Dimitris Agiakatsikas

Reconfiguration Control Networks for TMR Systems with Module-Based Recovery

Field-Programmable Gate Arrays (FPGAs) provide ideal platforms for meeting the computational requirements of future space-based processing systems. However, FPGAs are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for dynamically reconfiguring corrupted modules of Triple Modular Redundant (TMR) components are well known. However, most of these techniques utilize resources that are themselves susceptible to SEUs to transfer reconfiguration requests from the TMR voters to a central reconfiguration controller. This paper evaluates the impact of these Reconfiguration Control Networks (RCNs) on the systems reliability and performance. We provide an overview of RCNs reported in the literature and compare them in terms of dependability, scalability and performance. We implemented our designs on a Xilinx Artix-7 FPGA to assess the resulting resource utilization and performance as well as to evaluate their soft error vulnerability using analytical techniques. We show that of the RCN topologies studied, an ICAP-based approach is the most reliable despite having the highest network latency. We also conclude that a module-based recovery approach is less reliable than scrubbing unless the RCN is triplicated and repaired when it suffers configuration memory errors.

FMER: A hybrid configuration memory error recovery scheme for highly reliable FPGA SoCs

High-reliability SRAM-based Field Programmable Gate Array (FPGA) designs that are deployed in space are commonly triplicated to mask Single Event Upsets (SEUs) and employ either scrubbing or modular reconfiguration to recover from radiation-induced configuration memory errors. Scrubbing benefits from vendor support and clears errors anywhere in the design but suffers from longer recovery times and higher energy use. Module-based error recovery is more energy efficient and responsive but repairs only corrupted TMR modules, leaving the supporting parts of the design such as pins or routing that are not included in the modules unrecovered. This paper proposes and assesses a hybrid technique we refer to as Frame- and Module-based Error Recovery (FMER) that uses modular reconfiguration to repair faulty TMR modules and otherwise scrubs the supporting parts of the design. We derive and compare the reliability, availability and power consumption of TMR-based System on Chip (SoC) designs that incorporate FMER, modular reconfiguration alone, blind scrubbing and no recovery. Our results reveal that FMER has the highest reliability and availability of the studied techniques in high radiation environments or when a missions energy budget is limited.

Fine-grained module-based error recovery in FPGA-based TMR systems

Space processing applications deployed on SRAM-based Field Programmable Gate Arrays (FPGAs) are vulnerable to radiation-induced Single Event Upsets (SEUs). Compared with the well-known SEU mitigation solution — Triple Modular Redundancy (TMR) with configuration memory scrubbing — TMR with module-based error recovery (MER) is notably more energy efficient and responsive in repairing soft-errors in the system. Unfortunately, TMR-MER systems also need to resort to scrubbing when errors occur in sub-components, such as nets, which are not recovered by MER. This paper addresses this problem by proposing a fine-grained module-based error recovery technique that without additional system hardware can localize and correct errors that classic MER fails to do. We evaluate our proposal via a fault-injection campaign on a Xilinx Artix-7 application circuit and compare the reliability, the error correction latency and the energy cost of repairing errors, of our proposal with those of a conventional MER approach and with periodic and on-demand blind scrubbing. We find the reliability of our proposal to be the highest and the energy expenditure to be the lowest amongst those methods considered.

TLegUp: A TMR Code Generation Tool for SRAM-Based FPGA Applications Using HLS

We present TLegUp, an extension of LegUp, that automatically generates Triple Modular Redundant designs for FPGAs from C programs. TLegUp is expected to improve the productivity of application designers for space, to allow designers to experiment with alternative application partitioning, voter insertion and fault-tolerant aware scheduling and binding algorithms, and to support the automatic insertion of the infrastructure needed to run a fault-tolerant system. In this paper, we examine TLegUps capacity to make use of both combinational and sequential voters by triplicating a design before scheduling and binding occur. In contrast, traditional RTL-based tools are constrained to use only combinational voters so as to preserve the scheduling and binding of the design, critical path lengths are consequently increased. We compare the use of sequential and combinational voters for a range of benchmarks implemented on a Xilinx Virtex-6 FPGA in terms of: (i) maximum operating frequency, (ii) latency, (iii) execution time, and (iv) soft-error sensitivity. Compared to the use of combinational voters, the use of sequential voters reduces the application execution time on the CHStone benchmark suite by 4% on average.

Dynamic scheduling of voter checks in FPGA-based TMR systems

SRAM-based Field-Programmable Gate Arrays (FPGAs) are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for partially reconfiguring corrupted modules of Triple Modular Redundant (TMR) FPGA-based designs have been described in the literature. Most of these techniques require some form of network-on-chip for aggregating voter error messages from the systems TMR components to a central reconfiguration controller in order to trigger the partial reconfiguration of modules when they become faulty. The frequency at which TMR components fail in the system depends on their soft-error vulnerability. However, most error recovery techniques adopt a static voter error checking schedule, which leads to delays in checking TMR components with high failure probability. In this paper we propose a Voter Scheduling Engine (VSE) for dynamically prioritizing and managing TMR voter checks so as to minimize the error detection time in the system and to thereby maximize the systems reliability. Software and hardware implementations of the VSE are proposed. Moreover, we have implemented the classic static voter checking schedule and the VSE on a real TMR system and evaluated the reliabilities of both approaches for varying radiation environments. Results demonstrate that the likelihood of system failure can be decreased by up to 50% when the VSE, rather than static voter checking, is incorporated into the TMR system.

A Programmable Configuration Controller for fault-tolerant applications

FPGAs are promising candidates for computational tasks in space applications. However, they are susceptible to radiation-induced errors, the most common failure being due to the corruption of their configuration memory. Module-based partial reconfiguration and frame-based scrubbing are the two most commonly used techniques for detecting and recovering from configuration memory errors. Both methods require user-designed reconfiguration controllers (RC) to read and write FPGA configuration memory data. This paper proposes a Programmable Configuration Controller (PCC) specifically designed for fault-tolerant applications. PCC has a soft Application Specific Instruction Set Processor (ASIP) architecture. The PCC is software programmable using the C language, which allows it to be used in a wide variety of fault-tolerant applications with minimal design and/or hardware overhead. PCC also has instruction extensions to accelerate commonly-used reconfiguration operations such as reading and writing configuration data. Through 5 case studies, we demonstrate that the use of an ASIP architecture for reconfiguration control in applications prone to radiation-induced corruption strikes the right balance between speed, resource utilization and flexibility.

Reconfiguration Control Networks for FPGA-based TMR systems with modular error recovery

Abstract Field-Programmable Gate Arrays (FPGAs) provide ideal platforms for meeting the computational requirements of future space-based processing systems. However, FPGAs are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for dynamically reconfiguring corrupted modules of Triple Modular Redundant(TMR) components are well known. However, most of these techniques utilize resources that are themselves susceptible to SEUs to transfer reconfiguration requests from the TMR voters to a central reconfiguration controller. This paper evaluates the impact of these Reconfiguration Control Networks (RCNs) on the system’s reliability and performance. We provide an overview of RCNs reported in the literature and compare them in terms of dependability, scalability and performance. Most importantly, we compare the performance of soft networks with that of a hard network that utilizes the Internal Configuration Access Port(ICAP) available in advanced Xilinx devices to periodically read the TMR voter states. We have implemented our designs on a Xilinx Artix-7 FPGA to assess the resulting resource utilization and performance as well as to evaluate their soft error vulnerability using analytical and fault injection techniques. Results show that, of the RCN topologies studied, the ICAP-based approach is the most reliable despite having the highest network latency. We also conclude that a module-based recovery approach is less reliable than scrubbing unless the RCN is implemented with redundancy and repaired when it suffers from configuration memory errors.

Fine-Grained Module-Based Error Recovery in FPGA-Based TMR Systems

Space processing applications deployed on SRAM-based Field Programmable Gate Arrays (FPGAs) are vulnerable to radiation-induced Single Event Upsets (SEUs). Compared with the well-known SEU mitigation solution — Triple Modular Redundancy (TMR) with configuration memory scrubbing — TMR with module-based error recovery (MER) is notably more energy efficient and responsive in repairing soft-errors in the system. Unfortunately, TMR-MER systems also need to resort to scrubbing when errors occur in sub-components, such as nets, which are not recovered by MER. This paper addresses this problem by proposing a fine-grained module-based error recovery technique that without additional system hardware can localize and correct errors that classic MER fails to do. We evaluate our proposal via a fault-injection campaign on a Xilinx Artix-7 application circuit and compare the reliability, the error correction latency and the energy cost of repairing errors, of our proposal with those of a conventional MER approach and with periodic and on-demand blind scrubbing. We find the reliability of our proposal to be the highest and the energy expenditure to be the lowest amongst those methods considered.

Reliable SEU monitoring and recovery using a programmable configuration controller

FPGAs are promising candidates for computational tasks in space. However, they are susceptible to radiation-induced errors in their configuration memory. The recovery of configuration errors, either by device scrubbing or by module-based recovery, involves a series of reads and writes to the FPGAs configuration port, and is efficiently performed on-chip by a fast, flexible and reliable reconfiguration controller. In this work, we consider the reliability improvement of the recently proposed Programmable Configuration Controller (PCC), a soft reconfiguration controller that has been shown to be both fast and flexible, but whose reliability, particularly in the face of radiation-induced configuration errors, has not until now been studied. To ensure that the PCC itself is reliable, we propose the use of traditional Triple Modular Redundant (TMR) combined with a novel software-based interrupt-driven fault recovery process that leverages hardware-accelerated configuration access. We report on our design space exploration to balance the utilization, error recovery performance, and reliability of the PCC. In extremely harsh radiation environments, the Mean Time to Failure of the PCC is as high as 25 years, compared with 3.5 hours for its non-protected counterpart, and that it takes as little as 27 ms to recover from a configuration memory error affecting the PCC.