performed [4], [5], but the exact analysis has been regarded as extremely probability of two transient errors occurring in the same time period

Transcription

1 578 Work is currently underway to extend these results to handle sequential circuits as well. In combinational circuits it is possible to determine output probabilities in one step. However, sequential circuit modeling requires not only the input probabilities, but also the distribution of the input probabilities over time. It was found that if a uniform distribution is assumed, then the probabilistic modeling of a sequential circuit could be carried out using a Markov analysis. Further study is needed to handle more general input distributions. ACKNOWLEDGMENT The authors would like to acknowledge the help of R. C. Ogus in preparing the final manuscript. REFERENCES [1] S. B. Akers, Jr., "On a theory of Boolean functions," J. Soc. Ind. Appl. Math., vol. 7, no. 4, Dec [2] M. Ball and F. Hardie, "Effects and detection of intermittent failures in digital systems," in 1969 Fall Joint Comput. Conf., AFIPS Conf. Proc., vol. 35. Montvale, N. J.: AFIPS Press, 1969, pp ] D. Bastii et al., "Probabilistic test generation techniques," in Dig Int. Symp. on FaultTolerant Computing, Palo Alto, Calif., p [4] E. J. McCluskey, Introduction to the Theory of Switching Circuits. New York: McGrawHill, ] R. C. Ogus, "The probability of a correct output from a combinational circuit," IEEE Trans. Comput., this issue. [61 K. P. Parker, "Probabilistic test generation," Dig. Syst. Lab., Stanford Univ., Stanford, Calif., Tech. Rep. 18, Aug [7] K. P. Parker and E. J. McCluskey, "Probabilistic treatment of general combinational networks," IEEE Trans. Comput., vol. C24, June 1975, to be published. [8] F. Sellers, M. Y. Hsiao, and L. W. Bearnson, "Analyzing errors with the Boolean difference," IEEE Trans. Comput., vol. C17, pp , July ] S. Kamal and C. V. Page, "Intermittent faults: A model and detection procedure," IEEE Trans. Comput., vol. C23, pp , July A Combinatorial Solution to the Reliability of Interwoven Redundant Logic Networks JACOB A. ABRAHAM AbstractA combinatorial procedure is given to calculate the reliability of an interwoven redundant logic network to any desired degree of accuracy. The procedure consists of enumerating combinations of gate failure which are tolerated by the redundant network, and is explained with reference to a quadded logic network. Since the exact reliability calculation might be too time consuming for large networks, a formula is given for a lower bound which can be used in conjunction with the exact method to give a very accurate reliability figure with a comparatively small computation time. Index TermsFault pattern enumeration, interwoven redundant logic, quadded logic, reliability analysis I. INTRODUCTION One of the techniques proposed for achieving high reliability in digital systems is the use of circuits which correct errors as well as perform the desired logic function, such as quadded logic [1] and radial logic [2]. This type of circuit has been generalized by Pierce [3], who called it interwoven redundant logic. The problem addressed in this paper is to find the exact reliability Manuscript received July 8, 1974; revised November 15, This work was supported in part by the National Science Foundation under Grants GJ40286 and GJ36392X. The author is with the Digital Systems Laboratory, Stanford University, Stanford, Calif of such networks. Approximate analyses of the reliability have been performed [4], [5], but the exact analysis has been regarded as extremely difficult and costly [6] [7]. The reliability of a network ir the probability that it functions correctly. This will be calculated as a function of the reliability or the failure probability of a gate, with certain assumptions. If a gate fails so that it gives an intermittent oi transient error at its output, this will be corrected imrnmediately unless another gate gives a wrong output at the same time. The probability of two transient errors occurring in the same time period is very small. Furthermore, no data are available in general on the probability of intermittent failures of a gate. Therefore we will consider only permanent failures of a gate, and will use the model described in the next paragraph. It will be assumed that logic gates will fail in the "stuckat" mode, giving a constant zero or one at their output. The rationale of this model has been examined [8] and it has been shown that many failure modes of a gate exhibit the same behavior as stuckat failures and can be modeled as such. In addition, many "bridging" faults, caused by wrong connections between lines in a network, can be modeled as stuckat faults [9]. Therefore it will be assumed that any failure of a gate which cannot be modeled as a stuckat fault (such as a failure which introduces memory in a combinational circuit or causes oscillations) will cause the network to fail. We will also assume that the networks have been designed properly so that the error correcting properties of the redundancy scheme apply throughout the network. In this paper we will mainly consider a specific example of interwoven redundant logic, namely quadded logic. Quadding may be accomplished by different types of logic gates, but we will consider quadded NOR logic. An example is given in Fig. 1. Fig. 1 (a) shows the nonredundant and Fig. 1 (b) the redundant network. The set of redundant gates which replaces each gate in the nonredundant circuit is often called a redundant functional unit; in the case of quadded logic, we call it a quad. The analysis technique presented is sufficiently general and can be easily applied to other interwoven networks [10]. A fault or failure in a component is a physical malfunction which could cause an error or incorrect logic value at the output of the component. Quadded logic is designed to correct all single incorrect logical zero and incorrect logical one errors and many multiple ones in a logic network if the proper interconnections are made, i.e., if the pattern at the output of a quad is different from the interconnection patterns of any of the quads at its input [1], [4]. II. DEPENDENCE IN A QUADDED NETWORK A set of faults occurring in a quadded network may be called a fault pattern. Fault patterns are explicitly denoted by the notation la1/li,a2/12,,aan/ln where each ai is the label of one of the leads of the network or a gate output and each li is 0 or 1. The notation ai/li specifies that lead a, or gate output ai is stuckat the logical value li. Two kinds of errors are caused by faults, critical and suberitical. An error is said to be critical if its occurrence at the input of a gate causes it to give a wrong output, and subcritical it it does not do so. It can be seen that for quadded NOR logic, stuckat0 faults cause suberitical errors. For NAND networks it will be the other way around. For networks made with alternating levels of AND and OR gates [l], the faults which cause critical errors will also alternate, being stuckat0 at the input of AND gates and stuckati at the input of OR gates. A fault which causes a critical error is called a critical fault. We will be interested in sets of criticalfault patterns. Because of the symmetry of the gates in a quad, we do not need to know which of the gates in a quad has a critical fault. Therefore, a critical fault pattern can be concisely denoted by IQli,Q222,. Qi}, where ji E 11,2,3,4). The Qiii means that quad Qi has ji critical faults. The cardinality of a critical fault pattern is the sum of the ji's in it. This is the total number of critical faults in the pattern.

2 CORRESPONDENCE 579 xy + iy (a) (b) Fig. 1. Network used in reliability example. (a) Nonredundant network. (b) Quadded NOR network. A quad Qi is said to feed another quad Qi if there are lines connecting the outputs of Qi to the inputs of Q;. If two quads Qi and Qi feed the same quad, this relationship may be denoted concisely by QiFQj. We can specify that QiFQi in order to make the relation reflexive. Given a set of quads (Q,,, two quads Qi and Qi in the set are defined to be dependent if QiFQ, or if there exists a sequence of quads in the set {Q1,Q2,.,Q7} such that QiFQ,,Q,FQ2, * *,QFQi. This is illustrated in Fig. 2, where a quad is represented as a block, and only one of the interconnecting lines is shown. For example, 1F2 and 1F3. Given the set of quads (1,3,41, 1F3 and 3F4. Therefore in the set, 1 and 4 are dependent. Note that if the set were (1,41, they would not be dependent. It is easily seen that the dependence relation is an equivalence relation. Therefore any set of quads can be partitioned into equivalence classes by the relation. These classes are called classes of dependent quads, and the classes themselves are said to be independent of each other. It should be noted that if the given set is the set of all quads, then there is only one equivalence classall quads are dependent on each other. A fault pattern in a quadded network is said to be tolerable if, for all possible inputs to the network, all suberitical errors at the outputs of a quad are corrected by the quads which it feeds, and all critical errors at the output of a quad introduce only tolerable subcritical errors at the outputs of the quads which it feeds. For example, in Fig. 1 (b) the fault pattern {2a/1,2b/0 I would be tolerable, since the suberitical errors due to 2b/0 will be corrected by the correct value on 2c, and the critical errors due to 2a/1 will cause the tolerable subcritical errors {4a/0,4d/01. On the other hand, the fault pattern (la/0,lc/01 could, for some set of input values, cause the set of errors {2a/1,2c/1} or the set 13a/1,3c/1) or their union; all these error patterns will not be corrected subsequently, and the fault pattern {la/0,lc/0j is not tolerable. Note that a tolerable critical fault pattern (Q1io,Q2i2,. *.,Qin I will have the ji E (1,2} for if ji = 3 or 4 no fault pattern will be tolerable. The reliability of a quadded network is defined as the probability that only tolerable fault patterns occur in the network. This is the sum over all mutually exclusive tolerable fault patterns of the probability of occurrence of the patterns. Therefore, in order to find the reliability, we have to find all the tolerable fault patterns of the network. The reliability will be found as a function of the probabilities that a gate output will fail to stuckati (pi) and stuckat0 (p0), respectively, and the probability that the gate will not fail (R). R will not be equal to (1 (pi + po)) if there are failure modes that cannot be modeled as stuckati or stuckat0. The probability that a line will fail to a stuckat value can be incorporated into the probability that the gate which has the line as output will fail. The following discussion will concentrate on errors at the outputs of gates. We will briefly discuss later how errors at the inputs of gates may be modeled. The approach taken to find the reliability of a network will be to enumerate complex patterns in terms of simpler fault patterns in the network. For example, consider the part of a network shown in Fig. 3. Table I enumerates the tolerable fault patterns for the subnetwork. The entries are obtained from the properties of a quadded network. As an example, if Qi has one critical fault, it can have a subcritical fault in three ways: any one of the other three gates in the quad may fail to a suberitical stuckat value. On the other hand, because of the critical fault in Qi, Qk has two gates which have outputs stuckat a suberitical value; either of these gates may fail to a suberitical stuckat value, but neither of the other gates may do so without a fatal error, so that Qk can have a suberitical fault in two ways. Other entries of the table are obtained in a similar manner. The results are formalized in the lemmas below. The proofs may be found in [10]. Lemma 1: Given a set of dependent quads tqq,q2,,q }, the number of tolerable critical fault patterns of the type IQi",Q2s,..,

3 580 Fig. 2. Illustration of dependent quads. QQ k Fig. 3. Portion of a complex quadded network. TABLE I ENUMERATION OF TOLERABLE FAULT PATTERNS FOR THE SUBNETWORK OF FIG. 3, GIVEN VARIOUS CRITICAL FAULT PATTERNS FOR QUAD Qi Critical Suberitical Critical Qi Q j Qk Qi Qk Q S Q,j I is equal to 2. II 2/j,, ji E 11,2 1. Lemma 2: Given a critical fault pattern JQ1'1,Q2i2,...,Qn}, the number of ways in which a quad Qi can have one or two tolerable subcritical faults, denoted by 1i and mi, respectively, is as follows. If Qi E IQlQ2*)',Q}, then if Qi is fed by any of the quads in the set, if 1i = 2/ji mi = 2/ji 1; Qi is not fed by any of the quads in the set, 1i = 2/ji + 1 Mi = 4/ii 2. If Qi < {Q1Q2, * Qn 1, then if Qi is fed by any of the quads in the set, 1i = 2 Mi= 1; if Qi is not fed by any of the quads in the set, 1. = mi = 4. Given a critical fault pattern tqiil,qs2,..q) j, n we can therefore define two vectors L = 1 and M = mi associated with it. These give the number of ways in which each quad can have one and two subcritical faults, respectively. III. DETERMINATION OF THE RELIABILITY OF A QUADDED NETWORK Suppose we are given a network of n quads, Q1,Q2,.,Qn. The topology of the network may be represented by the structure matrix S of the network. This is defined as an n X n matrix, with S (i,j) = 1, if quad Qi feeds Qi = 0, otherwise. It can be seen that QpFQg if the logical bitbybit AND of rows p and q is not the zero vector. This gives an easy method to partition a set of quads into independent classes. The set of tolerable fault patterns of the network is given by the fault matrix F which is defined to be a (2n + 1) X (2n + 1) matrix such that F (i,) = number of ways in which exactly i critical and j suberitical tolerable faults may occur in the network. The theorems below show how F may be obtained for a network. The

4 CORRESPONDENCE TABLE 11 STRUCTURE MATRIX OF NETWORK OF FIG. l(b) [ ] proofs follow from the lemmas in the previous section and are detailed in [10]. Theorem 1: For a critical fault pattern IQli1,Q2'2.,Qnin } where the set {Ql,Q2,,Qn} can be partitioned into m independent classes, the number of ways in which the tolerable critical faults can occur is given by G.= ri [2. II 2/iij]. all m classes k ji E Iclass k } Theorem 2: Given a critical fault pattern {Q1il,Q2ih,...,Q,in with sets L and M, the number of ways in which exactly k tolerable subcritical faults can occur is given by G, (k), the sum over all twotuples (p,q) such that p + q < n and p + 2q = k, of all the products of the form where r = p + q, (pn2 q P + q Xil,Xi2,.. )Xir {ij,i2, * *ir) C {1,2,***,n),I each x,i E Il},mjj), and there are exactly p elements from L and q elements from M. As an example; if n = 4 and k = 5, the twotuples are (3,1) and (1,2). The products corresponding to (3,1) are * 13 * M * m$ * m m, 12 * Theorem 3: The entries of the fault matrix are given by F(i,j) = GEG.G(j). all critical fault patterns of cardinality i Corollary 1: The reliability of a quadded network is given by RQ = E E F (i,) pliipoi R4n(i+i) O4i<2n Oj4.2n where pi po R probability that a gate fails stuckati probability that a gate fails stuckat0 probability that the gate does not fail. The first row of the fault matrix gives the number of ways in which only suberitical faults can occur. This can be found without enumeration, as given by the following theorem. Theorem 4: The first row of the fault matrix is given by jc n /) :k) F(0,) = }1 ]4tk. A; k/ k/ Here we assume that the binomial coefficient =n\ xk: if k < 0 or k > n. These results may be used to calculate the reliability of a quadded network. Fig. 1 is chosen as an example. The structure matrix is given in Table II. Table III shows part of the process of enumerating G, and G, (i) for all the critical fault patterns. Table IV gives the fault matrix of the network. The probability of failure of the quadded network in Fig. 1 (b) is plotted as a function of gate probability of failure in Fig. 4. A logarithmic scale is used because gates usually have a low probability of failure and we would like to expand that region. As a comparison, the probability of failure of the nonredundant network, as well as that of a TMR network formed by triplicating the nonredundant network, is also plotted. The curve for TMR takes compensating failures into account. It can be seen that the quadded network has a lower probability of failure than a TMR network. This is because the quadded network can tolerate more failuressome triple failures in a quad are tolerable. Input failures of a gate may be considered in the following manner. If the input of a gate fails to a critical value, this can be modeled as the gate failing to a suberitical value at the output. All the inputs of a gate failing to suberitical values can be modeled as the output of the gate failing to a critical value. Therefore we need to account only for some of the inputs failing to subcritical values. This could be done by using another vector (say K) in the same manner as vectors L and M to count the number of ways in which tolerable input subcritical failures can occur. Doing this increases the complexity of the process; considering only output failures gives a lower bound on the reliability. The reliability of other interwoven networks can be calculated in a similar fashion; a radial logic example is given in [10]. IV. APPROXIMATE RELIABILITY ANALYSIS The computational complexity of the algorithm given earlier can be shown to be of the order 3N, where N is the number of quads in a network [10]. This is because all the tolerable critical fault patterns of a network are enumerated. A lower bound can be obtained for the entries of the fault matrix without enumeration from ln/ k \ nk k ' F(i,) > 2 O ()( )E C 2t, k beoe Hker ai i t at Here, as before, we assume that (n\ = 0, if k <Oork >n. k i >0. This formula is proved in [10]. A lower bound on the reliability may be found with a greatly reduced complexity by making the exact enumeration for a certain

5 582 TABLE III ENUMERATION OF GC AND GQ (i) FOR THE NETWORK OF FIG. 1(b) (ONLY PART OF THE ENUMERATION IS SHOWN) Gs(i) Critical fault pattern Gc L M TABLE IV FAULT MATRIX OF THE NETWORK OF FIG. 1(b) Suberitical Critical L _ number of combinations and then using the lower bound developed above. The gates which compose a quadded network will usually have error in reliability by using exact values for F up to the a very low probability of failure. Therefore for a large number of Et = t n th low bod f th urem failure combinations, the (pi) term in the reliability equation exactprobablity of failure becomes very small and we are justified in using the lower bound for Note that we divide by the probability of failure to make the paramlarge i. eter more sensitive. To get a measure of the error involved in using this approximate The network of Fig. 1 (b) was analyzed using this parameter. The analysis, we define the fractional error E by curves for Et are shown in Fig. 5 along with the curve for the frac

6 Quadded network h P0 4CO io4 nonredundant network 103 o2 10j ic6 Gate Probability of failure Fig. 4. Probability of failure of the quadded network in Fig. 1 (b), of the corresponding TMR network, and of the nonredundant network in Fig. 1 (a) as a function of gate probability of failure. 16o8 107 ii 6 Fractional Error E t 104 ional error due to cutset model 102 o2i 101 Il 10 1 I? 1I0 10' 1i0 I10 Probability of gate failure Fig. 5. Fractional error in reliability as a function of gate probability of failure when using exact values of F for t rows and the lower bound for the rest of the rows for the quadded network of Fig. (lb). i0

7 584 tional error in using the cutset model. (The minimal cutset model has been used to analyze the reliability of quadded logic [4].) The probability of stuckat zero and stuckat one failures are assumed to be equal. From the curves it can be seen that using the exact values for the zeroth, first, and second rows gives a maximum error of less than 14 percent, while the cutset model gives a maximum error of about 26 percent. Using the exact value for the third row also, we get a maximum error of less than three percent. We thus see that the approximate analysis yields good results with an amazing reduction in complexity. For example, using the exact enumeration for up to the third row implies a complexity of the order of N3, which should be compared with the original computational complexity of 3N. The cutset model, on the other hand, does not give good results in some cases, and there is no way of improving the bound, even if additional computation time is available. The rapid decrease in the error with increasing t can easily be explained analytically. Since some combinations of two failures can cause system failure, the probability of system failure has its leading term in p2, where p is the module or gate probability of failure. When t = 1 the error also has the leading term in p2, which means that El asymptotically goes to a constant for small p. This is shown by the curves. When t > 1, Et has its leading term in ptl; so the error becomes very small as t is increased, and the curve of the error increases to a maximum and then decreases, as can be seen in the figure. When the curve for Et is plotted on a logarithmic scale as shown, the slope for small p can easily be proved to go to (t 1). Thus when we increase the complexity of computation from Nt to Nt+', the slope for the error goes from (t 1) to t; the error decreases very rapidly as the complexity is increased. V. CONCLUSION We have given a method for enumerating all the tolerable fault patterns of a quadded logic network directly from its topology. A lower bound on the number of patterns was given in case the exact enumeration proved to be too time consuming. An approximate method of analysis was described, the results of which were very encouraging: using a technique with a complexity of the order of N2 or N3, one is able to obtain a reliability figure with an extremely small error. The method is sufficiently general to be used with slight modifications for the analysis of other interwoven redundant netwoirks. REFERENCES [11 J. G. Tryon, "Quadded logic," in Redundancy Techniques for Computing Systems, Wilcox and Mann, eds. Washington, D. C.: Spartan, 1962, pp ] T. F. Klaschka, "Reliability improvement by redundancy in electronics systenms. II. An efficient new redundancy schemeradial logic," Royal Aircraft Establishment, Farnborough, England, Tech. Rep , [3] W. H. Pierce, Failure Tolerant Computer Design. New York: Academic, [4] P. A. Jensen, "Quadded NOR logic," IEEE Trans. Rel., vol. R12, pp. 2231, Sept [5] R. Teoste, "Reliability of redundant computers," Lincoln Lab., Massachusetts Inst. Technol., Cambridge, Rep. 21G0029, ASITA Doc , [61, "Digital circuit redundancy," IEEE Trans. Rel., vol. R13, pp. 4261, June ] J. Goldberg, K. N. Levitt, and R. A. Short, "Techniques for the realization of ultrareliable space borne computers," Stanford Res. Inst., Menlo Park, Calif., Final Rep., Phase I, Project 558&t [81 E. J. McCluskey and F. W. Clegg, "Fault equivalence in combinational logic networks," IEEE Trans. Comput., vol. C20, pp , Nov ] K. C. Y. Mei, "Bridging and stuckat faults," IEEE Trans. Comput., vol. C23, pp , July [10] J. A. Abraham, "Reliability analysis of digital systems protected by massive redundancy," Ph.D. dissertation, Stanford UJniv., Stanford, Calif., 1974.