© Springer -Verlag Berlin Heidelberg 2011 Reliability and validity of tw o kinds of TMR technique s in LEON 3 processor Amira ELAGUECH, Wajih EL HADJ… [601667]

adfa, p. 1, 2011.
© Springer -Verlag Berlin Heidelberg 2011 Reliability and validity of tw o kinds of TMR technique s
in LEON 3 processor
Amira ELAGUECH, Wajih EL HADJ YOUSSEF , Afef KCHAOU, Mohsen
MACHHOUT, Rached TOURKI
Faculty of Sciences of Monastir
Laboratory of Electronics and Micro -Electronic (LEME) Monastir, Tunisia
[anonimizat]

Abstract. In this paper we explained the characteristics of LEON 3 soft -core
processor and its implementation on FPGA board. TMR technique is added to
LEON 3 processor design . Implementation performances show that TMR inte-
gration with triplicated voter in a triplicated design can have an important i m-
pact especially on the consumpti on resources . Furthermore o btained results
provide a new insight for implementing efficient fault -tolerant techniques in the
design o f reliable circuits and systems.
Keywords: LEON 3, SEU, TMR, Voter , benchmark .
1 Introduction
Embedded system is based on an integrated processor which executes software d e-
signed for a particular function. Security, resource constraints (area, energy …) and
real-time becomes more and more important for these system s [1, 2].
LEON3 processor is a highly configurable open source co de developed by
Aeroflex Gaisler Research , designed for embedded applications . It supports Power –
down mode and clock gating with robust and fully synchro nous single -edge clock
design [3 ]. ASIC and FPGA technologies provides integration of complex systems
based on LEON3 soft-core processor on a single chip. Today, there is a danger on
safety functioning of numerical circuit that concerns the feelings of the logical states
in the different sources of noise precisely in certain environment such as in the space
or the nuclear systems . In these spaces the collisions of charged particles can draw
away transitional errors. For space applications, fault to lerance is a requirement b e-
cause of the severe radiation environment. As manufacturing technology evolves to
increasingly finer geometries, the probability of Single Event Upset (SEU ) is increa s-
ing.
Various methods have been elaborated to mitigate the effects of single event upset
(SEU) in FPGAs, such as the well -known Triple Modular Redundancy (TMR) tec h-
nique. In this paper we proposed a new method to protect the integer unit block of
LEON3 processor against SEU attacks. TMR technique is placed in different IU pip e-

2
line stages. It involves creating three redundant copies of a circuit and adding major i-
ty voters to select the correct circuit output from the three copies. The voting circuitry
is also triplicated so that individual voter failures can also be corrected by the voting
process.
This paper is organized as follows: In section 2 , we study the soft -core LEON3
processor. Section 3 describe s the hardware fault injection method. Section 4 explains
the method of protection with different configuration. Experimental results are dis-
cussed in section 5 and section 6 concludes the paper.
2 LEON 3 processor
The LEON 3 is a processor that is used in the European aerospace and military a p-
plica tions . It is a synthesizable VHDL model of a 32 -bit processor compliant with the
SPARC V8 (Scalable Processor Architecture) architecture. The model is highly co n-
figurable, and particula rly suitable for system -on-chip (SOC) designs. The full source
code is available under the GNU GPL license [4].

The LEON 3 processor contains 7 -stage pipeline (Fetch, Decode, Register Access,
Execute, Me mory, Exception and Write -Back) with Harvard architec ture. It has the
following main features: on-chip debug support, Hardware multiplies divide and
MAC units. Figure 1 shows LEO N3 processor core block diagram .

Fig. 1. Structure of the LEON3 processor
2.1 Configuration of LEON 3 processor
The Leon3 processor is fully param eterizable thr ough the use of VHDL generics
[4]. Thus, it is possible to instantiate multiple processor cores in the same design with
different configurations. The LEON3 can be configured using a graphical tool built on
Linux kernel “tkconfig ” or “xconfig ” command in Cygwin [5].

This tool still allows you to configure other devices on a chip such as memory co n-
trollers and network interfaces. Figure 2 shows the architecture of LEON3 processor ,

3
which is configured to use the JTAG debug link, the controller AHB, the memory
controller, bridge AHB / APB, UART, the TIMERS, interrupts, and ports I/O.

Fig. 2. LEON3 Template design block diagram
3 The hardware fault injection
The fault injection is a validation technique for fault -tolerant systems, which co n-
sists of the realization of controlled experiments where the observations of behavior
in the presence of faults system explicitly induced by the volunteer introduction of
faults in the system. The proposed fault injection method (SEUs) is used for fault
injection in the IU of the LEON3 processor . For all the outputs of each pipeline stage ,
XOR logic function is performed with each digit of the output vector , and so , one
digit is changed every clock cycle . The injection will be directly applied in VHDL
code of the integer unit [1, 6,7].
4 Triple Modular Redundancy ( TMR )
4.1 Traditional TMR
TMR is the most commonly used mitigation technique against SEUs for FPGA d e-
signs used in radia tion environments. It works by triplicating a design and voting on
the outputs of the three modules. Majority voters are used to mask errors in any single
copy of the circuit.
If we suppose that the error is in the Integer Unit (IU), so we will apply the princ i-
pal of TMR and the final design will be composed of three redundan t copies of the
original (IU).
This technique is based on a block called majority voter with 3 inputs and one ou t-
put that always gives value as the logic level present on at least 2 inputs, and the m a-
jority. A voter is a necessary element in this kind of fault -tolerant architectures. The
importance of reliability in majority voter is due to its application in both conventio n-
al fault -tolerant design and novel nano electronic systems [8]. Figure 3 shows the
internal architecture of Voter that masks the present faults in a single bloc k of IU.

4

Fig. 3. Internal architecture of Voter

The principle of applied TMR on integer unit block of the LEON 3 processor is de-
scribed in Fig. 4 .

Fig. 4. Description of TMR design

Since the TMR is added in the LEON 3 processor , the redundant block as well as
the voter can be identified in the processor configuration, as shown in Fig. 5.

Fig. 5. Integration of TMR in LEON3 configuration

Although this technique can be implemented on the latest commercial FPGA tec h-
nologies, and its reliability can approach that of processor protected with radiation
hardening, it is expensive in terms of area and power. Thus, this protection technique
performs well on two of the three processor design -space axes: reliability and perfo r-
mance cost, but it has a very large a rea cost [ 10].
IU3
IU3 Voter
IU3_faul
t
Input Output
+ A1 A2 A3
A &
&
&

+

5
4.2 Proposed TMR with triplicated voter
A voter is a necessary element in the TMR technique. In theory, the weak point of
TMR is his vote since he cannot be protected by the triplication. As mentioned in [ 11]
traditional TMR is not the best solution against SEUs in voting logic or against SETs .
Furthermore it d oes not possess the right characteristics or qualities for the re –
configurability of Xilinx FPGAs.
In this work, we propose a modified kind of TMR. The major difference between
the elaborated and the traditional TMR is that the voters themselves are triplicated. If
an upset occurs in throughput logic or in a state machine somewhere in the design,
one of the redundant design domains will behave differently from the ot hers [ 13]. Th e
output voter for that domain will detect that its domain is behaving differently and
disable the three -state buffer for that domain, placing its pin in a high impedance
state. The other two domains will continue to operate correctly, driving the correct
output off the chip.

.

Fig. 6. Proposed TMR with triplicating Voter

Figure 7 shows the presence of three blocks of IU and three voters. A fourth voter
includes the output of three voters and gives the fi nal correctly output in the LEON 3
processor configuration.

Fig. 7. Integration of TMR and the three voters in the L EON 3 configuration
5 Implementation results and discussion
LEON 3 comes with support of several FPGA evaluation and develop ment
boards. The board used is Vertex V- ML507 from Xilinx, with JTAG interface, serial
port, button/ switches, SRAM and flash memory .
Input IU3
IU3_fault IU3 Voter1
Voter2
Voter3
Voter
Output

6
5.1 Performance s of LEON3 implementation
The use of TMR technique in LEON 3 processor improves the number of slice Luts
and register used. Table 1 shows the improvement of LEON 3 when adding the TMR
in terms of slice LUTs resources .
Table 1. Number of used slice LUTs of LEON3 processor (With/Without TMR )

When faults are injected in different pipeline stage s, we notice a slight difference
in the number of used slice LUTs . We observe that original LEON 3 used only 39% of
total number of slice LUTs (44800) . When apply ing TMR , the percentage of slice
LUT s used is reduced to 32%. Since TMR with triplicated voter placed the resource
consumption remain approximately the same . We notice that the TMR integration
improves the use of logic resource s in the LEON3 processor . In [12] authors showed
that the triplication of the combinational logic reduces the number of slice Luts nee d-
ed.The histogram presented in Fig. 8 shows that the logic resource s (registers) used
with TMR technique (with triplicating IU and triplicating voter) is decreased co m-
pared to the original processor design .

Fig. 8. Numbers of used register s in LEON 3 design (Without /With TMR / With TMR and
triplicated voter
0 2 4 6 8 10 12 number of registers
Without TMR
With TMR
With TMR and triplicated
voter IU Stage Without TMR With TMR With TMR and
triplicated voter
Fetch 17647 14470 14482
Decode 17616 14478 14484
Execute 17622 14477 14480
Memory 17647 14472 14489
Exception 17635 14476 14483
Write -Back 17636 14475 14485

7
The initial number of the register used in the basic processor design is 10342 out of
44,800 (23%), an improvement in the number of registers used is also noticed. When
applying both types of TMR, 7657 registers are obtained.

In our work , logic reso urces (slice LUTs and registers) are reduced by 7%, this
percentage depends on the number of error s injecte d and their location .
5.2 Efficiency of the TMR on a faulty program
LEON3 design integrating three redundant blocks of IU and triplicated v oters, was
implemented on Xilinx Virt ex V-ML507 development board. The processor is run-
ning the AES encryption as a benchmark, wh ich IU contains injected errors in diffe r-
ent pipeline stages [4]. To download the software AES and to run it in LEON3 ,
GRMON tool from Gaisler Research is used. It allows communicating with the pr o-
cessor for non -intrusive monitoring and debugging, providing full access to internal
peripherals. Debug support unit (DSU) is also included in LEON3 model to co m-
municate with GRMON via a serial cable (JTAG). As illustrated in Fig. 9, when ex e-
cuting execution result of the AES algorithm the processor is blocked and the error
message “S topped” is displayed .

Fig. 9. Load and run of AES benchmark in LEON3 processor without TMR
When the TMR techni que is placed i n LEON3 design, the processor operates co r-
rectly and masked all faults. The execution result of the AES algorithm and the us e-
fulness of TMR technology is approved a s shown in Fig. 10 .

Fig. 10. Load and run of AES benchmark in LEON3 processor with TMR
6 CONCLUSION
This paper presents a hardware implementat ion of TMR technique on LEON 3 de-
sign and a software implementation of AES algorithm . The proposed TMR technique
assures a reliable functioning of the considered processor when it is attacked by Sin-

8
gle Event Upset. This work analyses the perfor mance s of LEON 3 processor with two
types of TMR technique . The implementation results demonstrate a better perfo r-
mance with d ecreased FPGA resource s.

REFERENCES

1. Wei Jiang, ZhenlinGuo, Yue Ma, Nan Sang, (2013) Measurement -based research on cry p-
tographic algorithms for embedded real -time systems. Journal of Systems Architec ture,
vol. 59, Issue 10, Part D, November 2013, pp. 1394 -1404
2. RomainVaslin, Guy Gogniat, Jean -Philippe Diguet, Eduardo Wanderley, R ussell Tessier,
Wayne Burleson (2009) A security approach for off -chip memory in embedded micropr o-
cessor systems. Microprocessors and Microsystems, Vol. 33, pp. 37 -45
3. MeghanaH asamnis , PritiChimankar, S. S. Limaye (2012) Comparative Analysis of
LEON3 and NIOS II Processor Development Environment: Case Study Rijindael’s E n-
cryption Algo rithm. International Journal of Electronics and Computer Science Enginee r-
ing 2012, ISSN 2277 -1956/V1N3 -1308 -1314
4. Gaisler J, Cavtovic E, Habinc S (2007) GRLIB IP core user’s manual. Gaisler research
5. Afef Kchaou, Wajih El Hadj Youssef, Rached Torki (2014) Software implementation of
AES algorithm on leon3 processor. IEEE International Conference on Sciences and Tec h-
niques of Automatic Control and Computer Engineering (STA) December 2014
6. Nathan A. Harward, Michael R. Gardiner, Luke W. Hsiao, Michael J. Wirthlin (2015) E s-
timating Soft Processor Soft Error Sensitivity Through Fault Injection. IEEE International
Symposium on Field -Programmable Custom Computing Machines , pp. 143 -150
7. Afef Kchao u, W. El Hadj Youssef, Rached Tourki, Fraidy Bouesse, Pablo Ramos, Raoul
Velazco (2016) A deep ananlysis of SEU consequences in the internal memory of LEON3
processor . IEEE Latin-American Test Symposium (LATS) . Conference April 2016
8. Nathaniel H. Rollines (2012) Hardware and Software Fault -Tolerance of Softcore Proce s-
sors Implemented in SRAM -Based FPGA, PHD thesis in faculty of Brigham Young Un i-
versity
9. Nabihah Ahmad, S.M. Rezaul Hasan (2013) Low -power compact composite field AES S –
Box/Inv S -Box design in 65 nm CMOS using Novel XOR Gate. Integration, the VLSI
Journal, Volume 46, Issue 4, September 2013, Pages 333 -344
10. Shubham C. Anjankar, Dr.Mahesh T.Kolte (2014) Fault Tolera nt and Correction System
Using Triple Modular Redundancy. International Journal of Emerging Engineering R e-
search and Technology, vol. 2, pp. 187 -191
11. Sandi Habinc (2002) Function Triple Modulary Redundancy (FTMR). Gaisler Research
12. Ben Jrad M. (2013) Robustn ess circuit design implemented on FPGA SRAM and valid a-
tion fault injection, PHD thesis in Nano Electronic and Nanotechnology , TIMA laborat o-
ry of Grenoble University
13. Carmichael C. XAPP197 (2006 ) Triple Modular Redundancy Design Techniques for
Virtex -FPGA s.
http://www.xilinx.com/support/documentatio n/application_notes/xapp197.pdf