Triple Modular Redundancy Research Articles

Generation Methodology for Good-Enough Approximate Modules of ATMR

Approximate triple modular redundancy (ATMR) is sought for logic masking of soft errors while effectuating lower area overhead than conventional TMR through the introduction of approximate modules. However, the use of approximate modules instigates reduced fault coverage in ATMR. In this work, we target better design tradeoffs in ATMR by proposing a heuristic method that effectively utilizes a threshold for unprotected input vectors to generate good enough combinations of approximate modules for ATMR, which accomplishes higher fault coverage and reduced area overhead compared with previously proposed approaches. The key concept is to employ logic optimization techniques of prime implicant (PI) expansion and reduction for successively obtaining approximate modules such that the combination of three approximate modules appropriately functions as an ATMR. For an ATMR to function appropriately, blocking is used to ensure that at each input vector, through the prime implicant (PI) expansion and reduction technique, only one approximate module differ from the original circuit. For large circuits, clustering is utilized and comparative analysis indicates that higher fault coverage is attained through the proposed ATMR scheme while preserving the characteristic feature of reduced area overhead. With a small percentage of unprotected input vectors, we achieved substantial decrease in transistor count and greater fault detection, i.e., an improvement of up to 26.1% and 42.1%, respectively.

Dependability modeling and optimization of triple modular redundancy partitioning for SRAM-based FPGAs

SRAM-based FPGAs are popular in the aerospace industry for their field programmability and low cost. However, they suffer from cosmic radiation-induced Single Event Upsets (SEUs). Triple Modular Redundancy (TMR) is a well-known technique to mitigate SEUs in FPGAs that is often used with another SEU mitigation technique known as configuration scrubbing. Traditional TMR provides protection against a single fault at a time, while partitioned TMR provides improved reliability and availability. In this paper, we present a methodology to analyze TMR partitioning at early design stage using probabilistic model checking. The proposed formal model can capture both single and multiple-cell upset scenarios, regardless of any assumption of equal partition sizes. Starting with a high-level description of a design, a Markov model is constructed from the Data Flow Graph (DFG) using a specified number of partitions, a component characterization library and a user defined scrub rate. Such a model and exhaustive analysis captures all the considered failures and repairs possible in the system within the radiation environment. Various reliability and availability properties are then verified automatically using the PRISM model checker exploring the relationship between the scrub frequency and the number of TMR partitions required to meet the design requirements. Also, the reported results show that based on a known voter failure rate, it is possible to find an optimal number of partitions at early design stages using our proposed method.

Radiation-hardening and testing approach for bringing a terrestrial RF transceiver to the space environment

Present-day space-qualified component performance and flexibility is limited when compared to the capabilities of electronic parts for terrestrial applications. While some component manufacturers provide ranges of products that are radiation-hardened and radiation-tolerant, their computational performances are sometimes limited. In other cases, it is even impossible to find high reliability parts that match the required functionality, such as, for instance, radio-frequency components for a highly-dynamic software-defined radio platform. In fact, when talking about communications, terrestrial technologies are far more advanced than those applied in space. Motivated by the global mobile communications market, permanently seeking new products and development areas, these technologies experience an unparalleled evolution. Then, how can Space benefit from these technological advances on Ground, without sacrificing reliability?Such challenge was faced in the development of an Inter-Satellite Link (ISL) for the ESA Proba-3 formation flying mission. The baseline technology was based on a terrestrial software-defined transceiver architecture, relying on state-of-the-art electronic parts. For this reason, and to avoid a major redesign of the ISL data link, the approach selected to handle radiation in the ISL units was threefold: (i) Develop a mechanical design that is able to provide considerable shielding to the electronic components inside, through an increase of thickness. The additional mass is compensated by the miniaturisation levels attained by not using bigger and heavier radiation-hardened components; (ii) Implement design techniques that help to mitigate the single-event effects caused by high-energised particles. Techniques include latch-up protection, voting systems on the processors or Triple Modular Redundancy (TMR); and (iii) Perform radiation testing on selected critical components or assemblies, against the Proba-3 radiation environment, and devise backup component replacement strategies.This paper describes the approach being followed for the radiation qualification of the Proba-3 ISL unit, based mostly on commercial parts, and the different challenges faced throughout the process. It covers the three levels described before: mechanical shielding, radiation-hardening design techniques and radiation verification testing, including analysis and test results. Additionally, the paper addresses the benefits and technical and economical viability of this integrated strategy to increase the variety of the space-approved parts, in order to enable better-performing satellite missions and bridge the existing gap between space and terrestrial technology.

Predicting system failure rates of SRAM-based FPGA on-board processors in space radiation environments

Static random-access memory-based field-programmable gate arrays are increasingly being used for on-board processors in space missions. However, they are very susceptible to single event upsets that can generate on-board processor system malfunction or system failures in space radiation environments. This paper presents an on-board processor system adopting Triple Modular Redundancy with the concept of mitigation windows and external scrubber, and then suggests a mathematical model that predicts the on-board processor system failure rate by only using the information of system configuration resources. Our mathematical derivation can estimate on-board processor system reliability as a function of the single event upset rate, the number of mitigation windows, and on-board processor shield thickness. In addition, a guideline of the on-board processor system design is provided for achieving good single event upset mitigation capability and system reliability.

Configuration Self-Repair in Xilinx FPGAs

The usage of static random access memory-based field programmable gate arrays (FPGAs) on high-energy physics detectors is mostly limited by the sensitivity of devices to radiation-induced upsets in their configuration. In this paper, we describe a scrubber core designed for Xilinx FPGAs, based on configuration redundancy. When no upsets happen in homologous redundant bits and the scrubber is functional, the adopted redundancy makes it possible to correct all the errors. In fact, the scrubber corrects its own configuration and the one pertaining to a given user design. We discuss the architecture and two implementations of the scrubber, corresponding to different flavors of triple modular redundancy. We report results from proton irradiation tests, which prove that our core can extend the lifetime of a benchmark circuit up to 290%.

Modelling and mitigation of single-event upset in CMOS voltage-controlled oscillator

Single-event effects (SEEs) have been the primary concern in study of radiation effects since late 1970s with the discovery of soft errors in terrestrial and space environments. The interaction of a single ionized particle with electronic devices leads to SEEs. In this paper, single-event upset (SEU) on CMOS devices in designing of a voltage-controlled oscillator (VCO) is analysed. Further, mitigation approaches of SEU are also discussed. To observe the impact of radiation, a VCO was designed in Cadence Virtuoso, and GDSII file of one ring oscillator stage was extracted to incorporate the same design in Silvaco MaskViews. With the help of layer map information file, masks were identified and used to design the CMOS inverter structure file for simulation of SEU condition. The input parameters for SEU simulation were evaluated from linear energy transfer (LET) graph of heavy ion under space conditions. The current profile of CMOS inverter was extracted under influence of a high-energy particle with the help of LET graph of that particle. This current profile was applied to different nodes of VCO and upset conditions were identified. Further, the impact of upset conditions on lock stage of phase-locked loop (PLL) is discussed. Results show that the SEU has significant impact on the logic state of inverters used in ring oscillator stage compared with current starving/biasing stage. The current profile of CMOS device has strong dependence on the energy of ion, its track, angle of incidence and the material. When angle of incidence is very less (\(7^{\circ }-14^{\circ }\)) the channel will be occupied by a funnel of charge and it leads to the maximum degradation of device. This work shows that a device operating at high frequency is more susceptible to SEU. Triple modular redundancy (TMR) and Radiation Hardened By Design (RHBD) can be used to mitigate SEU. TMR consumes more power and is less accurate compared with the RHBD approach.

Operation-oriented reliability and availability evaluation for onboard high-speed train control system with dynamic Bayesian network

The reliability and availability of the onboard high-speed train control system are important to guarantee operational efficiency and railway safety. Failures occurring in the onboard system may result in serious accidents. In the analysis of the effects of failure, it is significant to consider the operation of an onboard system. This article presents a systemic approach to evaluate the reliability and availability for the onboard system based on dynamic Bayesian network, with taking into account dynamic failure behaviors, imperfect coverage factors, and temporal effects in the operational phase. The case studies are presented and compared for onboard systems with different redundant strategies, that is, the triple modular redundancy, hot spare double dual, and cold spare double dual. Dynamic fault trees of the three kinds of onboard system are constructed and mapped into dynamic Bayesian networks. The forward and backward inferences are conducted not only to evaluate the reliability and availability but also to recognize the vulnerabilities of the onboard systems. A sensitivity analysis is carried out for evaluating the effects of failure rates subject to uncertainties. To improve the reliability and availability, the recovery mechanism should be paid more attention. Finally, the proposed approach is validated with the field data from one railway bureau in China and some industrial impacts are provided.

A Stochastic Computational Multi-Layer Perceptron with Backward Propagation

Stochastic computation has recently been proposed for implementing artificial neural networks with reduced hardware and power consumption, but at a decreased accuracy and processing speed. Most existing implementations are based on pre-training such that the weights are predetermined for neurons at different layers, thus these implementations lack the ability to update the values of the network parameters. In this paper, a stochastic computational multi-layer perceptron (SC-MLP) is proposed by implementing the backward propagation algorithm for updating the layer weights. Using extended stochastic logic (ESL), a reconfigurable stochastic computational activation unit (SCAU) is designed to implement different types of activation functions such as the $tanh$ and the rectifier function. A triple modular redundancy (TMR) technique is employed for reducing the random fluctuations in stochastic computation. A probability estimator (PE) and a divider based on the TMR and a binary search algorithm are further proposed with progressive precision for reducing the required stochastic sequence length. Therefore, the latency and energy consumption of the SC-MLP are significantly reduced. The simulation results show that the proposed design is capable of implementing both the training and inference processes. For the classification of nonlinearly separable patterns, at a slight loss of accuracy by 1.32-1.34 percent, the proposed design requires only 28.5-30.1 percent of the area and 18.9-23.9 percent of the energy consumption incurred by a design using floating point arithmetic. Compared to a fixed-point implementation, the SC-MLP consumes a smaller area (40.7-45.5 percent) and a lower energy consumption (38.0-51.0 percent) with a similar processing speed and a slight drop of accuracy by 0.15-0.33 percent. The area and the energy consumption of the proposed design is from 80.7-87.1 percent and from 71.9-93.1 percent, respectively, of a binarized neural network (BNN), with a similar accuracy.

Triple-Triple Redundant Reliable Onboard Computer Based on Multicore Microcontrollers

The flight control system must meet extremely high levels of functional integrity and availability. The control algorithm is processed by onboard computer (OBC). To meet the reliability requirements for onboard computers, various type of redundancy must be employed. In this paper, we concerned with the triple modular redundancy (TMR) for an onboard computer with aerospace application. In the proposed architecture, control inputs and system states are measured using designated sensors. According to the acquired data, mission scenario and control algorithm are processed by the processing unit. Thereafter, the results are applied to the system by actuators.TMR technology in component level is used to improve the reliability of OBC according to the system requirements. All of the constituent modules of OBC, comprising processing unit, bus interface, sensor, actuators, and IO devices, benefits from triple redundancy. The case study shows that the similar architecture is used for high reliable flight computer of passenger airplanes except that our architecture is based on the available multicore microcontrollers. The reliability of the designed onboard computer is evaluated analytically, which indicates that the proposed OBC can meet the reliability requirements.

Design of approximate-TMR using approximate library and heuristic approaches

Approximate Triple Modular Redundancy (ATMR), which is the implementation of TMR with approximate versions of the target circuit, has emerged in recent years as an alternative to partial hardware replication where designers can explore reduced area overhead combined with some compromise on fault masking. This work presents a novel approach for implementing approximate TMR that combines the approximate gate library (ApxLib) technique with heuristics. The algorithm initially defines the gates to be approximated using testability and observability measures and then choose the gate transformation based on the bits difference. Experimental results compare the proposed new approach with another state of the art technique that uses approximate gate libraries with genetic algorithm showing a good trade-off between the ATMR schemes efficiency in terms of area and fault masking and the computational effort needed to generate them.

Determining the necessity of fault tolerance techniques in FPGA devices for space missions

Functionality of electronic components in space is strongly influenced by the impact of radiation induced errors which may interfere with the proper operation of the equipment. In space missions, FPGA implementations are generally protected using computationally expensive radiation-error mitigation techniques such as error co rrecting codes (ECC) and triple modular redundancy (TMR). For high-performance systems, such fault tolerance techniques can prove problematic due to both the added computational requirements and their resulting power overhead. As such it is important to make a proper assessment of the expected error rates to make a proper selection of mitigation techniques. This paper provides an extensive overview of the techniques used for determining the necessity of such mitigation techniques in space missions and other situations where a large radiation dose will be encountered. Given the presented study and radiation analysis, in this paper an experimental example is presented in the form of a case study on the Digital Receiver System (DRS) in the Netherlands–China Low-frequency Explorer (NCLE) mission, which is implemented using a Xilinx Kintex-7 SRAM FPGA. Fault rates are estimated for a five-year mission to the second Earth-Moon Lagrange point (L2) and the chosen fault mitigation strategy as implemented in NCLE–DRS is presented. The effect of potential upsets on the functionality of DRS has been taken into account in order to make error estimations more precise. Thus, two test-benches are developed and presented to experimentally evaluate the effect of upsets in FPGA configuration memory and the data on the DRS final outputs. The approach provided in this paper should generalize well to other space missions, as long as a general estimate of the expected radiation environment is available.

Dual-Interlocked Logic for Single-Event Transient Mitigation

A combinational logic family, termed dual-interlocked logic (DIL), designed for single-event transient (SET) mitigation has been fabricated at a 16nm/14nm bulk FinFET technology generation and irradiated with heavy ions. Through both simulation and heavy-ion irradiation, DIL is shown to be robust to both single- and dual-node strikes. Results are compared to cascode voltage switch and standard logic to show the effectiveness of the logic family in mitigating SETs at the gate level. Three exemplar radiation-hardened-by-design synchronous systems using DIL, spatial triple modular redundancy (TMR), and temporal TMR are compared across area, power, delay, and hardness relative to an unhardened baseline system. The system utilizing DIL exhibits desirable tradeoffs compared to spatial and temporal TMRs.

Feedback-Based Low-Power Soft-Error-Tolerant Design for Dual-Modular Redundancy

Triple-modular redundancy (TMR), which consists of three identical modules and a voting circuit, is a common architecture for soft-error tolerance. However, the original TMR suffers from two major drawbacks: the large area overhead and the vulnerability of the voter. In order to overcome these drawbacks, we propose a new complementary dual-modular redundancy (CDMR) scheme for mitigating the effect of soft errors. Inspired by the Markov random field (MRF) theory, a two-stage voting system is implemented in CDMR, including a first-stage optimal MRF structure and a second-stage high-performance merging unit. The CDMR scheme can reduce the voting circuit area by 20% while saving the area of one redundant module, achieving at least 26% error-rate reduction at an ultralow supply voltage of 0.25 V with 8.33% faster timing compared to previous voter designs.

Input vulnerability‐aware approximate triple modular redundancy: higher fault coverage, improved search space, and reduced area overhead

Area overhead reduction in conventional triple modular redundancy (TMR) by using approximate modules has been proposed in the literature. However, the vulnerability of approximate TMR (ATMR) in the case of a critical input, where faults can lead to errors at the output, is yet to be studied. Here, identifying critical input space through automatic test pattern generation and making it unavailable for the technique of approximating modules of TMR (ATMR) were focused, which involves a prime implicant reduction expansion. The results indicate that the proposed method provides 75–98% fault coverage, which amounts up to 43.8% improvement over that achieved previously. The input vulnerability-aware approach enables a drastic reduction in search space, ranging from 41.5 to 95.5%, for the selection of candidate ATMR modules and no compromise on the area overhead reduction is noticed.

Fault Tolerance Mechanisms for FPGA-Based Regular Expression Matching

Traditional fault-tolerance techniques relying on spatial and temporal redundancy typically imply high power, delay, and area overheads. Cost-effective solutions often depend on system’s design and hardware platform at hand. Particularly for Field-Programmable Gate Arrays (FPGAs), soft errors on the configuration memory are a significant dependability threat. In this work, we present an extended and comprehensive fault tolerance mechanism especially suited for dealing with configuration faults on FPGA-based systems that must deal multiple failure modes. Each failure mode may present different criticality and probability of occurrence, and these properties are measured and exploited to provide low-cost solutions when compared to standard approaches such as triple modular redundancy. The exploited properties are typically found in critical monitoring systems that may trigger security- or safety-critical alarms and warnings in general. In such systems, failing to trigger an alarm when necessary is frequently regarded as more critical than providing an occasional false alarm. For instance, Regular Expression Matching (REM), a compute-intensive mechanism heavily used to perform Deep Packet Inspection in critical network applications, presents such properties, and it can be greatly accelerated by FPGAs to meet performance constraints in high-throughput networks. Therefore, we use FPGA-based REM engines as a case study to demonstrate the effectiveness of the proposed techniques. Additionally, a mutually-aware placement and scrubbing mechanism is introduced to reduce the repair time, improving the system reliability and availability. Experimental results show that the failure rate and the repair time can be reduced by 95 and 90% respectively while avoiding the costs of triplication.

Addressing Functional Safety Challenges in Autonomous Vehicles with the Arm TCL S Architecture

Triple modular redundancy is an option to satisfy the strict safety requirements for autonomous driving. This article introduces a solution at CPU core level, which minimizes the possible single point of failures. Additional effort is spent to mitigate the fault-recovery routines and the assisting infrastructure. —Hans-Joachim Wunderlich, Universitat Stuttgart

Hardware redundancy architecture based on reconfigurable logic blocks with persistent high reliability improvement

On-chip digital system reliability is an important concern today in many critical applications. To achieve high reliability, hardware redundancy architectures are often employed. One of the most frequently used architectures is the triple modular redundancy due to its simplicity and good reliability improvement in the early stages of a product lifetime. However, one of its main drawbacks is the high area overhead, which presents a problem especially in non-time-critical applications. An alternative approach based on reconfigurable logic blocks is proposed in this paper for non-time-critical applications. The aim is to reduce the area overhead below the triple modular redundancy levels while also improving the overall system reliability over the entire operational stage of the product lifetime. Experimental results show that using reconfigurable logic blocks instead of triple modular redundancy the area overhead of redundancy can be significantly reduced up to 71% while also increasing the system reliability over the entire lifetime.

A Self-Checking TMR Voter for Increased Reliability Consensus Voting in FPGAs

Nanoscale field-programmable gate array (FPGA) circuits are more prone to radiation-induced effects in harsh environments because of their memory-based reconfigurable logic fabric. Consequently, for mission- or safety-critical applications, appropriate fault-tolerance techniques are widely employed. The most commonly applied technique for hardening FPGAs against radiation-induced upsets is triple modular redundancy (TMR). Voting circuits used in TMR implementations are decentralized and consensus is calculated from the redundant outputs off-chip. However, if there are an insufficient number of pins available on the chip carrier, the TMR system must be reduced to an on-chip unprotected simplex system, meaning voters used at those locations become single point of failure. In this paper, we propose a self-checking voting circuit for increased reliability consensus voting on FPGAs. Through fault injection and reliability analyses, we demonstrate that the proposed voter, which utilizes redundant voting copies, is approximately 26% more reliable than an unprotected simplex voter when reliability values of voters over normalized time are averaged.

An advanced SEU tolerant latch based on error detection * * Project supported by the National Natural Science Foundation of China (Nos. 61404001, 61306046), the Anhui Province University Natural Science Research Major Project (No. KJ2014ZD12), the Huainan Science and Technology Program (No. 2013A4011), and the National Natural Science Foundation of China (No. 61371025).

This paper proposes a latch that can mitigate SEUs via an error detection circuit. The error detection circuit is hardened by a C-element and a stacked PMOS. In the hold state, a particle strikes the latch or the error detection circuit may cause a fault logic state of the circuit. The error detection circuit can detect the upset node in the latch and the fault output will be corrected. The upset node in the error detection circuit can be corrected by the C-element. The power dissipation and propagation delay of the proposed latch are analyzed by HSPICE simulations. The proposed latch consumes about 77.5% less energy and 33.1% less propagation delay than the triple modular redundancy (TMR) latch. Simulation results demonstrate that the proposed latch can mitigate SEU effectively.

Reconfiguration Control Networks for FPGA-based TMR systems with modular error recovery

Field-Programmable Gate Arrays (FPGAs) provide ideal platforms for meeting the computational requirements of future space-based processing systems. However, FPGAs are susceptible to radiation-induced Single Event Upsets (SEUs). Techniques for dynamically reconfiguring corrupted modules of Triple Modular Redundant(TMR) components are well known. However, most of these techniques utilize resources that are themselves susceptible to SEUs to transfer reconfiguration requests from the TMR voters to a central reconfiguration controller. This paper evaluates the impact of these Reconfiguration Control Networks (RCNs) on the system’s reliability and performance. We provide an overview of RCNs reported in the literature and compare them in terms of dependability, scalability and performance. Most importantly, we compare the performance of soft networks with that of a hard network that utilizes the Internal Configuration Access Port(ICAP) available in advanced Xilinx devices to periodically read the TMR voter states. We have implemented our designs on a Xilinx Artix-7 FPGA to assess the resulting resource utilization and performance as well as to evaluate their soft error vulnerability using analytical and fault injection techniques. Results show that, of the RCN topologies studied, the ICAP-based approach is the most reliable despite having the highest network latency. We also conclude that a module-based recovery approach is less reliable than scrubbing unless the RCN is implemented with redundancy and repaired when it suffers from configuration memory errors.