IP and essential bits technology for enhanced fault injection was used by the authors in Refs. [10,46] to test the sensitivity of RISC-V processors to soft errors. The fault injection campaign was performed on a Kintex UltraScale FPGA KCU105 evaluation board. However, the fault injection to the FPGA board was carried out from a host PC using Matlab script through a UART peripheral. As a result, the fault injection time was long. It took more than 20 h to inject 9604 faults. In this paper, we used a ZedBoard FPGA for the designed TDC, and we present a TMR SEM IP-based fault injection strategy that only targets the configuration memory bits that are essential to the DUT, which largely reduces the execution time for injecting faults. The ZedBoard has two arm cores that run at a clock frequency of 100 MHz. The TMR SEM IP can communicate with the Zynq processor through the AXI4 lite interface. Unlike the fault injection carried out through a Matlab script from a host PC in Ref. [10], our method is a fast fault injection method that is limited by the ICAP’s maximum clock frequency, which is 100 MHz. We injected 3 million faults in 30 s. The comparison among the different fault injection methodologies and their advantages and drawbacks are summarized in

Table 1. Comparison of fault injection methodologies.

Work/ Year	Method	Technology	DUT	SEU Mitigation Strategy	Pros	Cons	Damage	#Injected Faults	Time/Fault	Layer
[33]/(2007)	Laser test	220 nm	Xilinx XCV1000 FPGA	TMR + continuous scrubbing	Realistic results	Expensive	Permanent	516 upsets of 6,127,744 configuration bits	-	Configuration layer
[34]/(2005)	Laser test	90 nm	V4LX25	None	Realistic results	Expensive	Permanent	1.9 gigabits	=	Configuration layer
[38]/ (2025)	Netlist-level fault injection based on Verilog	20 nm	KintexUltrascaleXQRKU060	None	Early design-stage verification	Time-consuming for complex designs	None	140 Mb	25 ns	Application layer
[39]/(2015)	Netlist-level fault injection based on Verilog HDL	65 nm	Virtex V	None	Early design-stage verification	Time-consuming for complex designs	None	_	15 ns	Application layer
[37]/(2018)	RTL-level fault injection based on Verilog	-	-	None	Early design-stage verification	Time-consuming for complex designs	None	34,182	38.2 ms	Application layer
[40]/(2012)	Autonomous instrumentational emulation-based fault injection (RTL+GTL)	45 nm	Xilinx XC6VLX240T FPGA	None	Early design-stage verification	Intrusive	None	164,720,820	0.3 ms	Application layer
[41]/(2007)	Autonomous instrumentational emulation-based fault injection	28 nm	Xilinx Virtex-2000E	TMR	Early design-stage verification	Intrusive	None	1,000,000	1 µs	Application layer
[42]/(2007)	Fault emulation based on partial reconfiguration	28 nm	Xilinx XQ2VR6000	XTMR	Early design-stage verification	Targets all configuration memory bits	None	3,300,000	18 ms	Configuration layer
[44]/(2019)	Fault emulation based on partial reconfiguration	28 nm	Artix-7XC7A200T-1SBG484C	_	Non-intrusive	Exhaustive testing		>170 million	10 ms	Configuration layer
[27]/(2023)	Fault emulation based on partial reconfiguration	65 nm	Xilinx Virtex 5 XC5VLX110T	TMR	Targets only essential bits to the DUT	Limited to Xilinx FPGAs	None	5425	0.2 s	Configuration layer
[45]/(2024)	Fault emulation	28 nm	XC7Z030-1SBG485I ZYNQ-7000	None	Non-intrusive	Takes more time	None	2752	685 ms	Configuration + application layer
[10]/(2019)	Fault emulation based on partial reconfiguration	20 nm	Kintex UltraScale FPGA KCU105 evaluation board	-	Non-intrusive Targets only essential bits to the DUT	Limited to Xilinx FPGAs	None	9604	12 s	Configuration layer
This work	Fault emulation based on partial reconfiguration	28 nm	XC7Z030-1SBG485I ZYNQ-7000	TMR + scrubbing	Non-intrusive Targets only essential bits to the DUT	Limited to Xilinx FPGAs	None	3,000,000	10 ns	Configuration layer

.

Although there are different architectures of TDCs based on FPGAs available in various literature, the tapped delay line (TDL) topology based on carry chains of FPGAs is commonly used for resolutions of less than 10 ps for high-energy physics and nuclear applications. Refs. [47,48,49] use TDL-based topology to obtain a resolution of 0.4 ps, 10.5 ps, and 20.97 ps, respectively. The resolution of the TDC highly depends on the topology and the technology of the FPGA that the TDC is implemented on. TDCs based on a matrix of counters that utilize the abundant routing resources available in FPGAs as delay components are implemented in Refs. [31,50], which report 7.4 ps and 5.7 ps resolutions, respectively. A review of recent advancements in FPGA-based TDC topologies and their performance is summarized in Ref. [51]. Although the resolution, precision, non-linearity, power, and resource consumption of these TDC topologies are targeted for enhancement, to the best of our knowledge, the sensitivity to SEUs in the configuration memory of the FPGA-based TDCs has not been analyzed. However, in Refs. [52,53], the effects of ionizing radiation on single-shot precision ASIC-based TDC is reported by performing physical fault injection in a controlled environment. In our work, we analyzed the SEU sensitivity of a 5.7 ps resolution TDC implemented on ZedBoard [31] by using a fault emulation framework that integrates a Xilinx TMR SEM IP controller to perform fault injections by partial reconfiguration of configuration memory bits.

3. Architecture and Methodology for Fault Injection Based on Emulation

3.1. Proposed Architecture

The emulation framework for fault injection includes a 5.7 ps resolution TDC implemented on ZedBoard, a TMR SEM IP for fault injection and correction, a universal asynchronous receiver and transmitter (UART) to enable communication between the FPGA and the user, JTAG for programming the FPGA, and a personal computer (PC) for data analysis, as depicted in Figure 1.

Both the TDC and the TMR SEM IP core are implemented on the programmable logic (PL) of the ZedBoard FPGA. The TMR SEM IP is programmed to communicate with the Zynq processing system via the AXI4-Lite slave interface.

The TMR SEM IP controller has six interfaces. The fault injection interface of the controller enables injection of faults targeting essential bits of the configuration memory in Xilinx FPGA designs. This can be completed externally from the monitor interface through UART or internally through the Advanced eXtensible Interface (AXI). The FRAME_ECC interface is a point-to-point connection between the SEM IP and the FRAME_ECC primitive that provides the soft error detection functionality to the configuration memory. The monitor interface is intended to ensure communication between the user and the SEM IP. The user can monitor the status of the IP or can inject errors into the configuration memory through the IP. The status of the TMR SEM IP is detected by the user by monitoring the status interface. This interface provides a decoded output of the status signals that enables the user to know what the IP is doing. The ICAP interface allows the IP to perform partial reconfiguration on the configuration memory.

The state of the TMR SEM IP can vary depending on what it is currently doing. In its observation state (SC 02), the IP continuously scans the configuration memory for errors. If the IP is doing nothing, then it is in its idle state (SC 00). The fault injection state (SC 10) is the state where the SEM IP is able to inject faults into the configuration memory. The IP can detect single- or multi-bit upsets depending on how it is configured and correct it when it is in its error correction state (SC 04). The other state is the reset state, where you can carry out a software reset on the SEM IP. All these states are encoded, and whenever the status of the IP is requested by the user, the state of the IP is reported through the monitor interface on any terminal, such as the TeraTerm or Vitis serial terminal. The states and interfaces of the IP can be referred to in detail in Refs. [54,55].

3.2. Fault Injection Methodology Using TMR SEM IP

Configuration memory bits store the logic and routing information of the design that will be loaded to the FPGA while programming it. The smallest units in configuration memory are called frames. Each frame constitutes a block of bits that configures part of the FPGA. Configuration bits can be classified as essential and non-essential. The essential bits are configuration RAM bits that define the circuitry and functioning of the TDC on the FPGA. If the essential bit is changed by radiation-induced effects, the TDC may not behave as intended. This will cause reliability issues. TMR SEM IP has the capability of classifying configuration memory bits as essential and non-essential.

A step-by-step flow of the design and implementation of the TDC on ZedBoard and how to classify the configuration bits using the TMR SEM IP is depicted in Figure 2. The first step is to successfully implement the DUT using HDL on Vivado. Once successful synthesis and implementation of the design are completed on Vivado, a bitstream file that contains information about the behavior of the design is generated, which later will be loaded to the FPGA to program it. Next, after integrating the TMR SEM IP controller with the TDC, a successful synthesis and implementation of the design is carried out. Afterwards, by setting the “enable essential bit generation constraint” property, writing of the bitstream is performed. This will generate an essential bit data (EBD) file that contains the list of essential and non-essential configuration bits of the TDC together with the bitstream file. The EBD file is used later for fault injection to the configuration memory using the TMR SEM IP. The EBD file is an ASCII file that contains multiple rows of 32-bit words. For 7 series FPGA families, each frame in the configuration memory contains 101 EBD lines. A 1 in the EBD line represents an essential bit, and a 0 means it is non-essential.

The address of each essential bit in the configuration memory must be known for fault injection and error correction. The addresses can be linear frame addresses, or they can be converted to physical addresses. Equations (1)–(3) below show how to calculate the linear frame address (LA), the word address (WD), and the bit address (BT), which correspond to a specific essential bit in an EBD file. The error injection command has the format depicted in Figure 3. It is a 40-bit command, where 17 bits are linear frame address bits (LA), 7 bits are the word address bits (WD) that identify which word address in the frame is an essential bit, and 5 bits indicate the bit position of the essential bit in a single word (BT).

$$LA={\displaystyle \frac{EBD line-\left(EBD line mod 101\right)}{101}}$$

(1)

$$WD=EBD line mod 101$$

(2)

$$BT=31-character position$$

(3)

An example of a linear frame address calculation is presented for two essential bits in the EBD file on line 327,615. The EBD line has ASCII characters of 1100 0000 0000 0000 0000 0000 0000 0000. We want to calculate the linear frame addresses of the two essential bits on this line. LA and WD are calculated using Equations (1) and (2). WD is 327,615 mod 101, which is 72 (1001000), and LA is 3242 (1100101010). The BT for the essential bit at character position 0 is 31 (11111), and for the essential bit at character position 1 it is 30 (11110) according to Equation (3). Since we have two essential bits in this specific EBD line, we will have two error injection commands. Concatenating the 17 bits of LA with 7 bits of WD and 5 bits of BT, the hex values for error injection are

110010101010100100011111 = 0 X CAA91F

110010101010100100011110 = 0 X CAA91E

The general fault injection strategy uses the following flow. The FPGA is loaded with the bitstream file generated from Vivado. To check for successful initialization of the TMR SEM IP, we first grant the ICAP access to the configuration memory of the FPGA. For Xilinx 7 series FPGAs, default access to the configuration memory is given to the Zynq processor. Therefore, to obtain successful initialization and fault injection capability of the TMR SEM IP, a grant should be first given to the ICAP. The IP will be in its observation state, where it continuously scans the configuration memory for errors after initialization. To inject faults, the user must force the IP to go into its idle state and later into its injection state. In the injection state, the Zynq processor scans the EBD file line by line and bit by bit to convert each essential bit to an injection address using Equations (1)–(3) until the number of faults the user needs to inject is reached. The faults are injected while the TDC is running so that the effects of SEUs on the functionality of the TDC are analyzed. Afterwards, the behavior of the faulty TDC is compared to the golden TDC. The methodology followed is summarized in Figure 4.

4. Experimental Results and Discussion

A TDC implemented on the ZedBoard FPGA, shown in Figure 5, is the DUT. The DUT is designed and implemented on Vivado 2020.1 using Verilog. The TMR SEM IP is successfully integrated into the design without the need to modify the hardware model of the TDC. The feature of the TMR SEM IP is set to error injection mode. The communication of the controller is set to AXI mode to enable communication to the IP through the Zynq processor present in the ZedBoard. An XDC file, which enables generation of the EBD file during bitstream generation, is also included in Vivado.

The post synthesis and implementation resource utilization of the TDC with and without the TMR SEM IP is reported in

Table 2. Resource utilization report of the TDC without and with the TMR SEM IP.

Resources	TDC Without TMR SEM IP			TDC with TMR SEM IP		Resource Overhead (%)
	Total	Utilized	Utilized (%)	Utilized	Utilized (%)
Slice registers	106,400	41,175	38.70	52,232	49.09	26.85
Slice LUTs	53,200	25,819	48.53	28,857	54.24	11.77
LUTs as logic	53,200	16,875	31.72	16,902	31.77	0.16
LUTs as memory	17,400	8944	51.40	11,955	68.71	33.67
Slices	13,300	11,041	83.02	12,612	94.83	14.23
Block RAM	140	32.5	23.21	66.5	47.50	104.62
MMCME2-ADV	4	3	75	3	75	0

. For the TDC with the TMR SEM IP, the percentage of utilized slices, slice LUTs, used as logic and memory is higher than the percentage of utilized slices, slice LUTs, used as logic and memory of the TDC without the SEU mitigation method, as the table shows. Soft error mitigation using the TMR SEM IP comes with a 26.85% increase in the slice registers used, an 11.7% increase in slice LUTs, a 33.67% increase in LUTs as memory, and a 14.23% increase in slices used for implementing the design. The huge penalty in resource utilization is in the block RAMs used, which is a 104% increase when a TMR SEM IP is integrated into the TDC. This is because extra memory resources are required for error detection and correction when the TMR SEM IP is integrated into the design. The sum of the total resource overhead is 191%, which proves the fact that the TMR method mitigates errors in a circuit with approximately 3× resource utilization. The report also shows that using the TMR SEM IP has an insignificant (0.16%) resource penalty on the LUTs as logic because there is no need to change the hardware model of the TDC for fault injection.

The FPGA is then programmed by the bitstream file in JTAG mode. We used Xilinx Vitis ISE to program the FPGA. Vitis ISE has a serial terminal that enables communication between the FPGA and a host personal computer (PC). Through the Vitis terminal, we monitored the initialization of the TMR SEM IP, its status, and its state changes. Moreover, the output of the TDC is monitored on the Vitis serial terminal.

We included the EBD file in Vitis so that the Zynq processor would complete a robust conversion from the EBD file to the error injection address when it encountered an essential configuration bit. The Zynq processor injects SEUs into corresponding injection addresses by writing to the monitor write FIFO of the TMR SEM IP. While injecting faults, the output of the TDC is sampled to evaluate its functionality in the presence of errors. The sampled output of the TDC was analyzed in Matlab to build its histogram.

Based on the power report generated by Vivado, the power consumption of the device without the TMR SEM IP and with the IP is reported in

Table 3. Power consumption of the TDC with and without the TMR SEM IP.

	TDC Without TMR SEM IP	TDC with TMR SEM IP	Power Overhead (%)
Static power (W)	0.171	0.181	5.85
Dynamic power (W)	2.343	2.463	5.12
Total on-chip power (W)	2.514	2.644	5.17

. As is shown in the table, the total on-chip power of the device, which is the sum of device static and dynamic power, showed a 5% increase when the TMR SEM IP was integrated into the design.

4.1. Validating the Functionality of the TMR SEM IP

To check the error detection and correction functionality of the TMR SEM IP, we injected three errors: one random fault injection targeting a nonessential bit and two essential bits at linear frame addresses, as calculated in Section 3. The status report of the IP after injection is reported in Figure 6. As is illustrated in the figure, the TMR SEM IP was initialized successfully and went into its observation state (SC 02). The IP should be in the injection state (SC 10) to inject the errors. The IP detects these errors when it reaches its observation state again. While the IP was scanning the configuration memory, it detected two errors corresponding to the essential bits and ignored the error injected for the nonessential bit. It is reported that the IP was in its correction state (SC 04), and it detected and corrected both errors at the corresponding linear frame addresses. This saved time spent dwelling on correcting the non-essential bit errors in the configuration memory.

4.2. Performance of the TDC with SEUs

Of the 25,697,632 configuration memory bits accessible in the ZedBoard FPGA, our design contained 9,100,280 essential bits, or 35.41% of the total. The TDC’s histogram was extracted using a statistical coding density test. To obtain a more realistic result, more than 500,000 hits were taken. The histogram was used to extract the fault-free golden TDC’s transfer function.

The linearity of the TDC is represented as its differential non-linearity (DNL), or deviation of the bin width from the ideal bin width and integral non-linearity (INL), which is the deviation of the actual transfer function from the ideal. These performance metrics quantify the reliability and linearity of the measurement of the TDC under the presence of SEUs. The DNL and INL of the TDC were extracted from its transfer function. The bin width distribution of the 1024 bins was calculated from the histogram. We used Equation (4) to calculate the bin size (Binsize_i) associated with each bin. K is the number of counts in bin i, and T_clk is the clock frequency of the counters, which was 5.831 ns, and N is the total sample size.

$${Binsize}_i={\displaystyle \frac{K\ast T_{clk}}{N}}$$

(4)

The histogram of the bin-width distribution is depicted in Figure 7. As is illustrated in the figure, the mean value (mean) of the bin size calculated using Equation (5) corresponds to the expected resolution, which was 5.7 ps. N is the total sample size, n_i is the frequency of the i^th Binsize. The standard deviation (std) of the Binsize from the mean value was calculated using Equation (6), and it was 2.4964 ps.

$$mean=\sum _{i=1}^N{\displaystyle \frac{n_i{Binsize}_i}{N}}$$

(5)

$$std=\sqrt{\sum _{i=1}^N{\displaystyle \frac{{n_i{(Binsize}_i-mean)}^2}{N-1}}}$$

(6)

The TMR SEM IP’s features are only configured in error injection mode, with the error correction capability turned off to monitor the behavior of the TDC under the accumulation of SEUs. The errors are injected while the TDC is operating and its output is being captured. The Zynq processor completes a fault injection address calculation for corresponding essential bits, and faults are injected into the configuration memory via the ICAP. The histogram of the faulty TDC is collected, and the bin-width distribution is calculated from the histogram. From the histogram, the DNL and INL of the faulty TDC are analyzed and calculated in Matlab 2023 as described in detail in Ref. [31]. These TDC performance metrics are compared between the golden TDC and the faulty TDCs. Initially, 4000 random faults were injected into the configuration memory. The bin-width distribution of the golden TDC was compared with the bin-width distribution of the TDC with 4000 errors injected, as depicted in Figure 8. As illustrated in the figure, compared to the golden TDC, some ultra-wide bins that correspond to wrong connections between routing nets caused by SEUs showed up at the outer edges of the bin-width distribution of the faulty TDC, and the frequency of occurrences of ultra-small bins increased due to the needless open connections in the routing nets.

Then, we introduced 200,000 SEUs into the configuration memory, and the bin-width distributions were compared with the golden TDC, as depicted in Figure 9. Figure 10 also shows the comparison of the golden TDC’s bin-width distribution with 3 million injected errors. The findings indicate that SEUs raise the likelihood of ultra-small and ultra-wide bin occurrences, but they had no discernible effect on the TDC’s functionality.

Table 4. Performance comparison of the golden TDC and the faulty TDCs.

	Golden TDC	4K SEUs	200K SEUs	1M SEUs	3M SEUs
Mean Binsize (ps)	5.69	5.69	5.69	5.69	5.69
std (ps)	2.4964	2.4962	2.4861	2.5027	2.5163
INL (LSB) (RMS)	0.5571	0.5686	0.5592	0.5951	0.606
DNL (LSB)(RMS)	0.4383	0.4382	0.4365	0.4394	0.4418

shows an overview of the golden TDC’s and faulty TDC’s performance. The SEUs injected into the configuration memory had no effect on the mean bin size of the TDC, as the table illustrates. For fault-free TDC, the standard deviation from the mean bin size was 2.4964 ps, and injecting 3 million errors resulted in a 0.8% increase in the standard deviation. This corresponds to a 0.02 ps increment in standard deviation from the mean. In addition to the standard deviation from the mean bin width, the root mean square (RMS) INL and DNL of the faulty TDC were compared with the golden TDC. Both INL and DNL are expressed in least significant bits (LSB), where 1 LSB corresponds to the resolution of the TDC, which was 5.7 ps. In comparison to the fault-free TDC, the INL of the defective TDC with 4000 SEUs exhibited a 2.06% increase. For 1 million and 3 million SEUs injected, the INL rose by 6.8% and 8.8%, respectively. Compared to the INL, the DNL was less affected by the introduction of the SEUs. The largest percentage of degradation in DNL was observed when 3 million errors were injected, and it was a 0.8% increase compared to that of the fault-free TDC. INL is the integration of DNL, which measures the cumulative effect of all errors in a single measurement, while DNL measures the difference between consecutive steps. This makes the accumulation of SEUs affect the INL more compared to the DNL. Although the percentage degradation in standard deviation in mean bin width (0.8%) is not huge by accumulation of the SEUs, the 8.8% degradation in INL when 3 million errors are injected is significant in the performance of the TDC in safety-critical systems. Therefore, by enabling the error correction feature of the TMR SEM IP, these errors can be detected and corrected to enhance the reliability of the TDC.

4.3. Performance Comparison with Other Works

The performance of prior FPGA-based TDC implementations and their comparison with this work is reported in

Table 5. Comparison of the performance of recent FPGA-based TDC topologies.

Work/ Year	Technology (nm)	Topology	Delay Elements	LSB [ps]	INL [LSB]	DNL [LSB]	SEU Analysis and Mitigation
[47]/(2023)	16	TDL + wave union	Carry chains	0.4	6.42	51.56	None
[58]/(2024)	28	Counter matrix + wave union	Routing paths	0.36	1.04 (rms)	0.60 (rms)	None
[50]/(2017)	40	Counter matrix	Routing paths	7.4	1.57	0.74	None
[57]/(2022)	20	TDL + wave union	Carry chains	1.23–2.53	5.97	1.75	None
[59]/(2019)	28	DSP delay lines	DSPs	4.2	31.54	20	None
[56]/(2015)	28	TDL + calibration	Carry chains	15 (rms)	0.8	1	None
This work	28	Counter matrix	Routing paths	5.7	0.606 (rms) (with 3 million SEUs injected)	0.4118 (rms) (with 3 million SEUs injected)	Yes

. In Ref. [56], a 15 ps (rms)-resolution TDC based on carry chains of FPGA is implemented. The implementation has a calibration that results in an INL of 0.8 LSB and a DNL of 1 LSB. Similarly, Refs. [47,57] both use carry chains as delay elements; however, a wave union technique is integrated that leads to enhanced resolutions of 0.4 ps and 1.23–2.53 ps, respectively. The authors in Ref. [50] use routing paths as delay elements to achieve a 7.4 ps resolution and an INL and DNL of 1.57 and 0.74 LSB, respectively. In Ref. [58], a wave union technique that uses the routing paths of FPGAs as delay components is implemented, and a 0.36 ps resolution is achieved, with an rms INL of 1.04 LSB and an rms DNL of 0.6 LSB. In Ref. [59], DSPs are used as delay elements, and a 4.2 ps resolution is achieved; however, the INL is large, at 31.54 LSB. As can be seen from the table, none of these FPGA-based TDCs were tested for the TDC sensitivity to accumulation of SEUs in the configuration memory. Our work used routing path delays as delay components, and a 5.7 ps resolution was achieved. In addition, a TMR SEM IP core was integrated into the design to enable fault injection into the configuration memory to analyze the sensitivity of the TDC. The results demonstrate that injection of 3 million errors resulted in an 8.8% degradation in INL and a 0.8% degradation in DNL.

The authors in Refs. [53,60,61,62] design and test ASIC-based TDCs for their tolerance to TID by exposing the TDC to a radiation environment. The comparison between the performance and fault test methodologies of ASIC-based TDCs and our work is summarized in

Table 6. Comparison with a prior radiation test for different topologies of TDCs.

Work/Year	Technology	Topology	Fault Injection Method	Radiation Test Type	Resolution (ps)	INL [LSB] (rms)	DNL [LSB] (rms)
[60]/(2012)	130 nm ASIC	Delta–sigma	Physical	TID	10.5	-	-
[61]/(2004)	800 nm ASIC	Pulse shrinking	Physical	TID	50	0.45	-
[62]/(2004)	250 nm ASIC	DLL	Physical	TID	24	2.1	0.21
[53]/(2019)	65 nm ASIC	Ring oscillator	Physical	TID	15.6	0.34	0.22
This work	28 nm FPGA	Counter matrix	Fault emulation	SEU	5.7	0.606	0.4118

.

5. Conclusions

In this paper, we presented a fast fault emulation framework to investigate the sensitivity of a TDC implemented based on the routing path delays of the FPGA to SEUs injected into configuration memory. A Xilinx TMR SEM IP controller was used to inject faults into the configuration memory of the implemented TDC. The results show that the mean bin width of the TDC was not affected by the SEUs; however, there was a 0.8% degradation in the standard deviation of the bin-width distribution when 3 million errors were introduced and an 8.8% degradation in the INL compared to the performance of the fault-free TDC. As the number of SEUs increased, the degradation in INL of the TDC also increased. The accumulation of SEUs largely affected the INL of the TDC as it measured the cumulative effect of the SEUs on the transfer function of the TDC. On the contrary, the DNL of the TDC was less affected as the number of SEUs injected increased. Although these changes were observed, the intended functionality of the TDC was not altered. However, the accumulation of errors due to SEUs may alter the intended operation of the TDC or cause fatal errors if not continuously monitored and corrected. Hence, for Xilinx 7 series FPGAs, integrating the TMR SEM IP controller, soft errors, and their effects can be monitored and mitigated to ensure reliable operation of the TDC in harsh environments.

In conclusion, using the TMR SEM IP controller for the fault emulation framework enables us to carry out a time-efficient hardware fault injection instead of the time- and power-consuming simulation-based fault injection strategy. The hardware model of the TDC is not changed for fault injection, unlike most traditional fault injection strategies. In the future, validating the results of this emulation framework using physical fault injection is recommended to obtain more realistic results, although it is expensive. Moreover, the sensitivity of different FPGA-based TDC topologies can be tested to see if the effects of SEUs on the performances of TDCs are dependent on their architecture.