One of the most important areas in the development of computer systems is associated with their critical applications, where they are used as instrumentation and control safety-related systems for managing high-risk objects that are widely represented in transport, energetics and other manufacturing and service industries [1,2]. International standards governing the design and use of safety-related systems, impose on them the task of ensuring functional safety of the object and the system itself to prevent accidents and reduce losses in the event of their occurrence [3,4].
Safety is provided by a set of test maintenance procedures for system components during work breaks and their continuous automatic monitoring based on on-line testing methods and tools [5,6]. Components are designed using fault-tolerant solutions based on correction codes, reconfiguration [7,8], as well as majority structures and multi-version technologies to counter common cause failures. Such failures include design errors and faults in chains of common signals that provide reset, synchronization, and other general control functions. Multi-version technologies are based on various types of diversity and are aimed at eliminating a common cause or the same effects in different versions of performing calculations [9].
As a rule, testing and on-line testing is performed by analyzing the result for an error, which relates the appropriate methods and means to the logical checking of digital circuits [10,11]. The source of error is the fault of the circuit. Therefore, the logical checking is performed if the circuit fault can be observed in the calculated result, causing an error in it. This property of the suitability of the circuit to a certain type of checking of its faults is called checkability [12,13].
Thus, the logical checking of the circuit can be performed only within its logical checkability. This conclusion also applies to the effectiveness of fault-tolerant structures and the multi-version technologies used in them [14]. A fault that does not cause an error in the analyzed result is not dangerous for computer systems working only in the operating mode, but creates the problem of hidden faults in safety-related systems designed for operation in two modes: normal and emergency. These faults, including faults in chains of common signals, can accumulate over the course of an extended normal mode and manifest themselves in emergency mode, violating the fault tolerance of the circuits and the safety of systems and control objects [15,16].
The need to support logical checking with other forms of checking and checkability finds a response in the modern level of development of green technologies [17,18] and FPGA design [19,20]. At the intersection of these areas, the evaluation of circuits for their energy consumption is improving.
On-line testing methods based on measuring the temperature of the circuits in the course of their work are known [14]. We propose a method that continues this direction in relation to faults in chains of common signals based on the capabilities of modern CAD systems in estimating consumption currents.
Faults in chains of common signals have a significant impact on the energy consumption of the circuit. Monitoring of common signals is carried out within the frame of power-oriented checkability, which marks the bottom level of current consumption with proper functioning of the circuit. The proposed method detects the impossible (with the correct operation) decrease in dynamic component of the current consumption in case of a fault in the chain of common signal.
Section 2 describes logical checking problems that limit the ability to detect faults in chains of common signals for safety-related systems and highlights bitwise pipelines that show the greatest logical checkability. Section 3 notes the possibilities of modern FPGA design in the evaluation of circuits in their power consumption and formulates the main points of the method of common signals monitoring. Section 4 presents the results of experiments on the use of the suggested method in a bitwise pipeline using the example of detecting synchronization errors of a shifting register.
Logical checking problems begin with its checkability. At the same time, the restrictions imposed on the checking of the circuit by appropriate checkability are also the motivation for its increase.
Logical checkability can be refined for testing and on-line testing as forms of logical checking.
Circuit testing is limited to testability, i.e. the suitability of the circuit for developing tests that detect faults. Testability refers to logical checkability, which is characterized as structural, since it is completely determined by the structure of the circuit. Structural checkability is enhanced by methods and means of testable design, which is aimed at the formation of the structure of the scheme with a high degree of controllability and observability of its internal points [21,22].
On-line testing is limited to logical checkability, which is characterized as structurally functional, since it is determined not only by the structure of the circuit, but also depends on its input data. Therefore, an increase in the structurally functional checkability of the circuit can be achieved on the basis of two approaches: the improvement of its structure, and a change in the character of the input data.
The matrix structure orients the digital circuit to receive and process of input data in parallel codes. This introduces major limitations to the controllability and observability of the interior points of the circuit. Therefore, the first approach, as a rule, is based on the reduction of matrix structures. The processing of approximate data in floating-point formats [23,24] demonstrates this approach in the use of truncated arithmetic operations with mantissas [25]. Residue checking of abbreviated operations performed in matrix arithmetic nodes is described in [26,27].
Both approaches are implemented in bitwise pipelines, which reduce the matrix of operational elements in the pipeline section to one element. At the same time, the nature of the input data changes, which are represented by sequential codes. The structure of bitwise pipelines is based on scanning registers, which are elements of testable design [28].
The fault-tolerant circuits used in the digital components of safety-related systems are also limited by logical checkability, which reflects the characteristics of these systems to separate the operating mode into normal and emergency [29].
The result of this separation is the following chain of consequences: Various input circuit data in these modes; Various structurally functional checkability, characterized as dual-mode; A new type of faults hidden in normal mode due to the lack of input data showing them and violating fault tolerance of circuits on other input data in emergency mode. The problem of hidden faults has not yet received a safe solution. Detection of hidden faults that can accumulate in the chains of common signals is still performed using simulation modes, that recreate emergency conditions and not once led to them as a result of unauthorized activation by malfunction or with human participation [30,31].
It should be noted that testability, as the simplest form of logical checkability, is the greatest. Structurally functional checkability is limited from above by testability because it has an additional limiting dependence on the input data. Dual-mode checkability is the least. It is bounded above by the structurally functional checkability of the normal mode, since does not consider faults hidden in emergency mode.
Therefore, it is important to increase dual-mode checkability both at the level of testability and at the level of structurally functional checkability. This solution is to perform calculations on bitwise pipelines:
Their register structures combine scanning register functions that increase testability in testable design; Minimal matrix structures in the sections of the pipeline increase the structurally functional checkability of the circuit; Processing data in sequential codes evens out the variety of input data and structurally functional checkability of the circuit in normal and emergency modes and in this way improves dual-mode checkability. Thus, logical checking is not sufficiently ensured by the checkability of circuits in the components of safety-related systems and needs to be supplemented with other forms of checking, in particular, to detect hidden faults in chains of common signals.
It should be noted that from the point of view of logical checking, the most checkable solution for safety-related systems is the design of their digital components based on bitwise pipelines.
The method of monitoring of the common signals is based on power-oriented checkability, which is provided by the circuit with the support of FPGA design methods and tools developed in green technologies. Modern FPGA-oriented CAD systems contain utilities that model a FPGA project to estimate its power consumption. The simulation results are estimates of currents consumption: the total current and its dynamic and static components. These results can be obtained for different activity of the input signals, which is given as a percentage of the activity of the clock signals. Reducing the activity of the input signals leads to a decrease in current consumption. Fault detection in the chain of common signals is based on the manifestation of this fault in the form of a decrease in current consumption in its dynamic component due to a decrease in the number of switching signals in the circuit. Such a manifestation of a fault is characteristically for synchronization signals, reset signals and other general control signals. Fault of the common signal blocks the operation of the circuit or its part, as a result of which we can expect a significant decrease in switching activity, as well as the dynamic component and the total current consumption.
The method detects a fault if the current consumption drops below the minimum possible level when properly functioning. This threshold I PT.MIN of fault detection is marked by power-oriented checkability, which takes into account:
The minimum total current consumption I PT , which is determined by simulation at zero activity of input signals; The error δI PT of simulation when estimating total current consumption; The error δI M of measuring the current consumption by the sensor in the process of common signals monitoring.
The fault detection threshold is determined by the following formula:
As a rule, CAD systems simulate and sensors measure the current consumption with an error not exceeding δI PT = δI M = 0.5%, which determines the fault detection threshold at the level: I PT.MIN = 0.99 I PT .
We consider the proposed method for a bitwise pipeline on the example of a shifting register to the right, which consists of n series-connected triggers, numbered from The decrease ΔI PT of the total current consumption, which is manifested in the reduction of the dynamic component ΔI PTD while maintaining the static component, is determined by the following formula:
The possibilities of the proposed method are governed by the minimum decrease ΔI PTD MIN in the dynamic component of the current consumption, which is achieved under the condition x = n -d + 1, i.e. in the case of the location of all disabled triggers in a row at the right end of the shifting register.
The minimum decrease of the total current consumption and its dynamic component is determined from the formula (1) as follows: The method uses the total current consumption I M , measured by the sensor [32], and the fault detection threshold I PT.MIN . In case of I M < I PT.MIN , the method identifies the fault.
For the experimental evaluation of the proposed method in the Quartus Prime 18.1 Lite Edition CAD system [33] the VHDL-project of a 32-bit shifting register with information input SI, reset input Res, clock inputs CLK for each individual register trigger, and information SO output has been created (Fig. 1).
The project was implemented on Intel Max 10 FPGA 10M50DAF672I7G [34]. Setting the time characteristics was made in the utility TimeQuest Timing Analyzer [35].
Setting activity values А I of the input and internal signals of the circuit, and modeling the total current consumption I T of FPGA core, as well as its dynamic I D and static I S components, was performed by the PowerPlay Power Analyzer utility [36]. Currents I T , I S , I D modelling results are given in Table 1.
Tab. In Table 1, value I PT = 17.59 of current I T for the case d = 0 and A I = 0 is highlighted in bold. This value is used to calculate the fault detection threshold I PT.MIN = 17.41. In the columns, where d > 0, the values of the current I T is highlighted in bold when it is below the I PT.MIN threshold, i.e. in case of fault detection. The total current consumption I T d=4, 8, 12 when d triggers are disconnected is calculated by reducing the current I T d=0 by the value ΔI PT MIN = I D d / 32. This expected current value is compared with the current I T , obtained for the corresponding d experimentally (Table 1). The error δ T d=4, 8, 12 is calculated by the formula:
Methods and tools for testing and on-line testing, as well as fault-tolerant solutions are the basis for ensuring the functional safety of safety-related systems. However, the possibilities of these approaches, combined by the features of logical checking, are significantly limited by the structural, structurally functional, and dual-mode checkability of digital circuits, respectively. The lack of dual-mode checkability, the carriers of which are matrix digital circuits in the components of safety-related systems, creates in them the problem of hidden faults. These faults pose a significant threat to the safety of systems and control objects in critical applications. The use of hazardous imitation modes that recreate emergency conditions to detect hidden faults is an indisputable proof of the significance of this problem, which prevents fault-tolerant solutions from becoming fault-safe.
In conditions of limited structurally functional checkability of digital circuits in normal mode, many faults can become hidden. In this case, faults in chains of common signals can cause serious functional disturbances in the system components and manifest themselves with the transition to emergency mode. Means of online testing can be blocked by such faults or taken for the correct state of the circuit, fixed by the fault.
Logical checking of circuits in critical applications requires the involvement of other forms of checking.
The suggested method of common signals monitoring continues the development of approaches that take into account the energy impact of faults on the operation of the circuit. Known solutions that perform temperature monitoring of circuits take into account changes in power dissipation using temperature sensors. The proposed method uses the achievements of green and FPGA technologies, which allow to detect the energy trace of faults based on much more accurate estimates of current consumption.
The method is shown for bitwise pipelines that have the greatest logical checkability in critical applications, using the example of a shifting register and a fault in the synchronization of its triggers. The results of the experiments have showed high efficiency of the method and their good convergence with the theoretical estimates of the method.