As IoT systems have increased the number of deployed embedded devices drastically and most of these devices are used in safety or security critical environments, the education of embedded software engineers is more important than ever. A critical part of their education is the development of their intuition for secure and safe software. In this paper 1 1 This research was funded by the city of Vienna (MA-23 call 21, project no. 9). we present an evaluation system used to generate fast and accurate feedback for student submission in, but not limited to, embedded software development courses. The system can be used as a first feedback loop to outline to the students where problems exist in their code and give them the opportunity to analyze and correct their errors. These extra steps ensure that the students can and will be notified early about their mistakes and can search for correct solutions, supporting the student's learning process. We present the implementation of the system and analyze its deployment in a microcontroller software development lecture. This analysis was done by means of surveys of the students and lecturers as well as a statistical analysis of the student submissions. The results show that the students made use of this extra features and even would prefer to have this feedback in other software development lectures as well.

The increasing number of clock domain crossings in modern systems-on-chip makes the careful consideration of metastability paramount. However, the manifestation of metastability at a flip-flop output is often unduly reduced to late transitions only, while glitches are hardly ever accounted for. In this paper we study the occurrence of glitches resulting from metastability in detail. To this end we propose a measurement circuit whose principle substantially differs from the conventional approach, and by that allows to reliably detect glitches. By means of experimental measurements on an FPGA target we can clearly identify late transitions, single glitches and double glitches as possible manifestations of metastability. Some of these behaviors are unexpected as they do not follow from the traditional modeling theory. We also study the dependence of metastable behavior on supply voltage. Beyond confirming that, as reported in previous literature, the metastable decay constant [Formula: see text] is voltage-dependent, we also produce strong evidence that the relative occurrence of glitches is not voltage-dependent.

In view of the increasing number of clock domains found in modern ASICs, the precise characterization of metastability at their boundaries becomes crucial. In some cases, the conventional approach does not provide a sufficient level of detail information. As an alternative approach, the use of a time-to-digital converter based on a tapped delay line has been proposed. In this paper we extend the latter by an additional tapped delay line thus allowing to further refine the concept. We present the underlying concept, its implementation, as well as experimental measurements on an FPGA platform that reveals significant variations in the metastable behavior of different FPGA boards of the same type.

With the increasing number of clock domain crossings in modern VLSI circuits, the area, power and performance overheads introduced by synchronization have a rising impact on the overall system parameters. To minimize these overheads while still reaching the targeted system reliability, it is very important to precisely know the parameters of the circuit elements used for synchronization regarding metastability. While it is well understood, what parameters are relevant and how they can be derived from circuit models, obtained from simulation or even measured, the state of the art measurement approaches require precisely timed clock inputs. These are typically provided with expensive test equipment, on-chip clock management blocks or calibrated delay lines. This paper proposes an approach for measuring metastability parameters using uncorrelated free-running clocks only at the expense of a more challenging post-processing. The principle is closely related to sampling oscilloscopes with the same fundamental property: the measurement resolution is theoretically unbounded but proportional to the measurement time. Apart from the description of the circuit, this paper includes an analysis of the effect of clock uncertainty (jitter) on the measurement result and an experimental evaluation.

It is well known that every sequential element may become metastable when provided with marginal inputs, such as input transitions occurring too close or input voltage not reaching a defined HI or LO level. In this case the sequential element requires extra time to decide which digital output level to finally present, which is perceived as an output delay. The amount of this delay depends on how close the element’s state is to the balance point, at which the delay may, theoretically, become infinite. While metastability can be safely avoided within a closed timing domain, it cannot be completely ruled out at timing domain boundaries. Therefore it is important to quantify its effect. Traditionally this is done by means of a “mean time between upsets” (MTBU) which gives the expected interval between two metastable upsets. The latter is defined as the event of latching the still undecided output of one sequential element by a subsequent one. However, such a definition only makes sense in a time-safe environm...

In view of the numerous clock domain crossings found in modern systems-on-chip and multicore architectures precise metastability characterization is a fundamental task. We propose a conceptually novel approach for the experimental assessment of upset rate over resolution time that is usually employed to extract the relevant characteristics. Our method is based on connecting a time-to-digital converter to the output of the flip flop under test, rather than using a phase shifted clock, as conventionally done. We present the details of an FPGA implementation of our approach and show its feasibility through an experimental evaluation, whose results favorably match those obtained by the conventional method. The benefits of the novel scheme are the ability to perform a calibration for the delay steps, a speed-up of the measurement process, and the availability of a more comprehensive and ordered measurement data set. Especially the latter can be of crucial importance when (even multiple) glitches or oscillation are suspected to result from metastability, or when the temporal distribution of upsets matters (bursts of upsets, e.g.).

We propose a novel method for transforming delay-line time-to-digital converters (TDCs) into TDCs that output Gray code without relying on synchronizers. We formally prove that the inevitable metastable memory upsets (Marino, TC'81) do not induce an additional time resolution error. Our modified design provides suitable inputs to the recent metastability-containing sorting networks by Lenzen and Medina (ASYNC'16) and Bund et al. (DATE'17). In contrast, employing existing TDCs would require using thermometer code at the TDC output (followed by conversion to Gray code) or resolving metastability inside the TDC. The former is too restrictive w.r.t. the dynamic range of the TDCs, while the latter loses the advantage of enabling (accordingly much faster) computation without having to first resolve metastability. Our all-digital designs are also of interest in their own right: they support high sample rates and large measuring ranges at nearly optimal bit-width of the output, yet maintain the original delay-line's time resolution. No previous approach unifies all these properties in a single device.

In view of the numerous clock domain crossings found in modern systems-on-chip and multicore architectures precise metastability characterization is a fundamental task. We propose a conceptually novel approach for the experimental assessment of upset rate over resolution time that is usually employed to extract the relevant characteristics. Our method is based on connecting a time-to-digital converter to the output of the flip flop under test, rather than using a phase shifted clock, as conventionally done. We present the details of an FPGA implementation of our approach and show its feasibility through an experimental evaluation, whose results favorably match those obtained by the conventional method. The benefits of the novel scheme are the ability to perform a calibration for the delay steps, a speed-up of the measurement process, and the availability of a more comprehensive and ordered measurement data set.

The significant process, voltage and temperature (PVT) variations seen with modern technologies make strictly synchronous design inefficient. Asynchronous design with its flexible timing is a promising alternative, but prototyping is difficult on the available FPGA platforms which are clock centric and do not provide the required functional primitives like mutual exclusion or Muller C-elements. The solutions proposed in the literature so far work nicely in principle but cannot safely handle metastability issues that are inevitable even at some interfaces in asynchronous designs. In this paper, we propose reliable implementations of the fundamental function blocks required to safely convert potential intermediate voltage levels that result from metastability into late transitions that can be reliably handled in the asynchronous domain. These are high- and low-threshold buffers as well as a Schmitt-trigger. We give elaborate background analysis for the proposed circuits and also present the associated routing constraints to make the Schmitt-trigger circuit work properly in spite of the uncertain routing within FPGAs. Furthermore, we propose a procedure for an “in situ reliability assessment” of the specific Schmitt-trigger element under consideration, which also applies to metastability containment with high- or low-threshold buffers only. Our proof of concept is based on experimental results for both Xilinx and Altera FPGA platforms.

The experimental metastability characterization of a flip flop requires a controllable delay with low jitter and high time resolution. In FPGAs such an experiment can be very useful for in-situ or even online characterization of a given flip flop, but existing solutions rely on the availability of a digital clock manager (DCM) or a phase locked loop (PLL) for implementing this controllable delay. Given that such a component may not always be available, and that its linearity is sometimes sub-optimal and hard to calibrate, we present an alternative approach in this paper. It is based on the use of the carry chain for determining the delay steps, which allows a very fine resolution. For calibration of the step sizes we propose to operate the delay line in a ring oscillator whose frequency is then measured for all delay settings. Our results show that this solution yields a fine-grain delay control with acceptable jitter. We demonstrate the usefulness of our approach in the context of a complete metastability characterization that now can be performed without requiring a DCM or PLL.

In digital CMOS essentially all sequential function blocks may get metastable in one way or another, when provided with marginal inputs. Most often the result is a delayed reaction at the output, which, in a synchronous design, potentially violates the timing assumptions. Therefore metastable behavior is often characterized by the Mean Time Between Upset (MTBU), which reflects the expected interval between such violations on a statistical base. However, not all designs are synchronous - there are even sequential elements specifically intended for use in context with elastic timing, such as the mutual exclusion element or the Muller C-element. For these a characterization via MTBU is not useful; but on the other hand there seem to be no reasonable alternatives. Therefore in this paper we propose the use of the delay graph (over the relevant quantity that causes metastability when becoming marginal) for this purpose. We elaborate its correspondence with the usual MTBU graph and the metastability parameters, namely tau and T0. As a proof of concept we apply our strategy to a set of sequential elements, like D-latch, RS-latch, Muller C-element and mutex and discuss the differences we identified.

As modern ASICs comprise an increasing number of independently clocked subsystems that need to interact, the accurate reliability assessment of synchronizers becomes crucial. Traditionally the reliability of a synchronizer is characterized by the mean time between upsets (MTBU), and the relevant flip-flop parameters are specified in a way to support MTBU calculation. In this paper we claim that actually a deeper insight into the distribution of upsets over time is needed in order to make a reasonable prediction in the range of the high reliability values that are generally targeted. We present a measurement concept that appropriately extends state-of-the-art approaches so as to allow for an experimental assessment of the upset distribution over time. In this way the distribution function can be studied, and in particular the probability of upsets with low temporal distance -- which is the relevant one for high reliability -- can be identified. We implement our concept on three different FPGA platforms and present the selected results. The distribution function we obtain indicates that the assumption of a uniform or standard normal distribution, which one might be tempted to imply for lack of better information, is definitely not generally useful.

The common way of characterizing the metastability properties of a circuit is by its metastability resolution constant τ and the aperture window. This approach is based on a model that represents the storage cell as a pair of crosscoupled inverters, each of which is, in turn, modeled by a constant-gain amplifier with a first-order low-pass filter at the output. The former reflects the inverter's signal regeneration capability, while the latter approximates its dynamic behavior. In this simple model there is no natural way of expressing, e.g., the load dependence of tau, therefore each change of the element's load capacitance requires a full recalibration. In this paper we propose decomposing the inverter into its constituent transistors and using their small-signal equivalent circuits for modeling. Metastability characterization is now based on a Spice AC analysis which yields a higher-order dynamic model of the circuit. Once the relevant parameters are known for a given element, the load dependence of tau can be expressed analytically, thus elegantly avoiding recalibration. We compare our approach with the extended nose short simulation (ENSS) method from literature and show that the results deviate by no more than 1-2%.

The significant PVT variations seen with modern technologies make synchronous design inefficient. Asynchronous design with its flexible timing is a promising alternative, but prototyping is difficult on the available FPGA platforms which are clock centric and do not provide the required functional primitives like mutual exclusion or Muller C-elements. The solutions proposed in the literature work nicely in principle, but cannot safely handle metastability issues that are inevitable at interfaces even in asynchronous designs. In this paper we propose a reliable implementation of a Schmitt-trigger, which allows to safely convert potential intermediate voltage levels that result from metastability into late transitions that can be reliably handled in the asynchronous domain. Beyond the actual circuit we also discuss the associated routing constraints to make the circuit work properly in spite of the uncertain routing within FPGAs. Furthermore we propose a procedure for an "in situ reliability assessment" of the specific Schmitt-trigger element under consideration, which also applies to metastability containment with high-or low-threshold inverters only. Our proof of concept is based on experimental results for both Xilinx and Altera FPGA platforms.

The efficient design of a synchronizer for a given MTBF limit heavily depends on the availability of an accurate metastability characterization of the bistables in the target technology. We propose a measurement approach for FPGAs that comes along without any specific measurement infrastructure and can hence be performed by the designer with relatively low efforts, but is yet very accurate. Our concept comprises the use of the FPGA-internal digital clock manager (DCM), calibration measurements for the latter, averaging over several parallel measurement runs, and separated analysis of different metastability cases. To demonstrate the power of our approach we present detailed measurement results for a Xilinx Virtex-4 FPGA that even show slave metastability. Furthermore, we discuss how diverse constraints can be considered to make the measurement more accurate and time efficient.

We present the architecture and a detailed pre-fabrication analysis of a digital measurement ASIC facilitating long-term irradiation experiments of basic asynchronous circuits, which also demonstrates the suitability of the general approach for obtaining accurate radiation failure models developed in our FATAL project. Our ASIC design combines radiation targets like Muller C-elements and elastic pipelines as well as standard combinational gates and flip-flops with an elaborate on-chip measurement infrastructure. Major architectural challenges result from the fact that the latter must operate reliably under the same radiation conditions the target circuits are exposed to, without wasting precious die area for a rad-hard design. A measurement architecture based on multiple non-rad-hard counters is used, which we show to be resilient against double faults, as well as many triple and even higher-multiplicity faults. The design evaluation is done by means of comprehensive fault injection experiments, which are based on detailed Spice models of the target circuits in conjunction with a standard double-exponential current injection model for single-event transients (SET). To be as accurate as possible, the parameters of this current model have been aligned with results obtained from 3D device simulation models, which have in turn been validated and calibrated using micro-beam radiation experiments at the GSI in Darmstadt, Germany. For the latter, target circuits instrumented with high-speed sense amplifiers have been used for analog SET recording. Together with a probabilistic analysis of the sustainable particle flow rates, based on a detailed area analysis and experimental cross-section data, we can conclude that the proposed architecture will indeed sustain significant target hit rates, without exceeding the resilience bound of the measurement infrastructure.

Radiation-induced Single Event Transients (SETs) have the potential to create metastability in asynchronous circuits, as they are much shorter than the typical handshake cycle and do not respect the timing closure. Micropipelines have been shown to be effective in filtering those pulses. In this paper(1) we investigate the propagation of pulses of critical width through a micropipeline in SPICE simulations. We study how the pipeline implementation, especially the output buffer design (matched threshold, high threshold, Schmitt-trigger) influences the propagation behavior. For the solutions with single sided thresholds we observe a considerable propagation potential of critical pulses that strongly depends, however, on the degree of threshold matching. The Schmitt trigger output, in contrast, reliably filters all pulses which are shorter than a certain threshold while propagating all others securely. At the same time our respective analysis reveals that the cost of the Schmitt trigger stage in terms of performance overheads is also significant, so the choice needs to be carefully balanced with the application requirements.

As modern systems-on-chip contain increasingly more clock domain crossings, the associated metastability effects become much more pronounced. To maintain the reliability of the design, efficient means for metastability analysis become mandatory. We propose an approach that allows simulation of late transitions, the most dominant effect of metastability in modern VLSI chips. While this approach is purely digital and hence very fast, it allows a precise treatment in the time domain. These properties make it attractive for modeling even complex circuit structures. The core of our approach is a timing model that carefully maps the relative times of setting the latch opaque and the arrival of new data at the input to the appropriate data-input/output delay. Unlike with existing models this mapping is not simply linear and hence restricted to a very narrow scope, it rather works for arbitrary inter-arrival times between data and enable. We systematically elaborate an analytic description of this input/output delay and illustrate how the respective model parameters can be derived from an initial circuit simulation, either automatically or with manual support. Once calibrated, the model allows fast and precise simulation, which we illustrate in a case study.