I.　Introduction

The use of a system on chip (SoC) based on commercial off-the-shelf devices has become attractive for space and mission-critical applications owing to their high integration and low power consumption [1]. Advanced SoCs, for example, are currently considered appealing candidates for space and high-energy physics experiment applications [2,3].

However, the single-event effect (SEE) caused by energetic particles impinging upon semiconductors impedes the application of nanoscale SoCs in a radiation environment. Energetic particles (e.g., heavy ions, low-or high-energy protons, thermal or fast neutrons, or electrons) can lead to SEEs in advanced SoCs. Protons (the dominant particle in cosmic rays), for example, can induce SEEs on the nanoscale SoC through direct or indirect ionization [4]. As a complex electronic system, the SoC comprises multiple functional blocks with different SEE sensitivity levels. This feature makes the evaluation of SoC challenging. Consequently, the reported tests and analyses regarding SoC sensitivity to SEE tests mainly involve vulnerable blocks or algorithms [5–12]. They have not considered SEE propagation among components in the SoC.

In advanced SoCs, various blocks spread at different locations on the chip. Suppose an energetic particle strikes a certain position, which can cause a SEE on blocks lying at this location. This can also lead to abnormal running of other blocks, even though they are not located in this region. The latter case can be considered as SEE propagation. To the best of our knowledge, the propagation of the SEE at the nanoscale system level has not been mentioned in previous studies. In this study, we performed a microbeam radiation test in a specific region in the Xilinx Zynq-7000 SoC to investigate the propagation of SEEs among the blocks of the device under test (DUT). With different functional blocks integrated and interconnected, the identification and quantification of SEE propagation among blocks is critical for SEE sensitivity analysis, especially because various applications may utilize the blocks in different ways. Unlike broad-beam irradiation, the target device is not entirely covered by one beam in microbeam irradiation [13,14]. Microbeam irradiation, benefiting from the micrometer-level beam spot, can provide information regarding SEE-sensitive locations and cross sections of the tested blocks to enable a more accurate analysis. Therefore, in this work, microbeam irradiation is used to explore SEE vulnerability on the nanoscale SoC.

Additionally, event tree analysis (ETA) was adopted to evaluate the block SEE consequence based on the results obtained from the microbeam irradiation. ETA is a technique for analyzing system reliability and quantifying risk to illustrate the consequences of an initial event (IE) and quantitatively predict the probability of possible outcomes [15–17]. Finally, we analyzed the SEE propagation from the irradiated block to the corresponding target block by combining the microbeam irradiation test and ETA.

To our knowledge, this is the first attempt to apply microbeam irradiation in conjunction with ETA to analyze the propagation of SEEs in a complex SoC. Currently, SEE evaluation in nanoscale SoCs remains an open question [18,19]. We expect that this effort will contribute to a comprehensive assessment of SEEs in nanoscale SoCs.

The rest of the paper is organized as follows: Section 2 briefly reports the SEE tests on the SoC. Section 3 introduces the architecture of the SoC under test and the test methodology for the evaluated blocks. Section 4 elaborates on the experimental setup, while Sect. 5 reports the experimental results of the microbeam. Section 6 is dedicated to ETA. Finally, the conclusions and future work are presented in Sect. 7.

II.　Related Work

Research has been performed on the effects of radiation on the Xilinx Zynq-7000 Series SoC. It involves different analyses, tests, and fault-tolerant solutions. Gallagher et al. [5] discussed the electron-induced SEE. Tambara et al. [6,7] examined SEE cross sections under several conditions. Amrbar et al. [8] detected a latch-up event and predicted the orbit soft error rate. de Oliveira et al. [9] explored the soft error in a lockstep dual core with heavy-ion irradiation. Stoddard et al. [10] developed a processor configuration access-port-based scrubbing strategy. Benevenuti et al. [11] took advantage of multi fault injection methods and explored the neural network algorithm error rate. Kibar et al. [12] evaluated the impact of repetition, redundancy, scrubbing, and partitioning through neutron beam irradiation.

Benefiting from the feature of fine scanning, both pulse lasers and heavy-ion microbeams have been applied in SoC irradiation tests. For example, Rodrigues et al. [20] conducted experiments exposing the decapsulated processor to laser beams targeting the data cache memory and emulation fault injections in the register file. Kohler et al. [21] compared the SEE laser energy thresholds for several types of memory. Pouget et al. [22] presented a methodology for analyzing the two-photon absorption laser testing results of the frequency domain. Pulse lasers and heavy-ion microbeams have also been used to explore SEEs on the DUT [23,24]. However, heavy-ion microbeam irradiation testing differs from laser irradiation testing and has some advantages. For example, the mechanisms of generating electron–hole pairs are Coulomb interactions for heavy ions, not absorption as for photons [25], which is the same as space irradiation. The metal layers in the devices reflect the laser, and the laser may not penetrate the sensitive region. However, heavy-ion microbeam irradiation testing has no such drawback as long as the energy is sufficiently high [26]. In addition, energy deposition is different. Laser energy loses more first along its track, but the ion loses much energy in the Bragg region of its range. Certainly, laser irradiation testing has advantages such as ease of performance.

To date, we have performed two heavy-ion microbeam irradiation tests on the SoC [27,28]. Our efforts first demonstrated that heavy-ion microbeams can be used to explore the SEE-sensitive location distribution on the advanced SoC effectively. In detail, the identification of the SEE-sensitive location distribution involving on-chip memory (OCM), D-Cache, arithmetic logic unit (ALU), floating-point unit (FPU), and peripheral blocks has been reported. The merits of microbeam irradiation have been verified in these studies. In addition, we also conducted other irradiation tests on the SoC, covering protons, neutrons, electrons, and heavy-ion broad beams [29–35]. Specifically, for the Xilinx Zynq-7000 SoC, SEEs induced by 3–10 MeV protons and medium-energy protons were examined and analyzed in [29] and [30], respectively. Atmospheric neutrons leading to the SEE were evaluated and analyzed using the China Spallation Neutron Source in [31]. The SEE caused by 12-MeV electrons was analyzed in [32]. In [33], by taking advantage of heavy-ion broad-beam irradiation, the soft error rates of different modes were predicted. This is different from the reported efforts. In this study, we primarily focused on SEE propagation in a nanoscale SoC.

III.　SoC Architecture and Block Testing

The Xilinx Zynq-7020 SoC was the tested device manufactured using a 28-nm complementary metal-oxide semiconductor. Unlike traditional individual processor systems or programmable devices, both are integrated into the SoC. Specifically, it is composed of a processing system (PS) and a programmable logic (PL) part in a single chip. Figure 1 shows a schematic of the SoC. It can be seen that the PS is composed of dual 32-bit ARM Cortex-A9 CPUs with an L1 I-Cache and an L1 D-Cache, a shared L2 cache, an OCM, and multiple controllers and peripherals [36]. Moreover, Fig. 1 highlights the tested blocks in yellow, while the irradiated blocks are marked in red. The ball-grid array package chip was de-capped and mounted on a customized circuit board whose size matched the sample stage of the microbeam facility.

Fig. 1Full-screen View

Schematic of the Xilinx Zynq-7020 SoC [36]. The red marked area is the irradiated block, while the yellow marked areas are the tested blocks.

The region in the chip associated with the OCM was verified by reverse engineering and microbeam irradiation, as described in previous manuscripts [27,28]. Figure 2(a) displays the locations of the PS and PL parts on the chip, and Fig. 2(b) shows the target region, which is the OCM block in which it is located, with a size of ~1900 µm × 580 µm. This was also the irradiated region in this study.

Fig. 2Full-screen View

(Color online) Xilinx Zynq-7020 SoC as a benchmark: (a) top view of the SoC without capping; (b) irradiated OCM regions.

Blocks of a single core of the PS were tested using a software test routine. The tested blocks were the D-Cache, ALU, register, and peripheral blocks, which involve direct memory access (DMA) transmission. The D-Cache was disabled in other block tests, and the utilized data were not directly generated from the OCM. The blocks were tested dynamically.

The details of each block test are described as follows:

D-Cache test: A pattern 0xFF (patterns, e.g., 0x00, 0xAA, 0x55, 0xA5, and others are also available) was written into the 32 kB L1 D-Cache. The host determined whether errors emerge during irradiation by flushing, writing, and invalidating the corresponding ranges.

ALU test: A set of logic and arithmetic operations was designed. The logic operation included logical AND, OR, and left-and right-shift operations (e.g., a $\gg$ b $\ll$ c, where a, b, and c are integer variables). Arithmetic operations, such as addition and multiplication, were performed on the operands (e.g., (a−b+c)×d, where a, b, c, and d are integer variables). The host read the tested values and compared them with the expected values to identify the irradiation-induced error.

Register test: Some general-purpose registers, such as R0–R12, were tested. First, the current data in the target registers were kept temporarily. These registers were set as pattern 0xFF (patterns, e.g., 0x00, 0xAA, 0x55, 0xA5, and others are also available). Lastly, we continuously checked whether a datum was corrupted by reading and comparing. These operations were repeated during beam scanning.

Peripheral test: DMA was tested in the peripheral block. An array was allocated to DDR memory with known data. Data were transferred from the occupied array to a new empty array using DMA and read-back. Once each transfer was completed, the host decided upon whether an error occurred during beam hitting by comparing the read values with the known ones.

This study aims to explore SEE propagation from the OCM to the tested blocks in the SOC. For a tested block, the status of data in the OCM can be divided into several conditions. For example, they are frequently accessed by the tested block, occasionally accessed by the tested block, or not accessed by the tested block. All these cases are possible when an energetic particle hits the OCM region. The analysis complexity of SEE propagation in each case is also different. This study is the first to discuss SEE propagation in a complicated SoC. During microbeam irradiation, we avoided the tested blocks accessing data in the OCM by setting the section to memory mapping (e.g., .text, .init, or .fini) in the linker script (lscript.ld) to simplify the analysis. We speculate that the SEE propagation probability may vary for different conditions, but the approach proposed in this study is still applicable.

IV.　Microbeam Irradiation Setup

Microbeam irradiation in a vacuum environment was conducted at the Beijing HI-13 tandem accelerator at the China Institute of Atomic Energy. Fig. 3 shows the layout of the microbeam facility terminal. The heavy-ion microbeam was obtained using a pinhole collimation approach. After two collimations, the ejected ion beam from the accelerator was cut into a 100-μm spot, striking the target region of the chip. The particles used during the microbeam radiation test were ³⁵Cl particles at 145 MeV. The linear energy transfer of this ion is ~13.59 MeV·cm²·mg⁻¹ and the penetration range in silicon is ~41.8 µm [37].

Fig. 3Full-screen View

Layout of the microbeam facility terminal.

For each block test, scanning started from point 0, as shown in Fig. 2(b). The upper left corner of the starting position of the OCM region was obtained from reverse engineering. The diameter of the beam spot was 100 µm, and the movement track in the target region was zigzag along the horizontal (L in Fig. 2(b)) and vertical (W in Fig. 2(b)) directions. During the irradiation, the ion beam emission position was fixed, and the DUT was held by the sample platform to enable movement to realize scanning different locations inside the OCM region. A universal serial bus cable powered it and provided communication between the DUT and the host personal computer. More details of the beam processing and experimental setup are reported in [27]. The SoC was run at a normal supply voltage without any biases in the functional blocks. In this study, the OCM region was irradiated at 114 different locations. Approximately 495 ions strike the devices within the beam spot per second. For each beam spot, the beam lasted ~1.75 s, and the beam switch controlled the duration. During the entire irradiation, the accelerator and beam status remained stable. Therefore, the total number of irradiated ions was ~866 for each spot, with a maximum of 10% nonuniformity. The scanning duration of each tested block was ~200 s, and the fluence φ of ~8.95×10⁶ cm⁻² was calculated using

where τ_i is particle number of each spot and δ is the area of the scanned region in cm².

V.　Microbeam Irradiation Results

A total of 32 different SEEs were detected for all the tested blocks. They were single-event functional interruption (SEFI) events rather than single-event upset events, as the system underwent malfunction. Specifically, these SEFI events behaved as the system halted, and they needed operations, such as restarting the program or repowering, to continue. These results are considered reasonable because of the setting of the OCM in the linker script. The D-Cache, ALU, register, and peripheral blocks were tested when the OCM region was irradiated without reading. The detected SEFI concerns these tested blocks.

Table 1 lists the SEFI events associated with each tested block and the corresponding recovery operations. It can be seen that the majority of SEFI events can be recovered by a software reset, although one case requires power cycling the device. This phenomenon demonstrates that the SEE can propagate from one block to another. In this research, SEEs have propagated from the irradiated block to other nonirradiated ones, causing system malfunctions. The detected events and system malfunctions illustrate that the influence of SEE propagation in nanoscale SoC radiation effect evaluation should be considered.

Figure 4 displays the SEE sensitivity location distributions of the D-Cache, ALU, register, and peripheral blocks obtained from irradiating the OCM geometry. The locations regarding OCM sensitivity spots are from the previous experiment [27]. Compared with that of the OCM block, SEE sensitivity location distributions are independent and scattered for these tested blocks. It has also been noted that the SEE sensitivity locations of the tested blocks are often not coincident or overlapped with the OCM's. This characteristic has been emphasized because, even though the SEE sensitivity locations of the OCM have been previously evaluated, the evaluation does not identify all SEE sensitivity locations of this region. The detected events demonstrate other blocks' experiencing vulnerability resulting from the SEE generated in the OCM. The sensitivity can be considered as proof of the SEE propagation from one block to another. The discovery is one of the main contributions of the current study. We speculate that other operating blocks may also suffer from the SEE when an energetic particle strikes the OCM region, apart from the tested blocks.

Fig. 4Full-screen View

Distribution of SEE sensitive spots of the tested blocks while irradiating the OCM region. OCM* is the result from [27].

We focus on the influence of spatial propagation because we tested the functions of other blocks while irradiating the OCM region. The sensitive spots in Fig. 4 show that all SEFI events in various blocks are generated from errors in the OCM block. The influence of OCM errors on other blocks' functions is different, not exhibiting a clear rule; therefore, the sensitive spots in Fig. 4 are not regular for different block errors. These results indicate the complexity of the SoC. However, some errors in the OCM cause more than one block malfunction, such as the position (400,1050) in Fig. 4, implying that this spot is highly vulnerable. For the D-Cache test, the influence of OCM errors is regular because the sensitive spots for the D-Cache in Fig. 4 are aligned. This is because both the OCM and D-Cache are memories, and the data in them are stored in matrix styles, and data reading is simple and mainly decided by data in matrices (aligned spatially). Nevertheless, the functions of the other blocks are more complicated. Through microbeam irradiation, we first presented this connection based on the location distribution. For each test, the program is based on plenty of resource communication, and these resources are distributed over different positions inside the chip. These phenomena illustrate the complexity of evaluating the SEE in nanoscale SoCs.

The SEE cross sections of the tested blocks of the current work and those in [27] are presented in Table 2 to further evaluate the above-reported influence. The SEE cross section $\varnothing$ in (cm²) is calculated using

where φ is the cumulative fluence of each block’s irradiation in cm⁻² and n is the detected SEE number in each block's irradiation.

Note that the cross section in this work is associated with the irradiation of the OCM block region. The detected SEE events of the tested blocks were not based on irradiation of their locating regions. As can been learned from Table II, the SEE cross sections are less than those in [27] by almost an order of magnitude for the tested blocks. This implies that events generated in the OCM can affect the SEE sensitivity of other blocks to a certain degree. To further illustrate the SEE influence from the OCM block, ETA was applied to analyze the microbeam irradiation results.

VI.　SEE Propagation Analysis Using ETA

ETA is an effective technique for assessing the probabilities of different failure outcomes for a complex system starting from an IE. Relying on ETA, we performed a reliability analysis reporting the likelihood of experiencing multiple failing subsystems within the SoC, starting from a common error source (i.e., the SEE in the OCM in this work's analysis). The event tree was built according to the probability of the blocks' failure or success (FX or SX). Finally, ETA provides a tree simplification and a quantitative failure probability calculation. The brief procedures for performing ETA are as follows:

1. Determine the initial event of the analyzed system.

2. Analyze the system's structure and build the relationship between each element and the states of success or failure.

3. Construct an event tree. According to the relationship and state, the event tree starts from the IE and pushes from left to right (with success (S) being above and failure (F) being below). If a branch event does not need to be analyzed, the horizontal line extends without branching.

4. Explain the results of the analysis and conduct event tree simplification and perform quantitative calculations. Calculate the probabilities of the different event sequences. The event sequence's final occurrence probability equals the product of the initial event's likelihoods and others in each independent phase.

Fig. 5 shows a simplified schematic as an example of ETA.

Fig. 5Full-screen View

Schematic of an ETA: IE = initial event; SX = success for block X; FX = failure for block X; P(*) = related event probability.

In our research, to build the event tree, the failure rates of tested blocks were evaluated using the figure of merit (FOM) method. The FOM method can be used to estimate the failure rates of the tested blocks based on the obtained SEE cross sections from the irradiation tests. Table 3 displays the failure rates of the blocks in low earth orbit with an average altitude of 420 km and 5 mm of aluminum shielding [19, 38]. The coefficient in the FOM method for the failure rate and cross section was generated from [38]. With that, we built the relationship between the cross section from our previous microbeam irradiation in [27] and the failure rate using the FOM. These form the basis of the ETA, and failure rates were adopted in the analyses. Moreover, during irradiation, the OCM block region was irradiated, the D-Cache block was disabled in other tests, and the SEE of each block was examined one by one. These operations helped to build block independence and also drove the implementation of ETA.

In the constructed event trees, the SEE in the OCM block is the IE, and the values of the SEE cross section and the failure rate were 6.68×10⁻⁷ cm² and 9.35×10⁻⁴ day⁻¹, respectively [19,38]. Block interconnection allows possible event propagation based on the following sequences:

OCM > D-Cache > register > ALU,

OCM > D-Cache > register > ALU > peripheral.

Therefore, we analyzed SEE propagation in the ETA on both sequences. Meanwhile, we assumed that the SEFI event occurred separately in the tested blocks of these ETAs. For the tested block, because the OCM data have several statuses as described in Section 3, clarification is required that the following probability is under the condition of OCM data not accessed by the test block during irradiation. This does not mean that other event sequences do not exist. In both ETAs, blocks 1, 2, and 3 represent D-Cache SEFI, register SEFI, and ALU SEFI, respectively. In the second event tree, block 4 was the peripheral SEFI.

The event tree of the ALU block is illustrated in Fig. 6. In this event tree, S1 is 2.28×10⁻⁴, which means that the probability of the D-Cache block encountering a SEFI is 2.28×10⁻⁴ per day when particles are hitting the OCM block region. F1 means no D-Cache SEFI events during hitting with a probability of (1–2.28)×10⁻⁴. If other blocks do not suffer from SEFI, the system output is abnormal because of the SEE emerging in the OCM region. In other cases, if SEFI occurs in any block, the related ongoing operation will be interrupted. Hence, the outcomes are SoC SEFI and output abnormalities. In the event tree, SoC SEFI (n) refers to n blocks undergoing a SEFI. According to the built event tree in Fig. 6, the probability is 3.31×10⁻¹⁶ for OCM, D-Cache, register, and ALU blocks suffering SEEs simultaneously. This implies that the probability is low. It also suggests that the condition of one SEFI propagating to several blocks at the same time exists but with a low probability. The event tree for the peripheral block is shown in Fig. 7. It is obvious that it is an extension of the ETA on the ALU block, as shown in Fig. 6. The probability of SoC SEFI (4) is 1.50×10⁻²⁰, which means that the probability of one SEE leading to four blocks' SEFI events in the SoC is at the level of 10⁻²⁰. Compared with that in Fig. 6, this was much lower.

Fig. 6Full-screen View

Event tree of the ALU block while irradiating the OCM region. SoC SEFI (n) means n blocks encounter a SEFI in Outcome.

Fig. 7Full-screen View

Event tree of the peripheral block while irradiating the OCM region. SoC SEFI (n) means n blocks encounter a SEFI in Outcome.

The following probabilities can also be summarized in the comprehensive analyses of the built event trees for ALU and peripheral blocks in Figs. 6 and 7. When the OCM block is struck by an energetic particle and experiences the SEE, the likelihood of another block facing SEFI is at the 10⁻⁸–10⁻⁷ level. The other two blocks encounter SEFI events simultaneously with a probability at the 10⁻¹²–10⁻¹¹ level, and another three blocks simultaneously experiencing SEFI events are at the level of 10⁻¹⁷–10⁻¹⁶. This action quantitatively describes SEE propagation at Xilinx Zynq-7020 SoC. This is another important contribution of the present study.

During each block's test, except for executing the algorithm, we did not perform other operations (e.g., monitoring the processor status or capturing the exceptions and traps) because we consider these executions would introduce other factors or operations, such as adding the reading or comparing operations Definitely, these operations can provide more information; however, they are also affected by the particles hitting the OCM region, thus complicating the propagation analysis. We consider introducing other operations as different cases from the current work's efforts.

Owing to the complexity of the SoC, it is difficult to completely clarify the relationship between phenomena and mechanisms. Therefore, we attempted to apply microbeam irradiation to reduce the uncertainty of the broad-beam irradiation and use ETA to analyze the error propagation in the SoC because the SoC is a complex system.

In this work, SEFI events of several other blocks were investigated with a 100-µm microbeam beam spot while irradiating the OCM block region. The results suggest that SEE analysis and hardening in an advanced SoC should be considered at a system level instead of solely for the tested blocks, especially because SEE propagation causes SEFI events and leads to system malfunction.

SoCs integrate various blocks, and these blocks interconnect via power rails, clocks, reset circuits, and other components. They may propagate the corrupted data from one block to the others, leading to single-event upset events in the nonirradiated blocks. Other blocks may also capture abnormalities in interconnected resources caused by particles striking one block region, leading to SEFI on one or more running blocks in the nonirradiated region. The tested blocks do not access data in the OCM block, but SEFI propagation was investigated in the current study. This is more akin to the second situation. Therefore, this work was dedicated to evaluating SEFI events. This work provides a solution for analyzing SEE propagation at the system level based on heavy-ion microbeam irradiation and ETA. Although the DUT of the current research is the Xilinx Zynq-7000 Series SoC, this solution is applicable for system- or circuit-level SEE propagation analysis.

VII.　Conclusion and Future Work

Various functional blocks (e.g., D-Cache, ALU, register, and peripheral blocks) were tested while running corresponding programs under irradiation of the OCM region in the Xilinx Zynq-7000 SoC. Under the condition of no data in the OCM being accessed by tested blocks during the irradiation, SEE sensitivity location distributions and cross sections were obtained from the heavy-ion microbeam irradiation. The sensitivity location distribution illustrates that functional blocks can also be vulnerable to failures related to particles hitting the regions of other blocks. Based on the detected SEE cross sections, the failure rates of the tested blocks were evaluated. Event trees were then constructed for the ALU and peripheral blocks. The probabilities of some event consequences were predicted. The OCM block experienced an SEE event, and the ongoing execution blocks did not access the data in the OCM. In this case, the likelihood of another block undergoing SEFI was at the 10⁻⁸–10⁻⁷ level, and the other two blocks encountered SEFI simultaneously with a probability of 10⁻¹²–10⁻¹¹ level. Another three blocks simultaneously experiencing SEFI were at the probability level of 10⁻¹⁷–10⁻¹⁶.

This work is the first attempt to quantitatively evaluate SEE propagation in an advanced and complicated SoC. Although it only involves SEE propagation of several blocks in one condition, this work provides a solution for analyzing and assessing SEE propagation at the system level.

SEFIs are related to multiple factors, such as spatial, logic, and timing factors, in an advanced SoC. It is difficult to clarify their propagation and influence at the same time completely. This study focused on the spatial propagation influence because we tested other blocks' functions while irradiating the OCM region, and tested blocks did not directly access data in the OCM. In the future, we will further extend the study to other factors (e.g., data transmission in logic between irradiated and test blocks, timing, and software test cases) during microbeam irradiation. In addition, based on this study, we plan to evaluate and analyze more cases and introduce more operations, such as monitoring processor traps and exceptions in these tests.