Lingkan Gong

Towards bounded error recovery time in FPGA-based TMR circuits using dynamic partial reconfiguration

Field-Programmable Gate Array (FPGA) systems are increasingly susceptible to radiation-induced Single Event Upsets (SEUs). Application circuits are most commonly protected from SEUs using Triple Modular Redundancy (TMR) and scrubbing to eliminate configuration memory errors. This paper focuses on implementing circuits that recover from SEUs within a specified maximum recovery period, a practical requirement not previously addressed. We develop a recovery time model, describe a scalable reconfiguration control network, and investigate the performance of a representative TMR system implemented using our approach. The results demonstrate that modular reconfiguration eliminate configuration errors more responsively and using less energy than scrubbing. However, these benefits are achieved at the cost of additional area, minor speed penalties, and greater design complexity.

Modeling Dynamically Reconfigurable Systems for Simulation-Based Functional Verification

Dynamically Reconfigurable Systems (DRS), which allow logic to be partially reconfigured during run-time, are promising candidates for embedded and high-performance systems. However, their architectural flexibility introduces a new dimension to the functional verification problem. Dynamic reconfiguration requires the designer to consider new issues such as synchronizing, isolating and initializing reconfigurable modules. Furthermore, by exposing the FPGA architecture to the application specification, it has made functional verification dependent on the physical implementation. This paper studies simulation as the most fundamental approach to the functional verification of DRS. The main contribution of this paper is in proposing a verification-driven top-down modeling methodology that guides designers in refining their reconfigurable system design from the behavioral level to the register transfer level. We assess the feasibility of our methodology via a case study involving the design of a generic partial reconfiguration platform.

Reconfiguration Control Networks for TMR Systems with Module-Based Recovery

Field-Programmable Gate Arrays (FPGAs) provide ideal platforms for meeting the computational requirements of future space-based processing systems. However, FPGAs are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for dynamically reconfiguring corrupted modules of Triple Modular Redundant (TMR) components are well known. However, most of these techniques utilize resources that are themselves susceptible to SEUs to transfer reconfiguration requests from the TMR voters to a central reconfiguration controller. This paper evaluates the impact of these Reconfiguration Control Networks (RCNs) on the systems reliability and performance. We provide an overview of RCNs reported in the literature and compare them in terms of dependability, scalability and performance. We implemented our designs on a Xilinx Artix-7 FPGA to assess the resulting resource utilization and performance as well as to evaluate their soft error vulnerability using analytical techniques. We show that of the RCN topologies studied, an ICAP-based approach is the most reliable despite having the highest network latency. We also conclude that a module-based recovery approach is less reliable than scrubbing unless the RCN is triplicated and repaired when it suffers configuration memory errors.

ReSim: A reusable library for RTL simulation of dynamic partial reconfiguration

Dynamic Partial Reconfiguration (DPR) enables software-like flexibility in hardware designs by allowing some of the logic on a Field Programmable Gate Array (FPGA) to be reconfigured while the rest continues to operate. However, such flexibility introduces challenges for verifying DPR design functionality because there is no straightforward way to simulate DPR at Register Transfer Level (RTL). This paper proposes the ReSim library to enable the RTL simulation of DPR. The library uses a simulation-only layer to hide the physically dependent details of DPR designs while providing sufficient accuracy for functional verification. The library is extensible and reusable. We assess the feasibility and demonstrate the value of our tool via two case studies of DPR designs.

Functionally verifying state saving and restoration in dynamically reconfigurable systems

Dynamically reconfigurable systems increase design density and flexibility by allowing hardware modules to be swapped at run time. Systems that employ checkpointing, periodic or phased execution, preemptive multitasking and resource defragmentation, may also need to be able to save and restore the state of a module that is being reconfigured. Existing tools verify the functionality of a system that is undergoing reconfiguration. These tools can also be employed if state is accessed using application logic. However, when state is accessed via the configuration port, functional verification is hindered because the FPGA fabric, which mediates the transfer of state between the application logic and the configuration port, is not being simulated. We describe how to efficiently simulate those aspects of the fabric that are used in accessing module state. To the best of our knowledge, this work is the first to allow cycle-accurate simulation of a system partially reconfiguring both its logic and state and a case study shows that our method is effective in detecting device independent design errors.

Improving F max of FPGA circuits employing DPR to recover from configuration memory upsets

Field-Programmable Gate Arrays (FPGAs) provide an ideal platform for meeting the performance, cost and flexibility requirements of on-board processing in spacebourne applications. However, given the reliance on SRAM-based configuration memory, off-the-shelf FPGAs are vulnerable to radiation-induced Single Event Upsets (SEUs). The detection and mitigation of the effects of SEUs is therefore of paramount importance. Moreover, in time critical applications, it is also desirable to detect and recover from errors rapidly. Techniques for partially reconfiguring a corrupted module of a Triple Modular Redundant (TMR) implementation have been described in the literature. In this paper we address the speed penalty incurred with such techniques and provide a generalized approach for alleviating it. The results indicate that the speed penalty can be greatly reduced enabling rapid recovery from SEUs in reconfigurable hardware.

Reconfiguration network design for SEU recovery in FPGAs

Field-Programmable Gate Array (FPGA) systems provide an ideal platform for meeting the computation requirements for future on-board processing. FPGAs, however, are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for partially reconfiguring a corrupted module of a Triple Modular Redundant (TMR) implementation have been described in the literature. In this paper we detail the design of a reconfiguration network that provides the infrastructure to enable SEU recovery in FPGAs. The reconfiguration networks structure and operation is detailed along with performance analysis using results from simulated and implemented designs. The results indicate that total error recovery time from SEUs is dominated by the reconfiguration delay, and that the communication delay of the reconfiguration network is relatively small.

Functional Verification of Dynamically Reconfigurable FPGA-based Systems

This book analyzes the challenges in verifying Dynamically Reconfigurable Systems (DRS) with respect to the user design and the physical implementation of such systems. The authors describe the use of a simulation-only layer to emulate the behavior of target FPGAs and accurately model the characteristic features of reconfiguration. Readers are enabled with this simulation-only layer to maintain verification productivity by abstracting away the physical details of the FPGA fabric. Two implementations of the simulation-only layer are included: Extended Re Channel is a System C library that can be used to check DRS designs at a high level; ReSim is a library to support RTL simulation of a DRS reconfiguring both its logic and state. Through a number of case studies, the authors demonstrate how their approach integrates seamlessly with existing, mainstream DRS design flows and with well-established verification methodologies such as top-down modeling and coverage-driven verification.

A Programmable Configuration Controller for fault-tolerant applications

FPGAs are promising candidates for computational tasks in space applications. However, they are susceptible to radiation-induced errors, the most common failure being due to the corruption of their configuration memory. Module-based partial reconfiguration and frame-based scrubbing are the two most commonly used techniques for detecting and recovering from configuration memory errors. Both methods require user-designed reconfiguration controllers (RC) to read and write FPGA configuration memory data. This paper proposes a Programmable Configuration Controller (PCC) specifically designed for fault-tolerant applications. PCC has a soft Application Specific Instruction Set Processor (ASIP) architecture. The PCC is software programmable using the C language, which allows it to be used in a wide variety of fault-tolerant applications with minimal design and/or hardware overhead. PCC also has instruction extensions to accelerate commonly-used reconfiguration operations such as reading and writing configuration data. Through 5 case studies, we demonstrate that the use of an ASIP architecture for reconfiguration control in applications prone to radiation-induced corruption strikes the right balance between speed, resource utilization and flexibility.

Reconfiguration Control Networks for FPGA-based TMR systems with modular error recovery

Abstract Field-Programmable Gate Arrays (FPGAs) provide ideal platforms for meeting the computational requirements of future space-based processing systems. However, FPGAs are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for dynamically reconfiguring corrupted modules of Triple Modular Redundant(TMR) components are well known. However, most of these techniques utilize resources that are themselves susceptible to SEUs to transfer reconfiguration requests from the TMR voters to a central reconfiguration controller. This paper evaluates the impact of these Reconfiguration Control Networks (RCNs) on the system’s reliability and performance. We provide an overview of RCNs reported in the literature and compare them in terms of dependability, scalability and performance. Most importantly, we compare the performance of soft networks with that of a hard network that utilizes the Internal Configuration Access Port(ICAP) available in advanced Xilinx devices to periodically read the TMR voter states. We have implemented our designs on a Xilinx Artix-7 FPGA to assess the resulting resource utilization and performance as well as to evaluate their soft error vulnerability using analytical and fault injection techniques. Results show that, of the RCN topologies studied, the ICAP-based approach is the most reliable despite having the highest network latency. We also conclude that a module-based recovery approach is less reliable than scrubbing unless the RCN is implemented with redundancy and repaired when it suffers from configuration memory errors.