Matthias Függer

Fault-Tolerant Distributed Clock Generation in VLSI Systems-on-Chip

This paper introduces a simple fault-tolerant tick generation algorithm based on Srikanth & Touegs consistent broadcast primitive that can be directly implemented in VLSI using asynchronous digital logic. The need for adaption originates from two peculiarities of hardware implementations: (i) Fine-grained parallel asynchronous computations, which undermines the concept of atomic steps common to all distributed computing models, and (ii) very limited resources, which makes even apparently simple operations prohibitively costly. We provide the cornerstones of the proof that the resulting algorithm is correct, and give analytic expressions for performance metrics like worst case precision and accuracy. Moreover, we outline the major building blocks of our synthesizable VHDL implementation and provide some measurement results from our FPGA prototype. Our results hence provide the required basis for investigating robust alternatives to synchronous clocking in VLSI systems-on-chip and similar applications

Reconciling fault-tolerant distributed computing and systems-on-chip

Classic distributed computing abstractions do not match well the reality of digital logic gates, which are the elementary building blocks of Systems-on-Chip (SoCs) and other Very Large Scale Integrated (VLSI) circuits: Massively concurrent, continuous computations undermine the concept of sequential processes executing sequences of atomic zero-time computing steps, and very limited computational resources at gate-level make even simple operations prohibitively costly. In this paper, we introduce a modeling and analysis framework based on continuous computations and zero-bit message channels, and employ this framework for the correctness & performance analysis of a distributed fault-tolerant clocking approach for Systems-on-Chip (SoCs). Starting out from a “classic” distributed Byzantine fault-tolerant tick generation algorithm, we show how to adapt it for direct implementation in clockless digital logic, and rigorously prove its correctness and derive analytic expressions for worst case performance metrics like synchronization precision and clock frequency. Rather than on absolute delay values, both the algorithm’s correctness and the achievable synchronization precision depend solely on the ratio of certain path delays. Since these ratios can be mapped directly to placement & routing constraints, there is typically no need for changing the algorithm when migrating to a faster implementation technology and/or when using a slightly different layout in an SoC.

On the Threat of Metastability in an Asynchronous Fault-Tolerant Clock Generation Scheme

Due to their handshake-based flow control, asynchronous circuits generally do not suffer from metastability issues as much as synchronous circuits do. We will show, however, that fault effects like single-event transients can force (sequential) asynchronous building blocks such as Muller C-Elements into a metastable state. At the example of a fault-tolerant clock generation scheme, we will illustrate that metastability could overcome conventional error containment boundaries, and that, ultimately, a single metastable upset could cause even a multiple Byzantine fault-tolerant system to fail. In order to quantify this threat, we performed analytic modeling and simulation of the elastic pipelines, which are at the heart of our physical implementation of the fault-tolerant clocks. Our analysis results reveal that only transient pulses of some very specific width can trigger metastable behavior. So even without consideration of other masking effects the probability of a metastable upset to propagate through a pipeline is fairly small. Still, however, a thorough metastability analysis is mandatory for circuits employed in high-dependability applications.

Approximate Consensus in Highly Dynamic Networks: The Role of Averaging Algorithms

We investigate the approximate consensus problem in highly dynamic networks in which topology may change continually and unpredictably. We prove that in both synchronous and partially synchronous networks, approximate consensus is solvable if and only if the communication graph in each round has a rooted spanning tree. Interestingly, the class of averaging algorithms, which have the benefit of being memoryless and requiring no process identifiers, entirely captures the solvability issue of approximate consensus in that the problem is solvable if and only if it can be solved using any averaging algorithm. We develop a proof strategy which for each positive result consists in a reduction to the nonsplit networks. It dramatically improves the best known upper bound on the decision times of averaging algorithms and yields a quadratic time non-averaging algorithm for approximate consensus in non-anonymous networks. We also prove that a general upper bound on the decision times of averaging algorithms have to be exponential, shedding light on the price of anonymity. Finally we apply our results to networked systems with a fixed topology and benign fault models to show that with n processes, up to

Runtime verification of embedded real-time systems

2n-3

Full reversal routing as a linear dynamical system

of link faults per round can be tolerated for approximate consensus, increasing by a factor 2 the bound of Santoro and Widmayer for exact consensus.

Transience bounds for distributed algorithms

Today’s hardware technology presents a new challenge in designing robust systems. Deep submicron VLSI technology introduces transient and permanent faults that were never considered in low-level system designs in the past. Still, robustness of that part of the system is crucial and needs to be guaranteed for any successful product. Distributed systems, on the other hand, have been dealing with similar issues for decades. However, neither the basic abstractions nor the complexity of contemporary fault-tolerant distributed algorithms match the peculiarities of hardware implementations. This article is intended to be part of an attempt striving to bridge over this gap between theory and practice for the clock synchronization problem. Solving this task sufficiently well will allow to build an ultra-robust high-precision clocking system for hardware designs like systems-on-chips in critical applications. As our first building block, we describe and prove correct a novel distributed, Byzantine fault-tolerant, probabilistically self-stabilizing pulse synchronization protocol, called FATAL, that can be implemented using standard asynchronous digital logic: Correct FATAL nodes are guaranteed to generate pulses (i.e., unnumbered clock ticks) in a synchronized way, despite a certain fraction of nodes being faulty. FATAL uses randomization only during stabilization and, despite the strict limitations introduced by hardware designs, offers optimal resilience and smaller complexity than all existing protocols. Finally, we show how to leverage FATAL to efficiently generate synchronized, self-stabilizing, high-frequency clocks.

HEX: scaling honeycombs is easier than scaling clock trees

We present a runtime verification framework that allows on-line monitoring of past-time Metric Temporal Logic (ptMTL) specifications in a discrete time setting. We design observer algorithms for the time-bounded modalities of ptMTL, which take advantage of the highly parallel nature of hardware designs. The algorithms can be translated into efficient hardware blocks, which are designed for reconfigurability, thus, facilitate applications of the framework in both a prototyping and a post-deployment phase of embedded real-time systems. We provide formal correctness proofs for all presented observer algorithms and analyze their time and space complexity. For example, for the most general operator considered, the time-bounded Since operator, we obtain a time complexity that is doubly logarithmic both in the point in time the operator is executed and the operator’s time bounds. This result is promising with respect to a self-contained, non-interfering monitoring approach that evaluates real-time specifications in parallel to the system-under-test. We implement our framework on a Field Programmable Gate Array platform and use extensive simulation and logic synthesis runs to assess the benefits of the approach in terms of resource usage and operating frequency.