Structural Fault Tolerance for SOC

Transcription

1 Structural Fault Tolerance for SOC Soft Error Fault Tolerant Systems Hrushikesh Chavan Department of ECE, University of Wisconsin Madison, USA Younggyun Cho Department of ECE, University of Wisconsin Madison, USA Abstract The number of transistors on IC continues doubling every eighteen months. It is feasible that more components can be integrated on a single chip. However, cramming more components onto a small area leads to increasing concern about reliability of systems. Without guaranteeing that systems are fault tolerant, it is meaningless that putting more components on a single chip. A soft error is the one that we need to more pay attention to since it is able to change a bit value unexpectedly after manufacturing process. To avoid data loss by soft errors, fault tolerant circuits are required to detect and correct wrong values while running. Using appropriate redundancy techniques, fault tolerant systems can be realized. Razor flip-flop and BISER flip-flop are well-known and widespread methods to protect data from soft errors. Performance of Razor flip-flop and BISER flip-flop is evaluated based on a five stage pipelined microprocessor. With respect to areas and power consumption, Razor flip-flop is a bit better than BISER flip-flop but it is possible that BISER flip-flop is preferred to Razor flip-flop in other perspectives. In this paper, BISER flip-flop and Razor flip-flop are evaluated. Keywords Soft Errors, Razor Flip-flop, BISER Flip-flop, C- Element, Fault Injection I. INTRODUCTION Soft error rate (SER) is the rate at which a device or system encounters or is predicted to encounter soft errors and single even upset (SEU) is another name of soft errors [2]. If a device has a SEU cross-section of cm! for neutrons of atmospheric energy distribution and if it is subject to a flux of 20 neutrons per square centimeter per hour, then it will experience an average of 0.02 upsets per hour [11]. A significant percentage of errors can result in data corruption without the system or the user knowing about it [12]. If the most significant bit of the register in the system changes 1 to 0 or 0 to 1, it is disastrous. For the reliability of systems, soft errors are detrimental so that it is tremendously essential to know how soft errors take place and how they influence performance of a system at first. Soft errors are unexpected transitions of a logic state in a system due to ionizing radiations [1] that create excess free carriers. The excess free carriers recombine with the stored charges, which causes the content of transistors to change [1]. A cross talk induced by the electromagnetic interference also can cause soft errors [2]. When a transient fault occurs in a combinational circuit, it might disturb the flip-flop following the combinational circuit and result in a soft error [4] (figure 1). To obtain reliability of systems, the fault tolerant circuits must detect and correct the soft errors. Fault tolerant systems can be realized using redundancy techniques [2]. Redundancy is defined as additional resources that increase reliability of the system. Redundancy techniques can be classified as hardware, software, time and information redundancy [2]. The main focus of this paper is to evaluate two different fault tolerant techniques, which individually contain BISER flip-flops or Razor flip-flops. They use the concept of time and hardware redundancy for reliability of the system. To evaluate two different fault tolerant circuits, a five stage 16-bit pipelined microprocessor is designed in Verilog HDL and then, ID/EXE and EXE/MEM pipelines [5] are changed to BISER flip-flops or Razor flip-flops to compare the performance. FITO [6] is used to inject faults into the model. FITO has one extra wire for Fault Inject Signal (FIS). When FIS is high, a fault will be injected into the circuit. The evaluation of performance is on area overhead and power overhead. Furthermore, how many faults injected each technique can detect and correct and how many clock cycles each one needs to complete are considered. The fault injections occur at the random intervals to figure out which one can detect more and which one cannot. Figure. 1. A Soft-error chain

2 II. DESCRIPTION OF ALGORITHMS The proposed algorithms are for a soft error protection. It can be realized using several strategies including time redundancy and hardware redundancy techniques. A. BISER flip-flop BISER is Built In Soft Error Resilience [3]. The key to implementing BISER flip-flop is c-element. The c-element has two inputs and one output. The behavior of the output is same as the input when the two input are equal or is holding the previous value when the two inputs are discrepant. C-element can be implemented at the transistor level (figure 2). However, two-pmos and two-nmos in series cannot be described in RTL or behavior level Verilog HDL. The different gate-level implementation is contrived using RS-latches (figure 3). A master-slave flip-flop can be implemented using a master latch and slave latch. BISER flip-flop [2] uses two flip-flops with a c-element(figure 4). When CLK is high, LB and PH1 are transparent. If LA and PH2 are driven by input D (CLK is low), LB and PH1 are vulnerable to soft errors. When CLK is low and a alpha particle hits the LB, the value of LB will be changed but the c-element does not allow the error to propagate to Q due to the fact that the two output are different (C-element keeps holding the previous value). On the other hand, LA and PH2 are prone to the error but not LB and PH1 when CLK is high. A alpha particle hits PH2 and then a content of PH2 is flipped. The two outputs vary. The C- element blocks the error to propagate to Q. Figure. 4. BISER flip-flop Figure. 2. C-element at the transistor level Figure. 3. C-element using RS-latches The truth table of c-element can be given as Table I. Truth Table for C-element A B Cn Cn Cn B. Razor flip-flop To implement Razor flip-flop [2], time and hardware redundancy are used. Razor flip-flop(figure 5) tries to sample the data twice in main flip-flop and shadow latch. The razor flip-flop consists of a main flip-flop driven by CLK, a shadow latch driven by CLK_DELAYED, a comparator to generate an error signal and a 2:1 multiplexer to select the input. The time interval between the main clock and the delayed clock is the error detection window [13]. When the value of the main flipflop and the value of the additional latch are different, the error signal is generated and the multiplexer corrects errors. When the error signal is high, all pipelines need to be stalled until the error signal goes down. It is necessary to guarantee that the shadow latch is always fault-free. If the shadow latch has a fault, there is no way to detect and correct errors. The difficulty to design Razor flip-flop is to determine the delayed clock cycle used by the shadow latch If the delay of the shortest path of the combinational logic is less than the δ delay, the shadow latch is corrupted with the new data so that a minimum length constraint is required to avoid this problem. The minimum delay of a combinational logic is supposed to be greater than the δ delay plus hold time of the shadow latch. If the minimum delay of the combinational circuit is less than this constraint, putting more buffers on the shortest path can solve the problem but area overhead and power overhead come at the cost.

3 The shadow latch is always correct and the logic delay does not exceed the shadow latch s setup time under worst-case conditions [5]. III. SIMULATION RESULTS Figure. 5. Razor flip-flop Figure. 7. Pipelined Processor Architecture C. FITO Fault injection is a key to evaluating fault-tolerant techniques. The numerous fault injection approaches [6] have been introduced already. Those approaches can be divided into hardware based fault injection [7], [8] and software based fault injection [9], [10]. Furthermore, software based fault injection can be classified as software-implemented fault injections and simulation based fault injections. One type of the simulation based fault injections, Verilog HDL, is used to inject faults into the five stage 16-bit pipelined microprocessor. Using Verilog HDL, the high observability and controllability [10] can be obtained. RTL and behavior level Verilog HDL can be supported by Fault injection tool (FITO) [6]. The RTL level fault injection model (figure 6) is used for the simulation. Single even upset (SEU) flips the content of the element. For the bit flip fault model, FITO has the additional signals, Bit[0] and FIS[0] with a 2:1 multiplexer. When FIS[0] and Bit[0] are high, the inverted input goes to the flip-flop so that the fault can be injected into the model. The target register is indicated by FIS signal and the target register bit is controlled by Bit signal. The FIS and Bit signals are responsible for fault injections. Since the bit-flip fault model is synthesizable, it is doable to obtain area overhead and power overhead after it is integrated into the five stage 16-bit pipelined microprocessor. To implement these fault tolerant techniques we implemented a five stage 16 bit pipelined processor. Figure 7 depicts the architecture of the pipelined processor. The ISA of this processor consists of following instructions: ADD, ADDI, SUB AND, OR, SLL LW, SW BEQ, JUMP HLT All components needed are complete in Verilog HDL. Table 1 is the assembly language code used for the simulation. The five stage 16-bit pipelined microprocessor with BISER FF and Razor FF are tested using the test benches mentioned Table 1, Table 2, Table 3 and Table 4. Each fault is injected into the model at different time and has different time intervals. When a new simulation starts, a different random seed is used to generate different time and intervals from the previous one. TABLE II. TESTBENCH AND R3,R2,R OR R4,R3,R ADDI R5,R0, ADDI R6,R1, SLL R7,R6,2 8 A000 HLT TABLE III. TESTBENCH 2 Figure. 6. Synthesizable bit-flip fault model SW R2,R2, LW R3,R2, SUB R5,R2,R1

4 ADD R6,R3,R SUB R7,R6,R LW R8,R2,3 9 A000 HLT TABLE IV. TESTBENCH AND R3,R1,R OR R4,R1,R LOOP: SUB R2,R2,R1 6 6FFE BEQ LOOP 7 A000 HLT B. Razor flip-flop When FIS is asserted, the main flip-flop might sample the faulty value that is caused by the fault injection. In δ delay, the shadow latch detects the fault-free value. As soon as the comparator detects any difference between the main flip-flop and the shadow latch, the error signal goes high and then all preceding pipelines are stalled until the error signal becomes low. One cycle later, the processor resume normal operation (figure 10) if the main flip-flop and the shadow latch contains the same value. If the error occurs during the phase of the clock when it is not transparent then the error will not be reflected at the output and no stall is asserted (figure 11). TABLE V. TESTBENCH ADD R3,R1,R ADD R5,R2,R SUB R4,R1,R ADDI R6,R0, ADDI R7,R0, ADD R8,R4,R ADD R9,R5,R3 10 2A62 SUB R10,R6,R2 11 0B34 ADD R11,R3,R4 12 A000 HLT Figure. 10. Razor flip-flop simulation result 1 A. BISER flip-flop As soon as FIS (figure 8) is high, one bit fault is injected into BISER flip-flop. The output influenced by the fault injection becomes low. In spite of the fact that two outputs that are inputs of c-element vary, the c-element blocks the error to propagate to q so that q still has the correct value. Figure 9 shows another scenario. After a fault is injected, the output of LB does not change because FIS is activated while CLK is low so that the state of LB is not affected. Figure. 8. BISER flip-flop simulation result 1 Figure. 9. BISER flip-flop simulation result 2 Figure. 11. Razor flip-flop simulation result 2 C. Five stage 16-bit pipelined microprocessor with BISER flip-flop Varying number of faults is injected into five stage 16-bit pipelined microprocessor with BISER flip-flop (figure 12). We consider these faults to be primarily being generated by the sequential circuitry. All faults are masked so that no error manages to propagate to the final output. The final outputs are not influenced by any transient faults. The second and last faults are injected when LB is deactivated (CLK is low). Those faults are masked by itself as the latches are not transparent. The first and third faults are blocked by c-element. Figure 13 is the result of the simulation using another random seed. Five faults are injected but none of them propagates to the final output except the third fault. When the third fault is injected, the c-element detects the discrepancy between two inputs so that the final output keeps holding the previous value, which is 0 that is not correct. This scenario seems to corrupt the system. In fact, as soon as FIS signals goes down, the final output can be updated to 1 and the output will be correct before the CLK goes down. Therefore, the system will not fail. However, if the interval of the third fault is extended, the final output will be wrong and the system might be corrupted (figure 14). As shown in figure 14, the fault interval lengthens and then it

5 needs one more cycle to become 1 which might cause the system to fail. However since transient fault more than often is just a spike and as such this scenario is not bound to occur. Faults injected in the combinational part resulted in erroneous output values and additional hardware redundancy is required to correct such faults. then after certain iterations the system will abort execution and display appropriate error message. For every fault detected the system will stall for 1 cycle re-executing the previous instruction. The third fault does not affect the system for the same reason of the first fault. Figure 16 shows another scenario. The second fault causes an error. At the rising edge of the shadow latch, the fault is injected. The main flip-flop contains the correct value but the value the shadow latch stores is wrong value. In the next clock cycle, the difference is detected. Generally shadow latch is considered to be error free when it comes to sequential faults. However there may always be transient errors propagated from the combinational circuitry. This is one such scenario. Figure. 12. Five stage 16-bit pipelined microprocessor with BISER flip-flop simulation result 1 Figure. 15. Five stage 16-bit pipelined microprocessor with Razor flip-flop simulation result 1 Figure. 13. Five stage 16-bit pipelined microprocessor with BISER flip-flop simulation result 2 Figure. 16. Five stage 16-bit pipelined microprocessor with Razor flip-flop simulation result 2 Figure. 14. Five stage 16-bit pipelined microprocessor with BISER flip-flop simulation result 3 IV. COMPARISON OF AREA AND POWER D. 5 stage 16-bit pipelined microprocessor with Razor flipflop We inject varying number of faults into the five stage 16- bit pipelined microprocessor with Razor flip-flop at different instants of time (figure 15). These faults are considered to have been generated either in the combinational or sequential part of the processor. The first fault occurs when both the flip flops are not transparent thereby the fault not being propagated. However the second fault occurs at the rising edge of clock and thus the faulty value is latched at the output of main flip flop. Till the time the shadow latch reads the input, the transient fault disappears causing the shadow latch to latch in correct value. Comparing the outputs of the shadow latch and main flip flop there is a mismatch which asserts the stall signal. Now since this error was detected at the ID/EX stage, we will stall IF/ID and ID/EX stage so that the instruction would be executed again. This will continue till the output of both main flip flop and shadow latch matches. If the problem continues Verilog logic synthesis is complete using tcbn40lpbwptc. TABLE VI. BISER FF INDIVIDUAL AREA AND POWER Razor FF Type Five stage 16 bit pipelined Microprocessor Area Power nw nW uw TABLE VII. AREA AND POWER AFTER FIVE PIPELINES SWAPPED WITH BISER FFS OR RAZOR FFS BISER FFs Type Razor FFs Area Power uw uw

6 TABLE VIII. AREA AND POWER AFTER TWO PIPELINES SWAPPED WITH BISER FFS OR RAZOR FFS BISER FFs Type Razor FFs Area Power uw uw V. ANALYZING THE DESIGNS For normal fault free simulation, the total number of clock cycles and CPI for the 4 test benches is mentioned as follows. TABLE IX. NORMAL OPERATION TB. No No. of instructions Clock Cycles CPI (load use hazard) (after loop unrolling) Average CPI = BISER flip-flop is able to detect transient errors occurring in sequential part of the circuit and it can correct the error without causing any performance overhead. As can be seen, we are not required to stall the pipeline or flush previous instructions for the error to be corrected. It is in turn corrected by the c-element. However, the overall frequency of operation may be affected due to the inclusion of c-element. In our implementation, for all transient faults occurring in the sequential part of the circuit, the fault tolerant design was able to detect faults while maintaining a CPI equal to that of normal operation. All transient faults occurring in combinational part of the circuit went undetected resulting in erroneous results at the output. TABLE X. WITH BISER F/F TB. No No. of instructions Clock Cycles CPI (load use hazard) (after loop unrolling) Average CPI = Razor flip-flop is able to detect transient faults occurring in both the combinational as well as sequential part of the processor. For every transient fault detected by the ID/EX and EX/MEM flop resulted in a stall signal increasing the number of clock cycles by 1. Thus for 2 transient faults occurring during the execution of the code the total number of clock cycles and equivalent CPI is mentioned in the table below. TABLE XI. WITH RAZOR F/F TB. No No. of instructions Clock Cycles CPI (load use hazard) (after loop unrolling) Average CPI = VI. FUTURE WORK Efforts should be made to reduce costs arising due to the inclusion of redundant latches. One such method is to reuse on-chip resources such as scan latches for multiple functions at various stages. Another method is to only insert the fault tolerant flops in critical paths rather than in all the paths. There is one added advantage associated with Razor, which could be exploited for further power and performance benefits. Razor can easily adapt to dynamic voltage and frequency scaling. It is a power management technique, which can be used to either increase or decrease the voltage with the frequency decreasing or increasing respectively. This added flexibility helps us achieve better power and performance. Also we could create a hybrid flop by combining both BISER and Razor. By doing so we do not have to stall or flush for every transient fault occurring in the sequential part of the circuit as c-element will provide required fault tolerance. Also fault tolerant capabilities of Razor flops will ensure that we detect and correct transient faults that were generated in the combinational part of the circuit. Another important area where the soft errors would create significant amount of hazards is the memory. Transient faults occurring in SRAM cells can cause memory values to flip. This may result in loss of data. We feel that for such errors ECC techniques should be able to provide appropriate fault tolerant capabilities. Also ECC techniques like SECDED can be used to handle multi-bit errors occurring in SRAMs. VII. CONCLUSIONS In advanced technologies, soft error rate are getting worse and worse. We have primarily discussed two types of fault tolerant design techniques. Each has its own advantages and disadvantages. Based on the application, the designer has to decide the best fit from the available schemes. Both the fault tolerant techniques presented in this paper are efficient and practical to design systems with built-in soft error correction.

7 REFERENCES [1] Alok Garg, Soft Error Fault Tolerent Systems: Survey. [2] Dinesh Kumar Ravindran, Reliable Networks-On-Chip in the Many- Core Era. [3] Ming Zhang, Subhasish Mitra, T.M. Mak, Norbert Seifert, Nicholas J. Wang, Quan Shi, Kee Sum Kim, Naresh R. Shanbhag, Sanjay J. Patel, Sequential Element Design With Built-In Soft Error Resilience. [4] Subhasish Mitra, Norbert Seifert, Ming Zhang, Quan Shi, Kee Sup Kim, Robust System Design With Built-In Soft-Error Resilience. [5] Dan Ernst, Shidhartha Das, Seokwoo Lee, David Blaauw, Todd Austin, Trevor Mudge, Nam Sung Kim, Krisztian Flautner, Razor: Circuit-Level Correction Of Timing Errors For Low-Power Operation. [6] G. Gopinath Reddy, A. Rajasekhar Yadav, Y.Mahesh, High Speed Fault Injection Tool Implemented With Verilog HDL on FPGA for Testing Fault Tolerance Designs. [7] H.Madeira, P.Joao, G.Silva, RIFLE:A General Purpose Pin-level Fault Injector Proc of the European Dependable Computing Conference, 1994, pp [8] J. Arlat, M.Auera, L.Amat, Y.Crouzet, J.C.Fabre, J.C.Laprie, E.Martines, D.Powell, Fault Injection for Dependbility Validation-A Methodology and Some Applications, Trans, on the IEEE Software Engineering, 1990, pp [9] Z. Segall, T. Lin, FIAT: Fault Injection Based Automated Testing Environment, Proc. of the International Symposium on Fault-Tolerant Computing, Jun. 1988, pp [10] H. R. Zarandi, G. Miremadi, and A. R.Ejlali, Fault Injection into Verilog Models for Dependability Evaluation of Digital Systems, Proc. of the International Symposium on Parallel and Distributed Computing, Oct. 2003, pp [11] Berke Durak, Soft error rates in modern computer, [12] Subhasish Mitra, Ming Zhang, Norbert Seifert, TM Mak, Kee Sup Kim, Soft Error Resilient System Design through Error Correction. [13] Alen Bardizbanyan, Minimizing Processor Power Dissipation with Selftuning Techniques. [14] Wikipedia, the free encyclopedia,