Self-Timed is Self-Checking

Transcription

1 Self-Timed is Self-Checing Ilana David 1, Ran Ginosar 1, 2, and Michael Yoeli 2 1 Department of Electrical Engineering 2 Department of Computer Science Technion - Israel Institute of Technology Haifa ABSTRACT Self-checing circuits detect (at least some of) their own faults. We describe self-timed circuits, including combinational logic and sequential machines, which either halt or generate illegal output if they include any single stuc-at faults. The self-timed circuits employ dual rail data encoding to implement ternary logic of 0, 1, and unde f ined states; the fourth state is used to signal illegal output and is shown to result only from certain circuit faults. The self-timed circuits also employ four-phase signaling according to a well-defined protocol of communications between the circuit and its environment; failures due to certain faults prevent the circuit from communicating properly, thus causing the circuit to halt. We show that any single stuc-at fault falls in either the first or the second category, thus providing complete fault coverage through self checing. No hardware needs to be added to our circuits to achieve the complete selfchecing property; further, the circuit is guaranteed to never generate a legal but erroneous output if it contains a fault. Minimal hardware is needed to detect that a circuit has either halted or has generated an illegal output. Keywords: Asyncronous systems, combinational logic, finite state machines, self-checings, self-timed. 1. Introduction Substantial attention has been given recently to the design of asynchronous circuits and systems [Ma89, MFR85, Se80]. Self-timed asynchronous circuits are designed to operate correctly regardless of any delays in either wires or gates. They are potentially easier to design, more

2 - 2 - modular, consume less power, and run faster than synchronous ones. Various automatic synthesis techniques which produce correct-by-construction circuits have been proposed [Ma89, Eb87]. One major difficulty of asynchronous circuits is that they are hard to test. The circuits operate on their own, without any external cloc. Thus, it is hard to single-step their operation through testing stages. Consequently, it was generally believed that testing asynchronous circuits would require extra effort and resources. At the same time, asynchronous circuits carry a great hope and potential for a unique advantage as far as faults are concerned. A faulty asynchronous circuit may halt its operation once a fault develops or is encountered, since there is no free-running cloc to tae the system away from the fault. However, up till now this potential never materialized. We have presented a novel method for the design of asynchronous self-timed circuits, including combinational logic as well as sequential machines [DGY92a, DGY92b]. In this paper we show that the self-timed design of the combinational logic and the sequential machines is self-checing, in the sense that every fault (of the stuc-at model) which might have caused wrong output, causes the circuit either to stop operating, or to generate an illegal output. Thus, testing is simplified: Instead of having to compare generated outputs with expected ones, testing merely verifies that the circuit under test neither halts nor generates invalid outputs. Furthermore, even if a faulty circuit manages to escape testing (e.g. due to incomplete coverage), it is still guaranteed to never generate erroneous outputs. A method of testing self-timed combinational logic is described in [HR84], however this method deals with testing from the outside whereas our paper deals with self-checing features. Another approach has been demonstrated in [CB90] for the design of asynchronous counters. Self-checing in general is described, e.g., in [MF78, Ni87].

3 - 3 - In this paper we first describe very succinctly the design of the combinational logic module and its operation and prove that it is self-checing. Next we describe the design of the masterslave register and prove that it is also self-checing. From these proofs we conclude that the finite-state machine is also self-checing. (Full descriptions and proof of correctness of the combinational logic module, the master-slave register and the finite-state machine are given in [DGY92a] and [DGY92b].) 2. Self-Timed Combinational Logic Module A general Self-timed Combinational Logic (CL) module, which can efficiently implement any set of Boolean functions, is shown in Figure 1 [DGY92a]. In principle, the logic operates on the ternary logic values { 0,U, 1 }, where U is the undefined value and 0, 1 are the defined values. In practice, however, the ternary logic levels { 0,U, 1 } are implemented by double-rail codes 10, 00, 01 respectively [Se80]. The sequential behavior of the CL networ and of its environment is specified by the following cycle of activities. The E i s represent environment (domain) constraints. The S i s represent networ (functional) constraints. Each cycle is started by E1 and terminates with S4. E1. All inputs are set to undefined. S1. All outputs become undefined. E2. Some (but not all) inputs become defined. S2. All outputs remain undefined. E3. All inputs become defined. S3. All outputs become defined. E4. Some (but not all) inputs become undefined. S4. All outputs remain defined. The intermediate steps of the environment E2 and E4 (and, correspondingly, S2 and S4) may be sipped. Note that this behavioral specification implies that outputs alternate between de f ined

4 - 4 - and unde f ined values, and no 10->01 transition is allowed. The circuit that implements the CL module consists of four subnets interconnected as shown in Fig. 1a. Subnets ORN, CEN, OUTN handle the timing handshae and control, while subnet DRN performs the Boolean functions of the CL. The full circuit is shown in Fig. 1b. Subnet ORN ORN detects when each of the inputs has become defined (or undefined). It consists of n 2- input OR-gates (and hence its name). The inputs I = { x 0 1,x 1 1,...,x 0 n,x 1 n } to the networ also constitute the inputs to ORN. The outputs of ORN are the set W = { w 1,...,w n }. Note that both x 0 i and x 1 i are never 1 simultaneously. Hence it can be shown that: 1. As long as all the inputs are undefined, all the w i s are Only after all the inputs are defined, all the w i s become 1. Subnet CEN CEN detects when all the inputs have become defined (or undefined). It consists of a single n-input C-element (CE) [Se80]. Its input is the set W produced by ORN. It has a single output y. The CE behaves as follows: 1. When all the w i s are zero, y = 0. When all the w i s are one, y = In all other cases, y retains its previous value. Subnet DRN DRN implements the Boolean functions of the CL. This is a combinational double-rail networ with input I (same as the input to ORN) and output F = { F 1 0,F 1 1,..., F m 0,F m 1 }. DRN satisfies the following conditions:

5 If all inputs are undefined, all F j s are zero. 2. Once all the inputs are defined, then eventually the F j s will assume the two-rail coded values of the desired Boolean functions. The transitions are monotonic, i.e. if a value changes from 0 to 1, it will do so in a single transition, and similarly for a change from 1 to 0. One way to achieve a monotonic networ is to use only AND and OR gates. Note that (1) only the double-rail implementation of DRN must be monotonic, but it can implement any Boolean function, including non-monotonic ones; (2) implementations other than AND/OR gates are also allowed, but in this paper we assume an AND/OR implementation. Subnet OUTN OUTN holds the output values of the CL. This subnet consists of 2m 2-input C-elements. 3. The CL is Self-Checing The fault model assumed in this paper considers single stuc-at faults on wires, namely the stuc-at-zero (s a 0) and stuc-at-one (s a 1) faults. In this section we show and prove that CL is self-checing, in the sense that if the CL contains a fault, it will change its operation and will not produce erroenous results. Definitions An output state is called steady if either (1) all outputs are defined, or (2) all outputs are undefined, or (3) some outputs are defined and some outputs have the value 11. Value 11 does not belong to the set of legal values, and is defined as illegal. A self-timed module is said to be in a hung up state if, after the environment has produced activity E i, the module fails to enter state S i. In such a case the cycle of activities is halted.

6 - 6 - The system is self-checing w.r.t. a fault t and a sequence of environment transitions E1-E4 if either the system produces the correct outputs, or the system goes into a hung up state, or the system reaches an illegal steady state. The system is self-checing w.r.t. a fault model T if, for every fault t T, the system is self-checing w.r.t fault t and every environment transition sequence E1-E4. It should be emphasized that a certain mechanism must be employed to detect the hung-up and illegal states. In the former case, a simple watchdog timer may suffice to detect a hung-up CL. In the latter case, an AND gate on each double-rail output can turn on the alarm upon entry to the illegal state. Theorem 1: The system CL is self-checing w.r.t. to the wire stuc-at fault model. Proof: To prove this theorem, we investigate the effect of s-a-0 and s-a-1 on each of the wires of the CL. Thus, as can be seen in Figure 2, we have to consider each fault in nine different locations. Case 1a: Wire x i A, an input to ORN, is s-a-0 Note that the input stem X i ( = 0, 1) feeds into both ORN (as x i A ) and DRN (as x i B ). For this fault to be observable, we assume that E3 has been applied by the environment, namely all inputs are defined, and that x i = 1 and consequently x i = 0. Without a fault, this state leads to all OR gates in ORN producing 1 s. Since both inputs to the i th OR gate are zero as a result of the s-a-0 fault, its output remains zero. Consequently, the output y of CEN (which was set to zero at state S1) remains zero as well. Thus, the outputs of subnet OUTN (which were set to zero at state S1) also remain zero. It follows that the CL will not reach state S3, hence it is hung-up. Note that have we started from any state other than E3, the CL and its environment would have proceeded

7 - 7 - without any problem until reaching E3. This proves that CL is self-checing w.r.t. fault s-a-0 on wire x i A. Case 1b: Wire x i A is s-a-1 This case is similar to case 1a, except that it is observed after E1 has been applied, i.e. all inputs are made undefined. In this case the output of the i th OR gate remains one, and y fails to switch to zero. Consequently, as above, the outputs do not become undefined, hence the CL does not reach state S1, i.e. it is hung-up. This proves that the CL is self-checing w.r.t. fault s-a-1 on wire x A i. Case 2a: Wire x i B is s-a-0 Assume = 1 (the other case is similar). This fault affects the output when, in state E3, x 1 i = 1, all other inputs to AND gate G are all 1, and the inputs to the CL are such that all inputs to the OR gate D, except line m i which is coming from G, are zero. Without a fault, m i should be 1, the output F 0 j of OR gate D should be 1, and eventually the corresponding CL output f 0 j also switches to 1. In the presence of the fault, line m i is zero, hence F 0 j and f 0 j also remain zero. Thus, the CL fails to reach state S3, i.e. it is hung-up. Case 2b: Wire x i B is s-a-1 Again we consider only = 1. Assume that E3 is applied such that x i 1 = 0, all other inputs to AND gate G are 1, and if there were no fault then the CL would have computed F j 0 = 0 and F j 1 = 1. In the presence of this fault, F j 0 becomes 1, and eventually we get f j 0 = f j 1 = 1, an illegal state. Case 3a: Wire x i is s-a-0

8 - 8 - This is a stem fault situation, which implies both cases 1a and 2a. Both cases led to hung-up state after application of E3, and in both cases the hung-up states consisted of some or all of the outputs undefined. Note that case 1a led to one input of a CE inside OUTN to be fixed at zero, while case 1b led to the other input of the same CE to be fixed at zero. In both cases, the result is that the output of that CE is fixed at zero. The present case leads to both inputs of the CE to be fixed at zero, and the CE s output is again zero, leading to the same hung-up state. Case 3b: Wire x i is s-a-1 This stem fault case leads to cases 1b and 2b. The former case led to a hung-up state after E1, whereas the latter case resulted in an illegal state after E3. Thus, the present state leads to the same two outcomes, and CL is self-checing also w.r.t. faults on an input stem. Cases 4 through 9 (as mared in Figure 2) are all similar in principle to the cases analyzed above, and the proofs of the self-checing property are straightforward. The only interesting exception is case 5b: Wire m i is s-a-1. In all other cases, the CL produces a self-chec (hung-up or illegal state) on either E1 or E3 (depending, of course, on the specific input values), but functions properly on the other environment state (E3 or E1, respectively). In case 5b, the CL produces a selfchec in both situations: It can get hung-up after E1 and may produce an illegal output after E3. Q.E.D 4. The Self-Timed Master-Slave Register The self-timed master-slave register (MS) is shown in Figure 3 [DGY92b]. It has n double-rail data inputs, one optional binary input acin, n double-rail data outputs, and one binary acout output. The sequential behavior of the MS and its environment is constrained by the following cycle of activities, similar to the CL above. E0 and S0 represent the

9 - 9 - initialization of the MS (we ignore here the details of initialization); thereafter each cycle starts with E1 and ends with S6. E0 S0 E1 S1 E2 S2 The input vector Y is set to undefined, and acin is set to 0. The output vector y is set to the initial-state defined value, and acout becomes 1. Some (but not all) inputs become defined. All outputs remain defined. All inputs become defined. All outputs become undefined. The value of the input-vector Y is saved inside the register as vector v. E3 The acin line is set to 1. S3 The acout line assumes the value 0. E4 S4 E5 S5 Some (but not all) inputs become undefined. All outputs remain undefined. All inputs become undefined. All outputs become defined and assume the values which were stored in v at state S2 above. E6 The acin line is set to 0. S6 The acout line becomes 1. MS registers can be used by themselves, or in conjunction with CL circuits to construct finite state machines (FSM). 5. The ST-MS is Self-Checing In this section we use the same notation and definitions as in Section 3, and prove the selfchecing property of the MS. Theorem 2: The MS is self-checing w.r.t. to the single wire stuc-at fault model. Proof of Theorem 2: As can be seen in Figure 4, there are 16 different possible locations of faults on wires in the MS

10 circuit. Each location involves two cases, one with the wire stuc-at-0 and the other with the wire stuc-at-1. Case 1a: Wire Y i A is s-a-0 (=0,1). For this fault to affect the output, we assume that E2 has been applied, such that Y i = Y i A = 1, and Y i = Y A i = 0. Note that E2 follows S1, in which state all outputs are defined, A = 1, and the output of CEN 1 is 0. Since Y i A is s-a-0, both inputs to the OR gate are zero, and hence w i = 0. Consequently, the output of CEN 1 remains zero, line A remains 1, and thus the outputs y do not become undefined. Thus, the ST-MS fails to reach state S2, i.e. it is hung up. This proves that the ST-MS is self-checing w.r.t. wire Y i A s-a-0. Cases 1b, 3, 13, 5, and 6 are very similar to case 1a, all leading to hung-up situations. Case 2a: Wire Y i B is s-a-0 (=0,1). For this fault to affect the output, we assume that E2 has been applied, such that Y i Y i = 1, and = 0. Note that E2 follows S1, in which state the outputs y are defined and hence b i = 0. Also in S1, acout = 1. Since Y i is s-a-0, Y i = Y i v i B = 0. As b i is also 0, it follows that = v i = 0. Consequently, u i = 0, and acout remains 1. Thus, the ST-MS fails to reach state S3, i.e. it is hung up. This proves that the ST-MS is self-checing w.r.t. wire Y i B s-a-0. Cases 2b, 10, 11, and 12 are similar to case 2a. Case 14 combine cases 1 and 2. Case 4a: Wire v i A is s-a-0 (=0,1) For this fault to affect the output, we assume that E5 has been applied, such that v i A v i = 0. Note that since E5 follows S4, the outputs y are undefined, i.e. y i = y i = 1, and = 0. Since

11 v i A is s-a-0, v i A = v i = 0. Consequently, the outputs y i will remain undefined (y i = y i = 0) and the ST-MS will fail to reach state S6, i.e. it is hung up. This proves that the ST-MS is selfchecing w.r.t. wire v i A s-a-0. Cases 4b and 7 are similar to case 4a. Case 15 combines both cases 4 and 10. Case 8a: Wire y i B is s-a-0 (=0,1). For this fault to affect the output, we assume that E5 has been applied such that v i v i = 1 and = 0. Since y i B is s-a-0, b i = 1. Thus, v i fails to become undefined, and consequently acout fails to change to 1, namely the ST-MS fails to reach state S6. This proves that the ST-MS is self-checing w.r.t. wire y i B s-a-0. Cases 8b and 9 are similar to case 8a. Case 16 leads to cases 7 and 8. This covers all the cases, Q.E.D. A self-timed finite state machine (ST-FSM) consists of interconnected ST-CL and ST-MS [DGY92b]. It can be shown that the following corollary is implied directly by Theorems 1 and 2: Corollary: The finite-state machine is self-checing. 6. Conclusions In [DGY92a] and [DGY92b] we have shown an efficient method for the synthesis of selftimed combinational circuits and self-timed finite state machines which may serve as building blocs for the design of complex self-timed systems (see e.g. [DGY93]). In this paper we have shown that combinational logic, master-slave registers and finite-state machines building blocs are self-checing with respect to the single stuc-at fault model. It can be shown that complex

12 self-timed systems composed of these and similar building blocs are also self-checing. A full mathematical proof, based on temporal logic, can be found in [DGY90]. It is quite easy to add to the CL, MS and FSM elements the hardware necessary to detect the occurrence of single stuc-at faults, as far as they interfere with the correct behavior of the circuit. To detect hung-up conditions, a simple time-out circuit has to be added. Invalid outputs can also be detected by simple circuitry. Acnowledgement Robert Johnson introduced us to Self-Diagnosis and motivated this research. References [CB90] [DGY90] Carson G. and Borriello G., A testable CMOS asynchronous counter, Technical Report, Computer Science Dept., University of Washington, Seattle, March David I., Ginosar R. and Yoeli M., Self-Timed is Self-Checing, Technical Report No. 758, Dept. Elect. Eng., Technion, Nov [DGY92a] David I., Ginosar R. and Yoeli M., An Efficient Implementation of Boolean Functions as Self-Timed circuits, IEEE Trans. on Computers, January 1992, pp [DGY92b] David I., Ginosar R. and Yoeli M., Implementing Sequential Machines as Self- Timed Circuits, IEEE Trans. on Computers, January 1992, pp [DGY93] [Eb87] [HR84] [Ma89] [MF78] David I., Ginosar R. and Yoeli M., Self-Timed Architecture of a Reduced Instruction Set Computer, Asynchronous Design Methodologies, IFIP Transactions A-28, pp , March Ebergen J. C., Translating Programs into Delay-Insensitive Circuits, Ph.D. Thesis,Eindhoven University of Technology, D.S. Ha and S.M. Reddy, On Testable Self-timed Logic Circuits, Proceedings of the IEEE International Conference on Computer Design: VLSI in Computers ICCD 84, pp , Martin A. J., Programming in VLSI: From communicating processes to delayinsensitive circuits, in UT Year of Programming Inst. on Concurrent Programming, C.A.R. Hoare (ed.), Addison-Wesley, Marouf, M., and Friedman, A.D., Efficient Design of Self Checing Checers for Any m-out-of-n Code, IEEE Trans. Computers, Vol. C-27, No. 6, pp , June 1978.

13 [MFR85] [Ni87] [Se80] Molnar, C.E., Fan, T.P., and Rosenberger, F.U., Synthesis of Delay-Insensitive Modules, Journal of Distributed Computing, Vol.1, 1985, pp Nicolaidis, M., Evaluation of a Self-Checing Version of the MC68000 Microprocessor, Microprocessing and Microprogramming, Vol. 20, pp , Seitz, C.L., System Timing, in C. Mead and L. Conway, Introduction to VLSI Systems, Addison-Wesley, 1980, pp