Which One is the Most Reliable Microcontroller?

"Yet the base question remain that why can't we have a Microcontroller which can be trusted in failure proof manner."

For one thing, we are only humans, and not omniscient. We can predict some, but not all, possible causes of failure. We can guard against the one we know, but not easily against the ones we don't (yet) know.

It could be made, but no one would buy it because the cost would be too high.

The world is driven by CHEAP! The only thing that matters any more is the maximization of profits, at all costs.

Greed drives everything today.

"Maximization of profits, at all costs" is actually self-defeating (e.g., spending two million to save one million).

"Maximization of profits, at least costs" may be better, but often it entails fobbing some costs onto someone else.

Maximization of profits this week, without regard to next week, is the problem I see.

...or into next week. (Which just fobs the costs forward into one's own future. Maybe this is what an MBA teaches?)

Oh, so many to blame, so little time.

We're from the old school. Ethics have been replaced by avarice and a complete lack of regard for our fellow man.

_{Steps off soap box.}

I agree that the lower cost gives popularity and most beginners will prefer to use lower cost Microcontrollers. Commercial Electronics also will use low cost Microcontrollers but there are many applications where money is not a primary consideration or problem and few companies do developed High Rad and Very High Temperature Microcontroller / Microprocessor.

Identical LOGIC can be copied into high reliability FPGA and hence that is the block which is supposed to be most reliable one.

We can discuss here mainly two things

Relatively least sensitive Microcontrollers

Method for elimination of Brown out Microcontroller in multiple Microcontroller environment and implementation of voting system

Superior watch dog circuit

Reference to superior FPGA for Microcontroller

Reliable Clock circuit

Reliable voltage Regulator

Reliable Memory, which is generally a part of the FPGA

Yes, there are few external components that go with Microcontrollers and those are also to be considered to maintain the reliability of the overall functioning of the system as everything adds up to the risk factor. However, here we are talking about the Microcontroller and its inside LOGIC and looking for performance reliability comparison.

Unfortunately you are left with microcontroller manufacturer literature (data sheets, application notes, etc) as the main resources to compare different microcontrollers. Sometimes reliability data is provided, sometimes not.

For very special cases you may be able to get additional reliability data out of the manufacturer directly, but I don't expect this to work unless you have a contact within the manufacturer (or have a good relationship with them) or are planning to buy many.

Based on you application you may have to rely on the manufacturer's supplied data and test in house to compare reliability (ideally with more than one sample of each microcontroller).

Users are good source of information. Most of the manufacturers will not admit problems unless someone pricks them and asserts with proof.

Sometimes you see PINs of the IC falling apart. This may sound ridiculous but this is what I have seen happening for real. Something within the material eaten itself and PINs dropped out just by blowing air.

There are more problems in both material and design process. World economy has pushed many manufacturers to cheat. It is going to happen more often.

Do I use Microcontroller in a pacemaker or not will remain only a question unless I can have a clear answer if this can keep working for 20 years from implanting date.

Critical applications where survival depends on reliability of that small tiny stuff matters. I will not place a question to you all unless I am very serious about it.

Which uC or uP you are going to trust? I will say none and will make my own State Machine to do the job. This I did 35 years ago and I still feel the same way. Why these years could not bring one device which we can trust?

GA! Jack,

My experience also shows that the vast majorities of control boards failures are in the order shown below. As you can see, the microprocessor is the least likely to cause the failure.

1- Programing errors.

2- Design error: Not including the type of protections needed to recover from adverse events : power glitches, em pulses, over-temperature...

3- Not enough IO protections that allow external over-voltages to reach the control logic.

4- Weak electronic design: Bad power supply or board design and as in #3 bad IO.

5- I have rarely seen a processor itself being affected by noise when the above is covered but it can happen.

Firstly great question and secondly some really great replies....

I would say that having purchased the best quality you can find, putting in also good quality components, programming and design, you then need to build, each totally separate, at least 3 of them and give them "voting" rights against each other, so that if one has a problem, the other two then switch it off and give a warning that this has been done.

I believe that early aircraft blind landing and takeoff systems did this say 40 odd years ago, but how its handled today I have no idea......Maybe someone else with more knowledge could comment.......

There are devices designed specifically for increased reliability; these are mostly used in military and aerospace applications.

Here are a few links:

http://www.baesystems.com/rad750

http://www.spacemicro.com/

http://www.honeywellmicroelectronics.com/

Texas Instruments has a new Hercules (c) Arm based microcontroller that has two controllers that run together and check the results. This is the technique that is used in high end control computers, but this is a first I've heard of a microcontroller doing it. Ti Says "MS570 provides high performance using dual CPU lockstep architecture based on the ARM® Cortex™ R processor for transportation and safety applications." Look into this product and a good safety RTOS.

http://processors.wiki.ti.com/index.php/Category:Hercules

For voting, we need AtLeast three identical cores to accept two matching results and to rule out one that does not match.

Honeywell high Temperature 8051 core is well known for long time and I will prefer this one for 250c to 350C operation for time limited application. Intel 8085 uP wa also designed to be Radiation tolerant but not sure to what degree and not that is obsolete.

Aeroflex perhaps has some Rad hard FPGA and Memories. http://www.aeroflex.com/ams/pagesproduct/prods-radinc-services.cfm

I looked online for more infos about these chips, but either the infos are incomplete or badly written as I was unable to find a description that dual processors are checking each other....I believe it may be called "Lock-Step CPU"......

So either it doesn't do that exactly or their advertising writers are total crap as if I was doing the writing, I would put this point squarely on the map in a simple format that even Andy Germany would understand.....

Thanks in advance.

SET effects are often reported in research papers and minimization of SET based damage is very important for reliability of Microcontrollers.

What I was trying to find more about was the statement:-

Texas Instruments has a new Hercules (c) Arm based microcontroller that has two controllers that run together and check the results.

I could not find out whether this was true or not!!

Its certainly not been mentioned in the reading I made......or not in a manner that I understand.

What you are saying about "set" is also not clear to me, can you post more?

OK

Normally we nee another processor to check or voting Logic to check.

...and what has that got to do with the word "set" that you used before?????

Having 3 computers each one checking the other two out is a relatively old concept, even in the analog days.....

SET is Single Event Transient caused by Cosmic Rays by Ionizing Semiconductor material and forming enough charge to bog off the Analog and Digital signal. Energy and LET of the Ionizing Radiation and charge particle type decides the amount of charge produced and if hit is at critical place then sure something wrong may happen just when you do not want it to happen. While SET events are predictable to some extent statistically but what they will do is very complex and not easy to predict. Some Semiconductor processes are specially designed to reduce the SET effect. Total removal is like removing COSMIC Rays which is just not possible. Cutting down their numbers and risk reduction is something that we all try to achieve.

You can easily find lots of conference papers on SET and space electronics is of lots of worry due to high Radiation environment. Tests are often done at high gamma rays doses of the order of 100kRad or about to that level.

Memory bit can simply turn ON / OFF due to SET event or even multiple of them can get affected.

In one design that I developed 35 years ago, I was writing duplicate entore data into three locations in static memories and by comparing all three data and if one of them was corrupted then I used to copy the matching one to that bad location. I have written a program which was checking memory all the time while task was being performed normally. This was Multichannel Analyzer (MCA) which was used to collect data for 400 days on continuous bases. I was afraid that something or other will corrupt the memory in 400 days. My program was in Fused PROM and data in static memories and these static memories were of my worry. I have used Intel 8085 Radiation hardened uP and extra bipolar state machine to keep watch on statistical events as well as data management. For 25 years, we did not find any great problem and then these system were scrapped by new generation engineers as they were not so sophisticated like PC which often requires reboot and can hardly hold few days data with reliability.

Well, it is a generation gap and so is the technology. We knew somewhat better value of reliability and perhaps it has lost its meaning now.

I was having my own developed ESD GUN and EMP source to rest all ICs before I placed those parts in the design. I found many types of ICs were very poor quality and they often died with ESD and EMP impulses. These tests I did in 1976 on my early stage designs. I think they were very interesting one. I published about my ESD GUN in EDN long ago in 1996 some 20 years after I developed it. You can find it here.

http://www.edn.com/archives/1996/091296/19di1.htm

I was with Atomic Energy at IGCAR Kalpakkam (www.igcar.gov.in) from 1976 to 1998. Now I own Sensors Technology and Advanced Sensor Research Organization companies.

.

That was one of the most interesting posts I have ever read on CR4, many thanks.

Here is the white paper on exactly how the checking works.

http://www.ti.com/lit/wp/spry178/spry178.pdf

From what I understand there is a second on-board CPU that is running a couple of clock cycles behind the first one. The first CPU results are delayed and the results are compared to second CPU.

Thanks.

I do not see it as being as good as the old fashioned "THREE" computer system as in an argument of "one on one" as here, you may have problems to decide which one is wrong.....

Not impressed.....

Voting LOGIC blocks information that does not match at least with any two of them. This how all nuclear power plants are operated. This is also very likely way for space missions.

The company I worked for formerly came to the conclusion that the most reliable electronics are those for motor vehicles.They are made by the million, unlike military/space parts and operate under severe temperature cycling under the bonnet. A poor part creates 1000s of unhappy customers and bad publicity, so quality is actually high. They have far more parts "in the field" than military/space, which ensures faults are recognized and corrected more quickly - and the reliability database has more statistical certainty.

Yes, the automotive electronics is paying type and volumes are high and quality demand makes sense. Not all electronics is automotive specs and some tends to remain commercial type an will gradually shift to automotive standard.

I am considering new IGBTs from International Rectifier IRGPS4067DPbF for most of the switching power drivers as it is designed for high power and high temperature. Greater sale will also bring down price and will make greater sense. Right now it is at $10 each in 100s but may come down to $5 level in few years.

Hi One & All,

The military has great line of microcontrollers that will with stand every thing except a bullet at close range. The last person getting his hands on one for his personal project, is doing 40 years to life--little draw back!!! You want something that will reliable; do what the Russian do, use no coils & sub-miniature tubes???

Just remember, you can NOT violate "Murphy's Law"!!!

Have a very nice day!

BEN

hmm wonder if we can look at how a microcontrollers pins are set...i don't mean to get into persistent(flash) and non-persistent memory and higher level UI designed and ran by MPLAB it is all sequentially hooked up and installed .... how reliable can components be made? extreemly reliable ... have relays switching to other controllers EMF supressor diodes on all circuits... When one controller fails, the other controller assumes the workload of the failed controller. Obviously, this increases the workload of the surviving controller. Are Dual-controller architectures severely limited in scalability and cannot have more than two controller nodes? NO depending on the rewritability of the MC... hmmm so the microcontrollers decides writability and allows you to design fail safes .... so many that chances are the helicoper you make out of motorcycle parts won't fall out of the sky depending on reliability elapse timing you set in your controllers by the mili second... but w/o the engineering aspect you can design a purely lean user interface with dual systems to take over firing order for example... as for radiation resistant microcontrollers... probably encased in lead but that won't stop a nutreno which probably isn't whats destroying microcontrollers... thats why Microcontrollers are strong in #'s as for 2012 scientific breakthrough of being able to detect a nutreno well thats far from repelling

There are two fundamental differences between the 8-bit PIC microcontroller
architectures and the new 16- and 32-bit architectures. The 8-bit architecture reserved PortA pins primarily
for this purpose; the roles of the two ports have been swapped!
peripheral module input/output signal is multiplexed on an I/O pin, as soon
as the module is enabled, it takes complete control of the I/O pin-independently
of the direction ( TRISx ) control register content. In the 8-bit architectures it was

up to the user to assign the correct direction to each pin, even when a peripheral module required its use.

the I/O pins.

r-0
bit 31 bit 24
- - - - - - - -
r-0 r-0 r-0 r-0 r-0 r-0 r-0
r-0
bit 23 bit 16
- - - - - - - -
r-0 r-0 r-0 r-0 r-0 r-0 r-0
R/W-0
bit 15 bit 8
PCFG15 PCFG14 PCFG13 PCFG12 PCFG11 PCFG10 PCFG9 PCFG8
R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0
R/W-0
Legend:
R Readable bit
U Unimplemented bit
W Writable bit P Programmable bit r Reserved bit
-n Bit Value at POR: ('0', '1', x Unknown)
bit 7
bit 31-16 Reserved: Reserved for future use, maintain as '0'
Note: The AD1PCFG register functionality will vary depending on the number of ADC inputs available on the
seleced device. Please refer to the specific device data sheet for additional details on this register.
PCFG<15:0>: Anlog Input Pin Configuration Control bits
1 Anlog input pin in Digital mode, port read input enabled, ADC input multiplexer input for this
analog input connected to AVss
0 Anlog input pin in Analog mode, digital port read will return as a '1' without regard to the voltage
on the pin, ADC samples pin voltage
bit 15-0
bit 0
PCFG7 PCFG6 PCFG5 PCFG4 PCFG3 PCFG2 PCFG1 PCFG0
R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0 R/W-0

i apologize off subject, but this may not be :

embedded applications are designed to run their main loops for months or years
in a row without ever being turned off or receiving a reset command. But the control

registers of a microcontroller are simple RAM memory cells. The probability that a
power supply fluctuation (un-detected by the brown-out reset circuit), an electromagnetic
pulse emitted by some noisy equipment in the proximity, or even a cosmic ray could alter
their contents is a small but finite number. Given enough time (years) and depending
on the application, you might see it happen. When you design applications that have
to operate reliably on huge time scales, you should start seriously considering the need
to provide a periodic " refresh " of the most important control registers of the essential

peripherals used by the application.

so..... maybe duplex double tripple failovers are key ... ask yourself how creative you are w/ java... and get used to C symantics and curly braces... just don't make one huge main() class.... hmm... i'll relate to java... because there's abilities to make changes like late cast method binding or constructor/clones super class inheritance properties all the more need for vector's in the main class but i'm sure you just use IF statements and make fail safes for important registers.... all in C ofcorse .... think it out in java ... convert it all in C