黃錫瑜 Shi-Yu Huang National Tsing-Hua University, Taiwan Speeding Up Byzantine Fault Diagnosis Using Symbolic Simulation

2 Problem: Fault Diagnosis Circuit Under Diagnosis (CUD) test patterns = expected response faulty response not equal ! Question: Where are the fault locations ? a chip with defects inside

3 Fault Classification Single Fault Two-net fault One-net fault bridging fault Multiple Fault Faults in A logic IC logical node fault Byzantine node fault stuck-at node open

4 A Node Type of Fault ABCZZfZf ~ faulty min-term C A bridging GND Z B C B VDD driver to ‘0’ driver to ‘1’ The faulty output could be ambiguous The faulty output could be ambiguous

5 Byzantine Open Fault Definition: –A fault that causes an ambiguous voltage level  ~ 2.5 v G2 G3 ‘1’ ‘0’ pseudo ‘0’ pseudo ‘1’ open fault G1

6 Motivation Lavo, Larabee, and Chess [1996] –Use Stuck-At Fault Simulation Venkataraman and Drummonds [2000] –Based on exhaustive enumeration –Complexity grows exponentially Our approach –Uses symbolic technique –Performs implicit enumeration –Exact and Efficient –Does not cause memory explosion

7 Outline Introduction Our Algorithm Experimental Results Conclusions

8 Terminology Circuit Under Diagnosis (CUD): The Faulty Chip Circuit Model (MODEL): The Gate-Level Netlist Failing Input Vector: Causes Mismatches input vector v Gate-Level MODEL xoooxxooox mismatched PO matched PO mismatched PO matched PO CUD

9 Methodology: Inject and Evaluate Grading a signal’s suspicion degree of being a fault: (1)Perform symbolic injection at f for each failing vector (2)Count the curable vectors and curable outputs v oooooooooo cured v xooxxxooxx symbolic injection

10 Overall Algorithm failing input vectors design model faulty response Sorting criterion Sort the signals by the no. of “curable vectors”, If tied, sort by the no. of “curable outputs” ranking of each signal’s possibility of being a fault location for each failing vector v { for each suspect signal f { Step 1: perform symbolic injection Step 2: perform symbolic propagation Step 3: curability check }

11 Step 1: Symbolic Injection v     v  x1x1 x2x2 x3x3 before injection after injection A symbolic injection implicitly enumerates 2 k injections for a signal with k fanout branches

12 Step 2: Symbolic Propagation v 1  (x 1 ’x 2 )’ 0 0x10x1 0x20x2 1  0x1’0x1’ 0 G1G1 G2G2 Speed-Up Techniques: (1) OBDD, (2) Event-Driven Simulation React function

13 Step 3: Curability Check v  1  (x 1 x 2 )’ x1x1 x2x2 x3x3 1x31x3 0x10x1 0000 0000 To cure this failing input vector v by injection at  : React function R i

14 Outline Introduction Our Algorithm Experimental Results Conclusions

15 Experimental Setup ISCAS85 benchmark (MODEL) inject random Byzantine stuck-at faults faulty netlist as the CUD Byzantine Fault Diagnosis Program 32 failing random vectors 1st-hit index CPU-times Injection of Byzantine stuck-at faults: (1)pick one signal at a time randomly (2)tie each fanout branch to either 0 or 1 randomly

16 Accuracy of Single Fault Diagnosis ISCAS-85 benchmark circuits Average first-hit index (100 faulty circuit for each benchmark) CPU time < 11.2 seconds

17 Accuracy of Double Fault Diagnosis ISCAS-85 benchmark circuits Average first-hit index (100 faulty circuit for each benchmark) CPU time < 211 seconds

18 Conclusions We proposed a symbolic formulation –For Byzantine fault diagnosis –On top of the inject-and-evaluate paradigm Major computation includes –(1) Symbolic injection –(2) Symbolic propagation with OBDD –(3) Curability check We achieved accurate results efficiently !