Fault-Tolerant Computing

Transcription

1 Fault-Tolerant Computing Dealing with Low-Level Impairments Slide

2 About This Presentation This presentation has been prepared for the graduate course ECE 57A (Fault-Tolerant Computing) by Behrooz Parhami, Professor of Electrical and Computer Engineering at University of California, Santa Barbara. The material contained herein can be used freely in classroom teaching or any other educational setting. Unauthorized uses are prohibited. Behrooz Parhami Edition Released Revised Revised First Slide

3 Slide 3

4 Slide 4

5 Multilevel Model Ideal Component Logic Information System Legend: Legned: Initial Entry Entry Deviation Last lecture Defective Faulty Erroneous Malfunctioning Today Low-Level Impaired Mid-Level Impaired Service Result Remedy Tolerance Degraded Failed High-Level Impaired Slide 5

6 Handling Faults Fault Disallow Tolerate Quality Assurance Testing Dynamic Redundancy Static Redundancy Prevent Remove Expose Mask Detect Miss Miss Detect Test Monitor Repair Discard Abandon Reconfigure Yes Full? No No Full? Yes Perfect Fixed Injured Screened Failed Failed-safe Degraded Restored Unaffected T y p e o f C o m p o n e n t o r S y s t e m Slide 6

7 Some Options for Fault Tolerance. Detect and replace Dynamic redundancy (cold/hot standby) Detection via -- coding, watchdog timer, self-checking -- duplication (pair-and-spares) Spare D Detector. Mask Static redundancy May revert to simplex instead of duplex Design challenges include -- synchronization for voting -- voting on imprecise results 3. Mask, diagnose, and reconfigure Hybrid redundancy Fault masked at output, but diagnosed -- e.g., via comparison with voter output Faulty circuit is replaced by spare Becomes static upon spare exhaustion Spare V 3 Voter S V 3 4 Switch-voter Slide 7

8 Comparing Fault Tolerance Schemes Advantages Less power (cold standby) Long life (just add spares) Drawbacks Coverage factor Tolerance latency Spare D Detector Immediate masking High safety Power/area penalty Voter critical 3 V Voter Immediate masking Power/area penalty Long life and high safety Switch-voter critical 3 S V Spare 4 Switch-voter Slide 8

9 Inherent in Logic Circuits a b c d e f h g 0 0 z 0 fault in b is critical 0 fault in c or d is not critical (it is masked) 0 fault in a or h is not critical (it is masked) Even nonredundant circuits have some masking capability Is there a way to exploit the inherent masking capabilities of logic gates to achieve fault tolerance? Slide 9

10 a b c d 0 a a b b a a b b a3 a4 b3 b4 a3 a4 b3 b4 Interwoven Redundant Logic e e e3 e4 f f f3 f4 e f h 0 g e e4 f f4 z Let x, x, x3, and x4 be 4 copies of the signal x 0 change is critical for AND, subcritical for OR 0 change is critical for OR, subcritical for AND Alternating layers of ANDs and ORs can mask each other s critical faults To mask h critical faults: Number of gates multiplied by (h + ) Gate inputs multiplied by h + For h =, the scheme is known as Quadded logic Slide 0

11 Interwoven Logic for Nanoelectronics Half-adder implemented in quadded logic a b s c a b s c IEEE D&T July-Aug. 005 pp From: Slide

12 Highly Reliable Logic with Crummy Relays Moore & Shannon, 956 a: prob [contact made energized] c: prob [contact made not energized] No matter how crummy the relays (i.e., how close the values of a and c), one can interconnect many of them in a redundant series-parallel structure to achieve arbitrarily high reliability Make contact (normally open) a > c x Break contact (normally closed) a < c y xy Slide

13 ? R = 3R m R m3 > R m TMR with Perfect Voter Condition on the module reliability: R = R m [ + ( R m )(R m )] ( R m )(R m ) > 0 R m > / R.0 TMR better.0 R TMR 3 V Voter 0.5 Simplex better 0.5 Simplex R m RIF TMR/Simplex = ( R m )/( R) = /[ R m (R m )] ln MTTF: TMR 5λ/6 Simplex λ λt Slide 3

14 ? R = R v (3R m R m3 ) > R m TMR with Imperfect Voter Condition on the voter reliability R v > / [3R m R m ] dr v min / dr m = ( 3 + 4R m )/(3R m R m ) 3 V Voter Condition on the module reliability 3 9 8/R v 4 < R m < /R v 4 Example: R v = 0.95 requires that 0.56 < R m < 0.94 R v 0.95 TMR better Simplex better R m Slide 4

15 TMR with Compensating Faults R m = p 0 p (0- and -fault probabilities) R = (3R m R m3 ) + 6p 0 p R m V Voter Example: R m = 0.998, p 0 = p = R = 0.999, ,006 = 0.999,990 Basic TMR Compensation RIF TMR/Simplex = 0.00 / 0.000,06 = 5 RIF Compen/TMR = 0.000,06 / 0.000,00 =.6 Slide 5

16 Implementing a Bit-Voter TMR bit-voting: y = x x x x 3 x 3 x (carry output of a single-bit full-adder) What about 5MR, 7MR? Gate-level design quickly explodes in size 3 x x x 3 V Bit-voter y Other designs are also possible Arithmetic: add the bits, compare to threshold Mux-based Selection-based (majority of bit values is their median) 3-out-of-5 voter built of -input gates Two mux-based designs for a 3-out-of-5 bit-voter Slide 6

17 Complexity of Different Bit-Voter Designs Cost of majority bit-voters as a function of the number n of inputs Slide 7

18 Voting at the Word Level Using bit-by-bit voting may be dangerous One might think that in this example, any of the module outputs could be correct, so that producing 0 at the output isn t all that wrong However, with bit-by-bit voting, the output may be different from all inputs x = 0 0 x = 0 x 3 = y = 0 x = x = 0 x 3 = 0 y = 0 0 Design of bit- and word-voting networks discussed in: Parhami, B., Voting Networks, IEEE TR, Aug. 99 Slide 8

19 Some Simple Voter Designs If in the case of 3-way disagreement any of the inputs can be chosen, then a simple design is possible x x Compare Disagree 0 y This design can be readily generalized to a larger number of inputs 3 x 3 One can perform pseudo voting that yields the median of 3 analog signals (Dennis, N.G., Microelectronics and Reliability, Aug. 974) Median and mean voting are also possible with digital signals Slide 9

20 Switch for Standby Redundancy Standby redundancy requires an n-to- switch to select the output of the currently active module The detectors use various info to deduce fault conditions -- Error coding -- Reasonableness checks -- Watchdog timer Once a fault has been detected, the switch reconfigures the system by flagging the faulty unit and activating next spare in sequence Spare Spares D D D 3 D Detector n-to- switch If we use an n-to- switch and compare the two selected outputs, the configuration is known as pair-and-spares Slide 0

21 Switch for Hybrid Redundancy Hybrid redundancy with n active and s spare modules requires an (n + s)-to-n switch to select the outputs of the active modules 3 S V Self-purging redundancy is a variant of hybrid redundancy in which all modules are active at the outset, but they are purged as they disagree with the majority output Spare 4 Switch-voter Voter in self-purging redundancy is a threshold voter that considers the inputs with weights of (active) or 0 (purged). Slide

22 Applications of nmr and Hybrid Redundancy The Space Shuttle: Uses 5-way redundancy in hardware Originally, 3 operational units and spares (one warm, one cold) More recently, 4 operational units and spare Additionally, uses two independently developed software systems Japanese Shinkansen Bullet Train Triple-duplex system (6-fold redundancy). Slide