3354

IEEE TRANSACTIONS ON NUCLEAR SCIENCE, VOL. 51, NO. 6, DECEMBER 2004

Simulation-Based Analysis of SEU Effects in SRAM-Based FPGAs

M. Violante, L. Sterpone, M. Ceschia, D. Bortolato, P. Bernardi, M. Sonza Reorda, and A. Paccagnella
AbstractSRAM-based eld programmable gate arrays (FPGAs) are particularly sensitive to single event upsets (SEUs) that, by changing the FPGAs conguration memory, may affect dramatically the functions implemented by the device. In this paper we describe a new approach for predicting SEU effects in circuits mapped on SRAM-based FPGAs that combines radiation testing with simulation. The former is used to characterize (in terms of device cross section) the technology on which the FPGA device is based, no matter which circuit it implements. The latter is used to predict the probability for a SEU to alter the expect behavior of a given circuit. By combining the two gures, we then compute the cross section of the circuit mapped on the pre-characterized device. Experimental results are presented that compare the approach we developed with a traditional one based on radiation testing only, to measure the cross section of a circuit mapped on an FPGA. The gures here reported conrm the accuracy of our approach.

I. INTRODUCTION

ODERN SRAM-based eld programmable gate arrays (FPGAs) offer high densities and in-system reprogrammability features that are very attractive for many electronic designs. Unfortunately, SRAM-based FPGAs are particularly sensitive to single event effects (SEEs) induced by high-energy ions [1], [2] and therefore they cannot be straightforwardly adopted in safety- or mission-critical applications, such as space-borne ones. Some works [1][3] have already investigated the sensitivity of SRAM-based FPGA devices to heavy ions, showing the probability for a particle to provoke a single event upset (SEU). This valuable information should, however, be coupled with indications about the probability for the circuit implemented in the FPGA to produce an error, i.e., the probability for an SEU to alter the expected circuits behavior in such a way that the circuit produces wrong output results. Although radiation testing is usually employed to measure SEU sensitivities, it is very expensive, and thus, more affordable techniques are needed. Moreover, the possibility of performing the analysis of SEU effects in the initial design phase, when only a model of the circuit is available, is becoming an increasingly important and necessary resource.
Manuscript received July 20, 2004. M. Violante, L. Sterpone, P. Bernardi, M. Sonza Reorda are with the Politecnico di Torino, Dip. Automatica e Informatica, 10129 Torino, Italy (e-mail: massimo.violante@polito.it; luca.sterpone@polito.it; paolo.bernardi@polito.it; matteo.sonzareorda@polito.it). M. Ceschia, D. Bortolato, and A. Paccagnella are with the Dipartimento di Ingegneria dellInformazione, Universit di Padova, 35131 Padova, Italy, and also with the Istituto Nazionale di Fisica NucleareSez. Padova, 35131, Padova, Italy (e-mail: ceschia@dei.unipd.it; damib@dei.unipd.it; alessandro.paccagnella@unipd.it). Digital Object Identier 10.1109/TNS.2004.839516

For this reason, researchers have investigated the use of simulation-based approaches for predicting the effects of SEUs. The methods proposed so far [4][6], although effective and accurate, are intended for the analysis of applications implemented as ASICs only. When the technology of interest is the SRAM-based FPGA, two complementary aspects should be considered: 1) SEUs may alter the memory elements the design embeds. For example, an SEU may alter the content of a register in the data-path, or the content of the state register of a control unit. 2) SEUs may alter the content of the memory storing the devices conguration information. For example, an SEU may alter the content of a look-up table (LUT) inside a logic resource of the FPGA, or the routing of signals. As far as the former aspect is concerned, the available approaches are adequate. Conversely, the latter aspect demands much more complex analysis capabilities. The effects of SEUs in the devices conguration memory are indeed not limited to modications in the designs memory elements, but may produce modications to the interconnections inside a logic resource and among different logic resources. We have developed a simulation-based approach to address the aforementioned problem: through suitably dened fault models and an ad hoc developed simulation tool, our procedure is able to predict the effects of SEUs in the devices conguration memory. After describing our approach, we report and discuss experimental results that compare the predicted SEU cross section with those obtained from radiation testing. These comparisons show that our method is quite accurate and that it can be used to predict the result of radiation testing. The main contribution of this work lies in the simulationbased procedure we described, and in the experimental validation we performed using radiation testing. II. PREVIOUS WORK The effects induced by SEUs on SRAM-based FPGAs have recently been investigated through radiation experiments (for example those reported in [1], [2], and [8]). The common denominator of these approaches is the adoption of a hardware set-up to expose the FPGA to radiation in order to measure the single event functional interrupt (SEFI) cross section of the FPGAs under investigation. An SEFI is generally dened as the result of an SEU that causes the device to stop operating properly. The mentioned approaches do not emphasize the analysis of the observed SEFI, i.e., the modications induced by radiation on the FPGAs conguration; therefore, they are valuable for understanding to what extent the specic circuit mapped on an

0018-9499/04$20.00 2004 IEEE

VIOLANTE et al.: SIMULATION-BASED ANALYSIS OF SEU EFFECTS IN SRAM-BASED FPGAs

3355

FPGA is resilient to SEU effects, but they provide few hints on the possible causes of SEFIs. For example, they are not able to identify the origins of the SEFIs. To gain a better understanding of the effects of SEUs on FPGAs in terms of modications induced on the devices resources, an analysis that combines the results of radiation testing with those obtained from analyzing the meaning of every bit in the FPGAs conguration memory was reported in [9] and [10]. This approach identied the conguration memorys bits responsible for each SEFI, and classied the observed SEFIs according to the affected FPGAs resource. This approach opens new possibilities. On the one hand, it offers a high-level view of the effects of SEUs on the circuit mapped on an FPGA, thus paving the way for the development of accurate circuit-oriented estimation techniques able to predict SEU effects in the circuit mapped on the FPGA only. Radiation testing can thus be postponed to the last development phase, to perform a nal validation of the developed system. In the meantime, circuit-oriented estimation techniques can be used during the early design phases to obtain quick feedback on the effects of SEUs. On the other hand, a better understanding of SEU effects on the FPGAs resources can be exploited to identify new and efcient hardening techniques that may overcome the signicant overhead that bedevils currently available techniques. As an alternative to radiation testing, several fault-injection approaches were recently proposed. All these approaches emulate the effects of SEUs in the FPGAs conguration memory as bit-ips in the memory content, i.e., by changing the bitstream that is downloaded in the FPGA at power up. Some of them exploit run-time reconguration [11]: the FPGA is initially programmed with a fault-free bitstream and allowed to operate for some number of clock cycles before the bitstream is changed to emulate the effects of SEUs affecting the devices conguration memory. Other approaches modify the bitstream before downloading it in the devices conguration memory [12], or during download operations [13], thus simplifying the needed hardware set-up. The main purpose of these approaches is to replace radiation testing during the design phase so as to be able to predict SEU effects by simulation, but none of them puts much emphasis on analyzing SEU effects on the FPGAs resources required by the mapped circuit. III. THE DEVELOPED APPROACH In this section, we describe the approach we developed for analyzing SEU effects in FPGA-based systems. In our approach, the FPGA-based system is viewed as composed of two independent layers: the application layer and the physical layer. The application layer corresponds to the digital circuit that implements the functionalities the system is intended to carry out. The application layer is a VHDL model that codes the netlist implementing the desired circuit. Its building blocks are the components available within the adopted FPGA: LUTs that store the truth table of the Boolean functions the circuit implements, routing resources, and memory elements (ip-op, register, etc.). Conversely, the physical layer corresponds to the FPGA device on which the circuit is implemented. In our approach, the two layers are analyzed independently. The application layer is analyzed using a simulation-based analysis tool described in Sections III-AIII-C, which provides

Fig. 1. Architecture of the fault-injection approach we developed. It combines both ad-hoc developed tools with commercial tools provided by the FPGA vendor for place and route operations, and independent suppliers for simulation operations.

. This gure is the probthe predicted error rate, ability that an SEU modies the circuit implemented by the application layer in such a way that it produces SEFIs, i.e., erroneous output results. The computation of the predicted error rate is performed by resorting to fault-injection experiments, which are based on fault models that emulate accurately the effects of SEUs in the conguration memory of FPGAs. The physical layer is analyzed using the test-bed we introduced in [9], and reviewed in Section III-D. The purpose of this analysis is to characterize the FPGA devices manufacturing technology from the point of view of sensitivity to radiation. For this purpose, radiation-testing experiments are performed to measure the cross section, , of the adopted FPGA device, which gives the probability for a particle to produce an SEU. The important aspect of this approach is that the computation of the cross section does not depend on the application layer: in fact it may be performed by conguring the FPGA device with test circuits that are different from the application layer. The cross section obtained by this method is associated with the FPGA device, and it is independent of the application using it. The analysis of the physical layer is required each time a new technology is exploited: once has been computed, it may be exploited for any application using that technology. As soon as both analyses are completed, we can compute the predicted cross section of the whole system, , as follows: (1) This gure gives the sensitivity to radiation of the whole systems. It thus combines the effects of SEUs in the application layer with those in the physical layer. A similar approach was proposed in [14] for analyzing processor-based systems. A. Simulation-Based Analysis of SEU Effects This section describes the simulation-based analysis tool we developed for analyzing the application layer of the FPGA-based system. The core of the tool is the fault-injection environment outlined in Fig. 1. Starting from an initial description of the circuit the system implements, we exploit the tools provided by the

3356

IEEE TRANSACTIONS ON NUCLEAR SCIENCE, VOL. 51, NO. 6, DECEMBER 2004

FPGA vendor for performing place and route operations. This preliminary step is typical of any design ow based on FPGA devices, and produces a conguration le where the content of the devices conguration memory is stored, i.e., the bitstream. This information denes the application layer. Starting from the information stored in the bitstream, two ad hoc developed tools are exploited. The Fault List Generation Tool identies the FPGAs resources in the application layer (for logic implementation, signal routing, etc.) that are used and it generates the list of faults (Fault List) to be injected, accordingly to the fault models described in Section III-B. Each fault is described by the couple (fault-injection time, fault location) describing when the SEU appears, and which resource it modies. The Fault Simulation Tool simulates serially the faults in the Fault List. During simulations the outputs produced by the faulty application layer are compared with those of the fault-free one. As soon as a mismatch is found, the simulation is stopped and the effect provoked by the injected fault is classied as Wrong Answer. Conversely, in case the simulation of the Input Stimuli set concludes, and no mismatch is found, the fault is classied as Effectless. The tools we developed produce the following gures: the number of conguration memory bits that needs to be programmed on the physical layer to implement the application layer; the total number of conguration memory bits for the physical layer. It includes the bits that need to be programmed for implementing the application layer, as well as those left unprogrammed since the resources they control are not used; the percentage of injected faults whose effects are classied as Wrong Answers. The aforementioned gures are combined by means of (2) to : estimate the predicted circuit error rate (2) The term is the percentage of faults provoking Wrong ratio estimates the probaAnswers, while the bility for an SEU to appear in the used portion of the physical layer. B. Fault Models and Fault List Generation Tool This section describes the fault models and the tool we developed while performing the analysis of the physical layer of the system. Given an SRAM-based FPGA device, its conguration memory may be considered as consisting of two types of bits: some controlling signal-routing resources, and some controlling logic resources. Signal-routing resources are all those resources concerned with the transmission of information within the physical layer. In general, these resources include: wire segments, which are wires unbroken by programmable switches (each end of a wire segment typically has a switch attached), and tracks, which are sequences of one or more wire segments [15]. Conversely, logic resources are all those

resources concerned with the implementation of combinational or sequential logic functions [15]. By considering the typical architecture of SRAM-based FPGAs, we can observe the following modications induced by SEUs to the FPGA resources conguration. 1) Signal routing resources: as soon as any SEU hits the bits controlling the programmable switches attached to wire segments, the routing of a logic signal from resource A to resource B (track A/B) may be affected as follows: a) Open: the track A/B is broken, and thus resource B is no longer fed with the expected logic value coming from resource A, which is instead left dangling. b) Bridge: the track A/B is replaced with a new track C/B, and thus resource B is no longer fed with the expected logic value coming from resource A. c) Conict: a new track C/B is created that overlaps with A/B. Resource B is thus driven by an unknown logic value which depends on the values coming from resources A and C. 2) Logic resources: as soon as any SEU hits the bits controlling a logic resource, the following effects are possible: a) Combinational defect: the logic function implemented by the logic resource is modied. b) Routing defect: signal routing inside the logic resource is altered. For example the paths connecting input ports to the look-up-tables implementing combinational functions are modied. c) Sequential defect: the content of a user memory bit is modied. The tool we developed for Fault List generation analyzes the device conguration le produced by the place and route tools, and it identies the bits used to route the ( bits), and those controlling the logic resources used by the mapped circuit ( bits). It then generates all the possible couples (fault-injection time, fault location), where fault-injection time ranges from the time of application of the rst input stimuli to the last one, while fault location corresponds bits. Fault to all the possible SEUs in sampling is exploited to reduce the number of faults to be is the number of simulated by the Fault Simulation tool: if simulated faults, then faults will be injected in the routing resource, while will be injected in the CLB ones. Similarly, fault-injection time will be randomly selected between the rst and the last input stimuli. In our analysis [9], [10], we concentrated on the devices belonging to the Xilinx Virtex family. However, our approach is general, and it can be applied to other devices from other manufacturers. C. Fault Simulation Tool In the following, we describe the fault simulation tool we developed while targeting Xilinx devices. The tool can be adapted easily to other devices from different manufacturers, provided that tools for obtaining the VHDL model of a circuit mapped on an FPGA is available (i.e., the application layer). To allow

VIOLANTE et al.: SIMULATION-BASED ANALYSIS OF SEU EFFECTS IN SRAM-BASED FPGAs

3357

TABLE I SUMMARY OF THE MUTATIONS INSERTED IN THE VHDL MODEL OF THE CONSIDERED CIRCUIT TO MIMIC THE EFFECTS OF SEUs IN THE DEVICE CONFIGURATION MEMORY

Fig. 2. Overview of the test-bed we developed for performing radiation-testing experiments on FPGA devices.

designers to evaluate the correctness of their designs after place and route, FPGA vendors usually provide this type of tool. The tool we developed exploits the ModelSim VHDL simulator for evaluating the outputs that faulty application layer produces. For this purpose, the application layer is rst obtained by exploiting the ncd2vhdl tool provided by Xilinx. Let us refer to the fault-free application layer as . Before fault simulation can start, for each fault in the Fault List a new model, , is computed as a mutation of . During this process the set of VHDL instructions that model the fault are . In particular, we use the mutations reported inserted in in Table I. An additional input port, inject, is nally added to the to activate the mutation at the injection interface of time: when inject is equal to 0, the circuit behaves as and when the inject is equal to 1 faults are injected. D. Test-Bed for Radiation Testing Experiments In this section, we describe the test-bed we developed for performing radiation-testing experiments in FPGA devices. The test-bed was introduced in [9], and it is briey described here for the sake of completeness. Fig. 2 shows an overview of the test-bed, including its main components. A Control Host, located outside the irradiation chamber, is used to monitor the experiment execution. It is provided with an IP connection with the set-up inside the irradiation chamber through which it sends commands and receives information about the status of the experiments, as well as data to be logged for elaboration purposes. Inside the irradiation chamber, we have a Test CPU (a Power-PC MPC860) that communicates with the Control Host as well as with the device under test. Its purpose is to perform the low-level operations needed for running an experiment: programming the device under test, applying input stimuli, collecting output responses, and reading back the conguration memory of the device under test. A Control Hardware is also used for adapting the Test CPU to the FPGA Under Test. The test-bed can be used for two purposes. It can be exploited for measuring the cross section of an FPGA-based

system, obtaining the measured cross section of the whole . For this purpose, the typical test session systems, consists in conguring the physical layer with the application layer, and then in continuously stimulating the FPGA device with a given set of input stimuli. The output responses are continuously collected and compared with the expected ones. As soon as a mismatch between the expected output values and the read ones is observed, i.e., when an SEFI is detected, the test is stopped and the conguration of the FPGA Under Test is read back and sent to the Control Host for data logging. Following this operation, the test is restarted from the beginning. By relating the number of observed SEFIs with the estimated number of particles hitting the devices surface is then possible to compute the device cross section. Similarly, the test-bed can be used to measure the cross sec. In this case, the FPGA is inition of the physical layer, tially programmed with an empty bitstream, and then its conguration memory is periodically read back. By comparing the read information with the fault-free bitstream we can measure the number of observed SEUs. As previously done, by relating this gure with the estimated number of particles hitting the devices surface is then possible to compute the device cross section. IV. EXPERIMENTAL RESULTS In this section, we determine the accuracy of the approach we developed. For this purpose, we performed two types of experiments. The rst one, described in Section IV-A, aims at evaluating the accuracy of our simulation-based approach while modeling the effects of SEUs in the device conguration memory. The second one, described in Section IV-B, aims at evaluating the accuracy of estimation of the predicted cross section of a circuit mapped on a device with respect to that measured by means of radiation testing. In our experiments, the physical layer was a Xilinx Virtex XCV300 device which we exposed to various ion species ranging from 84 MeV carbon to 210 MeV nickel featuring linear energy transfer (LET) values between 1.6 and 30 MeV cm /mg. Radiation testing experiments were carried out at the Tandem Van De Graaff Accelerator of INFN-LNL, Legnaro (PD), Italy. The application layer was a circuit composed of four 16 16-bit binary multipliers. Inputs of the four multipliers were connected in parallel, while the outputs were connected to an XOR gate array. The multiplier occupies 2524 out of 3072 slices of the adopted XCV300 device and operates at 10 MHz.

3358

IEEE TRANSACTIONS ON NUCLEAR SCIENCE, VOL. 51, NO. 6, DECEMBER 2004

A. Assessing Simulation Accuracy To assess the accuracy of the simulation tool we developed, we compared the output responses observed during radiation testing with those computed by the simulation tool. For each SEFI recorded during radiation testing, we identied the SEU that caused it, we modeled the SEUs in terms on the modication it introduces in the application layer, and nally we injected it in the application layer by means of our simulation tool. For this purpose, we performed an initial set of radiationtesting experiments. During our experiments the physical layer was congured with the application layer, it was continuously stimulated by a given set of input stimuli, and the resulting outputs observed. As soon as a mismatch on the output values was observed between the expected values and the measured ones, the test was stopped, and the content of the physical layers conguration memory was read back. By analyzing the faulty bitstream, we identied the FPGAs resources affected by SEUs. For each SEU observed during radiation testing, which , forced the system to produce the faulty outputs we performed a simulation experiment. We modeled the SEU observed in the devices conguration memory according to our technique by injecting an SEU into the application layer through the simulation-based approach described in the previous section. Then we recorded the resulting output traces . Finally, we compared the outputs observed during radiation testing with those obtained by simulations: for and always all the injected faults, matched. We can thus conclude that the approach we developed is able to model accurately the behavior of the analyzed FPGA device in the presence of SEUs. B. Comparing Simulations With Radiation Testing In this section, we compare the cross section of the FPGAbased system (a multiplier implemented on a Xilinx Virtex device) predicted by our simulations with that measured during radiation testing. For this purpose, we performed three types of analysis: we initially characterized the physical layer by measuring its cross . We then generated the application layer, and section, , according to we computed its predicted error rate, Sections III-AIII-C. The last experiments we performed consisted of measuring the cross section of the FPGA-based system . through radiation testing, In computing the predicted error rate, we injected 10 000 SEUs. For the application layer, we identied 9712 faults injected into the routing resources and 288 faults into the logic resources using our Fault List Generation Tool. After performing the fault-injection experiments, we applied (2) and obtained the predicted circuit error rate %. By multiplying the predicted circuit error rate by the cross section of the physical layer we obtained the predicted cross-section. Table II gives the predicted cross section obtained during radiation testing for the specic ions used in the experiment. Table II also gives the measured cross section obtained during radiation testing for the specic ions used in the experiment. As the reader

TABLE II COMPARISON BETWEEN THE CROSS SECTION OBTAINED DURING RADIATION TESTING EXPERIMENTS AND THAT OBTAINED BY MEANS OF SIMULATIONS

can observe, apart from C, predicted values are within a factor of two of the measured ones. Although the approachs accuracy needs further improvements, we can conclude that the proposed approach is a viable solution for anticipating the analysis of SEUs in the FPGAs conguration memory before any prototype is available. V. CONCLUSION SRAM-based FPGAs are becoming a key solution to the problem of developing new systems because they offer features like on-line reconguration that are not available with traditional ASIC technologies. However, this type of devices is quite sensitive to SEUs, particularly to SEUs that change the functions the FPGA implements by affecting its conguration memory. New techniques, which are available for use during the early design phases, are thus important to assess the effects of SEUs when a prototype of the system is not yet available. In this paper, we presented an approach that is able to predict accurately the effects of SEUs in SRAM-based FPGAs. The approach is based on radiation testing for technology characterization, and on simulation-based fault injection for analyzing the effects of SEUs. Extensive experimental results are reported showing the accuracy of the proposed approach. REFERENCES
[1] E. Fuller, M. Caffrey, P. Blain, C. Carmichael, N. Khalsa, and A. Salazar, Radiation test results of the virtex FPGA and ZBT SRAM for space based recongurable computing, in MAPLD 1999 Proc., C 2, Sept. 1999. [2] M. Ceschia, A. Paccagnella, S.-C. Lee, C. Wan, M. Bellato, M. Menichelli, A. Papi, A. Kaminski, and J. Wyss, Ion beam testing of ALTERA APEX FPGAs, in NSREC 2002 Radiation Effects Data Workshop Rec., Phoenix, AZ, July 2002. [3] R. Katz, K. LaBel, J. J. Wang, B. Cronquist, R. Koga, S. Penzin, and G. Swift, Radiation effects on current eld programmable technologies, IEEE Trans. Nucl. Sci., vol. 44, pp. 19451956, Dec. 1997. [4] B. L. Bhuva, J. J. Paulos, R. S. Gyurcsik, and S. E. Kerns, Switch-level simulation of total dose effects on CMOS VLSI circuits, IEEE Trans. Computer-Aided Design, vol. 8, pp. 933938, Sept. 1989. [5] N. Kaul, B. L. Bhuva, and S. E. Kerns, Simulation of SEU transients in CMOS IC, IEEE Trans. Nucl. Sci., vol. 38, pp. 15141520, Dec. 1991. [6] M. P. Baze, S. Buchner, W. G. Bartholet, and T. A. Dao, An SEU analysis approach for error propagation in digital VLSI CMOS ASICs, IEEE Trans. Nucl. Sci., vol. 42, pp. 18631869, Dec. 1995. [7] L. W. Massengill, A. E. Baranski, D. O. Van Nort, J. Meng, and B. L. Bhuva, Analysis of single-event effects in combinational logic-simulation of the AM2901 bitslice processor, IEEE Trans. Nucl. Sci., vol. 47, pp. 26092615, Dec. 2000. [8] M. Alderighi, F. Casini, S. DAngelo, F. Faure, M. Mancini, S. Pastore, G. R. Sechi, and R. Velazco, Radiation test methodology for SRAMbased FPGAs by using THESIC+, in Proc. 9th IEEE On-Line Testing Symp., 2003, p. 162.

VIOLANTE et al.: SIMULATION-BASED ANALYSIS OF SEU EFFECTS IN SRAM-BASED FPGAs

3359

[9] M. Ceschia, M. Violante, M. S. Reorda, A. Paccagnella, P. Bernardi, M. Rebaudengo, D. Bortolato, M. Bellato, P. Zambolin, and A. Candelori, Identication and classication of single event upsets in the conguration memory of SRAM based FPGAs, IEEE Trans. Nucl. Sci., vol. 50, pp. 20882094, Dec. 2003. [10] M. Bellato, P. Bernardi, D. Bortolato, A. Candelori, M. Ceschia, A. Paccagnella, M. Rebaudengo, M. S. Reorda, M. Violante, and P. Zambolin, Evaluating the effects of SEUs affecting the conguration memory of an SRAM-based FPGA, in Proc. IEEE Design Automation and Test in Europe, 2004, pp. 188193. [11] F. Lima, C. Carmichael, J. Fabula, R. Padovani, and R. Reis, A fault injection analysis of virtex FPGA TMR design methodology, in Proc. IEEE Eur. Conf. Radiation and Its Effect on Component and Systems, 2001, pp. 275282.

[12] M. Alderighi, S. DAngelo, M. Mancini, and G. R. Sechi, A fault injection tool for SRAM-based FPGAs, in Proc. 9th IEEE On-Line Testing Symp., 2003, pp. 129133. [13] M. Alderighi, F. Casini, S. DAngelo, M. Mancini, A. Marmo, S. Pastore, and G. R. Sechi, A tool for injecting SEU-like faults into the conguration control mechanism of Xilinx Virtex FPGAs, in Proc. 18th IEEE Symp. Defect and Fault Tolerance in VLSI Systems, 2003, pp. 7178. [14] R. Velazco, S. Rezgui, and R. Ecoffet, Predicting error rate for microprocessor-based digital architectures through C.E.U. (code emulating upsets) injection, IEEE Trans. Nucl. Sci., vol. 47, pp. 24052411, Dec. 2000. [15] J. Rose, A. el Gamal, and A. S. Vincentelli, Architecture of eld-programmable gate arrays, Proc. IEEE, vol. 81, pp. 10131029, July 1993.