Using Built-in Sensors to Cope with Long Duration Transient Faults in Future Technologies

Transcription

1 Using Built-in Sensors to Cope with Long Duration Transient Faults in Future Technologies Lisboa, C. A. 1, Kastensmidt, F. L. 1, Henes Neto, E. 2, Wirth, G. 3, Carro, L. 1 {calisboa, fglima}@inf.ufrgs.br, egas-henes@uergs.edu.br, {wirth, carro}@inf.ufrgs.br 1 Instituto de Informática, PPGC, Universidade Federal do Rio Grande do Sul 2 Engenharia de Sistemas Digitais, Universidade Estadual do Rio Grande do Sul 3 Departamento de Engenharia Elétrica, PPGEE, Universidade Federal do Rio Grande do Sul Abstract Transients spanning more than one clock cycle will challenge soft error tolerant designs for future technologies. To face this problem, a low overhead technique that uses bulk built-in current sensors and recomputation is proposed here. 1. Introduction Reliability and fault tolerance of digital systems has been a matter of concern since the very beginning of the computer era [1]. In recent years, the weaknesses that will be introduced by the use of future technologies, more prone to transient faults caused by radiation, called Single Event Transients (SETs), became a major topic of discussion and research. The well-established SET fault model [2] is based on a single particle hitting a sensitive node in silicon, and generating a transient pulse. If the particle s linear energy transfer (LET) is enough to generate charge above the critical charge of the node, the SET is able to switch the logical state of the node, and the erroneous value can be propagated to the logic output and reach a memory element. If this happens during the latching window of the memory element, this incorrect information can be stored, resulting in a Single Event Upset (SEU), which is considered a Soft Error, because the upset memory element remains operational and able to store new information. A SET can be masked, either logically, electrically or by a latching window, in which case it generates no error at all. However, in case the SET is not masked, a proper detection and mitigation technique must be applied in the design, to ensure SET tolerant operation. Most of currently used SET tolerance techniques rely on the assumption that the duration of a transient pulse due to radiation is shorter than the clock cycle of the combinational circuit to be hardened. However, devices with nanometric dimensions, and frequencies in the gigahertz range, bring along higher densities (smaller distances between neighbor devices) and shorter cycle times (faster signal propagation), which influence the SET effect on the design. The first significant influence is the generation of multiple SETs in a nearby design region. Due to the higher densities, the distances between junctions are decreasing, and a single particle hit may affect adjacent drain junctions, provoking a multiple transient fault. Also, in case those nodes belong to different logic gates, two output values may be affected [3]. The second and probably most important impact of SETs in future technologies regards SET pulse duration in respect to the operation frequency of the circuit. Since, for bulk devices, the transient pulse duration does not scale in the same proportion of the propagation delay in new technologies [4], the shorter cycle time provided by faster devices will lead to a completely new situation not presently studied: transient pulses lasting longer than one clock cycle. While in the past it was sufficient to analyze whether or not SETs not logically or electrically masked would be captured by a memory element within its latching window, at the end of a given cycle, in this new scenario there is a high probability that a SET will be continuously captured during more than one clock cycle. Therefore, conventional time redundancy techniques are not able to cope with this type of SET, and the trivial alternative of using full hardware redundancy is usually too expensive for commercial devices in the industry. Long transient pulse duration in respect to the clock frequency, and the possibility of neighbor nodes being simultaneously affected, point both to the need for new paradigms in the design of fault tolerant systems for future technologies. In this work, a new approach for SET detection and error correction for future technologies is proposed. It is based on the use of embedded sensors able to detect the silicon ionization, and consequently the SET, in a very early stage of occurrence, which allows warning a detection and recovery system to perform the recomputation. This paper is organized as follows. In section 2, the two facts highlighted in the introduction are detailed and related work is discussed. In section 3, the use of bulk built-in current sensors (bulk-bics), as a system level solution to cope with transient faults in this new scenario, is proposed. In section 4, an example of application of bulk-bics to harden adder circuits is presented and analyzed. Section 5 summarizes the conclusions and points to future works. Paper 24.3 INTERNATIONAL TEST CONFERENCE /07/$ IEEE

2 2. New design challenges In this section, related work that exposes the need for innovative design solutions for SET mitigation in future technologies is commented, and the reasons why some of the current mitigation techniques will soon be obsolete are discussed Multiple simultaneous faults The concern about multiple faults stems from the increased possibility of more than one transient fault occurring at the same time, due to a single particle hitting the silicon. In such case, secondary particles can be emitted in several directions, eventually affecting two different nodes of a circuit, as shown in Figure 1 [3]. While the hypothesis of multiple simultaneous faults has been neglected for a long time, in 2002 an industry report [5] warned that it should no longer be negligible for technologies of 0.13 µm and beyond. This conclusion, alone, has strong negative impact on many current mitigation techniques based on the single fault hypothesis such as the classic triple modular redundancy [6] Long duration transients In parallel with multiple faults, another issue arises, which has not yet been widely discussed: cycle times in future technologies will become shorter than the duration of some transient pulses caused by radiation. To the best of our knowledge, the first work in which the transient scaling across several different technologies was correlated with the cycle time was [7]. Departing from a study about the propagation of transients in four different technologies presented in [8], [7] has shown that in future technologies, such as the 32 nm node, one can predict that even particles with modest LET values will produce transients lasting longer than the predicted cycle time of circuits. In the study about the production and propagation of SETs in high-speed logic presented in [8], the variation of the transient pulse width according to the technology was predicted using four different technology nodes, and the results for bulk technologies are shown in Figure 2. Figure 1. One particle, multiple effects, from [3] Moreover, after experimentally confirming that two simultaneous upsets affecting adjacent nodes can occur, [3] has shown that the occurrence of bi-directional errors, i.e., two simultaneous complementary bit flips will be possible, precluding the use of error detection codes designed to detect only unidirectional simultaneous errors. More recently, [4] presented a detailed study on the charge collection mechanisms in SOI and bulk devices exposed to heavy radiation, using different technologies, from 0.25 µm to 70 nm. For bulk devices, the analysis in [4] shows that the shape and duration of transient pulses present significant variations, depending on the fabrication details, on the technology itself, and on the location in the device that was hit by the particle. Moreover, the comparison of the behavior of the same device exposed to different radiation sources has shown that some particles do not have enough LET to induce SEUs or SETs by direct ionization. However, those particles generate secondary ones, with much higher LETs, that can be emitted in all directions. Once again, the hypothesis of multiple transients generated by a single particle hit has been confirmed. Figure 2. Transient pulse width scaling across technologies, from [8] Besides the expected fact that the pulse width increases with the linear energy transfer (LET) of the particle, this plot unveils another important information: for low energy particles, the transient pulse width is almost the same for all four technologies included in the study. As the energy of the particle increases, the pulse width varies from a maximum of 948 ps for the 0.25 µm technology, to 694 ps for the 0.1 µm technology, for particles with a LET of 70 MeV-cm 2 /mg. The ratio between those values is 1.37 times, while the inverter delay ratio between both technologies is approximately 6 times [7]. This data clearly shows that the delay scaling is much more aggressive than that of the pulse duration causing a SET, and hence most likely a transient fault could last for longer than a clock cycle, as it will be shown shortly. In parallel with [8], the work in [9] presented a study of the width of transient pulses propagating in digital circuits for the 0.25 µm and 0.18 µm technology nodes, dealing with the effects of heavy ions in the space environment. The goal of that work was to determine the Paper 24.3 INTERNATIONAL TEST CONFERENCE 2

3 approximate actual width of these single event transients, but in the analysis of the results of their experiments, the authors commented that the SET pulse widths are approximately the same at both technology nodes, and that when the width of a transient becomes larger than the period of the clock frequency that the circuit is running at, then every induced transient will be latched. However, they did not propose a solution to the problem. In order to compare the scaling of the transient widths exposed in Table 1 with that of the cycle time of circuits across technologies, we have measured the propagation delay for different inverter chains in four different technologies. The number of inverters in each chain, as well as the measured propagation delay in each technology, are shown in Table 2. The measurements have been done using the HSPICE tool [10]. The parameters for all the technologies were obtained from the Predictive Model Technology Web site [11]. Table 2. Propagation delay scaling across technologies (ps) Technology (nm) inverter chain inverter chain inverter chain inverter chain Figure 3. Transient pulse width scaling across technologies, from [4] More recently, in [4], the width of the propagating transient voltage for bulk and SOI devices, in different technologies, using a chain of ten inverters, was measured through simulation, with similar results, as shown in Figure 3. This work analyzed only three technology nodes, and also did not correlate their results with the scaling of cycle times, nor explored the consequences of that finding. For the data in Figure 2 (from [8]), the pulse width was measured at the struck node, while the data in Figure 3 (from [4]) shows the pulse width at the output of the inverter chain, considering the effect of electrical masking. In Figure 3 the arrows indicate the threshold LET for each technology. Particles with lower LET do not generate transients able to propagate through the whole chain of inverters, and therefore were not plotted (note, also, the logarithmic scales). Selected transient width values have been manually extracted from Figures 2 and 3, and gathered in Table 1, which shows the predicted transient widths for the 180 nm, 130 nm, and 100nm technologies studied in [8] and for the 70 nm technology studied in [4], for particles with LET of 10 and 20 MeV-cm 2 /mg, respectively. Table 1. Predicted transient widths across technologies (ps) x LET Technology (nm) 180 (1) 130 (1) 100 (1) 70 (2) 10 MeV-cm 2 /mg MeV-cm 2 /mg (1) from [8] (2) from [4] The results in Table 2 show that the propagation delay decreases approximately 3.2 times from the 0.18 µm to the 0.13 µm technology, and from 5 to 6.4 times, depending on the length of the inverters chain, between the 0.18 µm and the 32 nm technologies. These ratios are much higher than those predicted for the scaling of transient pulse widths across technologies in [4, 8], summarized before, that increase only 1.37 times. In contrast with the monotonic behavior of cycle times scaling, the predicted pulse width behavior, for the maximum energy particles considered in the studies in [8] and [4], show an erratic behavior in both works. The reasons for this unexpected behavior are out of the scope of this paper, and are discussed in the referenced papers nm 10 70nm ( ) MeV-cm 2 /mg Figure 4. Cycle time x transient pulse scaling with technology In Figure 4, the predicted transient pulse widths for different technologies, shown in Table 1, have been combined with the line graphic showing the reduction of the cycle times across technologies. The two leftmost vertical bars show the predicted pulse width for particles Paper 24.3 INTERNATIONAL TEST CONFERENCE 3

4 with LET up to 20 MeV-cm 2 /mg, for the 0.18 µm and 0.13 µm technologies. The duration of transients due to particles with up 20 MeV-cm 2 /mg LET, used in Figure 4, is enough to demonstrate our point in future technologies, transients will last longer than the expected clock cycles; however, as one can see from Figures 2 and 3, even longer transients can occur for higher energy particles. The third and fourth vertical bars correspond to the 0.1 µm and 70 nm technologies, for which we do not have the measured cycle times. The position of those two bars in the graphic have been interpolated, considering that the LET scaling from 0.13 µm to 32 nm in the graphic is approximately linear. The predicted transient widths for 10 MeV-cm 2 /mg particles are also marked in the bars. The conclusions drawn from Figure 4 apply to bulk devices only, and are also implicit in [4], when the authors state that, for SOI devices, device scaling clearly induces a decrease of both the collected charge and the transient width distributions, while if we consider bulk devices, there is no obvious scaling trend. The fact that the scaling ratio of the pulse width between technologies is much smaller than the speed-up ratio between technology generations points to a new paradigm to be considered in the design of fault tolerant systems for future technologies: transient pulses spanning across more than one clock cycle of the circuits Limitations of current techniques Traditional SET mitigation techniques are based either on hardware redundancy or time redundancy. The most well-know hardware redundancy technique is TMR [6], shown in Figure 5(a), that can detect and mitigate SETs of any pulse duration as there are always two redundant logic blocks that are fault free, because it assumes that only a single fault will occur and that the voter circuit is fault tolerant. However, this technique is very expensive in terms of area and its cost for commercial circuits may be prohibitive. Duplication with comparison can be used to detect SET faults, Figure 5(b). As there is a fault free redundant block used as golden design, this method can also detect SETs of any pulse duration. In order to tolerate the SET is necessary to combine the hardware redundancy (duplication) with some time redundancy, which in this case can be recomputation. Once a SET is detected, it is necessary a detection and recovery system to recompute the data and discard the data processed in the presence of SET. But then again, the duplication of the hardware implies a 100% area overhead, which can still be very expensive for commercial designs. In the protection of processor-like circuits using hardware and time redundancy arena, there is the solution proposed in [12], which uses a fault free checker to repeat the operations executed in the datapath of a pipelined processor. In case of any discrepancies the checker sends its result to the commit stage of the pipeline as the correct one. This solution brings severe overheads both in performance and area. And it presents a big challenge on developing a fault free checker. Another approach, targeting SoCs and proposing the use of an infrastructure IP to check the execution of selected instructions of a given core processor, was presented in [13]. Besides being non-intrusive, from the architecture of the core processor standpoint, it allows the selection of instructions to be hardened at design time, thereby reducing the area overhead when compared to [12]. However, it still implies non negligible area and performance overheads. Long pulse majority voter (a) Triple Modular Redundancy (TMR) Scheme Long pulse = Detection and recovery system (b) Concurrent Error Detection and Recovery Scheme based on duplication Long pulse delay δ +δ = error Detection and recovery system (c) Time Redundancy with Recovery Scheme based on delay Figure 5. SET Mitigation Techniques Aiming to reduce the area overhead imposed by hardware redundancy, time redundancy based on double sampling with time delays has been proposed in the past to detect SETs, Figure 5(c). This technique has been largely used for SETs with short pulse duration error Paper 24.3 INTERNATIONAL TEST CONFERENCE 4

5 compared to the clock cycle. Examples of such method are the solutions proposed by [14] and [15]. Nevertheless, both techniques are based on the hypothesis that the SET pulse durations are a small percentage of the clock cycle. Consequently, both use time delays to capture the outputs of the circuit to be protected in different moments, and compare them to check for errors. However, this technique can no longer be considered in future technologies, since the SET pulse durations have the same size of the clock cycles, or even longer. In this case, there is no suitable delay (δ) to be used (Figure 5(c)), because if the transient width is wider than the delay, the circuit will loose its immunity. Another group of SET mitigation techniques includes those based on transistor resizing and partial gate duplication. The technique proposed in [16] uses hardware redundancy to harden the critical path of combinational circuits in order to cope with SET caused faults. All gates in the critical path are duplicated and the outputs are compared to detect errors. While this solution has lower area overhead than similar ones that propose duplication of the whole circuit, it will not be able to cope with transients spanning across multiple clock cycles, because under the long pulse duration assumption, all paths will be critical, and even by duplicating some critical nodes, long duration transient pulses can still propagate to the output. With all these aspects in mind, new low cost solutions must be found to cope with these long duration pulses. In the work presented here, we propose the use of sensors to detect the SET occurrence instead of hardware duplication, and the use of a recovery system to perform the recomputation once SETs are detected. The use of sensors embedded in the digital logic allows the detection of SET with short and long pulse duration, with a low area overhead and fast response, as it is presented in the next section. 3. The proposed technique: bulk built-in current sensors (bulk-bics) with recovery system When a SET occurs in a logic circuit, it may eventually appear at the input of the flip-flops placed at the combinational logic outputs, if the induced transient pulse is neither logically nor electrically masked by the logic inputs nor masked by the latch or flip-flop window. Logical masking occurs when the input stimuli are holding controlled values in the logical path in such way that the SET can not be propagated to the outputs [2]. Electrical masking occurs if the pulse is attenuated as it propagates through the logic chain and fades out before it reaches the registered output [2]. If a SET is neither logically nor electrically masked, it is interpreted as a valid signal at the register input, and it can be captured by a memory element according to the latching window (usually based on the setup and hold times of the memory element). Once a SET is captured, a wrong value will be stored in the register, provoking a soft error. For a long enough pulse duration, if the SET is not logically masked, this SET will appear at the memory element input, and it will not be masked by the latching window. In addition, the effect of this SET can remain for many clock cycles. Consequently, it is mandatory to be able to detect the SET occurrence in very early stages, to avoid the propagation of the error to many parts of the design. As soon as the SET is detected, the affected data can be discarded, and when the SET vanishes the data must be recomputed. The challenge then is to detect the SET in very early stage of occurrence. For that, the ideal scenario is to have a sensor placed on the logic circuit fabric that is able to detect any occurrence of a SET. The entire logic is divided in sub-parts and sensors are placed on these peaces of logic to detect the location of the SET. Once a SET is detected, a recovery circuit, such as the ones currently used to recompute instructions in microprocessors in the occurrence of a branch misprediction, is turned on, asking for recomputation. The recomputation consists in discarding the data processed during the clock cycles in which the SET was present, and to execute the operation again, this time free of SETs. Figure 6 shows the proposed technique in a datapath scheme, where there are a set of combinational logic blocks and registers. The sensors can detect SETs either in the combinational or sequential circuits. Long pulse sensors sensors Detection and recovery system Figure 6. Proposed Recovery Technique based on sensors A built-in current sensor (BICS) with some design modifications is proposed to work as a SET sensor. The use of BICS connected to the power lines as a means to detect faults has already been discussed in [17, 18], and proven to be a solution with less penalties than, e.g., error correcting codes. The problem is that the BICSs found in the literature are connected at the circuit power lines for detecting faults that manifest themselves as a variation in the power supply currents (quiescent current - I ddq ). They are efficient for permanent fault detection, such as manufacturing faults and displacement damage faults. But, as it was discussed here, SET does not necessarily modify the quiescent current, but only the silicon substrate current generated by the ionization. The use of BICS connected directly to the bulk of transistors instead of the power lines [19] has presented a Paper 24.3 INTERNATIONAL TEST CONFERENCE 5

6 tremendous advance in the use of this type of current sensors to detect transient faults as well. In this work, we extend the use of the bulk-bics presented in [19] for long pulse duration SETs detection and correction, since we present the BICS working in tandem with a recovery mechanism. We will show that there is a response time tradeoff concerning the number of monitored transistors, and a case study circuit operating at different frequencies is evaluated. The area overhead of all sensors is estimated based on the required time response Bulk-BICS operation When an energetic particle strikes a sensitive position in a CMOS circuit, it generates a current that flows between the drain of the transistor and the bulk. The current arises from the discharge of the node capacitance and from the current conducted by the transistor in the on-state. The direction of the current depends on whether the particle is discharging or charging the logic node [20]. The peak current induced by an energetic particle strike is more intense at the drain-bulk junction than at the connection to the power lines. During normal circuit operation the current flowing between a reverse biased drain junction and bulk is negligible, if compared to the current peak induced by an energetic particle hit. Consequently, it is more efficient to think about a BICS connected to the bulk of a circuit, instead of connecting it to the power lines of a circuit. The bulk-bics analyzes the current that appears at the bulk terminal. During normal operation, the current in the bulk is approximately zero. Only the leakage current flows through the biased junction, which is still very low compared to the current generated by energetic particles. So, when an energetic particle generates a current in the bulk, it is very clear to the bulk-bics that a SET has happened. The bulk-bics has a reset mechanism that allows SET detection as long as it takes to dissipate the transitory energy pulse. The reset signal must be activated by the recomputation system, through the RST and NOT RST lines of figure 7. The transistors connected to those lines complement the value stored in the latch of the bulk-bics. Since the bulk-bics circuit is in the transient detected state, it is reset to the normal state when those signals are received. The schematics of the N-BICS and P-BICS with reset capability are shown in Figure 7. V DD RST RST V DD Bulk (Gnd ) RST output N-BICS Bulk-BICS gnd Bulk (V DD ) output P-BICS V DD α particles, protons, heavy ions Bulk-BICS ionization Figure 7. Sample bulk-bics with reset capability RST This bulk-bics approach for SET detection is conservative, since it detects all SETs that might cause a soft error, whether masked (logically, electrically or by a latching window) or not. Nevertheless, one should ponder that, for future technologies, the probability of SET masking will be drastically reduced, and the bulk- BICS will not often overestimate the ionization. The bulk-bics can be calibrated at design time to detect only a range of transient current pulses that can cause a logic transition at the struck node. In this work, we assume that every time a SET occurs, even if it is a false positive, recomputation must be carried out in order to provide a correct result. Figure 8 depicts the connection of the bulk-bics to the body ties. The circuit itself connects to the power lines at the transistor sources, like every standard CMOS circuit, but the body ties are connected to V DD (n-well case) or to ground (p-well case) through the bulk-bics. Paper 24.3 INTERNATIONAL TEST CONFERENCE 6

7 SET was first detected, and the operation that was being executed when the SET was first detected happened is recomputed. Faulty cycles Figure 8. Connection of a body tie to ground through the bulk BICS (p-well case) 3.2. Dealing with long duration transients As shown in the previous sections, the shorter clock cycles provided by future technologies will lead to situations in which the duration of the transient pulses due to radiation will be longer than the clock cycle of the circuits. In order to cope with such scenario, we propose the use of bulk built-in current sensors with reset capability to detect the occurrence of SETs and allow the recovery of the system from the faulty state. Since there is no previous knowledge about the duration of transients nor about the exact time when they hit a given node, we propose the use of a mechanism that is able to start recomputation only after the SET has vanished. The operation of this proposed mechanism is shown in the diagram in Figure 9, with a positive SET (from zero to one value) in which a transient spanning two cycles is detected, and is described as follows: 1. When a SET makes the voltage of the output node of a logic gate change by more than V DD /2, it is detected by the bulk-bics, which activates one of the bulk-bics outputs. 2. At the beginning of the next cycle, the SET detection is recognized, the recomputation mechanism activates the recomputing state, and saves the previous status of the circuit for use when the SET has vanished. 3. At the same time, the bulk-bics outputs are reset, to allow the detection of new SETs (or to detect if the SET is still present, as in the case depicted here). 4. Since the SET is still present, the bulk-bics output is activated once again, to keep the system in the recomputing state. 5. At the next cycle start, since bulk-bics output is still active, the recomputation mechanism keeps the recomputing state active. 6. The bulk-bics outputs are reset once again. Since the transient has vanished, now those outputs remain off. 7. At the next cycle start, since no SET is present and the recomputing state is still active, the recomputation mechanism exits this state, restores the status of the circuit to the one saved when the SET BICS Vdd/2 recomputing_state * reset_bics Saves state for recomputation (*) Remains in this state while SET is present Starts recomputation Figure 9. Long duration transients mitigation mechanism As implied in the diagram shown in Figure 9, the time required by the bulk-bics to react in the presence of a SET (denoted by the two parallel vertical lines in the BICS output representation) is crucial to the proper functioning of the detection and recovery procedures. This response time, however, is dependent on the number of gates that are connected to a given bulk-bics and on the bulk resistance [19]. Also, the response time is also dependent on the actual recovery mechanism. Therefore, the tuning of the response time, by adjusting the number of gates protected by each bulk-bics, or by the restrictions on the recovery mechanism, is one of the steps that must be considered in the design, as will be shown in the next sections. 4. Application of the proposed technique The purpose of this section is to analyze the bulk- BICS response time and area overhead for circuits operating at different frequencies, where the response time needed in the bulk-bics is distinct in each case. This required response time affects the area overhead of the protected circuit. Also, another factor that affects the bulk-bics response time and area overhead is the characteristic of the SET. As it will be shown, the bulk- BICS responds faster to SETs with high amplitude and long pulse duration. However, the sensor must be calibrated for a large range of SET duration detection (from low charge and fast transients to highly charged SETs). These tradeoffs are discussed in this section. As an example of application of the technique proposed in this work to a practical case, we have Paper 24.3 INTERNATIONAL TEST CONFERENCE 7

8 selected an adder circuit for a case study, since this type of circuit is present in datapaths of all current processors, and its proper and fast operation is critical to the overall performance of the processor. The simulations have been done for the 32 nm technology, using parameters obtained from the Predictive Model Technology Web site [11], and the HSPICE tool [10] The adder circuit We have used the 4-bit carry look ahead adder module shown in Figure 10 as a building block for three different adders, for 8, 16 and 32 bits. published in the referenced works, it can be seen, by comparing the cycle times in Table 3 with the graphs in Figures 2 and 3, that the existence of transients lasting more than on cycle of those adders must be considered. Table 3 also shows the number of transistors required for each adder and the corresponding area. The area overhead figures shown later are based on these data The bulk-bics implementation The transistors of the bulk-bics scheme presented in Figure 7 were dimensioned to detect a large range of SET shapes and charges. Table 4 presents the dimensions for each one of them and the final area of each BICS. Note that both bulk-bics, the one used to be connected to the PMOS transistors and the one used to be connected to the NMOS transistors, occupy the same silicon area. Table 4. Bulk-BICS transistors dimensions and total area N-BICS P-BICS Transistor L (µm) W (µm) L (µm) W (µm) Area (µm 2 ) Fault tolerance analysis Figure bit carry look-ahead adder module used to build the three adders used in the work In each adder, two, four or eight of those 4-bit adder modules have been serially connected to obtain the desired data width. The three adders have been simulated and the corresponding cycle times determined, as shown in Table 3, in order to compare the predicted times with the duration of transients estimated in Section 2. Table 3. Characteristics of the adders Maximum Cycle # of Frequency Time transistors Adder Width area (µm 2 ) 8 bits GHz 175 ps bits Ghz 350 ps bits Ghz 700 ps 1, While the predicted transient duration for the 32 nm technology has not yet been neither measured nor The capability of the bulk-bics to timely detect a SET is a very important parameter to be considered in the analysis of the solution proposed here. In order to check this, we have simulated the injection of faults with several different characteristics and tested the response time of the bulk-bics in each case. The charge deposition mechanism has been modeled by a double exponential current pulse at the particle strike site, as proposed in [21]: I P (t) = I 0 (e -t / τ α - e -t / τ β ) (1) where I 0 is approximately the maximum charge collection current, τ α is the collection time constant of the junction and τ β is the time constant for initially establishing the ion track. In order to simulate transients with different durations, varying from 0.3 to 2 times the simulated cycle time for the circuit (T), the parameters in expression (1) must be adjusted. For each of the three adders, transients with five different durations, in terms Paper 24.3 INTERNATIONAL TEST CONFERENCE 8

9 of fractions of the corresponding cycle time, have been injected. The values of the parameters used in each of the 15 experiments are shown in Table 5. Table 5. Simulated transient parameters and area overhead for a bulk-bics response time = 0.5 T Case Adder τ α (ps) I 0 (µa) Duration % Area Overhead bits T T T T T bits T T T T T bits T T T T T = cycle time of the adder T 2.1 τ β = 5 ps for all cases The last column of Table 5 indicates the area overhead that the bulk-bics imposes, which varies according to the amount of transistors that are connected to a single bulk-bics. Each transistor bulk connected to the bulk-bics increases the bulk capacitance node, in other words, the capacitance node connected to the transistor number 10 of the N-BICS and P-BICS. The larger this capacitance is, the slower is the bulk-bics detection response. In our experiments we assumed that a time response less or equal to 50% of the clock cycle (T/2) is necessary to allow the use of a recovery mechanism based on recomputation. As a consequence, for an 8-bit adder operating at GHz, the bulk-bics must present a time response not larger than 87.5 ps, while for a 32-bit adder operating at GZ, the maximum bulk-bics response can be 350 ps. This means that, for high speed circuits, there are several constraints to be met to achieve a fast bulk-bics time response, a large range of SET detection, and a minimum area overhead. Note that the area overhead decreases with the increase of the transient pulse duration. When a SET has a high collected charge, the current generated at the bulk node is more intense, which turns on the bulk-bics output faster. This phenomenon happens in all the studied circuits. From Table 5, one can observe that there is a tradeoff between the number of transistors that can be connected to each bulk-bics and the response time needed for a given application. The worst-case simulated scenario, in terms of area overhead (47%), is for the 8-bit adder operating at GHz, with bulk-bics calibrated for detection of SETs with small pulse durations, such as 30% of the clock cycle (0.3 T). Still, this overhead is significantly smaller than that required by the duplication technique, which is more than 100%. However, one could still say that this overhead of 47% is not a desirable result, and one should have an option with a less expensive solution. It is important to notice that one of the most important factors that guide the area overhead is the target time response from the BICS. A low overhead solution could come from the recovery architecture itself. For example, the detection and recovery system can deal with slower response times from the bulk-bics if the machine is able to store its status for more than one cycle, allowing the status from several clock cycles ago to be restored once it gets the bulk-bics warning. If the circuit is not being clocked at its highest possible frequency, one could easily decrease the area overhead of the bulk-bics at the price of its sensibility. As an example, for the presented case, if the bulk-bics used to protect the 8-bit adder (F max = GHz, T cycle = 175 ps) instead of having a response time of 87.5 ps, had a cycle time of 350 ps, which corresponds to 2 times the clock cycle (2.0 T), the required area overhead to detect SETs with the duration of 0.3 T (52.5 ps) would be 13.4%. As it can be seen from the comparison between Tables 5 and 6, significant reductions in the area overhead are also achieved for the other hypothesis of transient pulse duration used in our experiments. This considerable reduction in the area overhead is obtained without reduction in the SET detection efficiency. Table 6. Area overhead for bulk-bics response time = 2T (8-bit adder only) Case Adder τ α (ps) I 0 (µa) Duration % Area Overhead bits T T T T T 2.6 T = cycle time of the adder τ β = 5 ps for all cases 5. Conclusions and future work This work has explored a new paradigm that must be considered in the design of circuits tolerant to transient faults to be manufactured with future technologies: the occurrence of transient pulses with duration longer than Paper 24.3 INTERNATIONAL TEST CONFERENCE 9

10 the cycle time of the circuits, that may affect more than one bit of the circuit output, thereby making obsolete most of the currently known mitigation techniques. The use of bulk-bics as sensors to detect SETs, combined to the recomputing capability of a system, has been shown as an efficient fault tolerant method to meet this new paradigm in future technologies. Results have shown that this approach leads to an area overhead varying from 50% to 2.1%, and the bulk-bics does not affect the normal operating frequency of the system. Moreover, one can trade the area taken by the sensors for the recomputation depth, thus making the final overhead a design decision that can be established a priori. The development of automated tools that, given the specifications of a target circuit, are able to determine the ideal balance between design constraints in order to achieve a fast bulk-bics time response, a large range of SET detection, and a minimum area overhead, is one of the major projects included in our future works schedule. 6. References [1] J. Neumann. Probabilistic Logic and the Synthesys of Reliable Organisms from Unreliable Components. In: Shannon, C. E. and McCarthy, J. (Eds.) Automata Studies. Princeton, N.J.: Princeton University Press, p [2] S. E. Diehl, J. E. Vinson, B. D. Shafer, and T. M. Mnich, Considerations for single event immune VLSI logic, IEEE Transactions on Nuclear Sciences, Vol 30, No 6, IEEE Computer Society, Los Alamitos, CA, December 1983, pp [3] D. Rossi, M. Omaña, F. Toma, and C. Metra, Multiple Transient Faults in Logic: An Issue for Next Generation ICs?, Proceedings 20 th IEEE Int. Symposium on Defect and Fault Tolerance in VLSI Systems, 2005, pp [4] V. Ferlet-Cavrois et all., Statistical Analysis of the Charge Collected in SOI and Bulk Devices Under Heavy Ion and Proton Irradiation - Implications for Digital SETs, IEEE Tr. on Nuclear Science, Vol 53, No 6, Part 1, IEEE Computer Society, Los Alamitos, CA, December 2006, pp [5] T. Heijmen, Radiation Induced Soft Errors in Digital Circuits: A Literature Survey. Philips Electronics Natl. Lab., Netherlands, Report 2002/828, August, [6] B. W. Johnson, Design and Analysis of Fault Tolerant Digital Systems: Solutions Manual, Addison-Wesley Publishing Company, Reading, MA, October [7] C. A. Lisboa, M. I. Erigson, and L. Carro, System Level Approaches for Mitigation of Long Duration Transient Faults in Future Technologies, Proceedings 12 th IEEE European Test Symposium, 2007, pp [8] P. E. Dodd et al., Production and propagation of Single-Event Transients in High-Speed Digital Logic ICs, IEEE Transactions on Nuclear Science, Vol 51, No 6, Part 2, IEEE Computer Society, Los Alamitos, CA, December 2004, pp [9] M. J. Gadlage, R. D. Schrimpf, J. M. Benedetto, P. H. Eaton, D. G. Mavis, M. Sibley, K. Avery, and T. L. Turflinger Single Event Transient Pulsewidths in Digital Microcircuits, IEEE Tr. on Nuc. Sci., Vol 51, No 6, Part 2, IEEE Computer Society, Los Alamitos, CA, December 2004, pp [10] Synopsis web site, last visited in November 2006: ice/hspice.html [11] Predictive Technology Model Web site: eas.asu.edu/~ptm, last visited in November 14, [12] T. Austin, DIVA: A Reliable Substrate for Deep Submicron Microarchitecture Design, Proceedings of the 32 nd ACM/IEEE Int. Symposium on Microarchitecture (MICRO32), 1999, pages [13] C. A. L. Lisboa, L. Carro, M. Sonza Reorda, and M. Violante, Online Hardening of Programs against SEUs and SETs, Proceedings 21st IEEE Int. Symposium on Defect and Fault Tolerance in VLSI Systems (DFT 2006), 2006, pp [14] L. Anghel, C. Lazzari, and M. Nicolaidis, Multiple Defects Tolerant Devices for Unreliable Future Technologies, Proceedings 7 th IEEE Latin- American Test Workshop, 2006, pp [15] S. Mitra, N. Seifert, M. Zhang, Q. Shi, and K. S. Kim, Robust system design with built-in soft-error resilience, Computer, Vol 38, No 2, pp , [16] A. Nieuwland, S. Jasarevic, and G. Jerin, Combinational Logic Soft Error Analysis and Protection, Proceedings 12 th IEEE Int. On-Line Test Symposium, 2006, pp [17] J. C. Lo, Analysis of a BICS-only Concurrent Error Detection Method, IEEE Transactions on Computers, Vol 51, No 3, IEEE Computer Society, Los Alamitos, CA, March 2002, pp [18] B. Gill, M. Nicolaidis, F. Wolff, C. Papachristou, and S. Garverick, An Efficient BICS Design for SEUs Detection and Correction in Semiconductor Memories. Proceedings Design Automation and Test in Europe (DATE), [19] E. Henes Neto et al., Using Bulk Built-in Current Sensors to Detect Soft Errors, IEEE Micro, Vol 26, No 5, IEEE Computer Society, New York, NY, September/October 2006, pp [20] P. E. Dodd, and L. W. Massengill, Basic Mechanism and Modeling of Single-Event Upset in Digital Microelectronics, IEEE Tr. on Nuclear Science, Vol 50, No 3, Part 3, IEEE Computer Society, Los Alamitos, CA, June 2003, pp [21] Messenger, G. C. Collection of Charge on Junction Nodes from Ion Tracks, IEEE Transactions on Nuclear Sciences, vol. NS-29, IEEE Computer Society, Los Alamitos, CA, 1982, pp Paper 24.3 INTERNATIONAL TEST CONFERENCE 10