Proceedings of esign, Automation and Test in Europe, (ATE'), France, March -8, A Fast Johnson-Mobius Encoding Scheme for Fault Secure inary Counters K. Papadomanolakis, A. Kakarountas, N. Sklavos and C.E. Goutis. Electrical and Computer Engineering epartment University of Patras, Patras, GREECE Abstract In this paper a novel encoding architectural scheme for high performance Fault-Secure synchronous binary s that are relies on the Johnson Mobius coding scheme, is introduced. This is based on the Parity prediction technique and it can detect any single fault, transient or permanent, in real-time. A thorough analysis of the s architecture and its behavior at the occurrence of any single fault on the circuit to ensure the Fault-Secure property of the, is presented. Also a comparison of this technique against other dominating fault secure implementations is presented in terms of area overhead, power dissipation and performance. The deviated results show the benefits that can be derived from the use of this scheme.. Introduction In the most recent years a continuously increasing need for on-line testability in the digital electronic circuits has been developed. Several techniques that improve the reliability of digital systems have been developed in order to detect errors on line. Generally, the design of highly reliable and safe systems leads to the use of additional hardware and/or software overhead (safety mechanisms). The required safety level for the target application determines the needed overhead. This safety level imposes the use of safety mechanisms that can offer error detection up to a certain level during the system s operation. Conventional technology employs double or multichannelled architectures (e.g. two microcontrollers) which continuously compare their data, in order to detect faults in a system. This solution, although high efficiently in error detection, leads to high demands in hardware and power. New design methods for on-line error detection are based on the use of coding techniques to obtain redundant information able to detect transient and permanent faults in a significantly lower cost [,,,,5]. These methods have created the class of self-checking circuits and systems. Self-checking design is based on the implementation of functional blocks, which deliver outputs belonging to an error detecting code. A checker is used to monitor this code, which performs error detection concurrent with the normal circuit operation [6]. This checker has the ability to give an error indication even when a fault occurs on the checker itself. Since it is relatively uncommon for multiple faults in a circuit to occur at the same time instant, the basic requirement of a self-checking circuit is to detect any single fault in the circuit before any second one occurs. In this way the Totally Self-Checking (TSC) property is ensured []. Most recently researchers have been drawn to the conclusion that parity prediction techniques are the most appropriate techniques for handling arithmetic operators [] since they require little area overhead in comparison to the most efficient but complex and area costing arithmetic residue codes (such as erger, CRC and n-outof-m codes). The design of highly reliable and safety systems leads to the use of additional Power dissipation that has become a critical VLSI design concern in recent years. The wide spread of portable and wireless communication systems increase the demand for the extension of the battery life. Portable systems are usually met in medical applications where they are used for continuously providing certain services to patients. The basic requirement of the portable medical equipment industry is the demand for highly safe operation (fail-safe systems []), in order to prevent any harm to the patient due to the system failures (according to the IN VE standards [9]), while keeping the power dissipated low and satisfying the real-time system constraints. One of the most commonly found components in this kind of applications is the counting unit, either in the form of a timer or as a state machine. The basic property that a counting unit must have is high performance. Fast s are components of great importance in safety critical applications because of the time critical aspect of these systems operation. The basic properties that a fast must have are most carefully summarized in []. These are in short: i) a high counting rate, preferably independent of the size, ii) a binary output that
Proceedings of esign, Automation and Test in Europe, (ATE'), France, March -8, can be read on-the-fly, iii) a sampling rate equal to the counting rate, and iv) a regular implementation suitable for VLSI. As stated in [8] an especially simple implementation for the design of a fault-secure binary is the synchronous implementation, made of T FFs. However, the synchronous operation of such a makes reading the value difficult (because the whole has to be stable) and reduces the counting rate, especially for large s. In this paper an implementation of a faultsecure binary based on the Johnson-Mobius [7] encoding scheme that complies to the desired properties referenced above, is presented. In the following paragraphs, this is examined in comparison to the simple Fault-Secure Parity-Prediction binary [8] and to the conventional approach (double ). The area, power and performance measurements for this implementation as well as its effectiveness in fault detection are determined. Prior to examining the FS binary presented, a simple reference to the Fault- Secure theory is presented.. Fundamental theory on Fault -Secure circuits Self-checking circuits are used to ensure concurrent error detection for on-line testing by means of hardware redundancy. This kind of circuits can detect the presence of both transient and permanent faults. All these circuits aim at the so-called totally self-checking goal; i.e. the first erroneous output of the functional block provokes an error indication on the checker outputs. To achieve this goal checkers have been defined to be TSC [6,] and they have to be combined with TSC or Strongly Fault Secure (SFS) functional circuits. The terminology of the safety properties of a circuit is following, in order to provide the ability to understand terms as the ones above. A circuit G is called fault-secure (FS) with respect to a fault set F if, for each f F, when the circuit never produces an incorrect output codeword for any input codeword. The above two properties, the self-testing and the fault-secure, when combined in a circuit, characterize it as totally self-checking (TSC). The meaning of the codeword is strongly related with the code-disjoint property, which will be defined later on. The Fault Secure circuits (FS) are parts of a greater group called Self Checking circuits (SC). A Self -Checking circuit is consisted of a functional unit, which produces encoded output vectors plus a checker unit, which checks these vectors to determine if an error has occurred. This checker also has the ability to produce an error indication even if a fault has occurred in the checker itself. y the term fault we imply an abstract view for all classifiable defects of the hardware, e.g. stuck-at, stuckopen and stuck-on faults. On the other hand errors are defined as the erroneous pattern shown at the output of the circuit in the presence of physical abnormality. All the SC circuits and checkers have been defined theoretically as follows[]:. A circuit is called Fault-Secure with respect to a fault set F, if and only if for every single fault and for all code word inputs the circuit will never produce an incorrect code word output.. A circuit is called Self-Testing with respect to a fault set F, if and only if each fault in F can be detected by at least one code word input.. A circuit is called Totally Self-Checking if it satisfies both and definitions. As a conclusion we can determine if a circuit is fault secure if its output code detects all errors generated by each modeled fault A circuit G is called strongly fault-secure (SFS), with respect to a fault set F, if for every fault in F, either: ) G is self-testing and fault-secure or, ) G is fault-secure, and if another fault from F occurs in G, then, for the obtained multiple fault, Case or is true. The above definitions are the properties, in terms of safe operation, of a circuit. Also, for the fault-secure circuits, a hypothesis is made for multiple errors, all along this paper. When an error is present in a circuit, a second one is possible to appear, after enough time, so the first one has been detected. This hypothesis may seem convenient but it is fully realistic. It is very hard that two errors appear simultaneously. When an error appears, the circuit should detect it, in order to be self-checking. Many codes can be used for the design of selfchecking circuits. For the design case of the binary we are interested only in the parity prediction code. The parity code is the least redundant error detection code and requires only one check bit indicating the parity of the information part. It can be directly applied to any bit-sliced circuit. The structure of a selfchecking circuit can be found in [5]. This work considers implementations using parity prediction techniques, with the use of standard cells because they are becoming predominant in industrial context and also can be easily automated through the use of a HL.. The bit binary coded Johnson-Mobius module Counter units are used vastly for the implementation of timers in microprocessors and microcontrollers. In fact timer units are non-stop s, so in order to design a safety critical application one of the most critical components, which has to work continuously and provide non-erroneous output is the unit. This leads to the
SET Proceedings of esign, Automation and Test in Europe, (ATE'), France, March -8, conclusion that in order for a system to be Totally-Self- Checking the units (included in it) must be implemented so that they comply with the TSC goal (they have to be fault-secure). This goal can be achieved also through the use of a double structure but this would lead to increased hardware and power costs. For the implementation of a N bit binary coded design based on the Johnson-Mobius encoding, a bit Johnson-Mobius coded will be used. As can be seen in Fig. a simple bit Johnson-Mobius encoded can give up to 8 states. This means that in order to produce a bit binary output (which has 6 states), we need to diversify the circuit a bit. This modification is shown in Fig., and gives 6 counting states by including an extra T Flip-Flop. SET SET SET Fig.. bit Johnson-Mobius coded SET T SET SET SET SET SET Preset Reset Clock Preset Fig.. Modified bit Johnson-Mobius coded with 6 counting states The 5 bit modified Johnson-Mobius coded output of the circuit illustrated in Fig., can give through proper modifications, a bit simple binary output that can be accessed by any architectural component of a processor on-the-fly. y using this modified bit Johnson-Mobius unit we can implement binary units that have a bitwidth multiple of (,8,,6, ). This bit module was chosen because in order to implement Johnson-Mobius s with more counting states the overall hardware would increase excessively (since every Reset Clock extra -FF in the circuit adds just two more counting states). In this design the binary implementation is of the synchronous type. Every next bit inary output modified Johnson-Mobius module (that is used to implement the following bits of the binary ) is triggered each time the sequence is scanned in the previous Johnson-mobius s output.. Fault Secure Johson-Mobius coded binary As referenced above the fault-secure binary implementation that is considered in this paper is based on parity prediction. This allows it to be compatible with the self-checking data-paths and components that are based on parity prediction algorithms, and are widely spread amongst the computer designing society []. This solution allows us to achieve low hardware cost since parity codes use only a single bit overhead.. Johnson-Mobius Parity prediction scheme In order to predict the parity of the output of the bit modified Johnson-Mobius, we must take under consideration the fact that the Johnson-Mobius encoding scheme is a Gray-like coding scheme. This means that every state transition flips the parity of the output. This observation, plus the fact that for the modified Johnson- Mobius module the parity changes with every state transition, except for those that happen every 8 th clock cycle (modulo 8), lead to the parity prediction scheme illustrated in Fig.. 5 bit modified J-M module To ecoder T Esimated Parity To TRC Predicted Parity Fig.. Parity Prediction scheme for the Modified bit Johnson-Mobius coded As it can seen easily the predicted parity derives from a T FF which is enabled to change state every clock cycle except for the one that the sequence is. Of course the predicted parity from the scheme in Fig. is Pest Ppr
S E T C L R J K S E T C L R Proceedings of esign, Automation and Test in Europe, (ATE'), France, March -8, not the total parity prediction for the binary output, after the decoding. The total parity prediction can easily derive from the equation: P = ( + + () in_ pr ) The Predicted Parity and the inversion of the estimated parity in Fig., plus the predicted parity in equation () and the inverted parity of the binary output are driven to a Two-Rail Checker (TRC) [6]. This TRC uses the values and for the correct operation indication and values and for the error operation indication. It has to be noted that the initial value of the T flip/flop must correspond to the parity of the initial state of the JM.. The N bit Johnson-Mobius FS In order to achieve high fault coverage the bit module based on the Johnson-Mobius Code must be designed to be fault secure. That means that under any single fault that might happen during operation, the errors generated on the outputs ( bit binary output) are single and thus are detected by the parity code. For presentation purposes the 8 bit FS parity prediction Johnson-Mobius encoded binary will be examined. The whole implementation scheme for this is illustrated in Fig., in order to indicate the certain modifications that are implemented to attain the Fault secure property for this design. 5 bit modified J-M module ECOER to inary - bits inary bit Johnson-Mobius module T Pbin EST. Two Rail Checker (TRC) nd T FF nd JM 5 bit modified J-M module ECOER to inary -7 bits inary T Pbin EST. Two Rail Checker (TRC) Fig.. 8 bit Johnson-Mobius FS binary architectural scheme The 8 bit implementation scheme for the proposed is constructed from two identical bit Johnson- Mobius encoded modules, with some logic in between them. The purpose of this logic is primary to enable the nd module only whenever this is needed. Using this enabling circuitry is the reason for the increased performance that this presents, since the parts past the first bits module remain stable during this first module s transition. This is related to the fact that each next module is changing state whenever the previous state of the preceding module is. In simple words the next module s state transition does not depend on the concurrent transition of the preceding JM module, but only from its previous transition. Thus for larger s the whole circuit remains stable during transitions, which increases the counting rate making this proposed architecture preferable for high performance safety critical applications. The disadvantage of this in-between logic, is that (along with the decoding units and extra parity estimator circuits for these units) it introduces a big hardware overhead. Also because of the Johnson-Mobius to inary decoder the overall dynamic power dissipation of the circuit is increased in general, but this increase is somewhat compromised by the fact that the Johnson- Mobius encoding is a Gray-like encoding technique. We know that for an n bit binary we have a total number of states that is equal to n. That means that the average number of bit transitions per state is: n n n n n + + + +... + n n which can be easily extracted by a simple observation of the inary coding. From Eq. () above the average number of bit transitions per state for a n bit binary is: + + +... + + n = / () = () Thus for a simple 8 bit binary the average number of bit transitions per stage is (in the Flip/Flops). On the other hand for the 8 bit Johnson-Mobius encoded FS binary, the average number of bit transitions per state is,5 bit transitions per state. This can be easily extracted from the fact that we have one bit transition per state for 7 cycles and two bit transitions every 8 th cycle giving us the total number of 88 bit transitions for 56 states/cycles. Following, the whole architectural scheme will be examined, in order to determine if this complies with the constraints that are imposed from the Fault- Secure theory. This study will prove the fault-secureness of the proposed design. 5. Fault-Secure analysis In the following paragraphs the fault-secure property of the proposed will be analyzed. It is shown that all errors, provoked by possible single faults in the circuit, can be detected.
Proceedings of esign, Automation and Test in Europe, (ATE'), France, March -8, 5. Faults in the modified JM module When a single fault occurs at the output of a flip/flop, in the modified 5 bit JM module shown in Fig., during a state or during the state transition, it is propagated through the gates to the estimated parity output P est for the Johnson Mobius encoding scheme as illustrated in Fig.. Then the derived estimated parity is compared with the predicted parity P pr which is produced through the totally independent parity prediction structure (with the separate T FF and logic), and in case of an error we have fault detection. If on the other hand a fault affects the input of a flip/flop, then after one or more clock cycles, depending on when the effectof this fault will lead to an error at the output of the flip/flop, it will be detected as in the previous case. Following the same methodology, if a single fault happens, during operation, on the parity prediction circuit (either the nand or and gates or on the T flip/flop) an error is propagated to party prediction output and it is detected from the comparison with the estimated parity. 5. Faults on the ecoder In order to examine the fault secureness of the ecoder circuit the equations that transform the 5 bit modified Johnson-Mobius encoding scheme to the simple bit inary representation. These equations are given below (note that is the inary output and M is the output of the modified Johnson-Mobius module): = M = M = M = M M M + M M () As can be seen from the equations above and by taking under consideration the theorem presented in [], which states that: Theorem : Parity prediction in an odd-cell fan-out circuit, achieves fault secureness for any single ermanent or transient fault, if this can be detected before the occurrence of a second fault. According to this theorem, and by taking under consideration the fact that each input of the Parity prediction circuit of the decoder (whose function is stated in equation ()), drives exactly two cells (gates so it does not affect the oddity of the total fan-out of these signals, since the same signals are used at least once in the ecoder circuit), the only input signal that seems to have an even number of cells to drive is the M. oubling the gate that gives as the signal, and then inverting the second output can solve this small and problem. Then the two signals ( ) are compared through a TRC circuit. After this modification if a single fault occurs in the ecoder circuits input this will propagate to one of the decoder output signals, and this will alter the parity of the binary output. This in turn will lead to the detection of the error occurrence after the comparison wit the predicted parity of the inary output. Similarly if a single fault occurs in the Parity prediction circuit this will be detected after the comparison of the predicted parity with the output parity as shown in Fig.. 5. Faults in the s If a single fault occurs on a gate of a, it is propagated to a single parity output and is detected. A fault, during a clock cycle, on the output of the of gates which derives the parity of the 5 bit modified JM can be detected through the comparison with the predicted parity stored in the T flip/flop, since this crcuit operates independently to the unit. 5. Faults on the enabling circuits As referenced in the description of the s architecture every next module is enabled if the modified JM module s output is. This statement of course y itself introduces a fallacy. If a fault occurred on the output of this enable decoding circuit, the next module would never be enabled to count, and the parity prediction circuit s output would remain in its initial value. Thus the error caused would never be detected. To avoid this erroneous situation we have implemented two separate enabling circuits, one for the parity prediction circuit (T flip/flop) and one for the JM mo dule. Of course if both enabling circuits were triggered by the same JM module s output ( ) the problem would remain. For this reason the second enabling circuit is taking as input, the output of the bit binary representation of the previous module (thus if an error has occurred in the previous module s decoder it would have been detected) and it is triggered when the sequence appears in it. 6. Experimental results We have developed parameterized VHL descriptions to present the fault-secure parity prediction Johnson- Mobius encoded binary implementation that can generate various sizes for this. The numerical results that were obtained are from mapping the produced from CA utilities netlist to the AMS (Austria Micro 5
Proceedings of esign, Automation and Test in Europe, (ATE'), France, March -8, Systems) standard cell library for.6-µm CMOS technology. In order to provide a better comparison between the proposed implementation and the simple FS binary presented in [8] the simple synchronous binary and the conventional FS (doubling technique) were realized as well. These designs serve as reference for the measurement of the overhead that is presented in area, power and performance. The results that arise are presented in Tables and for the fault -secure augh-wooley and ooth multipliers respectively. Note that the worst case delay signal is the Parity P s of the results of the multipliers, while the results themselves have a slight increased delay than those derived from the non fault-secure versions of the multipliers. In tables to the comparison between the three fault secure s that were implemented (the J-M encoded binary, the simple FS binary and the doubled ) is presented in terms of integration area, power dissipation and performance (time delay). The Mentor graphics Leonardo Spectrum utility at the version.b is used for the measurement of the chip area and performance, and the values that are provided by the tool are normalized to the non fault-secure binary implementation. For the measurements of the Power dissipated the Synopsys CA framework at the version 999. is used, and the values taken are also normalized to the non-secure binary. The designs are implemented for bitwidths of, 8, 6, and 6 bits. Table. Comparison of the three FS s in terms of integration area Counter type bit 8 bit 6 bit bit 6 bit FS binary..9.8.. ouble binary.75.9.9.97.98 JM FS.5.5.5.57.57 Table. Comparison of the three FS s in terms of power dissipation Counter type bit 8 bit 6 bit bit 6 bit FS binary..9.9.67.5 ouble binary.9.7.86.9.98 JM FS.89.58.8.. Table. Comparison of the three FS s in terms of performance (delay time) Counter type bit 8 bit 6 bit bit 6 bit FS binary.65.69.67.6.5 ouble binary.8.5... JM FS.7.6.86.69.59 Some obvious conclusions can be derived from the tables above concerning the comparison of the three Fault-secure s. If integration area is the main design issue in the implementation of a safety critical application, then it seems tat he simple FS binary proposed in [8] is the most suitable selection, for all bitwidths. This does not mean that the JM proposed lacks greatly in comparison to the simple FS. On the other hand as it derives from table, the simple FS is better sited for Low Power safety critical applications since it is by far the least power dissipating, in comparison to the other FS designs. In the comparison illustrated in table, the main asset that the proposed Johnson-Mobius FS binary has is presented. The obvious conclusion that is extracted is that the proposed is by far the fastest when compared to the other fault-secure designs. In fact for large bitwidths, it is even faster than the simple non fault-secure binary. This s difference in terms of performance (/delay) can be seen more clearly in fig. 5 below.,8,6,,,8,6,, Performance (/delay) 8 6 6 bitwidth (# bits) simple FS JM FS Fig. 5. Performance comparison between a) simple FS binary and b) JM FS binary 6
Proceedings of esign, Automation and Test in Europe, (ATE'), France, March -8, Of course the values used for the comparison presented in fig. 5 are also normalized to the simple nonsecure synchronous binary. From this figure we see that the proposed architecture has by far higher performance. In fact as the size grows the performance factor is tripling when compared to the simple FS binary presented in [8]. 7. Conclusions In this paper a fast fault-secure Johnson-Mobius encoded inary is presented, which is based on the parity-prediction technique and leads to high fault coverage. The whole architecture ensures the Fault-Secure property with the use of the parity prediction units that were previously described. The integrated area, power and performance requireme nts of this implementation were presented in comparison to other safe binary s such as the double and the simple Fault Secure Parity Prediction. The extracted results shown that for little area and power overhead, the proposed presents much better performance, when compared with the other FS designs. In fact its performance is even better that the simple non-secure synchronous binary and almost triple (for the 6 bit implementation the performance is better by 67%) to the fault secure binary presented in [8], as the s size increases. 8. References [] M. Nicolaidis, Fail-Safe Interfaces for VLSI: Theoretical Foundations and Implementation, IEEE Transactions on Computers, Vol. 7, pp. 6-77, Jan. 998. [] Niraj K. Jha, Sying-Jyan Wang, esign and Synthesis of Self-Checking VLSI Circuits, IEEE Tranaction on Computers, Vol, No 6, pp 878-887, June 99. [] M. Nicolaidis, R. O. uarte, S. M. J. Figueras, Fault- Secure Parity Prediction Arithmetic Operators IEEE esign & Test of Computers Magazine, pp. 6-7, Apr- Jun. 997. [] R. O. uarte, M. Nicolaidis, H. edder, Y. Zorian, Fault- Secure Shifter esign: Result and Implementations European esign and Test Conference, (E&TC), 997. [5] P. Kakaroudas, K. S. Papadomanolakis, E. Karaolis, S. Nicolaidis, C. E. Goutis, Hardware/Power Requirements versus Fault etection Effectiveness in Self-Checking Circuits, Proc. of Patmos 99, pp. 87-96. [6]. Nikolos, A. M. Paschalis, G. Philokyprou, Efficient esign of Totally Self-Checking Checkers for all Low-Cost Arithmetic Codes, IEEE Trans. On Comp., vol. 7, no. 7, pp. 87-8, July 998. [7] M. Morris Mano, igital esign, Prentice-Hall Inc., 99. [8] E. Karaolis, S. Nikolaidis, C.E. Goutis, Fault Secure inary Counter esign, Proc. of ICECS 99,vol III, pp. 659-66. [9] IN V VE 8 Principles for computers in safetyrelated systems, 99. []. Chu, Phase digitizing sharpens timing measurements, IEEE Spectrum, pp. 8-, July 988. 7