系列微机控制器对瞬时故障的容错能力的合成 计算机科学与技术专业毕业设计外文翻译.doc

装订线 毕业设计（论文）译文纸Synthesis of an 8051-Like Micro-Controller Tolerant to Transient FaultsThis paper presents the implementation of a fault detection and correction technique used to design a robust 8051 micro-controller with respect to a particular transient fault called Single Event Upset (SEU). A specific study regarding the effects of a SEU in the micro-controller behavior was performed. Furthermore, a fault tolerant technique was implemented in a version of the 8051. The VHDL description of the fault-tolerant microprocessor was prototyped in a FPGA environment and results in terms of area overhead, level of protection and performance penalties are discussed.1. IntroductionThe constant improvements achieved in the microelectronics technology allow the manufacturing of very complex circuits, substituting boards or even computers of the past 80s. Nowadays, because of the microelectronics advances, traditional applications become cheaper and more reliable, while a large range of new applications can take advantage of integrated devices by using the so-called embedded systems. In all cases, architectures are strongly based on some kind of data processor, such as a micro-controller or a DSP processing unit, for example. The continuous decrease in the semiconductor dimensions and in electrical features, leads to an increasing sensitivity to some effects of the environment (ionization due to radiation, magnetic perturbations, thermal,.) considered minor or negligible in the technologies of the past. Particularly, digital circuits operating in space are subject to different kinds of radiation. However, some problems have also been reported for some Earth applications, like avionics systems .Radiation effects can be permanent or transient . Permanent faults result from particles trapped at the silicon/oxide interfaces and appear only after long exposure to radiation (Total Ionization Dose). Transient faults (Single Event Effects, SEE) may be caused by the impact of a single charged particle in sensitive zones of the circuit. Depending on the impact location, two kind of SEEs are distinguished: SELs (Single Event Latchups) and SEUs (Single Event Upsets). SELs result from the triggering of parasitic thyristors (present in CMOS technologies) and provoke short circuits, capable to damage the component by thermal effect if the circuit is not powered-off at time. SEUs are responsible for transient changes, called upsets or bit flips, in bits of information stored within an integrated circuit. Total ionization dose (TID) and single event latch-up (SEL) effects can be reduced to acceptable levels using some of the existing CMOS technologies, for example the Epi-bulk CMOS process . However, Single Event Upsets (SEUs) represent radiation induced hazards, which are more difficult to avoid in the space applications, especially in high-density sub-micron integrated circuits. In this paper, only SEU faults are being considered. The consequences of a SEU fault depend on the nature of the perturbed information, ranging from erroneous results to system crashes. For complex circuits like DSP processors, co-processors, microcontrollers, the sensitivity to SEU correlates strongly with the amount of internal memory (registers, memory bits, flip-flops, etc.) available.In this context, it is clear the need for circuits immune to radiation effects, mainly those working in space, where a fault can imply the lost of millions of dollars and years of work. Moreover, it is extremely important to know the efficiency of a fault-tolerant technique before the circuit is in its real environment.This paper aims at investigating the efficiency of a fast prototyping design hardening technique, which focuses on general-purpose processor architectures. The proposed technique is mainly based on the inclusion of error detecting and correcting capabilities. A reduced instruction set version of a well-known microcontroller, the 8051 from Intel, was chosen as the test vehicle for these researches. This choice was motivated by the fact that this micro-controller is widely used in space applications. The paper is organized as follows: in Section 2 some related works are revisited. In Section 3 the effects of transient faults in a micro-controller are presented along with a tool capable to emulate the real process of a SEU fault occurrence. The implementation of a hardened 8051 micro-controller is presented in Section 4. Experimental results, concerning both the performance in terms of area overhead and operating frequency, and the sensitivity to transient bit flips, are summarized in Section 5. Section 6 brings some considerations about the implementation of a prototype of the fault-tolerant circuit to be tested in a real radiation environment. Concluding remarks and future work are discussed in Section 7.2. Related WorkSolutions to implement a fault tolerant device with respect to transient faults can be considered at different steps of the device development process. The mitigation solution can be divided in: circuit level, where a specific technology process for fabrication is used; design level, where logic structures are modified to achieve the SEU immunity; system level, where modifications in the software are performed.In order to avoid SEU , some microprocessor manufacturers such as IBM, are proposing microprocessors in the Silicon on Insulator (SOI) technology. However, this solution is still very expensive. Solutions at the design level, like triple modular redundancy, are widely used to cope with transient errors, especially in random logic. The drawback of this solutions is the resulting area overhead.Error detection and correction techniques (EDAC) have been used in the last few years to increase memories reliability. Examples of these techniques are parity check and Hamming Code . Some studies have shown the capabilities of using error detection and correction in State Machines instead of the use of redundant flip-flops with a voter . No previous work was found on protecting a full micro-controller using EDAC techniques. Related works restrict to the use of detection and correction techniques only in internal memories.3. SEU Effects in the 8051 MicrocontrollerSeveral space applications are based on the 8051 microcontroller, because it has a good tradeoff in terms of cost, area occupation, performance and software compliance. In order to implement efficient fault tolerance techniques, a very accurate measure about the localization and the effects of SEU faults in the circuit is necessary. This measure is obtained, in this work, by running controlled fault injection experiments on an existing hardware built on a standard 8051. During the experiments, the micro-controller executes a program designed to provide worst case conditions in terms of exposing the circuit to the effects of SEUs. Indeed, the selected program, a 6 6 matrices multiplication with both the operand and result matrices resident within the 128 byte internal SRAM, occupies most of the internal memory, which constitutes the main target of SEU.3.1. Basic Principles of THESIC TesterTesting integrated circuits in a severe radiation environment prior to their use in operational systems is a mandatory step and will help to reduce the probability of failures in future applications. The sensitivity evaluation of a circuit with respect to radiation can be done: 1) by the analysis of flight data issued from spacecraft operating in the actual environment; 2) by ground testing using electron beams; or 3) by fault injection in the circuit. Screening tests are mandatory to predict error rates in the final environment. They consist on a ground test based on the exposure of the studied parts to simulated radiation conditions issued, for instance, from particle accelerators.3.4. Obtained Fault Injection ResultsDetailed steps of this experiment can be found in . In this section, the resumed results are described as a motivation to the protection of the microprocessor. A total of 12245 random single CEUs were injected while executing the matrices multiplication program. According to the consequences of injected upsets at the program execution level, obtained results were classified into the three following types: tolerated errors; result errors; and lost of sequence.The first group, tolerated errors, corresponds to those bit flips injected on memory elements whose content is not relevant for the rest of the program execution when the fault occurs. For instance, it can be a register not used after the fault occurrence or a register that will be written after the fault occurrence, thus “erasing” the fault.All injected faults for which expected and obtained program results (the resulting matrix in our case) differ in at least one bit are considered as leading to result errors. Finally, cases where after fault injection, no answer is got from the processor, are classified in the lost of sequence group. These malfunctions are unrecoverable, needing a hardware reset to restart program execution. Tables 1 and 2 summarize the experimental results. For each type of error, the corresponding percentage of the identified consequences at the program execution level is given.Referring to the Table 1, one can note that nearly half (47.24%) of the total number of injected faults caused errors on the results of this application, while only 2.8% of them caused the lost of sequence. From the 5784 faults that resulted in errors, 98.5% (5700) of them caused bit flips in the internal memory, while only 1.5% (84 faults) affected the SFRs. This demonstrates that the internal memory should be protected against SEU faults to get a reliable operation. Furthermore, despite the reduced number of bits on SFRs (Special Function Registers) used in this application (88 bits = 10 8-bit registers + PC) compared to those used in the internal memory (944 bits = 108 words for matrices+ 10 words for variables and constants), they resulted in 44.8% of lost sequence faults (154 out of 344 faults that caused lost of sequence). This means, undoubtedly, that the protection of the SFRs in this processor is also required. Thus, from this analysis, the internal memory and the SFRs are defined as the sensitive zones of the 8051.4. Implementing Fault Tolerance in an 8051 DescriptionConsidering the results presented in last section, it clearly appears the need for some kind of protection of the micro-controller as a mean to guarantee the reliable operation of the whole system in radiation environments. In this work, the method chosen for protection is the implementation of a fault-tolerant version of the 8051 by means of an Error Correcting Code in the sensitive area of the micro-controller (memory and internal registers, as shown in the last section). The main idea is to provide a VHDL description of the fault-tolerant microprocessor that can be synthesized using existent tools.4.1. 8051 StructureThe MSC8051 VHDL description presented at was re-used to insert radiation tolerant test structures. The original code is entirely compatible with the INTEL 8051 microprocessor in terms of instruction timing. As shown in Fig. 3, the microprocessor description is divided into six main blocks: a finite state machine that generates the states and controls the number of cycles for each instruction to guide the circuit operation; a control part that provides some control signals for the data path; an instruction part which generates the microcode word for each instruction; the data path itself, including an ALU and some registers, the RAM and ROM memories.This original version of the 8051 micro-controller implements 25 instructions and uses 116 latches and 1075 LCs in a FLEX10K20 FPGA device. The clock frequency for this implementation is 2.59 MHz.In terms of permanent faults, an at-speed selftestable version of this micro-controller has been implemented by inserting in each block a specific builtin self-test structure . The goal now is to modify the finite state machine flip-flops, registers and memory blocks of the available VHDL description so that the whole microprocessor becomes tolerant to transient faults due to the radiation effects.4.2. Fault Tolerance TechniqueThe technique used in this work to detect and correct faults in memory cells is to assign a Hamming code to each memory element, and to perform the verification of the stored code every time this element is accessed. Since the implemented strategy concerning error recovery is completely combinational, it can be used for any sub-circuit (memory block or internal register).In order to implement the Hamming code, two combinational components were described in VHDL and inserted into the original description of 8051. The first component receives an n-bit data and returns an m-bit coded word (m = n +_log2 n.) The second component receives an m-bit word and returns an n-bit decoded and corrected data.The same components models for coding and decoding used in the memory were used to protect registers in the data path. Now, other instances of those models are used to code and decode ALU registers and accumulator, the stack pointer, the program counter, the instruction register, etc. Each time a register is accessed, it is decoded (and possibly corrected) before being used while the new data is coded before being stored. Since coding and decoding operations are completely combinational, there is no difference in terms of machine cycles needed for the execution of operations in the protected registers. This means the fault tolerant 8051 remains completely compatible with the original version in terms of timing. Of course, the clock frequency is altered, as it will be shown in Section 5.3. Fig. 5 shows the scheme of a protected register in the data path.4.3. Synthesis of the Fault Tolerant 8051The use of presently available high-density programmable circuits such as Field Programmable Gate Arrays (FPGAs) and Programmable Logic Devices (PLDs) is an attractive approach to fast prototyping and cost reduction. Indeed, these circuits can replace a high number of logic components allowing to build up complex designs on a single chip in a short developing time. The use of reprogrammable FPGAs along with the possibility to obtain the FPGA programming from high level language descriptions (such as VHDL) offers a flexible and low cost mean to compare the performances of different implementations for a given circuit.In order to validate the implemented structures, the fault-tolerant VHDL description was synthesized in a FPGA environment. Although some results related to the synthesis for FPGAs are not absolute, this environment is very useful for fast validation of the technique itself in terms of fault coverage and effectiveness.The 8051s description with the FSM, the internal RAM and registers tolerant to transient faults, was synthesized in the ALTERA FPGA environment . Table 3 shows the comparative results in terms of number of flip-flops, area overhead, and clock frequency for each block of the description and for the whole microprocessor. The extra number of latches represents the extra bits necessary for the Hamming code in each memory cell.From Table 3 it can be pointed out that the area overhead for this first implementation is of 64% for a complete fault-tolerant microprocessor. Although this can be considered a penalty, this is lower than replication techniques, while assuring the same or even better protection. Besides, as will be shown later, this is not the minimum possible area overhead.In terms of performance, the completely fault tolerant 8051 presents only a minor penalty if compared to the original version (2.55 MHz compared to 2.59 MHz, respectively). Indeed, since the protection blocks are completely combinational, only minor delays are inserted .VHDL simulations have shown that even in the presence of a fault in the protected registers, the microprocessor provides a correct result for a program execution. 5. Hardened Prototype ImplementationAfter the accurate definition of the sensitive parts of the 8051 microprocessor, and the implementation and validation of protection schemes for those blocks, the next step is to implement a physical device to be validated in a real radiation environment. The goal is to include this fault tolerant 8051 version in the THESIC daughter board and expose it to radiation . A FPGA prototype is being proposed in this work to run this last experiment.6. Conclusion and Future WorkWe have presented the principles of a strategy devoted to hardening embedded processor designs with respect to transient errors resulting from the interaction with the environment. Aparticular consequence of radiation environment, the Single Event Upsets phenomenon, was focused. The impact of the occurrence of this kind of fault in the microprocessor was evaluated by software fault injection experiments, performed by means of a dedicated system (THESIC) developed at TIMAdedicated system (THESIC) developed at TIMA laboratory. These experiments allowed the prediction that an 8051 robust version based on the hardening of internal RAM by error detection and correction strategy would tolerate the effects of transient bit flips in 98% of the cases. If extended to all accessible memory elements, the studied technique should allow the implementation of a SEU-immune processor.The protection of the memory cells against a bit flip was tackled by the insertion of error correcting codes in an existing VHDL design of a processor widely used in space projects: the Intel 8051 micro-controller. The main features of the new 8051 robus