Single event upset mitigation for sequential elements

Abstract

A circuit 700 for detecting, and optionally correcting, single event upsets (SEU) or glitches in an electronic circuit includes at least one edge detection sub-circuit 710, 712 connected to a sequenti

Description

FIELD This invention relates to a method for mitigating the effects of radiation on electronics, in particular for mitigating the effects of single event upsets and transients in digital electronic circuits such as those that include sequential elements. BACKGROUND Integrated circuits and programmable logic devices such as field programmable gate arrays (FPGAs) are used within many industries where the safety of systems is of paramount importance, such as in the aerospace or nuclear industries. These integrated circuits are susceptible to Single Event Upsets (SEUs) or glitches. SEUs are random, non-destructive events caused by energetic particle strikes from radiation. Areas of high exposure to radiation may be from cosmic radiation exposure in space applications, or from a nuclear reactor environment. Other types of electronic devices are also susceptible to SEUs, such as microprocessors, semiconductor memory or power transistors. An SEU can cause a logic register (e.g., a flip-flop in sequential circuits) to flip its state, thus leading to unexpected device operation. The effect of an SEU on an integrated circuit is not considered to permanently damage a circuit or a transistor. However, the SEU may cause an integrated circuit to not function as intended as data held in memory or the output of a computation may change. This may be catastrophic in certain use cases. In critical applications, Triple Modular Redundancy (TMR) is a specific and highly reliable error correction technique that is often used. TMR involves triplicating a component or digital circuit of an application device. Each component stores the same piece of information or computes the same calculation. For example, if there is a flip-flop in a digital system, TMR uses three identical flip-flops instead of one. Each of these three flip-flops operates independently on the same input data. The outputs from these triplicated circuits are then compared to identify any discrepancies. If all three flip-flops produce the same output, it is assumed to be correct, and no error correction is needed. However, if one of the flip-flops produces a different result due to an error, the system uses a voting mechanism to determine the correct value. Typically, the two matching outputs are considered correct, and the mismatched one is disregarded. TMR provides a high degree of fault tolerance. In applications where system failures can have catastrophic consequences, TMR ensures that even if one of the triplicated components experiences an error or a fault (e.g., due to radiation, cosmic rays, or other environmental factors), the system can continue to operate without disruption. While TM R introduces redundancy into the system, this comes at the expense of a large overhead of increased hardware, power consumption and cost. The preceding discussion of the background to the invention is intended only to facilitate an understanding of the present invention. It should be appreciated that the discussion is not an acknowledgment or admission that any of the material referred to was part of the common general knowledge in the art as at the priority date of the application. SUMMARY In accordance with an aspect of the technology there is provided a circuit for detecting single event upsets (SEUs) or glitches in electronic circuits, comprising: at least one edge detection sub-circuit connected to a sequential circuit element input or output which generates a signal if the sequential circuit element input or output changes logic levels; at least one comparison sub-circuit which compares the signal from the edge detection sub-circuit with a signal generated on an active edge of a clock signal of the sequential circuit element; wherein the comparison sub-circuit detects an SEU or glitch if the two signals do not coincide. The technology may also be capable of correcting SEUs. Therefore, in accordance with further aspects of the technology there is provided a circuit for detecting and correcting single event upsets (SEUs) or glitches in electronic circuits, comprising: a falling edge detection sub-circuit connected to a sequential circuit element output which generates a signal if the sequential circuit element output changes from logic 1 to logic 0; a rising edge detection sub-circuit connected to the sequential circuit element output and which generates a signal if the sequential circuit element output changes from logic 0 to logic 1; and a clock signal edge detection sub-circuit connected to a clock signal of the sequential circuit element and which generates a signal on an active edge of the clock signal; wherein the circuit asynchronously sets the sequential circuit element output to logic 1 if the signal from the falling edge detection circuit does not coincide with the signal from the clock signal edge detection sub-circuit; and wherein the circuit asynchronously resets the sequential circuit element output to logic 0 if the signal from the rising edge detection circuit does not coincide with the signal from the clock signal edge detection sub-circuit. The sequential circuit element may be a flip-flop (FF). The FF may be a D-type FF, a J-K type FF, an SR type FF, a T type FF. The rising edge detection sub-circuit may include an AND gate (AND1) which receives the sequential circuit element output and a delayed version of the sequential circuit element output. The delayed version of the sequential circuit element output may be obtained by inputting the sequential element output into a number of inverters (INV1). In one exemplary embodiment, the inverters (INV1) are NOT gates and the number of NOT gates is an odd number so that the delayed version of the sequential element output is not inverted compared to the sequential element output. The number of NOT gates is also chosen so that the cumulative timing delay of all of the NOT gates together corresponds to the duration of the signal generated by the rising edge detection sub-circuit. The falling edge detection sub-circuit may include a NOR gate which receives the sequential circuit element output and a delayed version of the sequential circuit element output. The delayed version of the sequential circuit element output may be obtained by inputting the sequential element output into a number of inverters (INV3). In one embodiment, the inverters are NOT gates and the number of NOT gates is an odd number so that the delayed version of the sequential element output is not inverted compared to the sequential element output. The number of NOT gates is also chosen so that the cumulative timing delay of all of the NOT gates together corresponds to the duration of the signal generated by the falling edge detection sub-circuit. The clock signal edge detection sub-circuit may include an AND gate (AND2) which receives the clock signal of the sequential circuit element and a delayed version of the clock signal of signal. The delayed version of the clock signal may be obtained by inputting the clock signal into a number of inverters (INV2), wherein the inverters are NOT gates and wherein the number of NOT gates is an odd number so that the delayed version of the clock signal is not inverted compared to the clock signal. The circuit may include an exclusive OR (XOR) gate (XOR1), and the signal from the rising edge detection sub-circuit and the signal from the clock signal edge detection sub-circuit may be the inputs into the XOR gate. An output of the XOR gate may be input, directly or indirectly, into a RESET port of the sequential element, where the RESET port asynchronously resets the sequential circuit element output to logic 0 when it receives a signal. The circuit may include an AND gate (AND6) which receives the output of the XOR gate (XOR1) and a delayed version of an input of the sequential circuit element, and the output of the AND gate may be connected to the RESET port. The circuit may include a second exclusive OR (XOR) gate (XOR2), and the signal from the falling edge detection sub-circuit and the signal from the clock signal edge detection sub-circuit may be input into the second XOR gate. An output of the second XOR gate may be input, directly or indirectly, into a SET port of the sequential element, where the SET port asynchronously sets the sequential circuit element output to logic 1 when it receives a signal. The circuit may include an AND gate (AND5) which receives the output of the second XOR gate (XOR2) and a delayed version of an input of the sequential circuit element, and the output of the AND gate may be connected to the SET port. The technology extends to a method of detecting single event upsets (SEUs) or glitches in electronic circuits, generating a signal if a sequential circuit element input or output changes logic levels; comparing the signal to a signal generated on an active edge of a clock signal of the sequential circuit element; and detecting an SEU or glitch if the two signals do not coincide. The method may include: generating a first signal if an output of a sequential circuit element changes from logic 1 to logic 0; generating a second signal if an output of the sequential circuit element changes from logic 0 to logic 1; generating a third signal on an active edge of a clock signal of the sequential circuit element; comparing the first signal and third signal and, if they do not coincide, asynchronously setting the sequential circuit element output to logic 1; and comparing the second signal and third signal and, if they do not coincide, asynchronously resetting the sequential circuit element output to logic 0. The step of asynchronously setting the sequential circuit element output to logic 1 may be performed only if a delayed version of an input of the sequential circuit element is logic 1. The step of asynchronously resetting the sequential circuit element output to logic 0 may be performed only if a delayed version of an input of the sequential circuit element is logic 0. Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS In the drawings: Figure 1 illustrates two flip-flops with rising and falling edge-triggering respectively; Figure 2 are truth tables for the rising and falling edge triggering flip-flops from Figure 1; Figure 3 is an exemplary D-type flip-flop which includes SET and RESET inputs; Figure 4 is a waveform diagram of input and output signal logic states of the flip flop of Figure 3; Figure 5 is a waveform diagram similar to Figure 4, including SET and RESET function signals; Figure 6A is an exemplary rising edge detection sub-circuit and corresponding waveform diagram; Figure 6B is exemplary falling edge detection sub-circuit and corresponding waveform diagram; Figure 7 is a schematic block diagram illustrating logic components of a circuit for detecting and correcting single event upsets (SEUs) or glitches in electronic circuits according to the technology; Figure 8A is a circuit diagram of an exemplary circuit implementation of the logical components of Figure 7; Figure 8B is a circuit diagram similar to Figure 8A but which includes additional circuit elements to prevent uncontrolled oscillations of the SET and RESET signals; Figure 8C is a circuit diagram similar to Figure 8B but which includes additional circuit elements to enable a controlled state at system start-up, and the ability to emulate an SEII; Figure 9 is a timing diagram which shows the operation of a flip-flop of Figure 8C without simulated errors; Figures 10A-10I are timing diagrams which show the operation of the circuit of Figure 8C with SEU’s being simulated; Figure 11A-11C are timing diagrams which show the operation of circuit of Figure 8C with single event transients being simulated; Figure 12 illustrates how the circuit of the technology integrates with a sequential logic circuit; and Figure 13 is a block diagram of a method of detecting and correcting SEUs or glitches in electronic circuits according to the technology. DETAILED DESCRIPTION WITH REFERENCE TO THE DRAWINGS Embodiments of the invention provide a circuit and a method for detecting and correcting or masking single event upsets (SEUs) or glitches in digital electronic circuits. The embodiments may not require circuit redundancy measures, such as double or triple modular redundancy, but rather may exploit the timing operation of a sequential circuit to detect and, optionally, to correct or mask SEUs. Sequential circuits may include any digital electronic circuit where multiple inputs and outputs may be present and where the next state (output) is dependent on the previous state (input). A sequential circuit element may include: a D-type flip-flop, a J-K type flip-flop, an SR flip-flop, a T type flip-flop, or any other sequential circuit element. A simple example of the functioning of a sequential circuit is one where the output is equal to the input. In the described embodiments, a D-type flip flop is illustrated but it will be appreciated that the technology is not limited to D-type flip flops, but any sequential circuit elements could be used. Sequential circuits rely on a clock signal to change the output based on an input. A clock signal is usually a square wave signal that controls the timing of internal operations of a circuit. The clock signal value repeatedly transitions from a low logic state (a value of 0) to a high logic state (a value of 1), each clock signal having a fixed and repeatable length of time (or frequency). Within a sequential circuit, a change in the output signal occurs during an edge of a clock signal (when a logic state changes from 0 to 1 or vice versa). This is referred to as a synchronous circuit, as the output only changes at specific intervals defined by the clock signal. In this description, a sequential circuit is illustrated where the change occurs at the rising or positive edge of the clock signal (clock logic state changes from 0 to 1). However, the technology may also function for a circuit where the change occurs at the negative or falling edge of the clock signal (clock logic state changes from 1 to 0). As the change in output state is synched to the clock signal, a constraint can be enforced that a change of an output signal of a flip-flop must coincide with the active edge of the clock signal. For example, if the clock signal is unstable or data input violates setup and hold time requirements, it can be inferred that there may be an error in the sequential element’s operation. An embodiment of the technology monitors the output of the sequential element for bit flips. Bit flips should only occur at the active edge of the clock signal (either rising or positive edge, or falling or negative edge). This is a fundamental property of sequential elements. Therefore, an embodiment of the technology may exploit the fundamental timing operation of the sequential element. The technology provides a circuit for detecting single event upsets (SEUs) or glitches in electronic circuits, including at least one edge detection sub-circuit connected to a sequential circuit element output which generates a signal if the sequential circuit element output changes logic levels; at least one comparison sub-circuit which compares the signal from the edge detection sub-circuit with a signal generated on an active edge of a clock signal of the sequential circuit element; and wherein the comparison sub-circuit detects an SEII or glitch if the two signals do not coincide. A rising edge or a falling edge of a signal can be detected by using a rising edge detection circuit or a falling edge detection sub-circuit, respectively. These sub-circuits may output a short high logic state (a value of 1) when either a positive change (from 0 to 1) occurs, or when a negative change (from 1 to 0) occurs. These circuits may continuously monitor a signal to or from a sequential circuit to determine when a rising edge or a falling edge occurs. A combination of rising edge detection circuits and falling edge detection circuits may monitor various signals to determine if any change was in sync with the clock signal or not. Furthermore, additional circuit components may include a self-correction component, whereby an asynchronous change in the output signal that may occur due to an SEU is corrected. Figure 1A and Figure 1B shows two sequential elements (100), in this case flip-flops (FFs). The sequential elements (100) include a rising edge-triggered flip-flop (110), wherein an input signal is captured when a clock signal (115) has a rising edge, and a falling edge-triggered flip-flop (120) wherein an input signal is captured at a falling edge of a clock signal (125). Figures 2A and 2B show truth tables of the logic states of the input signal (D) and output signals (Q and Q-bar) for Figures 1A and 1B respectively. A rising edge-triggered flip-flop truth table (210) shows that an input signal D (212) is captured on the rising edge of the clock signal (214). An upward arrow (222) indicates that the sequential element is sensitive only to a rising edge of a clock signal. An output signal Q (216) is then set to the value of the input signal D (212), and a complement value Q-bar (218) is set to a NOT Q value (the opposite of the output signal Q (216) in a binary operation). A truth table for the falling edge-triggered sequential element (230) differs only that the input signal D (212) is captured on the falling edge, represented by the downward arrow (232), otherwise the operation of a sequential element is identical. Synchronous inputs are transferred in the triggering edge of the clock signal. Most flip-flops have other inputs that are asynchronous, meaning they affect the output independent of the clock. Two such inputs are normally labelled set (SET or PRESET) and clear (CLR or RESET). These inputs are usually active LOW but can be active high. In this description these inputs are labelled SET and RESET. Figure 3 shows an embodiment of a sequential circuit (300) in the form of a flip-flop, which may include a configuration of 4 input signals and 2 output signals. An input signal D (302) is an input that is applied to the flip-flop and is used to determine an output signal Q (306) after internal computational processing by the flip-flop (300). A clock signal (304), or CLK, is a square wave signal that controls the timing of internal operations of the flip-flop (300), such that an output signal Q (306) is synchronised with the clock signal (304). In an embodiment of the invention, the output signal Q (306) may be the logic state (0 or 1) of the input signal D (302) from the previous clock signal or the value of the input signal D (302) when the clock signal (304) is at the rising edge (changes from 0 to 1). Furthermore, an output signal complement Q-bar (308) stores the complement (opposite value) of the output signal Q (306). The flip-flop (300) includes two further input signals, a SET signal (310) and a RESET signal (312). A high logic state (1) of the SET signal (310) sets the output signal Q (306) to a high logic state (1), whereas a low logic state (0) of the SET signal (310) has no effect on the output signal Q (306). A high logic state (1) The RESET signal (312) sets the output signal Q (306) to a low logic state (0), whereas a low logic state (0) of the RESET signal (312) has no effect on the output signal Q (306). The SET signal (310) and the RESET signal (312) function asynchronously, such that the logic state of the output signal Q (306) will change immediately when a SET signal (310) or a RESET signal (312) is applied and not only applied at an edge of a clock signal. A sequential element may include other synchronous and asynchronous input and output signals. Figure 4 illustrates a waveform diagram (400) of the logic states of the input and output signals of a sequential circuit (300). The first waveform is the clock signal (304). The clock signal is a square wave with rising edges, repeatedly transitioning from a low logic state (0) to a high logic state (1) and back again at set intervals, defined by the clock signal frequency. The output signal Q (306) is represented by the next signal waveform and is the stored value of the input signal D (302). The input signal D (302) is shown as the lowermost signal waveform and is configured to be captured by the sequential element (300) on the rising edge of the clock signal. Although the input signal D (302) can change at any time, the flip-flop only captures it on the rising edge of the clock. The SET signal (310) and RESET signal (312) are also shown as waveforms on the diagram. SET and RESET allow you to asynchronously force the Q output to specific states, regardless of the clock and data inputs. The SET and RESET inputs are active-high, meaning they force the Q output to specific states when they are set to logic high (=1). In Figure 4, SET and RESET are both held at logic low (=0) to illustrate the basic functioning of the flip-flop. When the clock signal (304) has a rising edge the flip-flop captures the value of the D input (302) and stores it in the Q output (306). For example, at the rising clock edge at 2.63ps indicated by the vertical timing line (402), the input D (302) has changed from logic high to logic low. The Q output (306) therefore transitions to logic low at a slightly delayed time (404). The delay is an inherent property of the flip-flop and is, in this example, a bit less than half of one clock cycle. Figure 5 shows a further waveform diagram (500) that illustrates the effect of the SET signal (310) and RESET signal (312) changing. As shown at 502, a transition of the SET signal (310) from low to high causes the Q output (306) to rise asynchronously (i.e. independently of the clock signal (304) as shown at 504. At the next rising edge of the clock signal, the input signal D (302) has a low logic state, and the output signal Q (306) logic state changes back to a low logic state as shown at 506, in accordance with the input signal D (302). As shown at 508, a transition of the RESET signal (312) from low to high forces the Q output (306) to a logic low, as shown at 510. At the next rising edge of the clock signal, the output signal Q (306) transitions back to a high logic state (as shown at 512) in accordance with the logic state of the input signal D (302). In summary, by setting SET or RESET to logic high, the Q output can be forced to specific states (high or low). When both SET and RESET are inactive (low) the flip-flop operates normally, capturing the data input on the rising edge of the clock. These active-high signals provide control over the flip-flops’ behaviour in situations such as initialization or reset conditions. Figure 6A and 6B illustrate embodiments of a rising edge detection sub-circuit and a falling edge detection sub-circuit, respectively, together with their timing diagrams. These embodiments do not represent the only circuits that can detect rising and falling edges in a signal but are used to show their application within the described embodiments. The rising edge detection sub-circuit is designed to produce an output signal when it detects a transition from a low logic (0) to a high logic state (1) at its input. This type of circuit is commonly used in various applications, such as in digital systems for triggering events or actions when a rising edge occurs. The rising edge detection sub-circuit may include an input signal (602), an output signal (604), a circuit element (606), and a delay element (608) or group of delay elements. The circuit element (606) may include an AND gate, where the output is a high logic state (1) if both inputs into the AND gate have a high logic state (1), else the output is a low logic state (0). The delay element (608) may create a delayed version of the input signal (602). The delay element may include a D type flip-flop, a D latch, a simple RC time constant circuit, or one or more inverters where an odd number of inverters is required so that the output of the AND gate is normally logic 0). The inverters may be NOT gates. The delay allows for the rising edge detection circuit to compare the current input signal (602) with its previous state. The number of NOT gates is also chosen so that the cumulative timing delay of all of the NOT gates together corresponds to the duration of the signal generated by the rising edge detection sub-circuit. The rising edge detection sub-circuit functions by continuously monitoring the input (602) signal for changes. The input signal (602) is delayed by a small amount using the delay element or elements (608), creating a delayed version of the signal (610). The delayed input signal (610) and the input signal (602) are compared using the circuit element (606), which may be an AND gate for the rising edge detection circuit. If the input signal transitions from low to high logic state (0 to 1) (612), and the delayed input signal is simultaneously at a high logic state (614) for a moment, the AND gate's output may become a high logic state (1) for a brief period. The high output from the AND gate represents the rising edge detection signal (616). Figure 6B shows a falling edge detection sub-circuit. A falling edge detection circuit is a logic circuit designed to produce an output signal when it detects a transition from a high logic state (1) to a low logic state (0) at an input (652). Falling edge detection is often used in digital systems to trigger events or actions when a falling edge occurs in the input signal. The rising-edge detection circuit may be converted into a falling-edge detection circuit with only a change of the circuit element AND gate (606) to a NOR gate (656). A NOR gate (656) is configured to output a high logic state (1) when both inputs are at a low logic state (0). The falling edge detection circuit may include an input signal (652), an output signal (654), a circuit element (656) which may include a NOR gate, and a delay element (658) or elements (where an odd number of delay elements is required so that the output of the NOR gate is normally logic 0). The inverters may be NOT gates. When the input signal (652) transitions from a high logic state (1) to a low logic state (0) (662), the input signal (652) and the delayed input signal (660) are momentarily at a low logic state (0) (662, 664). Therefore, the output signal waveform (654) is momentarily at a high logic state (666). The number of NOT gates is also chosen so that the cumulative timing delay of all of the NOT gates together corresponds to the duration of the signal generated by the falling edge detection sub-circuit. A fundamental property of sequential elements (e.g. flip flops) is that a change in state, or bit flip, should only occur at the positive or negative edge of the clock signal, termed the active edge. Any change in the state of a sequential element that is not at the clock edge must be an error (e.g. a Single Event Upset or SEU) unless the SET or RESET signals are in the active state. Therefore, the technology provides for detecting errors (e.g. SEUs) by continuously monitoring the edge of the clock and the sequential element output (or input, in other embodiments). The change in the output signal of these sequential elements is compared with the clock edge, and if they do not occur in sync (minus the internal delay of the sequential elements), the technology operates to correct the output to the state before the SEU. Therefore, the technology is capable of both detecting an error using a single flip-flop and correcting the error. Figure 7 is a schematic block diagram illustrating logical components of a circuit (700) that provides for the detection and correction of SEUs, according to an embodiment. The circuit (700) may include a sequential element (702), such as a flip-flop, that has a D-input (704), a Q-output (706) and a clock signal input (708). A rising edge detection sub-circuit (710) is provided, which receives the Q-output (706) as its input and asynchronously outputs logic 1 for a brief period of time when a rising edge is detected in the Q-output (706), as explained with reference to Figure 6A. A falling edge detection sub-circuit (712) is provided, which receives the Q-output (706) as its input and asynchronously outputs logic 1 for a brief period of time when a falling edge is detected in the Q-output (706), as explained with reference to Figure 6B. A clock signal edge detection sub-circuit (714) is also provided which receives the clock signal (708) as its input and outputs logic 1 for a brief period of time when an edge (in this example, a rising edge) is detected in the clock signal. The circuit (700) includes a first XOR gate (716) which receives the output of the rising edge detection sub-circuit (710) and the clock signal edge detection sub-circuit (714) as its inputs, and has its output connected to a RESET port (718) of the sequential element (702). The output of the first XOR gate (716) will be high if its inputs are different, and low if its inputs are the same. Therefore, if the rising edge detection sub-circuit (710) detects a rising edge at the Q-output that does not coincide with a rising edge of the clock, it must have been an error like an SEU that caused the rising edge, and which resulted in an erroneous change in the Q-output from 0 to 1. The RESET port (718) is then asynchronously set to 1 for a brief period of time, which causes the D output to asynchronously fall to 0 (which was the correct output) for the remainder of the clock cycle. In this way, the Q-output is corrected asynchronously and before the error can propagate to further sequential elements. The circuit (700) includes a second XOR gate (720) which receives the output of the falling edge detection sub-circuit (712) and the clock signal edge rising detection sub-circuit (714) as inputs, and has its output connected to a SET port (722) of the sequential element (702). The output of the second XOR gate (720) will be high if its inputs are different, and low if its inputs are the same. Therefore, if the falling edge detection sub-circuit (712) detects a falling edge at the Q-output that does not coincide with a rising edge of the clock, it must have been an error like an SEU that caused the falling edge, and which resulted in an erroneous change in the Q-output from 1 to 0. The SET port (722) is then asynchronously set to 1 for a brief period of time, which causes the D output to asynchronously rise to 1 (which was the correct output) for the remainder of the clock cycle. In this way, the Q-output is corrected asynchronously and before the error can propagate to further sequential elements. Figure 8A shows a circuit diagram of an exemplary circuit implementation of the logical components of Figure 7. In Figure 8A, the sequential element is a flip-flop (FF) which has an input (D), output (Q) and clock signal input (CLK). SET and RESET ports are provided. The rising-edge detection sub-circuit is formed by gate AND1 together with an inversion element INV1 (i.e. a NOT gate) on one of its inputs which forms a delay element as previously described. The rising-edge detection sub-circuit detects a change in the FF output (signal 3) from logic 0 to logic 1, resulting in a momentary logic 1, or glitch, at its output (signal 5). The width of the glitch can be controlled by adding delay elements or inverters to INV1. The falling-edge detection sub-circuit is formed by gate NOR together with an inversion element INV3 on one of its inputs which forms a delay element as previously described. The falling-edge detecting sub-circuit detects a change in the FF output (signal 3) from logic 1 to logic 0, resulting in a momentary logic 1, or glitch, at its output (signal 7). As with the rising edge detector, the width of the glitch can be controlled by adding delay elements or inverters to INV3. Also, the circuit includes a clock signal rising edge detection sub-circuit formed by AND2 together with an inversion element INV2 on one of its inputs. This sub-circuit yields a momentary logic 1, or glitch, at its output (signal 6) when the clock signal (2) transitions from low to high (the active edge). By comparing the arrival time of these three signals (5, 6 and 7), the circuit can discern whether the change occurred due to the active clock edge. An SEU must have happened if they do not coincide (minus the FF internal delay). Exclusive OR (XOR) gates compare signals 5 and 7 with the clock edge signal 6. XOR1 compares the output of AND1 and AND2 and yields a logic 1 output (signal 8) if they are different from each other, which logic output is input to the RESET port of the FF to asynchronously correct the output (signal 3) to logic 0. XOR2 compares the output of AND2 and NOR and yields a logic 1 output (signal 9) if they are different from each other, which logic output is input to the SET port of the FF to asynchronously correct the output (signal 3) to logic 1. The technology aims for the SEU to be detected and corrected immediately (although there will be a slight delay). It is for this reason that the output of XOR1 (signal 8) should be sent to the RESET signal of the FF (signal 15) because it will detect a positive edge if signals 5 and 6 are not the same, and therefore, the FF output (signal 3) must have changed from logic 0 to logic 1. With signals 5 and 6 out of sync, signal 8 will be logic 1, resetting the FF to logic 0. For the same reason, the output of XOR2 (signal 9) is connected to the SET signal of the FF (signal 10). Any input wide enough to meet the minimum SET and RESET pulse width for a FF will cause the FF to set or reset. This can be achieved by adding more inverters to the edge detection sub-circuits. Figure 8B includes the same circuit elements as Figure 8A with the addition of two AND gates (AND5, AND6) with AND6 having a delay element (INV6). AND5 and AND6 compare signals 8 and 9 with a delayed version of the input signal (1), the delay being provided by a transport delay element (AT). The two AND gates (AND5, AND6) act as multiplexers, electing whether a SET or RESET should be activated and controlled with the FF input signal (signal 1), and may be required to prevent uncontrolled oscillations of the SET (signal 10) and RESET (signal 17). The output of the FF in Figure 8B will depend on the value at the input after the previous clock edge (as expected from a normal FF operation). If the input was logic 0 at the time of the previous clock edge, AND6 would be activated and AND5 deactivated. If an SEII from logic 0 to logic 1 occurs at the FF output (signal 3), a positive glitch will appear at signal 5, resulting in a positive glitch at signal 8 on its way to AND6, resetting the FF back to its original state (logic 0). In a circuit using edge-triggered registers, the time taken for data to traverse the combinational logic to provide the values at the next register input depends on the delay path and the structure of the combinational logic path. It is ideal for the input to each memory element to reach its final value in time for the next clock edge, allowing the behaviour of the entire circuit to be predicted accurately. A system’s maximum operating speed must consider variations between circuit elements caused by physical composition and path length differences. In a synchronous circuit, two registers, or flip-flops, are said to be "sequentially adjacent" if a logic path (data-path) connects them. These logic paths will generally be different for various “sequentially adjacent” registers, which means that the arrival time of data to the various FF inputs will differ. This will affect the correct operation of the AND gate multiplexers. For example, should the data reach the input of the FF before the active edge of the clock, and it is opposite to the FFs current output state, the incorrect AND gate will be selected, and will not correct an SEU. For this reason, a transport delay (indicated by AT) may be required. The delay may be required as to how the AND gates (AND5, AND6) activate the SET and RESET signals. As explained previously, AND5 needs to be active when the FF output signal is logic 1 to SET the FF should an SEU occur that sets the FF output from logic 1 to logic 0, and AND6 to be active when the FF output is logic 0 for the RESET signal to be activated when an SEU occurs from logic 0 to logic 1. Should the transport delay not be included, the incorrect AND gate could be activated when an SEU occurs. In our scenario above (SEU from logic 0 to logic 1), without the delay signal, AND5 will be activated before signal 8 reaches AND6, if the input to the FF changes its logic value to 1 before the setup and hold time, keeping the FF in the SET state, which is useless for correcting the SEU. Therefore, we need to delay signal 1 (to remain logic 0 to keep AND6 activated) to at least the time it takes signal 8 to reach the input of AND6. Ideally, we need to delay it for as long as possible before the setup and hold time of the FFs come into effect. The opposite is applicable when the FF is in the SET state (output of logic 1), and an SEU causes it to transition to logic 0. To determine the value of AT, a detailed timing analysis is performed using Electronic Design Automation (EDA) tools to identify the minimum data-path delay (DPt) between adjacent FFs. To determine the value of AT, we subtract it from the clock period Tcik, thus AT = Tcik - DPt. Correcting the SEU depends only on the delay via the edge detectors, the XOR gates, the AND gates, and the OR gates. Gate delays of modern, approximately 5-7 nanometer digital semiconductors are typically between 0.5 and 1.0 picoseconds (ps). This means it takes between 0.5 and 1.0 picoseconds for a signal to travel through a single gate in a digital semiconductor circuit such as an ASIC. However, when FPGAs are used, there are no physical gates; lookup tables perform the function of logic gates, meaning that regardless of which gate is implemented, the delay from input to output for all gates will be the same. Therefore, it can be safely assumed that the total delay in resetting the FF will not exceed 4ps for modern semiconductors and could be even less for various FPGA manufacturers. As mentioned, some vendors provide a delay macro that can be instantiated in ASICS and FPGAs to add the delay. In general, every flip-flop in an ASIC of FPGA design should be resettable, whether required by the system to set the system into a known state at startup or when the system goes into an undefined state. Therefore, directly connecting the output AND gates to the FF SET and RESET signals would not make this possible. In any case, implementing FFs with SET and RESETS must be handled with care, as it could cause the FF to go into a metastable state and, in our case, an uncontrolled oscillation (this problem is solved by the AND gates, as mentioned previously). An additional requirement may be to have a controlled state at system start-up, and Figure 8C includes additional circuit elements to address that. Figure 8C includes all the circuit elements of Figure 8B but with the AND gates (AND5, AND6) being connected to the SET and RESET signals of the FF via OR gates, with one input connected to the AND gate output and the other to an external control signal. This is indicated by OR1 and OR2. OR1 and OR2 serve a dual purpose: indirectly connecting the AND gates (AND5, AND6) to the FF’s SET and RESET signals, and providing a control signal to set the FF in a predetermined state. These control signals are provided by the circuit components in the boxes illustrated as “control circuit 1” and “control circuit 2” respectively and are able to emulate an SEU so as to test the operation of the circuit. It should be noted that the same principle of the technology will apply if falling (or negative) clock edge triggered FFs are used. In that case, AND2 would be replaced with a NOR gate to detect the falling edge. Should the FF have negative active SET and RESET inputs, the XOR gates would be replaced with XNOR gates, and the output AND gates (AND5 and AND6) will be replaced with NAND gates. The two OR gates (connected to the SET and RESET signals) would be replaced by two AND gates, and circuits 1 and 2 in Fig. 8C would have the AND gates replaced by OR gates to emulate a momentary low signal (glitch from logic 1 to logic 0). The rest of the circuit would remain the same. When an error or glitch is detected, the technology described can also send a signal to scrub the error by reprogramming the digital integrated circuit or FPGA configuration memory. The time required for this operation is orders of magnitude less than the mean time between failures (MTBF) for SEU events. No duplication (or triplication) of the sequential elements is required to detect or correct the error. The described technology mitigates the effects of both SEUs and Multiple Bit Upsets (MBUs). Test results The circuit of Figure 8C was used to simulate an error using control circuit 1 and control circuit 2, by controlling the SET and RESET signals to make them high randomly. As will be explained with reference to the timing diagrams that follow, if, for example, the Q output is logic 0 and the SET signal is asserted using control circuit 1 to set the FF to logic 1 (thus simulating an SEU), this is detected by the rising edge detection circuit, which substantially immediately (i.e., within a few picoseconds) asserts the RESET signal to restore the correct state of the FF. The opposite happens when the FF is in the logic 1 state and the RESET signal is activated by control circuit 2 to simulate an error. Then, the falling edge detection circuit substantially immediately asserts the SET signal to restore the correct state of the FF. Figure 9 is a timing diagram which shows the FF’s operation without simulated errors. A simulation was performed at a frequency of 1MHz. Positive (rising) and negative (falling) edges are only detected when there is a change in Q at the output due to the clock’s active edge, as shown by “D(pos_detect)” and “D(neg_detect)” which correspond to signal lines 8 and 9 in Figure 8C respectively. Figure 10A is a timing diagram which shows several SET and RESETS being sent to the FF randomly by control circuit 1 and control circuit 2, to test the effectiveness and speed of the error detection and correction. These are shown as glitches in the output signal D(q). At this zoom scale, it appears that the glitches observed in the output signal D(q) coincide with the SET signal when D(q) is low, and the glitches in D(q) coincide with the RESET signal when D(q) is high. Zooming into to various regions of the waveform illustrates the operation more closely. Figure 10B is a zoomed-in portion of Figure 10A that shows the FF’s normal operation when the input changes from logic 0 to 1. When the positive edge of the clock (clk_edge) is detected, the output of both X0R1 (xor-1) and X0R2 (xor-2) goes high. However, because the input signal is high, AND5 is active in Figure 8C, sending a SET signal to the FF, resulting in the correct operation of the FF and a logic 1 being latched. Figure 10C is a zoomed-in portion of Figure 10A that shows the FF’s normal operation when the input changes from logic 1 to logic 0. When the positive edge of the clock (clk_edge) is detected, the output of both XOR1 (xor-1) and XOR2 (x-or2) goes high, as in Figure 10B. However, because the input signal is low, AND6 is active in Figure 8C, sending a RESET signal to the FF, resulting in the correct operation of the FF and a logic 0 being latched. Figure 10D is a zoomed-in portion of Figure 10A that illustrates the simulation of an SEU by means of a SET signal sent to the FF via the external switch in control circuit 1 of Figure 8C. This happens between clock edges and represents an SEU that affects the FF. The high SET signal can be seen to the left of the diagram (at time 4.6147). This causes the FF output to change to logic 1 (at time 4.6157us), and as a result, a positive edge is detected shortly thereafter (a zoom-in version of this is shown in Figure 10F.). However, because DJn is at logic 0, AND6 is selected causing the FF to RESET. This manifests as a high glitch with a pulse width of 1ns (this delay width depends on the internal delays of the FF). When the FF output is corrected, the output signal (Q), goes low again, resulting in a negative edge being detected. However, due to the input signal (D_in) at logic ‘O’, AND5 is deactivated and does not cause the FF to SET again, thus preventing an uncontrolled oscillation (depicted in Figure 10G). Figure 10E is similar to Figure 10D but illustrates an SEU causing a bit flip from logic 1 to logic 0. A zoomed in version of this figure is shown in Figure 10H. Figure 10F is a further zoomed-in portion of Figure 10D. When the positive edge is detected, XOR1 goes high. However, because D(d_in) is low, AND6 is selected, and hence the reset signal is activated. Figure 10G illustrates that when the RESET signal causes the FF’s output to change to logic 0, as explained in Figure 10D, a negative edge is detected, causing XOR2 to go high. However, because the input signal (DJn) is low, AND5 is deactivated, and the FF does not SET again. Figure 10H illustrates that when an SEU causes a bit flip from logic 1 to logic 0 as illustrated in Figure 10E, a negative edge is detected, but not at the active edge of the clock, and therefore only XOR2 goes high. However, because in this case the input signal is at logic 1, AND5 is now active, causing the SET signal to be activated thereby correcting the bit at the FF output to logic Figure 101 illustrates that when the SET signal causes the FF’s output to change to logic 1 (as depicted in Figure 10E), a positive edge is detected, causing XOR1 to go high. However, because the input signal (DJn) is high, AND6 is deactivated and the FF does not RESET again. Mitigation of Single Event Transients The technology may also be capable of mitigating single event transients. Single event transients may occur in the combinational logic of the circuit as well as the input. While the previous diagrams showed that a single event transient would be mitigated if it occurs during the clock cycle, the following diagrams will show that it can also mitigate a single event transient that reaches the FF input, SET or RESET signals at the active edge of the clock which coincides with the FF’s setup and hold time. Figure 11A is a timing diagram that illustrates a single event transient occurring simultaneously with the clock edge detector shortly after 10us. The input delay signal is first at logic 0; however, because of the single event transient, it changes to logic 1 with an overlap of the clock detect signal. This results in both XOR1 and XOR2 going high, but because the input delay signal changed to logic 1 due to the transient, AND5 is selected, setting the FF in the high output state. Figure 11B is the same as Figure 11A and shows that the overlap between the clock signal and the single event transient is only about 1ps. Figure 11C shows a timing diagram in which the transport delay was increased to 6ps after the set goes low, meaning that AND6 is selected and, therefore, the SET signal from AND5 is blocked. The input delay should ensure that the input remains low long enough for the XOR1 signal to reach AND6, thus resetting the FF in the case of a single event transient. In this waveform diagram, the delay is low for 6ps after the XOR2 is detected. This can be decreased to 0.1 ps, as shown in the next diagram in Figure 11D. The single event transient will be corrected as long as the input delay occurs after the XOR1 and XOR2 signals reach the output select AND gates. Figure 11D illustrates that the input delay should only retain its value long enough for the XOR1 to reach AND6. In this case, the input delay changes value 0.1ps after the XOR1 signal goes low. Figure 12 shows how the circuit of the invention would integrate with a sequential logic circuit. Preferably, the edge detectors of the circuit of the invention would be in sync with the FF’s internal edge detector. Figure 13 is a flow diagram illustrating an exemplary method of detecting and correcting SEUs or glitches in electronic circuits according to the technology, and which may be implemented by the circuits previously described. A first signal is generated (1300) if an output of a sequential circuit element such as a flip-flop (FF) changes from logic 1 to logic 0. This may be a signal generated by the falling edge detection sub-circuit of the previous figures (e.g. signal 7 in Figures 8A-8C). A second signal is generated (1302) if the output of the sequential circuit element changes from logic 0 to logic 1. This may be a signal generated by the rising edge detection sub-circuit of the previous figures (e.g. signal 5 in Figures 8A-8C). A third signal is generated (1304) on an active edge of a clock signal of the sequential circuit element. This may be a signal generated by the clock signal edge detection sub-circuit of the previous figures (e.g. signal 6 in Figures 8A-8C). The first signal and third signal are compared (1306) to determine if they coincide. The comparison may be performed by the XOR gate (XOR2) of Figures 8A-8C. If they do not coincide, the FF is asynchronously set (1308) to logic 1 and the method moves to the next step. If they do coincide the method moves directly to the next step without setting the FF. The next step is for the second signal and third signal to be compared (1310) to determine if they coincide. The comparison may be performed by the XOR gate (XOR1) of Figures 8A-8C. If they do not coincide, the FF is asynchronously reset (1312) to logic 0 and the method moves back to the first step (1300). If they do coincide the method moves directly to the first step without resetting the FF. In a practical implementation of the flow diagram, to avoid uncontrolled oscillation, a stop is needed after one asynchronous set or reset (step 1308 or 1312) until the next clock cycle. This is provided by the delayed input signal in Figures 8B and 8C, which ensures that only the correct output AND gate is selected. By asynchronously setting or resetting the FF, the SEU is corrected before it can propagate to the next stage of further downstream sequential elements (e.g. the downstream “data path” indicated at the right of Figure 12). Comparison to Triple Modular Redundancy When triple modular redundancy (TMR) is implemented with a hardware description language or via the manufacturer’s software tools, it instantiates triplicate circuits in the user design as well as voting circuits. This method of implementing TMR results in a four to seven times resource increase compared to no redundancy, which limits its usage to reliability-critical applications. In some cases, local TMR is provided where only the sequential elements are tripled. However, although this caters for single errors in the sequential elements it does not cater for single event transients occurring in combinational circuits which could filter through to the inputs of the sequential elements. It also does not address transients occurring on the global signals such as the clock, enable and clear lines, or a direct strike to the voter circuit. The technology disclosed herein does not require triple modular redundancy or even double modular redundancy and has a clear advantage over full triple modular redundancy as far as chip area is concerned. Instead of the tripling of the combinational logic (data path), the FFs, and the addition of three voting circuits, the disclosed technology requires only one FF with a minor circuit addition to the combinational logic. Whereas with full TMR there is a delay introduced by the voting circuit, in this disclosure the Q output of the FF is sent directly to the data path of the next stage without delay. The disclosed technology only requires the addition of the small combinational circuit and the adjustment of the input signal’s transport delay to detect and correct both single event upsets and single event transients. The foregoing description has been presented for the purpose of illustration; it is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Persons skilled in the relevant art can appreciate that many modifications and variations are possible in light of the above disclosure. The language used in the specification has been principally selected for readability and instructional purposes, and it may not have been selected to delineate or circumscribe the inventive subject matter. It is therefore intended that the scope of the invention be limited not by this detailed description, but rather by any claims that issue on an application based hereon. Accordingly, the disclosure of the embodiments of the invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims. Finally, throughout the specification and accompanying claims, unless the context requires otherwise, the word ‘comprise’ or variations such as ‘comprises’ or ‘comprising’ will be understood to imply the inclusion of a stated integer or group of integers but not the exclusion of any other integer or group of integers.

Claims

1. A circuit for detecting single event upsets (SEUs) or glitches in electronic circuits, comprising:at least one edge detection sub-circuit connected to a sequential circuit element input or output which generates a signal if the sequential circuit element input or output changes logic levels; andat least one comparison sub-circuit which compares the signal from the edge detection sub-circuit with a signal generated on an active edge of a clock signal of the sequential circuit element;wherein the comparison sub-circuit detects an SEU or glitch if the two signals do not coincide.

2. The circuit as claimed in claim 1 comprising:a falling edge detection sub-circuit connected to a sequential circuit element output which generates a signal if the sequential circuit element output changes from logic 1 to logic 0;a rising edge detection sub-circuit connected to the sequential circuit element output and which generates a signal if the sequential circuit element output changes from logic 0 to logic 1; anda clock signal edge detection sub-circuit connected to a clock signal of the sequential circuit element and which generates a signal on an active edge of the clock signal;wherein the circuit asynchronously sets the sequential circuit element output to logic 1 if the signal from the falling edge detection circuit does not coincide with the signal from the clock signal edge detection sub-circuit; andwherein the circuit asynchronously resets the sequential circuit element output to logic 0 if the signal from the rising edge detection circuit does not coincide with the signal from the clock signal edge detection sub-circuit.

3. The circuit as claimed in claim 2 wherein the rising edge detection sub-circuit includes an AND gate (AND1) which receives the sequential circuit element output and a delayed version of the sequential circuit element output.

4. The circuit as claimed in claim 2 or claim 3 wherein the delayed version of the sequential circuit element output is obtained by inputting the sequential element output into a number of inverters (INV1).

5. The circuit as claimed in claim 4 wherein the inverters (INV1) are NOT gates and wherein the number of NOT gates is an odd number so that the delayed version of the sequential element output is not inverted compared to the sequential element output.

6. The circuit as claimed in any one of claims 2 to 5 wherein the falling edge detection subcircuit includes a NOR gate which receives the sequential circuit element output and a delayed version of the sequential circuit element output.

7. The circuit as claimed in claim 6 wherein the delayed version of the sequential circuit element output is obtained by inputting the sequential element output into a number of inverters (INV3), wherein the inverters are NOT gates and wherein the number of NOT gates is an odd number so that the delayed version of the sequential element output is not inverted compared to the sequential element output.

8. The circuit as claimed in any one of claims 2 to 7 wherein the clock signal edge detection sub-circuit includes an AND gate (AND2) which receives the clock signal of the sequential circuit element and a delayed version of the clock signal of signal.

9. The circuit as claimed in claim 8 wherein the delayed version of the clock signal is obtained by inputting the clock signal into a number of inverters (INV2), wherein the inverters are NOT gates and wherein the number of NOT gates is an odd number so that the delayed version of the clock signal is not inverted compared to the clock signal.

10. The circuit as claimed in any one of claims 2 to 9 in which the comparison sub-circuit is an exclusive OR (XOR) gate (XOR1), wherein the signal from the rising edge detection sub-circuit and the signal from the clock signal edge detection sub-circuit are input into the XOR gate, and an output of the XOR gate is input directly or indirectly into a RESET port of the sequential element, wherein the RESET port asynchronously resets the sequential circuit element output to logic 0 when it receives a signal.

11. The circuit as claimed in claim 10 including an AND gate (AND6) which receives the output of the XOR gate (XOR1) and a delayed version of an input of the sequential circuit element, and wherein the output of the AND gate is connected to the RESET port.

12. The circuit as claimed in claim 10 or claim 11 including a second exclusive OR (XOR) gate (XOR2), wherein the signal from the falling edge detection sub-circuit and the signal from the clock signal edge detection sub-circuit are input into the second XOR gate, and an output of thesecond XOR gate is input directly or indirectly into a SET port of the sequential element, wherein the SET port asynchronously sets the sequential circuit element output to logic 1 when it receives a signal.

13. The circuit as claimed in claim 12 including an AND gate (AND5) which receives the output of the second XOR gate (XOR2) and a delayed version of an input of the sequential circuit element, and wherein the output of the AND gate is connected to the SET port.

14. A method for detecting single event upsets (SEUs) or glitches in electronic circuits, comprising:generating a signal if a sequential circuit element input or output changes logic levels;comparing the signal to a signal generated on an active edge of a clock signal of the sequential circuit element; anddetecting an SEII or glitch if the two signals do not coincide.

15. The method as claimed in claim 14 including:generating a first signal if an output of a sequential circuit element changes from logic 1 to logic 0;generating a second signal if an output of the sequential circuit element changes from logic 0 to logic 1;generating a third signal on an active edge of a clock signal of the sequential circuit element;comparing the first signal and third signal and, if they do not coincide, asynchronously setting the sequential circuit element output to logic 1; andcomparing the second signal and third signal and, if they do not coincide, asynchronously resetting the sequential circuit element output to logic 0.

16. The method as claimed in claim 14 wherein the step of asynchronously setting the sequential circuit element output to logic 1 is only performed if a delayed version of an input of the sequential circuit element is logic 1.

17. The method as claimed in claim 14 or claim 15 wherein the step of asynchronously resetting the sequential circuit element output to logic 0 is only performed if a delayed version of an input of the sequential circuit element is logic 0.

Images