The AMD UltraScale+ XCZU9EG, a multiprocessor system-on-chip (MPSoC) with integrated programmable logic (PL), is vulnerable to the effects of atmospheric radiation due to its large SRAM count. This article explores the effectiveness of the MPSoC's embedded soft-error mitigation mechanisms through accelerated atmospheric-like neutron radiation testing and dependability analysis. We test the device on a broad range of workloads, such as multithreaded software for pose estimation and weather prediction and a software/hardware codesign image classification application running on the AMD deep-learning processing unit (DPU). We found that for a one-node MPSoC system in New York City at 40 k feet (e.g., avionics), software applications demonstrate a mean time to failure (MTTF) of over 121 months, evidencing effective upset recovery. However, specific workloads, such as the DPU, displayed an MTTF of 4 months, which is attributed to the high failure rate of its PL accelerator. Yet, we show the DPU's MTTF can be extended to 87 months with no extra overhead by ignoring the failure rate of tolerable errors since these do not affect the DPU results.

Approximate Computing (AC) is an emerging design paradigm that exploits the error-resiliency of specific applications to trade-off between accuracy, performance, area, and power. Nonetheless, fault tolerance remains an open issue in AC since hardware (HW) faults that are caused, for example, by radiation-induced effects, environmental disturbances, or aging/wear-out phenomena, can lead to an arithmetic error out of application specification boundaries. In this work, we guard approximate adders against HW faults by selectively inserting Hardware Fault Detection (HFD) redundancy, i.e., parity code/parity prediction or Double Modular Redundancy (DMR) into the Approximate Arithmetic Circuits (AACs). Specifically, we insert HFD only to the 1-bit adder cells of AACs that can cause an arithmetic error out of their specifications when corrupted by HW faults. Therefore, our proposed approach introduces less area and delay overheads than blindly duplicating the whole AAC. We employ our methodology to state-of-the-art approximate adder models (either low-latency approximate adder or approximate full adder models) to prove that our proposed technique inserts HFD into the AACs without negating their original approximation gains.

Microprocessor power consumption and dependability are both crucial challenges that designers have to cope with due to shrinking feature sizes and increasing transistor counts in a single chip. These two challenges are mutually destructive: microprocessor reliability deteriorates at lower supply voltages that save power. An important dependability metric for microprocessors is their radiation-induced soft error rate (SER). This work goes beyond state-of-the-art by assessing the trade-offs between voltage scaling and soft error rate (SER) on a microprocessor system executing workloads on real hardware and a full software stack setup. We analyze data from accelerated neutron radiation testing for nominal and reduced microprocessor operating voltages. We perform our experiments on a 64-bit Armv8 multicore microprocessor built on 28 nm process technology. We show that the SER of SRAM arrays can increase up to 40.4% when the device operates at reduced supply voltage levels. To put our findings into context, we also estimate the radiation-induced Failures in Time (FIT) rate of various workloads for all the studied voltage levels. Our results show that the total and the Silent Data Corruptions (SDC) FIT of the microprocessor operating at voltage-scaled conditions can be 6.6 × and 16 × larger than at the nominal voltage, respectively. Moreover, changes in the microprocessor’s clock frequency do not have a noticeable impact on its soft error susceptibility. The findings of this work can aid computer architects in striking a balance between power and dependability, thus, designing more robust and efficient microprocessors.

Approximate Computing Techniques (ACTs) take advantage of resilience computing applications to trade off among output precision, area, power, and performance. ACTs can lead to significant gains at affordable costs when efficiently implemented on Field Programmable Gate Array– (FPGA) based accelerators. Although several novel ACTs works have been proposed for FPGA accelerators, their applicability to high-assurance systems has not been explored as much. ACTs are becoming necessary in many critical Edge computing systems, such as self-driving cars and Earth observation satellites, to increase computational efficiency. However, an important question comes to mind when targeting critical systems: Does ACT optimization negatively affect the reliability of the system and how can one find optimal design architectures that blend classic mitigation techniques like Triple Modular Redundancy with approximation- and precise-based arithmetic hardware units to achieve the best possible computational efficiency without compromising dependability? This work aims to solve this research problem by introducing a Design Space Exploration (DSE) methodology that employs ACTs in arithmetic units of the design and identifies Pareto-optimal microarchitectures that balance all relevant gains of ACTs, such as area, speed, power, failure rate, and precision, by inserting the correct amount of approximation in the design. In a nutshell, our DSE methodology has formulated the DSE with a Multi-Objective Optimization Problem (MOP). Each Pareto-optimal solution of our tool finds which arithmetic units of the design to implement with precise and approximate circuits and which units to selectively triplicate to remove single points of failure that compromise system reliability below acceptable thresholds. We also suggest another formulation of the DSE into a Single-Objective constraint Optimization Problem (ScOP) producing a single optimal point, and that the user may demand, as a less time-consuming alternative to the MOP if a complete Pareto-front is not needed. Our methodology generates fault-tolerant versions of the Pareto-optimal approximate designs (or simple optimized approximate designs if the ScOP choice is picked) by selectively applying mitigation techniques in a way that the overheads of redundant resources for fault-tolerance do not negate the gains of approximation in comparison to the fault-tolerant versions of the precise design. We evaluate our method on two FPGA-based accelerators: a JPEG encoder and an H.264/Advanced Video Coding decoder. Our experimental results show significant gains in area, frequency, and power consumption without compromising output quality and system reliability compared to classic solutions that replicate all or a part of the resources of the precise design to increase dependability metrics.

Commercial SRAM-based field-programmable gate arrays (FPGAs) are becoming popular computing platforms for building efficient Neural Network (NN) accelerators for space missions. FPGAs can implement custom NN architectures that are tailored to the requirements of the mission to improve the performance-to-watt ratio of the design. However, SRAM FPGAs are vulnerable to radiation-induced Single Event Upsets (SEUs), imposing significant design-for-reliability challenges. In this work, we study the impact of hardware folding on the dependability of Binarised NN (BNN) FPGA accelerators. Hard-ware folding configures the level of resource sharing in the design. We implemented three design versions of a BNN that performs image classification. The BNNs were generated with FINN, an open-source framework for developing quantised NNs on AMD-Xilinx FPGAs. The BNNs were implemented on a Zynq-7020 system-on-chip FPGA and tested with configuration memory fault injection experiments to estimate their SEU vulnerability. The three BNN design versions have a maximum (Max), medium (Med), and minimum (Min) folding factor, respectively. Assuming a Low Earth Orbit (LEO), our results show that the Med BNN has the highest Mean Time Between Failure (MTBF) and the Min has the lowest MTBF. However, Min has the highest Mean Executions Between Failure (MEBF) due to its high computational performance.

This work presents an automated flow for producing fault-tolerant Field Programmable Gate Array (FPGA) systems. The flow uses the TLegUp High Level Synthesis (HLS) tool to generate triplicated register-transfer level designs for algorithms expressed in the C language and Vivado design suite for their implementation on Xilinx 7-series FPGAs. TLegUp has been extended to partition the design into a number of Triple Modular Redundant (TMR) components, which can be optionally floorplanned during their implementation. Partitioning the TMR design into a network of smaller TMR components and isolating their modules through flooplanning increases system reliability. We implemented a fine- and a coarse grain approach to partition the design, whereby the former approach uses a network flow algorithm to partition the application's Data Flow Graph (DFG) at the instruction level, while the latter uses the same algorithm to partition the design at the C function level. Results reveal that both approaches provide similar reliability enhancement to the system, but function-level partitioned designs are smaller and faster.

Space processing applications deployed on SRAM-based Field Programmable Gate Arrays (FPGAs) are vulnerable to radiation-induced Single Event Upsets (SEUs). Compared with the well-known SEU mitigation solution—Triple Modular Redundancy (TMR) with configuration memory scrubbing—TMR with module-based error recovery (MER) is notably more energy efficient and responsive in repairing soft-errors in the system. Unfortunately, TMR-MER systems also need to resort to scrubbing when errors occur between sub-components, such as in interconnection nets, which are not recovered by MER. This article addresses this problem by proposing a fine-grained module-based error recovery technique, which can localize and correct errors that classic MER fails to do without additional system hardware. We evaluate our proposal via fault-injection campaigns on three types of circuits implemented in Xilinx 7-Series devices. With respect to scrubbing, we observed reductions in the mean time to repair configuration memory errors of between 48.5% and 89.4%, while reductions in energy used recovering from configuration memory errors were estimated at between 77.4% and 96.1%. These improvements result in higher reliability for systems employing TMR with fine-grained reconfiguration than equivalent systems relying on scrubbing for configuration error recovery.

We present TLegUp, an extension of LegUp, that automatically generates Triple Modular Redundant designs for FPGAs from C programs. TLegUp is expected to improve the productivity of application designers for space, to allow designers to experiment with alternative application partitioning, voter insertion and fault-tolerant aware scheduling and binding algorithms, and to support the automatic insertion of the infrastructure needed to run a fault-tolerant system. In this paper, we examine TLegUp's capacity to make use of both combinational and sequential voters by triplicating a design before scheduling and binding occur. In contrast, traditional RTL-based tools are constrained to use only combinational voters so as to preserve the scheduling and binding of the design, critical path lengths are consequently increased. We compare the use of sequential and combinational voters for a range of benchmarks implemented on a Xilinx Virtex-6 FPGA in terms of: (i) maximum operating frequency, (ii) latency, (iii) execution time, and (iv) soft-error sensitivity. Compared to the use of combinational voters, the use of sequential voters reduces the application execution time on the CHStone benchmark suite by 4% on average.

FPGAs are promising candidates for computational tasks in space. However, they are susceptible to radiation-induced errors in their configuration memory. The recovery of configuration errors, either by device scrubbing or by module-based recovery, involves a series of reads and writes to the FPGA's configuration port, and is efficiently performed on-chip by a fast, flexible and reliable reconfiguration controller. In this work, we consider the reliability improvement of the recently proposed Programmable Configuration Controller (PCC), a soft reconfiguration controller that has been shown to be both fast and flexible, but whose reliability, particularly in the face of radiation-induced configuration errors, has not until now been studied. To ensure that the PCC itself is reliable, we propose the use of traditional Triple Modular Redundant (TMR) combined with a novel software-based interrupt-driven fault recovery process that leverages hardware-accelerated configuration access. We report on our design space exploration to balance the utilization, error recovery performance, and reliability of the PCC. In extremely harsh radiation environments, the Mean Time to Failure of the PCC is as high as 25 years, compared with 3.5 hours for its non-protected counterpart, and that it takes as little as 27 ms to recover from a configuration memory error affecting the PCC.

Field-Programmable Gate Arrays (FPGAs) provide ideal platforms for meeting the computational requirements of future space-based processing systems. However, FPGAs are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for dynamically reconfiguring corrupted modules of Triple Modular Redundant (TMR) components are well known. However, most of these techniques utilize resources that are themselves susceptible to SEUs to transfer reconfiguration requests from the TMR voters to a central reconfiguration controller. This paper evaluates the impact of these Reconfiguration Control Networks (RCNs) on the system's reliability and performance. We provide an overview of RCNs reported in the literature and compare them in terms of dependability, scalability and performance. We implemented our designs on a Xilinx Artix-7 FPGA to assess the resulting resource utilization and performance as well as to evaluate their soft error vulnerability using analytical techniques. We show that of the RCN topologies studied, an ICAP-based approach is the most reliable despite having the highest network latency. We also conclude that a module-based recovery approach is less reliable than scrubbing unless the RCN is triplicated and repaired when it suffers configuration memory errors.

High-reliability SRAM-based Field Programmable Gate Array (FPGA) designs that are deployed in space are commonly triplicated to mask Single Event Upsets (SEUs) and employ either scrubbing or modular reconfiguration to recover from radiation-induced configuration memory errors. Scrubbing benefits from vendor support and clears errors anywhere in the design but suffers from longer recovery times and higher energy use. Module-based error recovery is more energy efficient and responsive but repairs only corrupted TMR modules, leaving the supporting parts of the design such as pins or routing that are not included in the modules unrecovered. This paper proposes and assesses a hybrid technique we refer to as Frame- and Module-based Error Recovery (FMER) that uses modular reconfiguration to repair faulty TMR modules and otherwise scrubs the supporting parts of the design. We derive and compare the reliability, availability and power consumption of TMR-based System on Chip (SoC) designs that incorporate FMER, modular reconfiguration alone, blind scrubbing and no recovery. Our results reveal that FMER has the highest reliability and availability of the studied techniques in high radiation environments or when a mission's energy budget is limited.

FPGAs are promising candidates for computational tasks in space applications. However, they are susceptible to radiation-induced errors, the most common failure being due to the corruption of their configuration memory. Module-based partial reconfiguration and frame-based scrubbing are the two most commonly used techniques for detecting and recovering from configuration memory errors. Both methods require user-designed reconfiguration controllers (RC) to read and write FPGA configuration memory data. This paper proposes a Programmable Configuration Controller (PCC) specifically designed for fault-tolerant applications. PCC has a soft Application Specific Instruction Set Processor (ASIP) architecture. The PCC is software programmable using the C language, which allows it to be used in a wide variety of fault-tolerant applications with minimal design and/or hardware overhead. PCC also has instruction extensions to accelerate commonly-used reconfiguration operations such as reading and writing configuration data. Through 5 case studies, we demonstrate that the use of an ASIP architecture for reconfiguration control in applications prone to radiation-induced corruption strikes the right balance between speed, resource utilization and flexibility.

SRAM-based Field-Programmable Gate Arrays (FPGAs) are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for partially reconfiguring corrupted modules of Triple Modular Redundant (TMR) FPGA-based designs have been described in the literature. Most of these techniques require some form of network-on-chip for aggregating voter error messages from the system's TMR components to a central reconfiguration controller in order to trigger the partial reconfiguration of modules when they become faulty. The frequency at which TMR components fail in the system depends on their soft-error vulnerability. However, most error recovery techniques adopt a static voter error checking schedule, which leads to delays in checking TMR components with high failure probability. In this paper we propose a Voter Scheduling Engine (VSE) for dynamically prioritizing and managing TMR voter checks so as to minimize the error detection time in the system and to thereby maximize the system's reliability. Software and hardware implementations of the VSE are proposed. Moreover, we have implemented the classic static voter checking schedule and the VSE on a real TMR system and evaluated the reliabilities of both approaches for varying radiation environments. Results demonstrate that the likelihood of system failure can be decreased by up to 50% when the VSE, rather than static voter checking, is incorporated into the TMR system.

Space processing applications deployed on SRAM-based Field Programmable Gate Arrays (FPGAs) are vulnerable to radiation-induced Single Event Upsets (SEUs). Compared with the well-known SEU mitigation solution - Triple Modular Redundancy (TMR) with configuration memory scrubbing - TMR with module-based error recovery (MER) is notably more energy efficient and responsive in repairing soft-errors in the system. Unfortunately, TMR-MER systems also need to resort to scrubbing when errors occur in sub-components, such as nets, which are not recovered by MER. This paper addresses this problem by proposing a fine-grained module-based error recovery technique that without additional system hardware can localize and correct errors that classic MER fails to do. We evaluate our proposal via a fault-injection campaign on a Xilinx Artix-7 application circuit and compare the reliability, the error correction latency and the energy cost of repairing errors, of our proposal with those of a conventional MER approach and with periodic and on-demand blind scrubbing. We find the reliability of our proposal to be the highest and the energy expenditure to be the lowest amongst those methods considered.

Today's SRAM-based FPGAs provide a reach set of computing resources which makes them attractive in demanding and critical application domains, such as avionics and space. Unfortunately, their high reliance on SRAM configuration memory arise reliability issues due to the single-event upsets (SEUs). Considering the criticality of these applications, the vulnerability analysis of FPGA designs to SEUs becomes essential part of the design flow. In this context, we present an open-source framework for the soft error vulnerability analysis of Xilinx FPGA devices. The proposed framework will allow researchers to evaluate their reliability-aware CAD algorithms and estimate the soft error susceptibility of the designs at early stages of the implementation flow for the latest Xilinx architectures.