A Case for Superconducting Accelerators

TL;DR

This paper explores superconducting accelerators for SHA-256, demonstrating significant energy efficiency improvements over CMOS and proposing a workflow for design evaluation in this emerging technology.

Contribution

It introduces a superconducting accelerator design for SHA-256, achieving up to 46X energy efficiency gains and provides a workflow for evaluating such accelerators.

Findings

10.6X energy efficiency with direct porting from CMOS

12.2X energy efficiency after redesigning for superconducting constraints

46X energy efficiency with fault-tolerant design

Abstract

As the scaling of conventional CMOS-based technologies slows down, there is growing interest in alternative technologies that can improve performance or energy-efficiency. Superconducting circuits based on Josephson Junction (JJ) is an emerging technology that can provide devices which can be switched with pico-second latencies and consuming two orders of magnitude lower switching energy compared to CMOS. While JJ-based circuits can provide high operating frequency and energy-efficiency, this technology faces three critical challenges: limited device density and lack of area-efficient technology for memory structures, reduced gate fanout compared to CMOS, and new failure modes of Flux-Traps that occurs due to the operating environment. The lack of dense memory technology restricts the use of superconducting technology in the near term to application domains that have high compute intensity but require negligible amount of memory. In this paper, we study the use of superconducting technology to build an accelerator for SHA-256 engines commonly used in Bitcoin mining applications. We show that merely porting existing CMOS-based accelerator to superconducting technology provides 10.6X improvement in energy efficiency. Redesigning the accelerator to suit the unique constraints of superconducting technology (such as low fanout) improves the energy efficiency to 12.2X. We also investigate solutions to make the accelerator tolerant of new fault modes and show how this fault-tolerant design can be leveraged to reduce the operating current, thereby increasing the overall energy-efficiency to 46X compared to CMOS. Our paper also develops a workflow for evaluating area, performance, and power for accelerators built in superconducting technology, and this workflow can help other researchers explore designs using this technology.

Figures

Tables

Table 1. Table 1. Energy/op comparison of 16-nm CMOS and JJ-logic ( including cooling overhead of 300x)

Parameter	CMOS-16nm	JJ at 4K	Improvement
64bit-Add	0.592 pJ	0.06 pJ	9.86x
64bit-Multiply	2.367 pJ	0.248pJ	9.54x
64bit-RF-Load	0.050 pJ	0.05 pJ	1x
Off-chip Interconnect	300 pJ	8.6 fJ	30000x
300K to 4K link	-	3712 pJ/bit	NA

Table 2. Table 2. Performance and Energy Evaluations for SHA accelerator implemented in CMOS and JJ

Parameter	GoldStrike 1	JJ-Design	JJ-Design
	CMOS	only RCA	with KSA
Technology	16 nm	248 nm	248 nm
JJ Complexity (million)	N/A	3.38	5.54
Hashrate (GH/s)	1.05	0.661	0.951
Total Power (milli-Watt)	250	15.65	36.23
Energy-Efficiency	4.0	42.26	26.24
(GH/J)	(1x)	(10.6x)	(6.56x)

Table 3. Table 3. Breakdown of JJ-complexity

Design	Adders	Registers	Other Logic	Total
	(million)	(million)	(million)	(million)
With RCAs	1.69 (50.1%)	1.51 (44.8%)	0.17 (5.1%)	3.38
With KSAs	3.75 (67.7%)	1.51 (27.3%)	0.28 (5.0%)	5.54

Table 4. Table 4. Performance and Energy after Optimization

Parameter	RCA	KSA	4-CSA	4-CSA + Reg
	Adder	Adder	Adder	optimization
JJ Complexity (million)	3.38	5.45	3.57	2.89
Hashrate (GHz)	0.661	0.951	1.101	1.101
Total Power (mW)	15.64	36.22	27.5	22.26
Energy Efficiency (GH/J)	42.27	26.24	40.05	49.47
Efficiency wrt CMOS-16nm	10.56x	6.39x	10.0x	12.37x
Hashrate wrt CMOS-16nm	0.63x	0.90x	1.05x	1.05x

Table 5. Table 5. Evaluations for proposed Design Methodology

Logic	Estimated	Reported JJ	Percentage
block	JJ Complexity	Complexity (dorojevets2015towards, )	Error
32 bit RCA Adder	1316	1410	6.6 %
32 bit KSA Adder	3992	4160	4.0 %
Integer Multiplier	33320	37782	11.8 %

Equations

$$J{J}_{system}=J{J}_{gate}+J{J}_{interconnect}$$

$$P_{dynamic}=\frac{2}{3}\cdot n\cdot f\cdot I_c\cdot {\varphi }_0\cdot \alpha$$

$$P_{total}=coolin{g}_{factor}\cdot P_{dynamic}$$

Full text

The lack of dense memory technology restricts the use of superconducting technology in the near term to application domains that have high compute intensity but require negligible amount of memory. In this paper, we study the use of superconducting technology to build an accelerator for SHA-256 engines commonly used in Bitcoin mining applications. We show that merely porting existing CMOS-based accelerator to superconducting technology provides 10.6X improvement in energy efficiency. Redesigning the accelerator to suit the unique constraints of superconducting technology (such as low fanout) improves the energy efficiency to 12.2X. We also investigate solutions to make the accelerator tolerant of new fault modes and show how this fault-tolerant design can be leveraged to reduce the operating current, thereby increasing the overall energy-efficiency to 46X compared to CMOS. Our paper also develops a workflow for evaluating area, performance, and power for accelerators built in superconducting technology, and this workflow can help other researchers explore designs using this technology.

††copyright: none

1. Introduction

Slowdown in Moore’s law limits the energy-efficiency and performance that can be obtained with general purpose computers. To bridge the gap between available performance and application demand, system designs are increasingly moving towards building application-specific accelerators (TPU, ; brainwave, ). While accelerators provide significant performance and energy-efficiency gains, the continued performance growth offered by accelerators also gets affected by technology scaling. Unfortunately, the marginal improvements in CMOS device density and performance forces us to investigate alternative technologies that can provide improved performance and energy-efficiency. Superconducting technology is one such potential candidate. However, the technology has several constraints and it is not yet mature to support complex designs. This paper presents a case for accelerators based on emerging superconducting technology.

What is the Technology? Superconductivity is a physical phenomenon observed in certain metals that exhibit zero electric resistance at extremely low temperatures. It can be leveraged to build energy efficient and high-performance switching devices known as Josephson Junctions (JJ). JJ devices are used as the basic building blocks for constructing logic and memory circuits. JJ technology can operate at frequencies up to 20 GHz, due to minimal switching delay (2 pico-seconds) of JJs and lossless wires. Moreover, the switching energy of a JJ is about five orders of magnitudes smaller than CMOS. However, to achieve superconductivity, JJ devices need to be operated at temperatures close to few Kelvins (typically 4K). To maintain such temperature, a cryogenic cooler is used, and such coolers typically consume 300W power for every 1W dissipated at 4K. Although cooling overhead seems significant, the low switching energy of JJ can still enable devices that have 100x lower energy consumption over CMOS even after accounting for cooling energy overhead (herr2011ultra, ). Thus, JJ technology can provide significant improvements in operating frequency and energy-efficiency compared to CMOS.

What are the Challenges? Building a JJ based computing system is challenging. The primary challenge is limited logic and memory density of JJ-technology. For existing process technology with 248nm feature size, JJ-device density lags by 1000x as compared to CMOS (mit_ll, ; tolpygo2016superconductor, ). Although JJ density is projected to grow in coming years (holmes2013energy, ), near-term JJ-technology may not be able to close the 1000x density gap between CMOS and JJ devices. JJ based logic requires more devices per gate as compared to CMOS. The higher device complexity results from limited output driving capacity of JJs. For example, standard CMOS gates have fan-out of four, whereas, JJ based logic gates can drive at most one output without requiring extra output drivers. These output drivers are known as Josephson transmission lines (JTLs) and costs 2-JJ devices per JTL exacerbating the density problem. The limited fan-out results in significantly different design trade-offs for accelerators built in superconducting technology compared to conventional CMOS. The third challenge is the reliability of JJ devices that is susceptible to magnetic flux-trapping and manufacturing defects. These defects can result in intermittent faults. In this paper, we study near-term JJ technology for building accelerators and make the following contributions.

Contribution-1: Study of Superconducting Accelerator: Given the lack of dense memory technology, accelerators built with JJ based technology are likely to be restricted to applications with tiny working set size and high computational intensity, to obtain significant performance and energy efficiency improvements over baseline CMOS accelerators. In this paper, we focus on a SHA-256 accelerator used for block-chain applications or bitcoin mining. We choose a SHA accelerator due to its simple yet rich design that enables unique design trade-offs offered by JJ technology. Bitcoin mining application requires repeated computation of the double SHA-256 hash for an input message and a 32-bit random key known as a nonce. A bitcoin miner repeats the SHA computation until it finds a key that produces a hash with a set number of leading zeros. This repeated evaluation with the same input message but with different keys fit well with the JJ constraints as the compute intensity is exceptionally high with tiny memory footprint. Also, blockchain applications have a concrete figure-of-merit for both performance (Giga-hashes per Second, or GH/S) and energy-efficiency (Giga-hashes per Joule, or GH/J). Furthermore, existing CMOS bitcoin ASICs serves as highly optimized baseline facilitating technology to technology comparison to evaluate the system-level benefits of JJ based fixed function accelerators. We use Goldstrike 1  (Goldstrike, ) bitcoin miner as the baseline CMOS design.111Bitcoing mining is a competitive industry and the state-of-the-art industrial designs of bitcoin mining accelerators are often kept proprietary by the companies. We use Goldstrike 1 in our evalutions because the implemenation is publicly available and we can make a fair comparison of CMOS versus JJ technology. Given that the design details for state-of-the-art bitcoin mining accelerators, such as Antminer S-9 (16nm ASIC (debitcoin, )), are not publicly available, we are unable to evaluate such designs in JJ technology. Nonetheless, we do compare the energy-efficiency of our proposal with the publicly reported energy-efficiency number of Antminer S-9 in Section 5.6 and observe a 15x improvement (including the cooling overheads).

Contribution-2: Technology-Aware Design: JJ-based adders have significantly different area and performance trade-offs compared to CMOS designs. For example, by accounting for the fan-out problem, we choose an adder structure that minimizes the overall JTL count by fusing consecutive additions. Similarly, the baseline design requires per-stage registers to store the temporary values and relies on wide buses, both of which incur significant overheads. To reduce both JTL and memory overhead, we leverage a predictable register production and consumption of intermediate variables. Instead of storing the intermediate variables in register files we use extremely resource and energy efficient delay-lines to synchronize the producer and consumer stages. Redesigning the accelerator to JJ-technology specific constraints improve the performance by 1.8x and increases the energy-efficiency from 10.6x to 12.4x compared to CMOS implementation.

Contribution-3: Fault Mitigation and BTWC: Superconducting technology has a significantly different fault mode. The source of the fault lies in the operating condition and fundamental property of superconductivity known as Flux trapping. It results in correlated and large granularity faults. Furthermore these faults have relatively longer life time i.e they manifest for longer than transients but they are not permanent. To the best of our knowledge, this is the first paper to mitigate faults in JJ technology by leveraging architecture-level solutions, such as redundancy and sparing. To improve the reliability of the proposed accelerator, we design a fault-tolerant SHA-256 engine by provisioning one additional (spare) pipeline stage and a bypassing mechanism that can detect and protect the accelerator against large granularity faults. Our fault-tolerant design incurs minor storage overhead; however, it can be leveraged to improve energy-efficiency. For example, in superconducting circuits power is a product of critical current ($I_{c}$) and operating frequency. The critical current is essential for the correct operation of a circuit. Minimum value of $I_{c}$ ensures a noise margin dictating tolerable error rate in the logic and memory circuits. This trade-off between $I_{c}$ and error rate can be leveraged to operate the accelerator at Better-Than-Worst-Case (BTWC) operating point by leveraging the fault tolerance circuitry. Such, BTWC design can reduce the $I_{c}$ from 38 to 10 micro-amperes, improving the overall energy-efficiency of the superconducting accelerator to 46x compared to the CMOS implementation.

Contribution-4: Methodology for Estimating Area, Performance and Power of Superconducting Accelerators: Estimation of performance, power, and area for superconducting logic is difficult due to lack of automated design tools. Furthermore, standard cells and design rules in superconducting logic families are fundamentally different from CMOS technology. For example, logic cells in JJ technology has limited driving capacity, and to drive more than one cell, a buffer like cell known as Josephson Junction Transmission Line (JTLs) must be placed between two cells. This limits the direct usage of standard CMOS tools to perform a design space exploration for superconducting technology. To overcome this problem, we use open-source back-end design tools to incorporate design constraints specific to superconducting logic. In addition to the modified design tool, we use analytical models to calculate performance, power, and area for superconducting logic. We introduce a workflow and methodology to explore design space for accelerators built in superconducting logic. Such a workflow can help other researchers in exploring different designs at the architecture level using this emerging technology.

2. Superconducting Technology

2.1. Josephson Junction Device

Few metals exhibit zero resistance to the flow of current at cryogenic temperatures, a phenomenon known as superconductivity. Superconductivity can be achieved by cooling metal wires below their critical temperature. For example, Aluminum (Al) and Niobium (Nb) superconduct below 1.2K and 9.3K respectively. Superconductivity is leveraged in building a switching device called a Josephson Junction (JJ).

A JJ is fabricated by interposing a thin barrier between two superconducting wires as shown in Figure 2(a). This barrier allows the electrons to tunnel through it even in the absence of an applied voltage. Moreover, the tunneling is controlled by changing the input current. For example, when the current flowing through the device exceeds its critical current ($I_{c}$), a JJ switches from superconducting to a resistive state. Alternately, it goes back to the superconducting state if the current is reduced below $I_{c}$. Note that the voltage across the JJ in a superconducting state becomes zero.

2.2. Josephson Junction as Switch

In a superconducting loop with a JJ, the magnetic flux($\phi$) is quantized i.e. it can take only integer multiple values of a single flux quanta (SFQ) ($\phi_{0}$). Magnetic flux ($\phi$) is the magnetic field per unit area. SFQ is the magnetic flux generated by the tunneling of an electron pair. By switching the JJ between superconducting and resistive states, the amount of flux in the circuit can be controlled. Presence or absence of SFQ can thus be used to represent digital information “1” and “0” respectively. When a JJ switches from superconducting to a resistive state, the magnetic flux through the superconducting loop containing the JJ changes by a flux quanta, generating an SFQ pulse of about 1 pico-second duration and 2 milli-volt magnitude, as shown in Figure 2(d).

In superconducting technology, SFQ pulses facilitate encoding, processing, and transmission of digital information. JJs are almost ideal digital switches that are characterized by two basic properties: high-speed switching and ultra-low power dissipation. SFQ pulses can be as narrow as one pico-second making it possible to clock circuits at very high frequencies. Superconducting passive transmission lines (PTL) are also able to transmit SFQ pulses with extremely low losses at 4K. These lossless interconnects and low switching energy for JJs (2x$10^{-20}$ J) enable very low power dissipation.

2.3. Superconducting Logic Gates Using RQL

Reciprocal Quantum Logic (RQL) uses JJ based switches such that a digital “1” is encoded as a pair of SFQ pulses of opposite polarity and a “0” is encoded as the absence of SFQ pulses as shown in Figure 3(a). For details of RQL logic gate design please refer to (herr2011ultra, ). The RQL family consists of two universal gates, the AND-OR gate and the logical A-AND-NOT-B (referred to as A-NOT-B, as shown in Figure 3) gate that enables the design of complex circuits (oberg2011superconducting, ).

Since its introduction in 2011, RQL circuits with 72,800 JJs have been demonstrated. Other demonstrated circuits include shift registers, small arithmetic circuits, transmission driver systems, and serial data receiver systems (herr20138, ; herr2015reproducible, ; herr2018superconducting, ; shauck2018reciprocal, ). Design and resource estimates exist for 32-bit and 64-bit integer and floating-point arithmetic and logical units, register file, on-chip storage components, bloom filters  (dorojevets2015towards, ; dorojevets2015fast, ; dorojevets2018energy, ).

2.4. Memory Challenges for JJ Technology

Table 1 compares the energy-efficiency of typical operations in 16-nm CMOS and superconducting technology. To report energy for 16-nm, we use established ITRS scaling factors since we lack open source 16-nm synthesis libraries (wright2018standards, ; esmaeilzadeh2011dark, ). We observe that memory operations are less energy efficient compared to arithmetic and logic operations for JJ technology. Furthermore, building memory takes more area in JJ technology as there is no dense memory solution like SRAM or DRAM currently available in the superconducting domain. Researchers are exploring superconducting memory solutions such as hybrid-JJ-CMOS memory, Josephson magnetic random access memory (JMRAM), but their capacity is likely to remain severely limited compared to conventional technologies. The limited device density and costly memory operations and capacity constrains the potential applications to computationally intensive applications that have small working sets. We explore the design of superconducting technology for one such application.

3. Superconducting Accelerator

Superconducting circuits offer high energy efficiency. However, with limited device density and memory capacity, designing superconducting general purpose computers is incredibly challenging. Furthermore, lack of sophisticated design tools exacerbate the density problem as existing CMOS-based synthesis tools used for JJ design can not maximize device utilization. We believe that both of the problems are related to design and manufacturing economics rather than being fundamental challenges. However, until the technology reaches the maturity to manufacture and test billion Josephson Junctions per cm2, which is typically required for general-purpose computing, we can leverage the technology to build accelerators.

Applications with tiny working set size and high computational intensity are ideally suited for JJ-based accelerators. We study the SHA-256 application for building accelerators using JJ technology. We provide an overview of the application, the baseline CMOS implementation, and our JJ-based implementation. We optimize the JJ design for performance (in Section 4) and reliability (in Section 5). We use the methodology and workflow described in Section 6 for evaluations using the JJ technology.

3.1. Background on Bitcoin-Mining

A blockchain is a decentralized public ledger of transactions that maintains the validity of transactions by a distributed consensus mechanism (nakamoto, ). In bitcoin, the process of authenticating transactions in this public ledger is called mining. It involves searching for a 32-bit key known as nonce value such that when combined with the message which lists the transactions, the double SHA-256 hash of the block (message + key) falls within a certain range. Whenever a miner finds a block i.e. 32-bit key (nonce) for an input message that leads to desired hash, the miner is rewarded with bitcoins. The overall process for bitcoin mining is captured in 4(a).

A bitcoin miner tries to maximize profit by trying multiple keys in parallel and as fast as possible as the probability of finding the key and getting rewarded is directly proportional to the total hash rate. However, repeated SHA-256 computation requires substantial power due to high computational intensity. The net profit depends both on the reward and operating costs (energy consumption (o2014bitcoin, )). Hence, energy-efficiency (in GH/J) is the figure-of-merit that is optimized to increase profits. For this reason, bitcoin mining has evolved from CPUs to GPUs to FPGA and finally to ASIC-based implementations in the last decade  (magaki2016asic, ; taylor2017evolution, ).

3.2. Background on SHA-256 Algorithm

The SHA-256 computation of a message is carried out as shown in Figure 4(b). The message scheduler unit (MSU) takes an incoming message and splits it into 512-bit chunks. The MSU schedules a different 32-bit data to the compression function generator (CFG) every cycle, consuming 512-bit data over 64 rounds. The CFG uses this data and predefined constants to generate a 256-bit intermediate hash after every 64 iterations which is collected by the intermediate hash collector (IHC). When the entire message is processed, the values in the IHC registers is the final 256-bit hash.

3.3. Baseline CMOS Accelerator Design

Bitcoin mining ASICs are available commercially from different vendors today. Furthermore, the state-of-the-art ASICs are fully custom designed at 16 nm or lower technology nodes and implement several design and algorithmic optimizations to increase the throughput (GH/s) and energy efficiency (GH/J). However, bitcoin mining is a competitive industry and the designs of state-of-the-art industrial accelerators are often kept proprietary. In order to make a technology comparison for the same accelerator design, we use the publicly available Goldstrike1 (Goldstrike, ) miner as the baseline for our studies (we compare our proposal with the publicly reported energy-efficiency for 16 nm AntMiner S9 in Section 5.6).

A hash engine contains two instances of the SHA-256 computation blocks. SHA-256 algorithm uses 64 iterations, which can be pipelined. In Goldstrike1, these iterations are fully unrolled for both the rounds that eventually lead to a 128-stage pipeline. Each pipeline stage comprises a compression function generation (CFG) logic and a message scheduling unit (MSU). The hash collector compares the output hash with the target to be achieved and if the criterion is met, it sends the result to the host.

3.4. Superconducting Accelerator Design

We propose a superconducting blockchain accelerator that operates at 4K temperature and communicates with a host at room temperature. The architecture of our hash engine is shown in Figure 5(a). The host receives the incoming messages from the network and offloads them to the accelerator. The accelerator computes hashes for different nonce values and it sends a message to the host when the network target is met. We port the CMOS Goldstrike1 design to superconducting logic without any optimization.

SHA-256 algorithm requires computation using predefined constants. In our fully pipelined design, each pipeline stage requires a different fixed 32-bit constant for the computations, which are tied-off in the superconducting design to save on resources. The rotations and shifts in the SHA-256 computation involve fixed rotate/shift amounts. So the design does not implement any actual rotator or shifter logic but requires the signals to be routed appropriately.

3.5. Design Overview

Figure 5(a) shows an overview of our JJ-based implementation of GoldStrike1, which is designed by simply porting the CMOS-based implementation to JJ-based implementation. Based on our methodology described in Section 6.1, we compute the area (measured in JJ-complexity) for this design. The baseline design incurs significant JTL overheads (buffers that are required to facilitate fanout).

For the analysis of JTL overheads, we study the distribution of fanout in our design. Figure 6 shows the distribution of fanout in a single stage of our hash engine. Thus, a gate drives on average about 1.5 gates, requiring 50% additional JJs for fanout, incurring significant area overheads.

We perform a design space exploration to best meet the requirements of superconducting technology and present our results for a technology aware design of the superconducting SHA accelerator in Section 4 (as shown in Figure 5(b)). Reliability is a key challenge in superconducting logic circuits and we present a case for a reliable, fault tolerant SHA accelerator in Section 5 (as shown in Figure 5(c)).

3.6. Performance and Energy-Efficiency

In our design, 128 different values of nonce are processed in the pipeline and a hash is generated every cycle once the pipeline is full. The critical path in our design comprises of four adders in the CFG. We report the hashrate, power, and energy-efficiency in Table  2 for the accelerator using the methodology described in Section 6 for two design points, with ripple carry adders (RCAs) and Kogge-Stone adders (KSAs). An RCA is 3x more energy-efficient than a KSA but a KSA has 30% lower latency. This enables us to compare two design points, one that is optimized for energy-efficiency and another that is optimized for performance. For the high performance design, KSAs are used economically since they are expensive in terms of resources. They are used only to optimize the speed-path and the non-critical path adders are still designed to be RCAs. Table 2 also compares the performance and energy-efficiency of the GoldStrike 1 accelerator designed with superconducting logic using the baseline CMOS-based architecture for the two different design points.

The JJ-based design that is implemented with only Ripple-Carry Adders is 10x more energy efficient than the CMOS implementation, however it has 37% lower performance. Using Kogge-Stone adders reduce the energy-efficiency to 6.5x while bridging the performance difference to within 10%. We observe that our design energy-efficiency reduces by almost one-third for design optimized with KSAs, indicating that optimizing only for high-speed can be detrimental to the overall energy-efficiency. However, both designs show that simply porting the accelerator from CMOS to superconducting logic can provide significant energy-efficiency improvement.

The contribution towards JJ-complexity for our hash engine comes from adders, registers and other logic. Table 3 shows the contribution towards JJ-complexity from each of these three sources. We observe that about 50% of the contribution towards JJ-complexity is from adders for an RCA-based design and this increases to 67.7% for KSAs. Optimizing the accelerator design to suit the specific constraints of the JJ technology can further improve energy efficiency. We discus technology-aware optimizations in Section 4.

4. Technology-aware Design

In this section, we discuss the impact of JJ technology on design and architectural decisions. To illustrate the contrast between CMOS and JJ designs, we focus on two critical components of the SHA engine: adders and registers. We also discuss a way to optimize communication for the accelerator.

4.1. Tradeoffs in JJ Adder Circuits

The proposed SHA engine uses 1200 adders, which accounts for more than 50% of JJ-complexity. Furthermore, the clock frequency of the SHA engine is dictated by the critical path that consists of four additions in CFG unit as shown in Figure 5(b). Adders dominate the on-chip resources and overall latency. Thus, optimizing the adders to improve critical path and overall energy efficiency is essential.

Typically CMOS adder designs improve latency at the expense of more transistors or complex connectivity. Although, the complexity of the adder design increases, the delay and energy efficiency also improves. For example, a complex Kogge Stone Adder (KSA) is faster and more energy efficient as compared to simple Ripple Carry Adders (RCA). However, JJ based adders do not follow the same trends. For instance, tree based adders rely on complex communication patterns to improve the critical path from $O(N)$ to $O(log_{2}{N})$. However, to enable tree based adders, we need greater fan-out and complex wiring, both of which have low overhead in CMOS. However, the limited fanout of RQL gates require JTLs leading to high JJ complexity. For example, JJ based KSA improves performance, but it worsens the energy-efficiency (dorojevets2015towards, ; dorojevets20138, ). While designing the SHA engine, a combination of adders can be selected such that our design meets the baseline CMOS performance and maximizes overall energy-efficiency. To satisfy these criteria, we choose different design combinations of KSA and RCA as shown in Figure 7.

4.2. Fanout-aware Adder Design

Table 2 show that merely replacing RCAs with KSAs improve the critical path but degrades the energy- efficiency. Furthermore, even after replacing all four critical path RCAs with KSAs, JJ based accelerator fails to meet the baseline delay. Our goal is to meet the critical path requirement without deteriorating the energy efficiency. Thus we try to optimize our design such that JTL overheads are reduced, and simplicity of RCA is maintained. We observe that majority of the additions in the CFG of Figure 5(b) are back to back additions and most intermediate addition results are not used elsewhere. Thus, it is possible to replace some of these adders by a sequence of carry save adders (CSA). An n-operands CSA computes the composite addition much faster as compared to ripple carry adders. If $\delta_{FA}$ is the delay of a 1-bit full adder (FA), the latency of an N number addition with CSA that can add $N$ $k$-bit numbers is given by $Latency_{CSA}=(K+N-1)\delta_{FA}$.

CSA has lower fanout and does not requires routing between distant gates, making it more layout friendly. When two back to back adders on the critical path of the CFG and the MSU are replaced by a 3-op CSA, the design has 1.2x the performance and is 1.25x more energy-efficient than our baseline design, even after accounting for 20% skew. Hardware optimizations have been proposed in the past to move the addition of variables $W_{i}$ and $K_{i}$ from MSU to CFG  (ting2002fpga, ). We propose a similar optimization where this value is pre-computed in the $(i-1)^{th}$ stage of the pipeline and consumed in the $i^{th}$ stage. This allows us to use 4-op CSA in both CFG and MSU blocks and fuse 3 additions, thereby reducing the overall critical path. This design offers 1.67x the performance improvement for RCA baseline design and is 1.44x more energy-efficient. Table 4 lists the performance and energy-efficiency of the superconducting hash engine for the different adder optimized designs against the baseline design using all RCAs. A similar optimization uses multiple such CSA in parallel for a high-speed SHA-256 ASIC design besides carry-lookahead adders (dadda2004design, ). However, we use these CSAs in conjunction with energy-efficient RCAs to have a more economical design in terms of JJ-complexity.

4.3. Reducing Registers Using Delay-Line

In the baseline pipeline design, in each stage MSU uses 16 registers with 32-bit width, and CFG uses 8 registers. This results in about 35% JJ complexity for an optimized adder circuit. The registers hold the input values and the intermediate results. The contents of the registers are consumed by adders and other logic to produce an output in every stage, and subsequent stages consume the produced output of the stage. A baseline design replicates all the 24 registers at every stage requiring large JJ complexity. Furthermore, all the register values from $i^{th}$ stage to $(i+1)^{th}$ stage are expected to flush every clock cycle. We would need a wide bus to flush the contents of registers every cycle. wide bus and a small set of registers are trivial in CMOS. However, in JJ technology, JTL cost of wide buses and registers lead to high costs.

In traditional non-pipelined SHA-256 design a global register holds all the intermediate values. Whereas, in the quasi-pipelined SHA designs (SHA engine with 4 stage pipeline) each pipeline stage uses a local register (dadda2004asic, ). The local register file enables a higher clock rate. Whereas, shared registers improve the critical path significantly, especially for heavily pipelined designs requiring data values every cycle. So, to supply register values each uses a local set of registers leading to high JJ complexity (registers account for 35% JJs).

The baseline design has fixed control path, and identical operations are performed in every stage of the pipeline. Each pipeline stage produces an output that is consumed in the next set of stages. For example in MSU, only four registers are consumed by 4 input 32-bit adder in each stage of the pipeline, to produce one 32-bit output. After that, all the registers are simply copied to the next stage, such that $N^{th}$ register of the current stage is copied to $(N+1)^{th}$ register of the subsequent stage as shown in the Figure 8(a). Thus only one register value is produced, four values are consumed and rest of the register values are copied as is to the next stage. We can leverage this deterministic production and consumption of the values to eliminate the large fraction of registers.

An alternative to communicating between stages using registers is to connect producer and consumer via a Delay-Line. Delay line memory is a form of memory used in earliest computers during 1960s (eckert1953memory, ; auerbach1949mercury, ). Unlike modern day random access memories, a delay line memory is based on sequential access and requires to be refreshed from time to time. Such memories rely on transmitting information through a circuitry that adds delay and re-routing the end of the delay path to the input end such that information can be transmitted continuously through the closed loop as shown in Figure 9(a). We propose to delay lines to route data from producer register to consumer register in a synchronized manner by using the precise number of delay elements to match the desired delay.

In RQL, a delay line can be built using a series of JTLs that repeat signals for every clock activation. On a JTL delay line, input data is propagated from one JJ to next JJ every clock phase. This provides an efficient way to leverage the producer and consumer patterns in a hash engine to reduce JJ complexity. Delay lines keep the data in flight and deliver to the consumer at the precise clock cycle. Since the delay line can simply load a new value every clock cycle, it can be integrated seamlessly with the proposed pipeline design.

A delay line can facilitate the delivery of intermediate results from a producer stage to a consumer stage. The cost of delay line memory is 4 JJs per clock cycle per bit whereas register storage requires 12 JJs per bit. Although the crossover-point for the flop based register file is 3 clock cycles, the delay line memory enables point to point connection between the producer and consumer that eliminates the need for 16 registers for every stage. We use four staging registers along with the delay line design to tolerate clock skew. The delay lines reduce the per stage JJ cost by almost 20%. Furthermore, it simplifies the bus design.

4.4. Performance and Energy-Efficiency

Table 4 shows the performance and energy-efficiency of our baseline JJ-based accelerator (with RCA/KSA) and with technology aware optimization of 4-operands CSA (four-input) and use of delay-lines to reduce register cost. The 4-operands CSA optimization improves the energy-efficiency from 6.39x for KSA to 10.0x, while also improving the performance by 15% (bringing it in line with the performance of the CMOS-based implementation). The delay-line optimization reduces register file costs and improves energy efficiency from 10.0x to 12.4x, while still having similar performance.

5. Fault Tolerant & BTWC Design

In this section, we discuss fault models for JJ technology, and present a design that can use architecture-level solutions to protect against these faults. We also discuss how the proposed fault-tolerant design can be leveraged to improve energy efficiency by operating the circuit at a Better-Than-Worst-Case (BTWC) design point.

5.1. JJ Logic Fault Sources & Models

There are three primary sources of faults in superconducting logic: Fabrication defect, device level variations, and non-ideal operating environment. Fabrication defects result from the material and masking defects introduced during fabrication. These defects can manifest as permanent stuck-at-faults, similar to birth-time defects in CMOS, and can be mitigated by design time testing. Device parameter variation can cause degradation in noise margins. For example, variation in critical current ($I_{c}$) can cause degradation in noise margin resulting in timing errors and the design must operate at a point where it is robust against such variations.

In JJ technology, flux trapping causes a unique source of faults which we term the operating environment fault. These faults are challenging to protect against due to correlated nature of the errors. Furthermore, the faults are neither a permanent fault nor a transient fault, and it manifests not only because of the device but also due to non-ideal operating conditions. Flux-trapping results from trapping of stray magnetic field in the JJ circuits due to non-uniform cooling and can result in non-functional circuits or reduced noise margin for parts of the chip. Fortunately, steady progress and innovations in fabrication and device technology limits the problem of flux trapping considerably (herr2015reproducible, ). The reported flux-trapping solutions are demonstrated on 50K JJ circuits. However, the techniques are costly, hard to scale to large systems, and do not completely eliminate the problem of flux-trapping. For example, some of the demonstrations use active magnetic field cancellation or extremely low temperature (¡1K) at which flux vortex freezes, both of the additional requirements are expensive, especially for large scale systems.

5.2. Impact of Faults on SHA-256 Hardware

To understand the impact of faults on the output of the SHA engine, we use fault injection to quantify the Architectural Vulnerability Factor (AVF). For the baseline design, injection of faults shows 98.89% AVF. The high AVF of SHA engine results from the entropy maximization property of the algorithm where a single bit operational error can corrupt the output. Protecting a SHA engine is a traditionally non-trivial problem due to its cryptographic properties and tight area and energy constraints. Techniques based on replication or parity detection circuits are either too complex and expensive or provide partial protection against faults.

5.3. Application Level Resilience

Transient faults do not have any meaningful impact on the mining process and hash-rate as transient errors can corrupt only one of the key combinations. The probability of a miner missing out on a reward due to a transient fault is extremely small. For instance, the probability of finding a block is relatively low ($\frac{1}{2^{32}}$), and if the probability of transient fault is $P$, then collision of those two events is significantly lower ($\frac{P}{2^{32}}$). Recent proposals take advantage of this property to enable approximate bitcoin mining (vilim2016approximate, ).

On the other hand, permanent faults would result in non-functional SHA engine thus reducing the yield significantly. Furthermore, if not detected before deploying, the miner would simply consume power without doing any work. This problem is significantly worse for the flux trapping faults as fault patterns change every warm up cycle which forces us to test SHA engines after every cool-down. In CMOS, non-functional chips can be isolated by post fabrication tests. Whereas, in JJ circuits, faults can happen not only because of fabrication defects but also due to operating conditions.

5.4. Fault Tolerant Design

The correlated nature of faults due to large granularity impact of flux traps limit the ability to use standard low-cost protection techniques to protect against single-bit faults that happen in conventional technologies. Our goal is to leverage the regular structure of the accelerator to improve the reliability of the JJ based SHA-256 engine without significant complexity.

For the pipelined SHA-256 accelerator, all the stages in the pipeline are functionally identical. Furthermore, all the stages have deterministic control and data-path. This can be leveraged to enable low-cost fault tolerance. We propose to add an extra pipeline stage and build a bypass logic between consecutive pipeline stages such that if a fault is detected for a pipeline stage that stage can be bypassed as shown in Figure 10(b). The bypass logic and spare pipeline stage can be used to detect the faulty pipeline stage. A faulty stage can be detected by bypassing the stages one by one with a standard input and output pair until a right hash is produced. While we describe the solution with one spare pipeline stage, the same bypass network can be used to mitigate N fault stages in the accelerator by using N spare pipeline stages.

The bypass logic is placed between all 128 stages and it consists of four 32-bit 2:1 multiplexers as shown in Figure 10(c). The multiplexers can bypass the faulty stage and re-route the signals to subsequent working stages. The multiplexers are essential for routing signals from one stage to another even in the absence of faults as they are placed between two stages as shown in Figure 10(b). Fault on any of the multiplexers results in a non-functional SHA engine. However, multiplexers cover only a small fraction of total area and the likelihood of a fault occurring on any of the multiplexers is an order of magnitude less compared to other functional units. Thus, this design enables partial fault-tolerance as it can function correctly as long as faults do not occur on any of the multiplexer blocks. To evaluate the effectiveness of the design, we perform binomial trials assuming identical and independently distributed (iid) errors. In the baseline, even a single fault can lead to system failure whereas, sparing design build some fault-tolerance. To improve the reliability even further, we propose a spare stage design that uses a redundant multiplexers for bypass circuitry. As shown in Figure 10(e), the redundant multiplexer can tolerate one fault on any of the four multiplexers by using an extra 8:1 mux. The design with redundant mux can tolerate one fault anywhere. Figure 11 shows the probability of system failure for the baseline, stage-sparing, and stage-sparing with redundant muxes. The design with sparing and redundant mux is  5-6 orders of magnitude more reliable as compared to the baseline.

5.5. Using Fault-Tolerant Design for BTWC

The energy-efficiency and performance of the superconducting circuit is determined by the critical current (Ic). We can reduce the energy consumption by reducing Ic; however, this can cause certain devices to fail. Therefore, the critical current is set conservatively such that none of the devices fail. Recent studies suggest that the $I_{c}$ distribution for future technology nodes may have a large spread between devices, leading to as much as 5x difference between the average $I_{c}$ and worst-case $I_{c}$ (holmes2017non, ). The heavy tail on $I_{c}$ distribution may force designers to pick $I_{c}$ conservatively. However, we can leverage the proposed fault-tolerant design to tune the optimal $I_{c}$ by using a better-than-worst-case (BTWC) design philosophy. The proposed reliable SHA-engine design can be used to tune the $I_{c}$ as it can protect against a large granularity failure using a spare pipeline stage. To perform the run-time tuning, a $I_{c}$ value is lowered until a failure is observed. With the fault tolerant design, a weak pipeline can be detected and bypassed. If a fault can not be isolated, in that case the $I_{c}$ is increased. The tuning enables optimal $I_{c}$ by isolating a weak/faulty pipeline stage, and mitigation of the fault. This can reduce the $I_{c}$ from 38 $\mu A$ to 10 $\mu A$ (based on conservative scaling model of $I_{c}$ of Herr et al. (herr2011ultra, )).

5.6. Evaluations: Tying it All Together

Figure 12 shows the energy-efficiency of JJ-based designs, all normalized to the baseline CMOS implementation of Goldstrike 1. For reference, we also show the published numbers for commercial ASIC, Antminer-S9, which provides only a 3x improvement in energy efficiency. A basic design that simply translates the CMOS implementation of Goldstrike to JJ technology provides 10x improvement. Redesigning it for technology-specific constraints (fanout, efficient communication) improves the energy efficiency to 12.4x. To enable fault-tolerance, a proposed fault-tolerant design with one spare pipeline stage has overall energy efficiency of 12.2x. The additional JJs required for bypass logic lowers the efficiency compared to unreliable design. However, the fault-tolerant design enables lowering of the critical current ($I_{c}$) from 38 $\mu A$ to 10 $\mu A$, increasing the energy efficiency to 46x (while having 1.2x the performance of the CMOS implementation).

6. Evaluation Workflow

To the best of our knowledge, this is one of the first paper to explore superconducting accelerators and evaluate the performance and power using application-level metrics. As this is an emerging technology, there is no publicly available methodology or workflow for evaluating performance, power, and area of systems built using superconducting technology. Furthermore, standard cells and design rules in superconducting logic families are fundamentally different from CMOS technology. For example, logic cells in JJ technology have limited driving capacity, and to drive more than one cell, a buffer like cell known as Josephson Junction Transmission Line (JTLs) must be placed between two cells. This limits the direct usage of standard CMOS tools to perform a design space exploration for superconducting technology. To overcome this problem, we use open-source back-end design tools to incorporate design constraints specific to superconducting logic. In addition to the modified design tool, we use analytical models to calculate performance, power, and area for superconducting logic. Figure 13 provides an overview of the workflow of tools used in our evaluation.

6.1. Modeling Area Using JJ-Complexity

The area of a superconducting circuit is denoted by a term, called as JJ-complexity. The JJ-complexity is the number of JJs required to design a logic block. A logic block consists of logic gates and Josephson Junction Transmission Lines(JTLs). As JJ-based logic gates have limited driving strength, JTLs are inserted to facilitate the desired fanout. In this paper, we use JJ-complexity as a key figure of merit, similar to prior superconducting system designs (dorojevets2015towards, ; dorojevets2015fast, ). We evaluate the system level JJ-complexity by computing gate JJ-complexity and interconnect JJ-complexity.

Gate JJ-Complexity: To evaluate gate JJ-complexity, we use the RQL standard cell library and Yosys (wolf2016yosys, ; oberg2011superconducting, ), an open-source synthesis tool. Yosys enables us to derive the gate level netlist using only RQL standard cells. Yosys uses ABC (mishchenko2007abc, ), that allows it to map a design’s gate level representation to a target custom library (which is the RQL cell library for our analysis). We process the netlist to compute the gate JJ-complexity by determining the number of gates used of each type. Additionally, we also use Synopsys Design Compiler, a standard CMOS synthesis tool to generate the gate-level design and post-process the design to optimize it using RQL specific standard cells. The gate JJ-complexity obtained is the same from both techniques. Note that the lack of place and route tools, and restricted access to foundry models forces the superconducting logic designers to use manual routing to compute JJ-complexity.

Interconnect JJ Complexity: As RQL gates have limited driving strength, JTLs are used to drive gates. As shown in Figure 14(b), each JTL comprises 2 JJs. JTLs enable fan-out capacity similar to buffers in traditional CMOS circuits and limit clock-skew and jitter. Due to limited driving strength, RQL gates require one JTL for every output load. We process the Yosys generated netlist and determine the fanout for every input and output port and internal wires. To account for JTL overheads we compute the number of JJs required using the rules based on  (herr2011ultra, ):

1. (1)

A JTL is added after a series of five logic gates to suppress clock skew and jitter. 2. (2)

A JTL is required per fanout (a gate can drive a JTL, and a JTL can drive a gate and a JTL). 3. (3)

XOR gates need extra JTL because they operate at the phase boundary (RQL uses a four phase clock, two clock lines with a phase difference of $\pi/2$ provide two phases each (oberg2011superconducting, )).

Our analysis (Figure 6) shows that most of the gates drive either 1 or 2 gates, and the percentage of gates that drive more than 2 gates is quite small (less than 1%). Given that approximately half the gates drive exactly 2 gates, the overhead of additional JTL due to fanout is approximately 50% for our baseline implementation.

System JJ complexity: Full system design using superconducting technology requires JJs for implementing logic and enabling signal routing and fanout. We derive the system JJ-complexity $(JJ_{system})$ by adding gate JJ-complexity $(JJ_{gate})$ and interconnect JJ-complexity $(JJ_{interconnect})$ as shown in Equation 1.

[TABLE]

Table 5 shows the JJ-complexity of some commonly used logic blocks. For validation, we compare our method of evaluating JJ-complexity against published designs that use foundry RQL standard cell library based on foundry models and observe that our estimates are within 12% of the numbers reported in prior work  (dorojevets2015towards, ; dorojevets2015fast, ).

6.2. Modeling Power

RQL delivers power to on-chip devices through inductive coupling to an AC transmission line. As a result, RQL circuits dissipate negligible static power. RQL uses reciprocal data encoding where “0” is represented by the absence of SFQ pulses. Therefore, the dynamic power dissipation in RQL circuits result from only digital “1”s, and digital “0”s do not dissipate power. The total power dissipated (Pdynamic) by an RQL circuit is given by Equation 2.

[TABLE]

where, n is the number of JJs, f is the frequency, Ic is the critical current, $\phi_{0}$ is a universal constant, and $\alpha$ is the activity factor (or the percentage of JJs switching to “1” state). The power dissipated by the superconducting logic is directly proportional to the critical current which depends on the device fabrication technology and foundry services. For our evaluations, we assume the critical current to be $38\mu A$. However, a conservative analysis of critical current reveals that it is possible to reduce it to $10\mu A$ without substantial impact on the bit error rate (herr2011ultra, ). We determine the activity factor ($\alpha$) of a design by counting the number of “1”s from the value change dump (VCD) file of random simulations. We evaluate the total power consumption ($P_{total}$) by multiplying the power dissipated by the design at 4.2K with a cooling overhead as shown in Equation 3.

[TABLE]

Note: For all accelerators implemented using the JJ technology, we include a cooling overhead of 300x in our energy-efficiency calculations.

6.3. Modeling Performance

In order to model performance, we count the number of JJs in the critical path of a design and multiply it by the switching time of a JJ. We assume a uniform JJ switching time of 2 ps (herr2011ultra, ) for all devices. Switching time can be improved by using larger feature size. However, for our analysis, we lack the design and layout tools to study such optimizations.

7. Related Work

Superconducting circuits: A Josephson junction based processor was proposed as early as 1980  (anacker1980josephson, ). A number of circuits were demonstrated in RSFQ logic in the 1990s, including DSPs  (gupta2007digital, ), microprocessor components  (mukhanov1993rapid, ; mukhanov1993rsfq, ; filippov20118, ; dorojevets20138, ; yamanashi2007design, ), mixed signal devices  (rylov1995superconducting, ; inamdar2009progress, ; kirichenko2003multi, ), floating point units  (mukhanov1995implementation, ; kainuma2011design, ). However, due to static power dissipation challenges and high device counts per logic gate, RSFQ circuits faced scalability issues. With the introduction of the RQL family of logic gates, designers were able to mitigate the disadvantages of RSFQ. So far, several RQL family circuits are demonstrated including shift registers, an 8-bit carry-lookahead adder, shift register yield vehicles, transmission driver systems, and serial data receiver systems  (herr2011ultra, ; herr20138, ; herr2015reproducible, ; herr2018superconducting, ; shauck2018reciprocal, ). Dorojevets et. al. present resource estimates for 32-bit and 64-bit integer and floating-point ALU, on-chip storage elements, and bloom filters  (dorojevets2015towards, ; dorojevets2015fast, ; dorojevets2018energy, ). Holmes et al. analyze the feasibility of HPC systems with 1000 PFLOPs (holmes2013energy, ).

SHA Designs: SHA-256 optimizations include changing the computational platform from general purpose processors to FPGAs (chaves2008cost, ; chaves2006improving, ; esuruoso2011high, ; ahmad2005hardware, ; mcevoy2006optimisation, ) and ASICs (dadda2004asic, ; dadda2004design, ; kim2008efficient, ; satoh2007asic, ). Hardware optimizations of SHA engines include use of carry save adders and combination of different types of adders (dadda2004asic, ; dadda2004design, ; lien20041, ; mcevoy2006optimisation, ), pipeline designs (macchetti2005quasi, ; crowe2004single, ; lien20041, ; macchetti2005quasi, ; mcevoy2006optimisation, ), delay balancing (dadda2004design, ), operation rescheduling (dadda2004design, ; ting2002fpga, ; chaves2008cost, ; chaves2006improving, ).

Reliable SHA cores: Prior fault tolerant schemes for SHA hardware use triple modular redundancy  (juliato2009efficient, ), register protection using Hamming codes (juliato2008seu, ), and SHA cores with inbuilt self-checking mechanisms (michail2015hardware, ; michail2016design, ). These schemes assume uncorrelated errors and incur significant area and complexity.

8. Conclusion

In this paper, we evaluate the system level performance and energy improvements for an accelerator built with Josephson junction technology. We focus on three JJ-technology challenges: low device density, limited fanout, and correlated faults due to flux trapping. To leverage the existing technology with limited device density, we focus on SHA-256 engines, that are commonly used in bitcoin-mining accelerators. This application has high computational intensity, tiny memory footprint, and energy-efficiency is a key metric.

A direct translation of CMOS design to JJ design of a baseline (Goldstrike, ) provides 10x improvement in energy-efficiency (GH/J). We highlight the fan-out overhead in JJ technology, and how it impacts the design choices for arithmetic units and pipeline design. We study a technology-aware design that improves the performance by 1.6x while boosting the energy efficiency to 12x over CMOS baseline. We present a unique reliability challenge in JJ technology and propose a fault-tolerant design that can protect against large granularity faults that occur due to this new failure mode. Moreover, we utilize this fault-tolerant design to enable better than worse case design that enables scaling of the critical current without sacrificing functionality and providing a 46x improvement in energy efficiency over CMOS design. We introduce a methodology for estimating area, performance, and power of accelerators built in superconducting logic. Such a workflow can help other researchers in exploring designs using this technology. While we evaluate SHA-256 as an example, the JJ technology is also applicable to other domains.

Acknowledgements.

We thank Srilatha Manne, Elnaz Ansari, Zachary Myers for the technical discussions and feedback. This work was supported by a gift from Microsoft Research.