Matthias Pflanz

Evaluating Coverage of Error Detection Logic for Soft Errors using Formal Methods

In this paper we describe a methodology to measure exactly the quality of fault-tolerant designs by combining fault-injection in high level design (HLD) descriptions with a formal verification approach. We utilize BDD based symbolic simulation to determine the coverage of online error-detection and -correction logic. We describe an easily portable approach, which can be applied to a wide variety of multi-GHz industrial designs

Online check and recovery techniques for dependable embedded processors

Efficient online check and fast recovery techniques for embedded systems aim to detect single or multiple errors within the same clock cycle in which they occur. It is argued that such techniques can enable fast error correction; detection of illegal states, micro- rollback for transient and permanent faults; and prioritized, controlled recovery.

On-Line Techniques for Error Detection and Correction in Processor Registers with Cross-Parity Check

This paper proposes the Cross-Parity check as a method for an on-line detection of multiple bit-errors in registers or register files of microprocessors. Transient or ‘soft’ errors caused by radiation as single event upsets (SEUs) or electromagnetic coupling are in the focus of this work. Especially for register files or register groups, an easy implementable error correction method is proposed, which can be implemented by software routines or additional hardware. The method is based on the logical interpretation of Cross-Parity vectors.

Generating reliable embedded processors

This approach to designing fault-tolerant embedded systems-using PLDs to duplicate application-specific hardware-significantly reduces the costs of classical fault-tolerance techniques.

A test processor concept for systems-on-a-chip

This paper introduces a new concept for the self test of systems on a chip (SoCs) with embedded processors. We propose hardware- and software-based test strategy. A minimum sized test processor was designed in order to perform on-chip test functions. Its architecture contains special adopted registers to realize LFSR or MISR functions for pattern de-compaction and pattern filtering. High-performance interfaces allow parallel and serial pattern in and output, and a fast test vector comparison. The architecture is scalable and is based on a standard RISC architecture in order to facilitate the use of standard compilers.

On-line error detection and fast recover techniques for dependable embedded processors

This thesis summarizes investigations and experiments on on-line observation and concurrent checking of processors. The objective was to detect single and/or multiple errors within one clock cycle. First, refined techniques for data-path observation were investigated. Based on an approach for an observation of an ALU by Berger code prediction (BCP), the principle was extended to observe complete data-path structures to detect unidirectional errors. The applicability of BCP to more complex data-paths with floating-point units was shown with the help of single and double-precision addition/subtraction floatingpoint-units. Therefore, prediction formulas were developed, which consider the operation in multi-stage units. The cross-parity observation technique was developed especially for the on-line observation of large register-files or control-registers. By checking row, column, and diagonal-parities, single and multiple register errors can be detected. Cross-parity vectors have a potential diagnosis capability. Due to the critical character of the processor control-logic, different techniques were developed and investigated to detect single or multiple control-signal errors within the clock-cycle of occurrence. As a simple alternative for a fault-secure controller, a duplicated control-logic was implemented. The identification of control-word differences can be used for error-weighting a subsequent control and, finally, for further recovery strategies. As a practical solution for small processors, a triplicated structure was investigated. With it, a fault-tolerant generation of control-signals to compensate transient errors until the first permanent error was possible. An application-driven reduction (ADR) of control-logic was proposed to decrease the overhead, especially for embedded systems with standard CISCs and a limited number of applications. To detect control-signal errors, a new approach was taken by the processor state machine. To solve the problem with the complexity of state-spaces of common microprocessors, active control-signals were considered as a definitive representation of a current processor activity - the processor state. Access to all control-signals being assured and transitions being neglected, a combinatorial observation could be realized. Control-signals were encoded to a state-code, which represents the current (legal) state of the processor. With an access to control-signal conditions (instruction, time, flag-variables), a controller-independent generation (prediction) of the same code was realized. A comparison of both identifies an illegal state-code. To manage more complex state machines, an application-driven reduced state-encoder or a state-space partitioning was proposed. For pipeline structures, a partitioned observation of states was implemented as an example. As a consequence of a successful error detection within the same clock cycle, fast recovery techniques of the processor state were investigated. Starting from the positive oriented assumption that an error has a transient character, a fast repetition (rollback) of erroneous cycle(s) can deliver correct results. Time-intervals of many thousands of cycles in classical roll-back techniques can not satisfy demands for safety-critical applications. Therefore, a shorter time (rollback distance) for recovery was implemented by micro-rollback strategies. Recent approaches to micro-rollback can recover the corresponding structure in case of a transient error. But this technique fails in the case of permanent errors. Therefore, a double-processor architecture was investigated. The master-trailer structure turns out to be a suitable solution for small processors. The trailer is delayed for one cycle. With this plus on-line checked master, a fast repair (2 cycles) of transient errors can be executed by a backup of all master-registers by their counterparts in the trailer. The advantage is the function-takeover (3 cycles) in the case of a permanent-error occurrence. For pipeline processors, a further-developed rollback technique considers on one hand dynamical execution lengths for different stages, and on the other hand different error weightings. Therefore, a priority control was proposed to manage different rollbackactions (necessary rollback distances) for the recovery of the pipeline. Possible are one-cycle micro-rollback, a pipeline stage-rollback, and a macro-rollback by refilling the whole pipeline. In the worst case (lost all stored return points), a program reexecution is realized. Proposed on-line error detection and fast recovery techniques should be a supplement to other methods. In combination with other on-line observation principles, and/or with a combined hardware-software (self-)test, these techniques are used to fulfill a complete self-check scheme for an embedded processor. Strategies for a static or dynamic (micro-) rollback are a useful solution for processor errors due to transient faults of non-recurring characteristics. Then an executed program can be continued as quickly as the implemented structure allows. The overall approach for efficient on-line checking and fast recovery techniques enhances processor availability and improves the dependability of an embedded system at very reasonable additional costs.

A register-transfer-level fault simulator for permanent and transient faults in embedded processors

HEARTLESS (Hierarchical Register-Transfer-Level Fault-Simulator for Permanent & Transient Faults) was developed to simulate the behavior of complex sequential designs like processor cores in case of transient and permanent faults. HEARTLESS can be enhanced by propagation over macros described in a C++ function. Available is a C-interface for access to internal signals during the simulation.

Verifying full-custom multipliers by Boolean equivalence checking and an arithmetic bit level proof

In this paper we describe a practical methodology to formally verify highly optimized, industrial multipliers. We define a multiplier description language which abstracts from low-level optimizations and which can model a wide range of common implementations at a structural and arithmetic level. The correctness of the created model is established by bit level transformations matching the model against a standard multiplication specification. The model is also translated into a gate netlist to be compared with the full-custom implementation of the multiplier by standard equivalence checking. The advantage of this approach is that we use a high level language to provide the correlation between structure and bit level arithmetic. This compares favorably with other approaches that have to spend considerable effort on extracting this information from highly optimized implementations. Our approach is easily portable and proved applicable to a wide variety of state-of-the-art industrial designs.

On-line detection and compensation of transient errors in processor pipeline-structures

Based on strategies for on-line error detection in data and control path structures in simple microprocessors, this approach proposes techniques for the control- and component-error detection in high-performance processors. Detected errors are classified on-line with respect to their impact on the control and data flow. A compensation of detected errors is performed by micro rollback with different rollback distances according to pre-defined priority classes of error handling.

A new method for on-line state machine observation for embedded microprocessors

In this paper we propose an efficient method to observe a processor state machine and to detect illegal states within one clock-cycle. The strategy is based on a comparison of an encoded vector VCP1, representing the real state, and a predicted vector YCP2, representing the expected state. The practical applicability of the concept was evaluated on several experimental processor designs. We implemented check-units for 8-, I6- and 32-bit microprocessors and DSPs with sets of 32 up to 214 instructions and a deterministic control-flow. The applicability to processors with a higher complexity is demonstrated by a check unit for state machine on-line observation of a pipelined microprocessor with superscalar data-path and hardware-implemented hazard control. To minimize the overhead we investigated different strategies to modify check units. A reduction of hardware overhead can be reached by application specific reduction of processor state machines. For more complex processors we propose a reduction of the overhead by partitioning of the state space.