RASP-TMR : An Automatic and Fast Synthesizable Verilog Code Generator Tool for the Implementation and Evaluation of TMR Approach

Triple Modular Redundancy (TMR) technique is one of the most well-known techniques for error masking and Single Event Effects (SEE) protection for the FPGA designs. These FPGA designs are mostly expressed in hardware description languages, such as Verilog and VHDL. The TMR technique involves triplication of the design module and adding the majority voter circuit for each output port. Building this triplication scheme is a non-trivial task and requires a lot of time and effort to alter the code of the design. In this paper, the RASP-TMR tool is developed and presented that has functionalities to take a synthesizable Verilog design file as an input, parse the design and triplicate it. The tool also generates a top-level module in which all three modules are instantiated and finally adds the proposed majority voter circuit. This tool, with its graphical user interface, is implemented in MATLAB. The tool is simple, fast and user-friendly. The tool generates the synthesizable design that facilitates the user to evaluate and verify the TMR design for FPGA-based systems. A simulation scenario is created using Xilinx ISE tools and ISim simulator. Different fault models are examined during simulations such as bit-flip and stuck at 1/0. The results using various benchmark designs demonstrate that the tool produces synthesizable code and the proposed majority voter logic perfectly masks the error/failure. Keywords—Fault injection; fault tolerance; reliability; single event effects; triple modular redundancy; Verilog HDL


I. INTRODUCTION
The Field Programmable Gate Array (FPGA) has been a widely accepted solution in developing the embedded system during the last few decades.Owing to its remarkable features such as parallelism, reconfiguration, separation of functions, self-healing capabilities, and overall availability [1], the FPGA has become the core of many embedded applications.The major applications include aerospace, biomedical instrumentation, safety-critical systems, spacecraft, Internet of Things (IoT), and many others [2], [3].However, FPGA-based devices are susceptible to Single Event Effects (SEE) caused by various sources such as, α-particles, cosmic rays, atmospheric neutrons, and heavy-ion radiations.Since the capacity of FPGA chip has been growing by reducing the size of components integrated on the chip.This makes the device more prone to SEEs which provoke Single Event Upsets (SEU) in memory elements and Single Event Transients (SET) in combinational logic elements [4], [5].
Several SEE mitigation techniques have been proposed in the literature to avoid the effects of such errors in FPGAbased designs [6].The reliability of the FPGA systems is im-proved by various error mitigation schemes such as multipleredundancy with voting, Triple Modular Redundancy (TMR), hardened memory cell level, and Error Detection And Correction (EDAC) coding.Among all SEU mitigation techniques, TMR has become the most common practice because of its straightforward implementation and achieved the reliable results [6], [7], [8], [9].The TMR mitigation scheme uses three identical logic circuits for performing the same task in parallel with corresponding outputs obtained through majority voters.This technique is the simplest redundant technique conceptually and it was invented by Von Neumann [10] in the year 1956.There are certain merits and demerits of TMR technique: • Merits: • Simple and straight forward approach.
• Improves fault tolerance and reliability.
• More power consumption.
• More cost or uneconomical.
FPGA designs are written in Hardware Description Languages (HDL) which describes the designs in various abstraction style, for example, gate, data-flow and behavioural levels.For small designs, gate abstraction style is employed and testing & verification processes are directly and easily applied to the designs.At this level, designs look more similar to the actual hardware representation.Data-flow and behavioural abstraction styles are used to implement the large designs.
Building a triplication scheme into digital designs is not a simple task.It takes a lot of time to build and debug the system.It has been also a laborious and error-prone task.Xilinx Inc. with the help of Sandia lab developed Triple Modular Redundancy (XTMR) tool for the design triplication.XTMR works with HDL and synthesis tool to automatically built TMR methodology.It is designed for the SEU and SET immunity for the FPGA devices, which includes Virtex family of reconfigurable FPGAs [11].It requires two files, with extensions *.ngc (generated by synthesis process) and *.ngo (generated after the NGDBuild process) files, as an input and generates the TMR logic for the design.This tool is vendor specific and only used for Virtex family of FPGA devices.The TMRG (Triple Module Redundancy Generator) tool is developed in Python at CERN research institute, which automates the process of triplication of digital circuits at implementation stage.It is used to mitigate the SEEs.TMRG works on Verilog code and adds the classical majority voter circuit in TMR approach [12].Brigham Young University (BYU) developed BL-Tmr tool [13], which works on EDIF-format design.It parses input EDIF file(s) into a netlist data structure and uses the classification information to select circuit structures for triplication.This tool works for partial TMR approach.Another tool, named TLegUp, which automatically generates Triple Modular Redundant designs for FPGAs from C programs using high-level synthesis technology [14].Recently, some commercial tools such as Synopsys Synplify Premier, and Mentor Precision HiRel are available in the market to implement TMR during the synthesis process [15].Using commercial tools, the cost of the project increases unnecessarily.
In this work, a tool named RASP-TMR Code Generator (RechnerArchitektur und SystemProgrammierung -Triple Modular Redundancy) is presented, of which the first part is the German name of our department.It takes Verilog HDL design file as an input and generates the synthesizable Verilog code for TMR technique.A new and simple majority voter circuit is also proposed.To validate the operation of the proposed tool, a simulation set-up is created with the help of Xilinx ISE tools and ISim simulator.The TMR operation is validated by injecting bit-flip and stuck at 1/0 faults in the design during the simulation, and it has been observed that the proposed majority voter circuit perfectly masks the errors/failures.This tool, along with its graphical user interface, is developed in MATLAB and it requires the users to provide only Verilog module file and then it automatically generates all the designs necessary to perform TMR.Hence, the RASP-TMR tool is simple, fast and user-friendly.To validate these claims, various benchmark designs are evaluated.
The structure of the paper is as follows: Section II explains the structure of the proposed RASP-TMR in detail, along with the proposed majority voter circuit.Section III presents the results of the RASP-TMR tool for combinational and sequential designs from ISCAS'85, ISCAS'89, and EPFL benchmark designs.Finally, Section IV concludes the paper.

II. PROPOSED RASP-TMR CODE GENERATOR
The RASP-TMR code generator tool, with its graphical user interface, is developed in MATLAB.It is a tabbed based tool and Fig. 1 shows these tabs.The first tab depicts the information about the tool, whereas, the second tab consists of the RASP-TMR tool.The tool consists of 9 functions and 254 lines of code in MATLAB.To provide ease of use, a standalone app is created using MATLAB command deploytool.This app is installed by the user on any host machine, having a Windows operating system.This tool not only triplicates the design and generates Verilog top file but also instantiates the designs in the top file.The proposed majority voter circuit is added for each output port of the design.Fig. 2 depicts the flowchart of the RASP-TMR tool, which includes the series of operations performed by RASP-TMR code generator tool.The RASP-TMR tool accepts a Verilog design file as an input, parses it, obtains tokens (input arguments, output arguments) and makes three copies of it.Module name and the output argument must be changed in order to differentiate from each other and brought them under  the top-level file.RASP-TMR also generates the top-level module file which includes input arguments, output arguments, instantiation of all three TMR modules and proposed majority voter circuit for each output port.

A. Top File Structure
The top file consists of different components such as triplication of the module, their instantiations, and a proposed majority voter circuit.Fig. 3 shows the general block diagram of the top file generated by the RASP-TMR.These components are described in the sequel.

1) Triplication of Module:
The triple modular redundancy requires the triplication of a module.All three modules operate in parallel.If any of a module fails to perform the intended task or results in an error, it is masked by the majority voter circuit.Therefore, when a module is input to the RASP-TMR code generator tool by the user, it parses the design and triplicates it.It should be noted that the module name changes from c17 to c17 1, which denotes the first module of TMR designs.The other two modules are renamed to c17 2 and c17 3 respectively.The output ports are changed as shown in Fig. 4. It shows the original Verilog design as an example which is input to the RASP-TMR tool (above) and the output of the tool (below).
2) Instantiation Generator: Xilinx ISE design tools provide the built-in instantiation generator for modules available in the design to instantiate one module within another thus creating hierarchy.RASP-TMR has the ability to instantiate the  TMR modules in the top file.The function InstanceGen() is developed under RASP-TMR tool which generates the instantiations.Instantiation requires the module name, produces instance name and adds the information about the input/output ports.Fig. 5 shows the instantiation for the TMR module 1.
3) Proposed Majority Voter Circuit: The TMR scheme involves two-times duplication of the simplex system hardware, with majority voter ensuring correctness provided at least two out of three copies of the system remains operational.Various majority voter designs have been proposed for the last couple  of years.Fig. 6 shows the schematic diagram of majority voter circuits.Fig. 6 (a) shows the classical voter design.Some other majority voter logics are proposed by Kshirsagar and Patrikar voter circuit [16], Ban and Naviner majority voter [17], and Balasubramanian and Prasad majority voter circuit [7].Fig. 6 (b-d) show the schematic of other proposed majority voter circuits, respectively.
In this work, authors proposed another simple way to represent majority voter logic and added to the RASP-TMR tool as shown in Fig. 7.In this figure, T1,T2 and T3 are the inputs of the majority voter circuit.Proposed MVC consists of an AND, OR gates and a multiplexer (2:1).Table I shows the functional verification and correctness of the proposed voter logic.

III. RESULT AND DISCUSSION
The primary purpose of using a TMR design methodology is to remove all single point of failure from the design.If two redundant modules are simultaneously upset, then the output can not be guaranteed to be correct.In order to develop a TMR logic for a target system at a code level, the code needs to be modified for each module and also majority voter circuit is included in the design.This is a non-trivial and timeconsuming task.

A. Synthesizable Designs
Keeping these points in mind, the RASP-TMR code generator tool is developed for Verilog HDL designs.This tool not only triplicates the target systems but also generates the top file (named TMR TopFile).The components of this file are already described in Section II in detail.At the graphical user interface, the user needs to provide only a synthesizable Verilog HDL design as an input (This verifies our claim about the tool's simplicity and easy to use).A simple benchmark circuit (c17.v)from ISCAS'85 is considered as an example for illustration of the whole process.A project is developed using Xilinx project navigator.The synthesis of the design is performed and generated the RTL schematic of the example shown in Fig. 8.This proves that the designs generated by RASP-TMR tool are synthesizable.

B. Timing Analysis
This tool is fast and automatically generate the TMR designs.To prove this point, authors have generated TMR designs for various benchmark designs, written in Verilog.In this work, ISCAS85, ISCAS89, and EPFL combinational and sequential benchmark designs are considered for their generation of TMR technique and measured the time.Tables II to V show the size of the designs in terms of a number of logic gates.Last columns of these tables show the time taken by this tool in Seconds.It is noted that the TMR approach for the designs, consisting of thousands of gates, are generated in a fraction of the second by the RASP-TMR tool.The design "hypotenuse" is the largest design among them, which consists

C. Functional Verification of Proposed Majority Voter Circuit
In this tool, authors also proposed a new majority voter logic.In [7], authors describe the procedure to calculate the Fault Mask Ratio (FMR) for various majority voter circuits.According to them, FMR is the ratio of a total number of correct voter output states divided by the total number of likely internal and/or external faults corresponding to the applied primary inputs.
For classical majority voter circuit, the value of FMR is 42.86%.Similarly, for other majority voter circuits Fig. 6 (b-d), the values of FMR are 70.83,50, 75% respectively.In our case,

D. Simulation Verification using Fault Injection Technique
Fault injection is a useful technique to test the integrity of the TMR system.In order to test and verify the fault tolerance capability of the target design developed under the RASP-TMR tool, simulation of the design is carried-out with the help of Xilinx ISE Design Suite 13.4 tools and ISim simulator.Xilinx ISE is used to develop the project and writing a test bench, while the simulation is performed by ISim tool.A simulation environmental set-up is created and Fig. 10 shows the block diagram of the set-up.It consists of TMR design and a golden (fault-free) module of the design.Faults are injected in the TMR design in each module.When the faults are activated one by one in each module and different combinations of input are applied and then responses are compared.If the comparator output is logic '0', that means both the golden and TMR outputs are the same and the TMR approach masks the faulty module perfectly.In order to validate the approach, a simple benchmark design from ISCAS'85 combinational circuits has chosen.Authors have injected a total of 12 faults in the c17 benchmark circuit in different locations of the design, 4 faults in each TMR module.The way of injecting faults in the Verilog design code is described in our previous work [3], [18], [19].
In the first instance, the 'fault 0' to 'fault 3' are activated in module 1 of the TMR design using the 2-bit vector faultIn1.The input patterns are applied and denoted by input ports (N1, N2, N3, N6, N7).The 'cmp1' signal compares the responses of the golden module with the responses of the TMR approach.Fig. 11 shows that the signal 'cmp1' is continuously at logic '0', which means both the responses are the same.Similarly, the same approach is repeated for the second and third module of the TMR approach and simulation results are shown in Fig. 12 and 13.Hence, it verifies the operations of the TMR approach developed by the RASP-TMR tool and the proposed majority voter circuit.

IV. CONCLUSION
In this work, authors developed a RASP-TMR tool which triplicates any combinational and sequential digital designs.The RASP-TMR tool is simple, fast and user-friendly.The user needs to provide a synthesizable Verilog file as an input, and then the tool creates TMR design along with the proposed majority voter logic circuit.TMR design for various combinational and sequential benchmark circuits is generated and evaluated.The results show that the RASP-TMR tool takes less time to generate the synthesizable Verilog code with TMR technique.Benchmark designs are simulated using Xilinx tools to evaluate the features of our proposed tool.
The future work will add more features to the tool such as TMR with Multiple Voters, Duplication With Comparison (DWC) and N-modularity redundancy for the evaluation of the fault-tolerant capability of FPGA-based designs conveniently.

Fig. 9 .
Fig. 9. Simulation results for the validation of proposed majority voter circuit.

Fig. 10 .
Fig. 10.Simulation environment for the verification of proposed tool.

TABLE I .
TRUTHTABLE VERIFICATION OF PROPOSED MAJORITY VOTER LOGIC FOR TMR T3

TABLE V
calculated FMR for the proposed majority voter circuit is 50% which is better than the classical approach.Authors simulated the proposed majority voter circuit with all possible combinations of inputs.It can be seen from Fig.9that the voter signal has a value logic '0' if the majority of inputs are at logic '0' and vice versa.Hence, this simulation verifies the operation of proposed majority voter logic.It is noted that the the