We present single event effect test results for the Intel 80386 microprocessor, the 80387 coprocessor, the 82380 peripheral device, and on the 80486 microprocessor. Both single event upset and latchup conditions were monitored.

I. INTRODUCTION

The 80386 and 80486 microprocessors hold several distinct advantages over radiation-hardened microprocessors. These include reducing both cost and design time for spaceflight missions. This is accomplished by being industry-standard as well as commercially available devices with many commercial off-the-shelf (COTS) software applications, development tools, and operating systems. The 80386 microprocessor is currently in use on several spaceflight projects, while the 80486 is being considered for other projects. In particular, the 80386 is currently flying on Hubble Space Telescope (HST) and Solar Anomalous Magnetospheric Particle Explorer (SAMPEX), and is baselined for utilization on Earth Observing Satellite (EOS-AM), X-ray Timing Explorer (XTE), and Tropical Rainforest Measurement Mission (TRMM). The 80486 is currently being considered as a candidate HST replacement processor as part of the HST servicing program. This appears to be a spaceflight trend: utilizing commercial-type devices and up-screening them as per mission requirements.

However, the use of these commercial parts in spaceflight raises the issue of vulnerability to single event effects (SEE). A single event upset (SEU - a transient or bit flip) in a microprocessor's control unit may "crash" (halt or cause improper operation) a spacecraft system or subsystem. Worse yet would be an uncorrected single event latchup (SEL - a high-current condition) that may permanently damage a device or an entire system. It is essential to determine how vulnerable these commercial devices are to such SEEs. These experiments were performed in an effort to understand the effect of SEEs on a microprocessor from a system level standpoint: to determine how the use of these technologies will affect the system as a whole. This is a key difference from traditional piecepart testing.

II. TEST DEVICES

All devices tested were manufactured by Intel Corporation. Two to three samples of each device were tested. This is a compromise between test costs and time versus statistical validity. Table 1 describes these integrated circuits (ICs).

Three device types from the 80386 microprocessor family were tested: the 80386, 80386, and 82380. The 80386 itself is a general purpose 32-bit microprocessor. Test samples had maximum operating clock frequencies of 20 and 25 MHz (see Table 1) that were derated to operate at 16 MHz. The 80386DX has been tested previously [1,2] by NASA/GSFC and JPL, but as results may vary between lots, several lots were tested for various spaceflight projects. The 80387 math coprocessor is an extension to the 80386 microprocessor. It dramatically increases processing speed of 80386 application software. The 82380 peripheral integrates numerous functions necessary in a 80386 operating environment; the device acts as DMA controller, interrupt controller, interval timer, wait state generator, DRAM refresh controller, and system reset logic.

The 80486 microprocessor incorporates significant enhancements over the 80386. By integrating the microprocessor with the 80387 math coprocessor, on-chip cache memory, a clock doubler, and RISC design, operational performance is greatly enhanced. Because of differences in the manufacturing process (CHMOS IV and V), both the 80486DX33 and the 80486DX2-66 required testing. Devices from three potential spaceflight lots of 80486DX2-66 were tested because of the possibility of variance between lots. Slight changes in manufacturing process may have great impact on the SEE sensitivity of a device.

Objectives of this series of tests were to determine several SEE experimental parameters. For heavy ion tests, the linear energy transfer (LET) threshold (LET_th) is defined as the LET in MeV*cm²/mg where SEE is first observed during testing, at fluence 1E6 or 1E7 particles/cm². All LETs discussed are in MeV*cm²/mg. Additionally, a device cross section or sensitivity versus tested LETs were noted. For proton SEE results, device cross section versus proton energy was determined.

III. TEST PROCEDURE

A. Test Facilities

1) Heavy Ion Test Facility

Device	Function	Process
80386: - MG80386DX-20/B - 80386DX-25	32-bit Microprocessor	1.0um CHMOS IV [3]
MG80387-20/B	Math Coprocessor for the 80386	1.0um CHMOS IV [4]
82380: - MG82380-20/B - 82380-16	Integrated Peripheral for the 80386 - direct memory access (DMA) controller, interrupt controller, interval timer, wait state generator, dynamic random access memory (DRAM) refresh controller, system reset logic	1.5um CHMOS III [5]
80486: - 80486DX-33 - 80486DX2-66 (from 3 different lots)	32-bit Microprocessor - integrated 80387 math coprocessor, on-chip cache memory, clock doubler, RISC design	1.0um CHMOS IV [6] - (80486DX-33) 0.8um CHMOSV - (80486DX2-66)

Table 1 Test Devices

This setup utilizes a dual Tandem Van De Graaff acceleratorsuitable for providing ions and energies for SEU testing. Ions used are listed in Table 2. The SEUTF provides a computer interface that allows users to run the experiments.

Ion	Energy (MeV)	LET at normal beam incidence
F-19	139	3.4
Si-28	190	7.79
Ti-47	182	20.1
Ni-58	258	26.8
Br-75	285	37.2
I-127	311	59.6
Au-197	323	80.9

Table 2 Heavy Ions Used for Testing

Test boards containing the device-under-test (DUT) were mounted inside the SEUTF vacuum chamber. All test runs were performed with the ion beam held normal to the DUT; intermediate LETs were obtained by changing the energy of the beam. This was due to device packaging constraints not allowing angular beam incident testing to be performed. Tests were run with very low ion flux rates (1E3 to 2E4 particles/cm²/sec) in order that individual SEE events could be differentiated, typically with fluences of 1E6 or 1E7 particles/cm² (1E6 particles/cm² was often used to reduce the amount of total dose exposure of the DUT: we were worried about device failure and only had a limited number of samples). Devices were delidded to accommodate beam penetration limits.

2) Proton Test Facility

B. Test Technique

All devices were tested both with input power supply voltages of V_cc ± 5%. V_cc for all devices was 5V. Temperature for testing was a nominal 25 deg C. Table 3 summarizes each test setup and SEU types observed.

SBC	Test Method	Types of SEUs Observed
80386	Compare device data and address lines with known values stored in a PC.	Data - miscompare with stored data/address values; Lockup - single event functional interrupts (SEFI) requiring a reset signal to the device (HW or SW) to return to normal operations.
80486	Lock-step comparison of two DUTs (data, address, and control lines).	Non-compare - miscompare between DUT and reference device data/address/control lines; Lockup - single event functional interrupts (SEFI) requiring removal of device power to return to normal operations.

Table 3 Test Setups

1) 80386 Family Techniques

Previous tests² by NASA/JPL had been performed register by register: each register was loaded with known data, and its contents were monitored while irradiated the device. While this is a valid test method, providing useful data, it does not reflect normal operating conditions in most 80386 applications. Therefore, an active test was performed to simulate typical device operation: the microprocessor operated in protected mode, continuously performing a data write/read/check cycle.

The SEUs observed may be classified by the effects they had on the system: either data or operational errors (lockup). For the 80386, Data SEUs - incorrect data or addressing information - were detected in software. During the 80387 test, the DUT continuously performed a mathematical operation, and reported the result for a software check. Data SEUs, here, were defined as incorrect answers. The DMA function of the 82380 was tested by having the DUT perform DMA transfers continuously, while software monitored transfers for incorrect data. Data SEUs were defined as incorrect or incomplete data transfers. Additionally, all three devices experienced lockup SEUs, requiring a software-based reset or an external hardware reset signal to recover. Removal of device power (or a power reset) was not required to remove this condition. Lockup was most likely due to a hit to the control area, placing the device in an undefined state. Test runs were halted when lockup occurred. At higher LETs, immediate lockup prevented collecting of detailed SEU data. However, SEL tests were still performed. The power supply input current to the DUTs were set at levels just above maximum for the DUT during SEL testing. This is true for all device types tested.

2) 80486 Techniques

A non-compare SEU was defined as mismatch between DUT and reference device address, data or control lines, upon which a reset signal was issued to the DUT to clear the condition. During a lockup SEU, both DUT and reference enter halt states, requiring a power reset to clear. This is theorized based on observed device behavior to be caused by the DUT entering an internal test mode.

3) All Test Devices

IV. TEST RESULTS

Several devices were tested with V_cc ± 5% ; no statistical difference was noted versus nominal V_cc. For 80486 testing, utilizing different software was only briefly explored: worst case system software was used for almost all test runs. It is expected that some variation (+/- 30%) from software to software would be seen, with more cache-intensive programs being more vulnerable to SEU when the cache is enabled.

Results are summarized in Table 4. Figure 1 illustrates the dataset described below for the 80386 devices.

Device	SEU - Data/Non-compare	SEU - Lockup	SEL - Microlatchup	SEL - Destructive
Heavy Ion Effects
MG80386DX-20/B	LETth ~ 4.14	LETth ~ 4.14	LETth between 37.1 - 59.9	not detected
80386DX-25	not tested	not tested	LETth between 26.2 - 37.1	not detected
MG80387-20/B	LETth 3.38	LETth between 12 and 26.2	not seen	LETth between 37.1 - 59.9
MG82380-20/B	LETth 4.14	LETth < 3.38	-	LETth between 12.2 - 26.2
82380-16	not tested	not tested	not seen	LETth < 12
80486DX-33	cache on: LETth < 3.53; cache off: LETth between 3.83 - 8.27	not tested	not seen	LETth ~ 20
80486DX2-66	cache on or off: LETth between 4 - 7.79	LETth ~ 11.4	LETth~ 20	not detected
Proton Effects
-	Cache on		Cache off
80486DX-33	4E-10 cm2/device at 63 MeV		8E-11 cm2/device at 63 MeV
80486DX2-66	1.5E-10 cm2/device at 63 MeV		4E-11 cm2/device at 63 MeV

Table 4 Test Results

A) MG80386DX­20/B

Both data and lockup SEUs were first observed at an LET of 4.14. Above LETs of 11.4, devices were tested for SEL only, due to immediate device lockup during the test runs. Note that the lesson learned from this latter problem was to incorporate automatic device software resets into the test setup. We did this for the 80486 testing.

Destructive SEL was not detected during any test run. The LET_th for microlatch, however, was noted to be between LETs of 37.1 and 59.9. A dwell test, where the DUT was placed into a microlatch condition and allowed to continue to draw current for a ten minute period, was performed to determine if the microlatch was destructive to the DUT. It was not; the DUT was fully operational after a reset. This, however, was not a statistically reliable test; detailed reliability analysis of localized (within the device) current consumption should be explored as well.

B) 80386DX­25

SEL: This device was tested for SEL only. Microlatch was the only condition detected, with a threshold between LET 26.2 and 37.1. Devices were tested at both 5V and 5.25V. Destructive SEL was not observed on any test run.

C) MG80387­20/B

Data from these devices is presented in Figure 2.

Data SEUs were detected starting at an LET of 3.38. A stuck bit, i.e. a register or data value that remains at a certain logic level (high or low) despite efforts to change the value, was detected twice during the test. This condition was removed both times by a software reset. Lockup was first observed at an LET of 26.2. Above an LET of 37.1, devices were tested for SEL only, due to immediate lockup during test runs.

The LET_th for destructive SEL is between 37.1 and 59.9. No microlatch SEL was noted.

D) MG82380­20/B

Data from this device is presented in Figure 3. Data SEUs were first observed at an LET of 4.14. This device experienced lockup at all LET values tested, beginning at 3.38. At an LET of 11.4 and above, devices were tested for SEL only, due to immediate lockup during test runs.

The LET_th for destructive SEL was noted to be between LET values of 12.2 and 26.2. The device also experienced a possible microlatch at LET values of greater than 26.2.

E) 82380­16

This device was tested for SEL only. Traditional latchup was observed at the lowest LET tested of 12. A dwell test was performed, allowing the DUT to operate for two minutes at a high current induced by SEL (850 mA, with specified device maximum of 300 mA). The 82380 recovered fully, following a power reset. This, however, was not a statistically reliable test; detailed reliability analysis should be explored as well.

During several tests, the 82380-16 operating current jumped above device rated limits. This condition was cleared completely by a reset pulse to the DUT; power reset was not required. Most likely the device entered an internal test mode. This may also be called a single event functional interrupt (SEFI).

In another test run, following SEL, the operating current decreased (by ~ 20 mA in 2 minutes) of its own accord. Device failure was not noted. No explanation is offered at this time.

F) 80486DX­33

Non-compare with cache enabled: SEUs were observed at the lowest LET tested of 3.53. The LET_th appears to be around 3 based on curve fitting. This is illustrated in Figure 4.

Non-compare with cache disabled: SEUs were not detected at the lowest LET tested of 3.53. The LET_th is between 3.83 and 8.27, and appears to be around 5-6. Figure 5 presents this data.

Lockup was not observed due to test setup limitation. The device was not retested.

Figure 5 also displays the SEL test results. This device entered traditional or destructive single event latchup starting at an LET of 20. Both test samples of this device failed after occurrence of SEL. Inspection under a microscope shows holes in the silicon formed by the high current destructive condition. I_cc was removed after the occurrence of SEL within a 1 second time window.

Proton SEE testing was performed as well at a proton energy of 63 MeV. With a nominal V_cc of 5V and the internal device cache disabled, no SEUs were observed. When V_cc was reduced to 4.75V, a few sporadic errors were detected. With the internal cache enabled, the device was approximately an order of magnitude more sensitive to proton-induced SEUs. Device cross section was 4E-10cm² with cache enabled and <8E-11cm² with it disabled.

Proton SEE testing also may be used for total dose testing as well. Three device samples were tested thusly at the UCD facility. Two samples failed parametrically, but not functionally at total dose levels of 12-15 kRad(Si), while one sample failed functionally as well.

G) 80486DX2­66

Devices from three separate lots were tested, with varying SEE characteristics. Figure 6 represents the overall SEU data for two lots (Lots 1 and 2) that were tested. The third lot was tested more recently and will be talked about for general characteristics only. SEU data for lot 3 is consistent with those of lots 1 and 2.

From Figure 6, non-compare with cache enabled SEUs were not detected at the lowest tested LET of 4. The LET_th , thus, is between LET values of 4 and 7.79 and would appear to be roughly 5-6. Non-compare with cache disabled SEUs were not observed at the lowest tested LET (4). Hence, the LET_th is between 4 and 7.79 and appears approximately 5-6. Figure 7 compares the data results between having the internal cache enabled and disabled.

Lockup was observed starting at an LET of 11.4. Device cross-section at an LET of 37.2 was roughly 7E-6 cm².

Two of the three lots (Lots 1 and 2) of the 80486DX2-66s experienced only microlatchup starting at an LET of 20. The most recent test did not observed microlatchup until an LET of 37.2. No destructive SEL was observed up to a maximum tested LET of 90. Cross section at an LET of 80 was < 1E-4 cm². No device failures were seen following any SEL event. Figure 8 presents the SEL results for both the 80486DX-33 and lots 1 and 2 of the 80486DX2-66.

Proton SEE testing was also performed using the UCD facility. With a V_cc of 5V and the internal cache disabled, a few sporadic errors were observed (but not on every test run)at proton energies of 63 and 38.2 MeV, respectively. With the device cache enabled, the device was approximately an order of magnitude more sensitive to proton-induced SEUs. No SEUs were detected at an energy of 26.6 MeV.

Little variance was noted due to dropping supply voltage to 4.75V. Figure 9 illustrates the results for this device.

During proton SEE irradiation, test samples failed parametrically at total dose levels of 35-80 kRad(Si). None of the samples failed functionally. Recent total dose testing at NASA/GSFC has been performed on two of the candidate spaceflight lots using a Co-60 source. On lot 2, the data was consistent with the proton total dose results (parametric failure around 30 kRad(Si)). Lot 3 Co-60 testing has just been performed. Failure appears to be around 20-25 kRad(Si). The first failure this time was functional and not parametric.

V. IMPLICATIONS

Implications may be viewed from two sides: those that impact the spacecraft designer, and those that impact the SEE tester or IC designer.

From the spacecraft perspective, usability of the DUT is realistically all that is required. Are they able to utilize this device? Are there any concerns or stipulations? For all these devices, there are several. SEE testers and others also have several lessons that may be learned from this set of test data.

Spacecraft designers may be able to utilize these devices, but all would require care in their designs. All devices that were irradiated experienced some type of SEFI or device lockup. Occurrence of this condition could lead to a system problem during spaceflight. Therefore, a reliable detection/reset scheme is necessary in any spaceflight application. Items such as watchdog timers, parity checks, register copies, etc... may aid the designer in providing a dependable system.

Additionally, these devices have the potential for other types of SEU (data, address, or control errors) as well. Because these microprocessors and peripherals perform activities which coordinate system operation - such as interrupts, timers, memory transfers, etc. - any type of SEU may have wide-ranging system effects. Safeguards, again, are necessary wherever practical.

As one might expect on the 80486 devices, when the internal cache is enabled device cross section at a specific LET increased. Common sense agrees with this: more cells are now active in the device. For the DX-33 device, LET_th also was affected: the device LET_th decreased as well.

LaBel, et al... [1] have demonstrated that microlatchup may be mitigated by means of watchdog timers and power resets. For the 80486DX2-66 and the 80386DXs, this might prove useful. For the 80387, 82380, and 80486DX-33, all of which demonstrated destructive SEL, current limiting at the device level would be required as a minimum.

Devices from three different 80486DX2-66 lots were tested, with varying SEE characteristics. In particular, microlatchup LET_th varied between LETs of 20 and 37.2. Slight variation in the manufacturing process may lead to significantly different single event effect sensitivity, especially without the strict process control of military-process parts. Because of this type of variability in commercial devices, lot screening is recommended strongly.

It also should be pointed out that devices on the same INTEL CHMOS IV process demonstrated different SEL characteristics; the 80386s noted only microlatchup, while the 80387 and 80486DX-33 saw destructive SEL. The implication here is straightforward; the SEL path within a device is design and process dependent. Simply relying on SEE test data from a different device on the same process does not guarantee the same SEE characteristics.

A last note is based on the limited total dose test dated presented on the 80486DX2-66. The variance between lots for failure mechanisms (parametric versus functional) is of future interest and shall be explored accordingly.

VI. CONCLUSION

With the increased use of commercial technology in spaceflight, designers must be concerned with the impact of radiation on the devices. We have presented SEE test data on select microprocessors and their associated peripheral devices. This data may aid in the selection of proper error mitigative techniques, and in predicting the impact that the use of commercial technology may have on future mission success.

VII. REFERENCES

1. LaBel, K.A., Stassinopoulos, E.G., Brucker, G.J., Staufffer, C.A., "SEU Tests of a 80386 Based Flight-Computer/Data-Handling System and of Discrete PROM and EEPROM Devices, and SEL Tests of Discrete 80386, 80387, PROM, EEPROM, and ASICs," IEEE Radiation Data Effects Workshop, 1992.

2. Watson, R.K., Schwartz, H.R., Nichols, D.K., "Test Report for Single Event Effects of the 80386DX Microprocessor" NASA/JPL Publication 93-12, February 15, 1993.

3. INTEL Corporation datasheet, 80386DX, September 1993.

4. INTEL Corporation datasheet, 80387, September 1993.

5. INTEL Corporation datasheet, 82380, September 1993.

6. INTEL Corporation datasheet, 80486, February 1995.