Modelling Multiple Faults in Fault-Tolerant Processor Architectures

Manuscript for ReviewModelling Multiple Faults in Fault-Tolerant Processor ArchitecturesJournal:Electronics LettersManuscript ID:ELL-2005-3160Manuscript Type:LetterDate Submitted by theAuthor:02-Sep-2005Complete List of Authors:Flint, James; Loughborough University, Dept of Electronic &Electrical EngineeringTouloupis, Emmanuel; Loughborough University, Electronic andElectrical EngineeringChouliaras, Vassilios; University of Loughborough, Electronic andElectrical EngineeringWard, David; MIRA Ltd.Keywords:VLSI, FAULT TOLERANT COMPUTING, TESTINGPage 1 of 13Modelling Multiple Faults in Fault-Tolerant ProcessorArchitecturesAddress for correspondenceJames A FlintDepartment of Electronic and Electrical EngineeringLoughborough UniversityLoughboroughLeicestershireLE11 3TUUKTelephone+44 (0)1509 227036Fax+44 (0)1509 227014EmailJ.A.Flint@KeywordsVLSIFAULT TOLERANT COMPUTINGTESTINGPage 2 of 13 Touloupis, Flint, Chouliaras and Ward: Modelling Multiple Faults in Fault-Tolerant Processor ArchitecturesModelling Multiple Faults in Fault-Tolerant ProcessorArchitecturesE. Touloupis, J. A. Flint, V. A. Chouliaras and D. D. WardAbstract:The fault-tolerant microprocessor systems used in safety-criticalapplications need to be thoroughly validated during the design stages. As feature sizesreduce in future CMOS technologies, there is an increased probability of transient andintermittent faults. This paper proposes a new model for multiple bit-flips in the timedomain, which can be used to target fault injection experiments. This extends thesingle or multiple bit-flip model that is currently used. Some results from faultinjection experiments on two different processor architectures are also presented toillustrate the applicability of this model.Introduction: Semiconductor materials are by their nature sensitive to ionisingradiation. Radiation-induced faults in microelectronic circuits are caused whencharged particles (usually from radiation belts or cosmic rays) lose energy by ionisingthe medium through which they pass, leaving behind electron-hole pairs. These faultsare known as Single Event Upsets (SEUs) and their effects on computer systems havebeen studied thoroughly [1]. The vast majority of SEUs generate transient faults andin rare cases permanent faults, which can affect the reliability and availability of thecomputer system by altering internally stored data. As geometries in CMOS processesshrink the sensitivity to radiation increases [2] due to lower supply voltages andsmaller electrical charges that constitute the stored data. Furthermore, the occurrencerate of on-chip electrical disturbances such as electromagnetic coupling between wiresalso increases due to the smaller distances between interconnects [3]. Finally, thePage 3 of 13Touloupis, Flint, Chouliaras and Ward: Modelling Multiple Faults in Fault-Tolerant Processor Architecturesincreasing clock frequencies increase the probability of latching a fault that occurs ona combinational circuit in the output memory element [4]. As a result, embeddedprocessor designers are increasingly employing fault-tolerant techniques to protect theinternal datapaths and storage elements. This practice is in addition to the well-established requirement to protect the memory blocks, which are generally consideredto be more susceptible to transient faults. An additional consequence of shrinkingfeature sizes and of increasing clock frequencies is the increased likelihood thatmultiple faults will occur from a single upset event. Fault-injection experiments onmicroprocessors found in the literature use only single bit-flips or concurrent multiplebit-flips [5, 6, 7]. Concurrent multiple bit-flips are often used in the evaluation offault-tolerant memories. However, memory arrays and memory elements associatedwith the non-programmer-visible state control logic (such as the pipeline stageregisters of a RISC CPU) affect the processor’s operation in a different way. For thatreason it is necessary to enhance the existing fault models with temporal parametersin order to efficiently validate the latter.Fault model:As has been explained, radiation-induced errors may occur in severalconsecutive clock cycles due to the characteristics of future CMOS sub-microntechnologies. Furthermore, these errors may occur in different locations, dependingon the different fault-propagating paths. Electromagnetic interference (EMI) with aperiodic form can also be a source of consecutive errors. In order to model non-concurrent multiple faults we propose the use of the normal distribution as a means ofselecting the occurrence cycle number for each fault. Each randomly selected faultoccurs at a cycle determined from the cumulative distribution function defined by:Touloupis, Flint, Chouliaras and Ward: Modelling Multiple Faults in Fault-Tolerant Processor Architectures∞− −−=x x dx e x y 22121)(σµσπ (1)Where µ is the mean fault injection cycle number, σ is the standard deviation and x is the cycle number. To select the cycle number at which to inject the fault into a particular pre-selected register, a sample is taken from a uniformly-distributed set of numbers in the interval 0 y(x) 1 and then x is determined from the inverse. The distribution function is plotted in Figure 1 for a mean error cycle of x = 50 and with several different standard deviations. It should be noted that there is a finite probability of the fault occurring outside the execution time of the program. In the event that this happens, another random number is selected according to the linear distribution function: MAX x xx y =)( (2)Where x MAX is the last execution cycle number being considered in the fault injection campaign. By using this scheme it is guaranteed that the chosen fault or faults will be injected only during the execution of the program, and in addition it forms a method for injecting concentrated or uniformly distributed individual or multiple faults. For small values of σ, the fault profile takes the form of the cumulative distribution function of (1) and as σ increases it tends towards the uniform distribution of (2). This approach is general, and is potentially useful for characterising the properties of microprocessors in a variety of scenarios.Fault injection experiments : Using the multiple fault model described above, we have performed a set of fault-injection campaigns on two different processor configurations: a 5-stage pipelined microprocessor that implements the SPARC v8 Page 4 of 13Page 5 of 13Touloupis, Flint, Chouliaras and Ward: Modelling Multiple Faults in Fault-Tolerant Processor Architecturesinstruction set (hereafter known as the simple architecture), and a fault-tolerantversion of the above processor that has a triplicated core [8]. We injected doublefaults on the pipeline registers only, while the processor was executing two differentbenchmark programs (mtx4x4, bitcnt). We also gathered information concerning theprocessor’s status and the results that were produced. 6000 pairs of faults wereinjected in each campaign, resulting in a total number of 240,000 simulations. SinceVHDL simulation times are long, only a limited number of values for were selected(Table 1). Pairs of faults that occur within 5 clock cycles are of particular interestbecause of the 5-stage pipeline, and can be considered as the result of a single particlestrike. A slightly larger interval between faults has been studied by setting equal to10. The value of 510 was chosen so that the fault interval is smaller or equal to theexecution time of the shortest benchmark (mtx4x4). For each pair of faults, israndomly selected within the program execution time. Figures 2 and 3 present thepercentage of the injected faults that caused the simple and the fault-tolerantarchitecture respectively to produce wrong results. Whilst some of the information inthis study is quite clear and indeed, expected, such as the fact that the fault tolerantcore has a much better overall reliability, much more detail is revealed by conductingthis study. In this example the variations observed in Fig. 3 for different values ofreveal that for the fault tolerant architecture the timing of fault occurrence has asignificant impact on the system behaviour. Similar variations can be observed to asmaller extent in Fig. 2 for the simple architecture. Fault-tolerant systems and faultdetection mechanisms in general have a critical period after the occurrence of a faultwhere this fault is masked or corrected. With the use of this model the effects of asecond fault during this period can be studied efficiently. The results give anindication about the likely effect of transients when contrasted with the performancePage 6 of 13 Touloupis, Flint, Chouliaras and Ward: Modelling Multiple Faults in Fault-Tolerant Processor Architecturesunder uniformly distributed random faults. By carrying out a study of this type andstudying the temporal combination of faults that generates the wrong results, it ispossible to identify weaknesses in the design, which can be targeted for improvement.Conclusion: In this paper we have presented a general fault model for examiningmultiple faults in the time domain. The distribution of faults around a predefined timecan be adjusted through a single parameter. Fault injection campaigns on differentprocessor architectures implemented using this approach demonstrate the processor’sbehaviour under multiple fault injection and how the timing intervals between faultscan affect the behaviour of the system under study. This model can be used for anynumber of faults for the validation of digital systems where timing of faults plays animportant role.Authors’ affiliation:E. Touloupis, J. A. Flint and V. A. Chouliaras, Department of Electronic Engineering,Loughborough University, Ashby Road, Loughborough, Leicestershire, LE11 3TU,United KingdomD. D. Ward, MIRA Ltd, Watling Street, Nuneaton, Warwickshire, CV10 0TU, UnitedKingdomAcknowledgementThe authors wish to thank MIRA Ltd for funding this research.Page 7 of 13Touloupis, Flint, Chouliaras and Ward: Modelling Multiple Faults in Fault-Tolerant Processor ArchitecturesReferences[1] J. F. Ziegler, H. W. Curtis, H. P. Muhlfeld, C. J. Montrose, B. Chin, M. Nicewicz,C. A. Russell, W. Y. Wang, L. B. Freeman, P. Hosier, L. E. LaFave, J. L. Walsh, J.M. Orro, G. J. Unger, J. M. Ross, T. J. O'Gorman, B. Messina, T. D. Sullivan, A. J.Sykes, H. Yourke, T. A. Enger, V. Tolat, T. S. Scott, A. H. Taber, R. J. Sussman, W.A. Klein and C. W. Wahaus, “IBM experiments in soft fails in computer electronics,”IBM Journal of Research and Development, vol. 40, no. 1, pp. 3–18, January 1996.[2] C. Constantinescu, “Trends and challenges in VLSI circuit reliability,” IEEEMicro, vol. 23, no. 4, pp. 14–19, July – August 2003.[3] E. Dupont, M. Nicolaidis and P. Rohr, “Embedded robustness IPs for transient-error-free ICs,” IEEE Design & Test of Computers, vol. 40, no. 3, pp. 56–70, May2002.[4] F. Irom and F. F. Farmanesh, “Frequency dependence of single-event upset inadvanced commercial PowerPC microprocessors,” IEEE Trans. on Nuclear Science,vol. 51, no. 6, pp. 3505–3509, December 2004.[5] M. Rebaudengo, M. Sonza Redonda and M. Violante, “Accurate analysis of singleevent upsets in a pipelined microprocessor,” Journal of Electronic Testing: Theoryand Applications, vol. 19, no. 5, pp. 577–584, October 2003.[6] R. Velazco, S. Rezgui and R. Ecoffet, “Predicting error rate for microprocessor-based digital architectures through C.E.U. (code emulating upsets) injection,” IEEETrans. on Nuclear Science, vol. 47, no. 6, pp. 2405-2411, December 2000.[7] E. Jean, J. Arlat, M. Rimén, J. Ohlsson and J. Karlsson, “Fault injection intoVHDL models: The MEFISTO tool,” in Proc. of the 24th Annual InternationalSymposium on Fault-Tolerant Computing, pp. 66-75, 1994.Page 8 of 13 Touloupis, Flint, Chouliaras and Ward: Modelling Multiple Faults in Fault-Tolerant Processor Architectures[8] E. Touloupis, J. A. Flint, V. A. Chouliaras and D. D. Ward, “A fault-tolerantprocessor core architecture for safety-critical automotive applications,” Presented atthe SAE 2005 World Congress & Exhibition.Page 9 of 13Touloupis, Flint, Chouliaras and Ward: Modelling Multiple Faults in Fault-Tolerant Processor ArchitecturesFigure CaptionsFigure 1: Example of cumulative normal distribution functions for =50.Figure 2: Wrong results generated vs. level of fault distribution for the simpleprocessor.Figure 3: Wrong results generated vs. level of fault distribution for the fault-tolerantprocessor.Table CaptionsTable 1: Values of in fault-injection experiments.Figure 1Concurrent The two faults are concurrent= 0.83 99% of the two faults occur within 5 clock cycles= 10 99% of the two faults occur within 60 clock cycles= 510 99% of the two faults occur within 3056 clock cyclesUniform The time of the two faults is chosen by using a uniform distribution。