Why Multiple Faults ?

(1)

SBCCI 2005

Florianópolis, Brazil

Going Beyond TMR for

Protection Against Multiple Faults

Carlos A. L. Lisbôa Erik Schüler Luigi Carro

(2)

Why Multiple Faults ?

• Future technologies (2010 and beyond)

• very small transistors and fewer electrons to form the channel (→ SETs)

• transient pulses due to radiation attack will last longer than the propagation delays of gates

• devices will be more sensitive to the effects of

electromagnetic noise, neutrons and alpha particles

(3)

Single Event Upset Origin

1 0 1 0 0 0 0 1

(4)

Why Multiple Faults ?

Consequence:

Gates will behave statistically,

producing correct outputs only a

fraction of the time.

(5)

Outline

• How to deal with multiple faults ?

• Why beyond TMR ?

• Making TMR (more) reliable

• Dealing with multiple simultaneous faults

• Conclusions

(6)

• New paradigm: multiple simultaneous faults

• new fault tolerance techniques will be required (TMR will no longer provide enough protection)

• How to deal with this problem ?

• new materials and manufacturing technologies must be developed

OR

• new design approaches must be taken

How to Deal with Multiple Faults ?

• new design approaches

must be taken (our bet !)

(7)

Module 2 correct output

Why Beyond TMR ?

• TMR protects only against single faults in one of the modules

V O T E R

correct output

(8)

Module 2 wrong output

Why Beyond TMR ?

• TMR protects only against single faults in one of the modules

Module 1

Module 3

correct output

V O T E R

correct output

(9)

V O T E R

correct output

Why Beyond TMR ?

• When a single fault occurs in the voter circuit, the voter output may be wrong

Module 1

Module 2

correct output

(10)

V O T E R

correct output ?

Why Beyond TMR ?

• When a single fault occurs in the voter circuit, the voter output may be wrong

Module 1

Module 2

Module 3

correct output

correct output correct output

(11)

Why Beyond TMR ?

• Single fault injection experiment

• Module: 4x4-bit array multiplier, 96 gates

• Voter: 32 gates

• Total using TMR: 3 x 96 + 32 = 320 gates

• Injected faults: sa-0 and sa-1 (320 of each)

• Injection tool: CACO-PS

(12)

Why Beyond TMR ?

• Experimentation:

• injection of single faults with all possible 256 input combinations

(13)

Why Beyond TMR ?

• Single fault in one of the 3 modules :

• no propagation to voter output

(14)

Why Beyond TMR ?

• Single fault in one of the 3 modules:

• no propagation to voter output

• Single fault in the voter:

• 6 to 24 faults (in 640) propagated to voter output, depending on the input value: 0.9375% to 3.75% !

(15)

Making TMR (more) reliable

• Known solutions imply in

• area, performance and / or power penalties

• deadlock: how to protect the output generator ?

(16)

Making TMR (more) reliable

• Proposed solution:

• use TMR to cope with single faults in the modules

(17)

Making TMR (more) reliable

• replace the digital voter by an analog voter that

(18)

Making TMR (more) reliable

• replace the digital voter by an analog voter that

• uses a comparator to generate the output

• can support some noise, nevertheless producing

(19)

The Analog Voter

(20)

The Analog Voter

???

(21)

The Analog Voter

(22)

The Analog Voter

(23)

The Analog Voter

(24)

The Analog Voter

(25)

The Analog Voter

(26)

Electrical Simulation: Without Faults

(SPICE and CMOS 0.35 µm)

(27)

Minimum Area Comparator

Injection of faults

in the comparator ^(*)

(28)

Electrical Simulation: Multiple Faults

(SPICE and CMOS 0.35 µm)

(29)

Montecarlo Parameters Variation

(up to 30%): t

_ox

and V

_t

(30)

Why Multiple Faults ?

• with smaller devices

• less electrons to form the channel

• increased sensitivity to noise

(31)

Why Multiple Faults ?

• with smaller devices

• less electrons to form the channel

• increased sensitivity to noise

• gates will behave statistically,

producing correct outputs only

a fraction of the time

(32)

Why Beyond TMR ?

• When multiple simultaneous faults occur in different modules, the voter output may be wrong (and deemed correct !)

Module 1

Module 2

Module 3

correct output

correct output correct output

V O T E R

correct output

(33)

Why Beyond TMR ?

• When multiple simultaneous faults occur in different modules, the voter output may be wrong (and deemed correct !)

V O T E R

correct output

Module 1 wrong output

wrong output

(34)

Dealing with Multiple Simultaneous Faults: n-MR

The Analog Voter with 5 Inputs (for 5-MR)

(35)

Dealing with Multiple Simultaneous Faults: n-MR

The Analog Voter with 5 Inputs (for 5-MR)

(36)

Conclusions

• The proposed analog voter is tolerant to multiple simultaneous faults

(37)

Conclusions

• The proposed analog voter is tolerant to multiple simultaneous faults

• It can be used to replace digital voters in n-MR solutions to cope with multiple faults

(38)

Conclusions

• The proposed analog voter is tolerant to multiple simultaneous faults

• It can be used to replace digital voters in n-MR solutions to cope with multiple faults

• n-MR solutions will withstand up to (n-1)/2 simultaneous faults in the circuit

(39)

Future Work

• prototype in silicon several circuits, such as filters, using n-MR and the analog voter

(40)

Future Work

• prototype in silicon several circuits, such as filters, using n-MR and the analog voter

• test of those circuits under multiple faults

(41)

Future Work

• this work is part of a larger research

• study new additional techniques to implement complete fault tolerant processors using future technologies

• bring analog design techniques to the digital

(42)

Thank You ! Questions ?

Contact: calisboa@inf.ufrgs.br