Implementation of a 1oo2-RISC-Architecture on FPGA for Safety Systems

Josef Börcsök, Ali Hayek, Muhammad Umar

University of Kassel, Kassel, Germany
[Link]@[Link], [Link]@[Link], mumar@[Link]

Abstract language as input. But the problem is that it has been

designed for circuit simulation which tends to make the
Nowadays embedded systems are increasingly used specifications biased towards efficient ASIC solutions
in industrial applications. FPGAs are being used in and less appropriate for software implementation.
complex roles in critical systems. The purpose of this FPGA designs that are primarily designed at the
paper is to present the basic ideas behind the building behavioural and the structural level using VHDL are
of safety related 1oo2 system on FPGA platform. Since only intended for describing the implementation of a
systems with a single processor (1oo1) provide cost system for synthesis or simulation. For Verification
effective inputs with a safety integrity rating of SIL1 2, and Validation this language has been used also for
a dual architecture (1oo2) which provide high safety formal verification [3] to ensure the correctness of
integrity to a rating of SIL 3, is presented. In the first designs.
part the complete design of a simple FPGA 16 bit RISC If we define robustness as the ability to continue the
processor and a system on-chip design in synthesizable mission reliably despite the existence of systematic or
VHDL is presented and the safety demands for the random faults [4], we can say that modern electronic
1oo2 architecture is given. In the second half of the systems are less and less robust. This is due to the
paper, the implementation of the RISC architecture complexity of the new technologies, e.g. due to soft
and of the 1oo2 architecture and some running errors susceptibility, coupling effects, leakage
applications are shown. contribution and increased sensitivity to internal and
external disturbs and so on. Nowadays new
technologies and multi-CPUs electronic systems are
1. Introduction used in high volume applications where safety is a key
factor: in automotive industry, electronic systems,
Field programmable gate arrays and other control and process systems. In such scenario, there is
reconfigurable hardware devices can be used to a much need of tools, methodologies and HW/SW
implement almost any hardware design. They are architectures with which engineers can manage
called this because they are both programmable and robustness, safety and related costs at all different level
have a structure like a modern array ASIC. Safety of abstractions [5]. This Paper is presenting the first
critical systems are increasingly used in the most of the step of designing a safety critical system on a FPGA.
control and industrial applications. These systems In this, the implementation of a 16 bit RISC-
could be realized on many different hardware microprocessor as a 1oo2-architecture that consists of 2
platforms such as programmable logic controller CPU units is introduced.
(PLC), microcontroller (MCU), digital signal
processors (DSP) or other logic devices. In this work, 2. RISC Architecture
the possibility of modeling safety critical systems on
programmable logic using hardware programming 2.1. Introduction
languages like VHDL is studied. VHDL [1], [2] is a
very appropriate language for designing digital circuits, In this section the implemented microprocessor [6]
since it provides a direct route to ASIC implementation is presented. The 16 Bit RISC-processor used in this
by using high-level synthesis systems which accept this work is designed in our department and consists of the
following components:
1
SIL: The Safety Integrity Level is the relative level of risk- − Several machine Instruction with an
reduction provided by a safety function or it specifies a target level
of risk reduction [7] identical length of 16 Bits

978-1-4244-1968-5/08/$25.00 ©2008 IEEE 1046

 − Main Storage which is specified by 12 Bits stores the instruction currently being
(4096 bytes). executed.
− Arithmetic –logical-unit (ALU). − The instruction counter: the program counter
− Register file consisting of three 16 bit (also called the instruction pointer, part of the
register. instruction sequencer in some computers) is a
register in a processor which indicates
processor in its instruction sequence.
Figure 1 shows the architecture of the RISC processor.
− The accumulator: an accumulator is a register
Data Bus 16 Bit in which intermediate arithmetic and logic
16 bit outreg
results are stored.
penable

16 bit OP IR
4K x 16Bit
2.1.3 ALU. The arithmetic and logical operations are
16 bit
summarized in the ALU. Logical unit performs logic
16 bit
ldop ldia Main
16 bit Memory

alu_x alu_y
PC
functions (AND, OR, XOR etc.) and arithmetic unit
in_flags
accu_alu accu_db
Accu
Accu_in
ldpc

MPX
Output perform function (Addition & subtraction). Bit-shifting
out_flags
ALU opcode ldalu lddb
operation (shifting a word by a specified number of
bits to the left or right, with or without sign extension)
outpc
alu_out
mem_en read clk
5 bit
4 bit

in_flags
shift register
alu_out
Address Bus 11Bit
is also implemented in ALU.
out_flags databus
16 bit
N
Control signals
Z 4 bit
C
lddb ldalu ldflag ldop ldia ldpc incpc outpc m em _en read p_en
2.1.4 Memory. The main storage of the processor is
V
12
Controller
addressed over 12 address lines. For this reason 2
clk Reset words can be addressed. The entire storage capacity of
Figure 1. Data path of the RISC processor main storage amounts to 4096 byte (4 Kbytes).

In the following, the components of this architecture 2.1.5 Data path and operations. The FSM of the
are presented. processor is shown in figure 2. At the start up system
initialize all output signals to zero and it will check for
2.1.1 Instruction set. A list of all instructions that the control signals for memory from processor. In this
processor can execute are defined in instruction set. system 5 states are needed:
There are 21 instructions that can be handled by this
processor; some are listed in table 1. − Ready: the start state
− Fetch: to fetch the data
Table 1: Instruction set Architecture − Get01: for alu operations (Decode the
Assembler Mnemonic Short Explanation instruction, Fetch Operands)
SHLA SHLA Arithmetic Shift left − Get02: for load/store operations
− Finish: the end state
STA Adr. STAABS Absolute store
STA Adr. STAIND Indirect store
LDA Adr. LDAIND Load indirect
LDA#daten LDAUNM Load direct
LDA Adr LDAABS Load absolute
ADDA Adr ADDA Addition
SUBA Adr SUBA Subtraction
ORA Adr ORA Logic operation OR
ANDA Adr ANDA Logic operation AND
EORA Adr EORA Logic operation Ex-OR

2.1.2 Register file. The simple RISC architecture has

three 16 bits registers:
Figure 2. FSM of the RISC processor
− The register of instructions: an instruction
register is the part of a CPU's control unit that

1047
3. Safety-critical 1OO2-System 3.2.2 MTTF value. The MTTF-value is the expected
average time to a failure in a system. The MTTF is
In this section the 1oo2 (one out of two) safety simply the reciprocal of the failure rate λ.
system will be discussed. The 1oo2 safety architecture
is one of several system architectures that have been 3.2.3 MTTR value. The MTTR-value is the expected
described in the standard IEC 61508 [7]. The 1oo2 time to repair a system when a failure occurs. The
architecture is also one of the best safety system repair rate is normally represented by µ.
architectures [8].
3.2.4 Probability of failure. The Probability of failure
of a 1oo2-system can be determined with help of the
3.1 Introduction fault tree analysis [10]. The equation for the probability
of failure is:
The 1oo2 system is a safety system that consists of
2 independent channels. Both channels are connected
to each other in such a way that only one of them is
P(t ) = P1 (t ) ⋅ P2 (t ) + PDUC (t ) + PDDC (t )
sufficient for triggering the safety function [8].
with
3.2 Calculation P1 (t ) = 1 − e − λD1 ⋅t is the probability of failure for the
first component. λ D1 is the number of dangerous
Some safety characteristics are described and
calculated for the 1oo2 architecture. These failure appearing in the first component.
characteristics are described briefly. For more P2 (t ) = 1 − e − λD 2 ⋅t is the probability of failure for the
information see [8] and [9]. Some characteristics are
second component. λ D 2 is the number of dangerous
explained below:
failure appearing in the first component.
− Failure rate λ PDDC (t ) = 1 − e − β D ⋅λDD ⋅t is the probability of
− MTTF: Mean Time to Failure. common cause failures of the system. λ DD is the
− MTTR: Mean Time to Repair.
number of the dangerous detected failure, which is
− PFD: probability of failure of demand
− Markov-Model weighted by a constant β D .

3.2.1 Failure rate. The failure rate is the most 3.2.5 PFD value. The PFD-value represents the
important parameter in safety systems. It represents the probability of failure on demand. The PFD-value of the
frequency with which an engineered system or 1oo2-system can be determined as follows:
component fails, expressed for example in failures per PFDavg = 2 ⋅ [(1 − β ) ⋅ λ DU + (1 − β D ) ⋅ λ DD ]2
hour. The failure rate of a system in general can only
be determined experimentally. The failure rates and
their distribution are shown graphically in figure 3. ⋅ tCE ⋅ t GE
This distribution is statistically determinate and is with
mentioned in [8].

SAFE DETECTED tCE is the equivalent mean failure time of a circuit

SAFE S D

 T1 
SD
SD DANGEROUS UNDETECTED
λDU ⋅  + MTTR  + λDD ⋅ MTTR
tCE =  2 
SU
SU
SS
DU
λDU + λDD
DD
SAVE UNDETECTED and tGE is the equivalent mean failure time of a group
DD
DD
 T1 
S SD SU
DANGEROUS λDU ⋅  + MTTR  + λDD ⋅ MTTR
DANGEROUS DETECTED
tGE = 3  .
D DD DU λDU + λDD
Figure 3. Failure rates distribution

1048
3.2.6 Markov chain. The Markov Model is a Unit capable of evaluating logical and arithmetic
mathematical discrete-time stochastic process. The functions, main memory, and a single accumulator.
Markov model is used for calculating the MTTF-value The 1oo1 supports the following instructions: a load
of a safety system. instruction and a store instruction which copy data
between RAM and the accumulator, a branch on carry
4. Implementation instruction, and an addition instruction. The 1oo1
supports the following addressing modes: direct and
This section describes the implementation of the immediate. The RISC architecture has been explained
1oo2 RISC architecture on a FPGA. The first part deals in the second section. VHDL code written for the 1oo1
with the FPGA which was used in this system design architecture contains 7 components [RAM, ALU,
for the implementation of the 1oo2 architecture. The Accumulator, Shift register, Status register, (Control
second part deals with the implementation of the single path contain Instruction register, program counter and
multiplexer) and Output register]. All these 7
RISC architecture (1oo1 architecture) as how it is
components are used in the 1oo1 architecture where
programmed using VHDL and implemented in the
control sequence with 5 different states (Ready, Fetch,
FPGA and something about synthesis, usage and place
Get01 (execute direct addressing mode), get 02
& route facts. The third part the 1oo2 architecture will (indirect addressing mode) and finish. All 7
be described. components are programmed individually with utmost
functionality that RISC architecture can have. When
4.1 FPGA the system is programmed using VHDL, first important
thing is to synthesize3 the design. In the following the
An interesting use of reconfigurable technology is to synthesis results are shown. The Total number of slice
use it for computing. To a first order, the goal is to register (logic utilization) were 118 out of 6144, that
compile code into a hardware description instead of a means only 1 % utilization. The second step is to
sequence of machine instructions. The hope is that the implement the design into FPGA. In design
hardware configuration will result in a shorter implementation, the mapping phase involves simplified
processing time. The FPGA that was used for this functions being mapped to component primitives
design is the Xilinx XC2V500-6FG456C [11]. XC2V within the FPGA slices. PAR4 involves the process of
states device type which is Virtex2, 500 shows number interconnecting other primitives within the slice to a
of logic gates, -6 shows speed grade2, FG shows matrix of wire segments, programmable switches, and
package type, 456 shows number of pins and C is routing resources within the FPGA. The ISE tool is
temperature range (0° C to +85° C).Virtex2 is designed timing driven and therefore provides the ability to
for high performance with high speed and low power specify timing requirements for critical paths in the
design through its timing analyzer and constraints
consumption. Xilinx Virtex FPGAs are based on Look
editor tools. The Device utilization is categorized in 3
up Tables (LUTs). The basic elements are
parts. First one is the number of BUFGMUXs [12] and
Configurable Logic Blocks (CLBs), and each CLB
they were 2 out of 16(12% utilization), the number of
contains eight LUTs. CLBs are made up of FPGA external IOBs5 were 17 out of 264 (6% utilization) and
slices which contain function generators; storage there are 247 number of slices used out of 3072 (8%
elements, logic gates, multiplexers, and a fast carry utilization).
look-ahead chain. Typical usage includes
telecommunication, wireless, networking, video and 4.3 1oo2 Architecture
DSP application. For more information please refer
Xilinx data sheet [11]. The 1oo2 architecture consists of two independent
RISC processors. In order to carry out the safety
4.2 1oo1 Architecture function correctly both processors are connected with
each other in a way that output is available only if both
The 1oo1 architecture is represented by a single processors are working correctly. The 1oo2 system will
RISC architecture and has the following features: fail if both processors will fail or give different
single cycle instruction execution, an Arithmetic Logic
3
Synthesis is a process by which an abstract form of desired
circuit behaviour (typically register transfer level or behavioural) is
2
Internal frequency is the speed at which CPLDs/FPGAs can turned into a design implementation in terms of logic gates.
4
perform operations or transfer data internally. The propagation delay Place and Route
5
is the time interval between the application of an input signal and the Input/Output Block. A collection or grouping of basic elements
occurrence of the corresponding output in a logic circuit. that implement the input and output functions of an FPGA device.

1049
outputs. Figure 4 shows Block diagram of the 1oo2
architecture.

Figure 5. Place and route analysis of the 1oo2-

architecture

In order to achieve a safety aspect in the system, the 2

Figure 4. 1oo2 architecture Block Diagram architectures can be placed separately on the FPGA.
This can be achieved by a xilinx tool named
The implementation of 1oo2 architecture in FPGA is PlanAhead. PlanAhead design flow resembles like
almost same as the 1oo1 architecture. The Controller typical FPGA CAD tool flow till the synthesis level.
task is to check results of both processors and when After Synthesis, the netlist can be imported into the
both are equal, it will generate the output and that will PlanAhead tool and a manual floor planning can be
be fed to output register. If the controller finds that started. The PlanAhead hierarchical floor planner
both processors are giving different results, it won’t delivers a faster, more efficient design environment
output any result to output register and it will go in an that lets find and fix problems early in the design
alarm state by activating some fault signal generated a process. Only major difference that this work shows
by the controller system. In order to realize the safety was 552 numbers of slices out of 3,072 (17.97%) as
demands required by the 1oo2 safety system mentioned compared to 21% when automatically done by ISE.
in section 3, some further works are necessary. An Figure 6 Shows the PAR result after the PlanAhead
important impact is to let the system work in a safe procedure. Here the physically separated components
state if one of the two processors fails, by detecting are shown.
which processor is generating bad results.
The synthesize results shows the total number of slice
register (logic utilization) were 695 out of 6144, that
means only 11 % utilization. Logic distribution shows
745 numbers of occupied slices used out of 3,072 (24
%). The device utilization is categorized in 3 parts.
First one is number of BUFGMUXs and they were 2
out of 16(12% utilization), number of external IOBs
were 31 out of 264 (11% utilization) and there are 745
number of slices used out of 3072 (21% utilization).

5. Analysis
Figure 6. Place and route analysis of the 1oo2-
In this section the results of the implementation are architecture after PlanAhead
discussed. Furthermore, some results and applications
are shown. Figure 5 is a snapshot taking from ISE 8.2 One more application that has been done in this work
that show placement and routing of 1oo2 architecture. is deliberately injection of faults and checks the
It has been done automatically by a CAD tool, so one behaviour of system. For this purpose the VHDL code
can see a random placement of the components. of one processor is manipulated so that it won’t
generate right results with respect to the other
processor. The controller task is to check the results of
both processors. If these give different results, then it

1050
will generate alarm signal and shutdown the system as arguments for safety critical hardware and software are
can bee seen in the simulation results in figure 7. The developed together with the same rigour as for
signal “fault” is the signal that goes high when the software alone. In order to realize a complete safety
processors data are different. The “fault” signal goes critical system on a FPGA platform we plan to
high as it sees different “data_in” and “pudata_in” continue our research work in several steps. The most
value under get01 state that explained earlier in section important step is the implementation of safety
2. The rest of the figure shows several control signals, properties into the VHDL-code, placing the used
states and operation information. components accordingly, reducing routing delays
(physical synthesis) and verification of the system.

7. References
[1] ANSI/IEEE STD 1076–1993, IEEE Standard VHDL
Language Reference Manual. IEEE, New York, USA, 1994.

[2] Pong C.: RTL Hardware design using VHDL: Coding for
Efficiency, Portability and Scalability, Wiley & Sons, UK,
2006.

[3] A. Gupta. “Formal hardware verification methods: A

Survey”, Journal of Formal Methods in System Design,
1:151–238, 1992.

[4] H. Tahne, “Safe and Reliable Computer Control: Systems

Figure 7. Simulation results Concepts and Methods”, University of Stockholm, Sweden,
1996
Furthermore, for safety systems it is very important
that your device never fails and the code that resides in [5] R. Mariani, “A Platform-based Technology for Fault-
the used device must be fail safe. In the future works robust Soc Design”, IP/SOC 2006 Conference, Grenoble-
the processor code will be redesigned in such a way France, 2006
that it work as fail-safe system. For this work new
programming techniques must be used that are suitable [6] Börcsök J., Lecture: Computer architecture, University of
Kassel, Germany, 2006, pp. 327-349.
for (area and speed) of device and secondly component
verification methods must be realized in order to see [7] IEC/EN 61508: “International Standard 61508 Functional
the implementation meets the requirements. safety: Safety related Systems”, International
Electrotechnical Commission, Geneva, 2005
6. Conclusion
[8] Börcsök J., Functional Safety: Basic Principles of Safety-
As part of this work a suitable logic design strategy related Systems, Hüthig-Verlag, Heidelberg, 2006
required for the rapid prototyping of different
processor architectures on the reconfigurable system [9] Börcsök J., Electronic Safety Systems: Hardware
Concepts, Models and Calculations, Hüthig-Verlag
has been developed. The 1oo2 architecture gains the Heidelberg, 2004
most benefits from while the 1oo1 is the least sensitive.
For redundant architectures counts that there is more [10] Fault tree handbook, download: [Link]
chance on finding failures then there is for single Document name: NUREG0492
architectures. As already mentioned, the logic
utilization of both architecture for FPGA XC2v500- [11] Virtex-II platform FPGAs data sheet, Xilinx, Inc., 2005
[Link]
6gf456, total consumption of logic block were 24 % in
1oo2, that means in future more processor architecture [12] Global Clock MUX Buffer with Output State 0,
can be accommodated depending upon design [Link]
requirement or processors with bigger performance can v4lsc/v4lsc0030_21.htm
be used. To attain the necessary safety integrity levels,
new safety standards requires that correctness

1051