Fault Injection into VHDL Models: Experimental Validation of a Fault Tolerant Microcomputer System D. Gil1, R. Martínez2, J. C. Baraza1, J. V. Busquets1, P. J. Gil1 1 Grupo de Sistemas Tolerantes a Fallos (GSTF) Departamento de Informática de Sistemas, y Computadores (DISCA) Universidad Politécnica de Valencia, Spain {dgil, jcbaraza, vbusque, pgil}@disca.upv.es 2 Instituto de Robótica, Universitat de València, Polígono la Coma s/n, E-46980, Paterna, Valencia, Spain
[email protected]
Abstract. This work presents a campaign of fault injection to validate the dependability of a fault tolerant microcomputer system. The system is duplex with cold stand-by sparing, parity detection and a watchdog timer. The faults have been injected on a chip-level VHDL model, using an injection tool designed with this purpose. We have carried out a set of injection experiments (with 3000 injections each), injecting transient and permanent faults of types stuck-at, open-line and indetermination on both the signals and variables of the system, running a workload. We have analysed the pathology of the propagated errors, measured their latency, and calculated both detection and recovery coverage. We have also studied the influence with the fault duration and fault distribution. For instance, system detection coverage (including non-effective faults) is 98% and the system recovery coverage is 95% for short transient faults (0.1 clock cycles).
1. Introduction The fault injection is a technique of Fault Tolerant Systems (FTSs) validation which is being increasingly consolidated and applied in a wide range of fields, and several automatic tools have been designed [1]. The fault injection technique is defined in the following way [2]: Fault injection is the validation technique of the Dependability of Fault Tolerant Systems which consists in the accomplishment of controlled experiments where the observation of the system’s behaviour in presence of faults is induced explicitly by the voluntary introduction (injection) of faults to the system. The fault injection in the hardware of a system can be implemented within three main techniques: 1. Physical fault injection: It is accomplished at physical level, disturbing the hardware with parameters of the environment (heavy ions radiation, electromagnetic interference, etc.) or modifying the value of the pins of the integrated circuits.
2. Software Implemented Fault injection (SWIFI): The objective of this technique, also called Fault Emulation, consists of reproducing at information level the errors that would have been produced upon occurring faults in the hardware. It is based on different practical types of injection, such as the modification of the memory data, or the mutation of the application software or the lowest service layers (at operating system level, for example). 3. Simulated fault injection: In this technique, the system under test is simulated in other computer system. The faults are induced altering the logical values during the simulation. This work is framed in the simulated fault injection, and concretely in the simulation of models based on the VHDL hardware description language. We have chosen this technique due fundamentally to: • The growing interest of the simulated injection techniques [3], [4], [5], [6], [7], [8] as a complement of the physical fault injection [9], [10], [11], [12], [13] (these have been traditionally more numerous and developed) and Fault Emulation (SWIFI) [14], [15], [16], [17], [18] experiments. The greatest advantage of this method over the previous ones is the Observability and Controllability of all the modelled components. The simulation can be accomplished in different abstraction levels. Another positive aspect of this technique is the possibility of carrying out the validation of the system during the design phase, before having the final product. • The good perspectives of modelling systems and faults with VHDL, that has been consolidated as a powerful standard to analyse and design computer systems [19]. This work follows the one carried out in the paper [20], where the study of the error syndrome of a simple microcomputer was presented, errors were classified and latencies were measured. To do that, we performed an injection campaign by means of a fault injection tool deployed for such a purpose [21]. In present work, we intend to perform the validation of a fault tolerant system. The VHDL model of the microcomputer used in the previous paper has been enhanced and we have added mechanisms for the detection and recovery of errors. Using our own fault injection tool, we have performed an injection campaign on the system and we have calculated the coverage and latencies on the detection and recovery of the produced errors. In section 2, we present the general structure and main characteristics of the fault injection tool. In section 3 we describe the computer system, based on a simple 16 bitmicroprocessor. In section 4, we describe the fault models used in the injection. In section 5 we set the conditions and parameters of the injection experiments: type of fault, place where to inject, injection instant, duration of the fault, place where the errors should be detected, etc. In section 6 we present the obtained results, basically concerning the coverage factors and the propagation latencies. Finally, in section 7 we explain some general conclusions and possible future lines of continuation of the work.
2.
The fault injection tool
We have developed an injection tool for automatic fault injection in VHDL models at gate-level, register-level and chip-level. The general structure of the injection tool is shown in the block diagram of Fig. 1. It is composed by a series of elements designed around a commercial VHDL simulator. A more comprehensive description of the tool and the aspects currently in progress can be seen in [22]. The main components of the tool are: Configuration file. Fault injection experiments are defined in a file using the following parameters: 1. 2. 3. 4. 5. 6. 7.
Experiment name. Total number of injected faults. Fault injection time instant. Fault duration (transient faults). Places (signals/variables) where faults are injected. Fault value. Output file: result.
Macro generator. This is a program that writes a file with calls to the macros that perform the injection. The parameters of the macros are defined in the configuration file so that they can vary from one experiment to another. The macros have been written by the command-language of the simulator. Simulator. It has been used the commercial VHDL simulator V-System/Windows by Model Technology [23] for IBM-PC (or compatible). It is a simple and easy to use event-driven simulator. When activated by the user, the simulator executes the file with macros and generates the output text file .lst for every injection. The .lst file contains the trace of the whole simulation. Data analyser. This program analyses the output file .lst for each injection, and compares it to the reference fault-free output file to provide the following information: type of the injected fault, type of error, latencies (propagation, detection, recovery) and coverage (detection, recovery) estimators. The results of the comparison are stored in the file result. VHDL component library. It is a set of VHDL models used to build or modify models of Fault-Tolerant Systems, to be able to validate them. It has the VHDL models at gate, register or chip level. System. It is a VHDL model to be studied/validated. The proposed tool deals with models at gate, register or chip level.
VHDL injectors library
Fig. 1. Fault injection tool for VHDL models.
VHDL injector library. This library comprises injector models in VHDL that can be added to the system model. These models allow the injection of new faults to make available a large set of fault types. They can be applied to signals, in structural architectures of the model (stuck-at, open line, indetermination, short, bridging, delay or bit-flip faults). They can also be applied at algorithmic level in behavioural architectures of the model, changing the syntactical structures of the VHDL code [24]. They are called respectively saboteurs and mutants in [25]. In short, the tool is easy to use and versatile, and it is appropriate to perform injection experiments in medium complexity systems.
$(; =
@AB AC
$ % &'# (
> ?
$(; =
% &'# ($
! "# "
1 2 3 1 ) 3 ) 1 * 3 * 41 4 ) 543 4 6& % 6 %
$ 7 8 9 :
