A soft error is a bit that flips because a particle of radiation struck the chip. The hardware is not damaged; rewriting the bit fixes it. But a flipped bit in a cache, a register or a control flop can corrupt data or crash a system, so chips protect themselves with error detection and correction.
This article explains where soft errors come from, how often they happen, how designs protect against them, and how that protection is validated on silicon.
7 min read | Intermediate
What You'll Learn
- Explain how a particle strike flips a bit
- Estimate soft error rates for a memory
- Describe parity, ECC and interleaving
- Explain how soft error protection is validated on silicon
How a Bit Flips
Alpha particles from trace impurities in packaging, and high-energy neutrons from cosmic rays, pass through the silicon. Neutrons can shatter a silicon nucleus into charged fragments. Charged particles leave a trail of electron-hole pairs.
A nearby junction collects that charge within picoseconds to nanoseconds. If the collected charge exceeds the critical charge of the node, the stored value flips.
That is a single-event upset. Smaller nodes at lower voltage store less charge, so they need less to flip.
How Often
At sea level, SRAM typically sees soft error rates of about 100 to 2,000 FIT per megabit. Neutron flux rises by about two orders of magnitude at aircraft altitudes. Roughly 1 % of strikes upset more than one nearby bit.
Quick Check
Q: A chip has 32 Mb of SRAM at 1,000 FIT/Mb. How often does one chip see an upset?
Show Answer
32 x 1,000 = 32,000 FIT, one upset per 109 / 32,000 = 31,250 hours, about 3.6 years. Across a million chips that is about 30 upsets an hour, which is why protection is needed.
Logic Is Affected Too
A strike on combinational logic causes a short glitch. It only matters if it reaches a flop, and three effects often stop it:
- Logical masking: another input blocks the path.
- Temporal masking: the glitch misses the flop's sampling window.
- Electrical masking: the glitch is too short to pass through following gates.
Flops and latches themselves are increasingly sensitive as they shrink.
Protection
- Parity: one extra bit detects a single flipped bit but cannot correct it. Useful where data can be refetched, such as a clean instruction cache.
- ECC: a common code adds 8 check bits to 64 data bits, corrects any single flipped bit and detects double flips.
- Interleaving: bits of the same word are placed apart, so one strike that flips adjacent cells hits different words, each with a single correctable error.
- Scrubbing: memory is read and corrected periodically, so single errors do not accumulate into uncorrectable doubles.
Quick Check
Q: Why is interleaving combined with single-error-correcting ECC?
Show Answer
A single strike can flip two or more adjacent cells. Without interleaving they might be in the same word, giving an uncorrectable double error. Interleaving spreads them across words so each word has only one error, which ECC corrects.
Validating It on Silicon
- Error injection: debug features flip chosen bits or force wrong check bits. Validation confirms each error is corrected or detected, logged, reported to software, and handled correctly by firmware and the operating system.
- Beam testing: parts are run in a neutron or alpha beam that multiplies the natural rate enormously. Counting errors measures the real soft error rate and multi-bit behaviour.
Error paths are rarely exercised in normal tests, so they are a common place for bugs: a correction that works but is not logged, or a report that crashes the handler.
In Practice
Soft error budgets are set per product, and each large structure is protected according to its share of the budget. Error reporting is part of the reliability features customers rely on, and errors seen in the field feed field return analysis.
Common Mistakes
Mistake #1: Protecting memories but ignoring flops
Large flop arrays and control state also upset; include them in the budget.
Mistake #2: ECC without interleaving
Multi-cell upsets defeat single-error correction unless bits are spread.
Mistake #3: Never testing the error paths
Inject errors on silicon and check correction, logging and software handling.
Practice Exercise
Challenge: Fleet Upsets
A server chip has 64 Mb of SRAM at 500 FIT/Mb, all protected by ECC. A data centre runs 100,000 chips.
How many corrected errors per day should it expect? About 1 % of upsets flip two adjacent bits; with interleaving, how many of those become uncorrectable?
Hint
FIT per chip x chips gives failures per 109 hours.
Solution
Per chip: 64 x 500 = 32,000 FIT. Fleet: 3.2 x 109 FIT, about 3.2 upsets per hour, or about 77 a day, all corrected. About 0.8 a day flip two adjacent bits, but interleaving puts them in different words, so they are corrected too.
Summary
- Particle strikes deposit charge that flips a node when it exceeds the critical charge.
- SRAM sees about 100 to 2,000 FIT/Mb at sea level, far more at altitude.
- Parity detects, ECC corrects, interleaving and scrubbing keep errors correctable.
- Error injection and beam tests validate protection and error handling on silicon.
