A comparison of simulation based and scan chain implemented fault injection

Abstract

This paper compares two fault injection techniques: scan chain implemented fault injection (SCIFI), i.e. fault injection in a physical system using built in test logic, and fault injection in a VHDL software simulation model of a system. The fault injections were used to evaluate the error detection mechanisms included in the Thor RISC microprocessor, developed by Saab Ericsson Space AB. The Thor microprocessor uses several advanced error detection mechanisms including control flow checking, stack range checking and variable constraint checking. A newly developed tool called FIMBUL (Fault Injection and Monitoring using BUilt in Logic), which uses the Test Access Port (TAP) of the Thor CPU to do fault injection, is presented. The simulations were carried out using the MEFIS-TO-C tool and a highly detailed VHDL model of the Thor processor. The results show that the larger fault set available in the simulations caused only minor differences in the error detection distribution compared to SCIFI and that the overall error coverage was lower using SCIFI (90-94% vs. 94-96% using simulation based fault injection). Overview of the Thor processorThe Thor microprocessor is designed and sold by Saab Ericsson Space AB. It is a 32-bit RISC processor based on a stack-oriented instruction set architecture and is intended for embedded real-time applications with high dependability requirements. The Thor processor has onchip support for real-time processing specifically for the Ada language including task scheduling and dispatch, communication between tasks, time handling, accurate delays and fast interrupt handling. The support for dependability includes several internal error detection mechanisms and the possibility to run the processor in a pair configuration with a comparator function (master/slave comparator configuration).

Dependability evaluation of COTS microprocessors via on-chip debugging facilities

“…Comúnmente, los circuitos que se pretende evaluar (Device Under Tests o DUTs) se modelan mediante lenguajes HDLs y se prototipan en uno o más dispositivos de lógica programable (Field Programable Gate Arrays o FPGAs). Para inyectar fallos sobre el prototipo hardware es necesario construir recursos lógicos específicos dentro del circuito con fines de depuración, lo que permite reunir información sobre el funcionamiento del circuito en presencia de fallos, y evaluar el comportamiento de los mecanismos de tolerancia a fallos [8]- [10]. Otro enfoque lleva a cabo la inyección de fallos mediante el uso de las capacidades de reconfiguración de las FPGAs [11].…”

Contribución a la validación de sistemas complejos tolerantes a fallos en la fase de diseño. Nuevos modelos de fallos y técnicas de inyección de fallos.

“…Así, en la Universidad de Chalmers se ha desarrollado la herramienta FIMBUL (Fault Injection and Monitoring using BUilt in Logic) [Folkesson et al 1998]. A través del TAP (Test Access Port), es capaz de modificar el valor de los bits de los componentes internos del procesador para emular distintos tipos de fallos.…”

“…A través del TAP (Test Access Port), es capaz de modificar el valor de los bits de los componentes internos del procesador para emular distintos tipos de fallos. En [Folkesson et al 1998] se apuntaba que se podían inyectar fallos transitorios, y se esperaba poder inyectar fallos permanentes. La forma de inyectar se basa en establecer un punto de parada cuando se desea realizar una inyección y efectuar, cuando esto ocurra, la alteración de alguna unidad funcional del microprocesador.…”

“…La forma de inyectar se basa en establecer un punto de parada cuando se desea realizar una inyección y efectuar, cuando esto ocurra, la alteración de alguna unidad funcional del microprocesador. En [Folkesson et al 1998] se puede ver una comparación entre los resultados alcanzados con esta herramienta y MEFISTO-C (sobre un modelo en VHDL del mismo procesador). Se podría introducir la definición de un nuevo tipo de inyección, denominado "inyección de fallos mediante Scan-Chain" (Scan-Chain Implemented Fault Injection), o SCIFI.…”

Speeding-up model-based fault injection of deep-submicron CMOS fault models through dynamic and partially reconfigurable FPGAS

“…Several techniques and tools have been developed with this purpose: MESSALINE [12], RIFLE [15] and AFIT 1 [16] are representative tools of pin-level fault injection techniques; [17] describes the use of electromagnetic interferences for fault injection; heavy-ion radiation was used in [18] and by FIST [19]; FIMBUL [20] suggested the use of built-in scan-chains; finally, [21] proposed the use of a laser beam for fault injection. The required extra hardware usually increases the cost of applying HWIFI techniques and some of them may even damage or interfere with the system under test.…”