Single-event upsets (SEU) and single-event transients (SET) may lead to crashes or even silent data corruption (SDC) in microprocessors. Error detection and recovery features are employed to mitigate the impact of SEU and SET. However, these features add performance, area, power, and cost overheads. As a result, designers must concentrate their efforts on protecting the most sensitive areas of the processor. Simulated error injection was used to study the propagation of the SEU-induced soft errors in the latest AMD microprocessor module, Bulldozer. This paper presents the Bulldozer architecture, error injection methodology, and experimental results. Propagation of soft errors is quantified by derating factors. Error injection is performed both at the module and unit level, derating factors and simulation times being compared. Accuracy is assessed by deriving confidence intervals of the derating factors. The experiments point out the most sensitive units of the Bulldozer module, and allow efficient implementation of the error-handling features.

Nanocomputing and related-enabling technologies hold the promise of higher performance and lower power consumption, as well as increased communication capabilities and functionality. In addition to the impact on today computerized systems, nanocomputing is an essential lever to foster the emerging cyberphysical system paradigm. However, the dependability and security of these unprecedentedly small devices, of their deployment, and of their interconnection remain uncertain. The main sources of concern are: • Nanometer devices are expected to be highly sensitive to process variations. The guard-bands used today for avoiding the impact of such variations will not represent a feasible solution in the future. As a consequence, timing errors and their higher frequency of occurrence have to be addressed. • New and intricate failure modes, specific to new materials, are expected to raise serious challenges to the design and test engineers. • Environment induced errors, such as single event upsets (SEU), are likely to occur more frequently than in the case of more conventional semiconductor devices. • Design of hardware architectures encompassing resilience techniques are needed to achieve the development of highly reliable energy efficient systems. • The increased complexity of the systems based on nanotechnology will require improved computer aided design (CAD) tools, as well as better validation techniques. • The security of nanocomputing systems may be threatened by malicious attacks targeting new vulnerable areas in the hardware.

Nanocomputing technologies hold the promise for higher performance, lower power consumption as well as increased functionality. However, the dependability of these unprecedentedly small scale devices remains uncertain. The main sources of concern are: • Nanometer devices are expected to be highly sensitive to process variations. The guard-bands used today for avoiding the impact of such variations will not represent a feasible solution in the future. Thus, timing errors may occur more frequently. • New failure modes, specific to new materials, are expected to raise serious challenges to the design and test engineers. • Environment induced errors, like single event upsets (SEU), are likely to occur more frequently than in the case of conventional semiconductor devices. • New hardware redundancy techniques are needed to enable development of energy efficient systems. • The increased complexity of the systems based on nanotechnology will require improved computer aided design (CAD) tools, as well as better validation techniques. • Security of nanocomputing systems may be threatened by malicious attacks targeting new vulnerable areas in the hardware.

As already witnessed today, and as foreseen, concerns attached to hardware will play an increasing role in the design and assessment of dependable and secure computing systems.

There is still a strong demand for solutions to improve dependability and security. Issues at stake include threats ranging from managing complexity and manufacturing defects to accelerated aging and susceptibility to environment disturbances. These solutions extend beyond hardware, microelectronics or physics; major computing- related issues spanning various aspects are also essential: architecture, networks, communication, synchronization, task parallelization, etc. The workshop is aimed at further characterizing these impairments and threats, as well as distinguishing possible alternative design approaches and operation control paradigms that have to be enforced and/or favored in order to keep achieving dependable and secure computing. Finally, it is worth pointing out that besides design techniques aimed at providing dependable and secure computing, assessment techniques (risk evaluation, validation, testing, etc.) should also play a fundamental role! For all these reasons, we believe that DSN is an ideal forum to address all these issues and foster fruitful exchanges on a long term basis.

The higher complexity of the hardware and software employed by modern computing systems, as well as semiconductor technology scaling, are increasing the likelihood of Silent Data Corruption (SDC). SDC occurs when incorrect data is provided to the user, e.g., written to the memory or I/O system, and no error is triggered. Such events may have catastrophic effects, in the case of life critical applications, and represent a significant cost penalty for businesses. The purpose of this panel is to provide real examples of silent corruption, and discuss solutions for avoiding it. The presentations address SDC generated at the semiconductor device level, as well as the virtualization software level. Techniques for reducing SDC, from the circuit to system level, will be covered. Results of an extensive SDC study, carried out at Los Alamos National Laboratory (LANL) on high-performance computing (HPC) platforms are also given.

Hadrons generated by the primary cosmic rays penetrating the atmosphere have a negative impact on the reliability of semiconductor devices. The electrical charge induced by high energy particles manifests as a current spike and can affect both storage elements and combinational logic. Frequency of occurrence of the errors induced by this failure mechanism is referred to as soft error rate (SER). Continuous shrinking of the electronic devices and the lower supply voltages, in conjunction with the increased complexity of VLSI circuits, has led to higher SER. The impact of semiconductor technology scaling on neutron induced SER is discussed in this report. The experimental methodology and results of accelerated measurements carried out on Intel Itanium/spl reg/ microprocessors, at Los Alamos Neutron Science Center (LANSCE), are presented. Statistically significant values of the MTTF induced by high-energy neutrons are also derived, as a function of the number of upsets observed over the duration of the experiment. The presented approach doesn't require any proprietary data about the microprocessor under evaluation and, as a consequence, can be used as a dependability benchmarking tool both by manufacturers and independent evaluators.

The importance of benchmarking is increasing as every aspect of human life is relying on correct operation of computing systems. Although considerable efforts have been made, presently there are no widely accepted dependability benchmarks. The panelists, in the order shown above, address benchmarking of computer hardware, operating systems, applications, and systems.

High dependability has become a paramount requirement for computing systems, as they are increasingly used in business & life critical applications. Advances in the design & manufacturing of semiconductor devices have increased the performance of computing systems at a dazzling pace. However, smaller transistor dimensions, lower power voltages, and higher operating frequencies have negatively impacted dependability by increasing the probability of occurrence of transient & intermittent faults. This paper discusses the main trends in dependability of semiconductor devices, and presents a candidate architecture for a fault-tolerant microprocessor. Dependability of the processor is analyzed, and the advantages provided by fault tolerance are underscored. The effect of the higher rates of occurrence of the transient & intermittent faults on a typical microprocessor is evaluated with the aid of GSPN modeling. Dependability analysis shows that a five times increase of the rate of occurrence of the transients leads to about five time lower MTBF, if no error recovery mechanisms are employed. Significantly lower processor availability is also observed. The fault-tolerant processor is devised to mitigate the impact of the higher transient & intermittent fault rates. The processor is based on core redundancy & state checkpointing, and supports three levels of error recovery. First, recovery from a saved state (SSRC) is attempted. The second level consists of a retry (SSRR), and is activated when the first level of recovery fails. Processor reset, followed by reintegration under the operating system control (RB), is the third level of recovery. Dependability analysis, based on GSPN, shows that fault-tolerance features of the processor preserve the MTBF, even if the rate of the transient faults nearly doubles. In terms of availability, a four-time increase of the rate of occurrence of the transients is compensated. The effect of intermittent faults is also analyzed. A five-time increase of the failure rate of the intermittent faults may lower MTBF by 31% to 33%. MTBF decreases even more, by 45% to 67%, if bursts of errors are considered. Intermittent faults have a negative impact on availability as well. Maintaining the dependability of complex integrated circuits to the level available today is becoming a challenge as semiconductor integration continues at a fast pace. Fault avoidance techniques, mainly based on process technology & circuit design, will no be able to fully mitigate the impact of higher rates of occurrence of transient & intermittent faults. As a result, fault-tolerant features, specific to custom designed components today, ought to be employed by COTS circuits, in the future. Enhanced concurrent error detection & correction, self checking circuits, space & time redundancy, triplication, and voting all need to be integrated into semiconductor devices in general, and microprocessors in particular, in order to improve fault & error handling.

Effective error-detection is paramount for building highly dependable computing systems. A new methodology, based on physical and simulated fault injection, has been developed for assessing the effectiveness of error-detection mechanisms. This approach has 2 steps: (1) transient faults are physically injected at the IC pin level of a prototype, in order to derive the error-detection coverage. Experiments are carried out in a 3-dimensional space of events. Fault location, time of occurrence, and duration of the injected fault are the dimensions of this space. (2) Simulated fault-injection is performed to assess the effectiveness of new error-detection mechanisms, designed to improve the detection coverage. Complex circuitry, based on checking for protocol violations, is considered. A temporal model of the protocol checker is used, and transient faults are injected in signal traces captured from the prototype system. These traces are used as inputs of the simulation engine. s-confidence intervals of the error-detection coverage are derived, both for the initial design and the new detection mechanism. Physical fault-injection, carried out on a prototype server, proved that several signals were sensitive to transient faults and error-detection coverage was unacceptably low. Simulated fault injection shows that an error-detection mechanism, based on checking for protocol violations, can appreciably increase the detection coverage, especially for transient faults longer that 200 nanoseconds. Additional research is required for improving the error-detection of shorter transients. Fault injection experiments also show that error-detection coverage is a function of fault duration: the shorter the transient fault, the lower the coverage. As a consequence, injecting faults that have a unique, predefined duration, as it was frequently done in the past, does not provide accurate information on the effectiveness of the error-detection mechanisms. Injecting only permanent faults leads to unrealistically high estimates of the coverage. These experiments prove that combined physical and simulated fault injection, performed in a 3-dimensional space of events, is a superior approach, which allows the designers to accurately assess the efficacy of various candidate error-detection mechanisms without building expensive test circuits.

Advances in semiconductor technology have led to impressive performance gains of VLSI circuits, in general, and microprocessors, in particular. However, smaller transistor and interconnect dimensions, lower power voltages, and higher operating frequencies have contributed to increased rates of occurrence of transient and intermittent faults. We address the impact of deep submicron technology on permanent, transient and intermittent classes of faults, and discuss the main trends in circuit dependability. Two case studies exemplify this analysis. The first one deals with intermittent faults induced by manufacturing residuals. The second case study shows that transients generated by timing violations are capable of silently corrupting data. It is concluded that the semiconductor industry is approaching a new stage in the design and manufacturing of VLSI circuits. Fault-tolerance features, specific to custom designed computers, have to be integrated into commercial-off-the-shelf (COTS) VLSI systems in the future, in order to preserve data integrity and limit the impact of transient and intermittent faults.

Advances in semiconductor technology have improved the performance of integrated circuits, in general, and microprocessors, in particular, at a dazzling pace. Although, smaller transistor dimensions, lower power voltages and higher operating frequencies have significantly increased the circuit sensitivity to transient and intermittent faults. In this paper we present the architecture of a fault-tolerant processor and analyze its dependability with the aid of a generalized stochastic Petri net (GSPN) model. The effect of transient and intermittent faults is evaluated. It is concluded that fault tolerance mechanisms, usually employed by custom designed systems, have to be integrated into commercial-off-the-shelf (COTS) devices, in order to mitigate the impact of higher rates of occurrence of the transient and intermittent faults.

Intel Corporation developed the Teraflops supercomputer for the US Department of Energy (DOE) as part of the Accelerated Strategic Computing Initiative (ASCI). This is the most powerful computing machine available today, performing over two trillion floating point operations per second with the aid of more than 9,000 Intel processors. The Teraflops machine employs complex hardware and software fault/error handling mechanisms for complying with DOE's reliability requirements. This paper gives a brief description of the system architecture and presents the validation of the fault tolerance mechanisms. Physical fault injection at the IC pin level was used for validation purposes. An original approach was developed for assessing signal sensitivity to transient faults and the effectiveness of the fault/error handling mechanisms. Dependency between fault/error detection coverage and fault duration was also determined. Fault injection experiments unveiled several malfunctions at the hardware, firmware, and software levels. The supercomputer performed according to the DOE requirements after corrective actions were implemented. The fault injection approach presented in this paper can be used for validation of any fault-tolerant or highly available computing system.

Effective error detection is paramount for building highly dependable computing systems. A new methodology, based on physical and simulated fault injection, is developed for evaluating error detection mechanisms. Our approach consists of two steps. First, transient faults are physically injected at the IC pin level of a prototype server. Experiments are carried our in a three dimensional space of events, the location, time of occurrence and duration of the fault being randomly selected. Improved detection circuitry is devised for decreasing signal sensitivity to transients. Second, simulated fault injection is performed to asses the effectiveness of the new detection mechanisms, without using expensive silicon implementations. Physical fault injection experiments, carried out on the server, and simulated fault injection, performed on protocol checker, are presented. Detection effectiveness is measured by the error detection coverage, defined as the conditional probability that an error is detected given that an error occurs. Fault injection reveals that coverage probability is a function of fault duration. The protocol checker significantly improves error detection. Although, further research is required to increase detection coverage of the errors induced by short transient faults.

The hardware and software architecture of a fault-tolerant microcomputer for advanced control is presented. Use is made of performability as a performance and reliability measure. It is computed by means of the aggregation/decomposition technique with the aid of a numerical algorithm. An analysis is made of the influence of certain types of faults (i.e. permanent, intermittent, and transient) on the system performability. Different reward structures are compared and the effects of global and local repair actions are pointed out. An illustration is given of the influence of spare processing elements.>