www.ietdl.

org

Published in IET Computers & Digital Techniques

Received on 1st February 2009
Revised on 21st July 2009
doi: 10.1049/iet-cdt.2009.0011

In Special Issue on selected papers from the 18th

International Conference on Field Programmable
Logic and Applications (FPL 2008)
ISSN 1751-8601

Fault tolerance and reliability in field-

programmable gate arrays
E. Stott P. Sedcole P. Cheung
Department of Electrical and Electronic Engineering, Imperial College, Exhibition Road, London, UK
E-mail: edward.stott07@imperial.ac.uk

Abstract: Reduced device-level reliability and increased within-die process variability will become serious issues for
future field-programmable gate arrays (FPGAs), and will result in faults developing dynamically during the lifetime
of the integrated circuit. Fortunately, FPGAs have the ability to reconfigure in the field and at runtime, thus
providing opportunities to overcome such degradation-induced faults. This study provides a comprehensive
survey of fault detection methods and fault-tolerance schemes specifically for FPGAs and in the context of
device degradation, with the goal of laying a strong foundation for future research in this field. All methods and
schemes are quantitatively compared and some particularly promising approaches are highlighted.

1 Introduction faults that are caused by device degradation. This is a less

As process technology scaling continues, integrated circuits
face greater challenges from defects, process variability and
reliability. Field-programmable gate arrays (FPGAs) are no
exception to this; one recent study suggested defect
tolerance will be necessary in future large FPGAs at and
beyond the 45 nm technology node [1]. FPGAs have some
key advantages over application specific integrated circuits
(ASICs) for achieving fault tolerance. Firstly, they are
(mostly) composed of regular arrays of generic resources,
giving them inherent redundancy. Secondly, they can be
reconfigured in the field. These have been exploited in a
wealth of research and some promising fault tolerant
systems have been developed.
There have been different motivations for designs of fault
tolerant FPGA systems. Early work was concentrated on
increasing manufacturing yield through defect tolerance and
some of this has found its way into commercial use [2]. The
advent of SRAM FPGAs presented the problem of single-
event upsets (SEUs), which are sporadic flips of configuration
bits causing connectivity, logic and state errors. This has also
lead to a great deal of research, the benefits of which can be
widely found in space and nuclear applications [3].
The focus of this study, however, is on work relating to the
reliability of FPGAs and in-field tolerance of permanent
established field of research, although techniques developed
in defect and SEU tolerance schemes are highly relevant to
degradation fault tolerance. This aspect of fault tolerance is
set to become increasingly important with the continuing
development of silicon technology. This paper is based on
material previously published by the authors in [4]. It is
extended with new sections on fault modelling and future
work in the field. Existing sections are discussed at greater
depth, with 17 additional papers surveyed and eight new
figures.
A fault tolerant system consists of two main components;
these are fault detection and fault repair. Section 3 surveys
fault detection methods and Section 4 considers fault
repair. Causes of faults, modelling and application issues
are discussed in Section 2 and the possibilities for future
development of the field are explored in Section 5.
2 Background
2.1 Causes of degradation
Degradation is the permanent deterioration of a circuit over
time, resulting in a negative impact on performance. The
effects can be progressive, a gradual change of a circuit
parameter or catastrophic, a sudden onset of a failed state in a
circuit component. Degradation in VLSI circuits can be

196 IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
& The Institution of Engineering and Technology 2010 doi: 10.1049/iet-cdt.2009.0011

Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
 www.ietdl.org

attributed to a number of mechanisms [5]. The hot-carrier 2.3 Modelling of faults

effect leads to a build up of trapped charges in the gate-
channel interface region [6]. This causes a gradual reduction
in channel mobility and increase in threshold voltage in
CMOS transistors. The effect on the circuit is that switching
speeds become slower, leading to delay faults. Negative-bias
temperature instability (NBTI) has similar consequences for
circuits and is also caused by a build up of trapped charges [7].
Electromigration is a mechanism by which metal ions
migrate over time leading to voids and deposits in
interconnects. Eventually, these can cause faults because of
the creation of open and short circuits [8].
Time-dependent dielectric breakdown (TDDB) affects
the gates of transistors, causing an increase in leakage
current and eventually a short circuit. The mechanism here
is the creation of charge traps within the gate dielectrics,
diminishing the potential barrier it forms [9, 10].
All of these degradation mechanisms have the potential to
become more severe with the shrinking of process geometry.
This is due to increasing gate field strength, higher current
density, smaller feature size, thinner gate dielectrics and
increasing variability [11]. In the case of TDDB, the
situation is made complicated by the introduction of new
processes such as high-K dielectrics and metal gates [12].
2.2 Other types of fault
In addition to degradation, there are two other types of faults
that can affect FPGAs. These are relevant to this study as
some of the techniques that have been developed in
response to them can also be applied to faults caused by
degradation.
In order to effectively detect, locate and repair faults a model
is needed of how they affect the circuit. Fault modelling has
several aspects including (a) determining which fault
mechanisms may occur; (b) simulating the effect that
possible faults will have on the system; (c) predicting the
rate and distribution of failures; and (d) establishing fault
scenarios for evaluating potential repair strategies.
Faults can be modelled at different layers of the FPGA, as
shown in Fig. 1. Although faults occur in the silicon
structures which make up transistors and interconnect, fault
tolerant systems deal with them at various levels of
abstraction. A repair at each level of abstraction aims to be
transparent to the level above it.
Logic: A low-level approach considers the underlying logic of
the FPGA and models faults on particular circuit nets.
Fabric: Some fault tolerant systems consider faults in the
FPGA fabric, that is the set of LUTs, registers,
interconnect and so on that is available to the designer
[15]. This has the advantage that these elements are easy to
test with reconfiguration and BIST, though the behaviour
of the configuration logic is obscured.
Array: A popular option is to consider the FPGA at an array
level, that is to mark off entire clusters or interconnect lines as
faulty. This best exploits the regular structure of FPGAs.
Application: A higher level of abstraction is possible when the
application is modular and adaptable. This allows the fault
model to extend to other parts of the circuit outside the
FPGA for a very robust system.

The first of these is manufacturing defects. Manufacturing

defects can be exhibited as circuit nodes which are stuck-at 0 or
1 or switch too slowly to meet the timing specification. Defects
also affect the interconnect network and can cause short or
open circuits and stuck open or closed pass transistors [13].
Test of manufacturing defects is well established in VLSI
and defect tolerance techniques are currently used in some
types of device, including FPGAs [2], to increase yield.

The second class of fault which is widely discussed in relation

to FPGAs comprises of SEUs and single event transients
SETs, caused by certain types of radiation [14]. This is of
particular concern to aviation, nuclear research and space
applications where devices are exposed to higher levels of
radiation and high levels of reliability are required. The most
commonly considered failure mode is the flipping of an
SRAM cell in the configuration memory, leading to an error
in the logic function that persists until the configuration is Figure 1 Design of an FPGA and its application can be
refreshed in a process known as scrubbing. Although this abstracted to several levels
recovery method is not applicable to permanent faults caused Fault modelling and tolerance can be approached at numerous
by degradation, ways of detecting SEU faults are relevant. points in the hierarchy

IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210 197
doi: 10.1049/iet-cdt.2009.0011 & The Institution of Engineering and Technology 2010
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
www.ietdl.org
Within this study, fault repair is defined to be the repair of a
faulty system so that it returns to being fully operational.
Invariably, at some level of the FPGA this repair is achieved
by the replacement of a failed component with a functional
one. The size and nature of the replaced component varies
from scheme to scheme and this represents the granularity
of the approach. All of the studies surveyed here fall into the
fabric-level, array-level or application-level categories.
Approaching fault tolerance at different levels of
abstraction places the burden of dealing with them on
different parties over the design, manufacturing and service
phases of the product lifetime. A fabric-level repair, for
example, may be completely transparent to the engineer
who designs the application circuit and requires no
alteration of the configuration data. On the other hand, an
application-level strategy is likely to be embedded into the
system design and be tailored to the application.
An important part of fault modelling is to determine
the possible failure modes at the design level under
consideration. At the circuit level, the simplest of fault
models assumes that faulty circuit nodes can be either stuck
at 0, stuck at 1, shorted to another node or an open circuit
[13]. Although these hard-failure modes have been an
effective approach to defect testing for a long period,
worsening process variation and degradation require
marginal and timing faults to be considered [16]. Since
some of the VLSI wear-out mechanisms are progressive in
nature, marginal faults are likely to be more prevalent in
field failures than in failures because of manufacturing
defects. Examples of marginal faults include slow switching,
intermittent switching, weak drivers and unstable registers.
Another aspect to a degradation fault model is the rate at
which faults occur and how this varies over time [5].
Traditionally, a bathtub curve of failures is described for
VLSI circuits, in common with many other manufacturing
processes. High numbers of ‘infant mortality’ failures occur
shortly after manufacture, then the failure rate remains low
until the end of the design life. Greater process variation and
degradation will make these phases less distinct, for example
a significant background rate of failure may be observed over
the entire life of the product [11]. This is illustrated in Fig. 2.
FPGA systems can be reconfigured in the field, either to
change their functionality or as required by a fault-tolerance
system. This raises the possibility of dormant faults, faults
that occur on resources which are unused when the fault
occurs but which may be used in the future. The implication
of this is that multiple faults may become apparent on
reconfiguration and the system must be prepared for this.
2.4 Applications of fault tolerance
All of the fault detection and repair methods surveyed have
individual strengths and weaknesses and which method is
most appropriate depends on the application.
198
& The Institution of Engineering and Technology 2010
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
Figure 2 The failure rate of electronic devices varies
over time
Trace a depicts the traditional ‘bathtub’ curve, where most failures
occur early or late in the device lifetime. Trace b shows the higher
prevalence of mid-life failures that is caused by increased process
variation and degredation
In some cases, reliability is critical for safety or mission
success. For example, an automotive application was discussed
at a system level by Steininger et al. [17]. Fast detection and/
or error correction is crucial here so that erroneous data or
state is not acted upon, which could be hazardous.
A widely implemented application of fault tolerance in
FPGAs is in space missions. Traditionally, this is because
(a) they experience significant numbers of SEUs caused by
increased radiation; (b) the breakdown of an electronic
system could cause the mission to be lost; and (c) manual
repair is impractical.
In the light of variability and reliability concerns associated
with future VLSI process nodes, it may become economical
to use fault tolerance in general purpose, high-volume
applications. In this case, it will be important that the
detection and repair method has the lowest possible
overhead on timing performance and area. Such
applications may be able to compromise data integrity and
fault coverage to achieve this, for example infrequent visible
errors and a small proportion of returns would be tolerable
in a consumer video decoder.
3 Fault detection
The first function to take place in a fault-tolerant scheme
is fault detection. Fault detection has two purposes; firstly,
it alerts the supervising process that action needs to be
taken for the system to remain operational and secondly, it
identifies which components of the device are defective so
that a solution can be determined. These two functions
may be covered simultaneously, or it may be a multi-stage
process comprised of different strategies.
Fault detection methods can be categorised into three
broad types:
† Redundant/concurrent error detection (CED) uses
additional logic as a means of detecting when a functional
block is not generating the correct output.
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011
 www.ietdl.org

† Off-line test methods test the FPGA when it is not
operating.
† Roving test methods perform a progressive scan of the
FPGA structure whilst it is on-line.
The different approaches to fault detection are evaluated
against a set of metrics in Table 1.
Practical implementations of TMR partition the design
into multiple sets of modules so that transient errors do not
stick in state machines or registers [20]. The system
proposed by D’Angelo et al. [21, 22] is capable of
distinguishing between permanent and transient errors, and
also if the fault has occurred in a module or the voting
logic. In [15], a modular redundancy system is given which
can detect multiple faults on start-up.

CED allows a more space efficient design than modular

3.1 Functional redundancy and CED
The principle of using redundancy to guarantee a reliable
logical system was developed many years before the advent
of VLSI [18, 19], and today it is widely used as a method
of fault detection in FPGAs, particularly in the form of
triple modular redundancy (TMR). The main driver for
error detection of this kind is the need to detect and
correct errors because of SEUs and SETs. However, these
methods are also suitable for detecting permanent faults
that occur while the system is operating.
These detection methods work by invoking more than the
minimum amount of logic than is necessary to implement the
logic function. When an error occurs, there is a disagreement
between the multiple parts of the circuit over which a
particular calculation is processed and this is flagged by
some form of error detection function.
The simplest form of this kind of error detection is
modular redundancy. A functional block is replicated,
usually two or three times and the outputs compared. If
there are two modules then a difference between the
outputs indicates that one of the modules is faulty. If there
are three modules then, assuming a single fault, one group
of outputs will differ from the other two. The use of three
modules identifies which of them is faulty and allows the
correct output to be maintained whilst a repair is underway.
redundancy. Extra bits are added to data flows and stores
that are encoded with redundant logic, for example parity
information. Data validation circuitry at the output to
functional blocks can then detect faults that arise. The
application of CED is very much dependent on the data
flows and algorithms of the design and the logic overhead
that is required varies. It is least efficient for small width
signals such as those found in control logic.
CED techniques have been widely researched both
in theory and in application to ASICs [23], but
implementation on FPGAs presents additional problems.
Using traditional CAD tools for FPGAs, there is the
problem that error detection logic can be removed or made
ineffective once it is minimised and implemented on LUTs.
Bolchini et al. [24] sought to address this by mapping a
self-testing circuit using standard tools then testing and
redesigning any part where fault coverage had been lost. In
[25], a CED method is developed for state machines
in FPGAs using embedded memory blocks. Here, the
memory blocks are used as ROM look-up tables for next
state and output logic with embedded parity data. Any error
in either the memory or the controlling logic causes
a parity mismatch and is detected by a parity checker. A
similar function can be carried out when a state machine is
encoded using ‘one-hot’ logic; the activation of more than
one state at any time indicates an error. A full fault tolerant

Table 1 Comparison of fault detection methods

Method Speed of Resource Performance Granularity Coverage

detection overhead overhead
modular fast – as soon very large – very small – latency of coarse – limited good – all manifest
redundancy as fault is triplicate plus voting logic to size of errors are detected
manifest voting logic module
concurrent error fast – as soon medium – small – additional medium – medium – not
detection as fault is trade-off with latency of checking logic trade-off with practical for all types
manifest coverage resource of functionality
off-line slow – only very small small – start-up delay fine – possible very good – all faults
when off-line to detect the including dormant
exact error
roving medium – medium – large – clock must be fine – possible very good – multiple
(segmented order of empty test block stopped to swap blocks. to detect the manifest and latent
interconnect) seconds plus test Critical paths may exact error faults are detected
controller lengthen

IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210 199
doi: 10.1049/iet-cdt.2009.0011 & The Institution of Engineering and Technology 2010
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
www.ietdl.org
system using CED was proposed in [26], where the error
detection is broken down into regions to provide a level of
fault location.
Redundancy provides a very fast means of error detection
as a fault is uncovered as soon as an error propagates to the
voting or validation logic. In addition, this form of error
detection has a small impact on timing performance – only
the latency of voting or parity logic, or similar. Modular
redundancy detects all faults that become manifest at the
output of a functional block, including transient errors,
providing the other block(s) are fully functional. In CED,
coverage comes at a trade-off with area overhead [27].
These methods provide no means of detecting dormant
faults, which may be relevant if an FPGA is going to be
reconfigured in the field, either for fault repair or to alter
the functionality.
The chief drawback of redundancy as a method of error
detection is the area overhead needed to replicate
functionality, which can be over three times in the case of
TMR [3]. Furthermore, it provides a limited resolution for
identification of the faulty component. The fault can only
be pinned down to a particular functional block or, in the
case of TMR, an instance of a functional block. Fault
resolution can be increased to a certain extent by breaking
functional areas down and adding additional error detection
logic [26].
Redundancy does not have to be restricted to the circuit-
area dimension. It is also possible to detect errors in a
trade-off with latency/data throughput. Lima et al. [28]
proposed a scheme where operations are carried out twice.
In the second operation, operands are encoded in such a
way that they exercise the logic in a different way. The
output is then passed through a suitable decoder and
compared to the original.
Although most of the work on redundancy has been aimed
at detecting and correcting SEUs, there have been some
notable publications which apply the techniques to fault
detection. Parity checking is used in [29] as part of a fault
tolerant scheme that is structured so that detection is
applied to small regular networks, rather than being
bespoke to the function that is implemented. In the
evolutionary system of [30], dual modular redundancy
(DMR) is used to grade the ‘fitness’ of competing
configurations. The configurations are chosen in pairs from
a pool and the outputs are compared on each clock cycle.
The configurations that contain errors or faults cause more
frequent output mismatches and accumulate a poor fitness
score. More information on evolutionary fault tolerance is
give in Section 4.2.4.
Redundant and data-checking detection systems are
generally implemented as part of the application
configuration, as they fit around the specific data and
control functions that make up the circuit. They can be
200
& The Institution of Engineering and Technology 2010
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
designed manually by the configuration engineer to fit the
fault-detection requirements of the application, or integrated
automatically using tools, such as Xilinx’s TMRTool [31].
In [32], an FPGA architecture was proposed that has
error detection built in, so that it is transparent to the
configuration. The system uses a combination of area and
time redundancy to identify errors at the cell level and
subsequently trigger an automatic repair. The practicality of
this architecture is limited by the severe timing and area
overheads of incorporating the error detection logic in each
cell. Hardware error checking is used in Altera’s Stratix
FPGAs to detect SEUs in configuration memory. This
could be used to detect faults in configuration logic that
might otherwise be difficult to detect, but would need
supplementing with soft-logic error detection to provide
adequate coverage of the whole device.
3.2 Off-line fault detection/built-in
self-test (BIST)
Off-line fault detection is another widely used technique,
usually as a means of quickly identifying manufacturing
defects in FPGAs. Any scheme that does this without the
need for any external equipment is known as BIST, and is
a suitable candidate for fault detection in the field.
BIST schemes for FPGAs work by having one or more
test configurations which are loaded separately to the
operating configuration. Within the test configuration is a
test pattern generator, an output response analyser and,
between them, the logic and interconnect to be tested
arranged in paths-under-test (PUTs). To be fully
comprehensive, a BIST system will have to test not only
the logic and interconnect, but also the configuration
network. Specialised features such as carry chains,
multipliers and PLLs also need to be considered. The
Xilinx Virtex series of FPGAs feature a self-configuration
port which can speed up this process and reduce the need
for external logic [33].
Compared to traditional built-in and external test methods
for ASICs, FPGAs have the advantage of a regular structure
that does not need a new test programme to be developed for
each design. Also, the ability to reconfigure an FPGA
reduces or removes the need for dedicated test structures to
be built into the silicon [34]. However, with the ability to
reconfigure comes a vast number of permutations in the
way the logic can be expressed, making optimisation of test
patterns important.
Published BIST methods have competed for coverage, test
duration and memory overhead. Many focus on testing
just one subset of FPGA structures, e.g. interconnect,
suggesting a multi-phased approach may be appropriate for
testing the whole chip. Testing of LUTs is a mature field;
the BIST scheme for LUTs in [35] is designed to
minimise test time, whereas a means of detecting multiple
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011

faults in a single test block or PUT is given in [36]. Alaghi
et al. [37] also addressed multiple faults and concentrates
on achieving the optimum balance between granularity and
test logic overhead.
Many publications have focussed on testing interconnect
in response to the large amount of configuration logic and
silicon area it consumes [38, 39]. A method of exhaustive
testing for multiple faults global interconnect using six
configurations is given in [40]. In [41], a BIST system for
interconnect is given that reduces test time through a large
degree of self-configuration. Harris et al. used a hierarchical
approach which locates stuck-at faults, short circuits and
open circuits with the highest accuracy [13, 42].
Recent developments have considered timing performance
as well as stuck-at faults. Some authors have targeted
resistive-open defects in interconnect by testing for delay
faults in interconnect paths [43, 44]. Girard et al.
considered the optimum test patterns for exercising delay
faults [16, 45]. Methods for analysing the propagation
delays of logic chains have been proposed in [46], by
timing the difference between two paths using a ring
oscillator, and more accurately in [47], by using a built-in
PLL unit to match the clock speed to the propagation delay.
Elements of BIST can be found in roving test systems,
where only a small part of the FPGA is taken off-line for
testing at any point in time. Roving and off-line testing are
both cited as suitable applications for the delay-test method
in [46]. Doumar et al. proposed an off-line test that uses a
roving sequence to remove the need for reconfiguration;
instead a small self-test area is always present and is shifted
around the array to gain full coverage [48].
The advantage of BIST as a fault detection method is that
it has no impact on the FPGA during normal operation. The
only overhead is the requirement to store test configurations,
which may be compressed because of their repetitive nature.
BIST also allows complete coverage of the FPGA fabric,
including features that may be hard to test with an on-line
test system, such as PLLs and the clock network. As the
entire resource set is tested, the BIST process is common
to all systems using a particular FPGA model and can be
extended to cover a whole family of devices with little
modification. The only additional work required to
integrate BIST into a new FPGA design is to provide
storage for the BIST configuration and set up a trigger to
load it at the desired time.
The major drawback of BIST for fault tolerant systems is
that it can only detect faults during a dedicated test mode
when the FPGA is not otherwise operational. Typically,
this would occur during system start-up, as part of a
maintenance schedule, or in response to an error detected
by some other means.
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
www.ietdl.org
3.3 Roving fault detection
Roving detection exploits run-time reconfiguration to carry
out BIST techniques on-line, in the field, with a minimum
of area overhead. In roving detection, the FPGA is split
into equal-sized regions. One of these is configured to
perform self-test, whereas the remaining areas carry out the
design function of the FPGA. Over time, the test region is
swapped with functional regions one at a time so that the
entire array can be tested while the FPGA remains
functional. The process is illustrated in Fig. 3.
Roving test has a lower area overhead than redundancy
methods; the overhead comprising of one self-test region
and a controller to manage the reconfiguration process. The
method also gives excellent fault coverage and granularity,
comparable to BIST methods.
Roving test is less intrusive than a full system halt to carry
out off-line BIST and it is usually possible to detect faults
earlier. However, the speed of detection is not as good as
redundancy techniques. The detection latency depends on
the period of a complete roving cycle; the best reported
implementations of roving test have maximum detection
latency in the order of a second [49].
Roving test impacts performance in two ways. Firstly, as the
test region is moved through the FPGA, connections between
adjacent functional areas are stretched. This results in longer
signal delays and may force a reduction in the system clock
speed, reported to be in the range of 2.5 – 15%. Secondly,
implementations in current FPGAs require the functional
blocks to be halted as they are switched. A 250 ms window
for each swapping move has been reported [49].
The dominant work in the field of roving test and repair
has been carried out by Abramovici, Stroud et al. [49, 50].
Called roving STARs, this system uses two test areas, one
covering entire rows and one covering entire columns. A
roving test method was also proposed in [51] – by using
FPGAs with bussed, rather than segmented, interconnects,
a system was devised which had no impact on system clock
Figure 3 In roving test, blocks of the FPGA are taken off-
line one at a time for testing
By shifting functionality between blocks, the device can remain
operational
201
& The Institution of Engineering and Technology 2010
www.ietdl.org

performance. However, the resulting constraints on the
system topology and connectivity limit its applicability to
the majority of systems.
Like off-line BIST, roving detection does not need
adapting to application circuit, simplifying its deployment
and allowing a market to develop in 3rd party fault-
detection IPs. However, as the test process does have an
impact on FPGA resource use and timing performance,
careful verification of the application design would be
needed once it was integrated.
4 Fault recovery
Once a fault is detected and located, it must be repaired.
Depending on the fault modelling approach (see Fig. 1),
repair can be approached at a number of different levels:
Hardware: A hardware level repair performs a correction such
that the FPGA remains unchanged for the purposes of the
configuration. The device retains its original number and
arrangement of useable logic clusters and interconnects.
Configuration: A configuration level repair is achieved using
spare resources that the design does not use. The spare
resources can replace faulty ones in the event of a fault.
System: A higher level of repair can be carried out at the
system level. When a design is highly modular a fault can
be tolerated by the use of a spare functional block, or by
providing degraded performance [52]. Such methods are
not considered in more detail here, as they are not limited
in application to FPGAs.
It should be noted that some fault detection methods also
provide a level of fault tolerance. The voting system in TMR
allows the erroneous output of one module to be ignored.
Also, roving test provides fault tolerance by stopping the
roving process if a fault is detected. If the fault stays within
the test area it will not be used by the operational part of
the FPGA. In both these situations, the system operates in
a reliability degraded state where another fault would not
be tolerated and may not even be detected. But they do
allow the system to carry on functioning whilst a
permanent repair is carried out. Table 2 shows the classes
of fault repair techniques that have been reported and
evaluates them against a range of metrics.
To date, manufacturing defects are a far more common type
of fault than failures in the field and have been the focus of
practical fault-tolerance efforts in industry. The challenge of
attaining an economic yield in FPGA manufacture will
intensify along with the challenge of ensuring reliability, and

Table 2 Comparison of fault repair methods

Method Fault pattern tolerance Resource overhead Performance Complexity of Repair
overhead/ repair level
degradation
hardware poor: limited number and medium: spare low: transparent to low: effected with logic-
distribution tolerated resources required configuration hardware switches array
multiple poor: limited number and low: uses naturally low: each medium: selection array
configurations distribution tolerated. spare resources, but configuration can be and loading of
interconnect tolerance requires ROM for fully optimised configurations
causes complexity configurations
pebble shifting medium: relies on nearby low: uses naturally medium, rerouting high: re-routing array
spare PLBs spare resources causes uncertainty necessary
cluster reconfig. poor: reliant on spare low: uses naturally low: changes only medium: analysis fabric
resource in cluster. Poor spare resources local interconnect, of logic, no
tolerance in interconnect slight uncertainty re-routing
cluster good: flexible solutions low: uses naturally low: usually a fast high: analysis of fabric-
reconfig. þ possible spare resources alternative will be logic and rerouting array
pebble shifting found, medium
uncertainty
constrained poor: limited number and medium: a set of low low: alternative array
(chain shifting) distribution tolerated. interconnect must be routing already
Poor for interconnect reserved reserved
evolutionary good: implementation is large: configuration variable: solution is massive: may take app.
completely flexible grading and storage arrived through a long time to
random mutations repair

202 IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
& The Institution of Engineering and Technology 2010 doi: 10.1049/iet-cdt.2009.0011

Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.

it is likely that any scheme for fault tolerance will be used to
tackle both. The key difference is that overcoming
manufacturing defects only needs to be done once and does
not need to involve the end user of an FPGA or even, for
hardware-level repair, the OEM who installs and configures
it. Therefore, defect tolerance can be viewed as a subset of
multi-purpose fault tolerance, where the process is applied
during manufacture. The techniques discussed in this section
are targetted at in-field faults, but could also be applied to
manufacturing defects in this way.
4.1 Hardware-level repair
The regular structure of FPGAs makes them suitable
candidates for hardware-level repair, using methods similar
to those used for defect tolerance in memory devices. In
the event of a fault, a part of the circuit can be mapped to
another part with no change in function.
Hardware-level repair has the advantage of being transparent
to the configuration. This makes repair a simple process, as the
repair controller does not need any knowledge of the placement
and routing of the design. Another benefit is that the timing
performance of the repaired FPGA can be guaranteed, as any
faulty element will be replaced by a pre-determined
alternative. Switching in spare resources will change timing
slightly, for example net lengths may change, but the
configuration can be designed to function with the worst-case
selection. A fault-tolerant system using hardware-level repair
with off-line BIST could be packaged with a FPGA
architecture and require little work to integrate it into an
application nor maintenance intervention in the field.
Hardware-level fault tolerance has a drawback in that it can
tolerate just a low number of faults for a given area overhead
and there are likely to be certain patterns of faults which
cannot be tolerated.
Figure 4 Trade-offs in row/column shifting methods
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
www.ietdl.org
The first methods of this kind were based on column/row
shifting [53, 54]. Multiplexers are introduced at the ends of
lines of cells that allow a whole row or column to be
bypassed, by shifting across to a spare line of cells at the
end of the array. A column/row shifting architecture was
proposed in [32], which could repair faults in the field by
shifting the configuration memory. If the FPGA is bus-
based, the shifted cells can connect to the same lines of
interconnect. For segmented interconnect, bypass sections
need to be added to skip the faulty row/column. Today,
column/row shifting has found its way into commercial
FPGA designs for defect tolerance [2].
As illustrated in Fig. 4, adding more bypass connections and
multiplexers allows greater flexibility for tolerating multiple
faults and makes more efficient use of spare resources [55]. In
[56], faults in the configuration logic where considered and
the proposed solution was to split the FPGA up into sub-
arrays which can be configured independently.
4.2 Configuration level repair
Although hardware-level repair is attractive for defect tolerance
because it is mostly transparent at the configuration level, the
proposed schemes have not proved flexible or efficient enough
for use in reliability enhancement. As the computational
power available to FPGAs increases, the complexity of self-
repair is becoming less of a constraint. For these reasons, the
most promising fault tolerant systems have used configuration
level repair. Configuration level repair exploits two key
features in FPGAs; reconfiguration and the availability of
unused resources. Configuration level repair strategies can be
divided into several subclasses:
4.2.1 Alternative configurations: A straightforward
way of achieving fault tolerance is to pre-compile
203
& The Institution of Engineering and Technology 2010
www.ietdl.org
alternative configurations. As long as a configuration exists
in which a given resource is unused, the FPGA can be
repaired should that resource become faulty. In [57 – 59]
the FPGA is split into tiles, each with its own set of
configurations which have a common functionality and
interface to the adjacent tiles. The replacement of a faulty
tile is illustrated in Fig. 5.
Pre-compilation of the alternative configurations makes
a repair simple to compute in the field; the replacement
configurations can simply be indexed by the location of the
unused/faulty resource or resources. It also guarantees the
timing performance of the repaired design. Software tools
could generate the configuration set for any design, as long
as sufficient spare resources are available, and a simple
index could select a repair configuration based on the
location of the fault.
This strategy performs relatively poorly in terms of area
efficiency and multiple fault tolerance. It is dependent on
there being a configuration available in which any given
resource is set aside as a spare. If only a small amount of
spare resource is available then a large number of
configurations are needed to cover all possible faults.
Allocating more spare resources allows a smaller number of
configurations, but that reduces the amount of functionality
that can fit in the FPGA. If the system is required to
tolerate multiple faults, the number of configurations can
easily become prohibitive, especially if they must be stored
and recalled in the field. As the configurations are likely to
have a significant amount of commonality, compression can
be used to mitigate the ROM overhead, though this then
requires decoding logic. Splitting the array into tiles allows
multiple faults to be tolerated with superior overhead
efficiency, but introduces complications if a fault occurs on
the interface between adjacent tiles.
Figure 5 An alternative configuration is selected to repair a
tile of clusters containing a faulty resource
204
& The Institution of Engineering and Technology 2010
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
4.2.2 Incremental mapping, placement and
routing: A popular approach to fault tolerance is to
recompute the mapping, placement and routing of the
FPGA in the field. This has the potential to be a very
efficient method as it can exploit the residual amount of
spare resource which is found in virtually all practical FPGA
designs. It has also proven to be the only method capable of
handling large numbers of faults in an arbitrary pattern. The
challenge to overcome is that the mapping, placement and
routing tools of an FPGA CAD system must be adapted to
operate autonomously on an embedded platform. This will
impose constraints on processing power, memory and the
time available to compute a new configuration.
A simple method of tolerating faults in logic clusters exists
if the cluster can be reconfigured to work around the fault
[49, 60]. A typical example of this kind of repair is the
swapping of a faulty LUT input with an unused one.
Repair within a cluster is attractive because it has only a
small impact on the global routing of the device, which
makes the repair easy to compute and guarantees only a
slight impact on timing performance. However, a repair of
this kind is not always possible; there may be no spare
resource of the type needed or there may be architectural
constraints which prevent it being used without changing
other clusters and global interconnect. This is especially
true where hardware optimisations are used such as carry
chains and distributed RAM.
If there are spare clusters, then these can be used to replace
faulty ones. To minimise the impact on timing and routing
in the area around the fault, pebble shifting may be used.
An illustration of this method is shown in Fig. 6, where a
number of clusters are shifted to carry out the repair. In
[61], an algorithm is given that calculates the cost of
potential shifting moves as a function of additional routing
distance and congestion in routing channels. Using this
information, the entire repair can be optimised so that it
causes the smallest reduction in timing performance and
the least perturbation to the wider routing of the device.
In order to reconnect displaced clusters or to repair faulty
interconnect an incremental router can be used. One such
Figure 6 In pebble shifting, logic functions are shifted to
replace a fault cluster with a spare one
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011

algorithm is developed in [62]. The router is optimised for
deployment in the field and hence has a small hardware
and memory requirement. Invalid nets are ripped-up and
rerouted one at a time within a restricted window of the
array. The router determines the placement and routing of
the existing design by reading back the configuration
memory so it does not need to read or modify a separate
netlist database. A similar strategy is adopted by Lakamraju
and Tessier [60] and a performance evaluation is given.
Cluster reconfiguration, pebble shifting and incremental
routing can be combined to implement a flexible and
efficient fault tolerant system. Lakamraj et al. and
Abramovici et al. both recognised that cluster
reconfiguration is a good first line of defence against faults
because it is simple to evaluate and makes use of
‘naturally’ spare resources [49, 60]. However, as it cannot
guarantee a repair, pebble shifting and incremental
routing are also needed to form a robust system. In [50],
the approaches are merged so that a faulty cluster can still
be used as a spare for logic expressions which do not
require the faulty component. This further enhances the
efficiency of the system as fewer dedicated spare clusters
are needed.
Although self-redesign in the field is a complex task for
an FPGA-based system, it is becoming increasingly feasible
as FPGAs become larger and more powerful. Also, an
increasing number of applications use microprocessor cores
which are either implemented in soft-logic or are
embedded into the silicon as dedicated modules. A
general-purpose microprocessor platform could be turned
over to the task of self-repair when a fault arises, provided
it remains operational. An alternative would be to compute
a repair configuration remotely and download it to the
device; this would require some form of communication
resource. Providing the necessary computation or
communication resources would create a significant
workload for designers integrating this form of fault
recovery into a system, though the incremental CAD
algorithm itself would be general purpose.
4.2.3 Constrained and coarse-grained repair:
Incremental mapping, placement and routing provide a
high degree of flexibility for dealing with random fault
patterns, especially when cluster reconfiguration and pebble
shifting are used together. However, this comes at the cost
of increased computational effort for the repair which must
be carried out in the field. Some publications have
proposed less complex solutions by structuring the design
such that the repair mechanism can operate over a limited
set of parameters.
In [63], a repair method known as chain shifting is given.
Here, clusters are arranged into chains, each with one or more
spare clusters at the end. The spare clusters are allocated
when the device configuration is compiled along with a set
of spare interconnects. If a cluster becomes faulty in the
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
www.ietdl.org
field, the chain can be shifted along to use a spare at
the end. The pre-allocated interconnect is used to restore
the original connectivity (see Fig. 7). This method has the
advantage that it does not require placement and routing in
the field; the allocation of repair resources can be computed
by software tools within the configuration CAD flow.
Also, the worst-case performance of the repaired design is
known. However, each chain requires a certain amount of
spare resource and can only tolerate a given number of
failures. Hence, this method does not use its area overhead
as efficiently as more intelligent approaches.
In [29], a multi-level approach to fault tolerance is
presented which consists of an array of small, reconfigurable
multistage interconnection networks (MINs). Each MIN
contains an amount of redundant logic so that some faults
can be masked entirely [64]. After this, the system aims
primarily to correct faults by reconfiguring the network. If a
repair in this way is not possible the system can resort to
more extensive slice or device-wide methods such as
swapping a whole network with a spare and re-routing the
design as necessary. The results show that, on average,
several faults can be tolerated on each network using
network-level repair. However, repair at this level cannot be
guaranteed beyond the first fault. The area overhead of this
system is large, given the redundancy that is built in and
the use of a parity checker to validate every network.
4.2.4 Evolutionary algorithms: Reconfiguration makes
FPGAs well suited to evolutionary algorithms, where
random changes are made to a design to overcome faults.
The outcome of each change is monitored so that, over
time, beneficial changes are retained and the design
produces fewer errors. Unlike other fault recovery methods,
an evolutionary approach does not need to know the
location and nature of all the faults affecting a device.
Instead, some form of error checking is used to grade the
‘correctness’ of each attempted configuration.
Evolutionary algorithms were tested in [65, 66] as a means
of synthesising and repairing FPGA configurations. In [66],
stuck-at faults were simulated in a range of simple logic
circuits by changing bits in the configuration data. The
configuration then went through a iterative evolution
Figure 7 Clusters are shifted along a predefined chain using
spare interconnect that has already been allocated
205
& The Institution of Engineering and Technology 2010
www.ietdl.org
process. The results showed that in all cases there was an
improvement in the correctness of the circuit output.
However, a complete repair was not guaranteed even when
the fault density was low. The authors suggest that a wider
redundant scheme could be implemented around the
evolved modules to correct any residual errors.
In [65], the use of redundancy is also suggested to
complement an evolutionary repair mechanism. The focus
in this work is the use of an evolutionary algorithm to
generate a configuration that is tolerant to faults through
the use of redundant elements. The granularity of system is
considered and the results show a trade-off between the
level of fault tolerance possible and the number of iterations
needed to reach a solution.
Demara et al. proposed a complete system for achieving
fault tolerance, based on a pool of competitive
configurations [30]. To detect errors and assign a ‘fitness’
to each configuration, two functionally identical
configurations are invoked from the pool and the outputs
are compared. Over time, different pairs are selected and
each configuration accumulates a score representing the
number of missmatches it has generated. Configurations
that exceed a certain threshold are put through a mutation
process to attempt to correct the fault. The process is
illustrated in Fig. 8.
Evolutionary hardware is a research field that encompasses
more than just FPGAs. A finer-grained system based on
field-programmable transistor arrays is developed and tested
in [67].
An evolutionary approach allows a large degree of
flexibility with the number and distribution of faults that
can be tolerated. It does not need to carry out tests to
locate and classify faults and it can discover ways to use
partially faulty resources that would otherwise require
Figure 8 In this example of an evolutionary repair system
[30], candidate configurations are taken from pool,
graded against each other and mutated if faulty
206
& The Institution of Engineering and Technology 2010
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
complex modelling. It is best suited to numerical and data-
flow applications, where faults are less likely to be
catastrophic and error-detection circuitry can be added to
quantify the error rate.
The main disadvantage to evolutionary fault tolerance is
that the overheads are very large. Error detection circuitry
must be designed to check the outputs and this could
require a large amount of resource if an error-free output
is required. Also needed is a controller to manage the
configuration updates. As the process in random, there is
also no guarantee of how long a solution will take to evolve
following a fault, or what its timing performance will be –
although improved timing could be selected for by the
evolutionary algorithm.
4.2.5 Architectural enhancements for fault
tolerance: The majority of fault repair methods that
are based on reconfiguration target standard generic or
commercial FPGA architectures. There exists some
research that considers possible enhancements to FPGA
architectures to improve the effectiveness of configuration-
based repair.
In [68], the architecture of switch blocks and switch block
arrays is considered with respect to the ease of re-routing to
avoid an interconnect fault. An algorithm is developed
which evaluates the ‘routability’ of a generic parameterised
interconnect model when faced with different numbers and
types of fault. The results of the analysis show the expected
trade-off between better fault tolerance and lower area
overhead, and that switch matrices of different topologies
exhibit different fault-tolerance characteristics.
Switch matrix design was also explored in [69] and the
analysis used to develop a fault tolerant scheme. An
algorithm is given which evaluates a given routing channel
in terms of a connectivity matrix; this shows all the possible
point-to-point connections and the number of these which
have alternative routings. From this, it is possible to add
extra strategic switches to give the greatest increase in
routing redundancy for the smallest overhead. This scheme
is aimed primarily at yield enhancement and does not aim
to give complete fault coverage or tolerance for multiple
faults, as doing these would not be an efficient use of
additional silicon area.
5 Future development
Without methods of achieving in-field fault tolerance, the
growing challenges of process variation and reliability will
limit the progress of FPGA technology. Fortunately, there
remains plenty of scope for future work in this field, both
in developing the promising approaches seen so far and the
exploration of new ideas. This section explores some of the
possibilities that exist. We start by considering some
improvements that can be made to detection and repair
techniques using existing technology, and then consider
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011

how fault tolerance could be aided in the long term through
architectural enhancements.
5.1 Fault detection
BIST schemes for FPGAs have been widely researched and
efficient methods are available for testing connectivity and
logic function. The focus now is on self-testing of timing
performance, which will become necessary as process
variation and degradation become more severe [47]. For
fault tolerance, this will allow the degradation of the chip
(for certain wear-out mechanisms) to be monitored
throughout the lifetime of the chip. Corrective and
adaptive action, such as reducing clock speed or rerouting
of critical paths, will then be possible.
For some applications, off-line BIST is not possible because
fast fault detection is required or maintenance down-time is
not available. Modular redundancy provides a reliable
solution but it consumes a large amount of FPGA resource.
Future development here could take the form of a systematic
means of adding redundancy to a design in a more efficient
way. Possible approaches include an intermediate level in the
design hierarchy such as [29], or by analysis of datapath and
control logic within the automated design process. Fault
detection based on high-level behaviour is another
possibility; for example, output properties such as SNR
could be monitored for unexplained changes.
5.2 Fault repair
Current methods of incremental mapping, placement
and routing are quite effective at reconfiguring current
architectures to operate in the presence of faults. Some
possible enhancements to the technique are improved repair
speed, awareness of timing requirements for critical paths,
tolerance of faults in the fault detection/repair kernel and
tolerance of faults in DSP and memory blocks.
An alternative to incremental, embedded CAD could
be remote repair. If a system already has a means of
communicating with a remote server, a repair configuration
could be calculated remotely; this way the platform
constraints are removed.
Evolutionary algorithms are proven to be capable, in
principle, of evaluating repairs for FPGAs. However, more
development is needed before they can be considered
practical methods of achieving fault tolerance. As well as
improving the speed and accuracy of the process, more
thought is needed as to how evolution can be implemented
in a complete system.
5.3 Fault tolerant architectures
Much of the work to date on fault tolerance has assumed
an architecture broadly similar to that of contemporary
commercial FPGAs. Some publications have considered
parametric modifications to current architectures [68, 69],
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
www.ietdl.org
but there are plenty of opportunities beyond this. The
growing importance of fault tolerance allows researchers
and, subsequently, vendors to explore FPGA architectures
that are designed to accommodate fault tolerance as a
fundamental part of the system.
An example is roving test as a means of on-line fault
detection. Current implementations are limited by the
short periods when the clock must be stopped to move the
test blocks. This is imposed by the nature of the point-to-
point interconnect and configuration circuitry of current
FPGAs. It may be possible to use techniques similar to
those of proposed multi-context FPGAs to design an
FPGA architecture that is more sympathetic to on-line test
and repair. Multi-context FPGAs make more efficient use
of hardware resource by allowing instantaneous swapping of
blocks [70].
Another limitation which applies to virtually all proposed
fault detection and repair methods is that they consider
only faults in the programmable components of the FPGA.
There are a few examples that consider other parts of the
FPGA, such as the configuration network in [56], however
there remain many components which are not fault
tolerant. If a truly robust FPGA system is needed, every
part of the FPGA must either be testable and repairable
in the field or be intrinsically reliable, for example using
redundancy or more robust feature geometry.
Recently, there has been some discussion of coarse-grained
and network-on-chip FPGA architectures that are better
optimised for computing applications. This notion could
also be explored as a means of implementing fault
tolerance. Complex FPGA applications are likely to be
modular by design and may be organised in some form of
hierarchy, for example a microprocessor with several cores.
If the modules can be reconfigured, tested and repaired
independently and can serve as replacements for one
another then that provides a method of achieving on-line
fault tolerance.
A further avenue exists in the way FPGA configurations
are described. Currently, fault repair algorithms based on
incremental CAD operate on the affected portion of the
configuration bitstream and aim to restore the described
netlist. If the design information were stored in terms of
higher-level functionality, rather than connectivity, the
FPGA would have the freedom to correct faults using any
form of available hardware. This would be particularly
useful for heterogeneous arrays that contain a variety of
types of different hardware resource. Repairs could also be
carried out at a system level, using resources outside the
FPGA where the fault has occurred.
6 Conclusion
Fault tolerance in FPGAs has been widely studied with
works considering fault modelling, detection and repair.
207
& The Institution of Engineering and Technology 2010
www.ietdl.org
These have exploited advantageous features of FPGAs such
as regularity and the ability to reconfigure. This paper has
sought to present all the important publications in this field
and categorise and compare the techniques that they present.
The motivation behind the works studied here has varied
between recovery from SEUs, resilience to manufacturing
defects and tolerance of in-field faults because of degradation.
The latter of these goals is of growing interest because of the
increasing challenge of reliability that faces ongoing process
scaling. The development of circuit-level techniques to
handle degradation could enable FPGAs to provide new
opportunities for reliability-critical applications and further
push the boundaries of VLSI technology improvement.
There is much scope for future work in this field; the
techniques present have differing strengths and weaknesses,
or are suited to limited applications. Practical fault-tolerance
schemes will have to be of low overhead and make efficient
use of circuit resources. As the threat of degradation grows,
so too will the impetus behind this field.
7 References
[1] CAMPREGHER N., CHEUNG P.Y., CONSTANTINIDES G.A., VASILKO M.:
‘Analysis of yield loss due to random photolithographic
defects in the interconnect structure of FPGAs’. ACM Int.
Workshop on FPGAs, 2005, pp. 138– 148
[2] MCCLINTOCK C.: ‘Redundancy circuitry for logic circuits’.
U.S. Patent 66 166 559, December 2000
[3] BERG M.: ‘Fault tolerance implementation within SRAM
based FPGA designs based upon the increased level of single
event upset susceptibility’. Int. On-Line Testing Symp., 2006
[4] STOTT E., SEDCOLE P., CHEUNG P.: ‘Fault tolerant methods for
reliability in FPGAs’. Int. Conf on Field Prog. Logic and Apps.,
September 2008, pp. 415 – 420
[5] SRINIVASAN S. , MANGALAGIRI P. , XIE Y. , VIJAYKRISHNAN N. ,
SARPATWARI K. : ‘FLAW: FPGA lifetime awarenes’. Design
Automation Conf., 2006, pp. 630– 635
[6] GURIN C., HUARD V., BRAVAIX A.: ‘The energy-driven hot-
carrier degradation modes of nMOSFETs’, IEEE Trans.
Device Mater. Reliab., 2007, 7, (2), pp. 225 – 235
[7] DIETER K., BABCOCK J.: ‘Negative bias temperature
instability: road to cross in deep submicron silicon
semiconductor manufacturing’, J. App. Phys., 2003, 94,
(1), pp. 1 – 18
[8] CLARKE P., RAY A., HOGARTH C.: ‘Electromigration – a tutorial
introduction’, Int. J. Electron., 1990, 69, (3), pp. 333 – 388
208
& The Institution of Engineering and Technology 2010
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
[9] ESSENI D., BUDE J.D., SELMI L.: ‘On interface and oxide
degradation in VLSI MOSFETs – part I: deuterium effect
in CHE stress regime’, IEEE Trans. Electron Devices, 2002,
49, (2), pp. 247– 253
[10] ESSENI D., BUDE J.D., SELMI L. : ‘On interface and oxide
degradation in VLSI MOSFETs – part II: Fowler– Nordheim
stress regime’, IEEE Trans. Electron Devices, 2002, 49, (2),
pp. 254– 263
[11] SRINIVASAN J., ADVE S.V., BOSE P., RIVERS J.A.: ‘The impact of
technology scaling on lifetime reliability’. Int. Conf. on
Dependable Systems and Networks, 2004, pp. 177– 186
[12] CHEUNG K.: ‘Can TDDB continue to serve as reliability
test method for advance gate dielectric?’. Int. Conf. on
Integrated Circuit Design and Technology, 2004
[13] HARRIS I., TESSIER R.: ‘Testing and diagnosis of interconnect
faults in cluster-based FPGA architectures’, IEEE Trans. CAD
Integ. Circuits Syst., 2002, 21, (11), pp 1337– 1343
[14] NORMAND E.: ‘Single event upset at ground level’, IEEE
Trans. Nucl. Sci., 1996, 43, (6), pp. 2742 – 2750
[15] MOJOLI G., SALVI D., SAMI M.G., SECHI G.R., STEFANELLI R.: ‘KITE:
a behavioural approach to fault-tolerance in FPGA-based
systems’. Int. Workshop on Defect and Fault Tolerance in
VLSI Systems, 1996, pp. 327– 334
[16] GIRARD P., HRON O., PRAVOSSOUDOVITCH S., RENOVELL M.: ‘Defect
analysis for delay-fault BIST in FPGAs’. Int. On-Line Testing
Symp., 2003, pp. 124 – 128
[17] STEININGER A., SCHERRER C.: ‘On the necessity of on-line-
BIST in safety-critical applications’. Int. Symp. on Fault-
Tolerant Computing, 1999, pp. 208 – 215
[18] NEUMANN J.: ‘Probabilistic logics and the synthesis of
reliable organisms from unreliable components’. ‘Automata
studies’ (Ann. of Math. Studies, vol. 34, 1956), pp. 43– 98
[19] RAMAMOORTHY C., HAN Y.-W.: ‘Reliability analysis of systems
with concurrent error detection’, IEEE Trans. Comput.,
1975, C-24, (9), pp. 868 – 878
[20] CARMICHAEL C. : ‘Triple module redundancy design
techniques for Virtex FPGAs’. Xilinx Application Note
XAPP197, 2006
[21] D’ANGELO S., METRA C., PASTORE S., POGUTZ A., SECHI G.R.: ‘Fault-
tolerant voting mechanism and recovery scheme for TMR
FPGA-based systems’. Int. Symp. on Defect and Fault
Tolerance in VLSI Systems, 1998, pp. 233– 240
[22] D’ANGELO S., METRA C., SECHI G.: ‘Transient and permanent
fault diagnosis for FPGA-based TMR systems’. Int. Symp. on
Defect and Fault Tolerance in VLSI Systems, 1999, pp. 330–338
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011

[23] MITRA S., MCCLUSKEY E.J.: ‘Which concurrent error
detection scheme to choose?’. IEEE Int. Test Conf., 2000,
pp. 985–994
[24] BOLCHINI C., SALICE F., SCIUTO D.: ‘Designing self-checking
fpgas through error detection codes’. IEEE Inter. Symp. on
Defect and Fault Tolerance in VLSI Systems, 2002,
pp. 60– 68
[25] KRASNIEWSKI A.: ‘Low-cost concurrent error detection for
fsms implemented using embedded memory blocks of
fpgas’. IEEE Design and Diagnostics of Electronic Circuits
and Systems, 2006, pp. 178 – 183
[26] HUANG W., MITRA S., MCCLUSKEY E.J.: ‘Fast run-time fault
location in dependable FPGA-based applications’. IEEE Int.
Symp. on Defect and Fault Tolerance in VLSI Systems,
2001, pp. 206 – 214
[27] LO J., FUJIWARA E.: ‘Probability to achieve TSC goal’, IEEE
Trans. Comput., 1996, 45, (4), pp 450 – 460
[28] LIMA F., CARRO L., REIS R.: ‘Designing fault tolerant systems
into SRAM-based FPGAs’. Design Automation Conf., 2003,
pp. 650– 655
[29] ALDERIGHI M., CASINI F., DANGELO S., SALVI D., SECHI G.R.: ‘A fault-
tolerant FPGA-based multistage interconnection network
for space applications’. IEEE Int. Workshop on Electronic
Design, Test and Applications, 2002, pp. 302– 306
[30] DEMARA R.F., ZHANG K.: ‘Autonomous FPGA fault handling
through competitive runtime reconfiguration’. NASA/DoD
Conf. of Evolution Hardware, 2005
[31] Xilinx Inc.: ‘Xilinx TMRTool product brief’, 2006
[32] DURAND S.: ‘FPGA with self-repair capabilities’. Int.
Workshop on Field Programmable Gate Arrays, 1994,
pp. 1 – 6
[33] Xilinx Inc.: ‘Virtex-5 FPGA configuration user guide’
(vol. v2.5, 2007)
[34] STROUD C., KONALA S., CHEN P., ABRAMOVICI M.: ‘Built-in self-test
of logic blocks in FPGAs’. VLSI Test Symp., 1996, vol. 14
[35] LU S., YEH F., SHIH J.: ‘Fault detection and fault diagnosis
techniques for lookup table FPGAs’, VLSI Des., 2002, 15,
(1), pp. 397– 406
[36] ITAZAKI N., MATSUKI F., MATSUMOTO Y., KINOSHITA K.: ‘Built-in
self-test for multiple CLB faults of a LUT type FPGA’. Asian
Test Symp., 1998, pp. 272 – 277
[37] ALAGHI A., YARANDI M.S., NAVABI Z.: ‘An optimum ORA BIST
for multiple fault FPGA look-up table testing’. Asian Test
Symp., 2006, pp. 293 – 298
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
www.ietdl.org
[38] LIU J., SIMMONS S.: ‘BIST-diagnosis of interconnect fault
locations in FPGA’s’. Canadian Conf. on Electrical and
Computer Engineering, 2003, pp. 207– 210
[39] CAMPREGHER N., CHEUNG P.Y. , VASILKO M.: ‘BIST based
interconnect fault location for FPGAs’. Int. Conf. on Field
Programmable Logic, 2004, pp. 322– 332
[40] SUN X., XU J., CHAN B., TROUBORST P.: ‘Novel technique for
built-in self-test of FPGA interconnects’. Int. Test Conf.
2000, 2000, pp. 795 – 803
[41] SMITH J., XIA T., STROUD C.: ‘An automated BIST architecture
for testing and diagnosing FPGA interconnect faults’,
J. Electron. Test. Theory Appli., 2006, 22, (3), pp. 239– 253
[42] HARRIS I., TESSIER R.: ‘Diagnosis of interconnect faults in
cluster-based FPGA architectures’. Int. Conf. on Computer
Aided Design, 2000, pp. 472 – 475
[43] CHMELÂR E.: ‘FPGA interconnect delay fault testing’. Int.
Test Conf., 2003, vol. 1, pp. 1239 – 1247
[44] TAHOORI M.B. : ‘Diagnosis of open defects in FPGA
interconnect’. IEEE Int. Conf. on Field-Programmable
Technology, 2002, pp. 328 – 331
[45] GIRARD P., HRON O., PRAVOSSOUDOVITCH S., RENOVELL M.: ‘High
quality TPG for delay faults in look-up tables of FPGAs’. Int.
Workshop on Electronic Design, Test and Applications, 2004
[46] ABRAMOVICI M., STROUD C.E.: ‘BIST-based delay-fault testing
in FPGAs’, J. Electron. Test., 2003, 19, pp. 549– 558
[47] WONG J.S.J., SEDCOLE P., CHEUNG P.Y.K.: ‘Self-characterization
of combinatorial circuit delays in FPGAs’. Int. Conf. on
Field Programmable Techniques, 2007, pp. 17– 23
[48] DOUMAR A. , ITO H.: ‘Testing approach within FPGA-
based fault tolerant systems’. IEEE Asian Test Symp.,
2000, p. 411
[49] ABRAMOVICI M., EMMERT J.M., STROUD C.E.: ‘Roving STARs: an
integrated approach to on-line testing, diagnosis, and fault
tolerance for FPGAs’. NASA/DoD Workshop on Evolvable
Hardware, 2001, p. 73
[50] EMMERT J.M. , STROUD C.E. , ABRAMOVICI M.: ‘Online fault
tolerance for FPGA logic blocks’, IEEE Trans. VLSI Syst.,
2007, 15, (2), pp. 216– 226
[51] SHNIDMAN N.R., MANGIONE-SMITH W.H., POTKONJAK M.: ‘On-line
fault detection for bus-based field programmable gate
arrays’, IEEE Trans. VLSI Syst., 1998, 6, (4), pp. 656 – 666
[52] NAKAMURA Y., HIRAKI K. : ‘Highly fault-tolerant FPGA
processor by degrading strategy’. Pacific Rim Int. Symp.
on Dependable Computing, 2002, pp. 75– 78
209
& The Institution of Engineering and Technology 2010
www.ietdl.org
[53] KELLY J., IVEY P.: ‘A novel approach to defect tolerant
design for SRAM based FPGAs’. Int Workshop on FPGAs,
1994
[54] HATORI F., SAKURAI T., NOGAMI K., ET AL .: ‘Introducing
redundancy in field programmable gate arrays’. Custom
Integrated Circuits Conf., May 1993, pp. 7.1.1 – 7.1.4
[55] KELLY J., IVEY P.: ‘Defect tolerant SRAM based FPGAs’. Int.
Conf. on Computer Design, 1994, pp. 479 – 482
[56] HOWARD N.J. , TYRRELL A.M. , ALLINSON N.M.: ‘The yield
enhancement of field-programmable gate arrays’, IEEE
Trans. VLSI Syst., 1994, 2, (1), pp. 115 – 123
[57] LACH J., MANGIONE-SMITH W.H., POTKONJAK M.:
‘Enhanced FPGA reliability through efficient run-time
fault reconfiguration’, Trans. Reliab, 2000, 49, (3),
pp. 296– 304
[58] LACH J., MANGIONE-SMITH W.H., POTKONJAK M.: ‘Low overhead
fault-tolerant FPGA systems’, IEEE Trans. VLSI Syst., 1998, 6,
(2), pp 212– 221
[59] LACH J., MANGIONE-SMITH W.H., POTKONJAK M.: ‘Algorithms
for efficient runtime fault recovery on diverse FPGA
architectures’. Int. Symp. on Defect and Fault Tolerance in
VLSI Systems, 1999
[60] LAKAMRAJU V., TESSIER R.: ‘Tolerating operational faults in
cluster-based FPGAs’. ACM Int. Workshop on FPGAs, 2000
[61] NARASIMHAN J., NAKAJIMA K., RIM C.S., DAHBURA A.T.: ‘Yield
enhancement of programmable ASIC arrays by
reconfiguration of circuit placements’, IEEE Trans. CAD
Integ. Circuit Syst., 1994, 13, (8), pp. 976– 986
210
& The Institution of Engineering and Technology 2010
Authorized licensed use limited to: Thangal Kunju Musaliar College of Engineering. Downloaded on June 26,2010 at 07:00:23 UTC from IEEE Xplore. Restrictions apply.
[62] EMMERT J.M., BHATIA D.K.: ‘A fault tolerant technique for
FPGAs’, J. Electron. Test., 2000, 16, (6), pp. 591 – 606
[63] HANCHEK F. , DUTT S.: ‘Node-covering based defect
and fault tolerance methods for increased yield in FPGAs’.
Int. Conf. on VLSI Design, January 1996, pp. 225– 229
[64] ADAMS G., AGRAWAL D., SIEGEL H.: ‘A survey and comparision
of fault-tolerant multistage interconnection networks’, IEEE
Comput., 1987, 20, (6), pp. 30– 40
[65] SHANTHI A., PARTHASARATHI R.: ‘Exploring FPGA structures
for evolving fault tolerant hardware’. NASA/DoD Conf. on
Evolvable Hardware, 2003, pp. 174– 181
[66] LARCHEV G., LOHN J.: ‘Evolutionary based techniques for
fault tolerant field programmable gate arrays’. Int. Conf.
on Space Mission Challenges for Information Technology,
2006
[67] ESSENI D., BUDE J.D. , SELMI L.: ‘Fault-tolerant evolvable
hardware using field-programmable transistor arrays’, IEEE
Trans. Reliab., 2000, 49, (3), pp. 305– 316
[68] HUANG J. , TAHOORI M.B. , LOMBARDI F.: ‘Fault tolerance
of switch blocks and switch block arrays in FPGA’, IEEE
Trans. VLSI Syst., 2005, 13, (7), pp. 794– 807
[69] CAMPREGHER N., CHEUNG P.Y.K., CONSTANTINIDES G.A., VASILKO M.:
‘Reconfiguration and finegrained redundancy for fault
tolerance in FPGAs’. Int. Conf. on Field Programmable
Logic, 2006, pp. 455 – 460
[70] HARIYAMA M., OGATA S., KAMEYAMA M.: ‘Multi-context FPGA
using floating-gate-MOS functional pass-gates’, IEICE
Trans. Electron., 2006, E89-C, (11), pp. 1655 – 1661
IET Comput. Digit. Tech., 2010, Vol. 4, Iss. 3, pp. 196– 210
doi: 10.1049/iet-cdt.2009.0011