FTUNSHADES A design analysis tool based on Emulation
FT-UNSHADES A design analysis tool based on Emulation Technologies ESA-ESTEC/17540 University of Sevilla-AICIA-ESA
Summary Fault Injection in general What is FT-UNSHADES? What is not FT-UNSHADES? Main features Models for design analysis ◦ Cycle accurate ◦ Smart table FT-UNSHADES for FPGA analysis What can FT-UNSHADES do for you? Using FT-UNSHADES Accessing to FTUNSHADES 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
Fault Injection in general Certain Radiation Effects over digital circuits mainly affect to the stored information in Registers and Memories. These radiation effects are: ◦ Single Event Upset (one register is attacked) ◦ Single Event Transient (Due to propagation, one or several registers are attacked) ◦ Multi Bit Upsets (Several registers simultaneously due to Layout adjacence) These effects corrupt temporally the information processed by the silicon design. The corruption of the information due to these effects is because 0 changes into 1 or viceversa. This model is named bit-flip. FAULT INJECTION means reproduce the bit-flip in a dynamic execution of the circuit in order to analyze its behavior FAULT INJECTION needs two mechanisms: ◦ A platform that executes the circuit ◦ A method for producing a bit-flip in time. 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
Using Run-Time reconfiguration for FAULT INJECTION The execution is made using an SRAM-FPGA from Xilinx Implemented design The injection is performed using the configuration circuit The injection is made modifying either the REGISTER CONTENTS or THE CONFIGURATION CIRCUIT Modify the design behavior Configuration memory Configured elements Modify the register content Injection over user registers 11/09/2009 Injection over Config memory FPGA workshop. ESA/ESTEC, Noordwijk
What is FTUNSHADES? A Fault Injection system based on the concepts related to hardware debugging: observability and controlability*. The method is non intrusive. The design is analyzed with little modifications. Deterministic procedure of bit-flip insertion. The design is analyzed using a stimuli set or application (workload) Analysis of a design reliability attacking register, memory elements or configuration bits. The results are analyzed form design behavior point of view. A hardware accelerator allows to speed up the analysis. (This is the meaning of emulation, instead of simulation) Massive injection campaign and detailed analysis of * in this context observability means accessing to internal the registers, at every clock cycle. the design are performed in values the ofsame platform. Controlability is the possibility of perturbing the circuit at any time of the workload. FPGA workshop. ESA/ESTEC, 11/09/2009 Noordwijk
What is not FTUNSHADES? It is not a tool for technological analysis. The effects are not treated as physical phenomena. It is not exactly a tool for FPGA implementation analysis (but maybe…) It is not a system for setting up FTUNSHADES is a tool for reliability analysis(but over a logic experiments inside a beam description of a design, so it is technology independent. maybe. . . ) 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
Main features A design is treated using the Xilinx standard tools. The design flow can preserve the confidentiality of the design. The analysis is made by means of a time -location model: ◦ Time is a clock cycle of the application ◦ Location is the user register (DFF, or bit of memory or SRL 16) where the bit flip will be inserted. The register selection is based on the hierarchical tree, allowing selective injection. 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
How it works. . . INPUT VECTORS (APPLICATION) DESIGN OUTPUTS The starting point is a traditional simulation scheme over the structural netlist of the design. Input vectors are stored and inserted in a database. They will form the so called “workload” The design is converted to a fully equivalent netlist in a Xilinx technology. This step is extremely critical As an RTL equivalent netlist the consequences of the injections over the Xilinx netlist can be assumed in the original design FPGA workshop. ESA/ESTEC, WORKLOAD DESIGN 11/09/2009 Noordwijk
Standard model DESIGN Gold WORKLOAD Comparator DESIGN Faulty Emulator (FPGA) Comparator System Clock Workload inputs 11/09/2009 The model is similar to a system in an accelerator. Two identical instances of the design are implemented The inputs are stored in external memories and the outputs are compared between both instances The clock is the same. Both instances work in parallel The injection is always to the same instance. The other works for comparison. The register selection is made using a demapping information provided by Xilinx Time variable is also controlled Deterministic attack using the design hierarchical organization FPGA workshop. ESA/ESTEC, Noordwijk
Smart Table Model SMART CONTROLLER Software REFEREN CE TABLE The model is dedicated to microprocessor analysis. Outputs are stored in a memory: The table Inputs are stored in external memories Comparison are Comparator made using the table as a reference The injection is on the microprocessor netlist. Software Faulty redundancy techniques would recover the system Emulator (FPGA) using clock cycles The recovering is made using several extra instructions and the comparison is made using some recovery time. The clock accurate comparison would be FPGA workshop. ESA/ESTEC, relaxed using the 11/09/2009 Noordwijk smart controller μPROC Comparator System Clock Workload inputs
FT-UNSHADES Structure of the system User Commands (Scripts) VCD format Session. log INPUT VECTOR DATABASE BITSTREAM TNT Excel Sheet Console BIT ALLOCATION 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
FT-UNSHADES Analysis Example CLOCK: 133937 REGISTER: leon 0_mcore 0_proc 0_cx. c 0_icache 0_r. waddress_16 DAMAGE DETECTED: YES Error Detected LATENCY: 1 CLK After one clock cycle PORT: address Fault Inj. CLK A step by step analysis can be done, dump the data in VCD format and visualize the fault evolution with a waveform viewer 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
FPGA analysis DESIGN Gold Comparator WORKLOAD This model Studies the behavior of the FPGA and the design under radiation The objective is to evaluate reliability of the design already implemented on a particular family of FPGA The results, for being considered valid, must comply several conditions: ◦ ◦ DESIGN !! Faulty DATABASE OF CRITICAL POINTS Comparator Star-Rora alliance System Clock Workload inputs TNT ◦ The FPGA has to belong to the same family than the target The design is firmly fixed in his place and route The attack points are constrained to a restricted area. An static analysis has to be performed previous to the dynamic analysis in order FPGA to define the database of critical configuration points. Again, the design and its workload refines this database, classifying the points as critical or not critical form dynamic point of view There is a strong dependence between Workload and the result of 11/09/2009 FPGA workshop. ESA/ESTEC, this refinement. Noordwijk
What can FT-UNSHADES do for you? 1. 2. 3. 4. 5. 6. FTUNSHADES will deeply analyze your modular protections using a fully deterministic fault injection method. FTUNSHADES can optimize the redundancy insertion in your design. This can save area and power consumption. FTUNSHADES can analyze reset net and initialization strategy FTUNSHADES can provide an idea of the covering of the workload. The workload can be refined for further implementation in the acceleration test setup FTUNSHADES can evaluate the strategy of redundancy in the software of an embedded processor and optimize the balance performance/area&consumption FTUNSHADES allows the evaluation of the hardening of the place and route of a Xilinx FPGA. 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
Relevant features Combine fault injection campaigns with detailed analysis Provide internal view of hierarchical module criticality Provide the possibility of analyzing the criticality considering application time A tool for optimizing the overhead of a mitigated design. Preserve confidentiality of design Experiences contrasted in Spanish National Accelerators Centre 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
Experiences. . . Designs tested: Leon, Leon 2 and Leon 3 Micro. Blaze 8051 Cordic 18 x 18 Pico. Blaze RENASER Rad. Test device Other ESA benchmarks. . . Publications: TNS: 4, TIE: 1, TIME: 1. . Projects: RENASER, EMULASER, CELPAE, FTUNSHADES 2, . . . 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
Accessing to FTUNSHADES is managed by the Rad. Us team that belongs to the Electronic Engineering Group of the University of Sevilla The FTUNSHADES system is be offered to customers through an agreement with a company named AICIA The accessing framework is a service. The system can be accessed also remotely. Design secret is granted by ◦ ◦ ◦ NDA Training in the company Transfer of preparation tools Remote access or on site access if agreed Technical support 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
Contacts http: //walle. us. es/ftunshade s aguirre@gte. esi. us. es AICIA +3494487367 University of Sevilla Camino de los Descubriumientos s/n ! 41092 Sevilla (SPAIN) 2011 to Hope ECS D A R u in o y E E S 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
SS 1. Special Session on Ionizing Radiation Effects on Digital Devices for Safety Critical Industrial Applications Contacts: aguirre@gte. esi. us. es and luca. sterpone@polito. it http: //www. isie 2010. it/specialsessions/approved-special-sections 11/09/2009 FPGA workshop. ESA/ESTEC, Noordwijk
- Slides: 19