Single event upset fault injection method and platform

Abstract

The present invention discloses a single-particle upset fault injection method and platform, comprising: copying a module to be tested into a fault injection circuit and a non-fault injection circuit, and connecting a state storage unit between the same timing unit in the fault injection circuit and the non-fault injection circuit; controlling the fault injection circuit and the non-fault injection circuit in a circuit structure unit to operate for a specific number of cycles under the same clock, and saving the logic value of the non-fault injection circuit at this time into the state storage unit; injecting a single-particle upset fault into the fault injection circuit in a target circuit structure unit, and judging whether a fault occurs according to the operating state of the target circuit structure unit; if so, repairing the operating state of the target circuit structure unit according to the logic value in the corresponding state storage unit; otherwise, updating the logic value stored in the state storage unit corresponding to the target circuit structure unit, and performing the next fault injection; the present invention can realize continuous and rapid SEU fault injection and repair.

Description

Technical Field

[0001] The present invention relates to the field of testing technology, and in particular to a single event upset fault injection method and platform. Background Art

[0002] SRAM-based FPGAs are widely used in the aerospace field due to their flexible configuration, high performance, and fast operation speed. However, SRAM-based FPGAs contain a large number of storage cells that are highly sensitive to single-event upsets (SEUs), which greatly limits their application in the aerospace field. SEU refers to the phenomenon that high-energy particles (such as cosmic rays) interact with sensitive components in semiconductor devices or electronic systems, causing the state of internal storage elements (such as registers or storage cells) to temporarily change or flip. For SRAM-based FPGAs, more than 90% of SEUs occur in the configuration storage elements, causing the values ​​stored therein to flip, which may cause unexpected changes to the programmed logic functions or the data stored in the FPGA, which may lead to functional errors or even system crashes. In order to enhance the robustness of spatial SRAM-based FPGAs under SEUs, it is necessary to improve their fault tolerance by strengthening the fault-tolerant design.

[0003] In the process of enhancing the fault tolerance of circuits, evaluating the SEU sensitivity of circuits is a basic task. This not only allows us to understand the effectiveness of the applied reinforcement fault tolerance technology, but also provides useful information to identify the weak and sensitive parts of the circuit, providing effective guidance for efficient selective reinforcement. At present, there are two main methods to simulate the ground SEU effect of SRAM-based FPGAs: (1) Radiation experiment method, which involves building a test environment that simulates real space and placing the FPGA in it for long-term observation. This method can truly reflect the reliability performance of FPGAs in space, but it is costly, time-consuming, and may cause damage to the tested chip. (2) Fault injection method, which involves directly modifying the configuration bitstream (.bit) file to flip a specific bit, and then downloading it to the configuration memory of the FPGA through the JTAG or ICAP interface to simulate SEU fault injection, such as Figure 1 Compared to radiation experiments, fault injection is more controllable, does not require specialized equipment, is less expensive, and is more time-efficient. Therefore, it has gained widespread popularity among researchers.

[0004] Fault injection, as an effective method for evaluating FPGA susceptibility to SEUs, has been studied both domestically and internationally. For example, some researchers have proposed using dynamic partial reconfiguration to randomly inject SEU faults into the design under test (DUT), further improving the speed of fault injection by running multiple DUTs simultaneously. However, this approach cannot target faults to specific areas of the DUT, and the experimental results obtained cannot provide effective guidance for subsequent selective hardening. For example, some researchers have designed a fault injection platform that supports simultaneous SEUs and multiple bit upsets (MBUs), as well as an address generator to provide the locations for fault injection. However, after each SEU fault injection, the correct configuration bitstream must be downloaded to the FPGA's configuration memory again using the ICAP interface to repair the injected fault, which slows down the fault injection process. For example, some researchers have proposed a basic bit address generation algorithm to identify all bits in the configuration bitstream file associated with the DUT, ensuring that each SEU fault injection is effective. This approach uses secondary fault injection to repair the fault and improve the speed of continuous fault injection. However, it still only assesses the overall SEU susceptibility of the DUT and does not help identify sensitive areas of the circuit.

[0005] For example, the paper "Design and Implementation of a Targeted Fault Injection System for SRAM-Based FPGAs, Master's Thesis by Yao Jinjian" designs and implements a register-level targeted fault injection system to simulate single-event upsets. The hardware structure of the targeted fault injection system, including a data input module, a register upset control module, a reset management module, a data comparison and output module, and other modules, is designed. The hardware implementation is implemented on an FPGA using an area-speed trade-off. The proposed solution, when evaluating the reliability of circuits against SEUs, records and compares the output data of two circuits (the fault injection circuit and the non-fault injection circuit) bit by bit, calculating the bit error rate (note that the bit error rate calculation assumes that the output data volumes are equal). Specifically, the fault injection circuit and the non-fault injection circuit are fed the same frame of image data, and their corresponding output data is recorded and the bit error rate is calculated. The reliability evaluation metric used is specific to image processing circuits and is not adaptable to other circuits. Furthermore, although the fault injection strategy in this paper involves randomized fault injection, the structural modifications to the circuit proposed in this paper only enable the circuit to inject faults, but do not support continuous SEU fault injection.

[0006] For example, the patent application document with publication number CN107741559A proposes a single-particle upset test system for space radiation environments. The functional FPGA module in the system can be functionally configured according to different test requirements, and it has high flexibility. By comparing and analyzing the output results of the test system design with fault injection and the standard system design, the sensitive areas of the system design to single-particle upsets are obtained; the fault injection strategy in this scheme is based on the reconfigurability of FPGA, and SEU fault injection is achieved by modifying its configuration bit stream file. This fault injection method has high randomness and cannot achieve fault injection at the specific location of the test circuit. It is highly inefficient because not all bits in the configuration bit stream file are related to the test circuit. It is also inefficient because modifying the configuration bit stream requires first reading a frame of data from the FPGA, and then modifying the data before downloading it to the FPGA. Summary of the Invention

[0007] The technical problem to be solved by the present invention is how to perform continuous and rapid SEU fault injection and repair.

[0008] The present invention solves the above technical problems through the following technical means:

[0009] The present invention proposes a single event upset fault injection method, the method comprising:

[0010] S1. Duplicate the module to be tested to obtain a fault injection circuit and a non-fault injection circuit, wherein each of the fault injection circuit and the non-fault injection circuit comprises a plurality of sequential units, and a state storage unit is connected between the same sequential units in the fault injection circuit and the non-fault injection circuit;

[0011] S2. During the current round of fault injection experiment, control the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the current round of initialization state until a save time is reached, and save the logic values ​​of the sequential units in the non-fault injection circuit at the save time into the state storage unit corresponding to each sequential unit;

[0012] S3, selecting any time within a set number of clock cycles after the archive time as a fault injection time, injecting a single event upset fault into a target sequential unit in the fault injection circuit at the fault injection time, and then running for a fixed period to reach a check time, and comparing the operating states of the fault injection circuit and the non-fault injection circuit at the check time to determine whether a fault occurs, and if so, executing step S4, otherwise executing step S5;

[0013] S4. Repairing the operating states of the fault injection circuit and the non-fault injection circuit using the logic value stored in the state storage unit corresponding to the target sequential unit;

[0014] S5. Use the next clock cycle after the inspection time as the next archiving time, update the logic value stored in each state storage unit according to the logic value of the sequential unit in the non-fault injection circuit at the next archiving time, and repeat step S3 to perform the next fault injection.

[0015] Furthermore, when the number of fault injections during the current round of fault injection experiments reaches a preset value, the results of the current round of fault injection experiments are uploaded.

[0016] After uploading the fault injection experiment results of the current round, the method further includes:

[0017] Entering the next round of fault injection experiment, controlling the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the next round of initialization state until reaching the archiving time, and saving the logic values ​​of the sequential cells in the non-fault injection circuit at the archiving time to the state storage unit corresponding to each sequential cell, and then executing steps S3 to S5;

[0018] Among them, the number of running clock cycles of the initialization state is different during each round of fault injection experiments.

[0019] Furthermore, selecting any time within a set number of clock cycles after the archive time as the fault injection time includes:

[0020] According to the 0 to 16-bit random number generated by the pseudo-random number generator, any time within the set number of clock cycles after the archive time is used as the fault injection time.

[0021] Furthermore, a global save signal is applied to the input end of each state storage unit, and a global load signal is applied to the output end of each state storage unit;

[0022] When the global save signal is set to 0, the logic value of the non-fault injection circuit is saved to the corresponding state storage unit, and when the global save signal is set to 1, the logic value saved in each state storage unit remains unchanged;

[0023] When the global load signal is set to 0, the logic value in each state storage unit is transferred to the corresponding sequential unit to repair its operating state. When the global load signal is set to 1, the fault injection circuit and the non-fault injection circuit continue to operate.

[0024] Furthermore, a negated signal is applied to the input terminal of each sequential unit in the fault injection circuit. Accordingly, after injecting a single event upset fault into a target sequential unit in the fault injection circuit at a fault injection time, a fixed period is run until a check time is reached, and the operating states of the fault injection circuit and the non-fault injection circuit at the check time are compared to determine whether a fault occurs, including:

[0025] Before the input signal is transmitted to the selected target sequential unit, a single event upset fault obtained by inverting the input signal is injected into the target sequential unit;

[0026] After the fault is injected, the fault injection circuit and the non-fault injection circuit continue to operate for a fixed clock cycle until a check time is reached, and the operating states of the fault injection circuit and the non-fault injection circuit at the check time are compared to determine whether a fault occurs.

[0027] Furthermore, the comparing the operating states of the fault injection circuit and the non-fault injection circuit at the time of inspection to determine whether a fault occurs includes:

[0028] If the outputs of the fault injection circuit and the non-fault injection circuit are the same and the logic values ​​of the sequential units within the fault injection circuit are the same as the logic values ​​of the sequential units within the non-fault injection circuit, then it is determined that the impact of the injected single event upset fault on the module under test is classified as no fault;

[0029] If the outputs of the fault injection circuit and the non-fault injection circuit are the same but the logic values ​​of the internal sequential units of the fault injection circuit are different from the logic values ​​of the internal sequential units of the non-fault injection circuit, then it is determined that the impact of the injected single event upset fault on the module under test is classified as a potential fault;

[0030] If the output of the fault injection circuit is different from the output of the non-fault injection circuit, it is determined that the impact of the injected single event upset fault on the module to be tested is classified as a fault.

[0031] In addition, the present invention also proposes a single-event upset fault injection platform, which can test a circuit under test and return test results. The test results directly reflect the sensitivity of the circuit under test to SEU at the circuit function level. The platform includes a host and an FPGA chip. The FPGA chip includes a fault injection management module and a fault injection circuit and a non-fault injection circuit copied from the module under test. The fault injection circuit and the non-fault injection circuit each include multiple sequential units, and a state storage unit is connected between the same sequential units in the fault injection circuit and the non-fault injection circuit. The fault injection management module is communicatively connected to the host, wherein the fault injection management module includes:

[0032] a microcontroller, configured to receive configuration commands and startup commands issued by the host and parse the commands to obtain parsing results, wherein the parsing results include a fault injection time, a fault injection location, and a number of operating clock cycles;

[0033] The fault manager is configured to, during a current round of fault injection experiment, control the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the current round of initialization state according to the analysis result until a save time is reached, and save the logic values ​​of the sequential cells in the non-fault injection circuit at the save time into the state storage unit corresponding to each sequential cell; then select any time within a set number of clock cycles after the save time as the fault injection time, inject a single event upset fault into a target sequential cell in the fault injection circuit at the fault injection time, and then run for a fixed cycle until a check time is reached; compare the operating states of the fault injection circuit and the non-fault injection circuit at the check time to determine whether a fault has occurred; if a fault has occurred, repair the operating states of the fault injection circuit and the non-fault injection circuit using the logic values ​​stored in the state storage unit corresponding to the target sequential cell; otherwise, set the clock cycle after the check time as the next save time, update the logic values ​​stored in the state storage unit according to the logic values ​​of the sequential cells in the non-fault injection circuit at the next save time, and continue the circuit operation for the next fault injection.

[0034] Furthermore, a global save signal is applied to the input end of each state storage unit, and a global load signal is applied to the output end of each state storage unit;

[0035] When the global save signal is set to 0, the logic value of the non-fault injection circuit is saved to the corresponding state storage unit, and when the global save signal is set to 1, the logic value saved in each state storage unit remains unchanged;

[0036] When the global load signal is set to 0, the logic value in each state storage unit is transferred to the corresponding sequential unit to repair its operating state. When the global load signal is set to 1, the fault injection circuit and the non-fault injection circuit continue to operate.

[0037] Furthermore, the fault injection management module further includes a position controller and a pseudo-random number generator, the outputs of the position controller and the pseudo-random number generator are both connected to the fault manager, and an inverted signal is applied to the input end of each sequential unit in the fault injection circuit;

[0038] The position controller is connected to the negated signal to control the position and timing of fault injection;

[0039] The pseudo-random number generator is used to generate a random number. When the value of the internal counter of the fault manager is equal to the random number generated by the pseudo-random number generator, the position controller pulls the input signal applied to the selected target timing unit high for one clock cycle.

[0040] Furthermore, the fault manager adopts a finite state machine, which includes a configuration state, an initialization state, a save state, a running state, a loading state, an analysis state and an upload state, wherein:

[0041] When the FPGA chip is reset or powered on, the fault manager is in a configuration state and receives parsed results of commands;

[0042] After receiving the start command sent by the host, the controller switches to the initialization state, controls the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the previous round of initialization state, and enters the saving state after reaching the archiving time;

[0043] When in the saving state, the logic values ​​of the sequential units inside the non-fault injection circuit at the archiving time are saved to each of the state storage units, and then the running state is entered;

[0044] When in the running state, any time within a set number of clock cycles after the archive time is selected as the fault injection time to inject a single event upset fault into the target sequential unit selected in the fault injection circuit, and the system continues to run for a fixed clock cycle until reaching the check time and entering the analysis state;

[0045] When in the analysis state, the operating states of the fault injection circuit and the non-fault injection circuit at the inspection time are compared to determine whether a fault occurs. If it is determined that there is no fault, the system enters a save state to use a clock cycle after the inspection time as the next archiving time, and uses the logic value of the sequential unit in the non-fault injection circuit at the next archiving time to update the logic value stored in each state storage unit. Otherwise, the system enters a loading state to repair the operating states of the fault injection circuit and the non-fault injection circuit according to the logic value in the state storage unit and enters the operating state after the repair.

[0046] When it is determined in the analysis state that the number of fault injections reaches a preset value, the upload state is entered and the test result of the module to be tested is uploaded to the host.

[0047] Furthermore, when the finite state machine is in the analysis state, the process of performing fault analysis includes:

[0048] If the outputs of the fault injection circuit and the non-fault injection circuit are the same and the logic values ​​of the sequential units within the fault injection circuit are the same as the logic values ​​of the sequential units within the non-fault injection circuit, then it is determined that the impact of the injected single event upset fault on the module under test is classified as no fault;

[0049] If the outputs of the fault injection circuit and the non-fault injection circuit are the same but the logic values ​​of the internal sequential units of the fault injection circuit are different from the logic values ​​of the internal sequential units of the non-fault injection circuit, then it is determined that the impact of the injected single event upset fault on the module under test is classified as a potential fault;

[0050] If the output of the fault injection circuit is different from the output of the non-fault injection circuit, it is determined that the impact of the injected single event upset fault on the module to be tested is classified as a fault.

[0051] Furthermore, during each round of fault injection experiments, the number of running clock cycles in the initialization state is different.

[0052] The advantages of the present invention are:

[0053] (1) The present invention is based on the concept of parallel testing. The module to be tested is copied to obtain a fault injection circuit and a non-fault injection circuit, and a state storage unit is connected between the same timing unit in the fault injection circuit and the non-fault injection circuit. During the fault injection process on the operating time axis of the module to be tested, the fault injection circuit and the non-fault injection circuit are first controlled to run for the same number of clock cycles in the initialization state, and the logic values ​​of each timing unit in the non-fault injection circuit at this time are saved in the corresponding state storage unit as an "archive point". After the single-particle upset fault is injected into a specific timing unit in the fault injection circuit, if the circuit fault is determined, the fault injection circuit and the non-fault injection circuit can be repaired using the logic value data of the "archive point". Otherwise, the operating state of the timing unit in the non-fault injection circuit at this time is saved to achieve the update of the "archive point". Then the module to be tested continues to run for the next fault injection. This mechanism ensures that SEU fault injection and repair can be carried out continuously and quickly, and can achieve fault injection at a specific location.

[0054] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is the fault injection flow chart based on bitstream modification mentioned in the background technology section of the present invention;

[0056] Figure 21 is a flow chart of a single event upset fault injection method proposed in one embodiment of the present invention;

[0057] Figure 3 1 is a schematic diagram of a timing unit modification circuit structure of a DUT in one embodiment of the present invention;

[0058] Figure 4 This is a schematic diagram of a circuit structure for modifying a single sequential unit in one embodiment of the present invention;

[0059] Figure 5 1 is a schematic diagram of the operating timeline of the DUT and its fault injection process according to an embodiment of the present invention;

[0060] Figure 6 1 is a schematic structural diagram of a single event upset fault injection platform proposed in one embodiment of the present invention;

[0061] Figure 7 is a jump flow chart of a state machine in one embodiment of the present invention;

[0062] Figure 8 1 is the SEU fault injection result of the PIC16F54 in one embodiment of the present invention, wherein (a) is the failure rate, potential failure rate, and no-failure rate of each internal register obtained by the fault injection experiment when the PIC16F54 runs a specific load program, and (b) is the failure rate, potential failure rate, and no-failure rate of each internal register obtained by the fault injection experiment when the PIC16F54 runs another load program;

[0063] Figure 9 This is the SEU sensitivity evaluation result after reinforcement in one embodiment of the present invention. DETAILED DESCRIPTION

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0065] like Figure 2 、 Figure 3 and Figure 4 As shown, the first embodiment of the present invention provides a single event upset fault injection method, which includes the following steps:

[0066] S1. Duplicate the module to be tested to obtain a fault injection circuit and a non-fault injection circuit, wherein each of the fault injection circuit and the non-fault injection circuit comprises a plurality of sequential units, and a state storage unit is connected between the same sequential units in the fault injection circuit and the non-fault injection circuit;

[0067] It should be noted that, in this embodiment, all sequential units such as registers in the module to be tested are described at the RTL level using the Verilog hardware description language, and are copied into two copies. One of the two identical sequential unit copies constitutes a fault injection circuit, and the other constitutes a non-fault injection circuit, such as Figure 4 As shown, after the circuit of the module to be tested is modified, the upper part is a non-fault injection circuit, the lower part is a fault injection circuit, and a state storage unit supporting storage of 1 bit of data is connected between the same timing units in the fault injection circuit and the non-fault injection circuit.

[0068] S2. During the current round of fault injection experiment, control the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the current round of initialization state until a save time is reached, and save the logic values ​​of the sequential units in the non-fault injection circuit at the save time into the state storage unit corresponding to each sequential unit;

[0069] It should be noted that before injecting a single-particle upset fault into the target sequential unit selected in the fault injection circuit, the fault injection circuit and the non-fault injection circuit are controlled to run the same number of clock cycles in the initialization state and then reach the archiving time. The logic value of the sequential unit inside the non-fault injection circuit at the archiving time is saved to each corresponding state storage unit as a basis for fault repair.

[0070] S3, selecting any time within a set number of clock cycles after the archive time as the fault injection time, injecting a single event upset fault into the target sequential unit in the fault injection circuit at the fault injection time, and then running for a fixed period to reach the inspection time, comparing the operating states of the fault injection circuit and the non-fault injection circuit at the inspection time to determine whether a fault occurs, and if so, executing step S4, otherwise executing step S5;

[0071] S4. Repairing the operating states of the fault injection circuit and the non-fault injection circuit using the logic value stored in the state storage unit corresponding to the target sequential unit;

[0072] S5. The clock cycle after the check time is used as the next archiving time. The logic value stored in each state storage unit is updated according to the logic value of the sequential unit in the non-fault injection circuit at the next archiving time. After that, the circuit continues to operate and repeats step S3 to perform the next fault injection.

[0073] Specifically, in this embodiment, the positions of the two actions of logic value saving and fault analysis on the DUT running timeline are respectively referred to as AP (Archive Point) and CP (Check Point), and the moment of fault injection is referred to as FIP (Fault Injection Point). Figure 5 As shown in the figure, during the fault injection process on the DUT operation timeline, when the DUT reaches the checkpoint CP, if the SEU fault injection result is not "no fault", the fault injection circuit and the non-fault injection circuit will return to the operation state corresponding to the logic value stored at the previous archive point AP; otherwise, the clock cycle after the current checkpoint CP moment is taken as the next archive moment, and the operation state of the non-fault injection circuit corresponding to the next archive moment is saved (i.e., the "archive point" is updated), and then the two circuits will continue to run, and any moment within the set number of clock cycles after the next archive moment will be taken as the fault injection moment for the next fault injection.

[0074] Based on the concept of parallel testing, this embodiment replicates the module under test to obtain a fault injection circuit and a non-fault injection circuit. A state storage unit is connected between the same sequential cells in the fault injection circuit and the non-fault injection circuit. During the fault injection process on the operating timeline of the module under test, the fault injection circuit and the non-fault injection circuit are first controlled to operate for the same number of clock cycles in an initialization state. The logic values ​​of each sequential cell within the non-fault injection circuit at this time are stored in the corresponding state storage unit as a "save point." After a single-event upset fault is injected into a specific sequential cell in the fault injection circuit, if a circuit fault is confirmed, the fault injection circuit and the non-fault injection circuit can be repaired using the logic value data at the "save point." Otherwise, the operating state of the sequential cells within the non-fault injection circuit at this time is stored, thereby updating the "save point." The module under test then continues to operate for the next fault injection. This mechanism ensures continuous and rapid SEU fault injection and repair, and enables fault injection at specific locations. Furthermore, this embodiment converts each sequential cell in the module under test into a corresponding circuit structure, enabling fault injection at specific locations.

[0075] As a further preferred technical solution, when the number of fault injections during the current round of fault injection experiments reaches a preset value, the results of the current round of fault injection experiments are uploaded.

[0076] As a further preferred technical solution, after uploading the fault injection experiment results of the current round, the method further includes the following steps:

[0077] Entering the next round of fault injection experiment, controlling the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the next round of initialization state until reaching the archiving time, and saving the logic values ​​of the sequential cells in the non-fault injection circuit at the archiving time to the state storage unit corresponding to each sequential cell, and then executing steps S3 to S5;

[0078] As a further preferred technical solution, in step S3, selecting any time within a set number of clock cycles after the archive time as the fault injection time includes:

[0079] According to the 0 to 16-bit random number generated by the pseudo-random number generator, any time within the set number of clock cycles after the archive time is used as the fault injection time.

[0080] During each round of fault injection experiments, the number of clock cycles in the initialization state varied. Within the same round, the number of clock cycles between the AP and FIP corresponding to each 1000 fault injections also varied. Assuming the initialization state duration is numA, the duration between the AP and FIP corresponding to each fault injection is numB. The range of numA values ​​can be quite wide. In the experiment, with a 50MHz clock cycle, the duration of numA was set between 0 and 3 seconds, or between 1 and 150 MHz. However, numB's range is limited to 0 to 16, and its duration at a 50MHz clock is only 0 to 320 ns. The following example illustrates the relationship between the two:

[0081] Assume that this single-event upset fault injection experiment consists of 100 rounds, with 1000 fault injections per round. In the first round, the initialization state is maintained for 100,000 clock cycles. The initialization state then jumps to the next saved state to save the logic values ​​of the sequential cells within the non-fault injection circuit at the time of archiving. The circuit then jumps back to the operating state for 1000 consecutive fault injections, followed by fault analysis and fault upload. In the second round, the initialization state is maintained for 250,000 clock cycles, followed by a jump to the next saved state, and 1000 fault injections. This is repeated for the remaining rounds. Thus, the first FIP ​​point in each round corresponds to a different time. For example, in the first round, it is at over 100,000 clock cycles, while in the second round, it is at over 250,000. This results in a total of 100,000 FIPs with varying times, fully simulating the scenario of a circuit being subjected to SEUs at random operating moments.

[0082] The fault injection circuit and the non-fault injection circuit run under the same clock. Assume that the DUT is at the first archive moment (that is, AP1 point) at the 120th clock cycle. If 4 is selected from the random number between 0 and 16 bits at this time, then the 124th clock cycle is determined to be the fault injection moment. The DUT undergoes fault injection at the 124th clock cycle (corresponding to the FIP point). Subsequently, the two circuits continue to run for 1000 clock cycles until they reach the checkpoint (that is, CP point, which is 1124 at this time) for fault inspection and analysis. If the inspection result is a fault or potential fault, the state saved at the first archive moment is reloaded into the two circuits, which is equivalent to the two circuits returning to the operating state at the 120th clock cycle. Then the next SEU injection is performed. This time, 10 is selected from a random number between 0 and 16. The 130th clock cycle is determined as the second fault injection time. The DUT is fault-injected at the 130th clock cycle, and then runs for another 1000 clock cycles to reach the second check time CP (corresponding to 1130 clock cycles) for fault analysis and inspection. If the inspection result is fault-free, the next clock cycle after the second check time, that is, the 1131 clock cycle, is used as the second archiving time (that is, AP2 point), and the latest fault-free state of the 1131 clock cycle is archived. Then the system selects a number x from the random numbers between 0 and 16 and performs fault injection at 1131+x, which is the third fault injection time. By analogy, we can see that when performing continuous SEU fault injection, the randomness of the results of each check and the values ​​selected from 0 to 16 each time makes the number of clock cycles corresponding to each fault injection FIP in a round of 1000 fault injections not fixed. In other words, the fault injection time is flexible and variable to simulate the scenario of SEU occurring at random operating times.

[0083] It can be seen that the relationship between numA and numB is similar to the coarse and fine focusing screws of a microscope. In each round, the coarse focusing screw is first adjusted to a random value, and then the fine focusing screw is adjusted 1000 times based on this value. This can effectively evenly distribute the corresponding 100,000 points on the microscope scale. Accordingly, the purpose of this setting in this embodiment is to evenly distribute the 100,000 FIP points on the circuit operation timeline, so as to better simulate the scenario where the circuit suffers from SEU at random operation moments.

[0084] Furthermore, if Figure 5 As shown in the figure, the number of clock cycles maintained in the initialization state of each round can be randomly configured by the machine in the configuration state; in each round, the number of clock cycles between the AP point and the FIP point is determined by a random number between 0 and 16 generated by a pseudo-random number generator; the number of clock cycles between the FIP point and the CP point is a fixed clock cycle, which is fixed at 1000 clock cycles in this experiment.

[0085] In this embodiment, the number of clock cycles maintained in the initialization state and the difference in clock cycles between the AP and FIP points are random values, ensuring that the scenario of the circuit being subjected to an SEU at random operating moments is fully simulated. The difference in clock cycles between the FIP and CP points represents the number of clock cycles the circuit operates during between fault injection and the checkpoint. In actual applications, this can be determined based on specific circumstances. It is sufficient to ensure that the fault injection circuit operates for a set fixed number of clock cycles after the fault is injected, allowing the injected error to propagate within the circuit.

[0086] As a further preferred technical solution, a global save signal is applied to the input end of each state storage unit, and a global load signal is applied to the output end of each state storage unit;

[0087] When the global save signal is set to 0, the logic values ​​of the sequential units inside the non-fault injection circuit are saved to the corresponding state storage units; when the global save signal is set to 1, the logic values ​​saved in the state storage units remain unchanged;

[0088] When the global load signal is set to 0, the logic value in each state storage unit is transferred to the corresponding sequential unit to repair its operating state. When the global load signal is set to 1, the fault injection circuit and the non-fault injection circuit continue to operate.

[0089] It should be noted that, taking a module to be tested that includes 5 registers as an example, the improved circuit structure is as follows Figure 3 As shown, note that save and load are both 1-bit signals. The save and load ports corresponding to the five registers are connected to these two signals respectively. FI[4:0] is a 5-bit signal, and each bit is connected to the FI port of each register.

[0090] Figure 3 The circuit structure shown has two output groups: one for the non-faulty circuit (Module_out_G) and one for the fault injection circuit (Module_out_F). The injected SEU fault may cause Module_out_G to differ from Module_out_F. Furthermore, the outputs of the five registers are also extracted and divided into two groups: one for the non-faulty circuit (inner_reg_G) and one for the fault injection circuit (inner_reg_F). This allows both sets of circuit outputs and the values ​​of the two internal registers to be extracted. Subsequently, two flag signals, out_xor and inner_xor, are established to indicate whether the two sets of outputs and the values ​​of the two internal registers are completely consistent. The values ​​of these two signals are used to classify the effects of the SEU fault injection.

[0091] Analysis shows that by pulling up a certain bit in FI[4:0], SEU fault injection can be achieved in a register in a specific circuit. Obviously, the time of pulling up can be determined manually. Therefore, this structure can achieve SEU fault injection at a specific location in the circuit and the fault injection time is controllable.

[0092] Specifically, if Figure 4 As shown in the figure, when the global save signal "save" is set to 0, the state storage unit will save the logic value of the corresponding sequential unit in the non-fault injection circuit at that moment, which is equivalent to establishing an "archive point" for the DUT. When the global save signal "save" is set to 1, the data in the storage unit will remain unchanged. Corresponding to the global save signal "save", when the global load signal "load" is set to 0, the data previously stored in the storage unit will be transferred to the corresponding sequential unit, restoring the operating state of the DUT (including the non-fault injection circuit and the fault injection circuit) to the logic value corresponding to the previous "archive point", thus repairing the fault injected into the fault injection circuit. When the global load signal "load" is set to 1, the circuit operates normally and the fault injection at the next fault point is carried out.

[0093] As a further preferred technical solution, an inverted signal is applied to the input end of each sequential unit in the fault injection circuit. Accordingly, in step S3, after a single event upset fault is injected into a target sequential unit in the fault injection circuit at a fault injection time, a fixed period is run until a check time is reached, and the operating states of the fault injection circuit and the non-fault injection circuit at the check time are compared to determine whether a fault has occurred, comprising the following steps:

[0094] Before the input signal is transmitted to the target sequential unit, a single event upset fault obtained by inverting the input signal is injected into the target sequential unit;

[0095] After the fault is injected, the fault injection circuit and the non-fault injection circuit continue to operate for a fixed clock cycle until a check time is reached, and the operating states of the fault injection circuit and the non-fault injection circuit at the check time are compared to determine whether a fault occurs.

[0096] It should be noted that if Figure 3 As shown, "FI" is an inverted signal. When "FI" is set to 1 and maintained for 1 clock cycle, the input signal "Data_in" will be XORed with 1 (that is, inverted) before being passed to the corresponding timing unit, completing the SEU fault injection into the specific timing unit.

[0097] As a further preferred technical solution, the step of comparing the operating states of the fault injection circuit and the non-fault injection circuit at the time of inspection to determine whether a fault occurs includes the following steps:

[0098] If the outputs of the fault injection circuit and the non-fault injection circuit are the same and the logic values ​​of the sequential units within the fault injection circuit are the same as the logic values ​​of the sequential units within the non-fault injection circuit, then it is determined that the impact of the injected single event upset fault on the module under test is classified as no fault;

[0099] If the outputs of the fault injection circuit and the non-fault injection circuit are the same but the logic values ​​of the internal sequential units of the fault injection circuit are different from the logic values ​​of the internal sequential units of the non-fault injection circuit, then it is determined that the impact of the injected single event upset fault on the module under test is classified as a potential fault;

[0100] If the output of the fault injection circuit is different from the output of the non-fault injection circuit, it is determined that the impact of the injected single event upset fault on the module to be tested is classified as a fault.

[0101] It should be noted that the related art only observes whether the function of the circuit is abnormal (that is, whether its output is abnormal) after the fault is injected. However, in fact, although the circuit output is normal, the logic value of the internal timing unit is not necessarily completely consistent with the normal circuit. This inconsistency may cause the circuit to be abnormal in subsequent operation, so it is called a potential fault. The existing mechanism simply attributes the impact of the injected SEU to no fault and fault, which is not comprehensive enough. This embodiment combines the circuit output and the logic value of the internal timing unit of the circuit to conduct a comprehensive fault analysis, which can more comprehensively evaluate the impact of the injected SEU fault on the circuit.

[0102] It should be understood that when it is determined that there is a potential fault or when there is a fault, the operating state of the target circuit structure unit is repaired according to the logic value in the corresponding state storage unit.

[0103] As a further preferred technical solution, the global save signal is set to 0 and the global load signal is set to 0 to maintain the same clock cycle and are both set to 1 clock cycle.

[0104] It should be noted that, in this embodiment, only one clock cycle is required for the intermediate storage unit to store the values ​​of all internal sequential units of the fault-free circuit to form an archive point. Similarly, only one clock cycle is required to load the circuit operation status corresponding to the archive point into the two circuits, so that the FI signal can be used to control the location and timing of fault injection and realize fault repair, and both the fault injection and repair processes can be completed within one clock cycle.

[0105] In addition, if Figure 6 As shown, the second embodiment of the present invention provides a single-event upset fault injection platform, which includes a host PC and an FPGA chip. The FPGA chip includes a fault injection management module and a fault injection circuit Fault-Injected Circuit and a non-fault injection circuit Fault-FreeCircuit copied from a module to be tested. The fault injection circuit and the non-fault injection circuit each include multiple sequential units, and a state storage unit State Storage Unit is connected between the same sequential units in the fault injection circuit and the non-fault injection circuit. The fault injection management module is communicatively connected to the host PC, wherein the fault injection management module includes:

[0106] A microcontroller MicroBlaze, configured to receive configuration commands and startup commands issued by the host and parse the commands to obtain parsing results, wherein the parsing results include a fault injection time, a fault injection location, and a number of operating clock cycles;

[0107] A fault manager is configured to, during a current round of fault injection experiment, control the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the current round of initialization state according to the analysis results until a save time is reached, and save the logic values ​​of the sequential cells in the non-fault injection circuit at the save time into the state storage unit corresponding to each sequential cell; then select any time within a set number of clock cycles after the save time as the fault injection time, inject a single-event upset fault into a target sequential cell in the fault injection circuit at the fault injection time, and then run for a fixed cycle until a check time is reached; compare the operating states of the fault injection circuit and the non-fault injection circuit at the check time to determine whether a fault has occurred; if a fault has occurred, repair the operating states of the fault injection circuit and the non-fault injection circuit using the logic values ​​stored in the state storage unit corresponding to the target sequential cell; otherwise, set the clock cycle after the check time as the next save time, update the logic values ​​stored in the state storage unit according to the logic values ​​of the sequential cells in the non-fault injection circuit at the next save time, and continue the circuit operation for the next fault injection.

[0108] As a further preferred technical solution, the fault injection module further includes a position controller and a pseudo-random number generator (PRNG), wherein the outputs of the position controller and the pseudo-random number generator are both connected to the fault manager, and an inverted signal is applied to the input of each sequential unit in the fault injection circuit;

[0109] The position controller is connected to the negated signal to control the position and timing of fault injection;

[0110] The pseudo-random number generator is used to generate a random number. When the value of the internal counter of the fault manager is equal to the random number generated by the pseudo-random number generator, the position controller pulls up the signal applied to the input end of the selected timing unit for one clock cycle.

[0111] Specifically, the PC host and FPGA communicate using UART data transmission. The PC is responsible for configuring the fault injection process, such as selecting specific timing cells for fault injection, controlling the fault injection process, and displaying the results of the fault injection experiment. In implementing the UART communication interface, the experiment directly utilizes the UART IP core integrated into the Xilinx EDA toolset. MicroBlaze is a customizable microprocessor soft core provided by Xilinx.

[0112] Specifically, the position controller uses a 321-bit shift register with output enable. In the configuration state, the PC can send specific instructions to set the start and stop positions of the circular shift. Therefore, the scope of SEU fault injection is limited to a specific timing unit, submodule, or even the entire DUT. When the DUT runs to the time corresponding to the fault injection point FIP, the output of the position controller will be valid for one clock cycle, so that an SEU is injected into the specific position.

[0113] Specifically, PRNG uses a LFSR (Linear Feedback Shift Register), which generates consecutive left-shifted input bits by performing an XOR operation on specific internal bits. An n-bit linear feedback shift register can generate a total of (2 n -1) random numbers.

[0114] As a further preferred technical solution, the fault manager adopts a finite state machine (FSM), which consists of 7 states, including configuration state, initialization state, save state, running state, loading state, analysis state and upload state. The jump rules between states are as follows: Figure 7 The specific operations for each state are as follows:

[0115] (1) Configuration state: When the FPGA chip is reset or powered on, the FSM is in this state. The PC host can send some necessary configuration commands to the microcontroller MicroBlaze. MicroBlaze parses these commands to configure the fault injection process, such as selecting specific timing units for fault injection and enabling fault injection. After completing the platform configuration, the PC host can send a start command, and the FSM will transition to the next state, the initialization state.

[0116] (2) Initialization state: In the initialization state, the fault injection circuit and the non-fault injection circuit will run for a specific number of cycles under the same clock. This number of cycles is also controlled by the configuration command sent by the PC. The FSM will then automatically transition to the next state, the saved state.

[0117] (3) Save state: This embodiment sets the save state to be maintained for one clock cycle. In this state, the “save” signal of the DUT is set to 0, while in all other states, the “save” signal remains at 1.

[0118] (4) Loading state: The embodiment sets the loading state to be maintained for only one clock cycle. In this state, the "load" signal of the DUT is set to 0, while in all other states, the "load" signal remains at 1.

[0119] (5) Run state: In this state, there is a counter that starts at 0. When its value is equal to the random number generated by the PRNG, the position controller will pull the FI signal of the selected timing unit high for one clock cycle. This will inject an SEU at a specific location. Subsequently, the two circuits will continue to run for a certain number of clock cycles (set to 1000 in the experiment; this value is not fixed, but it cannot be too short to ensure that the injected SEU fault propagates in the circuit). After this, the FSM will transition to the next state.

[0120] (6) Analysis state: This state is used to compare the outputs of the two circuits and the differences between the internal timing elements, and classify the results of the SEU fault injection into three categories according to the classification method mentioned above. This state also only lasts for one clock cycle. The type of SEU fault injection result directly determines the next state that the FSM will transition to: if it is determined that there is no fault, it enters the save state to update the logic value stored in the state storage unit; otherwise, it enters the load state to repair the operating state of the circuit structure unit according to the logic value in the state storage unit and enters the operating state after the repair; if it is determined that the number of fault injections reaches the preset value in the classification state, it enters the upload state.

[0121] (7) Upload state: When the number of SEU fault injections reaches the preset value, the FSM will transition to this state and the FPGA will send the experimental results to the PC using the UART interface.

[0122] Furthermore, in this embodiment, a widely used microcontroller, the PIC16F54, was selected as the device under test (DUT) for the fault injection experiment. Taking the DUT used in this experiment as an example, each of the 321 sequential units within the PIC16F54 fault injection circuit has an inverted FI signal at its input. These 321 signals are combined to form the inverted signal FI[320:0] at the input of the fault injection circuit. Each bit FI[x] corresponds to one of the 321 registers, with x ranging from 0 to 320. Table 1 shows its submodules, internal sequential units (a total of 321 registers), and corresponding FI signals. Furthermore, a ROM with a 9-bit address and 12-bit data bit is instantiated in the project as the instruction memory for the microcontroller. By modifying the data in the ROM, the PIC16F54 can run different load programs. The pseudo-random number generator used in the experiment is 4 bits, so when the FSM transitions to the run state, SEU fault injection is executed within 16 clock cycles.

[0123] Table 1 Internal timing unit of PIC16F54

[0124]

[0125] When using this platform to perform fault injection on the PIC16F54, different loads compiled into different instructions may lead to different SEU sensitivity evaluation results. Therefore, in the experiment, two different loads were prepared for this microcontroller and SEU fault injection experiments were performed separately. The output pins of the DUT are two sets of GPIO (General-Purpose Input / Output) interfaces, PORTA and PORTB.

[0126] In a fault injection experiment, the default value was set to 1000. In the actual experiment, 100 rounds of fault injection were performed, meaning that all sequential cells in the DUT were exposed to 100,000 fault injections. The duration of the initialization state in each round was randomized to fully simulate the phenomenon of SEUs occurring during random circuit operation.

[0127] Use SER (Soft Error Rate) to measure the SEU sensitivity of the DUT. The sensitivity calculation formula is as follows:

[0128]

[0129] Where, Total num is the total number of SEU fault injections, Fault numis the number of times an error state occurs in the DUT after SEU fault injection.

[0130] (1) SEU sensitivity assessment before reinforcement

[0131] Targeted SEU fault injection was performed on various submodules of the PIC16F54. Table 2 shows the experimental results. Load 1 involved multiple subroutine calls, while Load 2 utilized the microprocessor's timer resource (TMR0). The experiments showed that the instruction fetch module, special function register module, and decode module exhibited high SEU susceptibility. While the experimental data under the two loads were not exactly the same, they generally showed similar trends.

[0132] Furthermore, since neither load uses a non-addressable register, SEU fault injection into this register does not affect the circuit's functionality or cause circuit output errors. Therefore, its soft error rate is represented by a dashed line.

[0133] Table 2 SER results of submodules

[0134]

[0135] Next, targeted SEU fault injection was performed on each sequential cell within the DUT. The results are shown in the figure. Figure 8 As shown in Figures 8(a) and 8(b), the horizontal axis represents the name of the sequential element and the vertical axis represents the SER value. Figure 8(a) shows the failure rate, potential failure rate, and no-fault rate of each internal register obtained by performing a fault injection experiment when the PIC16F54 runs the dot matrix display load program 1, and Figure 8(b) shows the result obtained when running the load program 2 for calculating the Fibonacci sequence. In the SEU fault injection experiment of load program 1, the sequential units with higher SER include Stack1, Stack2, PC_next, pop, push, etc. This is because this load is associated with frequent stack use. For load program 2, since it does not require frequent stack operations, the SER of stack-related registers (such as Stack1 and Stack2) is significantly reduced, as shown in Figure 8(a). Figure 8(b) shows this. However, due to the use of the TMR0 register, the corresponding SER reaches 90%. It should be noted that, due to the artificial setting of PORTA and PORTB as the outputs of the circuit, in the Load 1 experiment, the SER of PORTA is 100%. This load does not write any values ​​to PORTA, resulting in the error persisting after fault injection. On the other hand, PORTB frequently refreshes its value within a large program segment, resulting in a soft error rate of less than 5%. In Load 2, PORTA and PORTB are rewritten to new values ​​every clock cycle based on changes in TMR0. Therefore, the fault is cleared on the next clock cycle after fault injection, resulting in a stable SER of 0%. It should be noted that this is not the case in actual FPGA applications. Some sequential cells may not be used under certain loads. If faults are injected into these cells, no output errors will be generated, but they will also not be refreshed with the correct values, causing the injected fault to persist, making the fault injection result a 100% potential fault. Figure 8 The results of multiple register fault injection in also prove this situation.

[0136] (2) SEU sensitivity assessment results after reinforcement

[0137] Triple Modular Redundancy (TMR) technology is currently the most widely used and effective SEU hardening technique. This technology replicates the circuit into three copies and uses a three-way voter to output the final result. When FPGA resources are limited and full TMR redundancy cannot be implemented for the entire system, selectively hardening key timing elements in the system circuit can still enhance overall reliability. Based on previous SEU sensitivity assessment results, we use this technology to harden timing elements with high SEU sensitivity (such as the PC pointer register, stack-related registers, TMR0, and decoding control signals).

[0138] exist Figure 8 (a) After the corresponding fault injection experiment, the experimental data was summarized and it was found that some sequential units such as stack_1, stack_2, PC, etc. were highly sensitive to SEU. Fault injection into these units will lead to a high probability of circuit failure. After reinforcing these sequential units with triple-module redundancy technology, the results of the fault injection experiment were obtained again. Figure 9 Table 3 shows a comparison of resource overhead between the original microprocessor circuit and the reinforced microprocessor circuit. It can be observed that by selectively reinforcing highly sensitive sequential cells, circuit reliability can be significantly improved at minimal additional resource cost, which indirectly reflects the ability of the platform to accurately and effectively evaluate the SEU sensitivity of the DUT.

[0139] Table 3 Circuit resource consumption before and after reinforcement

[0140]

[0141] In the experiment, SEU faults were injected into a microprocessor circuit, and SEU sensitivity was evaluated before and after reinforcement. The results showed that the platform can effectively identify the sensitivity of various parts of the circuit to SEU and accelerate the debugging process of FPGA radiation-resistant design.

[0142] (3) Platform performance analysis

[0143] Unlike traditional random fault injection based on modifying the configuration bitstream file, the fault injection method used in the fault injection platform designed in this embodiment does not require frequent data transmission between the PC and the FPGA, which greatly improves the speed of fault injection. It can support SEU-directed injection of specific timing units in the circuit. Both fault injection and repair only require 1 clock cycle, so it supports fast and continuous fault injection. Taking a clock frequency of 50MHz and the number of cycles the circuit runs after fault injection as 1000 as an example, the speed of SEU fault injection is 20.4 microseconds per injection, while the time consumption of the configuration-based fault injection method is in the millisecond level. This platform not only helps to better understand the behavior of the circuit under fault injection scenarios, but also evaluates the robustness and reliability of each part of the circuit, providing an efficient method for fault analysis and mitigation.

[0144] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0145] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0146] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A single event upset fault injection method, characterized in that: The method comprises the following steps: S1. Duplicate the module to be tested to obtain a fault injection circuit and a non-fault injection circuit, wherein each of the fault injection circuit and the non-fault injection circuit comprises a plurality of sequential units, and a state storage unit is connected between the same sequential units in the fault injection circuit and the non-fault injection circuit; S2. During the current round of fault injection experiment, control the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the current round of initialization state until a save time is reached, and save the logic values ​​of the sequential units in the non-fault injection circuit at the save time into the state storage unit corresponding to each sequential unit; S3, selecting any time within a set number of clock cycles after the archive time as the fault injection time, injecting a single event upset fault into the target sequential unit in the fault injection circuit at the fault injection time, and then running for a fixed period to reach the inspection time, comparing the operating states of the fault injection circuit and the non-fault injection circuit at the inspection time to determine whether a fault occurs, and if so, executing step S4, otherwise executing step S5; S4. Repairing the operating states of the fault injection circuit and the non-fault injection circuit using the logic value stored in the state storage unit corresponding to the target sequential unit; S5. Use the clock cycle after the inspection moment as the next archiving moment, update the logic value stored in each state storage unit according to the logic value of the sequential unit in the non-fault injection circuit at the next archiving moment, and repeat step S3 to perform the next fault injection.

2. The single event upset fault injection method according to claim 1, wherein: When the number of fault injections during the current round of fault injection experiments reaches a preset value, the results of the current round of fault injection experiments are uploaded.

3. The single event upset fault injection method according to claim 1, wherein: After uploading the fault injection experiment results of the current round, the method further includes: Entering the next round of fault injection experiment, controlling the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the next round of initialization state until reaching the archiving time, and saving the logic values ​​of the sequential cells in the non-fault injection circuit at the archiving time to the state storage unit corresponding to each sequential cell, and then executing steps S3 to S5; Among them, the number of running clock cycles of the initialization state is different during each round of fault injection experiments.

4. The single event upset fault injection method according to claim 1, wherein: In step S3, selecting any time within a set number of clock cycles after the archive time as the fault injection time includes: According to the random number generated by the pseudo-random number generator, any time within the set number of clock cycles after the archiving time is used as the fault injection time.

5. The single event upset fault injection method according to claim 1, wherein: A global save signal is applied to the input end of each state storage unit, and a global load signal is applied to the output end of each state storage unit; When the global save signal is set to 0, the logic value of each sequential unit in the non-fault injection circuit is saved to the corresponding state storage unit; when the global save signal is set to 1, the logic value saved in each state storage unit remains unchanged; When the global load signal is set to 0, the logic value in each state storage unit is transferred to the corresponding sequential unit to repair its operating state. When the global load signal is set to 1, the fault injection circuit and the non-fault injection circuit continue to operate.

6. The single event upset fault injection method according to claim 1, wherein: An inverted signal is applied to the input terminal of each sequential unit in the fault injection circuit. Accordingly, after injecting a single event upset fault into a target sequential unit in the fault injection circuit at a fault injection time, a fixed period is run until a check time is reached, and the operating states of the fault injection circuit and the non-fault injection circuit at the check time are compared to determine whether a fault occurs, including: Before the input signal is transmitted to the target sequential unit, a single event upset fault obtained by inverting the input signal is injected into the target sequential unit; After the fault is injected, the fault injection circuit and the non-fault injection circuit continue to operate for a fixed clock cycle until a check time is reached, and the operating states of the fault injection circuit and the non-fault injection circuit at the check time are compared to determine whether a fault occurs.

7. The single event upset fault injection method according to claim 1 or 6, characterized in that: The comparing the operating states of the fault injection circuit and the non-fault injection circuit at the time of inspection to determine whether a fault occurs includes: If the outputs of the fault injection circuit and the non-fault injection circuit are the same and the logic values ​​of the sequential units within the fault injection circuit are the same as the logic values ​​of the sequential units within the non-fault injection circuit, then it is determined that the impact of the injected single event upset fault on the module under test is classified as no fault; If the outputs of the fault injection circuit and the non-fault injection circuit are the same but the logic values ​​of the internal sequential units of the fault injection circuit are different from the logic values ​​of the internal sequential units of the non-fault injection circuit, then it is determined that the impact of the injected single event upset fault on the module under test is classified as a potential fault; If the output of the fault injection circuit is different from the output of the non-fault injection circuit, it is determined that the impact of the injected single event upset fault on the module to be tested is classified as a fault.

8. A single event upset fault injection platform, characterized in that: The platform includes a host and an FPGA chip. The FPGA chip includes a fault injection management module and a fault injection circuit and a non-fault injection circuit copied from a module to be tested. The fault injection circuit and the non-fault injection circuit each include multiple sequential units, and a state storage unit is connected between the same sequential units in the fault injection circuit and the non-fault injection circuit. The fault injection management module is communicatively connected to the host, wherein the fault injection management module includes: a microcontroller, configured to receive configuration commands and startup commands issued by the host and parse them to obtain parsing results, wherein the parsing results include a fault injection time, a fault injection location, and a number of operating clock cycles; The fault manager is configured to, during a current round of fault injection experiment, control the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the current round of initialization state according to the analysis result until a save time is reached, and save the logic values ​​of the sequential cells in the non-fault injection circuit at the save time into the state storage unit corresponding to each sequential cell; then select any time within a set number of clock cycles after the save time as the fault injection time, inject a single event upset fault into a target sequential cell in the fault injection circuit at the fault injection time, and then run for a fixed cycle until a check time is reached; compare the operating states of the fault injection circuit and the non-fault injection circuit at the check time to determine whether a fault has occurred; if a fault has occurred, repair the operating states of the fault injection circuit and the non-fault injection circuit using the logic values ​​stored in the state storage unit corresponding to the target sequential cell; otherwise, set the clock cycle after the check time as the next save time, update the logic values ​​stored in the state storage unit according to the logic values ​​of the sequential cells in the non-fault injection circuit at the next save time, and continue the circuit operation for the next fault injection.

9. The single event upset fault injection platform according to claim 8, wherein: The fault injection management module further includes a position controller and a pseudo-random number generator, wherein the outputs of the position controller and the pseudo-random number generator are both connected to the fault manager, and an inverted signal is applied to the input end of each sequential unit in the fault injection circuit; The position controller is connected to the negated signal to control the position and timing of fault injection; The pseudo-random number generator is used to generate a random number. When the value of the internal counter of the fault manager is equal to the random number generated by the pseudo-random number generator, the position controller pulls the input signal applied to the selected target timing unit high for one clock cycle.

10. The single event upset fault injection platform according to claim 8, wherein: The fault manager uses a finite state machine, which includes a configuration state, an initialization state, a save state, a running state, a loading state, an analysis state, and an upload state, wherein: When the FPGA chip is reset or powered on, the fault manager is in a configuration state and receives parsed results of commands; After receiving the start command sent by the host, the controller switches to the initialization state, controls the fault injection circuit and the non-fault injection circuit to run the same clock cycle in the previous round of initialization state, and enters the saving state after reaching the archiving time; When in the saving state, the logic values ​​of the sequential units inside the non-fault injection circuit at the archiving time are saved to each of the state storage units, and then the running state is entered; When in the running state, any time within a set number of clock cycles after the archive time is selected as the fault injection time to inject a single event upset fault into the target sequential unit selected in the fault injection circuit, and the system continues to run for a fixed clock cycle until reaching the check time and entering the analysis state; When in the analysis state, the operating states of the fault injection circuit and the non-fault injection circuit at the inspection time are compared to determine whether a fault occurs. If it is determined that there is no fault, the system enters a save state to use a clock cycle after the inspection time as the next archiving time, and uses the logic value of the sequential unit in the non-fault injection circuit at the next archiving time to update the logic value stored in each state storage unit. Otherwise, the system enters a loading state to repair the operating states of the fault injection circuit and the non-fault injection circuit according to the logic value in the state storage unit and enters the operating state after the repair. When it is determined in the analysis state that the number of fault injections reaches a preset value, the upload state is entered and the test result of the module to be tested is uploaded to the host.

Images