錯誤摸擬是指在一工程系統中進行某種故障行為的模擬，並且透過模擬的結果來觀察故障可以被偵測到的錯誤覆蓋率 (Fault coverage) 百分比。在工程系統中會希望有高的錯誤覆蓋率的結果，像可測試性設計（DFT）及自動測試圖樣產生（ATPG）等技術也是用來提高錯誤覆蓋率。然而隨著電子設備的演進，待測的工程系統已經越來越複雜，電路模擬的時間將會根據待測系統電路的複雜而成長。所以本篇論文將提高抽象層級(abstraction level) 隱藏系統複雜的細節，讓系統進行錯誤模擬的時間能夠大幅縮短並且將抽象層級錯誤模擬的結果與暫存器傳遞語言 (Register Transfer Language, RTL) 錯誤模擬的結果進行比較確保錯誤模擬的結果是否一致。

現有的暫存器傳遞語言 (Register Transfer Language, RTL)錯誤模擬器，像是 ZOIX能夠提供不同的故障模型進行模擬，但是在會因為模擬速度的限制進而限縮了模擬故障的數量。若是要能夠不失去錯誤模擬結果的正確性又能夠提升故障模模擬的速度，則是本篇論文要探討的重點。

為了能夠解決暫存器傳遞語言錯誤模擬的速度限制下，我們設計了一個高階抽象層級的錯誤模擬器並且將其模擬結果與暫存器傳遞語言 (Register Transfer Language, RTL)錯誤模擬器的結果進行比較加速的比例以及模擬結果的正確性。

Abstract
To determine if a fault-tolerance architecture can be useful and efficient at protecting a system operating in a specific application environment, it must be tested in a realistic and representative manner with sufficient test coverage. Traditionally, formal verification and traditional register-transfer level (RTL) fault simulation were used for this purpose to test simple systems running trivial or no software. While formal verification is difficult for complex logic and software, RTL fault simulation has become too slow to test full MPSoC designs, especially when testing multi-core systems or software-implemented fault tolerance measures. For early system design reliability analysis, abstraction models are commonly used.

In this thesis, we propose an accurate reliability assessment fault simulator based on SystemC and provide the fault simulation results which are validated by RTL fault simulation.
To increase the simulation runtime speedup, the SystemC fault simulation is built by functional models. However The SystemC simulation timing is inaccurate due to lack of any RTL cycle information. To increase the SystemC fault simulation timing accuracy, we propose a SystemC and RTL timing mapping techniques to ensure the SystemC fault inject timing is related to RTL. In the SystemC fault simulation result, we quantify the accuracy of proposed fault injection mechanisms vis-a-vis the fault simulation result in RTL. furthermore, the monitoring of faulty effect is necessary. In our proposed method, the faulty effects are categorized by observing the internal variables of modules and channels. We include a compiler framework for instrumenting user code automatically to monitor the signals in the simulator. The experimental results show that our proposed fault simulator can provide fault-simulation with an average speed-up-factor of 470 times with approximate fault simulation results, which are validated with RTL fault simulation results.

1 Introduction 7
1.1 Motivation 7
1.2 Thesis Organization 8

2 Background 10
2.1 SystemC 10
2.2 OSCI TLM-2.0 11
2.3 ArchC 11
2.4 AspectC++ 12
2.5 Fault Simulation Tool 12

3 System Platform 14
3.1 SystemC simulation platform 14
3.2 RTL Platform: PULPino 15

4 SystemC Fault Injection Approach 18
4.1 SystemC Fault Injection 18
4.2 Fault Simulation Configuration 21
4.3 Fault Injection Platform 23
4.4 The Fault Injection Controller 25
4.5 SystemC/RTL Timing Mapping 26
4.6 Faulty Hardware Monitor 29
4.7 ACE-Guided Fault Sampling 31

5 Experimental Results 33
5.1 SystemC Fault Simulator Validation 35
5.1.1 RTL Fault Sampling Constraint 35
5.1.2 Fault Simulation Result with Architectural Register Injection 35
5.2 Non-architectural Register Injection 39
5.2.1 RTL Fault Sampling on Non-Architectural Register 39
5.2.2 Fault Simulation Result with Non-Architectural Register Injection 43
5.3 ACE-Guided Fault Sampling Fault Simulation 43

6 Conclusions and Future Work 47
6.1 Conclusions 47
6.2 Future Work 47

[1] Open SystemC Initiative, “IEEE Standard SystemC Language Reference Manual”, IEEE Std
1666-2005, pp. 1–423, Mar. 2006.
[2] D. C. Black, J. Donovan, B. Bunton, and A. Keist, SystemC: From the ground up, Springer
Verlag, 2009.
[3] Open SystemC Initiative, OSCI TLM 2.0 Language Reference Manual, July 2009.
[4] The ArchC Team, The ArchC Architecture Description Language v2.0 Reference Manual,
Aug. 2007.
[5] D. Etiemble C. Bechara, N. Ventroux, “Towards a parameterizable cycle-accurate iss in
archc”, in AICCSA. IEEE, 2010.
[6] Olaf Spinczyk, Daniel Lohmann, and Matthias Urban, “Advances in AOP with aspectc++”,
in New Trends in Software Methodologies, Tools and Techniques - Proceedings of the Fifth
SoMeT 2005, September 28-30, 2005, Tokyo, Japan, Hamido Fujita and Mohamed Mejri,
Eds. 2005, vol. 129 of Frontiers in Artificial Intelligence and Applications, pp. 33–53, IOS
Press.
[7] H. Ziade, N. A. Ayoubi, and R. Velazco et al., “A survey on fault injection techniques”, in
IAJIT, 2004, vol. 1, pp. 171–186.
[8] J. Arlat ; Y. Crouzet ; J.-C. Laprie, “Fault injection for dependability validation of faulttolerant
computing systems”, in Symposium on Fault-Tolerant Computing (FTCS). IEEE,
1989.
[9] J. Torin U. Gunneflo, J. Karlsson, “Evaluation of error detection schemes using fault injection
by heavy-ion radiation”, in Symposium on Fault-Tolerant Computing (FTCS). IEEE, 1989.
[10] A. Janning ; J. Heyszl ; F. Stumpf ; G. Sigl, “A cost-effective fpga-based fault simulation
environment”, in FDTC. IEEE, 2011.
[11] A. Ejlali A. Mohammadi, M. Ebrahimi and S. G. Miremadi, “Scfit: A fpga-based fault injection
technique for seu fault model”, in DATE. EDA Consortium, 2012.
[12] F. Novak U. Legat, A. Biasizzo, “Automated seu fault emulation using partial fpga reconfiguration”,
in DDECS. IEEE, 2010.
[13] L. Chen A. Pellegrini, R. Smolinski, X. Fu, S. K. S. Hari, J. Jiang, S. V. Adve, T. Austin,
and V. Bertacco, “Crashtest’ing swat: Accurate, gate-level evaluation of symptom-based resiliency
solutions”, in DATE. EDA Consortium, 2012.
[14] A. H¨oller, G. Sch¨onfelder, N. Kajtazovic, T. Rauter, and C. Kreiner, “FIES: a fault injection
framework for the evaluation of self-tests for COTS-based safety-critical systems”, in MTV.
IEEE, 2014.
[15] J. Wei, A. Thomas, G. Li, and K. Pattabirama, “Quantifying the accuracy of high-level fault
injection techniques for hardware faults”, in DSN. IEEE, 2014.
[16] CY Cher H. Cho, S. Mirkhani, J. A. Abraham, and S. Mitra, “Quantitative evaluation of soft
error injection techniques for robust system design”, in DAC. ACM, 2013.
[17] U. R. Karpuzcu ML Li, P. Ramachandran, S. K. S. Hari, and S. V. Adve, “Accurate
microarchitecture-level fault modeling for studying hardware faults”, in HPCA. IEEE, 2009.
[18] B. A. Tabacaru, M. Chaari, W. Ecker, C. N. T. Kruse, K. Liu, H. Post, N. Hatami, and
A. v. Schwerin, “Runtime fault-injection tool for executable systemc models”, in FDL. IEEE,
2015.
[19] “Z01x functional safety assurance”, in [Online], https://www.synopsys.com/
verification/simulation/z01x-functionalsafety.html.
[20] V. Guarnieri N. Bombieri, F. Fummi, “Accelerating rtl fault simulation through rtl-to-tlm
abstraction”, in ETS. IEEE, 2011.
[21] R. Ubar U. Reinsalu, J. Raik and P. Ellervee, “Fast rtl fault simulation using decision diagrams
and bitwise set operations”, in DFT. IEEE, 2011.
[22] Y. Fu, A. Terechko, T. Bijlsma, P. J. L. Cuijners, and J. Redegeld, “Avfi: Fault injection for
autonomous vehicles”, in ICSA-C. IEEE, Mar 2019.
[23] N.Binkert et al., “The gem5 simualtor”, in Arch. News, vol. 39, no. 2, 2011.
[24] D.Gizopoulos A.Chatzidimitriou, “Anatomy of microarchitecturelevel reliability assessment:
throughput and accuracy”, in ISPASS. IEEE, 2016.
[25] Christopher Weaver Shubhendu S. Mukherjee, Joel Emer, Steven K. Reinhardt, and Todd
Austin, “A systematic methodology to compute the architectural vulnerability factors for a
high-performance microprocessor”, in International Symposium on Microarchitecture (MICRO).
IEEE, 2003.
[26] Razvan Cheveresan Arijit Biswas, Paul Racunas, Joel Emer, Shubhendu S. Mukherjee1, and
Ram Rangan, “Computing architectural vulnerability factors for address-based structures”,
in International Symposium on Computer Architecture (ISCA). IEEE, 2005.
[27] Nour Sayed Mojtaba Ebrahimi, Maryam Rashvand, and Mehdi B. Tahoori, “Fault injection
acceleration by architectural importance sampling”, in International Conference on Hardware/
Software Codesign and System Synthesis (CODES+ISSS). IEEE, 2015.
[28] T. D. Hamalainen E. Pekkarinen, “Modeling risc-v processor in ip-xact”, in DSD. IEEE,
2018.
[29] R. A. Shafik ; P. Rosinger ; B. M. Al-Hashimi, “Systemc-based minimum intrusive fault
injection technique with improved fault representation”, in IOLTS. IEEE, 2008.
[30] Bogdan B. A. Tabacaru, Moomen Chaari, Wolfgang Ecker, Cristiano Novello, and Thomas
Kruse, “Comparison of different fault-injection methods into tlm models”, 10 2015.
[31] W. Ecker B. A. Tabacaru, M. Chaari, C. N. T. Kruse, K. Liu, H. Post, N. Hatami, and
A. v. Schwerin, “Fault-injection techniques for tlm-based virtual prototypes”, in FDL. IEEE,
2015.
[32] S. Dutta, D. Tabakov, and Moshe Vardi, “Chimp: A tool for assertion-based dynamic verification
of systemc models”, CEUR Workshop Proceedings, vol. 1130, pp. 38–45, 01 2014.