Alberto Bosio

MET Multiple Event Transient

First and foremost, I would like to thank my Lord, the Almighty, for being close and responsive throughout the course of my thesis. Only due to His countless gifts of sense, intellect, patience, health, family and many more, I could complete this task.

I would like to express my deepest gratitude to my thesis director, Prof. Arnaud Virazel. With his encouraging and supporting attitude, meeting him has always been a work-stress reliever for me. His profound guidance and invaluable advises helped keeping my research well directed and my progress on schedule

Example transient error propagation in

Introduction

Technology scaling allows realization of more and more complex system on a single chip. This high level of integration leads to increased current and power densities and causes early device and interconnect wear-out. It leads to shifts in electrical characteristics of circuit elements or renders them permanently damaged. Moreover, a high integration density makes these complex systems difficult to test and some test-escaped manufacturing defects are encountered as errors only during infield operation. In addition, there are failures not caused by wear-out nor escaped manufacturing defects, but due to increased susceptibility of transistors to high energy particles from atmosphere or from within the packaging. Devices operating at reduced supply voltages are more prone to charge related phenomenon caused by high-energy particle strikes referred to as Single Event Effect (SEE). They experience particle-induced voltage transients called Single Event Transient (SET) or particle-induced bit-flips in memory elements also known as Single Event Upset (SEU).

High-performance microprocessors being at the forefront of technology are becoming increasingly vulnerable to hard and soft errors due to their growing complexity, high operating frequencies and fragility of future Very Large Scale Integration (VLSI) technology nodes. SEE in CL are playing important role in increasing Soft Error Rate (SER), which was historically considered as a cause of particle strikes in memory elements. In addition, it is estimated that the susceptibility of CL circuits to SET nearly doubles as the technology scales from 45nm to 16nm. Hence, it is inevitable for the industry to prevent reliability from becoming a bottleneck for the development of high-performance and low-power microprocessors.

Various solutions using fault tolerant techniques for robustness improvement can be found in the literature, but a very few can address tolerance to both transient and permanent faults. These techniques generally rely on slow recovery mechanisms, thus are not suitable for highly interactive applications. For example, the method presented in [START_REF] Mehrara | Low-Cost Protection for SER Upsets and Silicon Defects[END_REF] has little area overhead but runs Built-In Self-Test (BIST) during periodic time intervals to detect the presence of permanent faults and uses deep rollbacks that have a severe impact on performance. Fault-tolerant architectures like Razor [START_REF] Ernst | Razor: a low-power pipeline based on circuit-level timing speculation[END_REF], CPipe [START_REF] Subramanian | Conjoined Pipeline: Enhancing Hardware Reliability and Performance through Organized Pipeline Redundancy[END_REF] and STEM [5] incorporate power saving and performance enhancement mechanisms like Dynamic Frequency Scaling (DFS) and Dynamic Voltage Scaling (DVS) to operate circuits beyond their worst-case limits. These architectures generally target timing errors and are not effective to deal with permanent faults. For instance, Razor only deals with timing faults and CPipe duplicates CL blocks in the pipeline to detect and correct transient and timing errors and can also detect permanent faults, but it does not offer provision for their correction.

Besides fault tolerance capability, power consumption is also a rising concern in the industry. In fact, as fault-tolerance becomes necessary in mass products, limiting power consumption of these techniques is one of the key factors in digital design. The classical fault tolerance techniques like TMR can effectively handle transient and permanent fault but cannot respect the low-power consumption demands.

Pipelining is a key technique to increase throughput in modern microprocessors by improving the resource utilization. But the complexity of interactions between pipeline stages make error detection and correction a major hurdle in designing high-performance reliable processing cores. To the best of our knowledge, none of the fault tolerance techniques in the literature address the problem of error detection and confinement in non-linear pipelined circuits nor in pipelines with memory interfaces.

Selecting the ideal trade-off between reliability and cost associated with a fault tolerant architecture generally involves an extensive design space exploration. Employing state-of-the-art reliability estimation methods makes this exploration unscalable with the design complexity.

This thesis focuses on improving and developing new low-power fault tolerance techniques that combine the attractive features of different types of redundancies for robustness improvement of future technology-scalable digital circuits and systems against transient and permanent faults. It addresses the problem of error correction in CL parts of complex pipeline circuits. Furthermore, it develops a fault tolerance capability assessment framework and low-cost reliability estimation techniques for use in cost-reliability trade-off analysis. Overall, this thesis establishes that hybrid fault tolerant approaches provide a good foundation for building low-power reliable circuits and systems from future technologies, and our experimental results set a good starting point for further innovative research in this area.

The following of this manuscript is divided in five chapters:

• Chapter 1 details the context and motivation of our research. It starts with a discussion of the trends in semiconductor technology scaling and their impact on the reliability of nanometric technology circuits. Later in Chapter 1 we briefly discuss the different approaches to improve their reliability and finally we end the discussion by presenting the objectives of our work.

• Chapter 2 covers the state-of-the-art in the field of fault tolerant architectures and robustness assessment techniques. It discusses some basic concepts of error detection and correction, followed by an overview of a set of state-of-the-art fault tolerant architectures, with a special focus on a hybrid fault tolerant architecture. In Section 2.3 we first develop the context by discussing some state-of-the-art methods employed for robustness assessment of circuits and systems and then present a gate-level fault injection framework for fault tolerance capability assessment of digital circuits. The last part of Chapter 2 presents an experimental study that quantitatively compare different fault tolerant architectures on the basis of their area, power, performance and their fault tolerance capability.

• In Chapter 3 we present a hybrid fault tolerant architecture for reliability improvement of complex pipelined circuits. We start the discussion by highlighting some issues that hinder error detection and correction in complex pipelined circuits. Then we discuss the extension of hybrid fault tolerant architecture discussed in Chapter 2 to make it solve the aforementioned problems. An experimental case study of the application of the developed fault tolerant architecture and other state-of-the-art solutions on a pipelined microprocessor is presented and finally with a comparative analysis we conclude the chapter.

• Chapter 4 consist of a design space exploration study aimed to optimize the cost and fault tolerance capability of the proposed hybrid fault tolerant architecture. We experimentally assess three proposed design improvements and present the results. The chapter is concluded by identifying the best candidate.

• Chapter 5 develops the principles of a low-cost reliability estimation method and a selective hybrid fault tolerant architecture. It starts with an overview of previous work in the area of selective hardening. In the subsequent sections we propose an efficient susceptibility analysis method to identify the most vulnerable circuit nodes for hardening and use it yo selectively harden some benchmark circuits. Also based on the susceptibility analysis method we also present a low-cost reliability estimation technique for fault tolerant architectures that use logic replication. In Section 5.5 we present the experimental result that compare the merits of circuits hardened to different extents and validate the hypothesis of the low-cost reliability estimation methods.

Introduction

The Conclusion section summarizes the contributions of this work and presents some future perspectives.

Chapter 1 Context and Motivation 1.1 Semiconductor Technology Evolution

The steady growth of the global semiconductor industry over the past four decades has been driven by the demand for enhancing performance and functionality at reduced cost. This growth has been primarily facilitated by the continuous evaluation of semiconductor manufacturing technology. Transistors are scaled in each successive technology generation to increase their speed, improve packing density [2], decrease their power consumption and reduce cost. Thus, semiconductor technology scaling optimizes circuit performance and power consumption and allows realization of more and more complex system.

In November 1971, Intel introduced the world's first single-chip microprocessor, the Intel 4004. It had 2,300 transistors, ran at a clock speed of up to 740 KHz, and delivered 60,000 instructions per second while dissipating 0.5 watts. The following four decades witnessed exponential growth in compute power, a trend that has enabled applications as diverse as climate modeling, protein folding, electronic games and autonomous soft landings on extraterrestrial bodies. Today's microprocessor chips employ billions of transistors, include multiple processor cores on a single silicon die, run at clock speeds measured in gigahertz, and deliver more than 4 million times the performance of the original 4004 [START_REF] Danowitz | CPU DB: Recording Microprocessor History[END_REF]. The plots of Figures 1.1 and 1.2 show the trend of some technologic advancements in microprocessors in the past four decades. In 2015, Oracle presented the processor with over 10 billion transistors on the die, the most denser microprocessor in terms of transistor count. The major contributions to this massive advancement in semiconductor technology come from the field of lithography, advanced materials in manufacturing [START_REF] Nishi | Handbook of Semiconductor Manufacturing Technology[END_REF] and Electronic Design Automation (EDA) tools.

To reduce power dissipation of semiconductor devices, the supply voltage V dd is also scaled, because dynamic power is proportional to the square of V dd while leakage power is proportional [START_REF] Rupp | 40 Years of Microprocessor Trend Data[END_REF] to V dd . However, voltage scaling only started in the late 80s because the industry had settled on 5V supplies in the early 70s to be compatible with bipolar Transistor-Transistor Logic (TTL) [START_REF] Dale | Recollections on MOSFET Scaling[END_REF].

As power dissipation became unsustainable, this standard finally collapsed. V dd was scaled within few years, first to 3.3V then to 2.5V, etc. In 2011, supply voltage of high-performance ICs was at 0.9V and predicted to be reduced to 0.66V in 2021 [46].

In Figure 1.2 we can see that in year 2005, the frequency scaling process reached the power wall limit at about 3 GHz. In fact, higher switching activity of transistors leads to higher power consumption. Even though these small transistors do not consume much, hundred millions of them are switching at the same time in less than five hundred millimeter square IC. This results in significant power density that must be limited to avoid breakdown of physical materials.

The manufacturing cost has also played an important role in the evolution of semiconductor technology. Building smaller physical structures demand more sophisticated thus expensive equipment. But this initial investment makes little difference in per wafer cost in view of the sheer production size of new high performance, enhanced featured and low-powered integrated circuits, that always remain in high demand.

Reliability threats in nano-metric technologies

While offering many advantages technological trends into the nanometer regime have lead to a host of reliability issues. The sources that affect the reliability of modern circuits and systems are wide spread including manufacturing process variations, manufacturing defects, wear-out and interference. In the following sections we discuss how these reliability impairment sources evolve with technology scaling.

Variability

Variability of transistor characteristics due to variations in Process, Voltage and Temperature (PVT) have always been an issue in integrated circuit design [START_REF] Wirnshofer | Variation-Aware Adaptive Voltage Scaling for Digital CMOS Circuits[END_REF]. PVT variations prevent the circuit from functioning correctly even though each individual transistor behaves correctly [START_REF] Oda | Nanoscale Silicon Devices[END_REF]. As device scaling enters into the nano-metric regime the effect of PVT variations are becoming more and more pronounced. Manufacturing process variations are increased due to the lack of precise control on the fabrication processes at small-feature technologies. They causes deviation of transistor characteristics and the resulting wide distribution leads to lower parametric yield [START_REF] Bhunia | Process Variations and Process-Tolerant Design[END_REF]. Supply voltage scaling brings it close to or even below the transistor threshold voltage (V th ) to achieve significant gains in energy efficiency. Once the supply voltage is lower than V th the delay shows an exponential dependence on the supply voltage, and therefore the magnitude of supply voltage shifts can have a significant impact on circuit delay [START_REF] Calhoun | Sub-Threshold Design: The Challenges of Minimizing Circuit Energy[END_REF][START_REF] Sapatnekar | Overcoming Variations in Nanometer-Scale Technologies[END_REF]. Scaling also gives rise to chip power densities and inadequate heat sinking cause hot spots to appear. These fluctuations of ambient temperatures alter the timing characteristics of circuits [START_REF] Kumar | The University of Wisconsin Madison[END_REF].

A conventional approach to deal with the problem of variability is to introduce large voltage and frequency guard-bands which considerably impact the power consumption and performance, cannot respond to rapid environmental changes [START_REF] Das | RazorII: In Situ Error Detection and Correction for PVT and SER Tolerance[END_REF] and implies a sharp increase in chip cost. Effectively dealing with variability to maintain or improve the high performance and energy efficient systems while satisfying the historical standards for reliability is becoming increasingly challenging with the scaling of technology [START_REF] Samandari-Rad | Confronting the Variability Issues Affecting the Performance of Next-Generation SRAM Design to Optimize and Predict the Speed and Yield[END_REF].

Manufacturing Defects

Semiconductor manufacturing process may induce permanent defects in a chip during one or more of hundreds of process steps involving implantation, etching, deposition, polarization, cleaning and lithography [46] due to imperfections. The device miniaturization is making advanced technology devices nodes increasing vulnerable to these manufacturing irregularities. It is important that the testing be thorough as possible to uncover defective chips before they are shipped out [START_REF] Janak | Manufacturing Process Variations and Dependability -A Contrarian View[END_REF]. However, according to past microprocessor data, the die size remains relatively constant [START_REF] Huang | Interaction of scaling trends in processor architecture and cooling[END_REF], whereas the number of transistors per chip double every 2 to 3 years. This means that defect densities continues to increase. Moreover technology scaling and increasing complexity give rise to defects more subtle and difficult to detect [START_REF] Santoro | New methodologies for eliminating No Trouble Found, No Fault Found and other non repeatable failures in depot settings[END_REF][START_REF] Segura | CMOS Electronics: How It Works, How It Fails[END_REF]. All these factors when combined with aggressive time-to-market objectives cause test escapes and raise reliability concerns.

Wear-out

As we have seen in Figure 1.1, the area scaling has had an exponential rate but the supply voltage (V dd ) scaling has been quite slow. The two main reasons for slow V dd scaling are to keep up with the competitive frequency growth and to retain the basic noise immunity and cell stability [START_REF] Srinivasan | The impact of technology scaling on lifetime reliability[END_REF]. Hence the dissimilar area and supply voltage scaling rates result in high power densities and elevated temperatures. The four well known wear-out failure mechanisms namely Time-Dependent Dielectric Breakdown (TDDB), Electromigration, Thermal Cycling and stress migration are all adversely affected by increase in temperature. These age-related hard errors that appear in-field after a certain period of use are major factors impairing the life-time reliability of modern microprocessors [START_REF] Srinivasan | The case for lifetime reliabilityaware microprocessors[END_REF] used in data centers and space equipment. These applications demand high throughput and better lifetime reliability. However, these wear-out failures limit their useful lifetime and performance.

Interference

Beyond manufacturing defects and wear-out related permanent faults, integrated systems of recent years are more susceptible to temporary effects like transient or intermittent faults. These effects may be due to electromagnetic influences, alpha-particle radiation or cosmic radiations. They are the major portion of digital system malfunctions, and have been found to account for more than 90% of the total maintenance expense [START_REF] Sachdev | Defect Oriented Testing for CMOS Analog and Digital Circuits[END_REF]. Smaller geometries increase coupling capacitances amount interconnects and current densities and cause problems of crosstalk. In addition threshold for noise sensitivity also shrinks with (V dd ) scaling and make new technology nodes more susceptible to transient faults due to high energy particle from environment or from within the packaging.

Errors in Integrated Circuits

A fault, when active, is the cause of an error. An error is that part of the system's state that may cause a subsequent failure, and a failure occurs when an error reaches the service interface and alters the service [START_REF] Avižienis | Fundamental Concepts of Dependability[END_REF]. An error in integrated circuit can be classified according to its temporal characteristics [START_REF] Lehtonen | On Fault Tolerance Techniques Towards Nanoscale Circuits and Systems[END_REF], the product life-cycle stage of its induction, its severity etc. In the following subsections however we classify errors on the basis of their underlying faults, as this classification forms the basis of techniques to tolerate them.

Soft Errors

Soft errors are a growing concern of the reliability of circuits and systems fabricated in advanced in Complementary Metal-Oxide-Semiconductor (CMOS) technologies. They are defined as events in which data is corrupted, but the device itself is not permanently damaged [START_REF] Nicolaidis | Soft Errors in Modern Electronic Systems[END_REF]. Soft errors are a subset of SEE, which are caused by high energy neutrons from cosmic rays or by alpha particles that are generated from impurities in packaging materials, when such particles strike sensitive region in microelectronic device.

When a particle strikes a microelectronic device, the most sensitive regions are usually reversebiased p/n junctions. The high field present in a reverse-biased junction depletion region can very efficiently collect the particle-induced charge through drift processes, leading to a transient current at the junction contact. Strikes near a depletion region can also result in significant transient currents as carriers diffuse into the vicinity of the depletion region field where they can be efficiently collected. Even for direct strikes, diffusion plays a role as carriers generated beyond the depletion region can diffuse back toward the junction.

Shortly following the discovery of SEU, researchers at IBM used numerical device simulators to compute the response of reverse-biased p/n junctions to alpha-particle strikes [START_REF] Hsieh | A field-funneling effect on the collection of alpha-particle-generated carriers in silicon devices[END_REF][START_REF] Hsieh | Collection of charge from alphaparticle tracks in silicon devices[END_REF]. An important insight gained from these early charge-collection simulations was the existence of a transient disturbance in the junction electrostatic potential, which was termed the "field funnel". Charge generated along the particle track can locally collapse the junction electric field due to the highly conductive nature of the charge track and separation of charge by the depletion region field, as shown in Figure 1.3a [START_REF] Baumann | Radiation-induced soft errors in advanced semiconductor technologies[END_REF]. This funneling effect can increase charge collection at the struck node by extending the junction electric field away from the junction and deep into the substrate, [START_REF] Baumann | Radiation-induced soft errors in advanced semiconductor technologies[END_REF] such that charge deposited some distance from the junction can be collected through the efficient drift process [START_REF] Dodd | Basic mechanisms and modeling of single-event upset in digital microelectronics[END_REF] .

!"# !"# $####%&'(# )# *# +,!!-./!0#1-0/&!# )/',2/&!#1-0/&!2# 3& ! #4 15 67 # !" #" !" #" !" #" !" #" !" #" !" #" 8 /! #9#:;<# 8 &,4 #9#:=<# 8 >> # *?@# +,!!-.#6&..-6A&!# )/',2/&!# 6B510-# 6&..-6A&!# (a) !"#$%&&'()## *+,'# !"#-(.')## /&0,1)#$23&4'# $

A brief history and nomenclature

In 1975, the first ever conclusively investigated encounters of soft errors in microelectronic devices, were found to be caused due to high-energy neutrons striking the active (sensitive) regions of memory cells [START_REF] Binder | Satellite Anomalies from Galactic Cosmic Rays[END_REF]. Historically, soft errors have been of primary concern for memories because of their high active region per unit area than that of CL circuits and the fact that a particle strike in the sensitive nodes of memory cells immediately results in a soft error provided that it infuses sufficient amount of charge to flip the stored value [START_REF] May | Alpha-particle-induced soft errors in dynamic memories[END_REF], [START_REF] Ziegler | Effect of Cosmic Rays on Computer Memories[END_REF] resulting in a SEU, a terminology that was born in the context of memories [START_REF] Ziegler | IBM Experiments in Soft Fails in Computer Electronics (1978&Ndash[END_REF].

However, in the 1980s, few studies addressed another emerging single-event related issue that is, soft errors due to single-events in combinational logic [START_REF] Friedman | Single Event Upset in Combinatorial and Sequential Current Mode Logic[END_REF], [START_REF] Diehl-Nagle | Single Event Upset Rate Predictions for Complex Logic Systems[END_REF], [START_REF] May | Dynamic Fault Imaging of VLSI Random Logic Devices[END_REF]. Hence, the terminology of SEU got a broader context. But the adaptation led to two different interpretations. One circuitlevel definition of SEU found in [START_REF] Karnik | Characterization of soft errors caused by single event upsets in CMOS processes[END_REF], [START_REF] Mohanram | Closed-form simulation and robustness models for SEU-tolerant design[END_REF], [START_REF] Zhou | Gate sizing to radiation harden combinational logic[END_REF] and [START_REF] Garg | A fast, analytical estimator for the SEU-induced pulse width in combinational designs[END_REF] states that an SEU is a high-energy particle-induced disturbance in a logic circuit node causing a voltage transient that may propagate through the CL stages and eventually be latched by a sequential element [START_REF] Karnik | Characterization of soft errors caused by single event upsets in CMOS processes[END_REF]. Thus treats SEU as a direct cause of particle strike in CL elements and the voltage transient that propagates through the CL network as its direct effect, which can lead to a soft error. Whereas a system level interpretation that can be found in [START_REF] Dodd | Basic mechanisms and modeling of single-event upset in digital microelectronics[END_REF], [START_REF] Shivakumar | Modeling the effect of technology trends on the soft error rate of combinational logic[END_REF] and [START_REF] Goessel | New Methods of Concurrent Checking[END_REF] considers SEU as soft error in storage elements and defines it as: "Radiation-induced errors in microelectronic circuits caused when charged particles (usually from the radiation belts or from cosmic rays) lose energy by ionizing the medium through which they pass, leaving behind a wake of electron-hole pairs" [1]. This definition of SEU is in accordance with the one traditionally used in the context of memories and considers SEUs as soft errors in storage elements caused by the voltage transient that propagates through CL from the point of single-event till that storage element.

In order to avoid ambiguity we use the system level interpretation of SEU throughout this manuscript irrespective of the abstraction level at which the issue is being discussed or resolved. We also use the terminology of SET to refer to the single-event induced transient voltage pulses generated in and propagating through CL stages as used unambiguously by many literary works [START_REF] Benedetto | Heavy ion-induced digital single-event transients in deep submicron Processes[END_REF][START_REF] Ferlet-Cavrois | Single Event Transients in Digital CMOS-A Review[END_REF][START_REF] Dodd | Production and propagation of single-event transients in high-speed digital logic ICs[END_REF].

In the late 1990s a new research interest towards developing techniques to limit SER due to SEE in CL emerged. This drive was in the wake of diminishing impact of the natural redundancies of CL circuits to prevent SET to result in soft errors and the perception that memory soft error situation was controllable with advanced technologies and effective error detection and correction techniques.

Lidén et al. in 1994 experimentally estimated that only 2% of bit flips in memory elements also known as SEU were caused by particle-induced transients or SET generated in and propagated through CL. The rest were due to direct particle strike in latches. Their experiments involved using a 1 µm CMOS process at 5MHz [START_REF] Liden | On latching probability of particle induced transients in combinational networks[END_REF]. Since then physical gate-length has downscaled up to 50 times, supply voltages have dropped to 0.9 V and operating frequency has shown a thousand fold increase [46]. This massive change in technology has resulted in greater sensitivity of memory elements to high-energy particle, but the effects are more pronounced on CL networks [START_REF] Shivakumar | Modeling the effect of technology trends on the soft error rate of combinational logic[END_REF]. A more recent work uses a probability model to estimate that the susceptibility to CL circuits to SET nearly doubles as the technology scales from 45 nm to 16 nm [START_REF] Velamala | Design sensitivity of Single Event Transients in scaled logic circuits[END_REF].

Increasing soft error rate in logic circuits

Early evidences of the problem of SEU in memories as discussed in the previous subsection, gathered prompt attention of the research community. However, in CL the concern of SET emerged much later but the inevitable drive of CMOS device scaling played a significant role in increasing soft errors due to SEE in CL circuits and raised certain new reliability issues. The major reason being the diminishing critical charge of future technology nodes, necessary to generate SET in CL, which is the result of reducing supply voltages levels [START_REF] Shivakumar | Modeling the effect of technology trends on the soft error rate of combinational logic[END_REF] and error margins. Besides the adverse impact on CL node susceptibility to particle strikes, the technology scaling also lessened the impact of natural barriers posed by CL to SET propagation. There are three inherent properties of CL networks that have prevented SET from resulting into soft errors:

Electrical Masking: The electrical characteristics of the transversed gates may cause the SET pulse duration and amplitude to be attenuated. If a pulse looses strength while propagating through a sensitized path or completely disappear before reaching a memory element, then the SET is referred to be electrically masked [START_REF] Massengill | Single-Event Transient Pulse Propagation in Digital CMOS[END_REF].

Latching-window Masking: Consider a SET pulse that gets a sensitized path and reaches a Flip-Flops (FF) input with amplitude enough to be considered a valid logic level, but misses the latching-window of the FF. This SET pulse will not affect the stored data due to the latchingwindow masking effect [START_REF] George | Characterization of logical masking and error propagation in combinational circuits and effects on system vulnerability[END_REF].

Logical Masking: For a SET to propagate through CL and result in a soft error it is necessary that the path from the point of SEE generation to a memory element, should be functionally sensitized during the time of SEE propagation [START_REF] George | Characterization of logical masking and error propagation in combinational circuits and effects on system vulnerability[END_REF]. For example, as incorrect logic value at one input of an OR gate somewhere in the path, does not produce an error at its output if another of its inputs is at logic level 1. This depends on the input vector being applied at the time of the SEE propagation.

As technology scales these factors are diminishing. Electrical masking is supposed to decrease because the smaller transistor are faster thus have less attenuation effect on a SET. High operating frequencies mean that there are more latching-windows per unit time thereby increasing the probability of a SET being latched. Among the three masking effects logical masking seems least affected by the technology trends [START_REF] Shivakumar | Modeling the effect of technology trends on the soft error rate of combinational logic[END_REF]. As a result research attention drawn towards developing techniques to limit SER in CL is becoming comparable to effort made in protecting state elements.

Hard Errors

Hard errors are caused by permanent silicon defects, which either exist due to manufacturing processes imperfections as discussed in Section 1.2.2 or are caused by in-field wear-out phenomenon as discussed in Section 1.2.3. The rapid development of silicon process has provided steady increase in processor performance and capabilities for the past three decades. However, the growth in the number of transistor per core, increases the chance of having more hard errors in a given core. In addition these high performance microprocessors mostly operate at higher clock frequencies and voltage, thus experience accelerated aging due to temperature and voltage stress [START_REF] Chen | Microprocessor Aging Analysis and Reliability Modeling Due to Back-End Wearout Mechanisms[END_REF]. Furthermore, the increasing complexity in connectivity between different stages of high-performance processing cores, to support advanced features (like hazard detection, branch prediction, data forwarding etc) and also having a large number of stages, makes error confinement a challenge [START_REF] Wali | An effective hybrid fault-tolerant architecture for pipelined cores[END_REF].

Some well-known failure mechanisms such as time dependent dielectric breakdown (TDDB) in the gate oxides and electromigration (EM) on interconnects have increasing adverse effects due to shrinking feature size. On the other hand, degradation of device parameters over the circuit's lifetime has emerged as a major threat to system reliability. In particular, circuit wearout resulting from negative bias temperature instability (NBTI) and random telegraph noise (RTN) that cause electrical parameter shift (e.g., transistor threshold voltage increase) is of particular concern with technology scaling and it is shown that they could result in significant performance degradation of the circuit over its service life [START_REF] Mathew | Energy-Efficient Fault-Tolerant Systems[END_REF].

Timing Errors

Unlike hard and soft errors, components that suffer from timing error still provide correct logic outputs. However, they have higher delays between input and output signal establishments. Faults induced by the drift in the electrical characteristic of circuit elements caused by PVT variability, manufacturing defects and aging are responsible for this type of errors. With the continuous downscaling of transistor feature size, there is an increasing uncertainty for the timing behavior of today's ICs, often manifesting themselves as infrequent timing errors on speed-paths, i.e., critical or near-critical paths [START_REF] Mathew | Energy-Efficient Fault-Tolerant Systems[END_REF].

Reliability Improvement Approaches

In order to achieve reliability goals, reliability practices must begin early in the design process and must be well integrated into the overall product development cycle. Steps must be taken at design time, implementation time as well as during execution time. Similarly, achieving system reliability requires understanding reliability needs at each level of the design. With the increasing complexity of systems interactions, interfaces and stress profiles it is becoming more and more important to understand when, what and where to use and how to create a balance of reliability improvement efforts on each design level and development cycle to meet the overall system reliability targets. Heimerdinger et al. in [START_REF] Walter | A conceptual framework for system fault tolerance[END_REF] characterize the reliability improvement practices according to their chronology in the product development and life cycle as follows.

Fault Avoidance

Fault avoidance uses various tools and techniques to specify, design and manufacture systems in such a manner that introduction of faults is minimized [START_REF] Shivakumar | Techniques to Improve the Hard and Soft Error Reliability of Distributed Architectures[END_REF] by targeting the source mechanisms that cause the failure as shown in Figure 1 reduce their analogousness and avoid faults during specification phase [START_REF] Rushby | Formal Methods and the Certification of Critical Systems[END_REF]. A typical example of fault avoidance at design phase is employing transistor resizing within critical gate to decrease the vulnerability to soft errors [START_REF] Zhou | Gate sizing to radiation harden combinational logic[END_REF]. Fault avoidance may also include technology mitigation techniques that implicate modifications of conventional manufacturing processes, like modern chips designs use Silicon-On-Insulator (SOI) technology that provides many advantages including significantly reduced susceptibility to soft errors due to the smaller volume for charge collection [START_REF] Hareland | Impact of CMOS process scaling and SOI on the soft error rates of logic processes[END_REF]. Besides these, used of radiation hardened components is another example of fault avoidance at design phase. Whereas fault avoidance during manufacturing involves adaptation of suitable standards of quality, for instance, ensuring the cleanroom standards.

Fault Removal

Fault removal refers to a wide spectrum of approaches aimed at detecting and eliminating existing faults during specification and design, and remove faulty components during production and operational phases. Fault removal uses various methods including formal verification, design rule checking, signal integrity analysis, static timing analysis etc. during sign-off to locate faults in specification or design enabling the necessary changes to be made before tape-out. Burn-in is one of the fault removal techniques that weeds out defective chips after manufacturing time, so that chips actually used in systems have very low failure rate. Chips also typically include Design For Test (DFT) structures such as scan chains, online and offline tests etc to aid in fault removal during their operational life [START_REF] Shivakumar | Techniques to Improve the Hard and Soft Error Reliability of Distributed Architectures[END_REF].

Fault Tolerance

In spite of the best efforts to avoid or remove them, there are bound to be faults in any operational system. Once a fault has been generated it can be prevented from activating an error using static fault tolerant techniques (refer Figure 1.4) such as masking. Alternately, errors can be detected and recovered using dynamic fault tolerance techniques like Error-Correction Code (ECC) [START_REF] Castano | Resilient Computer System Design[END_REF].

Fault tolerance aims at guaranteeing the service provided by the product despite the presence or appearance of faults [START_REF] Walter | A conceptual framework for system fault tolerance[END_REF].

There are various approaches to achieve fault tolerance in a system, but what they have in common is the use of certain amount of redundancy. John von Neumann in 1950's pioneered the idea of using redundancy to improve the reliability of systems in his work titled as "Probabilistic logic and synthesis of reliable organisms from unreliable components" [START_REF] John Von Neumann | Probabilistic Logics and the Synthesis of Reliable Organisms from Unreliable Components[END_REF]. According to the classification of redundancy done by Avižienis in [START_REF] Avižiens | Fault-Tolerant Systems[END_REF], there are two basic types; spacial and temporal redundancies.

Spacial Redundancy: Refers to redundant components, functions or data units used either to verify original execution or to replace the defective or erroneous ones [START_REF] Dubrova | Fault-Tolerant Design[END_REF]. Spacial redundancy is further classified into hardware, software and information redundancy, depending on the type of redundant resources added to the system.

Temporal Redundancy: In temporal redundancy a computation or data transmission is repeated to compare with the original one [START_REF] Dubrova | Fault-Tolerant Design[END_REF]. Spacial redundancy impacts the system size and power in terms of area for extra hardware resources to hold and execute extra software and information. In some application it may be desirable to spend extra time rather than extra space to tolerate faults. Therefore, temporal redundancy generally has overhead in terms of performance in order recompute data using the same hardware resources.

Hybrid Redundancy: Hybrid redundancy approaches combine the spacial and temporal redundancies to optimize the use of redundant resources. Faults appear in system from time to time, the use of temporal resources to detect errors could be of an adverse impact on the throughput of the system. Similarly occupying hardware resources for redundant computations can have an overhead on power consumption. Hybrid redundancy makes efficient use of spacial and temporal resources to optimize the impact on area, power and performance. A simple example of fault tolerant architecture that uses hybrid redundancy is given in Section 2.2.1.

Fault Evasion

It is possible to observe the behavior of a system and use this information to take action to compensate for faults before they occur [START_REF] Walter | A conceptual framework for system fault tolerance[END_REF]. During the operational life of a product situations like perturbations coming from the non-operational environment can induce faults. To avoid such situations external environment is monitored to detect these dangerous conditions and adequate shielding action are taken to protect faults from appearing. An example is the use of on-chip temperature sensors for power management to avoid wearout related faults [START_REF] Brooks | Dynamic thermal management for high-performance microprocessors[END_REF][START_REF] Feng | Maestro: Orchestrating Lifetime Reliability in Chip Multiprocessors[END_REF].

Research Objectives

The work in this thesis aims to improve the transient, permanent and timing error reliability of future technology circuits and modern microprocessor systems for their use in high-reliability applications. It places a special emphasis on the issue of error detection and confinement in complex pipeline circuits and addresses the reliability concerns arising from the Combinational Logic (CL) parts of logic circuits, a problem illustrated symbolically with the help of Figure 1.5. It shows the share and types of problems arising from sequential logic and CL parts of digital circuit. As discussed in Section 1.3.1.2, CL networks are becoming increasingly susceptible to SEEs. In addition, pronounced variability and power densities either causes the electrical characteristics of these node to change, resulting in timing errors or become permanently damaged giving rise to hard errors. As a result, the research attention drawn towards developing techniques to limit SER in CL is becoming comparable to effort made in protecting state elements. • As the first step towards achieving this global objective, the thesis aims to perform an in-depth analysis of spacial, temporal and hybrid redundancy approached existing in the state-of-the-art and classifying them with respect to their area, power and performance overheads, and fault tolerance capabilities.

• It aims to develop an effective hybrid fault tolerant approach that can be applied to complex pipeline circuits.

• To compare and identify the shortcomings of the developed technique by its application and the application of state-of-the-art techniques to a specific core architecture.

• It also aims to lay down the framework for the quantitative comparative analysis of different fault tolerant architectures specially in terms of their fault tolerance capability.

• As a final objective, It intends to optimize the developed technique for cost-reliability and provide the means to selectively use the technique to be able to control the cost-reliability trade-off.

Chapter 2

Fault Tolerant Architectures and Assessment Techniques

In order to prevent reliability from becoming a bottleneck for the development of high-performance, low-power systems, design architects must address the concern of reliability through the use of fault-tolerant architectures. These architectures are commonly used to tolerate on-line faults, i.e. faults that appear during the normal functioning of the system, irrespective of their transient or permanent nature [START_REF] Koren | Fault-Tolerant Systems[END_REF]. They use redundancy to tolerate faults in Combinational Logic (CL) and storage elements. These techniques as generally classified by the employed type of redundancy discussed in Section 1.4.3.

In this chapter we will first discuss some error detection and correction techniques generally employed in fault-tolerant architectures. In the second section of this chapter we will discuss some relevant fault-tolerant architectures. Among these architectures we will discuss a Hybrid Fault Tolerant (HyFT) architecture in detail because it serves as the starting point of the work in this thesis. In Section 2.3 we will briefly overview the robustness assessment techniques with special focus on a simulation based fault injection framework developed and used throughout the course of this thesis for fault tolerance capability assessment of different fault tolerant architectures. Later we will present an experimental study to compare different architectures on the basis of their implementation cost, performance and most importantly the fault tolerance capability and finally in the last section we will summarize the results of the experimental study and conclude the discussion.

Fault-Tolerance Techniques

Circuit-level fault-tolerance techniques are generally based on any one or a group of redundancies discussed in Section 1.4.3. These techniques change the original circuit by adding logic for error detection and correction or error masking. At system-level (for example microprocessor, System on Chip (SoC) etc.) these circuit-level fault tolerance techniques are generally categorized as hardware-based techniques because they mostly rely on hardware replication and additional hardware modules to protect system against faults. Moreover software-based fault-tolerance techniques are also widely implemented at system-level because of their non-intrusiveness, high flexibility, low development time and cost [START_REF] Koren | Fault-Tolerant Systems[END_REF]. However, software-based fault tolerance techniques cannot achieve full system protection because of their inability to handle all the possible control flow errors. In this section we focus on some circuit-level fault-tolerance techniques commonly used as building block of fault-tolerant architectures.

Concurrent Error Detection

Exhaustive testing has been long ruled out because of the increasing complexity of chips. Thus most but not all manufacturing defects can be detected during testing. The manufacturing faults that escape testing can appear infield anytime. Similarly, the moment of transient fault occurrence are not predictable. Also the failures caused due to aging effects on digital circuits cannot be precisely forcasted. Thus the errors caused by these faults have to be detected during normal operation. Error detection during normal operation is called concurrent error detection or on-line detection [START_REF] Goessel | New Methods of Concurrent Checking[END_REF].

Duplication with Comparison

Duplication with comparison is a commonly used, simple to implement error detection technique based on hardware redundancy. It uses two identical copies of a circuit to compare their outputs and flags error if there is an inequality in the results computed by the two copies as shown in Figure 2.1. One of the reasons of its popularity is its simple implementation, and also its ability to detect a wide variety of faults, which include permanent, transient and timing faults. An important design decision for schemes that use duplication with comparison is the placement of the comparator. Theoretically, any sequential circuit can be transformed into a pipelined circuit by grouping together all the FFs with same sequential depth1 as individual pipeline registers. Although the resulting pipeline may contain a large number of feedback and feed-forward signals but essentially functions as a pipelined circuit [START_REF] Marinescu | High-level automatic pipelining for sequential circuits[END_REF]. Consider a sequential circuit with FFs having sequential depth not more than 2. Such a sequential circuit can be transformed into a single stage of a pipeline, by grouping all the FFs with sequential depth of 1 as input register and all the FFs with sequential depth of 2 as output register. If this circuit is to be added with a duplication with comparison based error detection capability, after duplicating the CL blocks, a common way of placing comparator is to insert it after the pipeline register as shown in Figure 2.2a. The block labeled as '==?' represents a static comparator and the clouds represent CL blocks.

Any discrepancy in CL1 of CL2 will cause erroneous data to be latched in one of the register and the comparator will signal error for at least one cycle without a need of latching the error signal. With this placement not only the errors latched in the output registers due to Single Event Transient (SET)s caused in the CL blocks are detected, but also the Single Event Upset (SEU)s due to direct high-energy particle strikes in the output register FFs are detected and indicated by a stable error signal. This scheme can also detect timing unless faults in both the CL copies manifest themselves the same way at the outputs of CL. Furthermore, the power dissipation in the comparator's OR-tree will be low because it will undergo at most one transition per input per cycle. However this technique requires duplication of not only the CL but also of the output register.

A commonly used comparator placement is to insert it before the pipeline register as shown in Figure 2.2b. Although this scheme does not require the duplication of pipeline register, it has a few inherent drawbacks. Since the comparator compares during the entire cycle, the time when the CL outputs are unstable due to the difference in circuit path lengths, the OR-tree experiences a increased switching activity thus higher power consumption. Another possibility of comparator placement is to insert it across the output register as shown in Figure 2.2c. This scheme is similar to the architecture shown in Figure 2.2b except that, since in this case the comparator gets one synchronous input from the output register, half of the comparator inputs do not experience high activity during the CL outputs are unstable. Secondly, as the comparator gets to compare the output of the register is also marginally protects it against SEUs, which occur due to direct particle strikes in it.

In both the cases of Figure 2.2b and 2.2c the comparator output is an unstable signal which perturbs during the time CL outputs are unstable and needs a latching mechanism if a stable error signal is required. This in turn raises another question of, when to latch the error signal? If the error signal is latched with the clock edge, i.e. at the same time as data is latched in the register, a transient glitch or a delayed transition due to a timing fault may get latched in the output register but can possibly escape getting latched in error FF. These glitch escapes can happen because of the additional path it has to traverse in the coparator OR-tree before it can reach the error FF or can get electrically masked by the logic in OR-tree.

One solution to this problem is to move the error latching mechanism upstream in the OR-tree. This will not only reduce the difference in the lengths of paths a glitch or a delayed transition has to travel before reaching the FFs in the output register and the error latching mechanism but …….

…….

…….

B 0 A 1 B 1 A 2 B 2 A 3 B 3 A N B N Error A 0
Error latching Layer XOR Layer 0 OR Tree …….

…….

Fig. 2.3: An static comparator with Error Latching mechanism moved upstream also blocks the unwanted signal perturbations from causing excessive power dissipation in the OR-tree. But even if the error latching mechanism is moved all the way up till the XOR gates as shown in Figure 2.3, the architecture will not meet the power consumption of the first scheme (of Figure 2.2a) because the XOR gates will still experience the unwanted activity and the increased number of FFs to latch error cause higher power consumption due to constant activity of clock network. Alternatively, a latching mechanism at the end of the OR-tree can be used with a delayed clock to latch the error. This clock offset should match the delay of the OR-tree to prevent any glitches from escaping detection. But due to process variations it is difficult to match and could not guarantee zero glitch escapes. On top of that the switching activity in the OR-tree will still be there.

To address some of the problems due to static comparator used in duplication with comparison, the work in [93] proposes a circuit-level implementation of a special comparator discussed in the following subsection.

Pseudo-dynamic Comparator:

The main idea is to use an error latching mechanism upstream in the OR-tree. Secondly, instead of depending on a capture edge to latch the error signal it uses a user defined comparison-window for detection of permanent, transient and timing errors. Furthermore it reduces the power consumption in the error latching layer by the use of DOR gates shown in Figure 2.4.

…….

…….

…….

B 0 A 1 B 1 A 2 B 2 A 3 B 3 A N B N Error A 0 ……. ……. B 0 A 1 B 1 A 2 B 2 A 3 B 3 A 0 DC CompReset DOR DOR DOR XOR Layer 0 OR Tree B N-3 A N-2 B N-2 A N-1 B N-1 A N-3
Error latching Layer Fig. 2.4: Pseudo-dynamic Comparator [93] Figure 2.5 shows the structure of the 4-input DOR gate. The dynamic logic part, which is controlled by CompReset and DC signals forms an OR gate and the keeper acts as an error latching mechanism. During the pre-charge phase, reset is at logic-0. Input capacitance of the inverter is pre-charged to V DD , which puts the Error signal at logic-0. During the evaluation phase CompReset and DC are both at V DD . If atleast one of the inputs (C i ) turns to logic-1, the discharge will occur. Consequently, Error switches to logic-1. Note that once the discharge happens, Error will remain at logic-1 until the next pre-charge phase. Besides, the keeper must be weak enough so that its input can be pulled down to logic-0 by the driving transistors.

Figure 2.6 present the complete error detection architecture using the pseudo-dynamic comparator represented by the block labeled as '==?*'. It places the pseudo-dynamic comparator across the output register in order to protect it against SEUs that are generated in it. The Com-pReset and DC and the control logic that generates them is not show for clarity. Experimental results in [93] show that the new comparator exhibits better glitch and delayed transition detection [93] capability due to its error latching layer moved upstream in the OR-tree and with the use of dynamic logic it offers about 30% reduction in power compared with a static comparator, while having negligible area overhead in comparison with a static comparator.

Error Detecting Codes

Another widely used techniques of error detection in digital circuits is the use of error detecting codes. Error detecting codes introduce redundancy in information representation to detect possible errors in that representation [START_REF] Lussier | On Fault Tolerance and Robustness in Autonomous Systems[END_REF]. Consider a logic circuit that performs a function f on the n-bit input data i and produces a m-bit output f (i) as shown in Figure 2.7. Using error detecting codes to improve the data integrity of this logic block generally involves implementing a block which predicts some special characteristic C(i) of the output f (i) for every input sequence i. A checker circuit first computes this characteristic C ′ ( f (i)) of output from the output itself and finally compares it with the predicted characteristic C(i) to check for any data anomalies. Error detecting codes have been widely used to protect memories against SEUs and permanent faults [START_REF] Peterson | Error-correcting Codes[END_REF]. The main reason of their widespread use in memories is that their regular structure allows efficient incorporation [START_REF] Dutta | Combinational Logic Circuit Protection Using Customized Error Detecting and Correcting Codes[END_REF]. Use of error detecting codes to detect errors in logic circuit has been preliminarily based on the idea of reducing the implementation overhead of duplication with comparison. However reducing area overhead below the cost of duplication for random logic require redesigning the original circuits or compromising on fault coverage [START_REF] Goessel | New Methods of Concurrent Checking[END_REF].

Error Recovery

Following an error detection an error recovery mechanism restores the error-free state of the system or prevents faults from being activated again or both [START_REF] Lussier | On Fault Tolerance and Robustness in Autonomous Systems[END_REF]. Error recovery mechanism generally take two forms discussed in following subsections.

Rollback Error Recovery

In rollback recovery scheme errors are recovered by repeating the operation(s). Architectures based on rollback recovery generally use spatial redundancy to detect errors and correct them with temporal redundancy. Hardware and software use check-pointing to periodically or occasionally save system state, which is used to bring the system back to an error free state in case of error detection. These rollbacks can be as long as upto several thousands of cycles [START_REF] Mehrara | Low-Cost Protection for SER Upsets and Silicon Defects[END_REF] or can be just one cycle deep [START_REF] Tran | A Hybrid Fault Tolerant Architecture for Robustness Improvement of Digital Circuits[END_REF].

An example of a single cycle deep rollback recovery scheme is shown in Figure 2.8a in which a concurrent error detection mechanism checks for errors at the end of each cycle and if it detects an error the instruction re-executes during the next cycle. Figure 2.8b shows an example of a much deeper rollback recovery scheme. After each computation, which takes several cycles an error detection mechanism checks for errors. If no error is detected, system state (which can include the contents of pipeline register, control registers and memory update information etc.) is stored as checkpoint data. In case an error is detected the previous saved checkpoint data is used to restore system error-free state and the effected computation is repeated.

A fine-grained rollback recovery schemes demands frequent error checks and checkpoint updates, thus incur high energy cost. However the amount of check-pointing data to be stored is minimal and are generally less intrusive. Coarse-grained rollback recovery schemes on the other hand generally rely on software intrusive recovery sequences and check-pointing procedures, and demand significant storage to store check-pointing data specially if memory updates are involved. Besides implementation cost, coarse-grained recovery schemes can have significant performance overhead particularly in high error rate environments [START_REF] Yao | A Stage-Level Recovery Scheme in Scalable Pipeline Modules for High Dependability[END_REF].

Forward Error Recovery

In forward error recovery techniques whenever an error is detected, the correction is made ahead of time such that corrected data is available at or before the time when it is normally needed. Error masking is a typical example of forward error recovery scheme, where the recovery mechanism act as soon as an error is detected unlike rollback recovery in which the system steps back in time to recompute. Forward error recovery schemes are efficient to be used in tight deadline applications as they do not rely on re-computations [START_REF] Suresh | Advanced Error Recovery for TMR Systems[END_REF].

Forward error recovery schemes generally uses spacial redundancy for both error detection and correction. Significant amount of hardware resource is dedicated all the time whether there are errors or not. On the other hand, rollback recovery schemes make use of temporal resources only when they are needed thus have better allocation of redundant resources [START_REF] Naeimi | Fault-tolerant sub-lithographic design with rollback recovery[END_REF].

Fault tolerant Architectures

Several fault-tolerant architectures have been proposed in the literature in the past to address the circuit reliability concerns. A few of these relevant solutions include; Partial-TMR, Full-TMR, DARA-TMR [START_REF] Yao | DARA: A Low-Cost Reliable Architecture Based on Unhardened Devices and Its Case Study of Radiation Stress Test[END_REF][START_REF] Yao | A Stage-Level Recovery Scheme in Scalable Pipeline Modules for High Dependability[END_REF], PaS [START_REF] Johnson | Design and Analysis of Fault-tolerant Digital Systems[END_REF], CPipe [START_REF] Subramanian | Conjoined Pipeline: Enhancing Hardware Reliability and Performance through Organized Pipeline Redundancy[END_REF], STEM [5] and Razor [START_REF] Ernst | Razor: a low-power pipeline based on circuit-level timing speculation[END_REF], which are discussed in following subsections. We select this set of architectures because it includes a representative of each class of the broad spectrum of fault tolerant architectures available in the literature.

Pair-and-A-Spare

Pair-and-A-Spare (PaS) Redundancy was first introduced in [START_REF] Johnson | Design and Analysis of Fault-tolerant Digital Systems[END_REF] as an approach that combines Duplication with Comparison and standby-sparing. Figure 2.9 illustrated the principle of PaS redundancy. In this scheme each module copy is coupled with a Fault-Detection (FD) unit to detect hardware anomalies within the scope of individual module. A comparator is used to detect inequalities in the results from two active modules. In the case of inequality a switch decides which one of the two active modules is faulty by analyzing the reports from FD units and replaces it with a spare one [START_REF] Dubrova | Fault-Tolerant Design[END_REF]. This scheme was intended to prevent hardware faults from causing system failures. The scheme fundamentally lacks protection against transient faults and it incurs a large hardware overhead to accomplish the identification of faulty modules.

Razor

Razor is a well known solution to achieve timing error resilience by using the technique called timing speculation presented in [START_REF] Ernst | Razor: a low-power pipeline based on circuit-level timing speculation[END_REF]. The principle idea behind this architecture is to employ temporally separated double-sampling of input data using Razor FFs, shown in Figure 2.10a, placed on critical paths. The main FF takes input sample on the rising edge of the clock, while a time-shifted clock (clk-del) to the shadow latch is used to take a second sample. By comparing the data of the main FF and the shadow latch, an error signal is generated. The timing diagram of how the architecture detects timing errors is shown in Figure 2.10b. In this example a timing fault in CL A causes the data to arrive late enough that the main FF captures wrong data but the shadow always latches the input data correctly. The error is signaled by the XOR gate which propagates through the OR-tree for correction action to be taken. Error recovery in Razor is possible either by clock-gating or by rollback recovery. Razor also uses Dynamic Voltage Scaling (DVS) scheme to optimize the energy vs. error rate trade-off.

STEM

STEM cell architecture takes Razor a step further by incorporating capability to deal with transient faults as well. STEM cell architecture presented in [5] incorporates power saving and performance enhancement mechanisms like Dynamic Frequency Scaling (DFS) to operate circuits beyond their worst-case limits. Similar to Razor FFs, a STEM cells (shown in Figure 2.11) replace the FF on the circuit critical paths, but instead of taking two temporally separated samples, A STEM cell takes three samples using two delayed clocks. Mismatches are detected by the comparators and the error signals is used to select a sample which is most likely to be correct for rollback.

!"# $%&'#!())# ## &**+*# !", -# ## ## !"# . /# . /# . 0# 12345# !", 0# !", /# . /# . 0# . -# "12345# "6789# Fig. 2.11: STEM Architecture [5]

CPipe

The CPipe or Conjoined Pipeline architecture proposed in [START_REF] Subramanian | Conjoined Pipeline: Enhancing Hardware Reliability and Performance through Organized Pipeline Redundancy[END_REF] uses spatial and temporal redundancy to detect and recover from timing and transient errors. It duplicates CL blocks and the FFs as well to from two pipelines interlinked together as shown in Figure 2.12. The primary or leading pipeline is overclocked to speedup execution while the replicated of shadow pipeline has sufficient speed margin to be free from timing errors. Comparators placed across the leading pipeline register in somewhat similar way as the scheme of Figure 2.2c, detects any metastable state of leading pipeline register and SETs reaching the registers during the latching window. The error recovery is achieved by stalling the pipelines and using data from the shadow pipeline registers for rollback and it takes 3 cycles to complete.

TMR

TMR is one of the most popular fault tolerant architectures. One of the very first use of TMR in computing systems can be found in [START_REF] Robert | The use of triple-modular redundancy to improve computer reliability[END_REF]. In a basic TMR scheme called Partial-TMR and shown in Figure 2.13a, we have three implementation of same logic function and their outputs are voted by a voter circuit. This architecture can tolerate all the single-faults occurring in the CL block but faults in voter or pipeline registers cause the system to fail. Full-TMR on the other hand, triplicates the entire circuit including the FFs and can tolerate all single-faults in any part :.! *#*.0%1 ! :.! "#*.0%1 ! Fig. 2.12: CPipe Architecture [START_REF] Subramanian | Conjoined Pipeline: Enhancing Hardware Reliability and Performance through Organized Pipeline Redundancy[END_REF] of the circuit except voter and the signals to the input pipeline register, which may result in common-mode failure.

!! "!#!$%&'(%)'! !! *!#!$%&'(%)'!! !! *!#!$%&'(%)'! !! "!#!$%&'(%)'! "+,-./! *.0%1! *',-%)0! *.0%1
!! "#$! "#%! !! &! '()*+!,-./0+-1!! 2*+)*+!,-./0+-1! "#3! (a) Partial-TMR !! "#$%&!'()*+&(,!! !! "#$%&!'()*+&(,!! !! "#$%&!'()*+&(,!! !! -%&$%&!'()*+&(,!! !! -%&$%&!'()*+&(,!! !! -%&$%&!'()*+&(,!! ./0! ./1! ./2! 3! (b) Full-TMR

DARA-TMR

DARA-TMR triplicates entire pipeline but uses only two pipeline copies to run identical process threads in Dual Modular Redundancy (DMR) mode. The third pipeline copy is disabled using power gating and is only engaged for diagnosis purposes in case of very frequent errors reported by the detection circuitry. Figure 2.14 shows a simplified representation of DARA-TMR scheme.

Once the defective pipeline is identified the system returns back to DMR redundancy mode by putting the defected pipeline in off mode. The error recovery follows the same mechanism as pipeline branch misprediction, making use of architectural components for error recovery. DARA-TMR treats permanent fault occurrence as a very rare phenomenon and undergo a lengthy reconfiguration mechanism to isolate them [START_REF] Yao | DARA: A Low-Cost Reliable Architecture Based on Unhardened Devices and Its Case Study of Radiation Stress Test[END_REF].

Hybrid Fault-Tolerant Architecture

HyFT architecture employs information redundancy (as duplication with comparison) for error detection , timing redundancy (in the form of re-computation/rollback) for transient and timing error correction and hardware redundancy (to support reconfiguration) for permanent error correction [START_REF] Wali | Protecting combinational logic in pipelined microprocessor cores against transient and permanent faults[END_REF]. As shown in the simplified representation in Figure 2.15a, the HyFT architecture employs triplication of CL blocks. A set of multiplexer and demultiplexer is used to select two primary CL copies and to put the third CL copy in standby mode during normal operation. HyFT architecture is driven by a control logic module that generates the necessary control signals. The details of the HyFT control logic is provided in Appendix A. HyFT architecture uses the pseudo-dynamic comparator [93] for error detection to achieve better glitch detection capability and to reduce the power consumption as discussed in Section 2.1.1.1.

The HyFT architecture uses a concurrent error detection mechanism. A pseudo-dynamic comparator compares the outputs of two active CL copies. It can be seen in Figure 2.15a that the comparator is placed across the output register such that it gets to compare the output of the output register S out , which is a synchronous signal with the output of the secondary running copy A out , which is an asynchronous signal. As discussed in Section 2.1.1.1, this orientation of the pseudo-dynamic comparator also offers marginal protection against the errors due to faults in the The comparison takes place only during brief intervals of time referred to as comparisonwindow, represented in Figure 2.15b as regions shaded in red color. The timing of comparisonwindow is defined by the high phase of a delayed clock signal DC, which is generated from CLK using a delay element. These brief comparisons allow keeping the switching activity in OR-tree of the comparator to a minimum, offering a 30% power reduction compared with a static comparator. The functioning of the pseudo-dynamic comparator requires specific timing constraints to be applied during synthesis of CL blocks, as defined below.

Timing Constraints: In typical pipeline circuits the contamination delay of CL should respect hold-time of the pipeline register latches. However in the HyFT architecture, as CL also feeds to the pseudo-dynamic comparator, CL outputs need to remain stable during the comparison. And since the comparison takes place just after a clock edge, any short paths in the CL can cause the input signals of the comparator to start changing before the lapse of the comparison-window. Thus the CL copies have to be synthesized with minimum delay constraints governed by:

t cd δt -t ccq -t cdm -t cm (2.1)
where: In Figure 2.16 we explain the error detection and correction principle of HyFT Architecture shown in Figure 2.15a, with the help of three different fault scenarios among many other possible cases. Figure 2.16a is a timing diagram of system response to an occurrence of a permanent fault, Figure 2.16b shows the response in case of a SET occurrence and Figure 2.16c is in case of a timing fault. It can be noticed that either A out or S out can be affected by an error depending on the fault location. In both the cases the comparator detects the inequality and flags Err signal. In Figure 2.16, this is represented by a comparison window marked with an inequality ( =) sign, which compares a correct result with a faulty one represented by an asterisk (*) sign. The Err signal remains active for two cycles until the system returns back to normal operation after a reconfiguration and a recompilation cycle.

t cd = CL
Besides these three, many other fault scenarios are possible. For instance in case of permanent or timing fault it is possible that the system may not be able to isolate the fault by undergoing just one reconfiguration and a recompilation cycle. Since it is not possible to determine which of the two working copies of CL in a stage exhibits a permanent fault, the reconfiguration choice is irrespective of that. There is 50% chance that the first reconfiguration eliminates the fault. In this case another error detection triggers a pair of reconfiguration and re-computation cycles, which will definitely be able to select two CL copies that provide good results. Thus the error recovery penalty in this case will be four cycles instead of two.

Robustness Assessment Techniques

Unlike area/power overheads and temporal performance degradation of any fault tolerant architecture, robustness improvement and error recovery overhead are two important design merits, which cannot be assessed using standard circuit analysis methods and tools. The methods to assess these design merits can generaly be divided into two groups.

Axiomatic Methods

Analytic Methods

Analytic assessment of robustness requires abstract mathematical or logical models to specify the behavior of the design and the fault environment. It is then necessary to determine how well the fault tolerant mechanism works by producing analytic solution of the models [3]. Accurate analytic modeling of complex systems is extremely difficult since the models can get very large in practice, and the simplifying assumptions made in order to make analysis tractable reduces the usefulness of the results.

Simulation based

Simulation emerges as a reasonable solution to the problem of tractability versus usefulness in analytic methods of robustness assessment. It involves preparing a stochastic model of the fault tolerant system and the environment. Then simulating it over some relevant period of time and using the data gathered to characterize the model's behavior. Simulations allows speeding up fault occurrences to analyze the system response in terms of fault-tolerance capability and performance. Simulation-based fault injection environments need less time and effort to implement and offer better controllability and observability.

= ≠ = = inst1 inst2* inst3 inst2 inst1 inst2 inst3 inst2 inst2 inst3 inst1 inst2 inst3 inst2 Inst2* inst1 Cycle 1 Cycle 2 Cycle 3 Cycle 4 Permanent fault in CL1 CLK CL3 out A out S out CL2 out CL1 out Err (a) Permanent Fault in CL1 = ≠ = = inst1 inst2 inst3 inst2 inst1 inst3 inst2 inst2 inst3 inst1 inst2* inst3 inst2 inst2 inst2* inst1 Cycle 1 Cycle 2 Cycle 3 Cycle 4 Transient fault in CL2 CLK CL3 out A out S out CL2 out CL1 out Err (b) Transient Fault in CL2 = ≠ = = inst1 inst2* inst3 inst2 inst1 inst2 inst3 inst2 inst2 inst3 inst1 inst2 inst3 inst2 Inst2* inst1

Verification based

Formal verification techniques have been used in industry not only to ensure the correctness of hardware designs, but also to identify inherent robustness shortcomings in fault tolerant architectures for digital circuits. One of the earliest use of automated formal reasoning to verify fault tolerance of digital circuits in literature dates back to 1986 in [START_REF] Chisholm | An approach to the verification of a fault-tolerant, computer-based reactor safety system: A case study using automated reasoning[END_REF], where Petri nets were used to validate the fault tolerance of a processor architecture. This work defines formal verification as "A vehicle for hierarchically structuring the verification process so that only few claims need to be proven and only a controllable amount of critical assumptions need to be generated". A modern interpretation and use of formal verification in robustness analysis of digital circuits can be found in [START_REF] Fey | Effective Robustness Analysis Using Bounded Model Checking Techniques[END_REF]. This work addresses the problem of large state space and longer observation time needed in simulation based approaches for robustness assessment with the use of formal techniques such as boolean SATisfiablity (SAT)-based bounded sequential equivalence checking.

Besides these contributions many others have shown that, formal approaches to prove fault tolerance are relatively complete with respect to the whole input space in comparison with simulation based approaches. But still these methods do not scale well with the increasing complexity of digital electronic systems and suffer from run time limitations [3].

Empirical Methods

Field Experience based

Field experience based robustness methods rely on data collected form field to assess the robustness of designs. Generally a long history of field data in needed to make expert judgments about the reliability.

Fault Injection based

Besides analysis and field-experience based robustness assessment methods whose accuracy and applicability are significantly restricted, fault injection has emerged as a particularly attractive and viable solution for complex fault tolerant systems [START_REF] Kooli | A survey on simulation-based fault injection tools for complex systems[END_REF]. It allows speeding up fault occurrences to analyze the system response in terms of fault-tolerance capability and performance. Simulation-based fault injection environments need less time and effort to implement and offer better controllability and observability.

Fault Classification

Fig. 2.17: Fault Injection Flow

A Gate-Level Fault Injection Framework

To assess and compare the fault-tolerance capability of the Fault Tolerant architecture, we devised a simulation-based gate-level fault-injection framework. Gate-level simulation provides a suitable paradigm to perform fault-injection experiments because unlike micro architectural-level simulation, it offers high fidelity to model most of the physical defects and transient faults, and is much faster than transistor-level simulation. This fully automated fault-injection framework uses a flow shown in Figure 2.17. The flow is partitioned into three sections, each explained in the following subsections.

Fault list generation

In the fault list generation part a parsing script extracts an exhaustive fault site list from either Standard Delay Format (SDF) file or form Value Change Dump (VCD) file depending on the type of faults. Transient and permanent fault sites are extracted form the VCD file and the timing fault sites are extracted from the SDF file. The choice of using the VCD and SDF files for fault site extraction is based on the fact that the extracted sites are good gate-level representations of fault location and are easily interpreted by the gate-level logic-simulator used for fault injection. Another script randomly selects fault sites from the exhaustive fault site list with a possibility of constraining the fault locations to be in the specified design modules. It also associates timings

No. of injections

Specifies the number of faults in the list to be generated.

Injection time range

Specifies the range to constrain the random injection time generation process. Mainly used to ensure that none of the faults are injected during circuit initialization nor at the time too close to the end of the simulation.

Injection duration range

Used for transient faults to specify the pulse width of injected transient fault.

Timing error range

Specifies the range of additional random delay values to be used for timing errors.

Fault Location constraint

Constraints the fault list generation process to produce a faults list according to specified module(s).

Simulation duration

Gives the time of each fault simulation.

Injection type

Indicates whether single of multiple fault injections per simulation with each selected fault site in a constrained-random fashion. The input parameters it uses to control the fault injection are listed in Table 2.1 with their description.

Fault injection

In the fault injection part of the flow the fault injection script recursively runs gate-level simulations in logic simulator and inject faults according to the fault list by controlling it through simulator commands. A test bench generates the required data to be logged for analysis. Depending on the type of design under test, either cycle-by-cycle information is stored during simulations or just the final computed result is logged. The test bench also monitors Err signal and this information is also logged. The SDF mutant script injects timing faults in the SDF file to be used of simulations which involve timing faults. The fault injection campaign script generates a fault injection report.

Based on the possibilities offered by gate-level simulation to inject faults, we model permanent faults as stuck-at faults, SETs as temporary stuck-at faults and timing faults as interconnect delay faults. These fault models and their implications on the fault injection mechanism are discussed in the following subsections.

Permanent fault injection: We use standard stuck-at fault model to represent permanent faults. However instead of arbitrarily imposing stuck-at-0 or stuck-at-1 on the circuit nodes, we base this decision on the logic state of that node at the time of injection, i.e. if it were at logic-level 0 at the time of injection, a stuck-at-1 is forced and vice versa. This modification results in a large number of faults to manifest themselves as errors. A permanent fault is defined by fault location (l) and fault injection time (t). Figure 2.18a shows a timeline illustration of a permanent fault injection campaign. As shown, a fault injection campaign consist of a number of fault simulations specified at the fault list generation step. Each simulation is started and proceeded till time t. At this time the logic value at the injection location l is read and an inverted logic is forced on l. The simulation is resumed till the end of the workload and the collected information is logged into the fault injection logfile.

Transient fault injection: Transient faults are modeled as temporary stuck-at faults, which represent SETs as digital pulses using three parameters, fault location (l), fault injection time (t) and pulse duration (d). As shown in Figure 2.18b transient faults are injected in the same way as permanent except that the forced logic value on l is released after time d form the time it is forced i.e. t. At the end of each simulation the information gathered is saved in the fault injection logfile.

Timing fault injection: Timing fault injection uses SDF mutation technique, which models timing fault as an interconnect delay fault. In this technique the original SDF file generated by the synthesis tool is mutated such that the delay of a specific interconnect (l) is increased by an amount ∆t. As shown in Figure 2.18c at the beginning of each simulation the original SDF file (sdf1) is mutated based on l and ∆t. This mutated SDF file (sdf2) is used for gate-level simulation instead of the original one. Once the workload is finished running and the necessary information is logged and the mutated SDF file is deleted.

Fault analysis and classification

An analysis of the fault-injection report allows us to classify the injected faults into five categories based on the outcomes.

• Silent Faults: Faults that had no effect on the execution of the workload are classified as Silent. The workload terminates normally with no error detection, the result is correct and the contents of pipeline registers and other memory elements are the same as those of golden run.

• Latent Faults: Faults are classified as latent if the workload terminates normally, the result is correct, but the contents of pipeline registers, register-file or other memory elements are not the same as those of golden run. These stored errors can effect the computation at any later time moment when the workload makes use of data at the corrupt memory locations for computation. These types of faults effects are considered critical because they may result in erroneous computation without detection.

• Fail-silent Faults: The workload terminates normally with no error detection and the result computed is wrong. These faults are the most critical as the result computed are wrong without any error indication. • Corrected Faults: The workload terminates normally with at least one error detected, the result is correct and the content of pipeline registers and register-file are the same as that of the golden run.

Simul # 1 Simul # N Workload Simulation t! Simul # 3 Simul # 2 ... "#$%&#'!!"#$%"&'((#(&
• Unclassifiable: Some injected faults result in setup or hold violations and cause unknown logic value X to propagate. These X-propagations are due to limitation of gate-level simulation but in real circuits setup and hold violations may cause a faulty value to be stored in memory elements and this anomaly can be detected by the detection mechanism. Thus, in actual silicon test case these fault will either fall into corrected or silent fault categories, which are non-critical from the robustness point of view. Since using gate-level simulation we cannot make a distinction among them, we put them into the unclassifiable category.

Among these five categories of faults, we consider Latent and Fail-silent faults to be critical in our analysis of fault tolerant capability. These critical faults are the ones that escape the detection and lead to a failure. The ratio of the number of these critical faults w.r.t the number of total injected faults gives a figure of merit to compare the fault tolerant capability of different architectures.

Experimental Comparative Study

Many studies in literature like [START_REF] Mehrara | Low-Cost Protection for SER Upsets and Silicon Defects[END_REF], [START_REF] Subramanian | Conjoined Pipeline: Enhancing Hardware Reliability and Performance through Organized Pipeline Redundancy[END_REF] and [START_REF] Yao | DARA: A Low-Cost Reliable Architecture Based on Unhardened Devices and Its Case Study of Radiation Stress Test[END_REF], provide evaluation results within the scope of the architecture proposed therein. However, it is essential that these similar schemes be comprehensively compared using identical set of experiments and conditions in order to have a meaningful contrast. In this section, we present a comprehensive experimental comparative study of three fault-tolerant architectures with similar fault-tolerance capability in the context of spatial and temporal characteristics of faults and the architectural cost merits, which include area and power consumption. These architectures include partial-TMR and full-TMR [START_REF] Koren | Fault-Tolerant Systems[END_REF] and the HyFT [START_REF] Tran | A Hybrid Fault Tolerant Architecture for Robustness Improvement of Digital Circuits[END_REF][START_REF] Tran | A New Hybrid Fault-Tolerant Architecture for Digital CMOS Circuits and Systems[END_REF].

Experimental Methodology

Experiments are performed to compare the merits of HyFT architectures with partial-TMR and full-TMR architectures. Each architecture is applied to a few of the ITC'99 benchmark circuits and are synthesized using NanGate 45nm Open Cell Library [START_REF] Nangate | NanGate 45nm Open Cell Library[END_REF]. The area figures are obtained from the synthesized designs and power estimates are obtained by taking into account the switching activity generated by back-annotated gate-level simulations. The workload for simulation is a set of patterns optimized for stuck-at fault detection. The reason for using such a workload is to obtain switching activity distributed in all parts of the circuit. The performance overhead is evaluated in two different aspects. Firstly, in terms of temporal performance degradation, which is basically the additional delay in the data-path due to the fault-tolerant architecture (e.g., voter delay in TMR), and secondly in terms of error recovery penalty under a certain fault rate. The fault-tolerance capability of the three schemes is estimated by performing transient and permanent fault injections in the combinational logic parts of the circuits, by using a gatelevel simulation based fault-injection framework discussed in Section 2.3.3. The fault injection parameters used for this experiment are listed in Table 2.2.

During the fault injection campaign a fault-injection report is generated which contains the cycle-by-cycle outcome of each simulation. At the end of fault-injection campaign the faultinjection report is analyzed to classify the faults according to the fault effects into silent, corrected and fail-silent fault. The ratio of the number of fail-silent faults to the number of total injected faults gives us a figure to compare the fault tolerance capability of the four different schemes.

Comparative Analysis

Area and Power Overhead

Table 2.3 gives the average area and power for the BL circuits and the fault-tolerant implementations based on the results of their application on six ITC'99 benchmark circuits in column 2 and 4. In column 3 and 4 it gives their associated percentage overheads of area and power with the BL circuits as reference. The most obvious area and power overhead figures are those of Full-TMR. As it is based on triplicating the CL blocks and also the FF, it occupies a little more than three times the area and consumes a few microwatts over the three times the power consumed by BL implementations. This extra area and power is due to the voter in the Full-TMR scheme. The average percentage of area overhead values in Table 2.3 show that the partial-TMR implementation consumes less in terms of area that is about 155%. The most expensive architectures in terms of area is HyFT, with an average overhead of around 213%.

As far as the power consumption is concerned, HyFT architecture is most efficient based on the average power overhead figure of about 157% in Table 2.3. partial-TMR stands at 173%, making full-TMR the least power efficient scheme. This high power consumption of full-TMR is accounted to the triplication of FF. On the other hand HyFT saves power by having one CL copy in stand-by all the time. The graphs in Figure 2. [START_REF] Chisholm | An approach to the verification of a fault-tolerant, computer-based reactor safety system: A case study using automated reasoning[END_REF] show the percentage increase in area (Figure 2.19a) and power (Figure 2.19b) of the BL circuits to implement the three considered fault-tolerant architectures. Note that the benchmark circuits are arranged in ascending order of their size from left to right on X-axis to illustrate the impact of the size of CL block on the area and power overheads. The dotted lines in Figure 2.19 represent the average percentage figures of area and power overheads for the corresponding fault-tolerant architecture implementation.

An important observation that can be made in the graphs of Figure 2.19 is that, the area and power overheads of both partial and full-TMR are relatively independent of the size of CL block to which they are applied. However, these overheads for HyFT change with different sizes of benchmarks such that the area and power overheads of HyFT decrease with the larger benchmarks. This observation also gives an idea of the anticipated impact on the area and power overheads for CL blocks larger than the benchmarks considered in this study. Although the average area overhead of HyFT is higher than other considered fault-tolerant architectures but with large CL blocks we can expect it to decrease. Whereas the power overhead of HyFT, which is already the minimum, tends to further reduce with larger CL blocks.

Performance

The first evaluated measure of performance is the temporal performance degradation. In partial-TMR and full-TMR, it is defined by the delay of voter circuit in the data-path. In case of HyFT it is due to the delay of shadow latch multiplexers in input register responsible for rollback and the reconfiguration multiplexer and demultiplexer. The comparator being outside the critical path does not contribute to the temporal performance degradation. Using Static Timing Analysis (STA) the temporal performance degradation for partial-TMR and full-TMR was estimated to be 0.73% for a 100MHz operation. The same for HyFT was found to be 9.7% without any design optimization. The figures that can give us a measure of the second considered performance aspect, i.e. the error recovery penalty, can be interpreted from the transient fault injection results presented in Table 2.4. These results are obtained by injecting transient faults at an average rate of 250K faults/second. It can be observed in Table 2.4 that for partial-TMR and full-TMR the percentage of corrected faults is zero. This is because TMR is an error masking technique rather than an error detection and correction one and does not indicate the presence of error. With no provision of identifying the corrected faults, they are kept within the category of silent faults in our analysis. It also indicates that the error recovery penalty for TMR is zero as it corrects errors by masking them instead of undergoing a reconfiguration and re-computation cycle. It can also be seen in Table 2.4 that HyFT corrected on average 7.26% of injected faults. For each detected and corrected SET the HyFT undergoes a recovery phase that takes 2 additional cycles [START_REF] Bottoni | Partial triplication of a SPARC-V8 microprocessor using fault injection[END_REF]. According to these figures, HyFT spends around 14.52% of total computation time on recovering from potentially erroneous states.

Fault Tolerance Capability

Quantitative analysis To compare the fault-tolerance capability of different architectures we analyze them in terms of the percentage of faults that resulted in a fail-silent outcome among the total number of injected faults. Table 2.5 gives the transient fault-injection experiment results. Table 2.5 shows that the incorporation of each fault-tolerant architecture into the BL circuit reduces the percentage of fail-silent faults to a different extent. The average percentage of failsilent faults that was originally 7.56% in BL is brought down to 0.03% by partial-TMR. A through analysis of the fault-injection report revealed that these 0.03% faults were among those which were injected at the inputs of CL blocks and affected all the three TMR copies in the same way, thus resulted in a common-mode failure. Full-TMR on the other hand did not encounter this problem because of it construction and turned out to be the most effective by tolerating the effects of all the injected transient faults. In case of HyFT 0.28% of injected faults escaped detection and affected the results. With further investigation we found out that these fail-silent outcomes were not linked to a specific location as in case of partial-TMR, but escaped detection due to their specific timing characteristics. Static timing analysis showed that these 0.28% fail-silent faults were among those that were injected at a time such that their effects appeared at the inputs of register during the clock setup-hold window. Since in HyFT the comparison-window does not overlap the setup-hold window, these transient faults managed to affect the data during captured but escaped detection by missing the comparison-window. This problem of non-overlapping setup-hold window and comparison-window is analyzed in Chapter 4 and an improved version of HyFT architecture is proposed that solves the problem.

Similar observations can be made from the permanent fault injection results shown in Table 2.6. An average 1.36% of faults injected in partial-TMR result in fail-silent outcome, mainly due to the common-mode effect. Full-TMR shows nearly complete tolerance against permanent faults and in HyFT 0.08% faults escaped detection mainly due to the setup-hold window and comparison-window separation.

Qualitative analysis Some aspects of fault-tolerance capability that have an implication on the lifetime reliability of the circuit cannot be inferred from the fault injection experiment result discussed in the previous subsection. Therefore, we analyze them qualitatively here.

When a circuit enters into the wear-out phase of it's lifetime, most of the wear-out mechanisms show early symptoms as increasing signal propagation latency prior to inducing permanent device failures [START_REF] Diehl-Nagle | Single Event Upset Rate Predictions for Complex Logic Systems[END_REF]. The ability of the HyFT architectures to detect these early symptoms and act upon by causing reconfigurations reduces the aging effects on the system by distributing the stress on two of the three CL copies. The capability of selective sparing helps reduce the rate of failures and increase the life span of circuit parts that embed such fault-tolerant architecture. Another qualitative aspect of fault-tolerance capability is fault accumulation effect that distinguishes both considered versions of TMR from HyFT. TMR is an error masking architecture that does not indicate the presence of error, instead just corrects them until only one computational copy exhibits an error. When faults accumulate due to wear-out and multiple copies start getting affected, TMR fails to correct them and the lack of any provision of indicating error ends up in fail-silent outcomes. Whereas HyFT is able to correct errors until two faulty copies manifest the effect of fault at the output in a same way at the same time, which is very less likely. In all other possible scenarios HyFT, if cannot correct can at least indicate the presence of error and continue fail-safe operation.

Summary

Table 2.7 gives a summary of comparison of the architectures discussed in Section 2.2, also listed in column 2 of the table. Columns 3, 4 and 5 specify the type of fault that these architectures have the capability to detect and correct. Column 6 and 7 identify which of these architectures have or can possibly incorporate power conservation and performance improvement features of DVS and DFS. The architectural components that each scheme replicates is given in column 8. Columns 9, 10 and 11 give some figures of area, power and error recovery overheads respectively, associated with some of these architectures. Finally the last column determines which of these schemes also improve the lifetime reliability of the circuit.

We classified these architectures in two categories, those which provide protection against permanent, transient and timing faults as Full Protection solutions and those, which can handle a subset of these types of faults as Partial Protection solutions. Partial-TMR, Full-TMR, DARA-TMR and HyFT architectures fall in the first category. On the other hand, Razor is intended to detect and correct timing errors, and STEM and CPipe architectures are capable to deal with transient and timing faults, thus are considered partial protection solutions. However, some of these partial protection techniques have features like DVS and DFS, as can be seen in columns 6 and 7, which is not the case with full protection schemes considered here. On the other side, the HyFT architecture, due to its unique error detection and micro-rollback capability, becomes an ideal candidate for the application of these performance and power optimization techniques. Now if we focus our attention to the overheads associated with each of the architectures that offer protection against all the three type of faults, we can observe that HyFT incurs area overhead more that Partial-TMR and Full-TMR. Although there is no experimental data available about area cost of DARA-TMR in literature but it would be certainly more than HyFT because it uses CL and FF triplication, whereas HyFT triplicates CL only. In addition, DARA-TMR uses three times more comparators than HyFT. It can be observed in Table 2.7 that HyFT saves a significant amount of power in comparison with Partial-TMR and Full-TMR. The error recovery overhead for Partial-TMR and Full-TMR is zero because TMR is an error masking technique instead of an error detection and correction scheme. As its name suggests, DARA-TMR is also based on TMR but treats permanent fault occurrence as a very rare phenomenon and does not offer a fast reconfiguration mechanism. On the other hand, HyFT incurs an error recovery penalty of either 2 or 4 cycles to mitigate any type of fault. Although the partial protection schemes considered here have slightly lower error recovery penalties, they cannot be compared with that of HyFT because of the difference in their fault-tolerance capability. Among the eight fault-tolerant architectures considered in this comparison, HyFT is the only one that offers a life-time reliability improvement by selectively sparing the weakest CL block as discussed in Section 2.4.2.3. From this comparison it can be inferred that the HyFT architecture offers a fault tolerant capability almost equivalent to Full-TMR structures but with additional benefits of power saving and lifetime reliability improvement and also provides the opportunity to apply power conservation and performance enhancement techniques like DVS and DFS. No data in [START_REF] Johnson | Design and Analysis of Fault-tolerant Digital Systems[END_REF] No data in [START_REF] Johnson | Design and Analysis of Fault-tolerant Digital Systems[END_REF] No data in [START_REF] Johnson | Design and Analysis of Fault-tolerant Digital Systems[END_REF]

Razor [29] ✓ ✓ FF×2 1%-3% 3.1% 1 cycle STEM [5] ✓ ✓ ✓ FF×3 14%-15%
No data in [5] 1 or 3 cycles CPipe [START_REF] Subramanian | Conjoined Pipeline: Enhancing Hardware Reliability and Performance through Organized Pipeline Redundancy[END_REF] ✓ ✓ ✓ CL×2, FF×2 No data in [START_REF] Subramanian | Conjoined Pipeline: Enhancing Hardware Reliability and Performance through Organized Pipeline Redundancy[END_REF] No data in [START_REF] Subramanian | Conjoined Pipeline: Enhancing Hardware Reliability and Performance through Organized Pipeline Redundancy[END_REF] 1 cycle

Full Partial-TMR ✓ ✓ ✓ CL×3 155% 173% 0 cycles Full-TMR ✓ ✓ ✓ CL×3, FF×3 207% 206% 0 cycles DARA-TMR [108, 107] ✓ ✓ ✓ CL×3, FF×3
No data in [START_REF] Yao | A Stage-Level Recovery Scheme in Scalable Pipeline Modules for High Dependability[END_REF][START_REF] Yao | DARA: A Low-Cost Reliable Architecture Based on Unhardened Devices and Its Case Study of Radiation Stress Test[END_REF] No data in [START_REF] Yao | A Stage-Level Recovery Scheme in Scalable Pipeline Modules for High Dependability[END_REF][START_REF] Yao | DARA: A Low-Cost Reliable Architecture Based on Unhardened Devices and Its Case Study of Radiation Stress Test[END_REF] No data in [ Pipelined Hybrid Fault Tolerant Architecture

In computer systems, pipelining is defined as "an implementation technique whereby multiple instructions are overlapped in execution; it takes advantages of parallelism that exists among actions needed to execute an instruction" [START_REF] Hennessy | Computer Architecture, Fifth Edition: A Quantitative Approach. 5th[END_REF]. Pipelining is one of the key methods used to increase the throughput of digital systems such as microprocessors by splitting up each instruction into a sequence of steps so that different steps can be executed concurrently in parallel, rather than processing each instruction one at a time.

We start this chapter with a discussion on how errors can propagate in complex pipeline structures focusing on the specific pipeline properties that make error detection and correction difficult. We will extend the capabilities of HyFT architecture with some architectural modification that allow it to address these problems of error confinement, while doing that, we will formulate the principles of the new Pipelined Hybrid Fault Tolerant (PHyFT) architecture. We will also present the details of a comprehensive case study carried out to prove the effectiveness of PHyFT architecture to improve the robustness of practical pipeline structures and to compare it with other state-of-the-art techniques. Eventually, we will present the experimental results obtained form the case study and will conclude the chapter.

Error Propagation in Pipelined Circuits

Similar to stand-alone logic circuits, pipeline architecture may also suffer from transient, permanent and timing errors. Furthermore, in these structures, there are error propagations between pipeline stages which require special error detection and re-computation schemes for error correc-

Linear Pipeline

A pipeline in its simplest form, in which the entire datapath traverse successively through each pipeline register without any signals bypassing any of the pipeline registers is called a linear pipeline. In this example, we can see that at the beginning of Cycle 2, the fault is captured by the Pipeline Register A and remains active as error at the output of Stage A while Stage B is executing the first instruction. At the next clock edge, the error appears at the output of Stage B. Consequently, the error appears at the pipeline output during Cycle 4. Eventually, the pipeline returns to normal operation at the fifth period when errors have reached the final register. In this example, we consider transient faults. A similar propagation behavior could be observed in case of hard permanent or a permanent delay fault except that in these two cases all the subsequent instructions would be effected by error because of the persistent nature of the faults.

We saw that the error latency depends on the number of stages the error traverses before becoming observable. In deep pipeline (with a greater number of dependent steps), and an error detection mechanism at the output of the long chain a deep rollback-recovery would be needed to tolerate the error effects. These deep rollbacks have a significant impact on circuit performance specially in high error rate environments and are considered an overkill solution for error recovery.

Nonlinear Pipeline

The presence of feedback and feed-forward signals give a pipeline its nonlinear nature. These "loosely-bounded" signals between stages are commonly found in microprocessor pipelines for functions like register write-back, program counter iterations, branch addressing, datapath control signaling etc. Furthermore, the number of these signals increase if the microprocessor also incorporates advanced features like hazard detection and data-forwarding [START_REF] Wali | A Hybrid Fault-Tolerant Architecture for Non-Linear Pipelines[END_REF]. These advanced features are intended to improve performance by increasing hardware resource utilization. However, they change the error propagation behavior of the pipeline. Here we saw that in non-linear pipelines the error effects may not remain confined within the faulty stage during one clock period but can propagate to other stages through pipeline feedback and feed-forward connection. This property of nonlinear pipelines makes error detection and making reconfiguration decisions a non trivial task.

Pipeline with Memory Interface

Memories in datapaths also change the error propagation dynamics of the pipeline. Memories in datapath make error detection difficult because of their inherent nature of making error latent inside them, if a data or address anomaly occurred during write operation. No matter how deep the rollback-recovery scheme, it cannot ensure to have a checkpoint to return back in execution where the write operation can be repeated to tolerant the error latent in memory unless intelligent checkpointing schemes are employed. Although these advanced checkpointing schemes are effective in increasing the robustness of pipelines with memories, they remain a burden on performance of such systems.

Extension of HyFT Architecture to Pipelined Structures

Basic Pipeline Cascading

In this section with the help of a simple example, we explain some necessary considerations and work through the problem of extending HyFT architecture to make it applicable to simple pipelined circuits.

In Section 2.2.7, we discussed the non-pipelined implementation of HyFT architecture for stand-alone circuits. Now consider two such hardened stages cascaded together to form a two- In order to maintain synchronization, both the stages in thus formed pipeline should rollback in chorus when needed. This means that rollback is a centralized functionality of the entire pipeline and can be handled by a single rollback signal generated by the control logic. Unlike rollback, reconfiguration remains a distributed functionality because the reconfiguration state of each stage should be maintained individually according to the error profile of that stage. In order to incorporate a centralized rollback and distributed reconfiguration functionalities, the new control logic for PHyFT architecture is constructed to have a block that manages centralized functionalities like rollback and generating global error (Err_global) signal and distributed blocks for handling distributed functionalities like reconfiguration and delayed clock generation. The resulting structure of control logic is shown in Figure 3.4.

In the non-pipelined implementation of HyFT architecture shown in Figure 2.15a, the pseudodynamic comparator is placed across a register without any roll-back capability. Since the output register always holds a copy of data computed by the second running Combinational Logic (CL) block, the pseudo-dynamic comparator flagged error only when there are inequalities in the two data due to an error. In the case of cascaded stages as shown in Figure 3.4, the pipeline registers having pseudo-dynamic comparator across them also incorporate rollback capability. This gives rise to a problem of false error flagging during rollbacks. The problem is graphically illustrated in The problem of false error flagging is solved by disabling the comparison in all the error free stages for one cycle that follows error detection in one of the stages. The disabling of comparison is realized by inserting additional logic, shown in Figure 3.6, in the distributed control logic blocks. This additional logic masks the delayed clock signal (DC_B) if the Err_global signal is asserted but the Err_B is not, as shown in the truth table given in Table 3.1. With this correction in place, the timing graph for transient error correction is shown in Figure 3.7. Notice that the disabled comparison-window of Stage B is represented by a non-shaded dotted line box.

Stage/CL Classification and Partitioning

Formulation of a stage-level error detection and recovery scheme for a complex pipeline needs to consider the presence of feedback and feed-forward signals and memories because these pipeline attributes have an impact on the error propagation behavior of the processor as seen in Section 3.1. In the next section we discuss the implications of this considerations on the design of the

= inst1 inst2 inst2 Inst3* Inst3* inst2 inst1 inst2 inst1 inst2 inst1 inst2 ≠ ≠ ≠ ≠ ≠ = inst2 inst3* inst2 inst3* inst2 inst2 inst3 inst3 inst4 inst4 inst3* inst3
False Error Flag False Error Flag False Error Flag PHyFT architecture. But first, in order to simplify this discussion we give following definitions that classify the pipeline stages on the bases of aforementioned characteristics:

• Bounded stages: We classify the pipeline stages containing CL blocks that have all their inputs and outputs bounded by a single pair of consecutive pipeline registers as shown in Figure 3.8a, as bounded stages. A pipeline entirely made up of bounded stages forms a linear pipeline. These type of pipelines have a simple error propagation behavior as seen in Section 3.1.1, because an error in one stage remains confined in that stage for one clock period time and can be detected with an error detection mechanism placed at stage level granularity.

• Loosely-Bounded stages: The stages containing CL blocks that either generate or receive pipeline feedback or feed-forward signals are classified as loosely-bounded stages. We further divide them in two classes:

-Influencing stages: The stages with CL blocks that supply feedback or feed-forward signals to CL blocks in other stages of the pipeline are classified as influencing stages. An example of influencing stage is given in Figure 3.8b. These CL blocks not just feed signals to the following pipeline register but also to other stages.

-Influenced stages: We refer stages with CL blocks that receive feedback or feedforward signals form CL blocks in other stages as influenced stages. Which means that these CL blocks besides getting inputs from their preceding pipeline register also get input signals from other stages. Figure 3.8b shows an example of influenced stage.

• Unbounded stages: This class of stages holds those with memory interface. The presence of memory interfaces in a pipeline stages make them venerable to latent faults, even if the memories are hardened using error detection and correction codes.

Implication of this classification on the implementation of the error detection and recovery scheme are discussed in next subsections.

Dealing with Error Propagation in Nonlinear Pipeline

Error manifestation due to faults in bounded and influenced stages remain confined within the stage itself during one clock period because of the absence of feedback or feed-forward connections that generate from these stages. Thus, error detection mechanism at the output of these stages is solely sufficient to detect these errors. Whereas in case of an influencing stage the fault effects may or may not remain confined in that stage during one clock cycle, because of the asynchronous feedback and feed-forward signals to other influenced stages. Figure 3.9 shows a hardened version of the non-linear pipeline of Figure 3.2 using PHyFT architecture. Stage B of the pipeline is an influencing stage indicated by the orange shaded region surrounding it. To be able to detect errors, which are due to faults in Stage B and have manifested themselves at the output of Stage A, the PHyFT Architecture duplicates the feedback and feed-forward signals represented by the pair of orange dotted lines in Figure 3.9. If there were only a single set of feedback and feed-forward signals, an error propagating through them would affect both running copies of CL block in the influenced stage in the similar way and may result in a common-mode failure.

The stage-level reconfiguration framework for recovering from permanent faults presented here is also based on the classification of CL discussed in Section 3.2.2. Let us assume that an error is detected at the output of Stage A. This error can be the result of fault occurring in itself or this error may have propagated to it through the pipeline feedback paths from Stage B. In such case, the PHyFT architecture cannot identify which stage is actually faulty, thus all the suspected stages (which includes Stage A and Stage B) undergo a reconfiguration. In PHyFT this is achieve by ORing the error signals of Stage A and Stage B and using this signal as the error input of the Stage B centralized and distributed control logic blocks as shown in control logic block of Figure 3.9. To generalize this principle of PHyFT we can say that the newly derived error signal for each influencing stage in the pipeline will be logical OR of the error signals of all the stages it influences.

Error detection in Pipeline stages with memory interface

Memories generally take a large amount of silicon area, which makes it impractical to duplicate or triplicate them in order to improve system reliability. On the other hand their regular structure makes error detection and correction codes like Parity and Hamming much feasible. These methods have been in use to efficiently and effectively protect them against SEUs and permanent faults. But that is not enough to ensure the reliability of overall system if an unprotected CL driving the memory inputs and/or if an unprotected CL processes its outputs before being fed to the next pipeline register. In such cases, data anomalies during write operations are especially 4#8).#-)!@))*'21A!B#0-2.! Fig. 3.9: Error detection and reconfiguration scheme in non-linear pipeline difficult to detect because during write operations there is no data at the output to compare and detect errors and such situations give rise to the number of latent faults which are even more difficult to detect once they reappear, due to common mode effects. In the following subsections we will see what solutions the PHyFT architecture offers to improve the robustness of pipelines with memories.

Pipeline Stages with non-concurrent read-write access memories

Dual port memories have been previously used as a means of communication between copies of redundant CPU [START_REF] Balaji | Modeling ASIC memories in VHDL[END_REF]. In our architecture we propose a similar use of dual-port memory. In addition to that, memories are described in VHDL to have write-transparency property. This property makes the memory latch to be transparent during write operations which means that if a memory location is being updated as a result of a write operation, the data that is being written into the memory location appears on the data output bus as well [START_REF] Balaji | Modeling ASIC memories in VHDL[END_REF]. The use of dual-port write transparent memory allows propagating any error occurring in one of the two working copies of CL driving the memory, to the following pipeline register where they can be detected by the comparator. Read operations are by nature transparent so there is no need to take them into special consideration. An example of the use of dual-port write-transparent memory can be seen in Figure 3.10. The two input ports of the memory, which are labeled as P in 0 and P in 1 are supplied with memory data and control signals from the two running CL copies. The two output ports labeled as P out 0 and P out 1 feed the pipeline register and the pseudo-dynamic comparator respectively. However, the address bus comes directly from the preceding pipeline register and is assumed to be error-free because in the scope of this thesis we do not deal with the errors caused due to faults occurring in memory elements.

To evaluate the cost in terms of area, power and performance of the implementing writetransparency property and adding a port to a memory, we synthesized VHDL instances of a small memory block of 512 bytes using 45nm technology [START_REF] Nangate | NanGate 45nm Open Cell Library[END_REF], with and without the write-transparency and dual-port features. The resulting area, average power and access time estimates are given in Table 3.2. The estimates show that the area overhead associated with these additional features is 3.94% of the original memory with a average power overhead of 13.9%. However, through STA we found that there is no impact of these additional features on the access time of the memory.

One limitation associated with this memory modification is that it can only tolerate errors on data and partially on the control buses of the memory. Anomalies on address bus can not be detected because there is no possible way to make memory transparent for address data. Furthermore, it is important to note here that, since a transparent write operation can not concurrently coexist with a read operation, the applicability of this approach is only limited to memories without simultaneous read-write operations. Therefore, in the following subsection we detail the architectural modifications to be able to detect error in pipeline stages with concurrent read-write memories regardless of the error location.

Pipeline Stages with simultaneous read-write access memory

For the memories that do not allow write-transparency feature, we propose a simple solution to the problem of detecting errors at the memory inputs. It involves placing an additional set of pipeline register and a pseudo-dynamic comparator on the input ports of the memory. The scheme is illustrated by the example implementation in Figure 3.11, were a simultaneous read-write access synchronous memory is protected against error due to fault arising in the CL blocks that drive its inputs. The additional pipeline register is placed on the memory input coming from the first running CL block and the pseudo-dynamic comparator is anchored on to the signals from secondary running CL copy. These additional components are shaded in grey color in Figure 3.11 for easy identification. At each capture edge the additional pipeline register stores the data at the inputs of the memory and during the comparison-window the pseudo-dynamic comparator check for any inequalities in the stored data and the one generated by the secondary running copy. In the case of mismatch the pseudo-dynamic comparator reports error to the centralized control logic, which in turn initiates a rollback and the memory operation is repeated. Notice that there is no need of having a shadow latch array with the additional pipeline register because the additional register does not play any roll in the pipeline data path and thus does not need to rollback.

Unlike the previous solution, this method is based on detecting error right at the input of memory blocks instead of relying on comparison of data propagated through the memory. It can also detect error on the address bus of the memory.

!""#$% &'()*+,-./)0%"., [START_REF] Binder | Satellite Anomalies from Galactic Cosmic Rays[END_REF] 3"'+.%,44.00%5.(/"6%

Case Study: Fault Tolerant Microprocessor

The PHyFT architecture was implemented on a MIPS microprocessor with the objective to assess it with respect to area, power and performance overheads and its fault-tolerant capability and to compare it with a classical TMR scheme with bit-wise voter (TMR-b) and a TMR scheme that uses word-wise voter (TMR-w). Area estimations were obtained for five different versions of the microprocessor namely Baseline (BL), Hybrid Transient Fault Tolerant (HyTFT), Hybrid Transient and Permanent Fault Tolerant (HyTPFT), TMR-b and TMR-w by synthesizing them with a 45nm technology library [START_REF] Nangate | NanGate 45nm Open Cell Library[END_REF]. A simple workload program (provided in Appendix A) that uses add-shift method to multiply two operands was used to obtain switching activity for each microprocessor version and using this activity, estimates of average power consumption were obtained. The fault-injection framework discussed in Section 2.3.3 was employed to comprehensively evaluate the fault-tolerant capability of the microprocessors against transient, permanent faults and timing faults. Details of the five different versions of microprocessor are given in subsequent subsections.

BL Microprocessor

The microprocessor used as our case-study platform is a 5-stage MIPS processor. It incorporates hazard-detection and data-forwarding mechanisms. The microprocessor was developed as an academic learning exercise without considering any fault-tolerance capability. Some definite specifications of the baseline microprocessor are given in Table 3.3.

A simplified block diagram of the BL microprocessor is shown in Figure 3.12. The datapath is divided into five pipeline stages namely; Instruction Fetch (IF) stage, Instruction Decode (ID) stage, Execution (EXE) stage, Memory (MEM) stage and Write-back (WB) stage with their corresponding CL blocks, separated by five pipeline registers labeled as 1 . The microprocessor incorporates three memory blocks, which include the asynchronous instruction memory labeled as 2 , synchronous read-write access register-file with simultaneous read-write access labeled as 3 and synchronous data memory labeled as 4 . ' "" ( ""

All the signals shown in

) "" ! *+,-.+/-"0-1+23-42"" # 526/7849/9:2";/234:7<9/"=->946" % ;/?:-/7+/1"@A" % B6/7849/9:2"0-1+23-4"C+.-"" $ 526/7849/9:2"DE3E"=->946" & ;/?:-/7-F"@A"

( "G4+3-HIE7J"B+1/E.2" ) DE3E"C94KE4F+/1"B+1/E."

& L-M3";/234:7<9/"5FF4-22"B+1/E." ' N4E/78"5FF4-22"B+1/E." ( O/I9:/F-F"@A" ;D" @A" PQP" @A" =P=" @A" GN" @A" ;C" @A" ;/234:7<9/"C-378"R;CS" B3E1-" ;/234:7<9/"D-79F-"R;DS" B3E1-" PM-7:<9/"RPQPS"B3E1-" =->946"R=P=S"B3E1-" G4+3-HNE7J"RGNS" B3E1-" Fig. 3.12: Baseline Microprocessor stages, because they generate signals that go to the asynchronous data memory and synchronous register-file respectively.

HyTFT Microprocessor

In Section 2.2.7 we discussed the duplication and comparison based HyTFT architecture capable of tolerating the effects of transient faults and detecting permanent and timing errors in stand-alone circuits. Later in Section 3.2 we formulated the principles of PHyFT architecture to extend the usability of HyFT architecture to complex pipeline circuits. Utilizing these principles we realized the HyTFT microprocessor, represented by a simplified block diagram in Figure 3.13.

! "" ""

! "" ""

! "" ""

! "" ""

! "" "" ;<=:><"?<@:AB<CA"" & ->ABCDEFG>"5<HGCI" J "9A<DKGLKI>MH:E"/GH;MCMBGC" " ) NI>EOCG>GDA".DM=LC<MK"?<@:AB<CA"8:=<"" ( .DM=L;GCB"PAI>EOCG>GDA".MBM"5<HGCI" * ->QD<>E:>@"/0" ' "6C:B<LRMES"N:@>M=A" , .MBM"8GCTMCK:>@"N:@>M=" 11 U>RGD>K<K"/0" * V<WB"->ABCDEFG>"PKKC<AA"N:@>M=" + 7CM>EO"PKKC<AA"N:@>M=" * ->QD<>E<K"/0" ->ABCDEFG>"8<BEO"X-8Y" NBM@<" ->ABCDEFG>".<EGK<"X-.Y" NBM@<" 3W<EDFG>"X343Y"NBM@<" 5<HGCI"X535Y"NBM@<" 6C:B<"7MES"X67Y" NBM@<"

##$%" ##$%" ##$%" ##$%" & "" ' "" ( "
##$%" %" ##$%"
! "" ""

Fig. 3.13: HyTFT Microprocessor

It can be noticed that not only the CL blocks in each stage, but also the pipeline feedback signals are duplicated. The feedback connection duplication allows the detection of errors that propagate through these feedback connection from influencing stages to influenced stages as distinguished by orange and blue shaded regions respectively in Figure 3.13.

A practical utilization of a dual-port write transparent memory can be seen in the MEM stage of the HyTFT microprocessor. The block labeled as 6 represents the asynchronous data memory with two ports and incorporated write transparency property. Any transient, permanent or timing faults occurring in the unbounded MEM stage that could potentially become latent in memory can be detected by the following pseudo-dynamic comparator.

As discussed in Section 3.2.4, in order to detect errors on the synchronous memory interface we placed an additional set of pipeline register and a pseudo-dynamic comparator on the signals that go from the unbounded WB stage to the synchronous register-file, the block labeled as 5 .

Unlike the asynchronous data memory and the synchronous register-file, the asynchronous instruction memory gets its inputs from a pipeline register and not form a CL block. Since the context of this thesis does not encompasses the problem of SEUs caused due to faults in flip-flops, we do not employ any special technique to protect the asynchronous instruction memory from such problems.

HyTPFT Microprocessor

Starting with the BL microprocessor, the Hybrid Transient and Permanent Fault Tolerant (HyTPFT) microprocessor was realized by triplicating CL blocks, duplicating feedback and feed-forward signals, inserting reconfiguration switches, modifying pipeline registers to incorporate rollback capability and by adding pseudo-dynamic comparators and acHyTPFT control logic blocks. An architectural overview of the resulting structure is shown in Figure 3.14. Clouds represent CL between pipeline registers. Three different memories are embedded in the microprocessor structure which are instruction memory, register-file and data memory. It can be seen that the data memory has two ports and thanks to its write transparency, any fault in the MEM stage CL block can be detected by the following comparator as elaborated in Section 3.2.4. It can also be noticed in Figure 3.14 that an additional set of pipeline register and comparator is placed after the WB stage. These additional components are there to detect errors on write-back signals feeding the simultaneous read-write access synchronous register file memory as we saw in Section 3.2.4.2. . /(+,-0123("4&53-6" 7 8&50'2%'&9&-" : "#+&0;3<;6(=5$1">35%=-=,3-" " : 40'2%'&9&-" ? @6(1A-3(30+"80='<-&=;")&*$+,&-+"B$'&"" C 80='<%3-,"D+6(1A-3(30+"8=,="4&53-6" E /(F0&(1$(*">G"

H "I-$,&<J=1K"@$*(='+" L 8=,="B3-M=-;$(*"@$*(='" NN O(J30(;&;">G" " E P&9,"/(+,-0123("D;;-&++"@$*(='" Q R-=(1A"D;;-&++"@$*(='" E /(F0&(1&;">G" " SSTU" Fig. 3.14: HyTPFT Microprocessor

TMR-b Microprocessor

The TMR-b microprocessor is realized by triplicating the CL blocks in each stage of the pipeline and using a bit-wise voter that selects one CL output, which has at least one common equivalent, to be feed to the next pipeline register. The resulting scheme is represented by the simplified block diagram of Figure 3.15. In this way, each stage is dealt within its scope irrespective of its type (i.e. bounded, influencing, influenced or unbounded). In case of unbounded stages, since the voter masks all the types of error before they can potentially be stored in the memory, there is no need to use special memories to detect errors at the input of the memories.

TMR-w Microprocessor

The TMR-w microprocessor also has the same architecture as of TMR-b, shown in Figure 3.15. The only difference is the type of voter used. TMR-w microprocessor uses a word-wise voter that makes the voting decision based on the equivalence of entire words instead of individual bits. The word-wise voter has an additional output error which turns to logic-1 if the vote is impossible (i.e. no equivalent couple of input words exists).

Experimental Results

Experimental results in terms of area, power, fault tolerant capability and performance were obtained by first preparing Register Transfer Level (RTL) models of the five microprocessors version discussed in previous subsections. These models were then synthesized hierarchically using Synopsys ® Design Compiler with a 45nm technology library [START_REF] Nangate | NanGate 45nm Open Cell Library[END_REF]. The area estimates were obtained from the synthesized gate-level design models and the average power estimates were obtained from back-annotated gate-level simulations of workload program (Provided in Appendix A) that multiply two 16-bit operands using shift-add method. The fault injection framework discussed in Section 2.3.3 was used to perform transient, permanent and timing fault injection experiments with parameters given in Table 4.5a. Fault tolerance capability and performance overhead results were deduced from the fault injection results.

Area Overhead

The area overhead figures obtained for the five microprocessors are given in Table 3.5 along with the individual share of each component making up the microprocessor. The first column lists these design components and the subsequent columns give the absolute value of area and also the percentage share of each component in comparison with the corresponding component in the BL microprocessor. Most of the components show obvious amounts of increase when compared with BL for example, the CL blocks of HyTFT microprocessor are twice as large as those of the BL. The rest of the microprocessor versions employ triplication and thus, their CL blocks consume three times in comparison with BL.

Besides the CL blocks HyFT microprocessors have memories that consume 102% area of that of BL. This increased area is accounted to the dual-port write-transparency feature of the data memory in HyFT microprocessors. This area share is 100% for the two TMR microprocessors because they do not employ these features in their data memory. The HyFT microprocessors not only incorporate shadow latch arrays in their pipeline register but also use an additional pipeline register for error detection at the inputs of the synchronous simultaneous read-write access register file memory, therefore the area occupied by their pipeline registers is estimated to be 216% with respect to the pipeline registers in BL, TMR-b and TMR-w microprocessors. Table 3.5 also gives the area occupied by some components that are associated with one architecture only. Among these, an important figure to be compared between the four fault tolerant microprocessors is the area of their error detection hardware. We can see that the area of the pseudo-dynamic comparators is only 273 µm 2 , which is significantly less than the area of bit-wise voters and word-wise voters, which are 1538 µm 2 and 3065 µm 2 respectively.

The last row of Table 3.5 gives the total area figures and their percentage with respect to the total area of the BL microprocessor. According to these figures the most efficient candidate in terms of area is the HyTFT microprocessor. But its fault tolerance capability is limited to transient faults only. TMR-b and TMR-w microprocessors have area that is 187% and 190% of the BL microprocessors respectively. The most area consuming candidate is HyTPFT microprocessor which stands at 203% of the area of our reference microprocessor. Figure 3.16 gives a summary of overhead cost in terms of area. The height of each bar represent the total area of each microprocessor version. In each bar different colored regions represent the area occupied by individual components of the microprocessor. On the top, the total area in µm 2 is reported. The area overhead of HyTPFT microprocessor is 103% with respect to the BL microprocessor. This area is less than three times, since only the CL parts are triplicated in comparison with the basic approach [START_REF] Dubrova | Fault-Tolerant Design[END_REF], triplicating the entire microprocessor structure (including the memory). The TMR microprocessor versions incur lesser area overhead of 87% and 90% respectively for TMR-b and TMR-w. In comparison with HyTPFT this reduction is mainly due to the absence of reconfiguration multiplexers and demultiplexers and rollback shadow latches.

Power Overhead

Table 3.6 shows the power consumption results with a similar emplacement of area figures as in Table 3.5. Starting with the power consumption of memory, we see that the HyFT microprocessor versions consume slightly over than the memories in BL and TMR microprocessors, which is due to the write-transparency and secondary additional port of data memory. The HyFT pipeline registers, which on one hand occupy 216% area, consume 328% of power with respect of BL pipeline registers. This difference of increase rate is due to the fact that, incorporating shadow latches increase the switching activity in pipeline register with a larger ratio than the increase in area. Therefore we see a significant increase in power consumption of pipeline registers in HyFT microprocessors.

The power consumption in the TMR microprocessors CL blocks is close to three times of that of BL microprocessor. But in the case of HyTFT and HyTPFT this figure is slightly more that twice of that of BL CL blocks. The power consumption in HyFT CL blocks is due to the Figure 3.17 gives the summary of estimations of average power consumption for different versions of the microprocessor. In each bar different shaded regions represent the power consumption share of different components of microprocessors. On the top the total average power in mW dissipated by each microprocessor version is reported. The power consumption overhead of HyTPFT microprocessor is 105% with respect to BL. This power is 11.6% and 11.8% less than that consumed by the TMR-b and TMR-w versions respectively. Fig. 3.17: Power overhead results summary

2(f) 3(f) 3(f) 3(f) (g) 2(g) 3(g) 3(g) 3(g) k=5.6(j) (j) (j) (h) (i) (m)

Fault Tolerant Capability

The results of fault tolerance capability, the key merit for comparison of the four considered fault tolerant architectures, are presented in this section. Figures 3.18,3.19 and 3.20 show the transient, permanent and timing fault-injection results respectively for the five different versions of microprocessor. The bar charts in these figures represent the population distribution of injected faults according to the categories discussed in Section 3.3.6.3 on the basis of their outcome. The bars of each color represent a fault class and the their height represent the number of faults found to fall in that fault category on a logarithmic scale. On the top of each bar, the percentage share of the number of faults in the corresponding fault class in the total of 10,000 injected faults is given. The table attached at the bottom of the bar chart gives the exact number of faults found to fall in each category. Now if we focus on the transient fault injection results shown in Figure 3.18, we can see that in the case of BL microprocessor out of 10,000 injected transient faults 112 and 105 faults resulted in failt-silent and latent outcomes respectively which collectively makes 2.17% of the total injected faults. These faults critically affected the computation of BL microprocessor. Whereas 0.3% of the faults could not be classified and 97.53 % of the injected faults had no effect on the program Unlike BL microprocessor, HyTFT and HyTPFT microprocessors did not undergo any critical failures. However, because of the absence of a discretely observable error flag that can be captured on periodic intervals equivalent to the time period of operation, in TMR-b and TMR-w voters, it is impossible to distinguish between the silent and corrected faults. Thus both of these type of faults are kept in the category of silent faults. An important observation that can be made from the results of TMR-w microprocessor is the presence of 0.19% and 0.15% of fail-silent and latent faults respectively. This suggests that among the four fault tolerant microprocessors TMR-w is least effective in dealing with transient faults.

!"# $%&'&# $%&('&# &)*+,# &)*+-# ./
The severity of the impact of permanent faults on the baseline microprocessor is evident from the high number of faults falling into the category of fail-silent and latent as shown in graph of Figure 3.19. HyTPFT and TMR-b seem to have dealt well with the situations of permanent faults by having none of the faults falling in the category of critical faults. The incorporation of TMR-w architecture in the BL microprocessor seems to have reduced the number of critical failure

!"# $%&'&# $%&('&# &)*+,# &)*+-# ./
# D# =# <# EFAA1G31@#'45036# =# 8;# 9=# =# =# &/B1+F53#'45036# =# <D# =# =# =# '4/0+./0123#'45036# 8=# =# =# =# 7# "43123#'45036# D8# =# =# =# H# 78I9:J# 78I7;J# 77I:9J# <==J# 77I8;J# =I<=J# =I=CJ# =I=DJ# =I=<J# =I8;J# =I9=J# =I<DJ# =I8=J# =I=7J# =ID8J# =I=HJ# <# <=# <==# <===# <====#
!"#$"%$&'(')*$+,-./0$ Fig. 3.20: Timing fault injection results occurrences from 79.71% collectively to only 5.24% but still does not protect against permanent faults as fully as the HyTPFT and TMR-b microprocessors. As per its intended purpose, the HyTPFT microprocessor successfully detected 53.51% of the injected permanent faults, which makes the entire set of observable faults because all the rest were either masked and never showed up or resulted in an unclassifiable outcome. None of the injected permanent faults in HyTFT microprocessor escaped detection to cause either fail-silent or latent errors. This suggests that HyTFT microprocessor maintained fail-safe operation throughout the fault injection campaign.

The timing fault population distribution shown in Figure 3.20 shows a similar trend as for permanent faults but with lesser degree of effect on the computation. The BL microprocessor encountered 80 and 30 fail-silent and latent errors respectively, which is more or less the number of faults detected and/or corrected by HyTFT and HyTPFT microprocessor respectively. Since the timing faults injected were of permanent nature, the HyTFT repeatedly tried to recover form 13 time-out faults. However, TMR-w ended up in 13 critical outcomes.

From the results of three types of fault injection campaigns, we saw that the only architecture, which never resulted in an outcome that cannot be classified in TMR-b. As discussed in Section , these unclassifiable outcomes are due to the X-propagation that results because of setup or hold violations. The reason of not having any unclassifiable outcomes in TMR-b is associated with the property of TMR-b voter that it can mask these X-propagations and preventing it from spreading throughout the execution. However the small number of unclassifiable faults outcomes in other microprocessor versions does not have any impact on the conclusion that can be drawn from these results because X-propagations occur only in simulations. In real silicon implementation a setup or hold violation will result in either a correct computed value or a wrong one. In case a correct value is stored, there will be no impact on the execution nor on the data. Thus will result in silent outcome. But if the violation cause wrong data to be stored, the error detection and recovery mechanism in HyTFT and HyTPFT can deal with it and the fault will result in a corrected fault category.

Performance Degradation

There are two aspects in which the performance overhead of fault tolerant architecture can be assessed:

• Temporal performance degradation

• Error recovery overhead

The additional components inserted in the BL data-path to implement the HyTPFT architecture, which include reconfiguration multiplexers and demultiplexers and a level of multiplexers in the pipeline registers for rollback capability, are accounted for the temporal performance degradation. Conversely, in the TMR schemes the voter circuit in the data-path is responsible for reducing circuit speed. STA showed that for HyTPFT microprocessor temporal performance degradation is 3.8%. This figure is obtained by comparing critical path delays of CL blocks with the maximum delay of aforementioned additional HyTPFT circuit components. In the same way the percentage of temporal performance degradation were obtained for TMR-b and TMR-w and were found to be 0.9% and 8.5% respectively. These figures show that the HyTPFT architecture incurs less temporal performance degradation then TMR-w but is more costly in comparison with TMR-b.

Performance overhead due to error recovery can be comprehensively measured by performing multiple faults injection campaign and observing the impact on performance due to different error rates. However our single fault injection experiments show that all the errors in HyTPFT microprocessor due injected SETs, 51.8% of the errors due to permanent faults and 77.1% of errors due to delay faults were recovered in a time equivalent to 2 clock cycles. The remaining errors due to permanent and delay faults were mitigated with a penalty of 4 cycles. On the other hand, TMR microprocessor versions have zero error recovery penalties, as TMR is an error masking scheme rather than an error detection and correction architecture.

Discussion

From the experimental results presented in this section we can infer that the PHyFT architecture offers a method to improve the robustness of CL parts of complex nonlinear pipeline processor cores, with little impact on performance and quite modest amount of overhead in terms of area with respect to TMR. Both the HyTFT and HyTPFT microprocessors subjected to a fault injection campaign of 30,000 faults in their CL parts sustained correct of fail-safe operation and offer similar fault tolerance capability as TMR-b scheme with the added advantage of 11.6% power saving.

Summary

In this chapter we have seen some issues in modern complex pipeline circuits that make error detection and confinement a difficult task. We briefly overviewed some state-of-the-art solutions to these problems and their limitations. In the second part of the chapter we went through the steps to develop a Pipelined Hybrid Fault Tolerant architecture based on the Hybrid Fault Tolerant architecture for stand-alone circuits by proposing solutions to the hurdles faced in doing so. In the last section of this chapter we showed how we practically applied the principles of PHyFT architecture formulated in preceding sections, on a case study instance of MIPS architecture microprocessor. Finally we discussed the experiments performed to assess and compare PHyFT architecture with other solutions found in literature.

Chapter 4 Design Space Exploration and Optimization of HyFT Architecture

The case study outcomes in the previous chapter showed that the HyFT architecture can effectively tolerate errors due to transient, permanent and timing faults in the CL parts of complex pipeline circuits with an 11.6% average power saving compared with the TMR architecture. However, it is identified that there is further room for improvement in its efficiency in terms of area, power and performance, by optimizing the comparison-window timing. Furthermore, its applicability can also be improved by adapting it to work with symmetric (50%) duty-cycle clock.

In this chapter we will first analyze some properties of HyFT architecture, which limit its area and power saving, performance (in terms error recovery overhead) and applicability. Later, we will discuss some design and timing optimizations and based on these modifications we will describe four experimental design variants of HyFT architecture. We will analyze the impact of these modifications on the considered design merits. We will also verify that the proposed modifications do not have an adverse impact on the fault tolerance capability. Finally, based on the experimental results we will define the best candidate among the four design variants.

Limitations of HyFT Architecture

Contamination delay constraints

In Section 2.2.7 we studied the timing constraints needed to be imposed while synthesizing the CL blocks to be hardened with HyFT architecture. We saw that to prevent the asynchronous input of the pseudo-dynamic comparator from starting to change before the lapse of the comparison-window it is necessary to make sure that there are no paths short enough to violate the condition of Equation 5.1.

Commercial synthesis tools generally provide provision to apply minimum delay constraints to avoid hold-time violations. These constraints are less stringent than those needed for HyFT CL synthesis. Synthesis tools use techniques like buffer insertion, circuitous routing, gate or wire re-sizing [START_REF] Scheffer | EDA for IC Implementation, Circuit Design, and Process Technology[END_REF], [START_REF] Wu | On timing closure: Buffer insertion for hold-violation removal[END_REF] to increase the delay of short paths in the circuit. When these tools are used for tighter minimum delay constraints to considerably alter the path-delay distribution, as in the case of HyFT architecture, the resulting circuits cost significantly higher in terms of silicon space and power.

Asymmetric clock duty-cycle

In designs that use both, negative and positive edge triggered flip-flops, a symmetric clock dutycycle is important to ensure easy timing closure. Even for designs that use just one polarity of clock to capture data, an asymmetric clock duty-cycle reduces the maximum clock frequency of operation because as the pulse becomes narrower the bandwidth of the signal spectrum increases. Furthermore, the high frequency components present in non-50% duty-cycle signal increase clock induced noise and interference.

As we have seen that HyFT architecture rely on an asymmetric clock duty-cycle to generate necessary control signals, which limits its applicability to circuits that work on both, positive and negative edges and those used for high performance applications. Thus, by removing the dependency of HyFT control signal generation on the system clock duty-cycle we can improve its applicability.

Design and Timing Optimization

The optimization efforts are aimed at reducing the area and power overhead due the minimum contamination delay requirements applied to the CL blocks. As shown in Equation 5.1, these timing requirements can be eased by reducing δ t, which can be achieved by shortening and/or moving the comparison-window closer to the CLK edge. To study the impact of comparisonwindow timing on the four design metrics, i.e. area, power, fault tolerance capability and error recovery overhead, we selected two design parameters to be controlled, which include: This experimental design variant of HyFT is obtained by moving the comparison-window across the CLK capture edge as shown in Figure 4.2d. As in case of HyFT-2a, in this scheme also the comparator is placed before the pipeline register and gets its both inputs from the two running CL copies as shown in Figure 4.3. This scheme uses a 50% duty-cycle CLK with the logic circuit of Figure 4.1g, to generate DC. It can be seen in Figure 4.1h that the start of the comparison-window is a response of the falling edge of the CLK delayed by an amount of time equivalent to the delay of buffer (d buf ) and the end of comparison-window is also delayed form the falling edge of the CLK signal but with a delay equal to the cumulative delay of the buffer and the 'NOR' gate (d buf + d nor ). The amount of δ t for this variant is very minimal as it can be seen in the SPICE-like simulation graph of Figure 4.2d. When used with very narrow comparison-window completely renders the requirement of applying any minimum delay constraints because in that case the reconfiguration demultiplexer and multiplexer contribute sufficient contamination delay to satisfy the overall delay requirement. each HyFT design variant. As discussed in Section 4.2, δ t is the design parameter that can be controlled to ease the contamination delay constraints. From the SPICE-like simulation graphs shown in Figure 4.2 we extract the value of δ t for each HyFT design variant, which are mentioned in the second column of Table 4.1. The third column gives the lower limit of contamination delay constraints obtained by substituting the values of minimum clock-to-output delay of the FFs (t ccq ) to be 80 ps, minimum demultiplexer delay (t cdm ) to be 65.6 ps and minimum multiplexer delay (t cm ) to be 79.7 ps in Equation 5.1. These values are obtained from the technology library data and performing STA. The last column specifies the contamination delay constraints actually applied during the synthesis of CL blocks. It can be noticed in Table 4.1 that as we move the comparision-window back towards the CLK capture edge, it significantly reduces the minimum contamination delay requirements. Eventually, in the case of HyFT-2b the clock-to-output delay (t ccq ) of the flip-flops, the delay of reconfiguration demultiplexer (t cdm ) and multiplexer (t cm ) contribute enough that there is no need of applying any contamination delay constraints while synthesizing CL to be hardened using HyFT-2b architecture.

After synthesizing the CL blocks with contamination delay constraints corresponding to each of the HyFT design variant, we obtain area estimates which are given in Table 4.2. The first column lists the considered ITC benchmark circuits. The remaining columns are grouped according to the concerned HyFT variant. Since HyFT-1a serves as our reference the second column lists only the absolute area of CL blocks synthesized with corresponding contamination delay. While the other groups of columns, besides giving absolute area in µm 2 also gives the percentage area reduction with reference to the HyFT-1a CL blocks. From Table 4.1 and Table 4.2 we can deduce that with a 12% (from 1.00 ns to 0.88 ns), 67% (from 1.00 ns to 0.33 ns) and 100% (from 1.00 ns to 0 ns) reduction of contamination delay constraints there is a 11.3%, 82.1% and 90.3% reduction in CL area respectively. Although all the benchmark circuits show a significant gain in terms of area by easing the contamination delay but larger circuits seem to gain relatively less. The reason being that the larger circuits generally have a smaller percentage of very short paths, thus easing contamination delay has a less significant impact on their area.

RTL Description

As we have seen in Section 4.2, the first considered HyFT design variant is in fact identical to the HyFT scheme discussed in Section 2.4.1. So, the RTL modules are reused to construct HyFT-1a circuits. The other three design variants bare two types of differences from HyFT-1a in their RTL descriptions. These differences are the comparator placement and the comparison-window timing. The former difference is easily made at RTL in the top-level wrapper modules of HyFT-2a and HyFT-2b architectures. The latter difference requires modifications to the control logic modules of HyFT-1b, HyFT-2a and HyFT-2b architectures. We have already seen a glimpse of these modifications in Section 4.2, where we discussed the comparison-window generator circuits. The remaining RTL components to these architectures are similar to those of HyFT. In this subsection we provide the details of the modified control logic modules to generate appropriate control signals for HyFT-1b, HyFT-2a and HyFT-2b architectures.

As architectures HyFT-1a, HyFT-1b and HyFT-2a are all driven by an asymmetric duty-cycle clock , they use a similar control logic submudule1 with the only difference of their comparisonwindow generation components. Figure 4.4 shows the submodule1 in the control logic of the HyFT-1b architecture. The labels on each logic element is its reference and the symbol on the top of each element represent its delay. These delays are critical and essential to be constrained during the synthesis because a complete control of these delays is essential for the proper functionality of the HyFT architecture. HyFT-1b control logic submudule1 is not much different from that of HyFT-1a. The only difference is the addition of an AND gate to end the comparison-window with the falling edge of the CLK. In

Constrained Hierarchical Synthesis

The last step in the experimental setup is constrained hierarchical synthesis of the entire designs. A bottom-up synthesis approach is applied for the synthesis starting from the most time critical components like the control logic till the top-level HyFT wrappers. Comprehensive synthesis scripts are used to make sure that appropriate timing constraints are applied. Special attention is given to the synthesis of submodule1 of the control logic as its timing is essential for proper operation.

Experimental Results

Area and Power Estimation

The area figures for the hardened circuits are estimated from the synthesized designs obtained using method discussed in Subsection 4.3.1.5. Each synthesized design contains a version of the six benchmark circuits, hardened by each of the HyFT design variant discussed in Section 4.2.

The area estimates are presented in Table 4.3. The first column lists the considered benchmark circuits. The second, third, fifth and seventh columns give the absolute values of area occupied by each of the four HyFT design variants in µm 2 . Where as the fourth, sixth and eighth columns give the percentage area savings in case of HyFT-1b, HyFT-2a and HyFT-2b respectively with reference to HyFT-1a architecture. The last row of the Table 4.3 gives the average area savings.

It can be seen in Table 4.3 that HyFT-1b saves on average 20.8% area. By further moving the comparison-window towards the CLK capture edge, the gain increases drastically as in the case of HyFT-2a and HyFT-2b architectures the percentage of average area saving reach to about 60%.

The power estimates are obtained by exercising the synthesized circuits with the workload generated as discussed in Subsection 4.3.1.4. Note that same workload is used with all the hardened version of each benchmark to have a fair comparison. The switching activity information from the back-annotated gate-level simulation is used in power estimation tool to obtain the power estimates. These estimates are presented in Table 4.4, which uses the same structure as of Table 4.3. Power savings show a similar trend as area savings. The average power savings are 6.11%, 48.0% and 54.3% for HyFT-1b, HyFT-2a and HyFT-2b respectively with HyFT-1a architecture as reference.

The area and power results show that easing the contamination delay constraints on the CL synthesis not only saves significant amount of area but also power. We can also deduce from the results that in terms of area and power the best candidate is HyFT-2b as it is the one with least lenient or even no contamination delay constraints at all. However the impact of HyFT-2a architecture on fault tolerance capability and performance is discussed in next subsection before the all rounder candidate can be selected.

Fault Tolerance Capability Assessment

The fault tolerance capability assessment framework detailed in Section 2.3.3 is employed to assess and compare the robustness improvements associated with each of the HyFT design variant. Synthesized circuits are subjected to fault injection campaign with fault injection parameters given in Table 4.5. Table 4.5a lists the parameters common to fault injection campaigns run on all the benchmark circuits, while Table 4.5b gives the parameters associated with fault injection campaigns involving to each individual benchmark circuit. An important parameter mentioned in Table 4.5a is the fault location and as specified, the locations for fault injection as chosen randomly all over the circuits but not only in the CL blocks. This means that the faults are also injected in the reconfiguration multiplexer and demultiplexer, pipeline registers, HyFT control logic and in the pseudo-dynamic comparator.

We recall from Section 2.3.3 that the fault injection reports are used to classify the injected faults on the basis of their impact on the circuit output. Table 4.6 gives the distribution of injected faults among three categories namely Silent, Corrected and Fail-silent (as discussed in Section 3.3.6.3) and their percentages in the total injected faults for each of the HyFT design variant hardened version of each benchmark circuit. The third column of Table 4.6 gives the total number of injected faults in each benchmark circuit implementation. All the subsequent columns are grouped according to the associated HyFT variant, for example, forth, fifth and sixth columns give the number and percentages of faults with Silent, Corrected and Fail-silent outcomes respectively for HyFT-1a implementations of each benchmark circuit. Similarly the remaining three groups of columns give the same information for HyFT-1b, HyFT-2a and HyFT-2b architectures. Moreover, the last row gives the average percentages of faults that fall into the corresponding category.

Fault injection results in Table 4.6 show that on average 0.62% of total injected faults in HyFT-1a resulted in a fail-silent operation. Whereas, these percentages for HyFT-1b, HyFT-2a and HyFT-2b are 0.6%, 0.83% and 0.5%, respectively. This shows that HyFT-2a is the least effective against SETs. The reason for this robustness degradation in HyFT-2a can be explained with the help of the graph shown in Figure 4.10 that shows the average distribution of Fail-silent faults in different parts of the circuits protected by each HyFT design variant. The distribution associated with HyFT-2a architecture shows that four out of eight circuit regions remain relatively vulnerable. The input register with 59 Fail-silent faults, the CL copies with 22 Fail-silent faults, the HyFT-2a control logic with 14 Fail-silent faults and output register with 13 Fail-silent faults. This shows that HyFT-2a not only loses the marginal protection against SETs in the output register by having its comparator moved before the output register, but also misses detection of a significant number of faults injected in the CL blocks because of non-overlapping comparison-window and setup-hold window as shown in Figure 4.1f. Although, the HyFT-2b architecture also has no protection against SEUs due to direct strikes in the output registers, its ability to detect transients which occur close to the CLK capture edge gives it an advantage that makes it the most effective technique in terms of fault tolerance capability.

Performance Evaluation

The performance of the HyFT architecture can be interpreted in three aspects. First, the temporal overhead due to the delay added in the data path by the fault-tolerant architecture components. This aspect of performance remains the same for all the four HyFT variants because they all use the same components, which add a similar amount of delay to the data path. The second merit of performance is the error recovery penalty, i.e. the time needed to recover from a single error. Since all four variants take either 2 or 4 cycles to recover depending on the type and location of fault (as discussed in Section 2.2.7), even this aspect is irrelevant while comparing them. The third and the most important aspect of performance that differs among all the four variants is due to the effectiveness to target the transients that are most likely to result in an error. With this effectiveness, the performance can be improved by avoiding spending time to recover from conditions that are not even erroneous.

The figures that can give us a measure of this aspect of the performance overhead can be interpreted from the fault injection results presented in Table 4.6. It can be observed in Table 4.6 that HyFT-1a corrected on average 7.39% of injected faults. For each detected and corrected SET the HyFT undergoes a recovery phase that takes 2 additional cycles. According to these figures, HyFT-1a spends around 14.78% of the total computation time on recovering from potentially erroneous states. On the other side, HyFT-1b spends only 1.98% of the time in the recovery phase. Besides this, HyFT-2b also resulted in less fail-silent conditions. This clearly shows that the effectiveness to target only the fatal transient faults reduces the computation time and thus saves energy.

Discussion

Figure 4.11 graphically shows the way the four design metrics improve or degrade with each design modification. Each line graph corresponds to one of the four considered design metrics represented as a percentage in comparison with the corresponding metric of the initial design (HyFT-1a). Area, power and performance show very clear trends of improvement with each optimized design. Since the design evolution in moving from HyFT-1a to HyFT-2b causes the timing constraints to be relaxed, the improvements in terms of area and power are quite evident. Similarly, the performance improvement achieved with HyFT-2b signifies the advantage of having the comparison-window placed across the capture edge. The fault tolerant capability measured in terms of average number of fail-silent faults also shows an overall improvement with an exception in case of HyFT-2a. As discussed in subsection 4.3.2.2, the drop in robustness measure in the HyFT-2a variant is due to the lack of protection against SEUs caused by direct particle strikes in

Impact of circuit size on the evaluated metrics

In this section we discuss how the evaluated metrics change with the size of the circuit to which the optimized HyFT architectures are applied. To illustrate this relationship we show in Figure 4.12 the percentage improvement of the evaluated metrics of the HyFT-2b design for each of the considered benchmarks arranged in the ascending order of their size from left to right. The graph shows an overall increasing trend for average area and power reduction. The proposed optimizations seem more effective for larger circuits in terms of area and power improvements because the area that is saved is due to the application of relaxed constraints on the CL blocks. Therefore, the larger the CL block, the larger the improvement in terms of area and power when compared with the initial HyFT architecture. Performance on the other hand shows a relatively regular trend for different sizes of circuits. We can expect that this design merit will remain constant when assessing the improvements for circuits of different sizes. On the other side, the fault tolerance capability improvement shows an irregular trend and seems not to depend on the circuit size.

!!"#!$% &#"'($% &)"*#$% &)"'&$% +,"),$% (,"!!$% +'"!'$% !-"#!$% +#"+,$% +'"'*$% (("#!$% )"*+$% !"!&$% #-"'-$% )+"'+$% )!"+-$% ,("&,$% ,#"-!$% ,-"+-$% ,-"),$% ,+"!)$% ,!"+#$% '"''$% )'"''$% *'"''$% #'"''$% ('"''$% !'"''$% +'"''$% &'"''$% ,'"''$% -'"''$% )''"''$% !"#$ !"%$ !"&$ !"'$ !"($ !")$
./01%203456789% :8;0/%<1=79>% 203456789%79%?%8@%A17B%<7B096% A14B6C%

:0/@8/D1950%E=0/F013% 203456789% Fig. 4.12: Impact of circuit size on evaluated metrics

Summary

In this chapter we presented a design space exploration study aimed to optimize the HyFT architecture. A few limitations of HyFT architecture were also discussed. The prime design parameters were identified and controlled to limit these drawbacks. Three new design variants were obtained and their effect on the four important design merits were analyzed. The experimental results showed that the proposed optimizations save significant amounts of area and power by easing the synthesis constraints that were imposed by the initial design. Reducing surface intrinsically reduces the possibility of fault occurrence and the ability to act against only the potentially fatal SETs reduces the number of Fail-silent faults and improves the performance.

Chapter 5

Selective Hybrid Fault Tolerance

From the safety point of view, selecting the ideal trade-off between reliability improvement and cost associated with a fault tolerant architecture employed for hardening, mainly depends on the level of criticality of the application, the environment radiation levels and the technology used.

It is important to create a balance that best suits the design cost-budget and the acceptable error rate constraint [START_REF] Samuel | Selective hardening methodology for combinational logic[END_REF]. Selective hardening is a technique that creates this balance by allowing the design to move between the two edge-cases of no-hardening and fully hardened, and optimize it by selecting the most vulnerable circuit parts to be hardened. Selecting only the most vulnerable circuit parts for hardening and leaving others unprotected can provide improvement in error rate at an acceptable area and power overheads [START_REF] Polian | Selective Hardening: Toward Cost-Effective Error Tolerance[END_REF].

In this chapter we introduce an efficient cost (in terms of area and power) versus reliability improvement trade-off analysis methodology for CL circuits, which helps taking this key design decision. Based on this analysis we also propose a selective hardening technique using the Hybrid Transient Fault Tolerant (HyTFT) architecture. The selective hardening involves reducing the number of outputs to be compared for error detection. Reducing the comparison point not only reduces the size of the comparator but also significantly reduces the size of the duplicated CL copy since only the logic cones responsible for generating the selected outputs need to be synthesized to create the duplicated copy. This chapter is organized such that, we first briefly review some selective hardening techniques from the literature in Section 5.1. In the subsequent section we discuss a low-cost method for identifying the most venerable outputs nodes of a logic circuit and validate the results by comparing them with those obtained from an accurate fault injection based method. In Section 5.4 we present the selective HyTFT architecture and a low-cost method to estimate its fault tolerance capability. In Section 5.5 we present the experimental results obtained by using the low-cost reliability estimation method to study the cost-reliability trade-off of a Selective HyTFT implementation and we also validate them. Finally, we conclude the discussion with some perspectives in Section 5.6.

Previous work

Selective hardening is done in two steps. First the most vulnerable circuit parts are identified on the basis of their contribution to the overall circuit error rate. Second, a fault tolerance architecture is applied on the selected circuit parts [START_REF] Zoellin | Selective Hardening in Early Design Steps[END_REF]. Most of the approaches of selective hardening in the literature focus in improving the vulnerability analysis methodology and use existing fault tolerant architectures for hardening. Thus, are better classified on the basis of the former criteria. Table 5.1 give a summary of a few techniques used for selective hardening.

The three masking effects discussed in Section 1.3.1.2 that inherently prevent transient pulses from getting latched in FFs are generally employed in the circuit element vulnerability estimations. The use of accurate models that consider all three masking effects is impractical because of the immense amount of computational effort needed to simulate or to solve these models. Therefore, some techniques like [30], [START_REF] Mohanram | Cost-effective approach for reducing soft error failure rate in logic circuits[END_REF] and [START_REF] Bottoni | Partial triplication of a SPARC-V8 microprocessor using fault injection[END_REF] rely on approximate abstract models while considering all three masking effects, whereas others like [START_REF] Samuel | Selective hardening methodology for combinational logic[END_REF], [START_REF] Polian | Scalable Calculation of Logical Masking Effects for Selective Hardening Against Soft Errors[END_REF], [START_REF] Maniatakos | Workload-driven selective hardening of control state elements in modern microprocessors[END_REF] and [START_REF] Zoellin | Selective Hardening in Early Design Steps[END_REF] resort to only one or two of them to identify circuit elements with highest impact on soft error rate.

One of the techniques that only take into account the effects of logical masking is proposed by Pagliarini et al. in [START_REF] Samuel | Selective hardening methodology for combinational logic[END_REF]. It determines the a subset of standard cells when hardened, the circuit can meet the user defined reliability target in a power-effective manner. The vulnerability analysis is based on an algorithm in which reliability probability is attributed to each signal, then by propagating these signals probabilities through the logic block till the CL outputs, it reaches to an expression of the overall circuit reliability. Based on the extent of reliability contribution of each cell to theis circuit's reliability expression it ranks the cells. The work by Polian et al. in [START_REF] Polian | Scalable Calculation of Logical Masking Effects for Selective Hardening Against Soft Errors[END_REF] also uses error probabilities of gates to estimate its contribution to the circuit soft error rate. But unlike [START_REF] Samuel | Selective hardening methodology for combinational logic[END_REF], instead of propagating gate error probabilities, it expresses the circuit error rate as a conditional probability that an error at the gate output also have an observable effect on the circuit output. The gate observability metric is expressed as the detection probability of stuck-at fault on the output of that gate. This technique offer a scalable alternative to Binary Decision Diagram (BDD) based methods for soft error estimation. They use probabilistic models to account for possible unbalance in input values. The work by Maniatakos et al. in [START_REF] Maniatakos | Workload-driven selective hardening of control state elements in modern microprocessors[END_REF] focuses on identifying the most vulnerable parts of microprocessor for harden. The work takes into account the logical masking effects impact particular to the workload used. Bottoni et al. in [START_REF] Bottoni | Partial triplication of a SPARC-V8 microprocessor using fault injection[END_REF] propose a fault injection vulnerability analysis method which inherently takes into account the workload specific logical masking and latching window masking. The computation effort for the method proposed is high because involves simulation based fault injection. Among the techniques which consider the impact of all three masking effects for identifying the soft spots in circuits some prominent pieces of work include by Fazeli et al. in [30] in which they use probabilistic models the three masking effects. Where as the work by Mohanram et al. in [START_REF] Mohanram | Cost-effective approach for reducing soft error failure rate in logic circuits[END_REF] besides using probabilistic models, uses a novel heuristic model to meet the reliability and cost trade-off for the proposed partial duplication architecture.

A low-cost output susceptibility analysis

The output susceptibility analysis methodology is based on the fact that not all the outputs of a CL block have the same susceptibility to SET effects and hypothesizes that their susceptibility is a function of the number of nodes in its fan-in logic cone. It exploits the structural properties of the output fan-in cone to get their relative susceptibility estimates. The outputs are ranked on the basis of their relative susceptibility and the best candidates are selected for error detection. The number of output candidates selected, defines the reliability improvement and cost trade-off and the vulnerability-aware selection allows us to optimize it.

As seen in Section 5.1, techniques in previous work mostly consider logical masking to select the most vulnerable circuit nodes for hardening. A few approaches also consider the impact of electrical and latching-window masking effects in the susceptibility analysis. In our approach, the impact of these factors is not taken into account mainly to reduce the computational costs associated with these methods and secondly to investigate the possibilities of improving the efficacy of our approximate method to be used with large complex designs.

Algorithm 1 shows the pseudo-code of the proposed method. The algorithm starts by reading the pre-place-and-route netlist of the design. Then it forms groups F j of all fan-in cells for each CL output O j . Once the groups are formed the weight W j of each fan-in cone is calculated by adding together the weights of all the cells in the corresponding fan-in cone group. According to the hypothesis that forms the basis of this method, cell weight is the number of inputs and outputs of that cell. Ranks are assigned to each output on the basis of their fan-in cone weight using a sort function shown in line 15 of Algorithm 1.

1 read(netlist); 2 ✴✴ •r♦✉♣ ❛•• ❢❛♥✲✐♥ ❝♦♥❡ ❝❡••s t♦❣❡t❤❡r ❢♦r ❡❛❝❤ ♦✉t♣✉t ♥♦❞❡ 3 foreach O j do 4 F j ← O j .get_fanin(); 5 end 6 ✴✴ •❡t ✇❡✐❣❤t ♦❢ ❢❛♥✐♥ ❝♦♥❡ ♦❢ ❡❛❝❤ ♦✉t♣✉t 7 foreach O j do 8 foreach C i do 9 if C i ∈ F j then 10 W j ← W j + C i .get_pins(); 11 end 12 end 13 end 14 ✴✴ ❙♦rt ♦✉t♣✉ts ♦♥ t❤❡ ❜❛s✐s ♦❢ t❤❡✐r ❢❛♥✐♥ ❝♦♥❡ ✇❡✐❣❤t 15 sort(O j ,F j ,W j );
Algorithm 1: Output susceptibility analysis

The algorithm is further explained by its application to a simple example circuit shown in Figure 5.1. The shaded regions mark the boundaries of the two output fan-in cones. The weight parameter (W i ) is given on the top of each gate. The fan-in cones weight (S j ) given on the right of corresponding output is found to be 14 and 12 for O 1 and O 2 respectively. According to these figures we can infer that the output O 1 is more susceptible to SETs than output O 2 . In other words, having a SET detection mechanism placed on O 1 can improve the reliability of the circuit more than having it placed on O 2 .

A Tcl script implements the susceptibility analysis algorithm, which is used with Synopsys ® Design Compiler to perform the necessary operations. An experiment is performed by applying the proposed low-cost output susceptibility analysis method to a circuit obtained by extracting CL from an ITC'99 benchmark circuit (i.e. b05). We obtain the output susceptibility figures illustrated graphically by the red colored plot of Figure 5.2. It represents the normalized distribution of the output fan-in cone weight (S j ) with the output arranged on the horizontal axis. The trend of the graph suggests that there is a certain number of outputs driven by a notably large fan-in cones than the rest of the outputs. Presumably, these outputs should have a higher contribution to the circuit soft error rate.

Selective Hybrid Fault Tolerance

! "# $ " !"!#! ! %# $ % !"!#! ! & # $ & !"!$! $ ' !"!%! !! ( # !! )# $ ) !"!#! ! ' # $ ' !"#! ! * # $ * !"!#! #! + # $ ) !"!#! , % !"!&$! , " !"!&%!! & '( !)*+,-+!./+0!1-" 2!! $ +3 !)*+,-+!./+0!1-% 2!! )*+,-+!./+0!/4056*7!1-"# !8!-% 2!!
Fig. 5.1: Application of the output susceptibility analysis on an example circuit

Results

An experiment is performed by applying the proposed low-cost output susceptibility analysis method to a circuit obtained by extracting CL from an ITC'99 benchmark circuit (using the method explained in Appendix C) i.e. b05. We obtain the output susceptibility figures illustrated graphically in Figure 5.2. The graph represents the weight (S j ) distribution of the output fan-in cones. The trend of the graph suggests that there is a certain number of outputs driven by a notably large fan-in cones than the rest of the outputs. Presumably, these outputs should have a higher contribution to the circuit soft error rate.

Validation of the approach

The susceptibility analysis discussed in the previous section is based on the hypothesis that the susceptibility of CL outputs to SETs is a function of the number of signal nodes in the fan-in cone of that output. In order to test this hypothesis we compare the results of the low-cost susceptibility analysis method with fault injection based output susceptibility results.

Fault injection based output susceptibility analysis

The idea behind fault injection based output susceptibility analysis is to inject faults on randomly selected locations in an unhardened version of a CL circuit for which the output susceptibility is desired and observe which outputs fail more often. It involves running a number of fault injection campaigns using the fault injection framework detailed in Section 2.3.3. Running multiple fault injection campaigns allow us to obtain multiple distribution samples of the number of failures observed on CL outputs. The similitude among different distribution samples ensures the efficacy of this method. Five fault injection campaigns each comprising of 2012 simulations with single SET injection are performed on same circuit used for the low-cost output susceptibility analysis experiment discussed in Section 5.2.1. The fault injection parameters for these experiments are given in Table 5.2, which are common for all the campaigns. It can be seen that, SETs with random duration within 0.25 ns and 1.25 ns are injected on locations distributed randomly within the CL block at random times during the simulation. The workload used during fault injection consist of patterns optimized for stuck-at fault detection for obtaining activity distributed allover the circuit and to reduce the impact of workload-specific logical masking effect on the susceptibility of outputs. The graph of Figure 5.3 gives the distribution of average number of SEUs observed in the output register of the circuit with the output arranged on the horizontal axis. The vertical lines represent the standard deviation of five samples obtained from their average. Since the sample size of our experiment is low, we show the standard deviation figures to give an idea of the confidence level, which is sufficient enough to infer that there exist a correlation between the number of failures observed on an output node during our random fault injection campaigns and the susceptibility of that output. The sample size can be increased by running more fault injection campaigns if a higher confidence level is desired.

Discussion

Figure 5.4 shows the normalized distribution of output susceptibility obtained from the low-cost susceptibility analysis method and the average normalized distribution of fault injection based susceptibility on the same graph. We can see that the distribution obtained from the low-cost approximate method bears some similarities with the accurate distribution.

The CPU runtime for the accurate fault injection based method is around 45.5 hours, which involves five fault injection campaigns each with 2012 simulation. Whereas, the low-cost method took only 2.7 seconds to generate the susceptibility estimates. This runtime also include the overhead associated with the use of Synopsys ® Design Compiler. A standalone implementation of the algorithm can further reduce the runtime to make it feasible to be used with large industrial benchmarks. Low computational effort and the degree of accuracy of the low-cost output susceptibility analysis method gives good grounds to further study the short comings and improve its accuracy. duplication and pseudo-dynamic comparison to detect faults and a single-cycle deep rollback scheme for correction. Since the architecture relies on duplication of CL block and a pseudodynamic comparator its implementation incurs an overhead of more than 100% in terms of area and power.

Selective HyTFT Architecture

A practicable way of providing the designer the freedom to control the cost and reliability improvement of HyTFT implementation is to intelligently select a set of outputs for comparison. It allows reducing the overhead with duplication and comparison at a cost of the fault tolerance capability. Figure 5.5 shows a simplified scheme of selective HyTFT architecture. It can be seen that CL2 logic block only implements a part of the logic in CL1. CL2 only contains logic cones necessary to implement the logic function on the output pins selected of comparison. The method discussed in Section 5.2 provides us with a low-cost means of doing this selection.

!! !! !! Input Register Output Register ""#$! %&&'&! ()*+,! -+,*+,! CL1 CL2 . '! )!/!. '!

A low-cost HyTFT architectural reliability estimation

One method of estimating the reliability of a fault tolerant architecture is to perform fault injection experiments and analyze systems outcome, as we have seen in different experimental studies in this manuscript. To reach a statistical confidence level sufficient to infer the reliability improvement of a fault tolerant architecture, it requires a rigorous fault-injection campaign [START_REF] Maniatakos | Workload-driven selective hardening of control state elements in modern microprocessors[END_REF]. Furthermore, if fault-injection is employed to study the trade-off between cost and reliability improvement of various selectively hardened variants it multiplies the simulation effort as many times as the number of intermediate variants between no-hardening and full-hardened being analyzed.

To provide an analysis method that gives a reasonably accurate estimation of the reliability of the selective HyTFT architecture variants with minimum computational effort, we present a simple method that employs the same hypothesis used in Section 5.2 for output susceptibility analysis. According this methodology the ratio of cumulative weight (∑ n j=1 S j ) of the duplicated CL cones in CL2 to that of the CL1 gives an estimate of the reliability degradation factor from the fully hardened edge-case.

In the output susceptibility analysis method presented in Section 5.2 we do not mind about the fan-in cone overlaps because the analysis is meant to produce output ranking on the basis of individual cone weight (S j ). But in the case of selective HyTFT architecture, where one or more output cones are duplicated for comparison, the cumulative weight of the selected outputs should be calculated by resolving the fan-in cone overlaps. In Algorithm 2 with the help of a pseudo-code we explain how we resolves the fan-in cone overlaps. It can be seen in line 1 of the pseudo-code that it calls Algorithm 1 to obtain a list of outputs with fan-in cone weights already assigned. Once the individual cone weights are assigned to the outputs, Algorithm 2 begins iterating each output O j starting from the most susceptible one (i.e. one with highest weight) and continues in descending order ot their weights. During each iteration of O j , each cell (C i ) is checked if lies in the current output fan-in cone. If it exists in that cone and is already claimed to lie in any other output fan-in cone during previous iterations, its weight is deducted from the cumulative weight. And, if the cell exist in the current fan-in cone but is not claimed by any previously iterated output fan-in cone, it is marked as claimed. In this way Algorithm 2 continues till it has iterated each output in the design. Figure 5.6 explains how Algorithm 2 calculates the cumulative weight of outputs of an example circuit. It can be seen that in order to calculate the cumulative weight of two outputs (S 1 and S 2 ) the cells common to both the output fan-in cones (C 5 in this example) are counted only once. Table 5.3 gives the results obtained by applying the low-cost selective HyTFT reliability estimation method to a CL block extracted from four ITC'99 benchmark circuit listed in Column 1 (ckt.). Each row in the table represent a selective HyTFT variant starting from the no-hardening to fully-hardened edge cases grouped together for each benchmark circuit. Column 3 (#. of output nodes selected) gives the number outputs selected for error detection corresponding to each variant listed in Column 2 (Selective HyTFT variant). So, for example the first row of each group corresponds to the case in which only one output that is most susceptible is selected for error detection and the second row of each group represents the case in which the two most susceptible outputs are selected and so on. The suffix in the name of each variant represent the percentage ratio of cumulative fan-in cone weight of the duplicated CL copy given in Column 4 (Cumulative fan-in cone weight ∑ n j=1 S j ), to that of the primary copy. This percentage is also given in Column 5 (Cumulative fan-in cone weight %). The last column gives the Vulnerability Factor (VF). VF gives us the estimate of the unreliability of the HyTFT variant on the scale from 0 to 1. It is obtained by the expression of Equation 5.1.

1 Algorithm 1(); 2 ✴✴ |❡s♦•✈❡ ❢❛♥✲✐♥ ❝♦♥❡ ♦✈❡r•❛♣s ❜② ✐♥❝•✉❞✐♥❣ ❝♦♠♠♦♥ ❝❡••s ♦♥•② ✐♥ ❢❛♥✲✐♥ ❝♦♥❡ ✇✐t❤ •❛r❣❡r ✇❡✐❣❤t 3 foreach O j do 4 foreach C i do 5 if C i ∈ F j then 6 if C i / ∈ claimed_cells then 7 claimed_cells ← claimed_cells ∪ C i
V F = 1 - ∑ n j=1 S j ∑ N o j=1 S j (5.1) ! "# $ " !"!#! ! %# $ % !"!#! ! & # $ & !"!$! $ ' !"!%! !! ( # !! )# $ ) !"!#! ! ' # $ ' !"#! ! * # $ * !"!#! #! + # $ ) !"!#! , " !"!&%!! , % !"!&$!! -###, . !"!&%!'!&$!!(!!$!!!"!$%!! & )* !+,-(.-!/0-1!2/ " 3!! $ -4 !+,-(.-!/0-1!2/ % 3!! +,-(.-!/0-1!05167,8!2/ "# !9!/ % 3!! .#0#" ! % !

Experimental Validation and Results

The low cost vulnerability analysis method for selective HyTFT variants discussed in Section 5.4.1 provides us with fast way of analyzing the cost versus reliability improvement relationship. In order to validate the results obtained using this method we compare them with more accurate results obtained performing fault injection on the no-hardening version, the fully-hardened version and a number of intermediate selective HyTFT variants which lie between them.

Experimental Setup

The experimental setup for the validation of the results obtained from the low-cost selective HyTFT architecture vulnerability analysis is realized by applying the selective HyTFT architecture on the four considered benchmark circuits to obtain four sets of HyTFT variants each containing and the two edge-cases and a set of intermediate variants. The application involves steps described in following subsections.

CL Extraction and Reduction

We reuse the CL blocks extracted from the four benchmark circuit from the experiments discussed in Section 2.4.1 and 4.3.1.1. But the same can be obtained by the method explained in Appendix C.

In all the cases of duplication that we have seen in this thesis so far, all the CL copies are similar. But, in the case of selective HyTFT architecture the secondary copy is meant to have lesser logic than the primary copy, because it only contains the logic cones necessary to generate signals at the output selected for error detection. Such logic reduction can be realized by simply removing the CL outputs, which are not selected for error detection, from the input/output list of the HDL description of the extracted CL block. A re-synthesis of this edited CL block results in a CL block containing logic necessary for generating signals on the outputs remaining in the input/output list of the HDL description.

The HDL description of the extracted CL block is manually edited to obtain ten new HDL descriptions with only the required outputs remaining, each correspond to one of the intermediate selective HyTFT variants.

CL Synthesis

The control signal timing characteristics of the selective HyTFT architecture is similar to the HyFT_2b scheme which was found to be most effective in terms of area, power and performance by the study in Chapter 4. Since HyFT_2b scheme nullifies the need of applying minimum delay constraints during CL synthesis, as discussed in Section 4.3.1.2, both the primary and the set of reduced secondary copies are synthesized without any minimum delay constraints.

Workload Generation

The workload used for fault injection and power estimation experiments performed on selective HyTFT architecture is similar to the ones used in Section 2.4.1 and 4.3.1.1. We recall here that the workload is ATPG generated patterns optimized for stuck-at fault detection in the BL version of CL extracted form the four considered benchmark circuit.

RTL Description

In order maximize reuse, the architectural components for describing the ten HyTFT variants we modified the RTL blocks used in HyFT_2b scheme. The modifications we did to reuse the RTL models include; the size of the comparator, the control logic to exclude the reconfiguration state machine and associated control signals and the wrapper to reduce the nets to account for the reduction of outputs of secondary CL copy.

Constrained Hierarchical Synthesis

We employed the same synthesis method for obtaining the selective HyTFT designs that is discussed in Section 4.3.1.5.

Experimental Results

The cost results of selective HyTFT variants are presented in Column 6 (CL Area Absolute mW) to Column 9 (CL Power Gain %.) of Table 5.3, in terms of area and power. These results are generated by analyzing the synthesized selective HyTFT variants with Synopsys ® Design Compiler. For power estimation we used switching activity obtained by running the workload explained in previous section. We only focus on the CL parts of selective HyTFT variants instead of presenting the cost of entire implementation mainly because the non-CL part is relatively large in comparison with the CL parts and does not show significant change with the varying degree of duplication. Thus incorporating the relatively larger and fixed amounts in the presented data would make them obscure. In order to obtain comprehensive results, experimentation on larger circuits must be performed, but in this work with small benchmark circuits we intend to show the efficacy and cost-efficiency of the proposed method.

It is evident from Table 5.3 that reducing the number of outputs selected for error detection helps reducing the area and power of HyTFT variants. For instance, the selective HyTFT implementation of b05 benchmark circuit that uses only one output node for error detection (i.e. b05_40%) gains around 32.4% and 36.7% in terms of area and power, respectively.

To assess the fault tolerance capability of the selective HyTFT variants and to see how well our low-cost vulnerability analysis results coincide with the accurate results, we subjected the HyTFT variants to a fault injection campaigns with parameters listed in Table 5.2. A total of 442, 2333, 217 and 561 SETs are injected in each of the HyTFT variant of b03, b05, b06 and b08 benchmark circuits, respectively. The fault injection framework of [START_REF] Wali | Design space exploration and optimization of a Hybrid Fault-Tolerant Architecture[END_REF] is used to perform the experiments.

Column 10 (Soft error failure #.) of Table 5.3 show the outcome of the fault injection experiments. It can be seen that with the reduction of error detection points, the number of soft error failures shows an increase. This increase is due to the fact that the variants with lesser logic in their secondary CL copy become more vulnerable to faults because of reduced coverage of the error detection mechanism. Column 11 (Soft error failure %.) of the table gives the percentage of fail-silent faults with respect to the total number of faults injected.

Discussion

In order to compare the vulnerability factor obtained from the low-cost vulnerability analysis method with the fault tolerance capability results in terms of number of fail-silent faults obtained using fault injection experiments for the selective HyTFT variants we polt the two measures on the same graph on with a normalized vertical axis shown in Figure 5.7. The horizontal axis represents the percentage of cumulative weight of secondary CL copy to that of the primary CL copy such that the data points in the graph represent b05_0%, b05_40%, b05_51% till b05_100% from left to right. The straight line curve in purple represent the normalized venerability factor, where as the green curve represent the normalized number of fail-silent fault observed with the number marked on each data point on the graph. It can be seen that the vulnerability factor follows more or less a similar trend as the fault injection results with a positive error for the first two smallest HyTFT variants and a negative error for the rest of the variants.

The graph also shows in blue and red the trend of normalized area and power of the selective Hybrid Transient Fault Tolerant (HyTFT) variants respectively with absolute values of area and power mentioned on some data points. By analyzing the graph we can conclude that the first two selective HyTFT variants i.e. b05_40% and b05_51% seem most feasible because for these two cases the area and power overheads are minimum and the number of fail-silent faults are at reasonably low value, while the remaining cases either offer similar fault tolerant capability with increased cost (b05_62% and b05_70%) or cost too much compared to their impact on the fault tolerance capability (b05_70% till b05_100%).

Summary

The main objectives of the work presented in this chapter are, firstly, to propose a low cost method to analyze the cost versus reliability trade-off to avoid lengthy fault-injection campaigns at the early design phases. Secondly to show the feasibility of applying this method to selectively harden circuits using HyTFT architecture. We have seen in this chapter that the low-cost vulnerability analysis method is fast and the results obtained have a error within reasonable limits when compared with more accurate fault injection based methods. We have also shown that selective hardening circuits with HyTFT can improve the circuit reliability at a reasonable cost. Since the experiments are based on just one benchmark circuit and only one type of workload it is hard to make concrete conclusions. We intend to extend the work by adding more benchmarks and workloads to further explore the possibilities of using approximate methods for circuit reliability assessment method that can aid at early phases of design.

Conclusion

Whether it be, commerce, health-care, military, communication or transport, our increasing reliance on electronics to perform operations that demand high degree of reliability, availability and safety, and increasing vulnerability of transistors and interconnects are posing new challenges to the design of next generation of electronic systems. Moreover, the complexity of modern electronic systems make error detection and confinement a difficult task. On the other hand, the stringent low-power and high-performance demands has further shrinked the limits of industry's consensus about the permissible reliability enhancement overheads. In this work we present a low-power HyFT architecture for reliability improvement of modern complex pipeline circuits by protecting their combinational logic parts. The architecture can handle a broad spectrum of faults with little impact on performance. Moreover, it addresses the problem of error propagation behavior of nonlinear pipelines and error detection in pipeline stages with memory interface. We implement the proposed architecture onto a MIPS microprocessor as case study. We also present a gate-level fault-injection framework that offers high fidelity to model physical defects and transient faults. Our experimental results show the effectiveness of the proposed architecture in terms of fault-tolerant capability and power consumption.

To summarize, we state the major contributions of this work as follows:

• A comparative study based on experiments performed on four similar fault-tolerant architectures intended to reduce errors caused due to faults in combinational logic parts of microelectronic circuits and systems [START_REF] Wali | An Experimental Comparative Study of Fault-Tolerant Architectures[END_REF]. The experimental results show that the hybrid fault tolerant approach can handle transient faults as effectively as Partial-TMR and exhibits permanent fault tolerance capability similar to that of Full-TMR. Furthermore, it can handle the fault accumulation effect better than TMR.

• A Pipelined HyFT architecture that offers solutions to the problem of error detection and confinement in modern complex pipeline circuits [START_REF] Wali | An effective hybrid fault-tolerant architecture for pipelined cores[END_REF]. A case-study of implementation of a HyFT microprocessor reveled that the implementation offers similar fault tolerance capability as TMR but with the added advantage of 11.6% power saving.

• A simulation based gate-level fault injection framework that offer high fidelity to model transient, permanent and timing faults [START_REF] Wali | A Hybrid Fault-Tolerant Architecture for Highly Reliable Processing Cores[END_REF]. Comprising of a comprehensive flow starting from fault site extraction till fault injection report analysis, it provides customizability to suit any application and the degree of automation allows running exhaustive fault injection campaigns without any manual intervention.

• A design space exploration study aimed at optimizing the HyFT architecture in terms of area, power and fault tolerance capability [START_REF] Wali | Design space exploration and optimization of a Hybrid Fault-Tolerant Architecture[END_REF]. The experimental outcomes showed that by easing the synthesis constraints that were imposed by the initial design, one can save significant amounts of area and power, and the improved ability of the optimized architecture to act against only the potentially fatal SETs improves the performance.

• A selective HyTFT architecture based on a fast cost-reliability trade-off analysis methodology [START_REF] Wali | A Low-cost Selective Hybrid Fault Tolerant Architecture[END_REF]. This fast trade-off analysis uses a low-cost reliability estimation method that is 2, 500× faster and produces results having error within acceptable limits when compared with a fault injection based method. The selective HyTFT architecture can improve circuit reliability at a reasonable cost.

This thesis can form a basis for various possible future work in the area of dependable circuits and systems design, including the following:

• There is a need to enhance the usability of the gate-level simulation based fault injection framework by restructuring its components to be able to control all the tasks form the common command line interface. The goal of this future task is to obtain a simulation based fault injection tool that uses the existing framework and offers a comprehensive and easy to use user-interface. As a long term perspective, we also intend to exploit an open source logic simulator like Verilator [START_REF] Galbi | Introduction to Verilator[END_REF] or LIFTING [START_REF] Bosio | LIFTING: A Flexible Open-Source Fault Simulator[END_REF] to provide a complete open source fault injection and effect analysis tool.

• Field-Programmable Gate Array (FPGA) based prototyping of HyFT architecture and fault injection to validate the fault tolerance capability results obtained from the simulation based fault injection experiments. A major anticipated obstacle during the FPGA prototyping phase is the implementation of HyFT control logic, which is the most time critical component of the architecture and the pseudo-dynamic comparator because of its non-standard logic implementation. Another major challenge that could be faced to accomplish the fault injection would be to implement the fault injection instrumentation with time resolution and accuracy sufficiently high to emulate the occurrence of SETs.

• We intend to extend the work in the area of low-cost circuit reliability assessment methods by adding more benchmarks and workloads, aiming to further explore the possibilities of using these approximate analytic methods of reliability estimation of fault tolerant architectures at their early implementation phase. Another area of future research is to use the proposed low-cost reliability estimation technique with heuristic methods of cost-reliability trade-off optimization.

  Pipeline with Memory Interface . . . . . 55 3.4 Pipelined HyFT Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 3.5 False error flagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 3.6 Additional logic to prevent false error flagging . . . . . . . . . . . . . . . . . . . 57 3.7 False error flagging problem solved . . . . . . . . . . . . . . . . . . . . . . . . 58 3.8 CL Classification and Partitioning . . . . . . . . . . . . . . . . . . . . . . . . . 58 3.9 Error detection and reconfiguration scheme in non-linear pipeline . . . . . . . . . 60 3.10 HyFT hardening of pipeline stage with asynchronous non-concurrent read-write access memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 3.11 HyFT hardening of pipeline stage with synchronous simultaneous read-write access memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 3.12 Baseline Microprocessor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 3.13 HyTFT Microprocessor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 3.14 HyTPFT Microprocessor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 3.15 TMR-b and TMR-w Microprocessor . . . . . . . . . . . . . . . . . . . . . . . . 68 3.16 Area overhead results summary . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 3.17 Power overhead results summary . . . . . . . . . . . . . . . . . . . . . . . . . . 74 3.18 Transient fault injection results . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 3.19 Permanent fault injection results . . . . . . . . . . . . . . . . . . . . . . . . . . 76 3.20 Timing fault injection results . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 4.1 Comparison-window Generation Circuits and delays . . . . . . . . . . . . . . . 84 4.2 Comparison-window Timing Simulation Graph . . . . . . . . . . . . . . . . . . 85 4.3 Modified Hybrid Fault Tolerant (HyFT) . . . . . . . . . . . . . . . . . . . . . . 86 4.4 HyFT-1b Control Logic submodule1 . . . . . . . . . . . . . . . . . . . . . . . . 89 4.5 HyFT-1b Control Logic submodule1 simulation . . . . . . . . . . . . . . . . . . 89 4.6 HyFT-2a Control Logic submodule1 . . . . . . . . . . . . . . . . . . . . . . . . 90 4.7 HyFT-2a Control Logic submodule1 simulation . . . . . . . . . . . . . . . . . . 90 4.8 HyFT-2b Control Logic submodule1 . . . . . . . . . . . . . . . . . . . . . . . . 91 4.9 HyFT-2b Control Logic submodule1 simulation . . . . . . . . . . . . . . . . . . 91 4.10 Spatial distribution of Fail-silent faults . . . . . . . . . . . . . . . . . . . . . . . 95 4.11 Design metrics improvement summary . . . . . . . . . . . . . . . . . . . . . . . 98 4.12 Impact of circuit size on evaluated metrics . . . . . . . . . . . . . . . . . . . . . 99 5.1 Application of the output susceptibility analysis on an example circuit . . . . . . 106 5.2 Output susceptibility analysis results (of CL block extracted form b05) . . . . . . 106

Fig. 1. 2 :

 2 Fig.1.1: Feature size and operating voltage scaling trend over years[START_REF] Danowitz | CPU DB: Recording Microprocessor History[END_REF]

Fig. 1. 3 :

 3 Fig. 1.3: Single Event Effect Mechanism[START_REF] Baumann | Radiation-induced soft errors in advanced semiconductor technologies[END_REF]

. 4 .

 4 Fig. 1.4: Reliability improvement approaches across fault-failure life cycle[START_REF] Castano | Resilient Computer System Design[END_REF]

Fig. 1. 5 :

 5 Fig. 1.5: Error occurrences in combinational logic and storage elements

  Fig. 2.1: Duplication with Comparison

Fig. 2 . 2 :

 22 Fig. 2.2: Duplication with Comparison in sequential logic circuits

Fig. 2 . 6 :

 26 Fig.2.5: 4-input DOR gate[93]

Fig. 2 . 7 :

 27 Fig. 2.7: General architecture of Error Detection with Codes [63]

  Coarse-grained rollback recovery scheme

Fig. 2 . 8 :

 28 Fig. 2.8: Examples of Rollback recovery schemes

Fig. 2 .

 2 Fig. 2.9: Principle of PaS redundancy

Fig. 2 . 13 :

 213 Fig. 2.13: Triple Modular Redundancy

Fig. 2 .

 2 Fig.2.14: DARA-TMR[START_REF] Yao | DARA: A Low-Cost Reliable Architecture Based on Unhardened Devices and Its Case Study of Radiation Stress Test[END_REF]

Fig. 2 . 15 :

 215 Fig. 2.15: HyFT Architecture and associated timing constraints

  contamination delay δ t = the amount of time between CLK capture edge and the lapse of the comparison-window (as shown in Figure 2.15b) t ccq = FF clk-to-output delay t cdm = demultiplexer contamination delay t cm = multiplexer contamination delay In Figure 2.15b, with the help of a timing diagram we explain the associated timing constraints. Besides CLK and DC the timing diagram shows the signals at the two inputs of the comparator labeled as A out and S out also indicated in Figure 2.15a. The remaining two signals are the inputs of CL labeled as CL in and the outputs of CL labeled as CL out . The grey shaded regions in Figure 2.15b represent the allowed margins of the corresponding signals. The timing allowance for the start of the comparison-window depends on the clk-to-output delay of the output register. This implies that the comparison should not begin until the output of the output register stabilizes. Whereas the end of the comparison window should not extend beyond the point when the outputs of CL block start to change. Conversely, the inputs of the comparator should not begin to change before the lapse of comparison-window.

Fig. 2 . 16 :

 216 Fig. 2.16: Error detection and correction in HyFT Architecture

Fig. 2 .

 2 Fig. 2.18: Timeline illustration of Fault Injection Campaigns

  Fig. 2.19: Impact of CL blocks size on area and power overheads

  Fig. 3.1: Example transient error propagation in Linear Pipeline

Figure 3 .

 3 1a illustrates an example of a three stage linear pipeline. The graph of Figure 3.1b shows the timing plot of outputs of each of the three pipeline stages, namely O A , O B and O C in case of a transient fault occurrence in the CL block of Stage A during Cycle 1. The executions in red with an asterisk represent erroneous instructions.

Figure 3 .

 3 1b gives an example of error propagation in a nonlinear pipeline shown in Figure 3.2a. Note that a feedback connection is shown that transverse form Stage B to Stage A. Consider a case in which a transient fault occurring in Stage A during Cycle 1 causes erroneous data to be captured in Pipeline Register A, represented by inst2* label during Cycle 2. This error not only effects the computation in Stage B, but it also propagates back to Stage A CL through the feedback connection. Thus both the pipeline registers hold erroneous data at the next capture edge, represented by inst3* and inst2* labels during Cycle 3 in Figure 3.2b. Finally, during Cycle 4 and Cycle5 the error manifests at the output.

Fig. 3 . 2 :

 32 Fig. 3.2: Example transient error propagation in Nonlinear Pipeline

Fig. 3 . 3 :

 33 Fig. 3.3: Example transient error propagation in Pipeline with Memory Interface

Fig. 3 . 4 :Figure 3 . 5 .

 3435 Fig. 3.4: Pipelined HyFT Architecture

Fig. 3 . 5 :Fig. 3 . 6 :

 3536 Fig. 3.5: False error flagging

Fig. 3 . 7 :Fig. 3 . 8 :

 3738 Fig. 3.7: False error flagging problem solved

Fig. 3 . 10 :

 310 Fig. 3.10: HyFT hardening of pipeline stage with asynchronous non-concurrent read-write access memory.

Figure 3 .

 3 12 are multiple bits signals and single bit signals like clock and other control signals are not shown for simplicity. There are some feedback signals like next instruction address signals labeled as 5 , branch address signals labeled as 6 , wirte-back signals labeled as 7 and data-forwarding signals labeled as 8 . The datapath control logic is included in ID CL, which generates more feedback and feed-forward signals not shown in Figure 3.12 for the sake of simplicity. It can also be noticed that the CL blocks are surrounded by regions of different colors. These colored regions represent the type of each CL according to the classification given in Section 3.2.2. The CL blocks surrounded by regions shaded in blue are classified as influenced, as they receive feedback signals from other influencing stages. For example, IF stage gets branch address signals from ID stage. This makes the IF stage an influenced stage and ID stage an Influencing stage represented by the orange shaded region around it. At the same time the ID stage is also an influenced stage because if recieves Write-back signals from the WB stage. EXE and MEM stages are also influenced by WB stage. Furthermore the MEM and WB stages are unbounded

  %&'$(&")&*$+,&-+""

Fig. 3 .

 3 Fig. 3.15: TMR-b and TMR-w Microprocessor

Fig. 3 . 16 :

 316 Fig. 3.16: Area overhead results summary

•Fig. 4 . 1 :

 41 Fig. 4.1: Comparison-window Generation Circuits and delays

Fig. 4 . 2 :

 42 Fig. 4.2: Comparison-window Timing Simulation Graph

Fig. 4 . 4 :

 44 Fig. 4.4: HyFT-1b Control Logic submodule1

Figure 4 . 4 ,Fig. 4 . 6 :

 4446 Fig. 4.5: HyFT-1b Control Logic submodule1 simulation

Fig. 4 . 8 :Fig. 4 . 9 :

 4849 Fig. 4.8: HyFT-2b Control Logic submodule1

Fig. 4 . 10 :

 410 Fig. 4.10: Spatial distribution of Fail-silent faults

Fig. 4 . 11 :

 411 Fig. 4.11: Design metrics improvement summary

Fig. 5 . 2 :

 52 Fig. 5.2: Output susceptibility analysis results (of CL block extracted form b05)

Fig. 5 . 3 :

 53 Fig. 5.3: Output failure distribution

Fig. 5 . 4 :

 54 Fig. 5.4: Comparison of output susceptibility results (of CL block extracted form b05)

Fig. 5 . 5 :

 55 Fig. 5.5: Selective HyTFT Architecture

8 else 9 S

 89 j ← S j -C i .get_pins();

Fig. 5 . 6 :

 56 Fig. 5.6: Cumulative weight calculation of an example circuit

Fig. 5 . 7 :

 57 Fig. 5.7: Selective HyTFT cost versus soft-error (of CL block extracted form b05)

Fig. A. 2 :

 2 Fig. A.2: HyFT Control Logic submodule1

Table 2 .

 2 1: Fault injection parameters

	Input Parameter	Description
	Fault model	To specify to generate either permanent (stuck-at), transient (temporary stuck-at) or tim-
		ing (interconnect delay) fault.

Table 2 .

 2

			2: Fault injection parameters
			(a) Common parameters
	Parameter	Transient faults	Permanent faults
	Fault model	Temporary Stuck-at		Stuck-at
	Injection duration range	0.25 ns -1.25 ns (Constrained random)		-
	Workload	Stuck-at fault detection patterns
	Fault location constraint	Allover the architecture (Random)
	Injection type		Single fault
			(b) Individual parameters
	Benchmark	No. of injections Transient faults Permanent faults	Simulation duration (per injection)	Injection time range (Constrained random)
	b01	6088	6088	240ns		45ns -200ns
	b02	5245	5245	140ns		45ns -100ns
	b03	25630	25630	340ns		45ns -300ns
	b05	25248	25248	1020ns		45ns -980ns
	b06	9601	9601	220ns		45ns -180ns
	b08	20771	20771	550ns		45ns -510ns

Table 2 .

 2 3: Average Area and Power estimation results

		Avg. Area	Avg. Area	Avg. Power	Avg. Power
		(µm 2 )	Overhead (%)	(µW)	Overhead (%)
	BL	1231.00	-	351.50	-
	Partial-TMR	3141.59	155.02	971.66	173.32
	Full-TMR	3781.32	206.93	1077.74	206.09
	HyFT	3739.43	213.24	859.67	157.36

Benchmarks (arranged in ascending order of their area from left to write)

		250.00%
				238.52%
		230.00%			228.50%
	Area Overhead (%)	170.00% 190.00% 210.00%	Avg: 155.03% Avg: 206.93% Avg: 213.25%	206.74%	206.72%	159.75% 207.05% 212.52%	206.29% 203.12%	206.80% 200.97%	207.95% 195.83%
		150.00%		154.74%	153.95%		149.31%	155.43%	156.98%
		130.00%
				b02	b01	b06	b08	b03	b05
			Partial-TMR	Full-TMR	HyFT	Average
				(a) Area overhead
								210.84%
				206.08%		206.26%
				205.26%	202.73%		204.62%		206.02%
						177.10%		179.09%
									178.61%
					169.39%		174.29%
				167.47%
					163.40%
							151.81%
						144.53%			136.06%
								137.13%

Avg: 173.33% Avg: 206.09% Avg: 157.36%

	220.00%
	210.00%
	200.00%
	190.00%
	180.00%
	170.00%
	160.00%
	150.00%
	140.00%
	130.00%
	120.00%

Table 2 .

 2 4: Transient fault injection results summary

			Avg. % of	Avg. % of	Avg. % of
		Silent faults Corrected faults	Fail-silent faults
	BL		92.51%	0.00%		7.49%
	Partial-TMR	99.97%	0.00%		0.03%
	Full-TMR		100%	0.00%		0.00%
	HyFT		92.46%	7.26%		0.28%
	Table 2.5: Transient fault injection results
			Percentage of Fail-silent faults (%)
		BL	Partial-TMR	Full-TMR	HyFT
	b01	7.49	0.00		0.00	0.37
	b02	8.11	0.11		0.00	0.28
	b03	8.18	0.03		0.00	0.26
	b05	7.11	0.02		0.00	0.21
	b06	7.07	0.04		0.00	0.33
	b08	7.45	0.05		0.00	0.33
	Average 7.56%	0.03%		0.00%	0.28%

Table 2 .

 2 6: Permanent fault injection results

			Percentage of Fail-silent faults (%)
		BL	Partial-TMR	Full-TMR	HyFT
	b01	98.37	2.37	0.00	0.15
	b02	96.28	2.03	0.00	0.06
	b03	98.15	1.38	0.00	0.06
	b05	97.84	0.50	0.00	0.08
	b06	97.23	0.66	0.00	0.13
	b08	98.03	2.34	0.00	0.07
	Average 98.03%	1.36%	0.00%	0.08%

Table 2 .

 2 7: Summary of comparison of different related fault-tolerant architectures

			Permanent Transient fault fault tolerance tolerance	Timing fault tolerance	DFS	DVS	Hardware redundancy	Area overhead	Power overhead	Error recovery overhead	Lifetime reliability improvement
	Partial	PaS[47]	✓				CL×3

Table 3 .

 3 1: Truth table

		Inputs		Output	Comment
	DC_B	Err_B	Err_global	DC_B'
	1	0	0

Table 3 .

 3 2: Area and power results of write-transparency dual-port memory

	Memory	Area		Avg. Power		Access time
		absolute (µm 2 )	%. increase	absolute (mW) %. increase	absolute (ns)
	Baseline	16461	-	0.244	-	1.12
	Dual-port write-transparent	17110	3.94%	0.278	13.9%	1.12

Table 3 .

 3 3: Baseline microprocessor specifications

	Parameter	Value
	Data bus width	32-Bits
	CPU register size	32-Bits
	No. CPU registers	32
	Max. data memory	16384 MB
	Max. instruction memory	16384 MB
	Clock frequency	100 MHz
	No. of logic cells	110995
	No. of flipflops	7380

Table 3 .

 3 4: Fault injection parameters

	Parameter	Transient faults	Permanent fault	Timing fault
	Fault model	Temporary Stuck-at	Stuck-at	Interconnect-delay
	Injection duration range	0.25 ns -1.25 ns (Constrained random)	-	-
	Timing error range	-	-	2 ns -6 ns (Constrained random)
	No. of injections		10,000
	Simulation duration	510 ns (per injection)
	Workload	Add-shift multiplication program (Provided in Appendix A)
	Fault location constraint	CL blocks (Constrained random)
	Injection time range	50 ns -420 ns (Constrained random)
	Injection type		Single fault

Table 3 .

 3

				6: Power overhead results
		BL	HyTFT		HyTPFT	TMR-b		TMR-w
		A vg . Po w er (m W )	A vg . Po w er (m W )	% . of B L (% )	A vg . Po w er (m W )	% . of B L (% )	A vg . Po w er (m W )	% . of B L (% )	A vg . Po w er (m W )	% . of B L (% )
	Memory	1.319	1.329	101	1.329	101	1.324	100	1.324	100
	Pipeline Registers	0.306	1.005	328	1.005	328	0.316	103	0.316	103
	IF CL Blocks	1.382	2.719	197	2.935	212	4.145	300	4.145	300
	ID CL Blocks	0.958	1.880	196	2.077	217	2.873	300	2.883	301
	EXE CL Blocks	0.463	0.944	204	1.117	241	1.410	305	1.410	305
	MEM CL Blocks	0.077	0.152	197	0.200	260	0.230	299	0.230	299
	WB CL Blocks	0.192	0.422	220	0.449	234	0.579	302	0.582	303
	HyTFT Ctrl. Logic	-	0.355	-	-	-	-	-	-	-
	HyTPFT Ctrl. Logic	-	-	-	0.376	-	-	-	-	-
	Pseudo-dyn. Comparator	-	0.026	-	0.026	-	-	-	-	-
	Voter-b	-	-	-	-	-	0.037	-	-	-
	Voter-w	-	-	-	-	-	-	-	0.040	-
	HyTPFT Mux. & Demux.	-	-	-	0.117	-	-	-	-	-
	Total	4.697 mW	8.832 mW 188%	9.631 mW 205%	10.900 mW 232%	10.921 mW 233%

Table 4 .

 4 1: Contamination delay constraints for CL synthesis

	HyFT design	δ t	δ t -t ccq -t cdm -t cm	t cd
	variant	(ns)	(ns)	(ns)
	HyFT-1a	1.2229	0.9976	1.00
	HyFT-1b	1.0983	0.8730	0.88
	HyFT-2a	0.5493	0.3240	0.33
	HyFT-2b	0.2082	-0.0171	0.00

Table 4 .

 4 2: CL Synthesis ResultsFor power estimation and fault injection experiments the workloads used are Automatic Test Pattern Generator (ATPG) generated patterns optimized to detect stuck-at faults in the BL version of the CL blocks. The patterns contained in a .dat file are applied to the synthesized netlist by a test-bench also generated by the ATPG tool, in a gate-level simulation environment with back annotated delay information.

		BL CL	HyFT-1a CL	HyFT-1b CL	HyFT-2a CL	HyFT-2b CL
		Area	Area	Area	Reduction	Area	Reduction	Area	Reduction
		(µm 2 )	(µm 2 )	(µm 2 )	(%)	(µm 2 )	(%)	(µm 2 )	(%)
	b01	22.1	271.3	240.5	11.37	48.4	82.16	22.1	91.86
	b02	14.9	210.4	186.7	11.25	35.9	82.93	14.9	92.92
	b03	78.2	1052.8	923.5	12.28	162.8	84.54	78.2	92.57
	b05	333.0	1863.3	1673.1	10.20	426.1	77.13	333.0	82.13
	b06	33.2	471.3	416.8	11.57	71.5	84.82	33.2	92.95
	b08	88.8	842.4	750.4	10.92	159.6	81.05	88.8	89.45
	average	-	-	-	11.268%	-	82.106%	-	90.314%
	4.3.1.3 Workload Generation

Table 4 .

 4 3: Area Savings

		HyFT-1a	HyFT-1b	HyFT-2a	HyFT-2b
		Area	Area	Saving	Area	Saving	Area	Saving
		(µm 2 )	(µm 2 )	(%)	(µm 2 )	(%)	(µm 2 )	(%)
	b01	1404.2	1176.2	16.23	613.9	56.28	627.0	55.35
	b02	1066.7	884.7	17.06	510.2	52.17	530.4	50.27
	b03	4942.8	3782.2	23.48	1787.2	63.84	1429.7	71.07
	b05	8549.0	6634.3	22.40	3385.6	60.40	2720.6	68.18
	b06	2263.7	1739.9	23.14	836.6	63.04	610.2	73.04
	b08	4154.9	3217.8	22.55	1710.4	58.83	1195.4	71.23
	average	-	-	20.81%	-	59.09%	-	64.86%

Table 4 .

 4 4: Power Savings

		HyFT-1a	HyFT-1b	HyFT-2a	HyFT-2b
		Area	Power	Saving	Power	Saving	Power	Saving
		(µm 2 )	(mW)	(%)	(mW)	(%)	(mW)	(%)
	b01	318.7	300.0	5.84	178.5	43.98	164.0	48.55
	b02	205.4	203.8	0.75	146.7	28.54	136.6	33.46
	b03	954.4	873.2	8.51	432.0	54.74	346.6	63.68
	b05	1856.6	1706.2	8.10	799.0	56.93	742.2	60.02
	b06	441.9	407.3	7.85	206.8	53.21	174.5	60.50
	b08	877.3	828.2	5.60	433.4	50.60	356.6	59.35
	average	-	-	6.11%	-	48.00%	-	54.26%

Table 4 .

 4

		5: Fault injection parameters
		(a) Common parameters
	Parameter	Value
	Fault model	Temporary Stuck-at
	Injection duration range	0.25 ns -1.25 ns (Constrained random)
	Workload	Stuck-at fault detection patterns
	Fault location constraint	Allover the architecture (Random)
	Injection type	Single fault
		(b) Individual parameters
	Benchmark	No. of injections	Simulation duration (per injection)	Injection time range (Constrained random)
	b01	6088	240ns	45ns -200ns
	b02	5245	140ns	45ns -100ns
	b03	25630	340ns	45ns -300ns
	b05	25248	1020ns	45ns -980ns
	b06	9601	220ns	45ns -180ns
	b08	20771	550ns	45ns -510ns

Table 4

 4

							.6: Fault Injection Results
					HyFT-1a			HyFT-1b			HyFT-2a			HyFT-2b
			T o t a l	S i l e n t	C o r r e c t e d	F a i l -s i l e n t	S i l e n t	C o r r e c t e d	F a i l -s i l e n t	S i l e n t	C o r r e c t e d	F a i l -s i l e n t	S i l e n t	C o r r e c t e d	F a i l -s i l e n t
	b01	#. of Faults %. of Faults	6088 -	5605 92.07%	433 7.11%	50 0.82%	4713 93.64%	338 5.54%	50 0.81%	2527 97.78%	78 1.29%	57 0.93%	2589 97.88%	80 1.31%	49 0.81%
	b02	#. of Faults %. of Faults	5245 -	4784 91.21%	427 8.14%	34 0.65%	3987 93.07%	330 6.29%	34 0.65%	2352 97.00%	96 1.82%	62 1.18%	2532 98.56%	57 1.08%	19 0.36%
	b03	#. of Faults %. of Faults	-	23581 92.01%	1918 7.48%	131 0.51%	18243 94.66%	1232 4.81%	137 0.54%	8690 97.75%	347 1.35%	230 0.90%	7058 98.61%	246 0.96%	110 0.43%
	b05	#. of Faults %. of Faults	-	23259 92.12%	1876 7.43%	113 0.45%	18236 94.63%	1255 4.97%	102 0.40%	9550 98.21%	297 1.18%	151 0.60%	7683 98.61%	257 1.02%	95 0.38%
	b06	#. of Faults %. of Faults	9601 -	8857 92.25%	683 7.11%	61 0.64%	6871 94.70%	449 4.68%	59 0.62%	3376 98.21%	110 1.14%	63 0.65%	2456 98.63%	74 0.77%	58 0.60%
	b08	#. of Faults %. of Faults	-	19163 92.26%	1469 7.07%	139 0.67%	14892 94.25%	1068 5.15%	125 0.60%	8161 98.13%	241 1.16%	149 0.72%	5724 98.79%	167 0.80%	85 0.41%
	Avg.	#. of Faults %. of Faults	-	14208 91.99%	1134 7.39%	88 0.62%	14567 94.16%	779 5.24%	85 0.60%	15117 97.85%	195 1.32%	119 0.83%	15215 98.51%	147 0.99%	69 0.50%

Table 5 .

 5 1: Summary of selected previous work in the area of selective hardening

		Masking effects considered Logical Latching-Electrical window	Circuit element of interest	Targeted faults	Fault tolerance technique Employed	Vulnerability Analysis & Ranking Method Computational Error effort
	Pagliarini et al. [72]	✓			standard cells	MTFs	Cell TMR	SPRA[34]	5 -30% [45]	low
	Polian et al. [76]	✓			gates	SETs	-	Probabilistic	-	low
								Partial
	Maniatakos et al. [56]	✓ 1			FFs	SEUs	-	simulation based fault	1.4%	high
								injection
	Bottoni et al. [14]	✓ 1	✓		FFs	SEUs & permanent	FF TMR	Simulation injection based fault	4.4%	high
	Fazeli et al. [30]	✓	✓	✓	FFs	METs	-	MEPP[4]	2.5%	low
	Mohanram et al. [65]	✓	✓	✓	gates	SEUs	CL partial duplication with comparison	Probabilistic & heuristic	-	-

Table 5 .

 5 2: Fault Injection Parameters for output susceptibility analysis

	Parameter	Transient faults
	Fault model	Temporary Stuck-at
	Injection duration range	0.25 ns -1.25 ns (Constrained random)
	Workload	Stuck-at fault detection patterns
	Fault location constraint	Allover the CL (Random)
	Injection type	Single fault
	No. of injections	2012

Table 5 .

 5 3: Area, power and reliability estimates of Selective HyTFT variants

	CL Area	CL Power	Vulnerability

Table A

 A .1: HyFT submodule1 control signalsDCA periodic signal that defines the time interval during which the pseudo-dynamic comparator compares for error detection (comparisonwindow) by being at logic level-1.buf1 & buf2 • ∆(CLK ↑, DC ↑) = d buf1 + d buf2 • ∆(CLK ↓, DC ↓) = d buf1 + d buf2 Err ↑,CRegin ↑) = d and • ∆(CLK ↑,CRegin ↓) = d ccq + d and + d buf2

	Control	Description			Generating cir-	Timing (based on the circuit elements of
	Signal					cuit elements (of	Figure A.2)
						Figure A.2)
	CRegin	This	signal	• If CRegin is at logic	buf2, and & ff1	• ∆(
		indicates	a	level-1 and CLKRegin
		reconfigura-		undergoes a falling
		tion	cycle	transition, the state machine
		by staying at	reconfigures.
		logic level-1.		• If CRegin is at logic
					level-1 and CLKRegin
					acquires low logic level, the
					shadow latch in the input
					register preserves the last
					state to be used for rollback.
					• If CRegin is at logic
					level-1 and CLK undergoes
					a rising edge, the input
					register captures data from
					shadow latch instead of
					capturing a new input
					sample.

A flip-flop has a sequential dept of d seq if its output is dependent on primary inputs and at least one flip-flop of depth d seq -1. For example, if the output of a FF can be controlled by only primary inputs (and a clock pulse) it has sequential depth of 1

Workload-specific logical masking

Acknowledgements

[103] I. Wali, A. Virazel, A. Bosio, L. Dilillo, and P. Girard. "Protecting combinational logic in pipelined microprocessor cores against transient and permanent faults". In: South European Test Seminar (SETS). 2014.

Conclusion Scientific Contributions xiv

Table of contents

Controlling these parameters we obtain four HyFT design variants including the original scheme (i.e. without any optimization). These HyFT design variants are detailed in the following subsections.

Original HyFT (HyFT-1a) Architecture

This is the original HyFT architecture which is designed without considering any timing optimization. We use this scheme as our reference to access the improvements. As discussed in Section 2.2.7, it uses a simple delay buffer (shown in In HyFT-1a and HyFT-1b architectures the pseudo-dynamic comparator gets a synchronous input form the output registers as shown in Figure 2.15a. It implies that the comparison should not start until the FF outputs are stable. In other words, the FF clk-to-output delay imposes a limit while moving the comparison-window close to the CLK as shown in Figure 2.15b. To go beyond this limit, placement of the comparator at RT-level needs to be changed, such that the comparator now compares the output of two CL copies directly from the multiplexer, as shown in

Experimental Assessment of Improvements

The four design variants discussed in previous subsections undergo a comparative experimental study in order to assess and compare their design merits. These merits include area, power, fault tolerance capability and error recovery overhead. This study gives us an idea about how the design merits change with comparison-window timing and comparator placement. The results of the comparative study allow us to select the best candidate.

Experimental Setup

Experiments are performed on a few of ITC'99 benchmark circuits [START_REF] Corno | RT-level ITC'99 benchmarks and first ATPG results[END_REF] by hardening them with each of the four HyFT design variants and then assessing them for their design merits. The experimental methodology used can be broken down into the following steps:

CL Extraction

The first step in the experimental assessment is similar to the one explained in Section 2.4.1, in which we extract the CL from the original benchmark circuits. The step is also explained using an example in Appendix C.

CL Synthesis

In this step of the experimental assessment, the extracted CL blocks are synthesized using appropriate contamination delay constraints governed by the Equation 5.

1, corresponding to

Appendix A

HyFT Control Logic

The HyFT architecture is controlled by a control logic module having two submodules as shown in

Workload Program

The assembly workload program used with different versions of MIPS microprocessor, for their power estimation and fault-injection experiments is given below: