ection Technique for ehavioral - Level Models

TODD A. DELONG BARRY W. JOHNSON Universiiy of Virginia JOSEPH A. PROFETA 111 Union Switch and Signal, Inc. AS EARLY AS THE 1960~, designers recognized the importance of incorporating fault tolerance into microelectronic designs. However, they often performed this task late in the process when the design was near completion. As computer systems become more complex, designers must consider fault tolerance throughout the design process to allow early estimation of reliability and fault coverage. Designers usually perform dependability parameter estimation (DPE) at a high level of abstraction, using stochastic Petri net or queuing models. However, as specifications become more demanding, designers must go to increasingly lower levels of modeled detail to achieve the desired results. One such level of modeling is the instruction set architecture (ISA), where a modeled processing element executes machine instructions. Historically, designers have achieved the ISA level of detail with a gateor devicelevel model of the processor. Fault injection is an important technique for the evaluation of design metrics such as reliability, safety, and fault coverage. The process involves inserting faults into a system and monitoring the system to determine how it behaves in response. Researchers have made several efforts to develop techniques for injecting faults into a system prototype or model; most of these fall into three categories: hardware-, software-, and simulation-based fault injection. Practitioners have accomplished hardware-based fault injection by such methods as bombarding the hardware with heavy-ion radiation,’ injecting voltage sags on the hardware’s power rails,’ and corrupting logic values at the pin level.2 An example of software-based fault injection, known as fault injection-based automated testing (FIAT), injects faults into the actual source code in a real-time en~i ronment .~ These hardwareand software-based approaches do produce a dependability analysis of the system. However, they do not lend themselves easily to DPE during the design process, because they require a physical working system for the fault injection experiments. Consequently, by these methods, DPE takes place toward the end of-rather than throughout-the design process. Currently, however, researchers are realizing the advantages of simulation as a means to perform DPE. Typically, they perform simulations at gate where signal values in the simulation are stuck at logic 1 or 0, or at device level,6 where current or voltage values are fixed and a fault propagates to the gate level. Simulation approaches lend themselves nicely to the design process, but they do have a couple of shortcomings. First, we often need an implementation of the device before detailed simulations are possible. But the implementation is usually not available