ISSN 1292-862

TIMA Lab. Research Reports

TIMA Laboratory, 46 avenue Félix Viallet, 38000 Grenoble France

Upset-like Fault Injection in VHDL Descriptions: A Method and Preliminary Results

R. Velazco, R. Leveugle TIMA Laboratory

46, Av. Félix Viallet, 38031 Grenoble (France) regis.leveugle or raoul.velazco@imag.fr

O. Calvo

Universidad de las Islas Baleares (U.I.B.) Palma de Mallorca (Spain)

oscar@imedea.uib.es

Abstract This paper investigates an approach allowing to evaluate the consequences of Single Event Upset phenomena for the reliable operation of processors. The method is based on the simulation of bit flips using a modified version of a high-level circuit description. Preliminary results illustrate the potentialities of this new strategy.

1. Introduction

The increasing sensitivity of microelectronic circuits to the effects resulting from the interaction with natural radiation present in the space environment or in the earth’s atmosphere, make more and more useful the evaluation of their reliability in an early stage of design life. Indeed, to achieve such evaluation, usual adopted strategies are based on ground testing, consisting in exposing the target circuit to a suitable particle beam while it performs an activity considered as representative of the one that it will carry out in the final application. The complexity of hardware and software developments needed to set up ground testing, and the high costs related with the use of particle accelerators facilities to simulate the radiation environment, make this kind of testing reserved to a few specialized research & development teams. This paper will deal only with a particular radiation effect: the so-called Single Event Upsets (S.E.U.) also referred as “upsets” or “bit flips”, responsible for transient (non-destructive) changes in the information stored in memory cells within integrated circuits. References [1][2] provide, for space and avionics applications, an overview on the involved physical phenomenon, the creation of a spurious current pulse in sensitive areas of the circuit, while references [3][4] deal with the consequences of SEUs on different types of circuits behavior and the corresponding test methods. Owing to the constantly increasing number of memory cells (privileged targets for SEUs), static memories (SRAMs) and processors (microprocessors, digital signal processors, micro-controllers) are among circuits more frequently focused by radiation ground testing. Memory testing strategies and set-up are straightforward compared to the ones needed for processor-like circuits. Some interesting results were recently obtained using a technique allowing bit flip injection randomly in time and location, by means of the interruption capabilities available in most of programmable devices [5]. The accuracy of error rate estimations derived from such fault injection experiments was proved by comparing them to those error rates obtained when running the same programs under radiation. However, this type of fault injection performed directly on the studied chip and based on the execution of particular pieces of code, cannot cope with errors arising in sensitive areas (cache memories, flip-flops and registers of the control part, registers and memory areas embedded in the data path) which are either unknown to the user or not accessible to the programmer through the instruction set. Moreover, with such techniques upsets can only be injected at particular instants (corresponding to the beginning of an instruction execution), limiting the significance of derived estimations. Some reliability evaluations with respect to SEU can be done prior to the generation of the final silicon, by simulating the effects of transients on the circuit behavior using an available description. To study the effects of upsets in all possible targets and instants, some works [6][7] have proposed fault injection techniques based on hardware description languages such as VHDL. Beside the capability to attain all sensitive areas, main

advantages of such approaches reside in the reduction of production delays, their low cost and also the possibility to assess the efficiency of error. Most of the proposed techniques are based in a common principle: modifying the studied architecture in such a way that considered faults can be generated at given instants in desired targets. As an example, in [7] fault injection is achieved by affecting different values to a considered signal at regular intervals. Main drawback is here that fault generation is completely internal (including target and occurrence instant selection) and cannot therefore be controlled from the circuit external world. Moreover, the modifications needed to inject the faults may result in significant increase of circuit complexity, leading to long simulation times.

2. Proposed approach for upset injection using VHDL descriptions

The approach proposed in this paper consists in the transformation of the target architecture to have controllability over all its memory cells, by activation of some additional external signals (secondary inputs). Achieving such transformation requires minimal modifications: • Every flip-flop is replaced by a new one, called DFFinj, having the same functional features but designed to

allow fault injection at any clock cycle. • The original data path is multiplexed with the data path used for fault injection. • A new clock signal is included with the secondary inputs, used as an input of all DFF inj to trigger the fault,

thus simulating the random occurrence of real upsets with an accuracy of one clock period. We implemented this technique in the following assumptions: all the memory resources are implemented

with D type Flip-Flops and, for a given hardware description the number, nature and the localization of the Flip-Flops does not change with the technology used. The secondary (extra) inputs of the modified description are limited to: • Signal CLKI, the error injection clock, at zero during normal operation • Signal HOLD is used to stop the clock system and replace it by CLKI during fault injection. • Signal MUX allowing to select between Q and Q’ for all DFFinj, • Address bus INJ allows triggering the fault injection only for the selected DFFinj.

With each rising edge of clock signal CLK, the Q signal depends on the value of D. This value remains stable until the next positive edge (The various flavors of D Flip Flops are characterized by the existence of extra signals like RESET or PRESET or by the presence of two outputs of which one is reversed, but in this first study we considered only the three signals explained above).

To perform a correct emulation of an upset, it is necessary to be able to inject the SEU at a specific time. Since the FFs can be affected only on the positive edge of CLK, it is mandatory to modify this clock. A scheme of a D flip-flop coping with fault injection requirements is given fig. 1. Signal CLKV is the clock used in normal operation (without fault injection), signal CLKSEU represents the SEU as fault injection clock, set to zero during normal operation. A solution to inject an upset consists on holding signal CLK by activating HOLD, while sending an impulse on CLKSEU.

We call this structure: DFFinj. Signal DATAin is the original data signal without fault injection. The output Q and signal INJ are combined at the XOR. If signal INV is “one” at the output of the XOR, the signal Q will be reversed. Signal MUX tells the multiplexer to activate the normal flow of the data or the path of injection. To inject an upset it is thus necessary to: hold the normal clock, set MUX to one, activate the path of injection and give an impulse on CLKSEU. This sequence is shown in fig. 2. In this example, CLKIN is locked on the high level, but the structure also works if locking is made on the bottom level. During the fault injection interval, the contents of the Flip-Flop is reversed. Signal INJ can be selected at any time and it should only be valid at the moment of injection. Further details of this research can be found in [8].

3. Application to a fuzzy controller

To show the advantages and the limitations of the proposed technique of fault injection, we applied it to an example before generalizing the approach. The example considered is a fuzzy logic controller implemented in a FPGA. This controller was selected for two reasons: Its architecture is simple and the memory resources required are not too numerous. These characteristics allow us to explore various fault injection strategies without being concerned with the complexity of the architecture. It represents a typical case of microcontroller, where it is not possible to inject faults bypassing the primary inputs since none of the internal registers is accessible to the user. To carry out the injection of the faults it is necessary to adapt the hardware while keeping its functionality. Development of control systems based on fuzzy logic controllers is a popular approach: this type of systems is indeed simpler to design and to adjust compared to the conventional systems, when the mathematical equations representing the plant are not known very well. The development of those controllers requires the use of electronic systems, which are able to perform fuzzy operations. The standard processors cannot guarantee optimal execution times if they are used to solve these problems. An example of design of a microprocessor dedicated to fuzzy logic can be found in [9]. It is also possible to design circuits based on dedicated hardware to implement fuzzy arithmetic. This approach is increasingly popular, considering that the application can be established entirely in a FPGA and reprogrammed if necessary. In [10][11] a design method for integrated systems dedicated to fuzzy logic is presented. In particular, in this example we used the high level language description XFL, along with the tools provided by XFUZZY, to describe and implement the fuzzy logic system. Using this program the user can describe at a high level, the parameters of the controller to be developed. The program has a library of fuzzy primitives described in VHDL to implement a fuzzy logic controller (functions of inference, methods of defuzzification, etc.). The user can participate in this process choosing certain parameters for the realization of the design (standard of architecture, methods of realization of functions etc.). From this code it is possible to carry out the system on several supports (FPGA, ASIC).

D

CLKSEU

Q

XOR

CLK

DFlip-flop

CLK

XOR

MUX

DATAin

MUX

INJ

CLKV

LATCH

HOLD

INV

Figure 1 : DFFinj Suitable to Fault Injection. Bold arrows indicate signals used by standard DFF.

Figure 2 Time Sequence for an Injected Fault

4. The studied fuzzy microcontroller The architecture of the microcontroller is shown in fig. 3. It was designed to solve the classic ‘truck parking control’. The VHDL description of this circuit provided by XFVHDL was modified by replacing all its flip-flops with equivalent DFFinj, accessible from proper activation of a few added secondary inputs. It must be noticed that the considered circuit complexity, owing to the use of fuzzy-logic approach, was quite low. Indeed it comprises only 141 flip-flops, needing 12 cycles to get at the external outputs, the control commands corresponding to the input values. 4.1. The test bench To carry out the fault injection simulation, it is necessary to have an adequate test architecture. The state machine shown in figure 4 generates three signals INJ, MUX and HOLD starting from the edge of a clock at the time of the reception of an external signal CS (chip select). This stimulus is generated in correspondence with the positive edge of CS. To inject a bit flip it is necessary to be able to address any of the 141 bits present in the architecture of the studied case. This block decodes the 8 bits input CODEINJ, and generates the adequate stimulus for injection. Summarizing, to cause the injection of faults, it is enough to generate a positive edge on CS pointing to the target register with CODEINJ. If we implement the fault injection block on an FPGA we will have a component where upsets can be injected with an external system. To perform the tests without external equipment, it is necessary to include a built-in vector generator, which selects automatically the injection target. For this function we designed a pseudo-random generator. One of the most common ways to implement it is with a LFSR (Logical Feedback Register Shift). The fault injection mechanism is activated by 14 cycles of a clock. In this way we can select all the possible cycles of clock during a cycle of processing (Notice that a cycle of processing lasts 12 cycles of clock). Considering that to inject a fault it is necessary to stretch the clock during 3 cycles, the duration of an injection stage would be 15 clock cycles. Figure 5 exemplifies the principles just described.

CLKIN

CLKV

CLKSEU

CLK

Fault FreeOperation

Affected byFaults

HOLD

MUX

Simultaneously with fault injection instants, we also clock the LFSR with 8 cycles, which generates the code of injection. The test bench is supplemented by the use of two counters: Upset Counter. The pseudo-random number generator produces all the possible values between 0 and 255, but only the values between 1 and 141 are used to inject upsets counted by this register. Error Counter: It is updated by a simple comparison between the expected value and the result obtained. The operation is carried out on the negative edge of the Valid Output signal.

Figure 4. Test Bench Block

4.2. Simulation Results Two fault injection sessions were carried out. The first one was done with fault injection during the high level of the clock. An upset was injected with each one of clock cycles. The results were the following: upsets injected: 427, detected errors: 200. Consequently the rate of sensitivity to the upsets was 48 %.

CS

CLK

CODEINJ

INJ

MUX

HOLD

Target (141 :1)

Fault Injection

Generation

Valid Input

Valid

Output

Fuzzy Mean

Input 1

Input 2

Output

MFC1

MFC2

Multiplexer 1

Multiplexer 2

RulesMinimum

Control Unit

CLK

Reset

R1

R2

R3

Signal Flow

Multiplexer Control Signals

Register´s clocks

R4

R5

R6

R7

R8Division

R9

Figure 3: Architecture of a Fuzzy Logic Controller

In the second session faults were injected during the bottom level of the clock: all the clock cycles were explored. The results are: upsets injected: 588, detected errors: 270 and rates of upsets sensitivity: 46 %. These results show that the whole cycle of processing is sensitive without distinction between bottom and ceiling of the clock pulse. The total rate of effectiveness is approximately 47 %. A more precise analysis of the errors showed that the upsets on certain registers do not affect them significantly. This occurs in particular on the registers R1 and R2, which contains the results of the operation of Fuzzification of the inputs. Upsets affecting these registers produce no significant errors at the output. On the other hand, there are registers which contribute in a very significant way: in particular the register R4 and R5 used to calculate the operands of the divis ion operation. The deviation on the value of the output can be very significant (up to 100% of the operand). Also, the upsets on certain registers give errors only if they arrive at a given time. This phenomenon is coherent with the considerations exposed before. These observations were carried out in a general way, but it is possible with this framework to focus our study on the effects of faults on a particular register. As an example, this study was made on the register R4. This register has 21 bits, which are used to calculate the dividend in the operation of defuzzification. Its value is set during the first phase of the pipeline cycle. Simultaneously with the positive edge of the pipeline signal (which indicates the beginning of a new pipeline cycle), its contents is used to perform the division. It is thus at the end of this operation that the errors must be evaluated. To carry out this simulation we can point directly at the R4 register by replacing the content of the LFR with its address. Figure 6 summarizes the results.

Register R4 Sensibility to errors

0

1

2

3

4

5

6

0 5 10 15 20

Bit

Nb. E

rror

s (6

ups

ets

inj.)

Figure 6 : Sensitivity to upsets of a given register

We could expect that the upsets on this register give errors if they arrive during the first phase of the processing. However, the exper iment shows that the 21 bits of the register do not contribute in the same way to the errors on the output; the bits starting from bit 6 always give errors but bits 4 and 5 give errors only occasionally and the least significant bits never give errors. The experiment shows that the deviations on the results increase with the weight of the bit. This type of study should be carried out on all the registers to identify the more significant parts of an architecture and their sensitivity to errors. 4.3. Real-State cost of the proposed solution An important aspect to consider, is the increase in logical resources necessary to adapt an existing architecture for fault injection. The following considerations are made by taking account of the results of the synthesis made for a FPGA FLEX10K, of the Altera family of devices. The syntheses was carried out with the Leonardo software. The Real-State "cost" is given in term of logic cells (LC), and in terms of the extra D-Flip-Flops used. The synthesis of the microcontroller without the addition of the fault injection logic required 478 LC and 141 DFF, where the flip-flops are mainly used to implement registers and the LC for the combinatorial logic.

A VHDL design consists of several modules: table 1 shows the contribution of each module to the total overhead. The original architecture, with the additional structures for fault injection required 624 logical cells and 142 DFF. The additional DFF in the control module is used to perform the clock holding function. The extra logic cells are used mainly for all the additional XOR and multiplexes. The increase in the number of LC is 146; approximately one LC for each DFF. This report/ratio is rather high. However the separate synthesis of each module shows that more complex architectures (such as the divider in the example shown), contribute less to the total increase. In the divider module, the rate between added LC and DFF is 0,6. This study must be validated performing a fault injection experiment on a more complex architecture: in this case we can hope that the total overhead will be less than 1 LC for each DFF. Additionally, the module to generate the pseudo-random sequence required 23 LC and 22 DFF.

The module decoding the request for fault injection and generating the fault stimulus require 169 LC and 9 DFF. The most significant part is undoubtedly the stimulus decoder to address the Flip-Flop that will be the target of injected bit flips. To avoid significant overhead in the number of logical cells, it is possible to increase the size of the input stimulus (more than 8 bits).

Table 1: Overhead Due to the Injection Logic

Without Injection Logic With Injection Logic LC DFF LC DFF

Control 8 7 23 8 Antecedent1 82 15 106 15 Antecedent2 82 15 106 15

Rules 17 5 27 5 Multiplexer1 9 0 9 0 Multiplexer2 9 0 9 0

Minimum 11 0 11 0 Composition 123 35 158 35

Division 137 64 175 64 TOTAL 478 141 624 142

5. Predicting error rates

The main goal of this work is to define a well sound methodology for the prediction of error rate of circuits operating under radiation, and exposed thus to the occurrence of SEU resulting in random bit flips. For complex circuits the sensitivity to SEUs is usually evaluated by the which is derived from the results of experiments in which the target circuit is exposed the to a suitable particle beam. During such an experiment, all the circuit accessible memory cells are continuously observed after being properly initialized, to detect possible changes of it content. The number of observed errors, normalized by the particle fluency (number of impinging particles) gives the so-called underlying cross-section, σSEU (eq. 1). It is obvious that the underlying cross section represents a worst-case sensitivity, and can over-estimate of orders of magnitude the circuit sensitivity while immerged in the actual final application. Indeed, not all the memory cells contain relevant information at all the instants, moreover, a bit flip arising in a memory cell which will be written in a later, will no t have any consequence at the circuit behavior.

particlesofNumber

ErrorsSEU #

#=σ (1)

injectedfaults

Errorsinj #

#=τ (2)

From fault injection experiments, performed according to the strategy exposed in previous sections, it can be evaluated

the average number of bit flips needed to provoke a circuit malfunction. Let this measure be the error rate, τinj, (eq. 2). The error rate of the considered circuit while carrying on a given activity, can be estimated as the product of the underlying SEU cross -section SEUσ corresponding to the sensitive areas of the processor, by the errors rate issued from fault injection experiments, as shown in formula (3). In other words, formula 1 allows estimates the number of particles needed to provoke a bit flip in one of the circuit internal memory cells, while formula 2 gives how many bit flips are needed in the average to provoke an error in the circuit outputs while it carries out the actual final activity. The main advantage of this approach is the evaluation of the application sensitivity without running the evaluated circuit application under beam exposure. Obviously, radiation experiments are needed to determine the underlying cross-section, but, notice that hardware and software developments needed to perform such experiments are significantly more simple. Moreover, the sensitivity of particular memory cells for a given circuit manufacturing technology, should be in a close future, part of the information available in the circuit data sheet.

injSEUSEU circuit τσσ *)( = (3)

In [12] preliminary results obtained for different processors have shown that the approach for error rate prediction based on fault injection leads to well sound evaluations. Indeed, error rate predictions were compared to the results of radia tion ground testing experiments performed in the same conditions than the ones of fault injection. However, these experiments pointed out the limitations of the adopted fault injection approach (based on the execution of particular pieces of code as the response to the assertion of an interrupt signal), which is in general limited to not too complex processors.

The approach presented in this paper offer a general solution and should be validated in the future, by radiation testing experiments. 6. Conclusions Groundwork of VHDL fault simulation was carried out in this work. The study was applied to a fuzzy logic controller built with dedicated hardware in a FPGA. To adapt the target architecture to fault injection purposes, the access path to each Flip-Flop of the system was redesigned with minor modifications. To carry out fault injection experiments by VHDL simulations, a test bench was developed which generates a pseudo-random sequence to choose the target and the instant of occurrence of fault injection. The results of synthesis showed that the brought modifications do not make increase the complexity of the architecture considerably. Simulated fault injection sessions showed a rate of sensitivity less than 50 %. Thanks to this experiment it was possible to qualify the sensitivity of the various parts of the studied system, and to identify the more significant periods of clock. These simulations were realized on-line: the circuit processed a sequence of inputs for which the correct output is well known. The cycle is performed while an upset is injected. To analyze the impact of the occurrence instant, faults were injected during both the rising edge and the falling edge of the clock. Obtained results show that an average of 47% of the upsets provokes erroneous circuit outputs. Moreover, the detailed analysis of results put in evidence the most sensitive registers to injected errors, and those where the period of sensitivity was tighter have a ‘natural’ robustness with respect to transients. The overhead in terms of logic cells (LC) for the modified VHDL description was of about 1 LC per Flip-Flop of the original description. Such an overhead is not a major drawback to the generalization of this approach that, in principle, can be automatically performed. Another advantage of this strategy is that the VHDL test bench is usable to inject faults for any target circuit, independently on its nature and complexity.

The purpose of future work will be the design of a tool for synthesis where it should be possib le to adapt with an automatic process an unspecified architecture. Also, real radiation testing will be carried out on a FPGA implementation of the fuzzy controller to experimentally verify the simulation results presented in this paper. This is a preliminary work where the main ideas are presented. Some problems concerning a gated clock and the use of excessive routing resources have not been considered. Also, extra work need to be done to reduce the overhead by DFF. 7. References [1] P.J. McNulty, “Single-Event Effects Experienced by Astronauts and Microelectronic Circuits Flown In Space”, IEEE Transactions on

nuclear science Vol. 43, n 2, April 1996, pp. 475-482. [2] E. Normand, “Single -Event Effects in Avionics”, IEEE Transactions on nuclear science, Vol. 43, n 2, April 1996, pp. 461-474.

[3] J. H. Elder, J. Osborn, W.A. Kolasinsky, R. Koga, “A method for characterizing microprocessor’s vulnerability to SEU”, IEEE Trans.on Nuclear Science, Vol 35, N° 6, pp. 1679- 1681 , December 1988.

[4] K. W. Li, J. R. Armstrong, J. G. Tront, “An HDL simulation of the effects of Single Event Upsets on microprocessor program flow”, IEEE Trans. on Nuclear Science, Vol. NS 31, N° 6, pp. 1679- 1681 , December 1984.

[5] R. Velazco, S. Rezgui, R. Ecoffet, Predicting Error Rate for Microprocessor-Based Digital Architectures through C.E.U. (Code Emulating Upsets) Injection,, IEEE Transactions on Nuclear Science,Vol 47, N° 6, December 2000, pp. 2405-2236

[6] R.Leveugle, “Fault Injection in VHDL Descriptions and Emulation”, Proceedings of Brazilian Symposium on Circuit Design, (XIII SBCC) Manaos, (Brazil) 18-22 Sept.- 2000.

[7] F.Vargas, A. Amory, R. Velazco ,“Estimating Circuit Fault -Tolerance by Means of Transient-Fault Injection in VHDL”, Proceedings of Brazilian Symposium on Circuit Design, (XIII SBCC) Manaos, (Brazil), 18-22 Sept.- 2000.

[8] A. Bragagnini, “Etude d’une méthode d’injection de fautes à partir d’une description VHDL”, Master Repport, presented at the Institut National Polytechnique de Grenoble (INPG), 8 September 2000.

[9] P. Cheynet, “Architectures pour la logique floue”, Projet de DEA, Université Joseph Fourier de Grenoble, 22 juin 1994.

[10] M.A. Manzoul, D. Jayabharathi.,“FPGA for Fuzzy Controllers”, IEEE Transactions on Circuits and Systems, Vol. 25, 1995, pp 213 – 216.

[11] A. Barriga et al. “Automatic Synthesis of Fuzzy Logic Controllers ”, Mathware & Soft Computing, vol III, Nº 3 (1996) pp 425 -434.

[12] S. Rezgui, R. Velazco, R. Ecoffet, S. Rodriguez, J. R. Mingo, “Estimating error rates in porcessor-based architectures, to be published at IEEE Transactions on Nuclear Science, December 2001.