On-line Reliability Related Sites and Documents
Title, Authors, Reference Abstract/Conclusion NASA Advisory NA-GSFC-2006-01
January 12, 2006Summary
In both FPGA and EEPROM device applications, the realization of past parts issues was delayed, since the failure rate was low. Failures in non-flight parts are not always treated with the same rigor as failures in flight qualified devices. Additionally, proprietary and stove-piped information barriers, along with a cultural resistance to discussing failures, prevent the user community from pooling their data collectively, observing trends, and “connecting the dots.” Together, this had led to delays in manufacturers improving their parts, processes, and software.
NASA GSFC kindly requests other NASA and non-NASA programs and projects to share with the Advisory Technical Point of Contact (see block 13) all DPA and Failure Reports on FPGAs and non-volatile memory devices, from both flight and engineering model usage along with lessons learned that can benefit the community. Note that prior to dissemination on the NASA Office of Logic Design web site, appropriate care (i.e. deleting items such as contractor names) will be taken.
Reliability Prediction for SpacecraftH Hecht and M. Hecht
RADC-TR-85-229
December 1985Abstract This study provides the basis for improving the utility of Mil-Hdbk-2l7 for reliability prediction of spacecraft components and systems. The reliability performance histories of 300 satellite vehicles, which were launched between the early 1960's through Jan 84, were reviewed and analyzed during the course of the study. Analysis of over 2500 reports of malfunctions indicated strong evidence of a decreasing failure rate with time in orbit. The cause for the decreasing hazard was found to be traceable primarily to design and environmental causes. In general, however, it was found that current predictions over-estimate the failure rate by at least a factor of two and that the excess of predicted over observed failures increases with time in orbit.
Three methods are provided for spacecraft reliability prediction. In order to account for the decreasing hazard, two of the procedures use a Weibull model with parameters based upon similar spacecraft mission types. A third method uses modifications of Mil-Hdbk-2l7 procedures to account for the overestimation of failure rates which result when procedures are used.
NASA Advisory: Actel SX-A, RTSX-S, and RTSX-SU FPGAs in Mission and Safety-Critical Systems.November 29, 2004
NA-GSFC-2005-01Actions Recommended:
- Actel MEC SX-A FPGAs should not be used in safety-critical applications. Actel MEC RTSX-S FPGAs should not be used in manned, safety-critical applications. These two recommendations apply to both the “old” and “new” programming algorithms. Some faults present in the flight hardware may be undetectable. Other premature failures may manifest themselves after the conclusion of the test program.
- Current and prospective users of Actel UMC A54SX-A and the new Actel UMC RTSX-SU FPGAs are urged to follow the NASA Office of Logic Design UMC device testing progress (See www.klabs.org for latest results). Actel internal testing has detected no programmed antifuse failures on these two UMC device types.
- It is recommended that projects employ the following three techniques to decrease the risks associated with the usage of Actel MEC SX-A and Actel MEC RTSX-S FPGAs (Note: also recommended for Actel UMC FPGAs):
- Ensure that test procedures have maximized fault coverage and all circuit nodes are heavily exercised.
- Maximize the number of operating pre-launch hours, in particular high temperature environmental testing.
- Ensure that all specifications, manufacturer’s guidance and good engineering practices are always followed with conservative design practices employed. In particular, logic structures that use the routed array clocks or local signals must employ skew-tolerant clocking techniques.
Manned space programs accident/incident summaries (1963 - 1969)CR-120998
General Electric Co., Daytona-Beach, Florida prepared for NASAContract NASW-410 (Safety Task)
March 1970Abstract:
This summary is a compilation of 508 mishaps assembled from company and NASA records which cover several years of Manned Space Flight Activity. The purpose is to provide information to be applied towards accident prevention. The accident/incident summaries are categorized by the following ten systems: Cryogenic; Electrical; Facility/GSE; Fuel and Propellant; Life Support; Ordnance; Pressure; Propulsion; Structural; and Transport/Handling. Each Accident/Incident summary has been summarized by description, cause and recommended preventive action.
Manned Space Programs Accident/Incident Summaries (1970 - 1971)CR-120999
Cranston Research, Inc.Contract NASW-2225
April 1972Abstract:
This document is a compilation of 223 mishaps assembled from company and NASA records covering the Accident/Incident experience in 1970-71 In the Manned Space Flight Programs. It is the companion volume to NASA CR-120998 which covered the years 1963-1969. The objectives of this summary is to make available to Government agencies and industrial firms the lessons learned from these mishaps. Each accident/incident summary has been reviewed by description, cause and recommended preventive action. The summaries have been categorized by the following ten systems: Cryogenic; Electrical; Facility/GSE; Fuel and Propellant; Life Support; Ordnance; Pressure; Propulsion; Structural; and Transport/Handling.
Assurance Issues Related to Electronic Wire BondsXLNASA Goddard Space Flight Center
Code 562 Component Technologies BranchObjectives and Background
The purpose of this website is to provide the NASA community with information about recent failure incidences affecting NASA's flight hardware. Through this information, failure mechanisms associated with electronic wire bonds will be presented. General information about wire bonding technology is provided to give background information to those readers who are not familiar with it or with the vast amount of literature available on this topic. This site has been created and is maintained by Code 562, the Component Technology Branch at the NASA Goddard Space Flight Center.
LEM Electronics ReliabilityJ. B. Friedenberg, J.J. Landers, and P. Marcellos
LEM Program Management Office
Aerospace Systems Division, Burlington, Mass.
lem_electronics_reliabilityAbstract
The LEM Program at RCA pp. 16-20 A brief description of the wide range of reliability tasks implemented under the Lunar Excursion Module (LEM) reliability program illustrates the vital role of reliability in all phases of the program, from conceptual design of a circuit to delivery as flight hardware. Analytical techniques and hardware aspects of reliability are discussed.
Electronic Reliability Design HandbookMIL-HDBK-338B 1 October 1998
mil-hdbk-338b.pdf
mil_hdbk_338b_contents.pdf1.1 Introduction This Handbook provides procuring activities and development contractors with an understanding of the concepts, principles, and methodologies covering all aspects of electronic systems reliability engineering and cost analysis as they relate to the design, acquisition, and deployment of DoD equipment/systems.
1.2 Application This Handbook is intended for use by both contractor and government personnel during the conceptual, validation, full scale development, production phases of an equipment/system life cycle.
Reliability Analysis CenterAbout RAC
The Reliability Analysis Center (RAC) is a DoD Information Analysis Center (IAC). The RAC is chartered by the DoD to collect, analyze, and disseminate data and information in a designated technical area of specialization. Information is distributed to DoD and industry via data bases, methodology handbooks, state-of-the-art technology reviews, training courses, and consulting services.
RAC's scope is the reliability, maintainability, quality and supportability of microcircuits, semiconductors, electromechanical and mechanical parts, and equipment/systems employing these parts.
The Use of Triple-Modular Redundancy to Improve Computer ReliabilityR. E. Lyons, W. Vanderkulk
IBM Journal of Research and Development (1962)
Volume 6, Number 2, Page 200Abstract
One of the proposed techniques for meeting the severe reliability requirements inherent in certain future computer applications is described. This technique involves the use of triple-modular redundancy, which is essentially the use of the two-out-of-three voting concept at a low level. Effects of imperfect voting circuitry and of various interconnections of logical elements are assessed. A hypothetical triple-modular redundant computer is subjected to a Monte Carlo program on the IBM 704, which simulates component failures. Reliability is thereby determined and compared with reliability obtained by analytical calculations based on simplifying assumptions.
Gold Bonding Reliability in Actel’s RT54SXS and A54SXA High Density FPGA Devices
Introduction
Driven by the demand for high density FPGA for space application, Actel is producing FPGA devices with bond pad pitch beyond the level of capability of aluminum bonding typically used for hermetic packaging.
At this moment, some of the Actel’s high-density FPGA devices are using gold ball bonding to connect the die to the package. Gold ball bonding is not a preferred interconnect bonding process for high reliability hermetic package due to concern on long-term reliability of gold-aluminum (Au-Al) intermetallics formed between the gold ball and aluminum pad. It is known that a certain intermetallic phase contributes to the long-term degradation of Au ball to Al metallization since intermetallic formation accelerates when the device is exposed to high temperature such as hermetic package sealing process and burn-in. During diffusion, Kirkendall voids may form when either the aluminum or gold diffuses out of one region faster than it can diffuse in to the other side of that region. Vacancies pile up and condense to form voids that will result to weakened bond. However, weakening of bond due to voiding can be prevented with the application of robust wire bond process.
The objective of this study is to demonstrate the Au-Al interconnect reliability in hermetic packaging. Devices were subjected to environmental accelerated test of 3000 hours at 150°C high temperature bake. Some units were also subjected to temperature cycling to verify bond interface strength since crack may occur at intermetallics due to extreme change in temperature.
Product Qualification Report For RT54SXS (72S & 32S)July 2002
qual_report_sxs_july_2002.pdfIntroduction
Following qualification report covers the RT54SX-S (32 & 72) product family. This report includes the qualification summary in detail. Additional information like the characterization, data sheets, Total Ionizing Dose (TID) Data reports, bonding diagrams are included here for reference.All units are fabricated at MEC (Matsushita Electronic Corporation). The qualification for this family was done on the largest die available "RT54SX72S ". A QCM design was generated and used to program the devices for Group C testing. For additional details refer Appendix B.
Qualification process was completed and product was released for manufacturing on 2-14-2002.
A1020B and A1280A Life TestFrom "Evaluation of Actel A1020 and A1280A Field Programmable Gate Arrays, Parts Technology Report 64198, February, 1996
TEST PROGRAM Long term reliability was evaluated by subjecting sample devices to 1000-hour static and/or dynamic burn-in at 125°C. All of the devices submitted for life testing were pre-programmed using the test chip pattern described in the radiation testing. Electrical testing was performed initially at 25 °C, according to the test conditions in Table II. Interim and final electrical measurements at 25 °C were made after 500 hours and 1000 hours, respectively.
A static life test was performed on twenty two A1280A's (LDC 9411). These parts were provided by the HST Project from their flight lot procurement.
Dynamic life tests were performed on six A1020B (LDC 9424). Three of these devices were burned-in at VCC = 5.5 V and the other three were burned-in at 6.0 V, to determine if the higher burn-in voltage would induce early failures in these devices.
Destructive Physical Analysis: Xilinx XQVR300-4CB228V (QPRO Virtex 2.5)Conclusion
The Xilinx part exhibits overall high-quality construction, with the possible exception of the wire-bonding process, which seems to create bonds inherently weak at the joint between the ball and the bond.Wire Pull Results
Wire pull was conducted and all wires broke at the ball/wire joint. This is somewhat unusual, as typically some wires will break at the span. This fact, combined with the somewhat-lower-than-average pull results of about 4.30 gm-f for S/N 10 and 4.13 gm-f for S/N 15, argues that the Xilinx wire-bonding process is inherently weak at the ball/wire joint—a fact which might be related to the observed roughness of the wire surface, especially at the joint. Both parts had at least one wire (out of 328 wires) fail the Mil-Std-883 of 2.5 gm-f for a 1.0 mil gold wire in a post-cap inspection. [August 30, 2002]
Accelerated Life Test for RT54SX and SX-S Wire BondsAugust 9, 2002
Conclusion
The accelerated life test was conducted. A possible trend of weakening bonds at the wire/pad interface was observed. However, the reliability risk of the gold ball bonds in Actel parts over a mission lifetime appears to be small.
DPA: RT54SX32SReport Number: Q20130DPA
Part Number: 5962-0150803QYC
Lot: T25JS001
Note: Destructive Physical Analysis (DPA) was conducted per GSFC S-311-M-70. The devices met the requirements of GSFC S-311-M-70.
*13. One hundred percent inspection (100%) of wires bonds on all three (3) parts for evidence of ‘Purple Plague’ was conducted. No anomalies or contamination was found. Average bond pull strength on all three parts was greater than 6.0 grams. Minimum pull strength was greater than 4.0 grams. These parts do not show evidence of "Purple Plague".
DPA-22047 AS8ER128K32QMarch 26, 2002
21099-20dpa.pdfIntroduction
One sample lot consisting of three (3) randomly selected devices, part number AS8ER128K32Q, was received for Destructive Physical Analysis (DPA) testing in accordance with S-311-M-70 SEC. 5.12.3, MIL-STD-883 METHOD 5009, BALL DWG. 555492 and applicable Military Standards.LOT SUMMARY/CONCLUSION
This lot fails to meet the specified DPA Requirements at Bond Pull testing and Scanning Electron Microscopy (S.E.M. Inspection) (Added July 2, 2002)
AUGER ELECTRON SPECTROSCOPY (AES)SURFACE ANALYSIS REPORT
CEA NUMBER E5723Purpose
To investigate the cause of a bonding failure. Two samples were to be analyzed. The samples were identified as Q20101 EV S/N 11 and S/N 34. Sample S/N 34 was a plasma cleaned control sample.Summary
The cross section of gold filled vias of sample S/N 11 show "wishbone’ shaped features that appear to be rich in carbon, aluminum and oxygen. Potentially these features are "pockets" and carbon, aluminum and oxygen cover the inside walls of these pockets. The open vias outside the bonding area show that a 50 to 100 nm thick carbon-based residue sits at the bottom of the vias. This is not observed for the control sample (S/N 34).Note: These are RT54SX-series parts, one pre-2000, one post-2000. (June 28, 2002)
Military Product Qualification of RT54SX72S (rev. 1) and RT54SX32S (rev. 2) with MEC 0.25 µm Technology
Report No. M014
rtsx72s_rev1_rtsx32s_rev2_qual_approval.pdfConclusion
The RT54SX72S qualification devices have passed all requirements specified in the Qualification Proposal. Please refer to the summary table below for individual test results. Therefore, RT54SX72S (rev. 1) and RT54SX32S (rev. 2), are hereby qualified and shall be released for production.Note:
This qualification is to qualify the largest RT54SX72S device of the SXA/S family, and re-qualify the RT54SX32S device after mask changes. The RT54SX32S (rev. 2) devices are identical to the RT54SX72S (rev. 1) devices in design and process, but with smaller gate counts, therefore, it is qualified by extension. This qualification effort is a supplement to the commercial SXA family qualification which had previously been performed on A54SX72A and A54SX32A devices with MEC 0.25 µm technology. HTOL, LTOL, and Temp Cycle qualification had all be performed and all requirements have been met. (added June 27, 2002)
Military Process Qualification of RT54SX32S for MEI 0.25 TechnologyReport No. M010
32s_p03_qual_summary.pdfConclusion
The 0.25 µm RTSX32S for MEC (wafer lot number T25JSP03) satisfies all requirements specified in the Qualification Proposal.Note:
This qualification is a supplement of the commercial qualification, previously performed on A54SX32A and A54SX72A for MEC (0.25 µm technology). HAST, HTOL, LTOL, and Temp Cycle qualifications have been performed and all requirements were met. (added June 27, 2002)
Dynamic Burn-In of 1280ARPQG for the Hubble Space Telescope
SUMMARY Two parts were submitted to dynamic burn-in using the dynamic bum-in boards supplied by JACKSON and TULL. Device serial # 127 was placed on bun-in board # 00 I and device serial # 128 was placed on bum-in board # 003. Both devices had their RESET pins connected to ground according to JACKSON and TULL's instructions (On each of the bum-in board, J104 and J95 were tied to ground).
The bum-in conditions for the first twelve hours were: TA = 100 °C and VCC = 5.25V. Subsequently, these conditiom were changed to TA = 125 °C and VCC = 5.5 based on telephone conversation between UNISYS and the manufacturer (SEI). The signals were periodically checked at the test point provided on the burn-in boards.
The duration of the burn-in was 160 hours. Throughout the burn-in, no significant changes were noted in VCC, ICC and the test signals.
Pre and post elecffical measurements could not be performed by UNISYS (No ATE program was available for this particular design configuration). (Added June 18, 2002)
Failure Analysis Report for the RH1280 CQ172V May 10, 2002Conclusion
Based on all of the data collected herein, it was determined that the failure is a result of clock skew, resulting in a data arrival time which violates the failing sequential module’s hold time requirement.(June 6, 2002 -- Acrobat 4.0 or higher needed)
Note: This was a case of clock skew, using a high-skew local net, heavily loaded, as a clock. Reference: N_Clock_Skew.ppt
INVESTIGATION OF DSC TRANSISTOR FAILURESObservation
TT& E of a Dedicated Signal Conditioner (DSC) which had failed during the STS- 92 mission (Oct. ‘00) found two defective Raytheon transistors (P/N JANTXV2N3019, Lot Date Code 7525)(May 17, 2002) Acrobat 4.0 needed.
KSC Advisory
Transistor issue. Reference: XXXXX XXXXX XX-X-XX-XX
(OK, I'm trying to get permission to turn the X's back into a document number).May 14, 2002.
gsfc_bond_pull_data.htm jpl_bond_pull_data.htm
RT54SX32SCQ256E/0113Summary of Bond Pull Data for Actel Parts (updated 5/16/2002)
June 21, 2001. Updated reports. q20024fa_camicro_sorce_tp_revc2.pdf
q20024fa_camicro_sorce_tp_revc2.doc
May 10, 2002. Updated reports.
q20024fa_rev_b1.pdf
q20024fa_rev_b1.doc
Report Q20024FA - RT54SX16
sx16_plague.pdf
sx16_plague.docMarch 8, 2002
Conclusion (excerpt)
... However, the parts were found to exhibit watermelon striping due to contamination and characteristics of "Purple Plague"—intermetallic growth and weak bonds. Wire pull testing established that three wires in one part failed the minimum 2.5 grams-force Mil-Std-883 pull criterion. Based on the fact that these problems were seen on two parts with the same date code, parts from lot date code 9937 are not recommended for flight use.[Note: I have submitted samples of multiple part types and data codes for follow-on analysis. -- rk]
Update March 15, 2002: It turns out that this problem found by the Project was the subject of a prior Actel notification letter (July 2000). Affected date codes are: 9919, 9931, 9937. Reference:
Update June 21, 2002: Adds FIB/AES analyses.
q20101ev_rev_b.pdf
q20101ev_rev_b.docMay 16, 2002: Additional updates.
q20101ev_rev_a.pdf
q20101ev_rev_a.docMay 10, 2002: Additional updates.
April 3, 2002: Updated reports include data from additional devices and lot date codes.
Note: Lot date code 9901 devices were shipped has commercial and mil-temp devices.
Background Failure Analysis Report Q20024FA reported the discovery of intermetallic halos and low bond strength for gold ball bonds inside ACTEL parts with date code 9937. Following this report, ACTEL spare parts of various part numbers available at Goddard were forwarded to the NASA GSFC Failure Analysis Laboratory for evaluation of their gold ball bond integrity.
Part Description
Table 1 identifies the part numbers and date codes of microcircuits evaluated in this study. Manufacturer logos identify the parts to be ACTEL or LORAL.
(3/22/2002)
Gold Wire Bond Reliability Review
with NASA/GSFCWire bond Concern on Actel
Devices with Au wire
NASA - ACTEL PCN Meeting
notification.ppt
notification.pdf(May 8, 2002)
Background
An Actel RT54SX16/date code 9937 was found by GSFC having the following:
- Strength of some wires pulled were below the 2.5 Grams Mil-std minimum
- Parts exhibited intermetallic halo at ball periphery.
- Watermelon stripes were suggested to be contamination.
GSFC inspected samples from 11 Actel lots with Au wires:
- All samples exhibited intermetallic halo around the ball periphery.
- Except RT54SX16/9937, all passed the required wire pull test limits.
Summary
- The affected lots (1999), with weak bond strength and formation of voids within the Al-Au intermetallic interface, were due to insufficient power and force.
- The intermetallic mass (Halo) around the edge of the ball is typical.
- The dark stripe at the ball surface is not an indication for contamination based on EDX analysis.
- Au-Al intermetallic formation will always exist in Au wire bonded devices.
- Optimized bonding process to achieve uniform intermetallic formation and high bond strength is essential to maintain device reliability.
- Actel maintains tight process control and stringent wire pull monitors to ensure bond reliability.
Hi-Rel Laboratories Report Number FR-32271
RT54SX16-FPGA(May 6, 2002)
Conclusion
Analysis of this type failure over the last 40 years has found that failures of this type can, after a lengthy scientific exercise consisting of many samples, be traced to trace level contaminants on the surface of the aluminum film which interfere with the uniform formation of intermetallic phases. These contaminants can be in the part per million range or films in the angstroms in thickness. These are both beneath the detection limits of energy dispersive spectrometry.
Cross-sections of the samples indicate that both good and bad devices exhibited about the same degree of intermetallic thickness which in itself indicates they both have experienced similar thermal histories. Therefore the failures must be attributed to trace level contaminants on the pad surface at the time of bonding. This is supported by the fact that other lot date codes and similar product lines did not experience this mechanism. An additional factor which may exacerbate the problem could be the presence of the large number of metal 3 to metal 2 vias in the bond pad metal. These could act as traps for contaminants during processing.
From a reliability perspective, these parts are at risk since the Kirkendall void formation and subsequent weakening of the bonds will only progress with time and temperature.Fit rates over time for new and old Xilinx products. (4/7/2002). intermetallic_mass_gsfc.pdf intermetallic_mass_gsfc_3.pdf
(compatible with Acrobat 3.0)plague/intermetallic_mass_gsfc.doc
(14.6 Mbytes)
"Analysis on Bond Quality Concerns for RT54SX16 from GSFC" Conclusion
- The weak bond and formation of small voids within the Al/Au intermetallic interface of RT54SX16 lot are due to insufficient power and force ( underbonding) at wirebond process. This results to formation of isolated microwelds wherein grain surface vacancies defects causes a rapid intermetallic diffusion.
- The intermetallic mass around the edge of the gold ball on Al pad is due to ultrasonic wire bonding motion. It is normal and can be seen on good units also.
- Intermetallic mass of well-bonded unit will not grow to the extent that it will result to kirkendahl voiding when subjected to 150°C at 1000 hours.
- The ‘line’ on the wire ball and neck region is not a crack but grain boundaries. It can be seen also in good lots.
- The EDX analysis of the light spot and dark stripes on the ball does not show any difference. This means that the watermelon stripes are not caused by contamination. We think this could be an effect of heat energy from Electronic Flame Off during ball formation.
(Acrobat 4 or higher needed, ~ 2.1 Mbytes, 4/3/2002)
dpa_sx16-1cq208bx3_ldc0101_0113.pdf DPA Report, Actel RT54SX16-1CQ208BX3, LDC 0101, 0113
(4/3/2002)ball_dpa_2202-38.htm Destructive Physical Analysis Report on the RT54SX16, D/C 9937. Test Report Comments
One sample (S/N 024) was subjected to bond-pull test. There were 63 bond failures of less than 3.0 gf on this device. ... All bonds that failed were at the interface of the ball bond to the die bonding pad indicating potential surface contamination at the bond surface.
(April 2, 2002)
dpa_sx32s_ ldc0113_t25jsp03.pdf DPA Report, Actel RT54SX32S-CQ256E, LDC 0113, T25JSP03
(Acrobat 4 or higher needed, ~ 2 Mbytes, 3/26/2002)tmr_simplex.jpg Graph showing the relationships between simplex, TMR, TMR/simplex, and switchable spare redundancy configurations. JPL_92-22.htm
Field Programmable Gate Arrays:
Evaluation Report for Space-Flight ApplicationJPL Publicatin 92-22, September 15, 1992
Reliable Flight Hardware Welcome to Reliable Flight Hardware (RFH), a national resource for finding, qualifying, and purchasing reliable flight hardware. RFH was conceived by NASA to serve the agency, its contractors, and the U.S. aerospace community.
RFH provides an integrated one-stop shop for information on the availability and reliability of flight hardware. RFH links various information sources together into one seamless service which provides a personalized web site, a searchable index, and proactive notification of information news and updates.
http://arioch.gsfc.nasa.gov/302/pdf/mag-6696.pdf
Mission Assurance Guidelines For GSFC Orbital ProjectsSeptember, 1996
Home - NASA
Office of Logic Design
Last Revised:
January 12, 2006
Web Grunt: Richard
Katz
