ANGLIA RUSKIN UNIVERSITY A TYPE-SAFE APPARATUS EXECUTING HIGHER ORDER FUNCTIONS IN CONJUNCTION WITH HARDWARE ERROR TOLERANCE JONATHAN RICHARD ROBERT KIMMITT A thesis in partial fulfilment of the requirements of Anglia Ruskin University for the degree of Doctor of Philosophy This research programme was carried out in collaboration with The University of Cambridge Submitted: October 2015 Acknowledgements This dissertation was self-funded and prepared in part fulfilment of the requirements of the degree of Doctor of Philosophy under the supervision of Dr David Greaves of The University of Cambridge, and Dr George Wilson and Professor Marcian Cirstea at Anglia Ruskin University, without whose help this dissertation would not have been possible. I am grateful to Dr John O’Donnell of The University of Glasgow and Dr Anil Madhavapeddy of The University of Cambridge for their willingness to examine the degree. Dedication Dedicated to my wife Christine Kimmitt i ANGLIA RUSKIN UNIVERSITY ABSTRACT FACULTY OF SCIENCE AND TECHNOLOGY DOCTOR OF PHILOSOPHY A TYPE-SAFE APPARATUS EXECUTING HIGHER ORDER FUNCTIONS IN CONJUNCTION WITH HARDWARE ERROR TOLERANCE JONATHAN RICHARD ROBERT KIMMITT October 2015 The increasing commoditization of computers in modern society has exceeded the pace of associated developments in reliability. Although theoretical computer science has advanced greatly in the last thirty years, many of the best techniques have yet to find their way into embedded computers, and their failure can have a great potential for disrupting society. This dissertation presents some approaches to improve computer reliability using software and hardware techniques, and makes the following claims for novelty: innovative development of a toolchain and libraries to support extraction from dependent type checking in a theorem prover; conceptual design and deployment in reconfigurable hardware; an extension of static type-safety to hardware description language and FPGA level; elimination of legacy C code from the target and toolchain; a novel hardware error detection scheme is described and compared with conventional triple modular redundancy. The elimination of any user control of memory management promotes robustness against buffer overruns, and consequently prevents vulnerability to common Trojan techniques. The methodology identifies type punning as a key weakness of commonly encountered embedded languages such as C, in particular the extreme difficulty of determining if an array access is in bounds, or if dynamic memory has been properly allocated and released. A method of eliminating dependence on type-unsafe libraries is presented, in conjunction with code that has optionally been proved correct according to user-defined criteria. An appropriately defined subset of OCaml is chosen with support for the Coq theorem prover in mind, and then evaluated with a custom backend that supports behavioural Verilog, as well as a fixed execution unit and associated control store. Results are presented for this alternative platform for reliable embedded systems development that may be used in future industrial flows. To provide assurance of correct operation, the proven software needs to be executed in an environment where errors are checked and corrected in conjunction with appropriate exception processing in the event of an uncorrectable error. Therefore, the present author’s previously published error detection scheme based on dual-rail logic and self-checking checkers is further developed and compared with traditional N-modular redundancy. keywords: FPGA, type-safety, fault-tolerance, self-checking ii Contents Contents iii List of Figures vii List of Tables viii Glossary xiii 1 Introduction1 1.1 Background . .1 1.2 Statement of the Hypothesis to be demonstrated . .4 1.3 Research questions, Scope and Objectives . .6 1.4 Original contributions to knowledge . .7 1.5 Method Overview . .8 1.6 Thesis Structure . 10 2 Literature review 11 2.1 Software correctness review . 12 2.2 Logic synthesis review . 15 2.3 Reliability review . 16 3 Methodology 18 3.1 Methodology introduction . 19 3.2 Coq as a hardware verification language . 20 3.2.1 Limitations of Coq for hardware verification . 21 3.3 Compiling OCaml for FPGA . 21 3.4 Fault tolerance . 21 3.5 Garbage Collection . 21 iii 3.6 Utility . 22 3.7 Summary . 22 4 Dependent types in Coq 24 4.1 Proving formalisations in Coq . 24 4.1.1 Executable proofs . 25 4.2 Formalisation of the λ-Calculus.......................... 25 4.3 The extraction process . 26 4.4 OCaml for Hardware Description language use . 31 4.5 Design and Proving Example . 32 4.6 Summary . 33 5 An OCaml compiler for bare-FPGA 34 5.1 Comparison to High Level Synthesis . 35 5.2 Custom OCaml backend . 35 5.3 Library implementation . 36 5.4 Eliminating the type-unsafe layer . 39 5.5 Extracted Compilation Example . 40 5.6 Summary . 46 6 Conversion and compilation to FPGA 47 6.1 The compilation and linking process . 48 6.2 Formatting the control store . 49 6.3 Embedded startup and Global memory . 51 6.4 Parallel simulation and black-box testing . 51 6.5 Simulation Example . 52 6.6 Summary . 54 7 Comparison of TMR and Dual-rail logic 55 7.1 Double-rail logic for fault-tolerance . 55 7.1.1 Conventional Approaches . 55 7.1.2 Failure statistics . 56 7.1.3 Asynchronous double-rail logic . 56 7.1.4 The chosen approach . 56 iv 7.2 Methodology . 57 7.2.1 Conventional Methodology . 57 7.2.2 Description of the proposed new approach . 57 7.2.3 Detailed discussion of the conversion to fault-tolerance . 57 7.3 Results . 61 7.3.1 Preparing the pre-synthesis simulation . 62 7.3.2 Applying the tool-chain . 62 7.4 Benefits . 67 7.4.1 Security . 67 7.4.2 Adaptive clocking . 68 7.5 Limitations . 68 7.6 Comparison of different approaches . 68 7.7 Comparing the redundancy approaches . 69 7.8 Chapter Summary . 70 8 Memory Management 71 8.1 Basic garbage collection techniques . 71 8.2 Garbage collection as part of memory management . 72 8.3 In-place garbage collection algorithm . 72 8.4 Summary . 74 9 Discussion and analysis 76 9.1 Selection of the parser . 77 9.2 Example of a simply-typed λ-Calculus...................... 78 9.3 Built-in fault mitigation circuitry . 86 9.4 Comparison of implementation by five methods . 86 9.5 Error recovery in a fault-tolerant processor . 96 9.5.1 Linking hardware exceptions to the OCaml exception mechanism . 96 9.5.2 Hardware exceptions example . 97 9.6 Summary . 100 10 Conclusions 101 10.1 Limitations and Further work . 103 v References 104 Appendix-A 118 Appendix-B 126 Appendix-C 134 Appendix-D 144 Appendix-E 147 Appendix-F 152 Appendix-G 155 Appendix-H 163 Appendix-I 166 Appendix-J 175 vi List of Figures 1.1 Flow overview . .5 1.2 Software development flow . .9 6.1 Separate compilation flow . 48 6.2 ROM linkage flow . 49 6.3 Block diagram of Amber-derived memory architecture . 53 7.1 Modified FPGA flow . 58 8.1 Organisation of object memory . 74 9.1 Execution on ML605 apparatus of λ-Calculus example of Table 9.5...... 79 9.2 Close-up display of λ-Calculus example of Table 9.5 (SVGA montage) . 80 9.3 Top-level (block diagram) of FPGA processor . 87 9.4 Four redundancy techniques . 87 9.5 Four timing results . 88 9.6 Top-level (schematic) of FPGA processor . 89 9.7 Hardware logic synthesis redundancy flow choices . 90 9.8 Simulation of hardware error handling in fault-tolerant processor . 99 I.1 Internals of Amber-derived processor . 166 vii List of Tables 4.1 Dependently typed λ-Calculus formalisation . 27 4.2 Statically typed executable semantics . 28 4.3 Fragment of extracted code for λ-Calculus application . 29 4.4 Replacement axioms in OCaml code . 30 5.1 Embedded OCaml library features . 37 5.2 Compilation of let rec f n = if n = 0 then 1 else n*f(n-1) in f 6 ........ 38 5.3 Summary of polymorphic support in OCaml . 39 5.4 External functions in the embedded subset . 40 5.5 Influence of extraction algorithm on performance/size in bytes . 45 6.1 Control store format . 50 7.1 XQR4VLX200 upsets . 57 7.2 Custom flow code statistics . 58 7.3 Double rail logic encoding . ..