Implementation of Triple Modular Redundancy in ASIC Design

When a spacecraft is flying in space, it is always in a radiation environment composed of charged particles. In this radiation environment, the microprocessor may interrupt normal functions due to single-particle disturbances, leading to catastrophic accidents. This mainly involves two aspects: the total radiation dose effect and the single-particle effect. The single-particle effect is divided into two aspects: single-particle upset (SEU) and single-particle latch (SEL). The single-particle upset effect can cause a certain bit in the storage unit of the digital circuit to flip due to interference, thereby causing changes in the storage content. It can also introduce a short pulse on the output of the combinational logic circuit. The single-particle upset effect is currently the main cause of processor failure. The stability and reliability of the processor performance in the onboard computer system plays an important role in the stability and reliability of the entire system. Therefore, the circuit must be reinforced. Triple-mode redundancy technology is an effective fault-tolerant technology for single-particle upsets, which can greatly improve the reliability of the circuit.

1 Introduction to Triple-mode Redundancy

Triple-mode redundancy (TMR) technology is a sequential circuit reinforcement technology. Its basic idea is to generate two identical modules for the module to be reinforced, and then output them through majority voting. In this way, even if one module fails, the circuit can still work normally. The structure of triple-mode redundancy is divided into space redundancy and time redundancy. Time redundancy means that there is a certain delay between the three clock signals, and the delay value should be greater than the maximum pulse width of the SEU flip-flop. The role of time redundancy is that for the input burrs of the timing circuit, at most only one clock will sample the wrong value, so it can effectively prevent the errors caused by combinational logic glitches. Figure 1 is a circuit diagram of a trigger reinforced with ordinary space-time triple-mode redundancy (hereinafter referred to as TMR trigger), where VOTER is the combinational circuit of the majority voter.

Although triple-module redundancy technology can greatly improve the reliability of the system, the cost is also huge. From the basic structure of TMR, it is not difficult to see the two disadvantages of using TMR technology: first, the chip area is increased to more than three times the original due to hardware redundancy; second, due to the delay between the three clock signals and the addition of a voting circuit at the output, additional delays are introduced on the critical path, resulting in a decrease in the operating speed of the circuit.

If the critical path delay between the two triggers in the design is too short (such as a shift register), the triple-module redundancy circuit structure in Figure 1 may have problems with circuit output instability and circuit state errors during operation. Figure 2 is a circuit diagram of a 4-bit shift register reinforced with triple-module redundancy, and the circuit of the TMR_DFF module in the figure is shown in Figure 1.

FIG3 is a simulation waveform diagram of the top module of the register reinforced with triple-module redundancy. The circuit state at the marked line in the figure is wrong (it can be seen from the input d that the correct state should be that the output becomes 7 after the third clock rising edge). The reason is that TMR_DFF is a combinational logic output. At the first rising edge, the input D of reg0 is sampled by clk and clk_skew[1], and out[0] becomes 1. The input out[0] of reg1 is sampled by clk_skew[0], and its q2 (the signal in the circuit of FIG1) becomes 1. The circuit state is still 1. When the second rising edge comes, since q2 of reg1 is already 1, the input out1 of reg2 becomes 1 after being sampled by clk. After the majority vote, out1 becomes 1, and the circuit state is 3. After the input out1 of reg2 is sampled by clk_skew[1] and clk_skew[0], its q1 and q2 become high, and the output out2 becomes high. The circuit state becomes 7, and an error state occurs.

If the delay between clocks is reduced, the circuit may appear in an indeterminate state. The reason is also due to the early output of the combinational logic, which will not be discussed here.

2 Implementation of Triple-mode Redundancy

2.1 Modify the Netlist Secondary Synthesis

The function of DC synthesis is to read the RTL code of the design and synthesize the RTL code to the structural level according to the timing constraints, thereby generating a mapped gate-level netlist. One of the important steps is to specify the synthesis library used for synthesis. The synthesis library is generally provided by the wafer manufacturer. The library contains information such as pin-to-pin timing, area, pin type and power consumption. The cells in the gate-level netlist after synthesis are the cells defined in the library.

The reinforcement process of triple-mode redundancy is actually to generate two redundant triggers for each trigger in the design and add voting logic, which cannot be reflected in the RTL code. Therefore, the gate-level netlist after the original design synthesis can be modified, the trigger is changed to a triple-mode redundant trigger, and the triple-mode redundant trigger module is written with the gate-level description. Then, it is synthesized again with the modified netlist to obtain the netlist file after triple-mode redundancy reinforcement. It is worth mentioning that there are many types of triggers in the DC synthesis library, such as SDFF, EDFF, SEDFF, JK, and DFF. Even if the synthesis script is limited to using only DFF triggers, there will be several types, so for different units, corresponding three-module redundant trigger modules must be written (its structure is shown in Figure 1). In addition, since there are three clock signals, a clock generation module must be written, whose function is to generate two clock signals with mutual delays from clk.

First, the RTL code of the original design is synthesized under Synopsys's synthesis tool DsignCompiler to obtain the gate-level netlist of the circuit. The circuit in the gate-level netlist actually describes the structure of the circuit by instantiating the units of the synthesis library. The formal verification tool Formality can be used to verify whether the RTL code and the synthesized gate-level netlist are functionally consistent.

Then modify the gate-level netlist, add the line type ck[2:0] to the netlist, and instantiate the clkgen module, then change the trigger in the netlist to a three-module redundant trigger, and modify its clock port to {clk, ck[1:0]}. Since the synthesis library does not contain these two modules, there are two modules in the netlist that are not processed by the synthesis tool, the clock generation module and the three-module redundant trigger module. The modified netlist is not a completely mapped gate-level netlist.

Finally, the modified netlist, clock generation module and three-module redundant trigger module are synthesized again. This synthesis is actually the synthesis of the clock generation module and the three-module redundant trigger, mapping them to units in the synthesis library. The gate-level netlist obtained is the gate-level netlist designed after the three-module redundant reinforcement.

2.2 Establishing a library unit of a triple-modular redundant trigger

Since the clock port of a triple-modular redundant trigger unit has 3 bits, even if a triple-modular redundant trigger unit is added to the library, the synthesizer cannot directly map the design to the unit. Therefore, the clock generation module can be placed inside TMR_DFF, so that the clock port of the triple-modular redundant trigger has only 1 bit. In the library file, the trigger unit is replaced with the corresponding triple-modular redundant trigger unit. DC can directly map the trigger in the circuit to TMR_DFF, and the design can be completed in one synthesis. However, this will increase the area of ​​the entire chip a lot (the clock generation module is no longer shared). In addition, the above method can also be used to modify the netlist after the original design is synthesized. As mentioned earlier, there are many types of triggers in the library file, so corresponding library units should be established for different DFF triggers. The following is a method for establishing library units, which is mainly divided into two steps: layout design and simulation feature extraction.

The establishment of a cell library must first complete the layout design of the cell. After determining the types of cells and cell circuits contained in the cell library, the layout design of the cell is completed according to the process parameters and design rules of the processing manufacturer, and the circuit netlist is exported. At this time, the netlist not only contains the circuit structure, but also the resistance and capacitance parameters. Then the cell parameter extraction work can be carried out.

Parameter extraction requires the selection of a tool for parameter extraction. Here, Silicosmart is selected. Secondly, the simulation tool, such as HSpice, must be determined. The main steps include creating a working directory to configure the simulation environment, introducing a reference library, generating simulation files, running simulation feature extraction, and generating library files. Creating a working directory

means creating a directory for Silicosmart to run. At this time, a script file named config.tcl will be automatically generated. Some key configurations need to be performed manually, mainly including the selection of simulation tools (HSpice is selected here), the specification of simulation models, and the setting of variables such as ambient temperature. Introducing a reference library is to specify a reference library cell for the tool. The tool extracts the information of the reference cell and generates a control file for the cell. The file describes in detail the information of the cell to be extracted. Including unit netlist file, pin information, logic function, input signal rise/fall time, output pin load, etc. If there is no reference library file, you need to write the file manually. Generating simulation file tells the tool which aspects of the unit to extract characteristics, such as timing, power consumption, CCS model, etc. Running simulation extraction is to extract the characteristics of the unit. Generating library file will generate 2 library units, of which .v is the simulation library used by the simulation tool, and .lib is a readable comprehensive library. You can use the read_lib *.lib command to read the .lib file in DC, and then use the write_lib* *.db command to generate the .db comprehensive library (* represents the name of the library unit).

For radiation hardening, in addition to circuit hardening, you may need to choose a more reliable process. SOI process has good radiation hardness. It eliminates the latch effect and effectively reduces the single particle effect. At this time, you need to build your own unit library. The trigger unit in the library can be directly built into a library unit of a triple-mode redundant trigger.

3 Conclusion

The radiation resistance of chips in aerospace systems is an important indicator. For radiation-resistant processors and memories, irradiation experiments are an important part of the test. Triple-mode redundancy reinforcement technology is only one of many radiation-resistant reinforcement technologies. Other commonly used technologies include error detection and correction code EDAC and SOI process reinforcement. The cost of using SOI process for wafer production is more expensive than that of ordinary processes. The establishment of a standard cell library is a basic task for ASIC design. It is very important for chip design to establish a standard cell library that meets the design requirements. This article provides a general method for this.