A Soft Error Emulation System for Logic Circuits Sandip Kundu∗ Department of ECE University of Massachusetts Amherst, MA 01003, USA
[email protected]
Matthew D.T. Lewis
Ilia Polian
Bernd Becker
Albert-Ludwigs-University Georges-K¨ohler-Allee 51 79110 Freiburg i. Br., Germany {lewis|polian|becker}@informatik.uni-freiburg.de
Abstract In nanometer technologies, soft errors in logic circuits are increasingly important. Since the failure in time (FIT) rates for these circuits are very low, millions of test vectors are required for a realistic analysis of soft errors. This exceeds the capabilities of software simulation tools. We propose an FPGA emulation architecture that can apply millions of vectors within seconds. Comprehensive soft error profiling was done for ISCAS 89 circuits. Soft errors were assigned to four different classes, and their latency and recovery time were obtained. This information is useful for understanding the vulnerability of the system to soft errors and hardening it against such errors.
1 Introduction A transient fault causes a circuit node to glitch but does not cause any permanent damage. Such faults typically occur due to ionizing radiation from α-particles or cosmic rays [1]. Since a transient fault occurs due to an external event outside the control of logic operation, these faults are not repeatable (i.e., the fault may occur during a test run and not occur during a second identical test run). The probability that a single node upset will cause a circuit failure is small in many instances. In the literature, the terms “transient fault” and “soft error” have been used interchangeably. This causes some confusion. We define a transient fault as a single or multiple node(s) upset directly attributable to excess charge carriers induced by external radiation (the terms Single Event Upset (SEU) and Single Event Transient (SET) are used in the Nuclear Science literature [2]). By contrast, we define soft error as an impact of a transient fault that may persist beyond a cycle. For the impact to transfer from a clock phase to another, the impact must be captured in a storage element such as a latch or memory. Thus, soft error may manifest away from the location of the strike. Therefore, transient faults and soft errors can be viewed as cause and effect. As mentioned earlier, a transient fault is not repeatable. During manufacturing test, a soft error observed by ∗ This work was performed while the author was a guest professor at the Albert-Ludwigs-University of Freiburg.
a tester is indistinguishable from any other error source such as a permanent defect. These parts will be discarded. However, passing manufacturing test does not mean that transient faults will not occur during actual operation. On the contrary, process variation may make one circuit part more vulnerable to soft errors than another. To distinguish between parts based on soft error susceptibility different kinds of tests are needed. Such tests will apply patterns from a tester repeatedly and measure the mean time to failure (MTTF) to estimate the rate of failure in time (FIT) rate. FIT rate is defined as the number of failures per billion hours of operation, i.e. 114,000 years. Thus, FIT rate of 1 would imply that MTTF is 114,000 years. A typical FIT rate of a today’s commercial semiconductor circuit is between 1 and 100. Consequently, MTTF is between 1,140 and 114,000 years. It is quite obvious that measuring a MTTF of thousands of years is impractical. Therefore, acceleration techniques are needed to measure MTTF [3]. In an accelerated system, the device under test (DUT) is exposed to much higher levels of radiation than found in nature. The MTTF is measured under accelerated conditions, and then this result is scaled for lower levels of radiation. It is difficult to validate the scaling factors (calibration) [4]. Thus, FIT rates are often gross estimates. These estimates can be improved if such transient faults can be simulated. Since simulation is usually many orders of magnitude slower than actual hardware operation, it seems impractical as well. In this paper we study the applicability of emulation techniques to accelerate the simulation of transient faults. Please note that FIT rate is associated with a chip and not a circuit node. Typically the rate of transient faults is a few orders of magnitude higher than FIT rate. The relation between these two entities is a topic of investigation in this paper. As mentioned earlier, the main source of soft errors is radiation. Consequently, soft errors in devices with elevated radiation exposure were historically considered first, including medical [5] and aerospace applications [6, 7]. Soft errors in integrated circuits used in other fields are mainly due to cosmic radiation and the alpha particles emitted by the package (advances in packaging technology have almost eliminated the latter problem). Historically, memories rather than random logic were studied
[8], as memories tend to have higher integration densities and smaller feature sizes, making them more susceptible to transient faults. Furthermore, the area occupied by memory is larger than that of random logic for many modern designs. Nevertheless, there is an increased interest in soft errors affecting the logic part of a circuit, both digital [9, 10, 11] and analog [12]. A strategy for addressing soft errors includes the estimation of the vulnerability of a given device to these errors, and the design of the soft error detection and correction circuitry. For each of these steps, it is useful to know how the circuit behaves in the presence of a transient fault. For this purpose, software simulation methods for soft errors exist (including commercial tools such as IROC’s Roban [11]). However, some specific characteristics of soft errors impose limits on the applicability of software solutions. First of all, soft errors tend to show up relatively rarely (with millions of clock cycles in between) [13]. On-line test methods [14] used for soft error detection often employ on-chip pseudo-random pattern generators in order to apply such large numbers of test vectors to the device under test. Hence, realistic test sequences are too long to be handled by a software simulator. Furthermore, some profiling information on soft errors might be of interest (e.g. the number of cycles between the first and the last occurrence of a faulty response). In order to obtain this information from a software simulator, speed-up techniques such as fault dropping must be disabled, leading to even more performance deterioration. Consequently, FPGA-based emulation of soft errors is an attractive alternative. It allows the emulation of millions of clock cycles per second, making the application of a very large number of test vectors practical. Emulation has been proposed for permanent faults [15, 16, 17] but is not yet predominant in that field. We propose an emulation architecture for soft errors based on an FPGA platform. We target the following applications: 1. Given a circuit, estimate its vulnerability to soft errors by determining the fraction of transient faults that actually result in a faulty behavior. 2. Obtain soft error profiles of the circuit, e.g. the statistical information on the number of transient faults with effects solely on the combinational part of the circuit; the number of those faults that changed the state of the system (altered the values in the flip-flops); and the number of soft errors from which the system recovered after some time. In the latter case, we are also interested in the mean recovery time. These concepts will be defined more precisely in the next section. 3. On-line soft error detection schemes can be evaluated against each other. For instance, the detection capabilities of different test pattern generation blocks can be compared. Although we do not focus on such a comparison in this paper, the required modification is very small. 4. Once the circuit is hardened (e.g. by adding redundancy), the experiment can be repeated, to quantify the reduction in soft error vulnerability (fault tolerance evaluation).
Garc´ıa-Valderas et al. [18] have recently proposed an emulation-based solution for transient faults. However, their method is only partially suitable for the abovementioned applications. First, they only consider bit-flips in memory elements. This is inadequate for transient faults in combinational logic, since (1) a transient fault may not propagate to any flip-flop due to logical, electrical or latching-window masking [19] and (2) it may propagate to more than one flip-flop. In contrast, our technique is valid for faults on arbitrary logic lines. This allows us to collect meaningful profiling information on combinational vs. sequential soft error effects. Second, the approach from [18] requires the upload of the test sequence and the expected output values onto the FPGA. Both area restrictions and host-to-FPGA throughput issues prevent millions of test vectors from being applied. Indeed, the lengths of their test sequences for the two considered benchmark circuits are 16 and 160, respectively. However, a soft error is likely to happen after a large number of clock cycles. Hence, considering only the states of the system close to the initial (reset) state does not appear to be very realistic. Our proposed scheme radically reduces the interaction between host and FPGA. (In particular, neither test data upload nor reconfigurations are required). Further related publication are [20], which concentrates on bit flips in memory elements of a 8051-like microprocessor, and [21] which also focuses on faults in flip-flops (although multiple bit flips can be treated) and requires more bandwidth for communication with the host than the proposed technique. The remainder of the paper is organized as follows: details on soft error profiles are given in next section. The emulation architecture is described in Section 3. Section 4 contains experimental results. Section 5 concludes the paper.
2 Soft Error Profiles For the rest of the paper we define a transient fault as a bit flip in combinational logic with a duration of 1 clock cycle on an output of a gate1 , and a soft error as the impact of such a fault on the circuit functionality. We refer to the flipped node as the soft error location. We consider only single fault injections, i.e. only one fault is present at any given time. This assumption is meaningful, as the interval between two transient fault occurrences is typically very large. However, our technique can be easily modified to handle multiple transient faults or combinations of transient and permanent faults, should this be desired. Let the number of considered soft error locations be F . For a sequence consisting of L vectors, there are potentially L different soft errors for each location. However, we consider only one soft error per location, resulting in 1 Realistic transient fault duration are less than one clock cycle, and the length of the glitch also tends to diminish when it propagates through the circuit (electrical masking) [19]. We are currently working on assigning a fault an occurrence probability which would account for these phenomena. Note that, in general, layout information is needed for calculating occurrence probability.
F soft errors overall. Hence, we call kth soft error simply “soft error k”. We denote the clock cycle in which soft error k is injected as its injection time ITk . We call the first clock cycle in which a faulty value is observed on at least one primary output of the device under test first detection time F Dk and the last clock cycle in which a faulty value was present last detection time LDk . Our first goal is the classification of the F soft errors. We distinguish between the following four classes (which are different from the classification in [21]): 1. Class NE (no effect): these errors do not change the function of the device under test. No deviation from the expected outputs is observed either in the cycle in which the fault is injected or a later clock cycle. 2. Class CO (combinational only): circuit behavior is affected only in the clock cycle in which the fault was injected but not afterwards. Most probably, the state of the system (the values in the flip-flops) was not changed. 3. Class SR (sequential, recovered): faulty values are produced for several clock cycles, but after several more clock cycles only fault-free output values are observed. 4. Class SN (sequential, not recovered): faulty values are produced until the end of the sequence. This definition is somewhat vague; in our experimental setup we classify those soft errors as SN for which the circuit produces a faulty value in the last 64K clock cycles of the sequence. Note that all these definitions are with respect to a given test sequence and that the definitions are based on observation rather than on formal proofs. For instance, there is some (small) probability that an error classified as NE actually did change the state of the system, but this was not exposed by the remainder of the test sequence. For soft error k not belonging to class NE, 0 ≤ ITk ≤ F Dk ≤ LDk ≤ L holds. For a soft error from class CO, ITk = F Dk = LDk is true. For soft error k from class SR, either ITk < F Dk or F Dk < LDk must hold. Additionally, LDk L distinguishes class SR from class SN. Our second goal is to better understand the behavior of the faults in the system. For this purpose we define the latency Lat(k) := F Dk − ITk and the recovery time Rec(k) := LDk − ITk of soft error k. Latency indicates the number of cycles that a fault needs to start having an observable impact on the system. This number is important e.g. for designing a rollback recovery solution, as it indicates the minimum number of clock cycles to roll back. It is defined for all classes except NE; for errors from class CO, latency is always 0. Recovery time is only well defined for classes CO (for which it is always 0) and SR. Note that “recovery” does not mean that the error is not critical as a wrong value appears at the output of the system (although it disappears later). Recovery time indicates how long an error stays in the system. Latency and recovery time can be aggregated by calculating minimal, maximal and average numbers.
3 Emulation Architecture Suppose that the device under test has n primary inputs (PIs) and m primary outputs (POs). The number of considered error locations (and hence soft errors, as discussed above) be F . The block diagram of the proposed emulation system is shown in Figure 1. It consists of a miter circuit (blocks PRPG, DUTff, DUTinj and ORA), soft error injection circuitry (blocks TRC, TVC, INJ and ITG) and the result evaluation block Eval. Clock and reset signals are omitted for clarity.
3.1
Miter part
Block DUTff (in the miter part) is simply the device under test (this is related to the Golden Soft-core concept from [20]). Note that any synchronous sequential digital circuit can be treated by the proposed technique; no design for testability structures such as scan or test access ports are required. Block DUTinj also corresponds to the device under test, however XOR gates are inserted on the lines corresponding to the considered fault locations. The free input of the XOR gate is connected to a new primary input, called inject input. Since F fault locations are considered, there are F inject inputs inj1 , . . . injF . Figure 1 shows the circuit modification for the inject input injk . Soft error k is injected if and only if the logical value on injk is 1. Block PRPG is a pseudo-random pattern generator. In this work, we used an LFSR with a primitive characteristic polynomial as PRPG. Using pseudo-random patterns instead of deterministic test vectors stored in a memory on the FPGA ensures better correspondence to the on-line BIST technique actually used for soft error detection. Furthermore, the area requirement of an LFSR is not significant compared to the memory needed to store millions of deterministic patterns. The patterns generated by block PRPG are applied to both DUTff (fault-free) and DUTinj (affected by a soft error). Their respective outputs are compared by block ORA (output response analyzer), which produces a logic 1 on its output if and only if DUTinj calculated a wrong value on at least one output, leading to a mismatch. By duplicating the circuit and using the miter structure, the need to either store the expected responses in the FPGA or to communicate these responses to the host after every few clock cycles is eliminated. Moreover, no aliasing issues arise, in contrast to signature-based techniques.
3.2
Fault injection part
Since the proposed architecture is optimized for the target experiments (described in Section 4), it is appropriate to mention some specifics of the experimental setup. Slight changes in the architecture are required for different experiments. We apply a sequence of length L (using block PRPG) to DUTff and DUTinj. We inject only one fault (out of F ) and only in one clock cycle. Hence, the application of L vectors is repeated F times. We call the application of the sequence of L vectors a test run. During the kth test run, all the inputs Inji of DUTinj are held at logic-0, except Injk , which assumes the logical value
TVC
TRC
INJ 0
Inj1 PI1
0
Injk−1
1
Injk
0
0
Injk+1
ITG
InjF PO1
ORA
PRPG
PIn
DUTinj
POm
Eval PI1
PIn
To host
PO1
DUTff
POm
Figure 1: Emulation architecture. TRC = test run counter; TVC = test vector counter; INJ = fault injector; ITG = injection time generator; PRPG = pseudo-random pattern generator; DUTinj = device under test with fault injection logic; DUTff = fault-free device under test; ORA = output response analyzer; Eval = result evaluation block. Some clock and reset signals are not shown. of 1 for exactly one clock cycle. As mentioned in Section 2, this clock cycle is called injection time ITk . In our experimental setup, injection times are chosen randomly. Block TRC is the test run counter, which is incremented by one after each test run. Note that PRPG, DUTff and DUTinj are reset after each test run. Block TVC is the test vector counter, which counts from 0 to L − 1 and then initiates a new test run. Block ITG is the injection time generator. It uses the TVC value and produces a logic-1 on the output for exactly one clock cycle during a test run. The fault injector INJ is implemented using a shift register consisting of F flip-flops. Before the first test run, all flip-flops are initialized to a logic-0, except the leftmost one which is set to a logic-1. After each test run, the logic-1 is shifted to the next flip-flop and all other flipflops are reset to a logic-0. The values in the flip-flops are ANDed with the value produced by block ITG and applied to inject inputs of block DUTinj. Consequently, the inject input k can only become 1 in test run k, and only in the one clock cycle when ITG output is high.
3.3
Result evaluator
The result evaluation block Eval receives the information on the number of the current test run (from block TRC), the injection time (from blocks ITG and TVC) and the detection status in a given clock cycle (from blocks ORA and TVC). Based on this data, it can collect comprehensive statistical information. It is also responsible for aggregating that information and communicating it to the host. In our experiments, we focus (1) on the classification of the F faults into the four classes NE, CO, SR and SN and (2) on aggregated (minimal, average and maximum) latency and recovery time. For this purpose, block Eval has a total of 11 registers, from which all the numbers can be calculated. Only these 11 numbers are transmitted to the host at the end of the experiment. Optimizations include the computation of sums instead of average numbers, in order to simplify the FPGA by eliminating the need for a divider (the division is performed on the host after the measurement).
Circuit NE s01238 s01423 s05378 s09234 s13207 s15850 s35932 s38417 s38584
abs 416 467 279 439 351 381 432 459 403
% 83.20 93.40 55.80 87.80 70.20 76.20 86.40 91.80 80.60
Soft error classes CO SR abs % abs % 62 12.40 22 4.40 9 1.80 24 4.80 148 29.60 73 14.60 19 3.80 37 7.40 63 12.60 49 9.80 69 13.80 34 6.80 0 0.00 68 13.6 0 0.00 36 7.2 0 0.00 96 19.20
Latency (CO+SR+SN) min avg max
SN abs 0 0 0 5 37 16 0 5 1
% 0.00 0.00 0.00 1.00 7.40 3.20 0.00 1.00 0.20
0 0.17 0 1.09 0 0.45 0 3.56 0 3061.99 0 54.53 1 2.07 1 5.22 1 3.99
1 6 23 85 75541 1571 7 49 97
Recovery time (SR) min avg max 1 1.23 2 2 1.88 6 1 104.68 1200 1 1.81 5 3 159591.61 959934 1 5.79 61 3 4.09 7 1 4.95 11 2 24.21 42
Table 1: Soft error profiles of ISCAS 89 circuits. NE = No Effect; CO = Combinational Only; SR = Sequential, Recovered; SN = Sequential, Not recovered
4 Experimental Results Approximately 1 million (L = 220 ) LFSR-generated test vectors were applied to the ISCAS 89 benchmark circuits. We considered 500 random soft error locations (and thus errors) per circuit (F = 500). (In a setting in which layout information is available, an analysis such as one described in [9] should be performed in order to determine the most likely soft error locations). A 1-cycle soft error was injected at each soft error location. The fault injection time was selected randomly between clock cycle 210 and 219 (i.e. in the first half of the sequence, which is done in order to have a well-defined boundary between classes SR and SN). We did not consider multiple transient faults, as the period between two transient fault occurrences is typically larger than one million clock cycles for CMOS ICs. We also did not consider combinations of transient and permanent faults. We used the Altera EP2S60F672C5ES FPGA with a 50 MHz clock frequency. This resulted in a run time of approximately 10 seconds for the measurement of one circuit (in which a total of some 500 million vectors are applied). The FPGA accommodated 24,176 Advanced Logic Modules (which roughly corresponds to 60,440 Look-Up Tables). The utilization of the FPGA was around 5% for the largest ISCAS 89 circuits. Table 1 contains the classification of F = 500 soft errors and their latency and recovery time characteristics. Columns 2 through 9 contain the absolute number and the percentage of the errors belonging to the classes NE, CO, SR and SN. Errors that never lead to a mismatch between the outputs of blocks DUTff and DUTinj were counted as NE (no effect). An error k was classified as CO (combinational only) if ITk = F Dk = LDk . All other errors were classified as SN (sequential, not recovered) if L − LDj < 64K, i.e. there was a mismatch within last 64K clock cycles, and as SR (sequential, recovered) otherwise. Note that since we restrict error injection to the first half of the sequence, an error that is still present in the last 64K cycles was not eliminated during over 450,000 cycles. It can be seen that most soft errors (from 55 to 93 per cent) actually have no effect on the circuit functionality. This is consistent with earlier findings: Wang et al. [10] report that 85% of injected transient faults are masked
from software. The results by Civera et al. [21] indicate that the average proportion of faults leading to a failure is 22.75% (18.2% if a hardened design for which no errors were observed is considered). Note that even those faults that do change the function of the circuit may lead to no system error (the analysis in [22] determined the probability for this to be between 6.06% and 26.0% over various processor architectures and benchmark applications). Most other faults are from classes CO and SR, i.e. the system recovers from these faults by itself. Only a few faults seem to remain in the system permanently (class SN). The rightmost six columns of Table 1 contain the minimal, average and maximal values of latency Lat and recovery time Rec among the faults. The latency is calculated for soft errors from classes CO, SR and SN while the recovery time only considers errors from class SR. This explains why maximal latency is sometimes higher than maximal recovery time: some of the errors from which the circuit does not recover need a significant number of cycles before they are exposed for the first time. For most, but not all circuits, both latency and recovery time are within a few cycles. A latency of several tens of thousands cycles means that the system state is corrupted for that many cycles without being noticed. This information is useful for making a design soft error-tolerant: for a circuit such as s13207, it must either be possible to undo tens of thousands of computation steps, or there must be an additional observation technique that monitors the state of the system (the values in the flip-flops). On the other hand, such a technique does not appear mandatory for a circuit like s01238. There are on-line BIST solutions that monitor the system continuously and those that check the system for some time and are turned off between such checks. Very short recovery times (such as in case of s05378) are an argument in favor of the former option, as the probability of a soft error to remain unnoticed is higher for such circuits. There is an unusually high maximal recovery time for s13207. From further analysis, we identified a fault that manifests itself once in every few hundred thousand cycles. Nevertheless, according to our definition it belongs to class SR, as it does not appear during the last 64K cycles.
5 Conclusions We presented a system for emulating soft errors in synchronous logic digital circuits. We eliminated the need to store the test vectors and expected responses on the FPGA or to upload them from the host through a slow communication channel. Consequently, it is the first method that can apply millions of vectors, which is required to treat and analyze soft errors in a realistic way. We are not aware of an earlier soft error emulation technique which targets faults in combinational logic. Using our methods, we generated soft error profiles of ISCAS 89 circuits. We classified the soft errors as either NE (no effect), CO (combinational effects only), SR (sequential effects, recovered) and SN (sequential effects, no recovery). This information can be use for making the circuit soft error-tolerant: errors from class SN could be considered most severe, and their locations would be targeted with high priority. We also calculated the aggregated latency (number of clock cycles between fault injection and its first manifestation) and recovery time and discussed the use of this information for soft error-tolerant design. The performed analysis with a million-vector test sequence would be impossible using existing software tools or emulators. Our pattern generator is currently an LFSR. An interesting question is how the soft error detection changes if a different pattern generator is used. One promising option would be Deterministic Logic BIST which embeds deterministic test vectors in a pseudo-random sequence [23]. While this scheme achieves very high coverage of permanent (stuck-at) faults at low hardware cost, its efficiency in detecting transient faults is currently unexplored. The proposed scheme can be instrumented to perform this experiment by simply reconfiguring block PRPG. Such a study can be used to select the optimal on-line BIST architecture for a given device. A further open question is whether pseudo-random vectors are exciting the device under test in the same way as do stimuli that are applied to it in its intended application. It is also possible to mimic the behavior of the DUT in application by implementing on FPGA (a subset of) the circuitry that drives the DUT in system instead of block PRPG. Comparing soft error profiles obtained by this architecture with those obtained by a PRPG, the validity of using pseudo-random vectors for studying soft error susceptibility could be established.
6 References [1] P.E. Dodd and L.W. Massengill. Basic mechanisms and modeling of single-event upset in digital microelectronics. IEEE Trans. on Nuclear Science, 50(3):583–602, 2003. [2] R. Baumann. Tutorial: Ghosts in the machine: A tutorial on single-event upsets in advanced commercial silicon technology. In Int’l Test Conf., 2004. [3] N. Seifert, X. Zhu, and L.W. Massengill. Impact of scaling on soft-error rates in commercial microprocessors. IEEE Trans. on Nuclear Science, 49(6):3100–3106, 2002. [4] H. Kobayashi, H. Usuki, K. Shiraishi, H. Hiroo Tsuchiya, N. Kawamoto, G. Merchant, and J. Kase. Comparison between neutron-induced system-SER and accelerated-SER
[5]
[6] [7] [8]
[9]
[10]
[11]
[12]
[13]
[14]
[15]
[16]
[17]
[18]
[19]
[20]
[21]
[22]
[23]
in SRAMs. In Int’l Reliability Physics Symp., pages 288– 293, 2004. P.D. Bradley and E. Normand. Single event upsets in implantable cardioverter defibrillators. IEEE Trans. on Nuclear Science, 45(6):2929–2940, 12 1998. E. Normand. Single-event effects in avionics. IEEE Trans. on Nuclear Science, 43(2):461–474, 4 1996. E. Normand. Single event upset at ground level. IEEE Trans. on Nuclear Science, 43(6):2742–2750, 12 1996. T.C. May and M.H. Woods. Alpha-particle-induced soft errors in dynamic memories. IEEE Trans. on Electron Devices, 26(1):2–9, 1 1979. K. Mohanram and N.A. Touba. Cost-effective approach for reducing soft error failure rate in logic circuits. In Int’l Test Conf., pages 893–901, 2003. N.J. Wang, J. Quek, T.M. Rafacz, and S.J. Patel. Characterizing the effects of transient faults on a high-performance processor pipeline. In Int’l Conf. on Dependable Systems and Networks, 2004. E. Dupont, M. Nicolaidis, and P. Rohr. Embedded robustness IP for transient-error-free ICs. IEEE Design & Test of Comp., 19(3):56–70, 5 2002. Y.S. Dhillon, A.U. Diril, A. Chatterjee, and A.D. Singh. Sizing CMOS circuits for increased transient error tolerance. In IEEE Int’l Online Testing Symposium, pages 11– 16, 2004. N. Cohen, T.S. Sriram, N. Leland, D. Moyer, S. Butler, and R. Flatley. Soft error considerations for deep-submicron CMOS circuit applications. In Int’l Electron Devices Meeting, pages 315–318, 1999. C. Metra, M. Favalli, and B. Ricco. Online detection of logic errors due to crosstalk, delay and transient faults. In Int’l Test Conf., pages 524–533, 1998. R.W. Wieler, Z. Zhang, and R.D. McLeod. Emulating static faults using a Xilinx based emulator. In Int’l Symp. on FPGAs for Custom Computing Machines, pages 110– 115, 1995. L. Burgun, F. Reblewski, G. Fenelon, J. Barbier, and O. Lepape. Serial fault simulation. In Design Automation Conf., pages 801–806, 1996. K.-T. Cheng, S.-Y. Huang, and W.-J. Dai. Fault emulation: A new methodology for fault grading. IEEE Trans. on CAD, 18(10):1487–1495, 10 1999. M. Garc´ıa-Valderas, C. L´opez-Ongil, M. Portela-Garc´ıa, and L. Entrena-Arrontes. Transient fault emulation of hardened circuits in FPGA platforms. In IEEE Int’l Online Testing Symposium, pages 109–114, 2004. P. Shivakumar, M. Kistler, W. Keckler, D. Burger, and L. Alvisi. Modeling the effect of technology trends on the soft error rate of combinational logic. In Int’l Conf. on Dependable Systems and Networks, pages 389–398, 2002. F. Lima, S. Rezgui, L. Carro, R. Velazco, and R. Reis. On the use of VHDL simulation and emulation to derive error rate. In RADECS, pages 253–260, 2001. P. Civera, L. Macchiarulo, M. Rebaudengo, M. Sonza Reorda, and M. Violante. An FPGA-based approach for speeding-up fault injection campaigns on safety-critical circuits. Jour. of Electronic Testing: Theory and Applications, 18(3):261–271, 2002. A. Benso, S. Di Carlo, G. Di Natale, and P. Prinetto. Static analysis of SEU effects on software applications. In Int’l Test Conf., pages 500–508, 2002. H.-J. Wunderlich and G. Kiefer. Bit-flipping BIST. In Int’l Conf. on CAD, pages 337–343, 1996.
