To my mother and father...

Résumé étendu en français

La conception des systèmes embarqués modernes est très complexe car ces systèmes doivent simultanément satisfaire à un certain nombre de critères qui se contredisent généralement.

Les applications embarquées doivent

généralement s'exécuter et fournir leur résultat dans un délai déterminé, le temps total d'exécution est donc essentiel. Une défaillance dun système embarqué peut avoir des conséquences fatales, la fiabilité est donc devenue un facteur très important. D'autre part, l'industrie des circuits intégrés s'efforce de réduire les coûts unitaires. La minimisation de la surface et de la puissance revêt donc une grande importance. L'augmentation de la fréquence d'horloge est une pratique courante pour améliorer les performances du système et, par conséquent, le temps d'exécution de l'application. Cependant, en augmentant la fréquence d'horloge, la consommation d'énergie augmente également. Une solution à ce problème consiste à faire évoluer les architectures mono-cur classiques vers des architectures prenant en charge une sorte de parallélisme, telles que les processeurs VLIW (Very Long Instruction Word) utilisés dans cette thèse. La figure 1 présente un chemin de données VLIW simplifié pouvant exécuter jusqu'à quatre instructions simultanément, prenant ainsi en charge l'exécution en parallèle via lILP (Instruction Level Parallelism) du processeur. La phase dexécution a été amplifiée pour montrer le parallélisme inhérent à de tels systèmes. Pour réduire la consommation électrique, une autre pratique courante consiste à réduire la tension et la fréquence de fonctionnement du système. Cependant, la réduction de la tension de fonctionnement, associée à la taille décroissante des transistors, rend les systèmes intégrés plus vulnérables aux erreurs et, par conséquent, moins fiables. Pour répondre à la demande croissante de fiabilité, les systèmes embarqués sont généralement conçus avec des capacités de détection et/ou de correction, atténuation et masquage des erreurs. Cependant, augmenter la fiabilité implique généralement l'utilisation d'une forme de i

Titre : Mécanismes d'optimisation des performances des processeurs VLIW à tolérance de fautes.

Mots clés : tolérance aux fautes, VLIW processeurs, exploitation des ressources inactives, optimisation de performance, injection de fautes, analyse de la vulnérabilité.

Résumé :

Les processeurs intégrés dans des domaines critiques exigent une combinaison de fiabilité, de performances et de faible consommation d'énergie. Very Large Instruction Word (VLIW) processeurs améliorent les performances grâce à l'exploitation ILP (Instruction Level Parallelism), tout en maintenant les coûts et la puissance à un niveau bas. L'ILP étant fortement dépendant de l'application, les processeurs n'utilisent pas toutes leurs ressources en permanence et ces ressources peuvent donc être utilisées pour l'exécution d'instructions redondantes. Cette thèse présente une méthodologie d'injection fautes pour les processeurs VLIW et trois mécanismes matériels pour traiter les pannes légères, permanentes et à long terme menant à quatre contributions. La première contribution présente un schéma d'analyse du facteur de vulnérabilité architecturale et du facteur de vulnérabilité d'instruction pour les processeurs VLIW.

La deuxième contribution explore les ressources inactives hétérogènes au moment de l'exécution, à l'intérieur et à travers des ensembles d'instructions consécutifs. La technique se concentre sur les erreurs légères. La troisième contribution traite des défauts persistants. Un mécanisme matériel est proposé, qui réplique au moment de l'exécution les instructions et les planifie aux emplacements inactifs en tenant compte des contraintes de ressources. Afin de réduire davantage le surcoût lié aux performances et de prendre en charge l'atténuation des erreurs uniques et multiples sur les transitoires de longue durée (LDT), une quatrième contribution est présentée. Nous proposons un mécanisme matériel qui détecte les défauts toujours actifs pendant l'exécution et réorganise les instructions pour utiliser non seulement les unités fonctionnelles saines, mais également les composants sans défaillance des unités fonctionnelles concernées.

Title: Performance Optimization Mechanisms for Fault-Resilient VLIW Processors.

Keywords: fault tolerance, VLIW processors, idle resource exploitation, performance optimization, fault injection, vulnerability analysis Abstract: Embedded processors in critical domains require a combination of reliability, performance and low energy consumption. Very Long Instruction Word (VLIW) processors provide performance improvements through Instruction Level Parallelism (ILP) exploitation, while keeping cost and power in low levels. Since the ILP is highly application dependent, the processors do not use all their resources constantly and, thus, these resources can be utilized for redundant instruction execution. This dissertation presents a fault injection methodology for VLIW processors and three hardware mechanisms to deal with soft, permanent and long-term faults leading to four contributions. The first contribution presents an Architectural Vulnerability Factor (AVF) and Instruction Vulnerability Factor (IVF) analysis schema for VLIW processors.

The second contribution explores heterogeneous idle resources at run-time both inside and across consecutive instruction bundles. The technique focuses on soft errors. The third contribution deals with persistent faults. A hardware mechanism is proposed which replicates at run-time the instructions and schedules them at the idle slots considering the resource constraints. In order to further decrease the performance overhead and to support single and multiple Long-Duration Transient (LDT) error mitigation a fourth contribution is presented. We propose a hardware mechanism, which detects the faults that are still active during execution and reschedules the instructions to use not only the healthy function units, but also the fault-free components of the affected function units. La première contribution présente un environnement danalyse de lArchitectural Vulnerability Factor (AVF) et de lInstruction Vulnerability Factor (IVF) pour les processeurs VLIW. Ces métriques définissent le facteur de vulnérabilité architecturale et micro-architecturale d'un processeur, quelle que soit la fréquence des occurrences de fautes. Lobjet de létude AVF et IVF dans cette thèse est de mettre en évidence les capacités de masquage de fautes des processeurs VLIW de type RISC et de trouver les parties les plus critiques de la conception qui doivent être protégées contre ces fautes. Pour cela, une méthodologie dinjection de fautes au niveau de différentes structures de mémoire est proposée pour extraire les capacités de masquage aux niveaux architecture et instruction du processeur. Un schéma de classification des défaillances de haut niveau est présenté pour catégoriser la sortie du processeur.

La deuxième contribution explore les ressources inactives hétérogènes au moment de l'exécution, à l'intérieur dun ensemble et entre plusieurs ensembles d'instructions conséiii cutifs. Pour ce faire, une technique dordonnancement des instructions optimisée pour le matériel est appliquée en parallèle avec le pipeline afin de contrôler efficacement la réplication et lordonnancement des instructions. Suivant les tendances à la parallélisation croissante, une conception ciblant les architectures VLIW clustérisées est également proposée pour traiter les problèmes de passage à léchelle, tout en maintenant un surcoût en surface et puissance raisonnable. La technique proposée accélère la performance de 43,68% avec un surcoût en surface et en puissance de ∼10% par rapport aux approches existantes. Les analyses AVF et IVF évaluent la vulnérabilité du processeur avec le mécanisme proposé.

Les résultats montrent quen raison du mécanisme proposé et de la technique de réplication appliquée, les instructions les plus vulnérables de larchitecture protégée, cest-à-dire les opérations arithmétiques et mémoire en entier, sont jusqu'à 2,2x moins vulnérables que celles de larchitecture non protégée.

Chapter 1

Introduction and Motivations

The design of modern embedded systems is very challenging, since these systems have to simultaneously meet a number of criteria that usually contradict one another. Embedded applications usually have to react and provide their result within a fixed delay, so the total execution time is essential. A failure of an embedded system can have fatal consequences, so reliability has become a very important factor. On the other hand, the Integrated Circuit (IC) industry has been striving towards unit cost reduction, so area and power minimization is of great importance.

Increasing the clock frequency is a common practise to increase system performance, and, thus, the application execution time [START_REF] Yu | Towards high-performance and energy-efficient multi-core processors[END_REF]. However, by increasing the clock frequency, the power consumption is increased as well. A solution to this issue was the evolution of the classic single-core architectures to architectures supporting a kind of parallelism. The shrinking of the transistor size enables hundreds of millions transistors to be placed on a single chip reducing manufacturing cost and increasing integration and computer processing abilities. Three levels of parallel execution exist: a) Thread Level Parallelism (TLP), where different tasks are executed in parallel on an architecture with several processing elements (e.g. Multi-cores, Simultaneous multithreading (SMT) processors), b) Data Level Parallelism (DLP), where parallelism arises from executing essentially the same code on a large number of data (e.g. Single Instruction Multiple Data (SIMD) processors, vector processors and Graphics Processing Units (GPUs)), and c) Instruction Level Parallelism (ILP), where parallelism is explored by executing in parallel independent instructions (e.g. Very Large Instruction Word (VLIW) processors and superscalars). Architectures exploring TLP (such as General Purpose Processors (GPP)) are used in multi-application domains where task parallelization is of critical importance and they introduce increased complexity and cost [START_REF] Blake | A survey of multicore processors[END_REF]. Architectures exploring DLP introduce large area and power overhead and they are useful only in case of applications with extensive data level parallelism (e.g. rendering applications [START_REF] Krüger | Linear algebra operators for gpu implementation of numerical algorithms[END_REF], etc.). Architectures exploring ILP can offer parallelism with minimum complexity [START_REF] Schlansker | Achieving high levels of instruction-level parallelism with reduced hardware complexity[END_REF] being a very promising candidate for the domain of embedded systems striving for performance, without introducing high area overhead (e.g. Hexagon DSP [START_REF] Codrescu | Hexagon dsp: An architecture optimized for mobile multimedia and communications[END_REF], etc.).

To reduce power consumption, another common practise is to reduce the operating voltage and frequency of the embedded system. However, reducing the operating voltage in combination with the decreasing size of the transistors, makes the embedded systems more susceptible to reliability violations and, thus, less reliable [START_REF] Mcpherson | Reliability challenges for 45nm and beyond[END_REF], [START_REF] Shivakumar | Modeling the effect of technology trends on the soft error rate of combinational logic[END_REF]. Reliability violations occur due to Process, Voltage, and Temperature (PVT) variations [START_REF] Sengupta | A process, voltage, and temperature compensated cmos constant current reference[END_REF], circuit aging-wearout induced by failure mechanisms, such as Negative-Bias Temperature Instability (NBTI), Hot Carrier Injection (HCI) [START_REF] Oboril | Extratime: Modeling and analysis of wearout due to transistor aging at microarchitecture-level[END_REF], radiation-induced Single-Event Effects (SEEs), such as Single-Event Upsets (SEUs) and Single Event Transients (SETs) [START_REF] Baumann | Radiation-induced soft errors in advanced semiconductor technologies[END_REF], clock skews [START_REF] Ramanathan | Fault-tolerant clock synchronization in distributed systems[END_REF], thermal stress [START_REF] Skadron | Temperature-aware microarchitecture: Modeling and implementation[END_REF], electromagnetic interference, such as cross-talk and ground bounce [START_REF] Sudo | Electromagnetic interference (emi) of system-on-package (sop)[END_REF], etc. These phenomena can cause errors that may affect the embedded system temporarily (soft errors), permanently (hard errors) or semi-permanently (intermittent errors) [START_REF] Castano | Resilient Computer System Design[END_REF]. To satisfy the increasing demand for reliability, embedded systems are usually designed with error detection and/or error correction/mitigation capabilities.

However, to increase the reliability, it usually implies a form of redundancy, either spatial or temporal, impacting in a negative way on the area and/or the execution time. Several techniques have been developed to provide reliability from the transistor level up to the application level, using either Hardware (HW) or Software (SW) redundancy [START_REF] Psychou | Classification of resilience techniques against functional errors at higher abstraction layers of digital systems[END_REF]. Approaches using HW redundancy extend the hardware of the original unprotected system by adding spare resources. Then, the same instructions are executed several times on the extra resources and their results are compared to provide error detection and/or correction [START_REF] Klecka | Error self-checking and recovery using lock-step processor pair architecture[END_REF]. As the instructions are executed in parallel, normally no execution time overhead is observed.

However, the area overhead is significantly increased. On the other hand, SW redundancy mechanisms introduce redundancy through software modifications on the application running on the original unprotected system. They reuse the available resources to execute the fault tolerant instructions, and, thus, increasing the execution time [START_REF] Reis | August. Swift: Software implemented fault tolerance[END_REF].

In this dissertation, we explore efficient ways to provide reliability to the embedded systems, while keeping the area and execution time overhead low. We expect that SW redundancy methods are able to achieve reliability with less cost when they are combined with architectures that have inherent redundancy, such as VLIW processors.

VLIW Processors

An example of a VLIW architecture (similar to VEX [START_REF] Fisher | Embedded computing: a VLIW approach to architecture, compilers and tools[END_REF]) is presented in Fig. 1 Counter (PC). Thus, it can issue up to n instructions per cycle, where n is the number of issues of the architecture. These instructions are executed on:

• Memory units (MEM) that perform load and store instructions. There are as many memory units as data cache memory ports connected to the processor. More precisely, there should be at least ⌈n/4⌉ data cache ports to interact with the Data Memory (DM). In the presented example there is one MEM in the second issue.

• Integer and logic units that execute the common set of integer, compare, shift and logical instructions on registers or immediate operands. More precisely, the VLIW FUs are either complex FUs, which are able to execute all types of operations and simpler FUs, which cannot execute sophisticated operations, such as multiplications and divisions. In this configuration, there are ⌈n/2⌉ simple FUs, including only ALUs and ⌈n/2⌉ complex FUs, including ALUs and multiplication units. These FUs commit their result in the registers of a Register File (RF) comprising of 64 general-purpose 32-bit registers.

• Single branch unit that executes control instructions based on conditional results stored in registers. The control instructions can be conditional branches, unconditional jumps, direct and indirect calls, and returns. In this configuration the BRanch (BR)

unit is only available in the first issue.

The Instruction-Set Architecture (ISA) considered in this dissertation follows the RISC ISA implementation and encoding (similar to the ISA of RISC-V processor [START_REF] Waterman | The risc-v instruction set[END_REF]). The number of instructions executed in parallel per cycle depends on VLIW's FU parallelization capability (i.e. issue-width), the configuration of the VLIW (type of FUs used) and the intrinsic ILP available in each application. The instructions, which are issued and executed in parallel, form a bundle named instruction bundle. The VLIWs execute instructions in parallel, based on a fixed schedule determined when the programs are compiled.

For instance, suppose that the following matrix multiplication operation needs to be calculated:

  A B C D   ×   E G   =   A × E + B × G C × E + D × G   (1.1)
As shown, for the calculation of this equation we need to perform four independent multiplications and two independent additions afterwards. Compilers can determine this parallelization opportunity and exploit processor's resources to obtain better performance, while respecting dependencies (e.g. the addition must be executed after the calculation of the multiplications, thus it is dependent from them). Since the order of execution of instruction and the decision of which operations can be executed simultaneously is handled by the compiler, any scheduling hardware (such as the instruction queue, reorder buffer, dependency-checking) that is needed when using out-oforder processors is avoided. Thus, VLIWs offer good computing power, high parallelization and performance gain with reduced hardware complexity and power consumption. For this reason VLIWs have been commercialized and used in several implementations during the past years (e.g., Intel Itanium [START_REF] Sharangpani | Itanium processor microarchitecture[END_REF], Trimedia CPU64 [START_REF] Van Eijndhoven | Trimedia cpu64 architecture[END_REF], Hexagon DSP [START_REF] Codrescu | Hexagon dsp: An architecture optimized for mobile multimedia and communications[END_REF], etc.).

VLIWs and Fault Tolerance

In the context of VLIW processors, the compiler is not always able to fill the entire bundle with instructions [1], because either there is no parallelism in the application or the processor configuration provides limited resources. Hence, idle slots are introduced in the form of No OPeration instructions (NOP). These idle slots can be used to execute redundant instructions. In this way, processor's reliability increases since SW redundancy is applied, while the execution time overhead, introduced by the instruction replication, decreases. The SW redundancy approach applied on VLIWs can be implemented either in software or in hardware.

Approaches following a software implementation insert redundant instructions during design-time (i.e. applying a kind of redundancy in the original code itself) and/or during compile-time (i.e. the compiler is programmed to apply a kind of redundancy during compilation). They can efficiently explore the idle slots to schedule the redundant instructions without additional hardware control. However, the code size, the storage requirements and the power consumption are increased, whereas they cannot deal with dynamically changing faulty environments. For instance, the compiler duplicates the operations and schedules them in different FUs of a VLIW processor [START_REF] Bolchini | A software methodology for detecting hardware faults in vliw data paths[END_REF] or it exploits the idle FUs for soft error mitigation by adding a new time slot, whenever the idle FU exploitation in the current time slot is not possible [START_REF] Hu | Compiler-directed instruction duplication for soft error detection[END_REF]. For the comparison of the results of the replicated instructions extra comparison instructions should be executed [START_REF] Bolchini | A software methodology for detecting hardware faults in vliw data paths[END_REF][START_REF] Blough | Fault tolerance in super-scalar and vliw processors[END_REF]. To reduce the number of executed instructions, software-implemented approaches are combined with hardware implementations.

The instruction duplication and scheduling is performed in the software by the compiler, but the comparison is performed by the hardware. In case of an error, a simple HW instruction rebinding takes place so as to re-execute the instruction at the next time slot [START_REF] Schözel | Hw/sw co-detection of transient and permanent faults with fast recovery in statically scheduled data paths[END_REF].

Hardware mechanisms replicate the instructions at run-time. Existing approaches maintain the compiler's result and explore the use of idle FUs in space, i.e., only inside the current instruction bundle. For instance, in [START_REF] Sartor | A novel phase-based low overhead fault tolerance approach for vliw processors[END_REF], the idle issue slots inside the current instruction bundle are used for the execution of the duplicated instructions. If no idle slots exist, the instructions are not duplicated, which reduces the reliability of the processor. In [START_REF] Sartor | Adaptive ilp control to increase fault tolerance for vliw processors[END_REF][START_REF] Sartor | Exploiting idle hardware to provide low overhead fault tolerance for vliw processors[END_REF] the technique is extended by adding an extra time slot, so as to duplicate the instruction bundles that have more that half of its issue-width filled with instructions. However, the execution overhead is increased.

In this dissertation, we explore hardware mechanisms for SW redundancy, as they can efficiently deal with dynamically changing faulty environments compared to software implementations. We expect that by exploring the idle FUs of VLIWs, not only in space, but also in time through rescheduling of independent instructions of subsequent bundles, the reliability will be increased, while the execution time overhead will decrease.

Motivations

To motivate the benefits of the design of such mechanisms, we need to reply to two main questions:

1. How many of these resources are actually available to be used for fault tolerance each cycle?

How many of each application's instructions can be potentially rescheduled to enable further idle FU exploitation?

In order to answer to these fundamental questions, we analyzed ten basic media benchmarks from the MediaBench suite [START_REF] Lee | Mediabench: a tool for evaluating and synthesizing multimedia and communications systems[END_REF] with respect to their intrinsic parallelization capability. Similar media applications have been used by others in the literature to evaluate fault tolerant approaches [START_REF] Sartor | Exploiting idle hardware to provide low overhead fault tolerance for vliw processors[END_REF], [START_REF] Bolchini | A software methodology for detecting hardware faults in vliw data paths[END_REF], [START_REF] Mehrara | Low-cost protection for ser upsets and silicon defects[END_REF]. In order to perform our analysis we utilized the VEX C compiler 1 provided by HP to compile our benchmarks. Initially, we perform an analysis of the binaries obtained by the VEX compiler in order to export the benchmarks' characteristics. Table 1.1 illustrates the average number of instructions per bundle, ILP, for the 4-issue and 8-issue VLIW configurations. We observe that 1.51 ≤ ILP ≤ 2.85 for the 4-issue configuration. For the 8-issue configuration, we observe that 1.75 ≤ ILP ≤ 4. 46. This implies that in several bundles, there is a sufficient number of idle slots to be exploited. By duplicating the issue width, it does not imply a duplication of the ILP, because of the limited parallelization capability of the applications. Therefore, more idle slots exist in the 8-issue configuration. ILP metric provides us relevant information for the idle FUs exploitation in space, meaning that only the idle FUs within one bundle are explored.

When idle FUs exploitation occurs also in time, meaning that the FUs exploitation is performed among several bundles, we require to explore another metric, i.e. the percentage of the dependency occurrences per application. In this way, we implicitly know how many instructions are independent and, thus, they can be postponed in time so as to explore idle FUs in upcoming bundles. We analyzed the benchmarks to identify the number of 1 The VEX compiler is derived from the Lx/ST200 C compiler, which is a descendant of the Multiflow C compiler. VEX compiler allows complex program compilation, custom instruction experimentation, and scalability. It targets C language and concentrates on acyclic scheduling (no software pipelining is supported). It supports partial predication and its only region shape is a trace (no superblocks nor treegions). It uses trace scheduling as its global scheduling engine. A programmable machine model determines the configuration of the target architecture. Some of the tuneable parameters that allow architecture exploration without having to recompile the compiler are for instance the number of clusters, the number of execution units, the issue width, and the latency of specific instructions.

the dependent instructions between two bundles. In Table 1.1 we present the dependency occurrence (%) for each application for zero, one, two and three or more simultaneous dependencies between consecutive bundles. As we observe, for most of the applications, the case of having zero dependencies between two consecutive bundles is more than 50%. The case with exactly one dependency is also quite frequent (∼40%), whereas the case of multiple dependencies is rather rare (∼15%). Considering the limited ILP of the applications and the limited number of dependent instructions between consecutive bundles, we assume that the idle FU exploitation in time would be beneficial in terms of execution time overhead improvement.

The need for increased reliability in combination with the above-mentioned findings regarding applications' characteristics motivate the development of efficient hardware mechanisms that exploit idle resources both in space (limited ILP of the applications) and time (independent instructions that can be postponed later). The next subsection presents an overview of the contributions of this work which are all driven by the observation of several idle resources in modern VLIW processors.

Dissertation Contributions

The main contributions of this dissertation with respect to the research topic of reliable VLIW processors are the following. whereas an extended version has been submitted for publication in [START_REF] Psiakis | HW initiated idle resource exploitation for heterogeneous fault tolerant VLIW processors[END_REF].

• Instruction rescheduling for persistent errors: When errors become persistent, the number of available FUs is reduced, thus affecting the execution time of the applications. A coarse-grained mitigation mechanism is proposed, that replicates and binds the instructions at run-time in order to provide error detection and mitigation. When a permanent error is detected, the instruction execution is modified to avoid the faulty FU.

Both instruction replication and binding explore the healthy FUs taking the limitations on the type and the number of resources into account. A set of evaluation performance experiments with respect to the execution time overhead are performed and show up to 49% performance gain over existing techniques. This work has been published in [START_REF] Psiakis | Run-Time Instruction Replication for Permanent and Soft Error Mitigation in VLIW Processors[END_REF].

In order to further decrease the performance overhead, while supporting dynamic faulty environments including single and multiple Long-Duration Transient (LDT) faults, we propose a fine-grained mitigation mechanism that detects the active faults during execution and excludes only the faulty components of the affected FUs and for as long as it is necessary. To achieve that, a fine-grained micro-architectural solution is proposed that partitions an FU in components, where each component is an individual circuit that executes a group of instructions. Each FU component is enhanced with a Built-In Current Sensor (BICS) mechanism, so as to identify the exact location of the fault and the duration that the fault is active. An online fine-grained instruction re-scheduling mechanism is proposed that explores idle healthy FU components in the current and the next instruction execution. Finally, we perform exhaustive fault injection simulations (214K)

varying the number of total faults, the number of concurrently occurring faults and the fault duration. The obtained results show a minor performance degradation (∼ 9% for four concurrent faults) even for several occurring multiple long duration faults. This work has been accepted for publication in [START_REF] Psiakis | Fine-Grained Hardware Mitigation for Multiple Long-Duration Transients on VLIW Processors[END_REF].

Thesis Organization

The dissertation is organized into six chapters including this one. Chapter 2

Background and state of the art

In the following sections we present the state of the art concerning fault injection and fault mitigation methods on modern embedded architectures and more specifically VLIW processors. We present the work related to the aforementioned research area split in four sections. In the first section, we discuss the latest published works on fault injection and vulnerability analysis on modern embedded processors. In the following sections, we discuss about the state of the art techniques concerning transient, permanent, and long duration fault detection and mitigation.

Fault Injection and Vulnerability Analysis

According to [START_REF] Ziade | A survey on fault injection techniques[END_REF], the fault injection techniques can be classified as: 1) Hardware-based, 2)

Software-based, 3) Emulation-based, 4) Simulation-based, and 5) Hybrid methods.

Hardware-based fault injection techniques test processors in realistic experimental conditions (e.g., radiation chambers, thermal stress experiments). In [START_REF] Glorieux | Damsel?dynamic and applicative measurement of single events in logic[END_REF] an approach for SET detection and measurement is proposed. Real fault injection experiments are performed targeting a custom test chip, which is irradiated with heavy ions and pulsed lasers, while it is triggered by random inputs. FIST5 [START_REF] Gunneflo | Evaluation of error detection schemes using fault injection by heavy-ion radiation[END_REF], developed at the Chalmers University of Technology in Sweden, uses heavy ion radiation to create transient faults at random locations inside a chip when the chip is exposed to the radiation and can thus cause single-or multiple-bit-flips. Messaline [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF], developed at LAAS-CNRS, in Toulouse, France, uses both active probes and sockets to conduct pin-level fault injection. Messaline can inject stuck-at, open, bridging, and complex logical faults. Although such approaches are very accurate, a drawback is that they require the physical implementation of the device under test and that the tested chip is heavily stressed, being defected after the experiment.

Software-based fault injection techniques are applied at the application level and mainly focus on applications' masking capabilities. Due to application-level fault masking (operationlevel fault masking, fault masking due to fault propagation, and algorithm-level fault masking), the manifested errors may have zero impact on the application outputs. In [START_REF] Guo | Application-level resilience modeling for hpc fault tolerance[END_REF], an application-level fault modelling is proposed. The proposed method models the behaviour of the faults which have already been manifested in the application-level. In [START_REF] Schirmeier | Avoiding pitfalls in fault-injection based comparison of program susceptibility to soft errors[END_REF], softwareimplemented fault injection is studied and a pitfalls interpretation is presented. The fault probability is approximated using the Poisson distribution, which is used to inject single errors in the memory. Ways to reduce the experiment effort are also studied using fault sampling and defuse, and pruning analysis. A high-level fault injector for Intel Xeon Phi, built upon GDB (the GNU debugger), is presented in [START_REF] Oliveira | Carol-fi: An efficient fault-injection tool for vulnerability evaluation of modern hpc parallel accelerators[END_REF]. Results show that 75% of the injected faults do not generate an observable error. Software-based techniques cannot inject faults into locations that are inaccessible to software and, thus, they have limited accuracy.

On the other hand, since they are applied at high level, they require minimum simulation time and they can be easily implemented.

Emulation-based fault injection has been presented as an alternative solution for reducing the time spent during simulation-based fault injection campaigns. It is based on using Field Programmable Gate Arrays (FPGAs) for speeding-up fault simulation. This technique allows the designers to study the actual behavior of the circuit in an application environment, taking real-time interactions (e.g. I/Os) into account. However, when an emulator is used, the initial architecture or algorithmic description must be synthesizable to an FPGA design.

In simulation-based fault injection, there is a simulator that simulates the hardware as well as the injected faults. For instance, in [START_REF] Rajaraman | Seat-la: a soft error analysis tool for combinational logic[END_REF], the authors propose analytical equations to model the propagation of a voltage pulse to flip flops. Random errors are injected at all possible nodes of a circuit gate-level netlist in order to calculate the Soft Error Rate (SER).

Verification afterwards is performed using HSPICE. A tool for automated integration of fault injection modules is presented in [START_REF] Simevski | Automated integration of fault injection into the asic design flow[END_REF]. The gate-level netlist is enhanced with injection modules after each gate and flip-flop. These modules are parametrized by the user for various fault specifications. In [START_REF] Slimani | A tool for transient fault analysis in combinational circuits[END_REF] a gate-level fault injection methodology for logical and electrical masking effects in case of reconvergent fanouts is presented. Delayed fault glitches are generated in case of reconvergent fanouts. In [START_REF] Fu | A fault tolerance framework in a concurrent programming environment[END_REF] the authors propose a simulator implemented fault injection tool, where faults are induced by altering the logical values of the model elements during the simulation. They enhance MGSim [START_REF] Poss | Mgsim -a simulation environment for multi-core research and education[END_REF] with a fault injection capability, thus the fault injection is performed at component-level. In [START_REF] Miskov | Mars-c: Modeling and reduction of soft errors in combinational circuits[END_REF] the relationship between glitches in the gates and latched errors in the flip flops is studied using mathematical models. The results of the proposed method are compared with HSPICE's results. The work in [START_REF] Robache | A methodology for system-level fault injection based on gate-level faulty behavior[END_REF] introduces faulty behavior signatures that are computed after several gate-level injections. These signatures give the error occurrence probability of each output vector and are used by a saboteur that injects faults on a high level representation model of the tested design. This technique benefits from the high accuracy of the low-level injection and the simulation speed of a high-level injection. In [START_REF] Ebrahimi | Comprehensive analysis of sequential and combinational soft errors in an embedded processor[END_REF], the authors measure the SER of a processor starting from a technology response model up to application masking.

Only the injected errors from lower levels, which were latched by a memory element, are considered in the higher level and, thus, simulation time is reduced due to masking. In [START_REF] Paliaroutis | Placement-based ser estimation in the presence of multiple faults in combinational logic[END_REF],

a Monte-Carlo-based fault injection technique is proposed, taking into account multiple faults. In order to obtain accurate results, the injected nodes are selected according to their proximity to the error source in the place and route diagram.

AVF (Architecture Vulnerability Factor) was proposed by [START_REF] Shubhendu | A systematic methodology to compute the architectural vulnerability factors for a high-performance microprocessor[END_REF]. It concerns the probability of a soft error to result in an error of the program visible output. AVF estimation of modern microprocessors, using Statistical Fault Injection (SFI) for MBUs, is proposed in [START_REF] Maniatakos | Revisiting vulnerability analysis in modern microprocessors[END_REF]. The presented method partitions the design into various hierarchical levels and systematically performs incremental fault injections to generate vulnerability estimates. Fault injection times are accelerated by 15x on average. A simulator-level fault injection framework is proposed in [START_REF] Ubal | Exploring the heterogeneous design space for both performance and reliability[END_REF] that targets the Multi2Sim simulator. It measures the AVF of each application for a specific architecture, when single or multiple bit-flips into memory structures occur. In [4], the authors propose a new reliability metric named as Instruction Vulnerability Factor (IVF). Each instruction is tested with different operands in all the stages of a processor's pipeline under soft errors to measure the IVF. Results show that the execution stage is the most vulnerable part of the tested processor according to the average IVF of each stage. The study concludes with a technique for a fast and accurate AVF estimation using the IVFs of running instructions. Fault injection experiments at the Register Transfer Level (RTL) and Instruction Set Simulator (ISS) level are performed in [START_REF] Espinosa | Analysis and rtl correlation of instruction set simulators for automotive microcon-troller robustness verification[END_REF]. The results are compared in order to find a correlation between the two approaches.

Each application's instruction diversity is measured (i.e., the number of different opcodes) in order to detect which areas in the RTL are actually affected. The authors in [START_REF] Mueller-Gritschneder | Etiss-ml: A multi-level instruction set simulator with rtl-level fault injection support for the evaluation of cross-layer resiliency techniques[END_REF] propose a multi-level simulation that switches between ISS-level and RTL at run-time. The fault injection is performed when the simulation has passed to the RT level, evaluating the impact of soft errors in the pipeline of a RISC processor. The multi-level simulation benefits from the accuracy of the RTL-level simulation and the fast simulation time of the ISS-level simulation. Finally, simulation-based techniques provide accurate enough results, because the simulation models have most of the low-level hardware information while the run-time injection concept provides an accurate enough simulation of real scenarios. Additionally, when using simulation-based fault injection techniques, there is no risk to damage the system in use. A drawback of such approaches is the significant overhead in simulation and development time.

Few hybrid techniques also exist. A method combining software-based and simulationbased fault injection is presented in [START_REF] Guthoff | Combining software-implemented and simulation-based fault injection into a single fault injection method[END_REF]. It uses pin-level forcing or generates interrupts to activate software fault injection. Hybrid methods benefit from the the advantages of both categories.

In this dissertation, we developed a simulation-based fault injection methodology and we used the AVF and IVF metrics to evaluate the VLIW architecture and the proposed hardware mechanism. To the best of our knowledge, this is the first AVF, IVF study on VLIW processors with heterogeneous issues. Valuable insights are obtained from this analysis, concerning the masking capabilities and the vulnerability characteristics of VLIW processors.

VLIW Processors Under Soft Errors

Software-based and hardware-based techniques have been proposed to take advantage of the additional resources in statically scheduled processors with inherent resource redundancy and to provide error detection and/or error correction. Software-based approaches replicate and schedule the instructions at design-time and additional instructions are inserted for comparison of the results. Software error detection approaches apply the duplication of the instructions after the compilation of the code and, thus, they can control where the original and replicated instructions are executed, e.g., in different function units.

For instance, the approaches presented in [START_REF] Bolchini | A software methodology for detecting hardware faults in vliw data paths[END_REF][START_REF] Blough | Fault tolerance in super-scalar and vliw processors[END_REF] apply full duplication and full compari-son at the compiled code, whereas the approach of [START_REF] Holm | Low cost concurrent error detection in a vliw architecture using replicated instructions[END_REF] reduces the number of compared instructions. CASTED [START_REF] Mitropoulou | Casted: Coreadaptive software transient error detection for tightly coupled cores[END_REF] proposes a compiler-based technique to distribute error detection overhead across core/clusters applicable to tightly-coupled cores and clustered VLIWs.

To reduce the number of additional instructions, software-based approaches are combined with hardware-based ones. The instructions duplication and scheduling is performed by the compiler whereas the comparison is performed by the hardware [START_REF] Hu | Compiler-assisted soft error detection under performance and energy constraints in embedded systems[END_REF][START_REF] Hu | Compiler-directed instruction duplication for soft error detection[END_REF]. In [START_REF] Lee | Dynamic code duplication with vulnerability awareness for soft error detection on vliw architectures[END_REF], a hardware/software-based technique is proposed, where the compiler encodes information in the instructions and a hardware mechanism decodes the information to run-time duplicate the instructions.

However, the aforementioned approaches do not provide any correction means. In software-based techniques no additional hardware control is required, but code size, storage and power consumption are increased. The code size increase has also a negative impact on system reliability, as more bits are present in the system, leading to a higher soft error rate [START_REF] Reis | Design and evaluation of hybrid fault-detection systems[END_REF]. Additionally, software-based techniques cannot deal with dynamic fault situations, meaning that they are not able to change the schedule according the current affected unit. To avoid these limitations, hardware approaches replicate the instructions at run-time using specific hardware mechanisms.

Hardware-based approaches eliminate the need of high storage requirements and additional instructions and are either applied to homogeneous or heterogeneous VLIWs. In [START_REF] Anderson L Sartor | Adaptive and polymorphic vliw processor to optimize fault tolerance, energy consumption, and performance[END_REF],

a dynamically adaptive homogeneous processor design is proposed, which is capable of reconfiguring the processor in order to achieve the best trade-off among fault tolerance, performance, and energy consumption. The applied fault tolerance technique exploits the spatial and temporal identical idle resources of a VLIW. In [START_REF] Chen | An integrated fault-tolerant design framework for vliw processors[END_REF][START_REF] Chen | Reliable data path design of vliw processor cores with comprehensive error-coverage assessment[END_REF], the authors propose a common approach for short transient and permanent faults. The instructions are partitioned in groups in order to be able to be directly compared, inserting one or two idle cycles for each instruction bundle. Due to the increased performance overhead, the use of spare function units is explored. Results are provided for one spare unit and homogeneous issues with ALU FUs.

Combination of a software and a hardware approach is presented in [START_REF] Schözel | Hw/sw co-detection of transient and permanent faults with fast recovery in statically scheduled data paths[END_REF]. The instruction duplication and scheduling is performed by the compiler and the comparison of the instructions is performed by the hardware. In case of an error, re-execution takes place through a simple HW operation rebinding that adds an additional slot and re-binds the operation to another FU. However, the VLIW also consists of homogeneous issue slots with FUs that can execute any type of operations.

Although hardware-based approaches that exploit the idle resources inside homogeneous VLIWs introduce a less complex control logic, they cannot be applied for heterogeneous VLIW data paths. In addition, their scalability is argued because an N -issue implementation would require N identical FUs, with N multipliers, N memory units, etc. On top of that, homogeneity in FUs does not usually reflect to realistic VLIW processor configurations with limited resources (e.g., [START_REF] Sharangpani | Itanium processor microarchitecture[END_REF]). Especially for architectures that employ floating point units, the area and power overhead can be very high. Existing approaches for heterogeneous VLIWs do not explore dependencies and idle slots among instructions bundles, adding unnecessary performance overhead.

In [START_REF] Sartor | A novel phase-based low overhead fault tolerance approach for vliw processors[END_REF][START_REF] Sartor | Adaptive ilp control to increase fault tolerance for vliw processors[END_REF][START_REF] Sartor | Exploiting idle hardware to provide low overhead fault tolerance for vliw processors[END_REF], one-to-one coupling of heterogeneous VLIW pipelines is applied and, thus, the duplicated instructions can use the schedule of the original instructions given by the compiler. In [START_REF] Sartor | A novel phase-based low overhead fault tolerance approach for vliw processors[END_REF], error detection is applied through instruction duplication. If no idle slots exist, the instructions are not duplicated. When an error is detected, instruction reexecution is applied. In [START_REF] Sartor | Adaptive ilp control to increase fault tolerance for vliw processors[END_REF][START_REF] Sartor | Exploiting idle hardware to provide low overhead fault tolerance for vliw processors[END_REF], the technique is extended with ILP reduction. When a VLIW bundle has more than half of its issue-width filled with instructions, the bundle is divided into two and an additional time slot is added.

Compared with existing approaches, in this dissertation we propose a hardwarebased approach for heterogeneous VLIW data paths, which explores at run-time the idle slots in space and time, i.e. both inside and among instruction bundles, to decrease performance overhead. Restrictions due to both the number and the type of resources and the dependencies are taken into account. The technique proposed in this thesis is applied to a VLIW with a combination of simple and complex FUs, but it can be easily extended to VLIWs supporting floating point arithmetic operations. Supporting floating point operations would require FUs with significant area/power overhead, where their replication to achieve fault tolerance is forbidden when resources are limited. Thus, the proposed technique would have a more significant impact since it provides fault tolerance without adding extra FUs.

VLIW Processors Under Permanent Faults

The approaches designed for permanent errors have to modify the execution of the program to avoid the use of faulty units. As these methods focus on permanent faults, the detection of the faulty unit is usually assumed to be done upfront. These approaches can be implemented either off-line in software or on-line in hardware.

Several software approaches exist. For instance, the compiler duplicates the operations and schedules them in different FUs of VLIW processors [START_REF] Bolchini | A software methodology for detecting hardware faults in vliw data paths[END_REF] or exploits the idle slots for soft errors [START_REF] Hu | Compiler-directed instruction duplication for soft error detection[END_REF]. The authors in [START_REF] Mitropoulou | Casted: Coreadaptive software transient error detection for tightly coupled cores[END_REF] propose a compiler based technique to distribute error detection overhead to the available resources of architectures with abundant ILP, like

VLIWs. The software approach of [START_REF] Karri | Computer aided design of fault-tolerant application specific programmable processors[END_REF] stores several versions of the scheduling, where each scheduling is an alternative implementation for a given error. The permanent faults are detected offline and the program memory is modified adequately, in case of an off-line detected permanent fault. The work in [START_REF] Xu | Software-based Permanent Fault Recovery Techniques Using Inherent Hardware Redundancy[END_REF] focuses on permanent faults in the registers of the VLIW and proposes a recompilation technique with a register pressure control to re-assign variables to fault-free registers. Concerning the software approaches, usually no additional hardware control is required, but code size, storage and power consumption are increased.

Several hardware approaches also exist. Few of them are capable of online identifying and handling the permanent errors. The following techniques add spare hardware resources for the error handling, thus the area and control overhead are increased. In [START_REF] Chen | An integrated fault-tolerant design framework for vliw processors[END_REF], a spare function unit is added for error detection in VLIW, whereas single errors of one type are considered. In [START_REF] Chen | Reliable data path design of vliw processor cores with comprehensive error-coverage assessment[END_REF], spare function units are inserted to support Triple Modular Redundancy (TMR) and when not enough resources exist and the recovery is performed by re-execution of the faulty instruction. In [START_REF] Chan | High-level synthesis of gracefully degradable asics[END_REF][START_REF] Orailoglu | Microarchitectural synthesis of gracefully degradable, dynamically reconfigurable asics[END_REF], a coarse-grained reconfiguration is proposed for a single permanent fault for each hardware class of ASICs based on the partitioning of the time and instruction bundle space. The technique has been extended for multiple faults by assuming one fault at each band and each reconfiguration of the scheduling can isolate one faulty unit. The fault detection is assumed to have been done in advance. In [START_REF] Shyam | Voltaire: Low-cost fault detection solutions for vliw microprocessors[END_REF], the fault is detected by adding smaller ALUs and a reconfiguration logic is inserted in the execution stage to avoid the use of the faulty unit. Concerning the hardware approaches, usually no software modifications are required, but area and power consumption are increased due to extra hardware.

Some approaches combine software and hardware implementations. In [START_REF] Schölzel | Combining hardware-and software-based self-repair methods for statically scheduled data paths[END_REF], a software repair routine modifies the instructions permanently in the memory. During start-up, a selftest takes place to identify the faulty slots. This information is used to change the schedule stored in the memory. If the repair routine fails, a simple hardware binding mechanisms adds time slots and sequentially maps the instructions that cannot be assigned to other slots. In [START_REF] Schölzel | Fine-grained software-based self-repair of VLIW processors[END_REF], the approach is extended to cover pipeline registers, the register ports and the bypass logic. In [START_REF] Schölzel | A comprehensive software-based self-test and self-repair method for statically scheduled superscalar processors[END_REF], the approach is combined with adaptive software-based self-test, assuming though that the permanent errors have been already detected.

When permanent errors occur, either spare units have to be used or the executed program has to be modified through self-repair routine or through the use of several stored versions. However, these solutions introduce high area overhead for the additional resources, time overhead for the execution of the repair algorithm and storage overhead of the multi-versioning. To address these limitations, a hardware mechanism is proposed (Chapter 5, Section 1) which at run-time replicates the instructions and schedules them at the idle FUs considering the resource constraints. If a resource becomes faulty, the proposed approach efficiently rebinds both the original and replicated instructions during execution.

VLIW Processors Under Long-Term Faults

To the best of our knowledge, there is no technique targeting VLIW processors that deals with Long-Duration Transient (LDT) faults. Few approaches exist that focus on LDTs in general and they mostly focus on the error detection part at the transistor level using Built-In Current Sensors (BICS). In [5], a comparison of different BISCs can be found.

Existing approaches usually stall the computation as long as the LDTs are valid or apply re-execution of the faulty instruction to single instruction processors. In [START_REF] Lisboa | Using builtin sensors to cope with long duration transient faults in future technologies[END_REF], a BICS is proposed as a SET sensor connected directly to the bulk of transistors. In [START_REF] Bastos | A single built-in sensor to check pull-up and pull-down cmos networks against transient faults[END_REF], a new lower area BICS scheme is propose using a single circuit to monitor at the same time both CMOS networks. When the SET is vanished, the computation restarts. In [START_REF] Leite | Using bulk built-in current sensors and recomputing techniques to mitigate transient faults in microprocessors[END_REF], a recomputing instruction mechanism is combined with BICS for transient errors on a micro-controller.

In [START_REF] Koser | Tackling long duration transients in sequential logic[END_REF][START_REF] Koser | A long duration transient resilient pipeline scheme[END_REF], DMR is applied to detect any corruption of the application logic in a pipeline processor and a new micro-rollback scheme is applied to correct long duration transients, single event upsets and timing violation. Other approaches insert spare resources increasing the area overhead. For instance, a fault tolerant technique with a double-mirror BISC is proposed in [START_REF] Guibane | Fault tolerant system based on iddq testing[END_REF], allowing the detection of abnormal current consumption. If a defect occurs, redundant circuits are used.

Concerning VLIW processors, as most of the existing approaches are designed for transient and/or permanent errors, they are either not applicable or too pessimistic for LDTs.

As mentioned in the previous sections, several software-based and hardware-based techniques have been proposed to take advantage of the abundant resources inside the VLIW data paths in order to provide error detection and/or error correction.

Software-based approaches for transient errors apply duplication of the instructions at the compilation time and. Thus, they can control where the original and replicated instructions are executed, i.e., in different function units, to support the detection of both transient and permanent faults [START_REF] Bolchini | A software methodology for detecting hardware faults in vliw data paths[END_REF][START_REF] Blough | Fault tolerance in super-scalar and vliw processors[END_REF][START_REF] Holm | Low cost concurrent error detection in a vliw architecture using replicated instructions[END_REF][START_REF] Hu | Compiler-assisted soft error detection under performance and energy constraints in embedded systems[END_REF][START_REF] Hu | Compiler-directed instruction duplication for soft error detection[END_REF][START_REF] Schözel | Hw/sw co-detection of transient and permanent faults with fast recovery in statically scheduled data paths[END_REF]. Although these techniques could be applied for LDTs, the performance overhead introduced by the continuous re-execution of the faulty instructions because of the long duration faults is rather significant. Hardwarebased approaches for transient errors replicate the instructions at run-time using specific hardware [START_REF] Sartor | Adaptive ilp control to increase fault tolerance for vliw processors[END_REF][START_REF] Sartor | Exploiting idle hardware to provide low overhead fault tolerance for vliw processors[END_REF][START_REF] Psiakis | Neda: Nop exploitation with dependency awareness for reliable vliw processors[END_REF]. Since no restrictions are applied to the on-line schedule, these techniques cannot detect persistent errors and, thus, they are not applicable to LDTs.

The approaches designed for permanent errors have to modify the execution of the program to avoid the use of faulty units. Approaches based on the modification of the execution of the program can be implemented either off-line in software or on-line in hardware. Software approaches such as [START_REF] Karri | Computer aided design of fault-tolerant application specific programmable processors[END_REF][START_REF] Schölzel | Combining hardware-and software-based self-repair methods for statically scheduled data paths[END_REF][START_REF] Schölzel | Fine-grained software-based self-repair of VLIW processors[END_REF][START_REF] Schölzel | A comprehensive software-based self-test and self-repair method for statically scheduled superscalar processors[END_REF] assume that the detection of the faulty unit is done upfront, which is not possible in the case of LDTs. Few hardware approaches are capable of online identifying the permanent errors [START_REF] Psiakis | Run-time instruction replication for permanent and soft error mitigation in vliw processors[END_REF][START_REF] Shyam | Voltaire: Low-cost fault detection solutions for vliw microprocessors[END_REF][START_REF] Chen | An integrated fault-tolerant design framework for vliw processors[END_REF][START_REF] Chen | Reliable data path design of vliw processor cores with comprehensive error-coverage assessment[END_REF], and, thus, could be applied for LDTs. However, the exclusion of the faulty unit is permanent leading to pessimistic results

for LDTs.

To eliminate the performance overhead due to the re-execution or due to the pessimistic FU exclusion for LDTs on VLIW processors, we propose a finegrained mitigation hardware mechanism combined with BISC FUs (Chapter 5, Section 2). During execution, this mechanism characterizes the components of each FU, identifies LDTs, reschedules the faulty instructions to the healthy FU components, and temporarily excludes the faulty ones. When LDTs vanish, the faulty FU components can be reused once again.

19

Chapter 3

Architecture's Vulnerability Analysis

Today's increased demand for reliable systems rises questions such as:

1. Given a processor's architecture with a given fault masking capability, what is the frequency of the errors a system experiences from its environment?

2. Is it necessary to incorporate a mitigation technique inside a given design, or the probability of a fault propagated to the user level is rather negligible (fault masking)?

3. Which part(s) of an architecture should be protected the most?

4. Which is the most suitable mitigation technique to be adopted?

Although the first question is not always easy to be answered since it depends on external to the system factors (e.g., radiation, PVT), the research community found a way to respond to the second and third questions by introducing two new metrics. These metrics define the architectural and micro-architectural vulnerability factor of a processor, regardless of the frequency of the fault occurrences. In the following sections, we explore the Architectural Vulnerability Factor (AVF) and the micro-architectural / Instruction Vulnerability Factor (IVF) of the VLIW architecture used in this dissertation, in order to point out its fault masking capabilities and find the most critical parts of the design that should be protected against faults.

Architectural Vulnerability Factor Analysis

A structure's architectural vulnerability factor (AVF) is the probability that a fault in a processor will result in a visible error in the final output of a program [4,[START_REF] Shubhendu | A systematic methodology to compute the architectural vulnerability factors for a high-performance microprocessor[END_REF]. For instance, an error in the offset part of a NOP instruction has zero impact to the executed application, it is considered as masked and, thus, it reduces the overall AVF of the processor. The AVF is measured only for the storage cells (bits) of an architecture. Adopting the classification of [4,[START_REF] Shubhendu | A systematic methodology to compute the architectural vulnerability factors for a high-performance microprocessor[END_REF] the important bits are the Architecturally Correct Execution (ACE) bits, while the remaining bits are un-ACE bits. The AVF is defined as the portion of the important bits, which are required for the correct calculation of the final output of a program, to the total number of bits and it is given by AV F = ACE storage bits T otal storage bits of the processor .

(3.1)

Since the processor changes its state at each cycle, the ACE bits also change. Therefore, the AVF is calculated per cycle.

We define the following six classes that refer to the application's output and the processor's state after the complete execution of a program with one fault injected, as compared to the golden values obtained from an execution without faults:

1. Correct: The program is executed correctly. The program's output and processor's internal states (registers, stack memory, PC, etc.) match with the golden values.

Execution Time Violation (ETV):

The output and processor's internal states are as expected, but the program finishes later than expected.

3. Crash: Execution finishes unexpectedly. An exception is raised and the processor crashes.

4. Hang: Execution enters in an infinite loop.

Application Output Mismatch (AOM):

The program exits correctly, but its output does not match with the golden one.

Processor's State Failure (PSF):

The output of the program is correct, but there is(are) mismatch(es) in processor's internal state (registers, stack memory, PC, etc.).

When a fault occurs in the ACE bits, the result of the execution is either Crash, Hang or AOM. On the other hand, faults in the un-ACE bits result in Correct, ETV or PSF outputs.

A processor's simulator that simulates the behaviour of the VLIW architecture was developed during this thesis. The processor's model is developed in C++ and it is capable of executing vex binaries. The simulator is enhanced with: a) a non-synthesizable fault injection function, which injects faults at user specified injection points and random timestamps, and b) a function which checks the output of the application and the state of the processor, compares them with the golden values, and categorizes the result in one of the six presented classes. The injection points can be in all the storage structures of the processor.

The memory units (IM and DM) are excluded for better simulation performance under the assumption that ECC codes or similar techniques have been used for their protection.

The fault injection experiment is presented by Alg. 1. We execute once the binary file with our simulator without injecting faults to obtain the golden output values of the application and the golden state of the processor (line 1). Having the information about the cycles needed for one complete execution, we decide the number of cycles we will inject faults on (inj_cycles). Then, at each iteration, we choose randomly one unique cycle inside the valid range where the fault will be injected (line 3). For each of these cycles we iterate over all issues, all memory structures and all bits of each structure (lines 4,5,6).

Algorithm 1 AVF Fault Injection Experiment Algorithm 1: ./vliw "binary_file" > gold_log 2: for (i = 0, i < inj_cycles, i++) do 3:

c[i] = unique_random(max_cycles, c, size_of(c)) 4:
for each issue ($is) do

5:
for each struct ($s) do 6:

for each bit ($b) do 7:

./vliw "bin" "gold_log" $is $s $b $c > inj_log end for 11: end for For the VLIW architecture used here we have four issues; the structures and their bits are shown in Table 3.1 (refer to Fig. 1.1). Thus, in every iteration, we inject one fault (modelled as bit-flip) to one bit of one of the FtoDC, DCtoEx, PC and RF registers. The results are compared with the golden ones from the gold_log file and a report is generated and stored into the inj_log file, categorizing each injection to one of the six presented categories. 3.2 presents the categorization of processor's AVF according to the aforementioned six classes when executing the matrix multiplication application. The results are normalized in order to be independent from the ILP and are presented in logarithmic scale. We observe that for most of the structures, the output of the application is rarely affected. This is because of: a) application masking (e.g. fault injection to a register that is not used by the application), b) architectural masking (e.g. the MSBits of the output of a multiplication instruction are affected, but the executed instruction passes only the LSBits to the output registers), c) logical masking (e.g. an AND operation between '0' and '0' has the same result as an AND operation between '1' and '0'). [START_REF] Nicolaidis | Design for soft error mitigation[END_REF][START_REF] Gill | An efficient bics design for seus detection and correction in semiconductor memories[END_REF][START_REF] Calin | Upset hardened memory design for submicron cmos technology[END_REF], there is not much work regarding the faults occurring in the execution stage of (VLIW) processors.

To identify the most vulnerable parts of a processor, except of the vulnerability factor of each tested structure, one should also consider the probability of an error occurring in this particular structure. According to the empirical model provided in [START_REF] Shivakumar | Modeling the effect of technology trends on the soft error rate of combinational logic[END_REF], this probability in case of soft errors is proportional to: Consequently, in order to measure this probability, we compare the logic area of each FU of each pipeline stage, as depicted in Table 3.2. We observe that the area coverage of the execution stage components, including both simple and complex FUs, in comparison with the area coverage of all the stages of this architecture is greater than 70%. This observation in combination with the aforementioned findings, motivate the focus of the proposed approaches of this dissertation on the protection of the execute stage. Consequently, in the remaining chapters, we present novel techniques to mitigate errors mainly in the execution stage of VLIW processors.

Instruction Vulnerability Factor Analysis

A processor's Instruction Vulnerability Factor (IVF) is the probability that a fault in a processor's pipeline register will result in a visible error in the final output of the instruction under study [4]. For instance, an error in the offset part of a LOAD instruction will result in a wrong memory address calculation and, thus, in a wrong memory read. The IVF of this particular LOAD instruction is consequently decreased. A counter paradigm is a fault occurring in a value which is used by a logical operation (e.g., AND, OR, XOR). In Table 3.3

presented in [3], P M shows the masking probability of a soft error occurring in one of the inputs of an logic gate. For example, when both inputs are 0, errors in each of the inputs of an OR or XOR gates are never masked. The IVF of these particular instructions is consequently high. P F shows the error propagation probability to the outputs of a gate and is calculated by

P F = 1 - ∑ 2 n i=1 P M i 2 n , (3.2)
where n is the number of inputs of the each gate.

Adopting the classification of [4] for IVF, the bits which are involved in the execution of an instruction are divided into two groups: Correct Execution of Instruction (CEI) and Un-CEI. If a fault in a pipeline register bit causes incorrect instruction output or abnormal Table 3.3: Logical masking for three logic gates [3].

Inputs AND OR XOR in 1 in 2 out P M out P M out P M 0 0 0 1 0 0 0 0 0 1 0 0.5 1 0.5 1 0 1 0 0 0.5 1 0.5 1 0 1 1 1 0 1 1 0 0 P F 0.5 0.5 1
behaviour (e.g., segmentation fault), then the bit is classified as CEI. Otherwise the bit is an Un-CEI one. The IVF is defined as the portion of the CEI bits of the each pipeline stage to the total number of bits of the processor and it is given by IV F = CEI storage bits of stage T otal storage bits of the processor .

(3.3)
We define the following four classes that refer to instruction's output and processor's state after the execution of an instruction with one fault injected, as compared to the golden values obtained from an execution without faults.

Correct:

The instruction is executed correctly. The output and processor's internal states (registers, stack memory, PC, etc.) match with the expected golden values.

2. Crash: Execution finishes unexpectedly. An exception is raised and the processor crashes.

Application Output Mismatch (AOM):

The instruction is executed, but its output does not match with the golden one.

Processor's State Failure (PSF):

The output of the instruction is correct but there is(are) mismatch(es) in processor's internal state (registers, stack memory, PC, etc.).

The faults in the CEI bits are responsible for Crash and AOM errors. for (i = 0, i < rest_n0, i++) do

3: r = random(max_rest) 4:
randomize(DM,RF)

./vliw $op $r > gold_log 6:

for each struct ($s) do 7:

for each bit ($b) do 8:

./vliw "gold_log" $op $r $s $b > inj_log end for 12: end for For each instruction and for each bit of each structure of the VLIW architecture we generate 1000 test cases in order to create a uniform distribution of the input masking probability. For each injected stage the IVF is calculated from Equation 3.3. Table 3.4 presents the IVF of each instruction of each stage of the processor. The table depicts the IVF of all the logical, multiplication, memory, control and integer arithmetic operations of the ISA of a RISC processor (similar to the ISA of RISC-V processor [START_REF] Waterman | The risc-v instruction set[END_REF]).

For all the instructions, the IVF of the fetch stage is greater than the IVF of the decode stage, meaning that the decode stage is more vulnerable than the fetch stage. This is because the registers of the decode stage are more than the registers of the fetch stage and, thus, there are more bits and more fault injection points, which affect the correct execution of the instruction. The logical masking effect, which was discussed in this section and analyzed for specific instructions in Table 3.3, is prominent enough for the XOR instructions (P M = 0, ∀ (in 1 , in 2 ) and P F = 1) which have the lowest IVF among all the other logical operations. We observe that integer arithmetic and memory operations have a lower IVF in the decode stage than other instructions (e.g. from the logical operations). This is explained because: a) these instructions use most of the pipeline registers in order to perform computations between registers and/or immediate values ( integer arithmetic operations) or for the computation of the memory addresses (memory operations), and b) there is no logical masking in integer arithmetic operations, thus errors are usually propagated to the output. The multiplication operations are implemented in the same way, but since only a part of the multiplication result (Hi or Low) passes as a result of the operation, there is some masking introduced which increases the IVF when errors are injected into the decode stage registers. The control operations change the PC and redirect the execution to the desired position inside the program. They operate in the decode stage, thus any fault injected into the decode stage registers has zero effect to the output of these operations, thus the IVF is always one.

Conclusion

In order to identify the most vulnerable parts of the adopted processor architecture, a fault injection methodology has been developed for VLIW processors. For that, we performed experiments to measure the Architectural Vulnerability Factor (AVF) and the Instruction Vulnerability Factor (IVF) of the processor. Vulnerability factor analysis results in combination with measurements for the logic area of each FU of each pipeline motivated the focus of the proposed approaches of this dissertation (Chapters 4 and 5) on the protection of the execute stage.

Time and Space Instruction

Rescheduling

We propose a hardware mechanism that combines the benefits of the software redundancy and the hardware mechanisms for heterogeneous VLIW data-paths. The proposed mechanism is capable of both replicating at run-time the original instructions to achieve fault tolerance and dynamically scheduling them to efficiently explore the idle slots in time and space to improve performance, while preserving reliability. The scheduling exploration window is two instruction bundles and their potential additional time slots. To support the scheduling decisions, a hardware dependency analysis takes place between the two original instruction bundles. The independent instructions can use the idle slots of the next bundle and the potential time slots added for the execution of its replicated instructions. As the instruction scheduling is flexible, a more efficient idle slot exploitation takes place.

Running example

In this section we present the proposed approach through a running example. (SUB 2 , MUL 2 ) and two idle slots, while B i+1 has one instruction (OR 3 ) and three idle slots.

B i-1 B i t i-1 ADD 1 ADD 1 MUL 1 MUL 1 SUB 2 t i MUL 2 ADD 1 MUL 1 MUL 2 SUB 2 MUL 2 t i+1 SUB 2 OR 3 NOP t i+2 OR 3 B i+1
The upper box of the Fig. 4.1a presents the corresponding assembly instructions with their implied registers. For instance, ADD 1 is an instruction that adds the values of the registers r1 and r3 and stores the result to the register r2 . Fig. 4.1b describes our approach for idle slot exploitation in consecutive bundles. We assume that the applied fault tolerance technique is the triplication of the instructions and, thus, every instruction has to be executed three times. The light blue boxes represent original instructions and the dark blue ones represent the replicated instructions. Initially, an instruction dependency analysis takes place (implementation details in Sections 4.4.1 and 4.4.2) between the instructions of two consecutive original bundles. If no dependency exists, the instructions that do not fit in the current bundle are allowed to be scheduled to the potential idle slots of the next bundle. In our example, when our approach is applied to the bundle B i-1 , none of the instructions (ADD 1 , MUL 1 ) uses as destination register one of the source or destination registers of the instructions of the bundle B i (SUB2 , MUL 2 ).

Hence, no dependency exists. On the other hand, concerning the bundles B i and B i+1 , the instruction OR 3 reads the registers r5 and r3 , which are also used as destination registers by SUB 2 and MUL 2 of B i . Hence, there is a dependency between the instructions of B i and the instruction of B i+1 . Therefore, a potential parallel execution of these instructions is forbidden.

The dependency analysis results are used by the replication scheduler (implementation details in Section 4.4.3), which is responsible for the dynamic scheduling of the original and duplicated instructions. The scheduler operates according to three priorities in the following order: 1 ⃝ instructions of a previous bundle have a higher priority than instructions of the current bundle, 2 ⃝ the dependent instructions have a higher priority than the independent ones, and 3 ⃝ the first copy of an instruction has a higher priority than the second copy of an instruction. These three priorities applied by the hardware scheduler to the considered instructions are illustrated in Fig. 4.1b by their respective encircled number.

In Fig. 4.1b, for t i-1 , one copy of each of the ADD 1 and MUL 1 is placed along with the original instructions occupying the two available idle slots, due to priority 3 ⃝. At t i , the scheduler is applied on the bundle B i and the remaining instructions of the previous bundle are scheduled first (due to priority 1 ⃝). Then, the original dependent instructions of the bundle B i are scheduled (priority 2 ⃝). Due to the dependency explained above, no exploration of the idle slots of B i+1 can take place and a new time slot has to be added.

At this new time slot t i+1 , the same scheduling policy is applied, filling the complete slot with the remaining dependent redundant instructions of B i (priority 2 ⃝). At t i+2 , there are not any remaining instructions from the previous bundle, thus OR 3 and its replicas are scheduled according to priority 3 ⃝.

Overview of the proposed architecture

We use the 4-issue VLIW data-path of Fig. 1.1 and the triplication as fault tolerant method to illustrate the proposed approach. The dependency analyzer is the component responsible for analyzing two subsequent bundles in order to identify potential dependencies. The replication switch allocates previously decoded instructions (from the ReplicRes register) and the currently decoded instructions (from the decoders) to the pipeline DCtoEX register following the schedule provided by the replication scheduler. The voting switch allocates and groups the results of the previously executed instructions (from the VotingRes register) as well as the currently executed instructions (from the FUs) to the voters for correction following the schedule provided by the voting scheduler. As our main goal is to reduce the performance overhead, the processing components required to be added in the VLIW data-path are strategically placed, whereas all the control components of our architecture are designed to run in parallel with the main data path of the processor, so as to not affect the clock frequency.

Processing Components

To enable the dynamic scheduling of the instructions, our approach requires two switches and a voter to be added in line with the VLIW data path, as shown in Fig. 4.2. In the rest of the chapter, n will represent the number of the issues.

Replication Switch

The replication switch selects some of the 2 × n possible inputs -i.e., the output of the ReplicRes [1] ReplicRes [3] ReplicRes [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF] 8:1 MUX DCtoEX [1] sel_r[0] sel_r [1] 8:1 MUX DCtoEX [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF] 8:1 MUX DCtoEX [3] sel_r [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF] sel_r [3] Issue 1 Issue 0 Issue 2 Issue 3

ReplicRes[0]

ReplicRes [1] ReplicRes [3] ReplicRes [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF]

Voting Switch

This switch is placed after the FUs and it is responsible for the grouping of the results of the replicated instructions: a) into the voters and b) into the VotingRes register. The results of the instructions, whose replicated instructions have not been executed yet, are stored to the VotingRes register (Fig. 4.6b). The voting scheduler is responsible for the correct storing of the results in the VotingRes register. The results of the two instances of the same instruction are stored in adjacent positions in the VotingRes register, i.e., in the even position for the first instance and in the odd position for the second instance. Using this configuration, the first input of a voter, Voter[i][0], is required to be connected only to the FUs. The second input, Voter[i] [1], is connected either to the FUs or to the VotingRes[2i] and the third input, [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF], to either the FUs or the VotingRes[2i+1] register, ∀i ∈ {0, .., n -1} (Fig. 4.6a).

Voter[i]
In this way the switch complexity and its corresponding area are reduced.

In case of the 4-issue VLIW, the switch is presented in Fig. to VotingRes [START_REF] Baumann | Radiation-induced soft errors in advanced semiconductor technologies[END_REF]). Fig. 4.6a depicts the part of the switch required for one voter. It has 12 inputs (4 coming from the FUs outputs and 8 from the VotingRes register outputs), which have to be connected to 12 voters inputs. Finally, the select signal is 96 bits.

Voters

The voters are similar to the majority voters like the ones used in [START_REF] Lyons | The use of triple-modular redundancy to improve computer reliability[END_REF]. These voters detect and correct errors between the values that were grouped by the Voting switch. The voters compare the three 32-bit results of the EX stage, either coming from the FUs or the VotingRes register. They can be also easily extended to compare the rest of the values in the registers in order to provide fault tolerance for the control flow (opcode comparison) and the register address (destination register comparison).

Control Logic Components

Information Extraction Unit

The information extraction unit is depicted in Fig. 4.8. It reads each instruction from the F stage and extracts the opcode, the destination, and the source registers. This early decoded information is stored in an intermediate internal register (Info register). The outputs are read from the dependency analyzer and the replication scheduler. To implement both the scheduling of the instructions to the replication switch and the grouping of the instruction to be voted in the voting switch, we need to introduce a logic that associates an instruction with an identifier. An Instruction Identifier (ID) corresponds to an instruction currently in the data path. These IDs provide the required information about the inputs of the replication switch in order to decide its output, through the selection signal vector sel_r of

Vo#ngRes[i]

Voter[i][0] Voter[i][1] 2:1 MUX Vo#ngRes[i+1] Voter[i][2] 2:1 MUX 4:1 MUX 4:1 MUX sel_v[i][0] sel_v[i][2] sel_v[i][4] sel_v[i][7] sel_v[i][6] sel_v[i][1] sel_v[i][3] sel_v[i][5]
(a) Part of the voting switch required for one voter.

B i-1 0 0 0 0 0 NOP 0 0 1 0 1 MEM 0 1 0 1 0 MUL 0 1 1 1 1 ALU B i 1 0 0 0 0 NOP 1 0 1 0 1 MEM 1 1 0 1 0 MUL 1 1 1 1 1 ALU
Two additional register arrays are used to store the remaining instructions that need to be scheduled, i.e., the FtoDC_rem and ReplicRes_rem. The ReplicRes_ID array is related to the remaining instructions from the previous bundle B i-1 : the first element (00000) indicates that the first slot is a NOP , the second one (00111)

stands for an ALU instruction, the third one (01010) stands for a MUL operation and the last one (01100) stands for a NOP . At the time t i-1 two ADD 1 and two MUL 1 instructions have been scheduled (Fig. 4.1b), so the ReplicRes_rem array has been updated accordingly by setting the corresponding values to 1.

Dependency Analyzer

The dependency analyzer in Fig. 4.8 decides about the dependencies between two subsequent bundles. To do so, it reads the opcode, the destination and the sources of each instruction of each bundle. Three possible dependency cases may exist: 1) Read After Write (RAW), 2)

Write After Read (WAR) and 3) Write After Write (WAW). RAW and WAW are taken care by the dependency analyzer. However, WAR never occurs as it is prevented by architecture design: The proposed mechanism may move the 'read' instruction in the next bundle and, thus, it will be executed in parallel with the 'write' instruction. However, as the rescheduling occurs after the decode stage, the read instruction has already obtained the correct value from the register file.

Replication Scheduler

The replication scheduler is responsible for the scheduling of the inputs of the replication switch, represented by ReplicRes_ID and FtoDC_ID, to the output of the switch, represented by DCtoEX_ID. The scheduling priorities are given in the following order: 1) whichever instruction remains in the ReplicRes register has the highest priority, 2) only the dependent instructions in the FtoDC register are scheduled and 3) the independent instructions from FtoDC register are scheduled.

Pre-processing

In order to reduce the overhead of the replication scheduler, our approach works on instruction occupation vectors instead of the ID arrays. Following the above priority rules we introduce the three following vector groups: 1) ReplicRes for the previous instructions, 2) FtoDC_dep for the dependent current instructions and 3) FtoDC for the independent current instructions. Each group includes two vectors: 1) instr, which indicates the existence of instructions in the slots and, 2) mul, which indicates if the instructions are multiplications based on the current VLIW configuration. Thus, each element of the vector instr has a size of n, while each element in mul has a size equal to the number of issues with MUL FUs. Concerning the memory operations, as their execution is performed after the EX/VOTE switch, the voting scheduler is responsible for their correct scheduling.

Group Transformation

ReplicRes (ID[i][0] ∥ ID[i][1]) & (rem[i] ≥ 3 -j) FtoDC_dep (ID[i][0] ∥ ID[i][1]) & (rem[i] ≥ 3 -j) & dep[i] FtoDC (ID[i][0] ∥ ID[i][1]) & (rem[i] ≥ 3 -j) & !dep[i]
The mul vector for each group is obtained by checking whether the IDs in the positions with a multiplication unit (i.e., i ∈ {2, 3}) belong to a multiplication instruction or not ). Therefore, the second and third bits of the ReplicRes_instr [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF] are set. The instruction in slot 2 is a multiplication, while the instruction in slot 3 is a NOP. Thus, the vector mul is set to 10 for all its entries. The FtoDC_dep_instr, FtoDC_dep_mul, FtoDC_instr and FtoDC_mul are constructed in a similar way.

(ID[i][0] & !ID[i][1]).
Bitwise Logic Based on the scheduling priorities, the occupation arrays are explored in the order depicted by Fig. 4.9 (Latin numbers in red). For each occupation array, two scheduling mechanisms are applied: 1) direct assignment, i.e., the issue where the instructions are originally scheduled is not modified and, thus, no verification of the type of FUs is required, and 2) circular exploration, which is applied after the direct assignment in case there are still instructions to be scheduled. These instructions are scheduled to the remaining idle slots taking into account the type of the FUs.

Direct assignment: This scheduling mechanism has two inputs: 1) the occupation vector for the instructions to be scheduled (instr) and 2) the current occupation of the issues (issues), and has three outputs: 1) the updated occupation of the issues (issues_up), 2) the scheduled instructions at this step (fit) and 3) the remaining ones to be scheduled (rest).

The mathematical representation of the direct assignment algorithm is defined as:

issues_up[j] = instr[j] ∥ issues, f it[j] = issues_up[j] ⊕ issues, rest[j] = instr[j] ⊕ f it[j], j ∈ {0, .., 2}. (4.1)
The scheduling is performed through a bitwise OR operation between the instr[j] and the issues vectors. The issues_up[j] result is compared (bitwise XOR) with the initial output vector issues to decide which of the instructions can be mapped directly to the output (fit[j]). According to the fit[j], the ID and rem arrays are modified as follows: a

) if fit[j][i] = 1, then Rem[i] = Rem[i] -1, b) DCtoEX_ID[i] = ID[i].
The sel_r vector signal is also updated: sel_r[i] = i + n for the ReplicRes group and sel_r[i] = i for the others.

To obtain the instructions that could not be scheduled directly, rest[j], the vector fit[j] is compared with the initial input vector instr [j]. If the vector rest[j] is zero, it means that all the instructions were scheduled and the next input vector can be explored for scheduling.

The fig. 4.10 shows how the direct assignment technique is applied to the running example. Initially, the issues vector is initialized to zero. We start by testing the ReplicRes vectors. Since instr[0] and instr [1] are both zero, no instruction exists to be scheduled.

Then, instr [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF] is assigned to the binary value 0110. The output fit [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF] is the same as the input instr [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF], meaning that all instructions can be scheduled (rest [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF] = 0000). Accord- ing to the fit [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF], the ID and rem arrays are modified as follows: a)

ReplicRes_Rem[1] = 0, b) ReplicRes_Rem[2] = 0, c) DCtoEX_ID[1] = ReplicRes_ID[1], d) DCtoEX_ID[2] =
ReplicRes_ID [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF]). We also update the sel_r vector signal as sel_r [1] = 5 and sel_r[2] = 6.

The next vectors to be checked are the FtoDC_dep vectors. The new issues is the previous issues_up [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF] and the input vector is instr[0]. The output fit[0] is not the same as the input instr[0], meaning that some instructions cannot be scheduled (rest[0] = 0010).

Finally issues_up[0] is the updated issues occupation vector. According to fit[0] we update the IDs and sel_r as we did above. As the rest signal is not zero and the bits in issues_up are not all set, there are still empty FUs that could be potentially used to schedule the rest instructions by applying the following circular exploration mechanism.

Circular exploration: This mechanism takes three inputs: 1) the occupation vector for the instructions to be scheduled (instr = FtoDC_ID [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF]. The sel_r vector signal is updated to sel_r[0] = 2. Finally, the issues is updated to 1111 for the next direct assignment, as depicted in Fig. 4.10, and, thus, no further scheduling exploration can be performed.

Time-slot insertion decision:

After the instruction scheduling phase, the replication scheduler decides whether there is a need to stall the fetch and decode stages. The stalling decision occurs when: a) there are still unscheduled instructions in the ReplicRes (Repli-cRes_rem ̸ = 0), or b) there are still unscheduled dependent instructions in the FtoDC (FtoDC_rem ̸ = 0).

Voting Scheduler

This scheduler decides the scheduling of the currently executed instructions either to the voters and the commit/memory phase or to the VotingRes register to be stored. It has two inputs: 1) DCtoEX_ID and 2) VotingRes_ID, which are concatenated to form an array named unGrouped_ID. A comparison-based sorting algorithm is applied to group the instructions with the same IDs in order to form triplets respecting the memory resource constraint. The output is a sorted array named Grouped_ID. The way the instructions have been sorted

in triplets determines the values of the signal sel_v, which configures the voting switch.

For instance, if a triplet is formed in the three first places of the Grouped_ID array, i.e., there are instruction IDs in Grouped_ID[0], Grouped_ID [1] and Grouped_ID [START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF], the corresponding instructions are sent to the first voter. In case of an incomplete triplet in the first places of the Grouped_ID, i.e., IDs only in Grouped_ID[0] and/or in Grouped_ID [1], the corresponding instructions are stored to the VotingRes[0] and VotingRes [1] registers. Memory instructions are grouped only in Grouped_ID [3], Grouped_ID [4] and Grouped_ID [5] in order to be scheduled to the second voter that is connected to a memory unit.

Cluster-based approach

The proposed architecture follows an n-issue configuration. Based on the experimental results with respect to the area overhead (Fig. 4.14 in the Exmperimental Results Section 4.6 page 57), the most dominant components are the switches. Therefore, with the increase of the number of issues n, we expect a non-linear increase of the area and an increase in the delay, since the switch complexity has a non-linear increase, as shown in Table 4.3. To avoid this limitation, we propose a cluster-based approach based on multiple instances of a VLIW with smaller issue number. For instance, for a n × 4 cluster approach we employ n parallel 4-issue components, that ideally each handles the 1/n of the instructions, as shown in Fig. 4.11 for n = 2. In this way, the area grows in a linear way since the hardware needed for a n × 4 approach is n times the hardware needed for the 4-issue approach. In addition, the delay of the data path is preserved no matter how much we scale the design since there is zero scaling of the switches.

However, following the cluster-based approach, the exploitation of the idle slots is restricted only within a cluster. The compiler usually schedules the instructions as dense as possible in order to occupy less area in the memory and, thus, it tries to first fit the instruc- 64 32 1952 tions to the first cluster. Because of this behaviour, the instructions are not assigned to the other clusters and the potential idle slots cannot be exploited resulting in unnecessary stalling of the processor. To deal with this limitation, we propose a shuffling approach, where we provide the compiler with a shuffled FU VLIW configuration so as to generate instruction bundles, where the instructions are more uniformly distributed. To avoid inserting additional area overhead, a static de-shuffling according to the real VLIW cluster configuration is performed during the fetch stage. An example of such case is depicted in Fig. 4.11, where the fetched bundle of this 2x4 configuration is shuffled in a random way and a static de-shuffling is performed in order to drive the instructions to their corresponding VLIW issues.

In addition, the real VLIW cluster configuration is defined in such a way to allow a better FU exploitation: the multiplication (or memory) function units are gathered in the

Experimental Results

In this section we discuss about performance, area and power results of our approach. We employ the VEX VLIW processor [START_REF] Fisher | Embedded computing: a VLIW approach to architecture, compilers and tools[END_REF] The VEX processor has been modified and enhanced with the proposed approach. Both the original unprotected processor and the components of our approach have been developed in C++ and synthesized using the Catapult High Level Synthesis (HLS) tool. Following this approach, we are capable of both simulating the processor and synthesizing a functional RTL design. However, it should be highlighted that modern HLS tools still fail to produce the same high quality results as hand written RTL code [START_REF] Rokicki | Hardware-accelerated dynamic binary translation[END_REF]. This especially holds for complex irregular designs with algorithms that have a highly data dependent behavior, such as our schedulers. Therefore, the obtained results provide an upper bound in the area and power overhead.

Performance

We compare the behaviour of the proposed approach (TMRi) with: a) the unprotected architecture (Unprotected), b) the architecture that triplicates the FUs and votes for the result (FU triplication), and c) the architecture which exploits the idle slots in space, i.e.

only inside the current bundle (TMR), without the dependency exploitation. For the performance metric, both the unprotected architecture and the FU triplication architecture have the same performance results.

In Table 1.1 in the first chapter, we have presented the dependency occurrence (%) for each application for 0, 1, 2 or 3+ number of simultaneous dependencies between consecutive bundles. As we observe, for most of the applications the case of having zero dependencies between two consecutive bundles is more than 50%, pointing out a high potential benefit for our approach. The case with exactly one dependency is also quite frequent (∼30%).

Our approach exploits these cases as dependent instructions are prioritized before the independent ones. Thanks to this prioritization policy our technique can benefit even in case there are more dependent instructions simultaneously in one bundle.

Fig. 4.12 depicts the execution cycles of the 10 benchmarks executed on a processor with the 4-issue configuration. The proposed TMRi architecture has a performance speed-up from 13.47% for the matrix _mul benchmark up to 43.68% for the huff _ac_dec benchmark compared with the TMR architecture. The average speed-up that our architecture achieves for the 4-issue configuration is 30.15%. Fig. 4.13 depicts the execution cycles of the benchmarks with the 2 × 4-issue configuration. Compared with the TMR architecture, we observe a speed-up from 7.62% for the crc benchmark up to 27.61% for the adpcm_dec benchmark. The average speed-up that our architecture achieves for the 2 × 4-issue configuration is 19.84%. We observe that in general the speed-up for the 4-issue is slightly higher than for the 2 × 4-issue. This occurs because of the following reasons:

1. The average ILP of the applications compiled for an 2 × 4-issue configuration is low and, thus, there are more idle slots in the current bundles than the idle slots in a 4-issue and TMR approaches have the required idle slots available in the current bundle.

2. The speed-up also depends on the code structure of each application. For instance, an application with consecutive bundles full of instructions has a similar behavior in both TMR and TMRi. Both techniques have no idle slots to exploit neither in the current nor in the next bundle. A paradigm of such an application is the matrix _mul , which achieves the lowest performance speed-up for the 4-issue configuration.

3. A third reason is the number of dependencies. If there are idle slots to be exploited in the next bundles, but the instructions to be scheduled are dependent, then no idle slot exploitation is allowed and new time slots have to be added. However, in most of the cases, there are less than two dependent instructions (see Table 1.1) and the remaining independent instructions can use the idle slots of the next bundle. This is the reason why the crc benchmark for the 4-issue configuration has high performance speed-up even though 70% of the bundles have one or two dependent instructions.

4. The last reason is the scheduling of the memory instructions. In our approach, these instructions can be scheduled in any issue, since the voting switch leads them correctly to the appropriate functional unit that implements the memory operations. In TMR, the memory instructions are scheduled from the beginning only in the issues supplied with a memory unit. A paradigm of this case is the huff _ac_dec benchmark, which has a low ILP and a lot of bundles with just one memory instruction. In this case, TMRi rarely adds time slots, whereas TMR requires each time two additional time slots in order to triplicate a memory instruction, given the VLIW configuration with only one memory unit.

Area and Power

All the techniques have been synthesized using Catapult HLS tool (University Version 10.0b/273613) to obtain the RTL design. The last step of generating the gate-level netlist was handled by Design Compiler (Version J-2014.09-SP5-7) from Synopsys using a 28-nm ASIC library. Area and power results obtained with a target frequency of 200MHz are shown in Table 4.4. Note that the power analysis of each approach, provided by Design Compiler, is based on a statistical activity factor estimation with the assumption that every net toggles 10% of the time. In Table 4.5 we present the overhead of each of the techniques when they are compared with the unprotected architecture. We observe that the FU triplication architecture implies an area overhead up to 55,83% and a power overhead up to 61,41%. The TMRi has less overhead, i.e. up to 30,05% for area and up to 32,74% for power. The TMRi has the lower overhead, i.e. up to 19,58% and up to 22,69% for the power overhead. However, TMRi can provide a performance speed-up up to 43,68% with an area/power overhead of ∼ 10% over the TMR approach.

Finally, we explore the participation of each component of the proposed TMRi architecture in the area overhead of our approach. Fig. 4.14 depicts graphically the area coverage of each of the basic components of our design. The area of the switches dominates the area of our design with the 76,2% of the total area overhead. The other components (the schedulers, the voters and the rest of the logic) contribute to the remaining the delay of the components inserted inside the VLIW data path (replic. switch, voting switch and voters), they add a rather low amount of delay (0,16ns, 0,33ns and 0,27ns, respectively). The largest delay is given by the replication scheduler (2,19ns), which, however, does not affect the clock speed of the processor, since it is strategically placed in parallel with the data path.

According to the obtained results for the 4-issue and the 8-issue configurations, we give an extrapolation on how the proposed approach scales. Fig 4 .15a illustrates the extrapolated area estimations, while Fig. 4.15b presents extrapolated estimations for the power consumption. As we observe TMRi is growing slower than the FU triplication, making it a better candidate if area is a design constraint. Same observations are performed for the power, where we observe that the slope of the FU triplication is steeper , making our approach a good candidate if power is also a constraint.

AVF and IVF analysis

We perform an AVF and IVF analysis similar to the analysis presented in Chapter 3, so as to explore the behaviour of the proposed architecture. cycles randomly chosen in Chapter 3 for the AVF analysis. The same simulation scenario is applied here (i.e. exactly the same registers as injection points and same injection cycles) in order to have exactly the same faults injected, so as to be able to compare the proposed TMRi approach with the Unprotected one. We observe that the AVF of the TMRi (Fig. 4. [START_REF] Chen | Reliable data path design of vliw processor cores with comprehensive error-coverage assessment[END_REF]) is similar to the AVF of the unprotected original architecture (Fig. 3.1) and the average AVF is 0.0533. This can be explained as follows: The AVF calculation as well as the fault injection experiment itself are mainly dominated by injections in the registers of the RF (32x64 = 2048 bits over a total of 2644). Since our technique does not protected the RF directly from errors happening in the registers, it does not improve to the AVF value contributed by the RF. On the other hand our technique protects the RF from indirect errors happening inside the data path and being propagated to the registers of the RF. Another reason why the AVF of the TMRi is similar to the unprotected one is because according to Fig. 3.2 the masking capabilities of the unprotected architecture, when an error is injected in the DCtoEX register are quit high (∼ 99%). Fig. 4.17 presents the categorisation of processor's output running a matrix multiplication for the fault injection experiment according to the classes presented in Chapter 3. The results are presented in logarithmic scale. Since TMRi applies an instruction triplication scheme before the DCtoEx register, we are able to detect and correct errors occurring in these registers. In the current implementation the voters compare only the obtained results of the operations after the EX stage and, thus, only the errors in DCtoEX_dataa and DC-toEX_datab are always guaranteed to be corrected. Errors in DCtoEX_dest are corrected only in case the result chosen by the voters is the correct one. On the other hand most of the times errors in DCtoEX_opcode are corrected, since an execution of another instruction instead of the original one will result in a different calculated result, which can be detected and corrected in the voters. Hang errors in case of injections in the DCtoEX_opcode occur rarely and in cases such as: A triplicated LDB instruction, which loads an 8-bit value, resides in the DCtoEX register and one bit of the DCtoEX_opcode register changes, referring to instruction LDW, which loads an 32 bit value. After the execution stage the result will be the same for all three copies of the instruction, so the voters will not detect the error. Therefore, they will commit the faulty instruction, which will load a value with a different size into a register. In case this register is used to evaluate a loop condition, this error may lead to a hang error. IVF analysis: For each instruction opcode and for each bit of each of the structures ( FtoDC, DCtoEx, Register File and PC) of TMRi, we generate 1000 different test cases with random inputs in order to create a uniform distribution of the input masking probability.

Table 4.6 presents the IVF of each instruction of each stage of the VLIW processor. For all the instructions, the IVF of the decode stage is greater than the IVF of the fetch stage, because of the applied fault tolerant technique. More precisely, the Table 4.6 presents the IVF of all the logical, multiplication, memory, control and integer arithmetic operations of the Instruction Set Architecture (ISA). Because of the proposed triplication mechanism, the most vulnerable instructions of the unprotected architecture, i.e. the integer arithmetic and memory operations (see Table 3.4) are now up to 2.2x less vulnerable compared to the integer arithmetic and memory operations of Table 4.6. In case of an implementation with voters checking for errors in the both the opcode and destination registers, the IVF of all the instructions in the decode stage would be one.

Conclusion

In this chapter, a hardware-initiated approach for heterogeneous VLIW data-paths was proposed to reuse the idle slots to provide fault tolerance. The proposed approach explores the idle slots in the current and next bundles and prioritizes dependent instructions. The result is a more compact schedule for both original and replicated instructions. In order to keep the hardware cost low while still providing with full rescheduling flexibility, a hardwarefriendly instruction scheduler is proposed. In addition, for scalability purposes, a clusterbased approach is presented and evaluated to avoid area and power overhead with a small decrease in performance. The processor is tested with 10 different media benchmarks and the obtained results show a 43.68% maximum speed-up with both area and power overheads to be ∼10% with respect to existing approaches. Finally, we performed an AVF and IVF analysis of the proposed architecture, in order to evaluate its vulnerability and compare it with the unprotected original architecture. To improve performance, the proposed approach explores at run-time the rebinding of original and replicated instructions to explore the existing FUs, as depicted in Fig. 5.1(d).

In this example, the instruction ADD 3 is moved to the third slot, whereas the instruction instructions and binds them in the idle slots of the instruction bundle taking into account the limitations on the number and the type of resources. In case not enough idle slots or FUs exist, a new time slot is added by stalling the fetch of new instruction bundles. The stall of the fetch stage is performed by propagating the fetch stall command to the fetch stage. The faulty information is used by the IRB in case of detected errors. When duplication with re-execution is selected as mode and a temporary error occurs, the IRB stalls the pipeline and re-executes the faulty instruction in a different FU. If a permanent error is detected, the IRB updates the state of the FUs and explores the idle slots and the available FUs to bind efficiently the original and replicated instructions. The binding information is sent to the fault detector to inform how the instruction binding has been performed. The fault detector uses this binding information to decide which results are ready to be compared and committed. When an error is detected, it is initially assumed to be a temporary error.

If a number of sequential instructions continue to indicate that the FU is faulty, then the fault detector decides that the error is permanent and sends this information to the IRB to update the status of the FUs. If the selected mode is triplication, the fault detector corrects the error and propagates the corrected value for commit.

Performance Evaluation

We have performed a set of experiments to evaluate the performance gain of the proposed approach. For the experimental part, we have used basic media benchmarks extracted from MediaBench [START_REF] Lee | Mediabench: a tool for evaluating and synthesizing multimedia and communications systems[END_REF] and the VEX VLIW processor [START_REF] Fisher | Embedded computing: a VLIW approach to architecture, compilers and tools[END_REF] with HP VEX compiler. The VLIW is configured based on realistic configuration of resources used by commercial VLIWs, e.g.

Intel Itanium [START_REF] Sharangpani | Itanium processor microarchitecture[END_REF], as depicted in Fig. 5.2. A simulation tool is developed to calculate the execution cycles of each application compiled with the HP VEX compiler (see fig. FUs. Otherwise the processor is declared as "out of service", as it is not able to execute every instruction anymore. 5.1 depicts the impact of the multiple permanent errors in the performance of our approach implementing DMR and TMR. The performance overhead of DMR (TMR) with p = 1, . . . , 5 permanent errors is calculated relatively to DMR (TMR) with no errors (p = 0). For the DMR, the performance overhead for motion, huff and crc remains quite small, up to 27%, even for 5 concurrent permanent errors. As these applications have a relatively small number of memory and multiplication instructions, the impact in performance is low when errors occur in MEM and MUL units. A similar overhead exists for most of the remaining benchmarks with up to 2 permanent errors. We observe that the concurrent permanent errors affect the performance of matrix_mul, with a maximum overhead of 75% in the case of 5 errors. This overhead, in contrast to the aforementioned cases, occurs because matrix_mul intensively uses the multiplication FUs, and, thus, the lack of these resources due to errors leads to high performance overhead. The last row shows the average overhead over all the benchmarks. Existing hardware approaches are applicable for single permanent errors [START_REF] Schözel | Hw/sw co-detection of transient and permanent faults with fast recovery in statically scheduled data paths[END_REF]. Extending them for multiple permanent errors means that all the instructions scheduled by the compiler on a permanently faulty unit have to be re-executed to another unit by adding an extra time slot, like in Fig. 5.1(c). Similarly, hybrid approaches re-execute the instruction that can not be assigned to a slot of the current bundle [START_REF] Schölzel | Combining hardware-and software-based self-repair methods for statically scheduled data paths[END_REF]. The performance overhead of these approaches can be estimated as the execution cycles of the fault tolerance technique, taking into account the effect of the re-execution each time the instructions have been scheduled

by the compiler to permanently faulty units.

Table 5.2 depicts the performance gain of the proposed approach over the existing approaches that re-execute the faulty instructions adding extra cycles. For our approach using the DMR, we observe that for all the benchmarks we achieve a high performance gain even for 5 multiple concurrent permanent errors, as depicted in the left part of Table 5.2. The highest gains have been observed for the crc benchmark, from 49% for one permanent error up to 40% for 5 permanent errors and the smallest gains for matrix_mul from 32% for 1 permanent error up to 12% for 5 permanent errors. In the case where our approach uses TMR, it has also achieved a high performance gain for all the benchmarks, as depicted in the right part of Table 5.2. We observe that for up to 2 permanent errors we have high gains for all the benchmarks, whereas for the matrix_mul, which has high ILP, the gains are slightly reduced for 3, 4 and 5 permanent errors. The gains of the TMR compared to the DMR are higher, even for the instructions with high ILP. This occurs because due to the triplication of the instructions, more time slots are required to be added, which also increases the number of idle issues. As the proposed approach efficiently explores these idle issues and the available FUs, it provides higher gains.

Fine-Grained

Overview and Motivating Example

We use the 4-issue heterogeneous VLIW data-path of Fig. 5.5 to schematically illustrate our approach. The components in blue color correspond to the basic architecture, whereas we highlight the hardware components added or modified by our approach with yellow color.

The proposed approach focuses on LDT faults occurring in the arithmetic FUs, as they have the largest area footprint of the system combinatorial components based on our experiments in Table 3.2. The faults in the storage components, e.g., register file, memory and pipeline registers, are assumed to be protected with other methods, such as Error Correction Codes (ECC).

Before describing in details the two main components of the proposed mechanism, i.e.

the fault checker and the online fine-grained scheduler, we illustrate through an example the main idea of this work. instructions. This action is allowed, if the instruction A 1 is independent from the B k instructions.

Fault Checker

The fault checker keeps the faulty status of the FU components, identifies new fault occurrences and takes care of miscalculated results. To achieve a fine-grained use of the The output of each BICS sensor is combined into a fault status signal, signal f, with a size of 9 (8) bits for complex FU (simple FU). Then, the f signals of each FU are combined

A 1 k k+1 k-1 FU[0] FU[1] FU[2] FU[3] C 1 C 2 A 2 C 2 A 3 B k-1 A 1 C 1 C 2 A 2 B k A 3 B 1 Nop B 2 Comp 3 Comp 2 Comp 1 A 1, A 2, A 3 B 1, B 2, B 3 C 1, C 2

Online fine-grained scheduler

The instructions in the F/DC register are decoded at cycle k -1 and the scheduler at cycle In order to allow the scheduling of the instructions in different issues than the ones defined by the compiler's original schedule, a switch has to be inserted to the VLIW data-path.

However, if the switch implements all combinations between the three instruction inputs

Extract part

It performs an early decoding of the instructions at the Fetch stage to create the info signal, which consists of the opcode, the destination registers and the source registers of

Processing part

This part is implemented based on bit masks, called IDentifiers (IDs). Each potential instruction input to the DC/EX switch is represented by a table (Res_DC/EX_ID, Res_DC_ID and DC_ID) that has a size equal to the number of VLIW issues. Each table element is an ID that corresponds to the instruction scheduled at position i either by the compiler (Res_DC_ID[i] and Res_DC_ID[i]) or by the proposed mechanism (Res_DC/EX_ID[i]). Fig. 5.8 shows the table element and the 11 bits are coded as follows: a) bits 10 to 2: when a bit is set, its position shows the FU component (Fig. 5.7) required for the instruction execution, b) bit 1: when it is set, it is a remaining instruction, i.e. it has not been scheduled yet, and c) bit 0: when it is set, the instruction has a dependency with at least one of the instructions of the next bundle. For instance, the ID="00000001110" is decoded as: the operation requires the 1 FU component, i.e. it can be a MEM/ADD/ADDSHIFT operation (bit 3=1), the final multiplexer (0 FU component) is required (bit 2=1) and the instruction has not been scheduled yet (bit 1=1). The status of all FUs components is represented by the table status_ID, where each element is the f signal of a FU enhanced by with an additional bit that is set when the FU is occupied.

The scheduling procedure is given by Alg. 4. The inputs are: 1) the ID of the input signal to be scheduled, Input_ID (each time equal to one of the Res_DC/EX_ID, Res_DC_ID and DC_ID), and 2) the status_ID. The outputs are: 1) the control signal sel_DC/EX of the DC/EX switch, 2) the updated ID of the input signal and 3) the updated status_ID.

The procedure is as follows: For all the instructions i of the Input_ID (line 3) and for each issue j described by Status_ID (line 6), if the instruction i has not been scheduled (line 5) and the FU in the j issue is unoccupied (line 6), check if the required component is available (line 7). If this is true, the occupied bit of the corresponding Status_ID is set (line 8), the remaining bit of the Input_ID is cleared, since the instruction is scheduled (line 9), and the signal sel_DC/EX instructs the switch to pass the instruction currently at issue i to issue j (line 10) and the next instruction is explored (line 11). end for 16: end for

Algorithm 4 SCH procedure

if (Input_ID[i][1]) then ▷ if the instruction is not scheduled 6: if Status_ID[j][0] then ▷ if the issue is not occupied 7: if (Input_ID[i][2 : 10] & Status_ID[j][1 : 9]) then 8: Status_ID[j][0] = 1; ▷ The Status_ID is set to occupied 9: Input_ID[i][1] = 0; ▷ The Input_ID

Control part

The last part controls the inputs and the execution of the scheduler processing part depending on the fault occurrence (occur signal) and the type of the scheduled instructions (signal flag). The state machine diagram of Fig. 5.9 describes its functionality, where i ∈ [0, n] and n is the number of issues.

C1:(Res_DC/EX_ID[i][1]==0)&&(DC_ID[i][0]==0) C4:(Res_DC_ID[i][1]==1)||(DC_ID[i][0]==1) C2:(Res_DC_ID[i][1]==0)&&(DC_ID[i][0]==0) C3:Res_DC/EX_ID[i][1]==0

Condi.ons hold i [0,n]: In the first case (S1 ), no stall is required and these instructions are the first to be executed at cycle k (Input_ID=Res_DC/EX_ID). Then, the decoded instructions at cycle k -1 are explored (Input_ID=DC_ID). An example of this case is

Evaluation results

For the experimental results we used the VEX VLIW processor [START_REF] Fisher | Embedded computing: a VLIW approach to architecture, compilers and tools[END_REF] with two heterogeneous configurations: i) 4-issue configured with 2 complex FUs, 2 simple FUs, 1 memory FU to the coarse-grained approach, the gain of the fine-grained mechanism is achieved because whenever a persistent fault is detected, the proposed approach is capable of still utilizing the healthy FU components in the current and the next instruction bundle.

2)Error duration and fault stressing: In the second experimental part, a fault injection simulation framework has been developed that explores the behaviour of the proposed approach under a wide range of faulty scenarios. A script which simulates scenarios with several faults in the FUs is applied to the processor simulator in order to evaluate the performance of the architecture using the proposed mechanism. Depending on the total number of original cycles needed per benchmark, we group them and we stress them under different faulty scenarios. The tuned parameters are depicted in Table 5. 4, where Group 1 has bcnt, adpcm_enc, adpcm_dec, fft benchmarks and Group 2 has huff and dct benchmarks.

Note that up to 5 new faults can simultaneously occur in a cycle, but the architecture may already suffer from previously occurred, but still active, faults. Out of 214,000 simulations performed, we show the obtained results for the fft benchmark. This benchmark has been selected as it has a steeper slope compared to the rest.

Since it has a higher average ILP (4-issue: 2.85, 8-issue: 4.19) than the rest benchmarks, it introduces less idle slots, and, thus, it further stresses the proposed approach, especially for the 4-issue configuration. The 3-dimensional scatter diagram of Fig. 5.10 is plotted by randomly selecting 1,500 simulations from the total number of experiments. Each dot shows the execution cycles of one complete execution with the proposed approach with respect to the number of injected faults and the fault duration. Generally, we observe that for all the benchmarks with a reasonable amount of injected faults and regardless their duration, the performance degradation is rather negligible. This is because the proposed mechanism: a) is capable of partially utilizing FUs even if they are severely damaged, and b) exploits opportunities in the next instruction bundles, when no sufficient healthy FUs components exists in the current instruction bundle. From the experimental results, we observe that the proposed approach is capable of dealing with large numbers of injected faults, even for scenarios that the existing approaches are not applicable.

Area and power

Table 5.5 shows the area and power results of the implementation of the proposed mechanism with a target frequency of 200MHz. Compared to the unprotected version, the proposed approach implies an area and a power overhead of up to 34% and 33%, respectively. The overhead of the coarse grained approach is expected to be comparable, since both techniques require a switching mechanism and a re-scheduling logic, which are the most costly components of the design.

Conclusion

In this chapter we proposed a coarse-grained hardware mechanism for permanent errors in order to replicate and schedule the instructions at run-time, thus exploring the idle slots under constraints in the FU number and type. When permanent errors occur, less FUs are available and the proposed approach efficiently rebinds the original and the replicated instructions based on the available resources and idle slots.

In order to protect embedded processors with several FUs against transient faults with a long duration, while also further improving the coarse-grained hardware approach, we proposed an online fine-grained hardware mechanism with low performance, area and power overhead. The FUs of the processor are enhanced with Built-In Current Sensors (BISC) for fine-grained multiple Long Duration Transient (LDT) fault detection and correction. An online rescheduling of the faulty and the current decoded instructions has been proposed that temporarily excludes the faulty FU components. From the obtained results, the proposed approach can sustain several multiple faults even with very long duration with significant reduction in the performance, area and power overhead.

85

to propose three hardware mechanisms for reliable execution on VLIW processors.

Initially, a hardware rescheduling mechanism for heterogeneous VLIW data-paths was proposed to reuse the idle slots and to provide fault tolerance. The proposed approach explores the idle slots in the current and next bundles and prioritizes dependent instructions.

The result is a more compact schedule for both original and replicated instructions. In order to keep the hardware cost low while still providing with full rescheduling flexibility, a hardware-friendly bit-wise instruction scheduler was proposed. In addition, to support scalability, a cluster-based approach is presented and evaluated to avoid area and power overhead with a small decrease in performance. The processor is tested with 10 different media benchmarks and the obtained results show a 43.68% maximum speed-up with an area and power overhead of ∼10% with respect to existing approaches.

A second hardware mechanism was proposed that focuses on permanent error mitigation.

The technique replicates and schedules the instructions at run-time, thus exploring the idle slots under constraints in the FU number and type (coarse-grained exploration). When permanent errors occur, less FUs are available and the proposed approach efficiently rebinds the original and the replicated instructions based on the available resources and idle slots.

Early evaluation results for an 8-issue VLIW processor prove that the proposed method is able to sustain up to 5 concurrent permanent errors with a significant, though logical performance penalty of up to ∼ 350% compared to other approaches that are not applicable.

In order to further reduce this penalty and enable the FU recovery in case of single/multiple Long Duration Transient (LDT) errors, a fine-grained hardware mechanism was proposed. During execution, this mechanism characterizes the components of each FU by using Built In Current Sensor (BICS) circuits; it reschedules the faulty instructions to the healthy FU components, and temporarily excludes the faulty ones. From the obtained results, several multiple faults even with very long duration are mitigated with significant reduction in the performance, area and power overhead.

Directions for Future Work

There are several directions of research that can be followed based on the techniques proposed in this dissertation.

Concerning the AVF analysis performed in Chapter 3, an exhaustive AVF analysis for the proposed technique can be considered in order to obtain a more accurate AVF estima-tion. An even more accurate fault injection framework can be developed taking the SETs occurring in the combinational logic of the various stages of the pipeline into account. The goal is a modelization for high-level fault injection from gate-level exhaustive fault injection.

Concerning the second contribution, it would also be interesting to explore the implementation of the proposed technique to other systems with multiple function units, such as the Coarse Grained Reconfigurable Arrays (CGRAs). For all the proposed mechanisms different application domains other than media applications can be tested to see if the performance improvement would be as significant. The emerging domains of approximate computing, cryptographic algorithms, machine learning etc., may be the interesting choices to explore for both performance and energy efficiency.

for sharing expertise, and sincere and valuable guidance and encouragement extended to me. Her help and guidance has been so valuable that I would not be able to reach here without them.

A very special gratitude goes out to the whole Cairn team of the Inria research center, which accommodated and supported me all these 3 years of my PhD research. With a special mention to Simon Rokicki, who provided me with valuable help with his technical expertise. I will miss our brainstorming sessions my friend!! I am also grateful to our beloved team assistant, Nadia Derouault, for her unfailing support and assistance.

Last but by no means least, a special thanks goes to University of Rennes 1 for funding this PhD research and providing me with everything needed for its completion.

Figure 1 :

 1 Figure 1: Architecture VLIW à quatre voies. Détail de la phase d'exécution avec ses quatre unités fonctionnelles parallèles.

Figure 2 :

 2 Figure 2: Redondance SW/HW dans un scénario VLIW.

Figure 1 . 1 :

 11 Figure 1.1: VLIW architecture with 4 issues.

  figure depicts a processor's data path with four issues. The data-path consists of a 3-stage pipeline with Fetch (F), Decode (DC) and Execute/Memory-WriteBack (EX/M-WB) and, thus, it does not require a bypass logic. The processor has one Instruction Memory (IM) port, that fetches an n×32-bit word each cycle according to the current value of the Program

Fig. 1 .Figure 1 . 2 :

 112 Figure 1.2: Three instruction bundles scheduled by the compiler for the computation of Eq. 1.1.

Fig. 3 .Figure 3 . 1 :

 331 Fig.3.1 presents the per cycle AVF of the processor when it executes a matrix multiplication application, calculated from Equation3.1. The whole execution of the application takes 30228 cycles, thus an exhaustive fault injection simulation injecting faults at each cycle would require several days. Small intervals, such as one cycle difference, leads to a more accurate estimation with the AVF being more sensitive to the instantaneous behaviour of the application. On the other hand, when the interval length is too large, a lot of AVF variations may be lost. To tackle this issue and decrease the simulation time, we randomly choose 1000 unique cycles to inject faults at. The periodic behaviour of the AVF observed in Fig.3.1 with instantaneous changes from max to low values shows the existence of loops in the executed code. The average AVF of the matrix multiplication application is 0.0534.

  a) the neutron flux with energy > 1 MeV, b) the area of the circuit sensitive to particle strikes, c) the critical charge, and d) the charge collection efficiency of the device.

  figuration and register the golden output values into a log file (line 5). For each of these generated instructions and configurations we iterate over all the pipeline storage structures (FtoDC, DCtoEx) and all the bits of each structure (lines 6, 7) and we inject one fault in the corresponding stage during the instruction execution (Fetch in cycle 0, Decode in cycle 1). The results are compared with the golden values from the gold_log file and a report is generated and stored into a log file (inj_log) categorizing each injected fault to one of the four above-mentioned categories.Algorithm 2 IVF Fault Injection Experiment1: for each opcode ($op) do 2:

Fig. 4. 1 depictsADD 1 :

 11 the proposed approach on the 4-issue VLIW of Fig. 1.1 with one Arithmetic Logic Unit (ALU ) and one Branch unit (BR) in the Issue_0, one ALU and one Memory function unit (MEM ) in the Issue_1, and one ALU and one Multiplication unit (MUL) in Issue_2 and Issue_3. Fig. 4.1a is the compiler's original schedule to the VLIW issues. Three consecutive instruction bundles of the original code are depicted, B i-1 , B i and B i+1 . B i-1 has two instructions (ADD 1 , MUL 1 ) and two idle slots (NOP ). B i has also two instructions ADD(r2,r1,r3) MUL 1 : MUL(r4,r2,r3) SUB 2 : SUB(r5,r1,r3) MUL 2 : MPYL(r3,r5,r1) OR 3 : OR(r1,r5,r3) Compiler's original schedule.

  priority (b) Schedule of the proposed approach.

Figure 4 . 1 :

 41 Figure 4.1: Scheduling running example on an 4-issue VLIW.

Fig. 4 .

 4 2 depicts the original VLIW data path in blue color. The yellow color highlights the hardware components added to implement our approach. It is important to mention that the relative size of the blue and yellow boxes in the figure is not representative of the relative size of the actual hardware. The control components of the proposed fault tolerant mechanism are: 1) the information extraction unit, 2) the dependency analyzer, 3) the replication scheduler, and 4) the voting scheduler.The processing components are: 1) the replication switch, 2) the voting switch, and 3) the voters. The information extraction unit performs an early decoding in the F stage providing the necessary information to the dependency analyzer and the replication scheduler.

Figure 4 . 2 :

 42 Figure 4.2: Original VLIW datapath (blue) enhanced with the proposed fault tolerant mechanism (yellow).

  decoders and the ReplicRes register -and places them to the n inputs of the pipeline register DCtoEX. The ReplicRes register stores an exact copy of the decoders' output in the previous cycle. Each input/output of the switch consists of 109 bits, i.e., the size of the decoded instruction. The decoded instruction is depicted in Fig. 4.3. Therefore, the input signal has a width of 109 × 2n bits, while the output has a width of 109 × n bits. For the switch implementation, n × (2n-to-1) multiplexers are required and the selection signal has n × log 2 (2n) bits. Fig. 4.4 presents the implementation of the switch for a 4-issue VLIW. Data from RF Data from RF / or Immed. Data for storing instr. Opc Dest Adr.

Figure 4 . 3 :

 43 Figure 4.3: Decoded instruction

Figure 4 . 4 :

 44 Figure 4.4: Replication switch implementation details

4 . 6 .

 46 Each individual input and output has a size of 78 bits and it is structured as in Fig. 4.5. Fig. 4.6b depicts the

Figure 4 . 5 :

 45 Figure 4.5: Voting switch I/O instruction.

  Part of the voting switch for storing back to VotingRes register.

Figure 4 . 6 :Figure 4 . 7 :

 4647 Figure 4.6: Implementation of the voting switch.

Table 4 . 1 :

 41 ID encoding in the information extraction unit.

  For the bundle currently in the DC stage, the values of the FtoDC_rem are initialized to 3, since instruction triplication is applied as fault tolerance method. During scheduling, some of the instructions are executed on the FUs of the VLIW datapath. Therefore, the values of the ReplicRes_rem are updated to depict the new number of the unscheduled instructions. In Fig. 4.7 we illustrate the ID and the Rem arrays of our running example presented in Fig. 4.1b at time t i . The FtoDC_ID array is related to the current bundle B i : the first element (10000) and the second one (10100) indicate that the instructions in the first and second slot of the current bundle are NOPs, the third element (11011) stands for an ALU operation and the last one (11110) stands for a MUL operation. The array FtoDC _rem is initialized to 3, meaning that each of the corresponding instructions have to get triplicated.

Fig. 4 .FFigure 4 . 8 :

 448 Fig. 4.1b), where both instructions of the current bundle (B i ) are dependent on the memory instruction of the next bundle (B i+1 ), thus the corresponding FtoDC _Dep positions are set to 1.

Figure 4 . 9 :

 49 Figure 4.9: Pre-processing of IDs to occupation arrays.

Fig. 4 .

 4 Fig. 4.9 illustrates the input occupation vectors for the running example of Fig. 4.1b at time t i . The instructions in slots 1 and 2 of the ReplicRes need to be executed one more time (ReplicRes_Rem[1]=1, ReplicRes_Rem[2]=1). Therefore, the second and third bits

Figure 4 . 10 :

 410 Figure 4.10: Direct assignment algorithm on the running example.

  [j]) initialized with the vector rest[j] from the direct assignment, 2) the current occupation of the issues (issues) initialized with the issues_up[j] result coming from the direct assignment, and 3) the mul[j]. The output is the assignment signal assign[i]. This signal holds the configuration values for each decided assignment. Algorithm 3 presents the most representative cases of the circular exploration mechanism. The first two cases represent the situations when only one instruction needs to be scheduled. When instr[j] = 1000 the instruction cannot be a multiplication, whereas in case instr[j] = 0010 the instruction can be a multiplication. In the first case, the instruction can be tested in any available issue. In the second case, two possibilities exist: a) whatever the value of mul[j][1], the instruction can be potentially executed in issues_up[j][0] and b) otherwise, the instruction can be potentially executed in any possible position, if and only if this instruction is not a multiplication (mul[j][1] = 0). In the third case, two instructions need to be scheduled (case 0011). Because of their position we have to check if the instructions are multiplications. Three possibilities exist: a) mul[j][1] = 1 and mul[j][0] = 0, b) mul[j][1] = 0 and mul[j][0] = 1 and c) mul[j][1] = mul[j][0] = 0.No available scheduling exists for both instructions being multiplications due to resource restrictions. For a) and b) cases, the multiplication instruction cannot move, since the remaining untested issues do not have a multiplication FU. Only non-multiplication instructions can be scheduled. For c) case, no multiplication instruction exists, thus the instructions can be scheduled in any available slot. The case in which there are three instructions to be scheduled (case 1101, 1110, etc.) has the least complexity. Since all three instructions have been tested and failed to be scheduled in their current position by the direct assignment technique, the only legitimate action is to potentially schedule the non-multiplication instructions (instr[j][START_REF] Arlat | Fault injection for dependability validation of fault-tolerant computing systems[END_REF], instr[j][3]) (e.g. 1101 → 1011). In any of the aforementioned cases, if an instruction is scheduled, the signal assign[i] is updated with the original scheduled position of the instruction, where i is the new issue where the instructions is currently scheduled. According to the assign[i] signal, we update the issues_up[j] vector, the ID arrays and the signal sel_r.For instance, inFig. 4.10 after the direct assignment of the instr[0] of the FtoDC_dep, the rest[0] = 0010. Since mul[0][1] = 0, issues_up[0][0] = 1, issues_up[0][2] = 1 and issues_up[0][3] = 0, the condition of line 11 in Algorithm 3 is met and, thus, assign[0] ← 2. Consequently we have: a) issues_up[0][3] = 1, rem[2] = rem[2] -1 and b) DCtoEX_ID[0]

Figure 4 . 11 :

 411 Figure 4.11: Example of a cluster-based 2 × 4 VLIW configuration.

  same cluster. With this configuration the FUs of the same type are grouped, allowing the exploitation of the FUs of a specific type. Fig. 4.11 illustrates a 2 × 4-issue VLIW with 1 branch unit, 8 ALUs, 4 multiplication units and 2 memory units. A global fetch occurs that distributes the 8 shuffled fetched instructions to the two 4-issue clusters. The stall signal (stall) generated by the hardware scheduler of each cluster has to be global for the whole architecture; the fetch and decode stages of all clusters are stalled, if at least one of them needs an extra time slot.

  Figure 4.12: 4-issue performance results.

Figure 4 .

 4 Figure 4.13: 8-issue performance results.

Figure 4 . 14 :

 414 Figure 4.14: Area coverage of each of our technique's components.

  Area scaling (µm 2 ).

  Power scaling (mW).

Figure 4 . 15 :

 415 Figure 4.15: Scaling of the proposed approach

AVF analysis: Fig. 4 .Figure 4 . 16 :

 4416 Figure 4.16: Per cycle AVF for VEX processor

(Figure 4 . 17 :

 417 Figure 4.17: Error occurrences per storage structure for the matrix multiplication (Normalized)

ADD 1 :Figure 5 . 1 :

 151 Figure 5.1: Illustration of the proposed approach

MUL 1

 1 is moved to the fourth slot without adding a new time slot. In case there is a need for an extra time slot, the instructions that fit in the first time slot are scheduled, while the remaining ones are scheduled in the next time slot.

Fig. 5 .Figure 5 . 2 :

 552 Fig. 5.2 depicts the two hardware components added to the VLIW data path: the Instruction Replication and Binding (IRB) and the fault detector. The IRB takes the decode stage result, the mode, and the faulty information as input, and has the binding info and the fetch stall as output. The mode is defined by the designer and it defines which fault tolerance technique is implemented: i) duplication of instructions, ii) triplication of instructions, or iii) duplication and re-execution. Depending on the mode, the IRB duplicates or triplicates the

  5.3). Intermediate files (.cs.c) from compiled simulator step are instrumented with a code enhancing script, in order to provide us with processor's execution instruction sequence traces when they are linked and compiled with GCC compiler. Our tool parses these traces to calculate the processor's execution cycles and, thus, estimates the performance of each approach. We

Figure 5 . 3 :

 53 Figure 5.3: Simulation tool flow for performance evaluation results.

Fig. 5 .Figure 5 . 4 :

 554 Fig. 5.4 depicts the execution cycles estimated for running the applications on the un-

  Mitigation for Multiple Long-Duration TransientsIn order to further decrease the performance overhead introduced by the previous technique and also to support single and multiple Long-Duration Transient (LDT) faults we extend our approach with a new fine-grained hardware mechanism. This mechanism detects the active faults during execution and temporally excludes only the faulty components of the affected FUs for as long as it is necessary. A fine-grained micro-architectural solution is proposed that partitions an FU into components, i.e. an individual circuit that executes a group of instructions. Each component is enhanced with a Built-In Current Sensor (BICS) mechanism to identify the exact location of the fault and the duration that the fault is active. The online fine-grained instruction scheduling mechanism excludes only the faulty FU components for as long as they are affected and reschedules the instructions onto the remaining healthy FU components exploring mitigation solutions in the current and the next instruction execution.

Fig. 5 .Figure 5 . 5 :

 555 Figure 5.5: VLIW enhanced with the proposed mechanism.

Figure 5 . 6 :

 56 Figure 5.6: Illustration example of the proposed mechanism

Figure 5 . 7 :

 57 Figure 5.7: Components of complex FU enhanced with BICS.

k - 1

 1 decides the instructions to be executed at cycle k based on the status of the faulty FU components. The decoded instructions that couldn't be scheduled at cycle k, due to insufficient FUs or instruction dependencies, are stored to the Reserve_DC shadow register.At the same time instance, the EX/MEM/WB stage executes the instructions scheduled for execution at cycle k -1 (scheduling decision occurred at cycle k -2). The Reserve_DC/EX shadow register keeps the instructions executed at cycle k -1 in case a fault occurs during their execution. The instructions to be scheduled at cycle k -1 can potentially come from three inputs: 1) the decoded instructions at cycle k -1 (DC ) 2) the remaining instructions not scheduled at cycle k -2 (Reserve_DC register) and 3) the executed instructions at cycle k -1 (Reserve_DC/EX register).

(

  DC, Reserve_DC, and Reserve_DC/EX ) to the VLIW issues, the switch complexity is significantly increased. In contrast, the design of our online hardware mitigation mechanism reduces this overhead. A 2n to n switch, DC/EX switch, passes the instructions from one of the shadow registers and the decoded instructions DC to the main pipeline DC/EX register. A 2n to n multiplexer is used to decide which shadow register to be used as an input to the switch (signal sel_MUX).The online fine-grained hardware scheduler is implemented by three components. The first component extracts the required information (info signal) from the F stage and the instruction dependencies (dep signal). The second component is the scheduler processing part that schedules the input (one of the three potential instruction inputs) to the output of the DC/EX switch using bit masks and taking into account the status of the faulty components. The third component is the scheduler control part that decides which of the three input signals (DC, Reserve_DC, and Reserve_DC/EX ) has to be used as input to the processing part (input signal) based on occurrence of new faults (signal occur) and the type of the scheduled instructions (signal flag). Finally, the output of the processing part is the signal sel_DC/EX that controls the DC/EX switch. The rest of this subsection describes in details the three scheduler components.

Figure 5 . 8 :

 58 Figure 5.8: ID coding

(

  S1-S2) One (more) faults occurred at cycle k -1 (occ = 1): The executed instructions on the faulty FU components at cycle k -1 (which reside in Reserve_DC/EX register) are not committed and they must be scheduled again for execution at cycle k. Whether or not the Fetch and Decode stages must be stalled (F/DC_stall) depends on whether the faulty instructions are decoded instructions at cycle k -2 (flag=0) or at cycle k -3 (flag=1).

Figure 5 . 9 :

 59 Figure 5.9: Control part.

Fig. 5 . 6 ,

 56 where two faults occur during the execution of the instructions of bundle B k-1 at cycle k -1. During the scheduler decision for execution at cycle k, the remaining instruction A 1 is scheduled at issue 1 and, then, the decoded instructions of B k are scheduled. In the second case (S2 ), the stall signal is activated (F/DC_stall=1) and a new cycle is inserted for the re-execution of the Reserve_DC/EX instructions. The process is repeated until no instructions are left in the Reserve_DC/EX (guaranteed by condition C2). S3-S4) No fault occurred at cycle k-1 (occ=0): If no FU component is affected by a new fault at cycle k -1, the mechanism schedules first the remaining decoded instructions from cycle k -2 (that now reside in Reserve_DC ) for execution at cycle k, and, then, the current decoded instructions. If there are still instructions inside the Reserve_DC and/or if there is any dependent instruction in current decoded instructions DC that cannot be scheduled (condition C4), the F/DC_stall signal is activated to stall the Fetch and the Decode stage for one cycle. During this inserted cycle, the mechanism schedules these instructions.

Figure 5 . 10 :

 510 Figure 5.10: Proposed mechanism performance for fft benchmark under different number of faults and fault duration

  Concerning the third contribution, a hardware implementation of the rebinding technique applying different fault mitigation techniques (DMR, TMR etc.) could be explored.The improved technique is applied for Long Duration Transient (LDT) errors with the assumption that Built-In Current Sensors (BISC) exist. The BICS enhanced FUs could be physically implemented and the obtained SoC could be tested under realistic radiation stressing conditions.

Table 1 .

 1

			1: VEX Compiled Applications' Profiling
				4-issue				8-issue
	Benchmark	ILP	Dep. Occurrence% ILP 0 1 2 3+	Dep. Occurrence% 0 1 2 3+
	adpcm_dec 1,77 60,6 35,2 4,1	0	2,28 50,3 37,7 9,6	2,3
	adpcm_enc 1,82 58,7 35,9 4,9 0,5 2,41 48,6 39	9	3,3
	bcnt 2,49	36	54	10	0	3,62	27 43,5 5,1 24,3
	dct 2,22 53,9 30,1 7,7 8,3 3,31 45,4 28,1 7,1 19,4
	fft32x32s 2,85 62,6 17,2 20,2	0	4,19 60,8 6,8	6,5	26
	huff_ac_dec 1,51 59,9 36,1 3,6 0,5 1,75 40,7 50,7 7,9	0,7
	motion 1,94	57 29,1 11,6 2,3 2,39 47,1 30 18,6 4,3
	fir 2,09 62,3 29,8 7,9	0	2,5 51,6 36,8 11,6	0
	crc 1,76 29,8 65,6 4,5 0,1	1,8 28,2 64,8 6,9	0,1
	matrix_mul 2,61 51,5 32,2 16,4	0	4,46 21,1 62,7 16,2	0

•

  Vulnerability analysis through fault injection:A fault injection software methodology is developed to test the vulnerability of the presented VLIW architecture. Both Architectural Vulnerability Factor (AVF) and Instruction Vulnerability Factor (IVF) analyses are performed to motivate the need for increased reliability against faults occurring in VLIW data paths. A high-level failure classification scheme is presented to categorize the output of the processor.

	• Time and space instruction rescheduling: We propose a hardware mechanism ca-
	pable of i) replicating at run-time the original instructions to provide VLIW processors
	with fault tolerance and ii) dynamically scheduling these original and replicated instruc-
	tions to efficiently explore the idle FUs of current and upcoming bundles to improve
	execution time overhead. To achieve that, a hardware-optimized scheduling technique is
	proposed based on bit-wise logic. A cluster-based architecture is proposed, to support
	larger VLIW configurations and scalability. The detailed hardware implementation of the
	proposed mechanisms in the VLIW data path is presented and evaluated through exten-
	sive results on performance, area and power consumption. The AVF and IVF analysis is
	performed to evaluate the vulnerability factor of the VLIW architecture enhanced with
	the proposed mechanisms. Early results of this work have been published in [Psi17a],

Table 3 .

 3 1: Bit composition for the used VLIW architecture.

		FtoDC instr	DCtoEx dataa datab datac	dest opcode	PC	RF
	issues x struct_bits	4 x 32	4 x 32 4 x 32 4 x 32 4 x 6	4 x 7	32	64 x 32

  ETV is a bit flip in a counter causing a drawback to a previous value or a bit flip in PC which drives the program to a previous stage of the execution which happens to be idempotent with the current one.In our architecture, Crash errors are mostly frequent because of segmentation faults, and, thus they are more prominent in PC injections as well. Infinite loop errors or Hang errors usually happen when there is a violation in a checking condition of a loop. We observe that it is mostly fault injections in structures such as the PC, the instr, the RF and the dest that cause these types of errors. AOM and PSF errors refer to mismatches in the output of the application and the state of the processor respectively, and, they are more prominent in case of faults injected in the RF.

	(Occurences per structure)/(Total bits of structure) (Log)	10 -4 10 -3 10 -2 10 -1 10 0	instr ETV Crash Hang AOM PSF	dataa	datab	datac	dest	opcode	RF	PC
		Class instr dataa datab datac dest opcode RF	PC
		ETV 0.025 0.019	0.014	0.0	0.014	0.015	0.006 0.221
		Crash 0.01	0.0	0.0	0.0	0.0	0.0	0.012 0.74
		Hang 0.017 0.005	0.003	0.001 0.023	0.008	0.014 0.012
		AOM 0.009	0.0	0.0	0.0	0.013	0.001	0.031 0.027
		PSF 0.028 0.102	0.001	0.0	0.031	0.015	0.506 0.016
	Figure 3.2: Error occurrences per storage structure for the matrix multiplication (Normal-
	ized)

We observe that ETV is more prominent in PC error injections. That is because ETV refers to these cases where the execution is correct, but there is a cycle violation. An example of The goal of this analysis is to identify the most vulnerable parts of the VLIW architecture. We observe that the PC is the most vulnerable part of the architecture, but since it is only a 32-bit register, it can be easily protected with negligible hardware cost (e.g., ECC codes, radiation hardening). The next candidate for protection is the RF, which has the biggest number of AOM and PSF errors among all the other structures. PSFs are not considered as errors, since they do not affect the executed program, but they potentially corrupt other program's data, thus they should not be ignored. Errors in the RF might be either because of a direct fault injected in this storage structure or because of a transient error occurring in the execution stage and committed to the RF. Although error correction methods for memory elements of embedded processors have been studied thoroughly the past years

Table 3 .

 3 2: Area of pipeline stages (µm 2 ).

		DC DC_BR ALU ALU_MUL WB MEM_WB Issue_Total
	issue_0	×	2,530	1,533	×	11	×	4074
	issue_1	250	×	1,533	×	×	358	2141
	issue_2	250	×	×	3,843	11	×	4104
	issue_3	250	×	×	3,843	11	×	4104
	FU_Total 750	2530	3066	7686	33	358	14423

Table 3 .

 3 4: Per stage IVF for all operations of the ISA

			Integer Arithmetic Operations	OPCODE Fetch Decode	ADD 0.817518 0.445255	ADDi 0.766533 0.445387	SUB 0.819555 0.448956	SUBi 0.766628 0.445365	SRL 0.829642 0.764204	SRLi 0.838234 0.767715	SRA 0.829876 0.763569	SRAi 0.838387 0.767927	SLL 0.820591 0.757124	SLLi 0.829723 0.760131	SH1ADD 0.817518 0.445255	SH2ADD 0.817518 0.452555	SH3ADD 0.817518 0.459854	SH4ADD 0.817518 0.467153	SH1ADDi 0.766577 0.438022	SH2ADDi 0.781029 0.452555	SH3ADDi 0.773810 0.445336	SH4ADDi 0.773737 0.445255	ZXTH 0.877964 0.697277	ZXTB 0.878131 0.697496	SXTH 0.885343 0.704679	SXTB 0.877934 0.697255	ZXTHi 0.908504 0.776095	ZXTBi 0.908708 0.776234	SXTHi 0.914095 0.781730	SXTBi 0.908504 0.776095	MOVI 0.788321 0.715328	NOP 0.951402 0.949620
		Multiplication Operations	OPCODE Fetch Decode	MPYLL 0.885080 0.704453	MPYLLU 0.884964 0.704453	MPYLH 0.894161 0.713409	MPYLHU 0.884964 0.704453	MPYHH 0.885080 0.704453	MPYHHU 0.892292 0.711672	MPYL 0.892146 0.711650	MPYLU 0.877898 0.697255	MPYH 0.886978 0.699015	MPYHU 0.899445 0.718847	MPYHS 0.892263 0.711650			Memory Operations	LDW 0.766423 0.437956	LDHU 0.770204 0.441584	LDH 0.770036 0.441672	LDBU 0.770460 0.443547	LDB 0.770701 0.443606	STW 0.766431 0.248175	STH 0.766423 0.364971	STB 0.766635 0.423453	Control Operations	CALLR 0.905117 1.000000	BR 0.817518 1.000000	BRF 0.978102 1.000000	RETURN 0.810219 1.000000	GOTO 0.824818 1.000000	GOTOR 0.905124 1.000000	CALL 0.810219 1.000000	STOP 0.948905 1.000000
	Logical Operations	OPCODE Fetch Decode	CMPEQ 0.882569 0.800358	CMPGE 0.880146 0.837737	CMPGEU 0.885730 0.842606	CMPGT 0.878686 0.840891	CMPGTU 0.880526 0.843241	CMPLE 0.880438 0.841562	CMPLEU 0.879891 0.842343	CMPLT 0.875088 0.833307	CMPLTU 0.875496 0.834365	CMPNE 0.884139 0.801453	CMPEQi 0.905533 0.912861	CMPGEi 0.912431 0.897628	CMPGEUi 0.912453 0.897759	CMPGTi 0.912445 0.897635	CMPGTUi 0.912438 0.897664	CMPLEi 0.912416 0.897460	CMPLTi 0.905153 0.890460	CMPLTUi 0.905153 0.890314	CMPNEi 0.905204 0.912475	AND 0.819788 0.690934	ANDi 0.815328 0.751708	ANDC 0.885117 0.704453	ANDCi 0.906555 0.776095	OR 0.819810 0.674073	ORi 0.815102 0.609774	ORC 0.870752 0.690058	ORCi 0.897701 0.765102	NOR 0.817555 0.671314	NORi 0.814088 0.606350	NOT 0.861365 0.678832	NOTi 0.861365 0.678832	XOR 0.819577 0.448993	XORi 0.766606 0.445401

Table 4 .

 4

2 presents the transformation required to obtain the instr vector: Each bit of the vector is set, if at least one of the two LSBs of each ID[i] is not zero and there

Table 4 . 2 :

 42 ID to instr vector transformation.

Table 4 .

 4 3: Implementation complexity of the Replication switch (Fig. 4.4) for different nissue configurations.

	Configuration	Size In Out (No. of 2:1 mux) Complexity
	4-issue	8	4	28
	8-issue	16	8	120
	16-issue	32 16	496
	32-issue

Table 4 .

 4 4: Area footprint and power estimation results.

	Approach	area(	4-issue	8-issue

µm 2 ) power(mW) area(µm 2 ) power(mW)

	Unprotected	50843,82	6,48	79661,02	7,36
	TMR	58818,67	8,01	95257,57	9,03
	TMRi 2x4	62812,26	8,61	103597,9	9,77
	FU triplication	73522,58	8,81	124136,94	11,88

Table 4 .

 4 5: Area and power overhead to the unprotected approach.

	Approach	4-issue area(%) power(%) area(%) power(%) 8-issue
	TMR	15,68	23,61	19,58	22,69
	TMRi 2x4	23,54	32,87	30,05	32,74
	FU triplication	44,60	35,96	55,83	61,41

  [START_REF] Glorieux | Damsel?dynamic and applicative measurement of single events in logic[END_REF]8%. Concerning

	Info extr. unit
	0.4%
	Dep. Analyzer
	1.5%
	Vo6ng Switch
	57.3%
	Replic.
	scheduler
	8.3%
	Vo6ng scheduler
	4.0%
	Voters
	9.7%
	Replic. Switch
	18.9%

Table 4 .

 4 6: Per stage IVF for all operations of the ISA

				Integer Arithmetic Operations	OPCODE Fetch Decode	ADD 0.817518 0.9740584	ADDi 0.766547 0.9739489	SUB 0.819540 0.9738248	SUBi 0.766606 0.9739854	SRL 0.830073 0.9735766	SRLi 0.838212 0.9743431	SRA 0.830015 0.9735985	SRAi 0.838380 0.9744526	SLL 0.820752 0.9737591	SLLi 0.828942 0.9744015	SH1ADD 0.817518 0.9746934	SH2ADD 0.817518 0.9745036	SH3ADD 0.817518 0.9744818	SH4ADD 0.817518 0.9742409	SH1ADDi 0.766569 0.9740949	SH2ADDi 0.781022 0.9738394	SH3ADDi 0.773818 0.9735839	SH4ADDi 0.773723 0.9741825	ZXTH 0.877781 0.9746861	ZXTB 0.877964 0.9742555	SXTH 0.885204 0.9744964	SXTB 0.877737 0.9740073	ZXTHi 0.907854 0.9801971	ZXTBi 0.908051 0.9803942	SXTHi 0.913482 0.9802190	SXTBi 0.907854 0.9804161	MOVI 0.788321 0.9743796	NOP 1.000000 1.0000000
		Multiplication Operations	OPCODE Fetch Decode	MPYLL 0.884847 0.9733431	MPYLLU 0.884745 0.9732774	MPYLH 0.893891 0.9742628	MPYLHU 0.884745 0.9738029	MPYHH 0.884847 0.9750584	MPYHHU 0.892088 0.9750073	MPYL 0.891942 0.9748759	MPYLU 0.877650 0.9740219	MPYH 0.886701 0.9752847	MPYHU 0.899241 0.9752774	MPYHS 0.892044 0.9744161		Memory Operations	LDW 0.927015 0.9733796	LDHU 0.919730 0.9731387	LDH 0.919730 0.9732628	LDBU 0.919708 0.9722190	LDB 0.919708 0.9722774	STW 0.766423 0.9754088	STH 0.766423 0.9752263	STB 0.766672 0.9748686	Control Operations	CALLR 0.905110 1.0000000	BR 0.817518 1.0000000	BRF 0.978102 1.0000000	RETURN 0.810219 1.0000000	GOTO 0.824818 1.0000000	GOTOR 0.905124 1.0000000	CALL 0.810219 1.0000000	STOP 1.000000 1.0000000
	Logical Operations	OPCODE Fetch Decode	CMPEQ 0.883569 0.9741606	CMPGE 0.880248 0.9740000	CMPGEU 0.884861 0.9743504	CMPGT 0.878577 0.9734307	CMPGTU 0.880839 0.9741387	CMPLE 0.880664 0.9738759	CMPLEU 0.880212 0.9742774	CMPLT 0.875409 0.9736569	CMPLTU 0.875854 0.9742555	CMPNE 0.884956 0.9739343	CMPEQi 0.905679 0.9745182	CMPGEi 0.912467 0.9744015	CMPGEUi 0.912482 0.9735839	CMPGTi 0.912467 0.9737153	CMPGTUi 0.912460 0.9736496	CMPLEi 0.912453 0.9737737	CMPLTi 0.905175 0.9738832	CMPLTUi 0.905175 0.9744891	CMPNEi 0.905263 0.9743212	AND 0.819912 0.9742847	ANDi 0.814737 0.9738832	ANDC 0.884934 0.9751752	ANDCi 0.905898 0.9810292	OR 0.819927 0.9739562	ORi 0.815715 0.9738613	ORC 0.870540 0.9744891	ORCi 0.896905 0.9804891	NOR 0.817547 0.9740584	NORi 0.813270 0.9745985	NOT 0.861423 0.9741898	NOTi 0.861423 0.9740657	XOR 0.819533 0.9745109	XORi 0.766584 0.9732190
																																63

Table 5 .

 5

	1: DMR (TMR) performance overhead (%) for the proposed approach with respect
	to DMR (TMR) without faults.
	Benchmark	1	2	DMR 3	4	5	1	2	TMR 3	4	5
	motion	11 14 17 21 27	7	9 12 17
	huff	11 14 15 19 21	7	8 10 12
	fft	16 23 35 47 59	9 13 22 33
	dct	21 28 37 48 58 13 17 23 32
	bcnt	21 26 31 39 49 11 13 16 22
	adpcm_enc 21 26 34 42 47 12 16 23 30
	adpcm_dec 23 28 35 43 47 12 16 23 30
	matrix_mul 36 40 54 66 75 14 21 34 46
	fir	16 20 27 34 38 10 14 20 26
	crc	3	4	7 12 20	2	3	5 11
	average	18 22 29 37 44 10 13 19 26

Table 5 .

 5 2: Performance gain (%) estimation of the proposed approach over existing approaches for multiple permanent errors.

	Benchmark	1	2	DMR 3	4	5	1	2	TMR 3	4	5
	motion	44 43 42 40 37 46 46 44 41
	huff	45 43 42 41 39 47 46 45 44
	fft	42 39 33 27 21 46 43 39 34
	dct	40 36 32 26 21 44 41 38 34
	bcnt	39 37 35 30 25 44 43 42 39
	adpcm_enc 39 37 33 29 27 44 42 39 35
	adpcm_dec 38 36 32 29 26 44 42 39 35
	matrix_mul 32 30 23 17 12 43 40 33 27
	fir	42 40 36 33 31 45 43 40 37
	crc	49 48 46 44 40 49 49 48 45
	average	41 39 35 31 28 45 43 41 37

Table 5 .

 5 3: Performance comparison (execution cycles) under several multiple faults and average performance overhead (%).

Table 5 .

 5 4: Tuned parameters (Min, Max, Step) for each group.

	Bench.	Total	Fault	Parallel	Total
	Group	injected faults duration occ. faults simulations
	1 (4-issue)	0, 310, 10	0, 100, 1	0, 5, 1	15,500
	1 (8-issue)	0, 260, 10	0, 100, 1	0, 5, 1	13,000
	2 (4-issue)	0, 1000, 10	0, 200, 1	0, 5, 1	100,000
	2 (8-issue)	0, 850, 10	0, 200, 1	0, 5, 1	85,000

Table 5 .

 5 5: Area footprint and power estimation.

	Approach area(µm Unprotected 50,844	4-issue	6.48	79,661	8-issue	7.36
	Proposed	62,314		7.92	107,258		9.89

2 ) power(mW) area(µm 2 ) power(mW)

La troisième contribution traite des défauts persistants. Un mécanisme matériel, qui réplique au moment de l'exécution les instructions et les planifie aux emplacements inactifs en tenant compte des contraintes de ressources, est proposé. Si une ressource devient défaillante, l'approche proposée permet de réaffecter efficacement les instructions d'origine et les instructions répliquées pendant l'exécution. Les premiers résultats dévaluation de performance montrent un gain de performance jusquà 49% par rapport aux techniques existantes. Afin de réduire davantage le surcoût en performance et de prendre en charge latténuation des erreurs simples et multiples de type transitoires longues (Long-Duration Transients -LDT), une troisième contribution est présentée. Nous proposons un mécanisme matériel qui détecte les défauts toujours actifs pendant l'exécution et réorganise les instructions pour utiliser non seulement les unités fonctionnelles saines, mais également les composants sans défaillance des unités fonctionnelles concernées. Lorsque le défaut disparaît, les composants de l'unité fonctionnelle concernée peuvent être réutilisés. La fenêtre dordonnancement du mécanisme proposé comprend deux ensembles d'instructions pouvant explorer des solutions d'atténuation des fautes lors de l'exécution de l'ensemble dinstructions en cours et de l'ensemble d'instructions suivant. Les résultats obtenus sur l'injection de fautes montrent que l'approche proposée peut atténuer un grand nombre de fautes avec des surcoûts faibles en performance, surface et puissance.

The execution cycles needed are different from the cycles in section 4.6.1 because a different matrix multiplication implementation has been used.

Acknowledgements

Publications

Acknowledgements

To my life-coach, my mother, Margarita who has always been there for me in the most difficult and yet happy moments of my academic life. Thanks a lot for teaching me that life is all about fighting and never giving up, and that happiness is a state of mind. To my father, Marios, who helped me discover and love science, by stimulating my childish brain.

To my sister, Georgiana, my grandma, Anastasia and the rest of my family for their love and support throughout all these years of my studies. Many many thanks and love!! I am also grateful to my friends who have supported me along the way. I also want to thank the God for giving me courage and hope in these moments when everything else has failed!! I would like to thank my supervisors, Professor Olivier Sentieys and Assistant Professor Angeliki Kritikakou, for the patient guidance, encouragement and advice they provided throughout my time as their student. I consider myself lucky to have such supervisors who cared so much about my work, and who responded to my questions and queries so promptly.

In particular, I am extremely thankful and indebted to my co-supervisor Angeliki Kritikakou

List of Figures

List of Abbreviations

assign [

Instruction Rescheduling for persistent errors

We propose a coarse-grained mitigation mechanism that takes advantage of the idle issue slots of VLIW instruction bundles to: 1) execute original and replicated instructions in order to provide fault tolerance and 2) rebind instructions in case of permanent errors. It can be combined with several fault tolerant techniques, i.e. duplication and triplication of instructions supporting error detection and mitigation, and it is applicable for any VLIW structure, i.e. any issue width and number and type of FUs.

In order to further decrease the performance overhead introduced by the coarse grained mitigation mechanism and also to support single and multiple Long-Duration Transient (LDT) faults a fine-grained mitigation mechanism is proposed. This mechanism detects the active faults during execution and temporally excludes only the faulty components of the affected FUs for as long as it is necessary. (MEM) and 1 branch unit (BR), and ii) 8-issue configured with 4 complex FUs, 4 simple FUs, 2 MEM and 1 BR. The processor has been enhanced with the proposed approach.

Coarse Grained Mitigation for Permanent Errors

Motivation example and overview

Both the original unprotected VLIW processor and the VLIW with the proposed online fine-grained mitigation mechanism have been developed in C++ and synthesized using the Catapult High Level Synthesis (HLS) tool to obtain the RTL design. The gate-level netlist was generated by the Design Compiler of Synopsys using 28 nm ASIC library. Following this approach, we can both simulate the processor and synthesize a functional RTL design. To evaluate our approach, we use the same ten benchmarks from the MediaBench suite [START_REF] Lee | Mediabench: a tool for evaluating and synthesizing multimedia and communications systems[END_REF], which were used to evaluate the architectures proposed in the previous chapters. The benchmarks are compiled with VEX compiler for each configuration.

Performance

We compare the performance of the fine-grained mitigation mechanism with the coarsegrained mitigation approach. In the coarse-grained approach, when a fault occurs in: i) a complex FU, the part that is still healthy -either the simple FU part or the additional multiplication operator -is used and the faulty part is permanently excluded, or ii) a simple FU, the FU is permanently excluded. In contrast, the fine-grained approach explores the FUs in a fine-grained way and applys temporal exclusion. 1)Fine-grained FU exploration: In the first experimental part, we evaluate the benefit of our approach only due to the proposed fine-grained FU exploration. To do so, we randomly injected multiple faults during the benchmarks' execution and we consider them as permanent, i.e. they last for the rest of the execution. Table 5.3 shows the cycles required to execute the ten benchmarks considering: i) 0 faults (Original), ii) 1 up to 4 multiple faults for the 4-issue configuration and iii) 2 up to 10 multiple faults for the 8-issue configuration.

In this experimental part, we have to limit the number of injected faults to 4 and 10 for the 4-issue and 8-issue configuration, respectively, since this is the maximum number of concurrent faults that the coarse-grained approach can sustain. The performance results are obtained by taking the mean value of 20 simulations running the same benchmark, but the faults are injected at random cycles for each simulation. When no faults occur, both approaches have the same performance, i.e. the original execution cycles. From the Table 5.3, we observe that: 1) the proposed approach inserts significantly lower overhead than the coarse-grained approach, and 2) in several benchmarks our performance is very close to the original one, i.e. without faults, even for several multiple faults. In contrast

Chapter 6

Summary and Future Work

Thesis Summary

Technology scaling and harsh environments have significantly increased the error occurrences in embedded systems making fault tolerance an essential topic for a wide range of domains, especially the safety critical ones. Errors can harm processors temporarily, permanently and semi-permanently. To satisfy the increasing demand for reliability, the systems are designed with error detection and/or error correction capabilities. At the same time, modern systems have to meet the increasing demands in performance, energy, and area efficiency. Very Long Instruction Word (VLIW) processors excel in this category because they offer high performance through Instruction Level Parallelism (ILP) exploitation, while keeping cost and power in low levels. This dissertation is motivated by the fact that ILP exploitation is not always possible due to applications' fluctuating ILP, thus the available resources of a VLIW processor are not always used. In order to prove this statement benchmarks were analyzed and the results showed that the average ILP is less than 2.85 and 4.46 for a 4-issue and 8-issue configurations, respectively. In order to identify the most vulnerable part of the VLIW architecture used, a fault injection mechanism was also developed that evaluates the Architectural Vulnerability Factor (AVF) and the Instruction Vulnerability Factor (IVF) of the processor.

Extensive simulations with fault injections on a simulator software representation of the adopted processor showed that the execution stage takes significant area and it should be prioritized compared to other stages. The findings from the benchmark experiments and the vulnerability analysis in conjunction with the need for fault resilient execution led us

List of Figures