TMR voting in the presence of crosstalk faults at the voter inputs

In high reliability systems, the effectiveness of fault tolerant techniques, such as Triple-Modular-Redundancy (TMR), must be validated with respect to the faults that are likely in the current technology. In todays' Integrated Circuits (IC), this is the case of crosstalks, whose importance is growing because of device & interconnect scaling. This paper analyzes the problem of crosstalk faults at the inputs of voters in TMR systems. In particular, possible problems are illustrated, and it is shown that such crosstalk may invalidate the reliability of both voting, and diagnosing operations. The problem is analyzed from a probabilistic point of view. Its occurrence is estimated by using a set of TMR systems obtained with combinational benchmarks as functional modules. The possible problems of such operations are discussed in the presence of crosstalk faults. It is shown that crosstalk may invalidate the reliability of both voting, and diagnosis operations. A probabilistic model of the voting & diagnosis operations in the presence of crosstalk has been developed. Finally, such a model has been used to estimate the probability of voting & diagnosis failures in a set of TMR systems obtained by using combinational benchmarks as functional modules. We have shown that the presence of crosstalk faults at voter inputs may impair both the voting, and the diagnosis mechanisms. This problem has been quantified by applying a probabilistic model of crosstalk fault effects on voting and diagnosis to a set of benchmark circuits. Results show that crosstalk may create a reliability problem for TMR systems. Such a problem can be solved by using on-line testing or design for testability providing additional controllability & observability to the replicated functional units.     

Comparative redundancy, an alternative to triple modular redundant system design

A new scheme for implementing highly reliable digital systems is proposed. The method has a circuitry overhead which is comparable to that of the triple modular redundancy (TMR) scheme, although it is shown to have a reliability, and more importantly a mean time to failure, improvement well beyond that expected from the standard TMR systems. The reliability and mean time to failure are both developed from a discrete state, continuous time, Markov model of the new system. The results for the reliability and mean time to failure characteristics for this new design of system, termed comparative redundancy, are compared to both TMR and a single unit.     

Task-scheduling strategies for reliable TMR controllers using taskgrouping and assignment

Real-time computers are often used in embedded, life-critical applications where high reliability is important. A common approach to make such systems dependable is to vote on redundant processors executing multiple copies of the same task. The most popular redundant structure is triple modular redundancy (TMR). The processors that make up such systems are subject not only to independently occurring permanent and transient faults, but to correlated transient faults, such as electromagnetic interference (EMI) caused by the operating environment. This paper proposes two new scheduling strategies for TMR computer-controllers. Both strategies can tolerate correlated faults as well as independent faults. These strategies, TMR-R (TMR with rotated task group) and TMR-Q (TMR with quintuple computation), are developed using task grouping and assignment. To evaluate the reliability of these strategies, a discrete-time Markov model for control systems is devised. Reliability equations for the TMR-R and TMR-Q are derived from state transitions of sampling intervals based on the Markov model. The reliability of these TMR is proved by comparing them with a conventional TMR, using numerical analysis. These proposed strategies are anticipated to be useful for control systems operating in harsh environments, such as controllers of airplanes or nuclear power plants     

Reliability analysis of k-out-of-n systems with partially repairable multi-state components

In some environments the components might not fail fully, but can lead to degradation and the efficiency of the system may decreases. However, the degraded components can be restored back through a proper repair mechanism. In this paper, we present a model to perform reliability analysis of k-out-of-n systems assuming that components are subjected to three states such as good, degraded, and catastrophic failure. We also present expressions for reliability and mean time to failure (MTTF) of k-out-of-n systems. Simple reliability and MTTF expressions for the triple-modular redundant (TMR) system, and numerical examples are also presented in this study.     

A Reliability and Comparative Analysis of Two Standby System Configurations

Equations are derived which enable one to calculate the system reliability for parallel or triple modular redundant systems with standby spares. Software error detection is introduced into the TMR/Spares system configuration in order to utilize fully all of the units. An indication of the sensitivity of the system reliability to an increase in the number of spares, partitioning, switching, variations in the powered and unpowered failures rates, and time is presented. A comparison of the parallel and the TMR/Spares system configurations, under similar conditions, is given.     

Reliability study of duplex-hybrid systems

Duplex (double modular redundant) systems utilising standby spares are described and the reliability equations of such systems are derived. The system reliability as a function of normalised time is plotted and compared with conventional TMR (triple modular redundant) system. It is shown that the duplex-hybrid system is noticeably more reliable than the TMR-hybrid system with the similar configuration of standby spares. Implementation of a duplex-hybrid system supplemented by an intelligent unit with powerful capabilities is discussed.     

Vom Lenkrad zum Joystick

Embedded computer systems are increasingly being entrusted with vital control tasks in safety critical applications. Due to their immense versatility they are replacing conventional relay- and mechanical control systems as well as pneumatic systems. The high complexity inherent to computer control systems, however, makes the assessment and proof of their reliability more difficult. While conventional failure mode analysis has proven effective for mechanical and relay control, embedded systems rather require probabilistic and metrological approaches. In this context our paper will concentrate on some aspects of fail-silent architectures as an alternative to TMR systems, system level reliability modelling and fault injection for the assessment of fault tolerance. The implications of this approach will be demonstrated for an automotive steer-by-wire system.     

Floating redundancy in digital systems

The traditional styles of redundancy such as triple modular redundancy (TMR) use exact functional duplicates to provide increased reliability [NE63]. This need not be the case; a system may be designed using floating redundancy. Floating redundancy improves reliability by using a floating spare that may perform as several module types. The adjective “floating” is used to describe this ability to function as two or more types.This paper outlines some of the results of a study of floating redundancy.     

Computer Redundancy: Design, Performance, and Future

The literature on the theoretical aspects of redundancy in digital computers is extensive providing a sound basis for highly reliable design. This paper describes the design problems, the reliability prediction, the field performance, and the future application of redundancy techniques to digital systems. Triple modular redundancy (TMR) is described using the logic of the Launch Vehicle Digital Computer utilized in the uprated Saturn I and the Saturn V vehicles. The self-correcting memory of this computer is described along with the associated design problems and the design verification based on production experience. Consideration is given to system design problems involved with TMR logic. A Monte Carlo technique for predicting computer reliability is considered in a design engineering rather than programmer approach. The unique means of indicating single-channel malfunctions, while continuing to mask these single-channel malfunctions with respect to system operation, is introduced. The result of field operation are given and compared with predicted reliability. Quad redundancy at the component part level is described using the circuitry of the primary processor and data storage (PPDS) for NASA's Orbital Astronomical Observatory. The process of arriving at a quad redundancy implementation is considered in light of the constraints of cost, schedule, and an initial reliability requirement of 95 percent for a year's operation in space. The circuit and system design problems associated with quad redundancy such as impedance and part parameter variations, power consumption, fan out limitations, and testing restrictions are indicated. The results of field operation are given and compared with predicted reliability.     

可演化TMR容错表决电路的设计研究

在高温、辐射等恶劣环境下微电子设备的可靠性要求越来越高,利用演化硬件(EHW)原理,将EHW技术与三模块冗余(TMR)容错技术相结合,在FPGA上实现可演化的TMR表决电路,使硬件本身具有自我重构和自修复能力,大大提高了系统的可靠性.     

Fault-Tolerant ICs: The Reliability of TMR Yield-Enhanced ICs

The use of triple modular redundancy (TMR) for reliability enhancement is well known. This paper presents a simple method' for predicting the reliability of integrated circuits (ICs) which use TMR for yield enhancement. A simple yield-model is included as it is necessary to factor in the effect of consumption of redundancy paths due to wafer fabrication defects. TMR implementation is briefly discussed as well.     

一种具有TSC功能的TMR系统表决器设计方法

本文给出了一种具有完全臬校验功能的三模冗余系统表决器的设计方法。与以往有关ＴＭＲ自温度方面的研究相比，此电路是完全自校验的，它直接将表决器做成完全自校验的，不用在系统外另加冗余四阶累积量适于ＶＬＳＩ实现，此设计思想很容易扩展成Ｎ模冗余系统完全自校验表决器的设计。     

三模冗余演化自修复系统设计及可靠性分析

将演化硬件与TMR技术相结合在系统级层面设计并实现了一款ETMR系统,并以马尔可夫过程理论为基础探讨了其可靠性规律.发现在任意区间上,ETMR较之单模和TMR系统具有较高可靠性,同时指出修复率与故障率比值是影响ETMR系统可靠度的主要因素,且比值越大其可靠度接近于1的区间跨度越大.系统构建方法及所得结论对于将ETMR系统应用于具体工程实践具有一定的启发和指导作用.     

The effect of compensating faults models on NMR system reliability

Realistic estimates of the reliability of systems with N-tuple modular redundancy (NMR), must consider the effect of compensation of logic faults. Earlier analyses that include compensating faults are impractical to use, yield very complex mathematical formulas for reliability indices, and/or concern the simplest triple modular redundancy (TMR) system only. This paper gives a general approach to the problem. Two models of compensating faults are considered. For either model the lower and upper bounds on frequency of compensating faults are found. By applying some results of NMR system evaluation, the new estimates of upper and lower bounds of NMR system reliability with respect to compensating faults are derived. A simple algebraic form of the final results makes them useful     

Reliability evaluation of a TMR computer system with multivariate exponential failures and a general repair

A Triple Modular Redundant (TMR) computer system is discussed under the assumptions of the multivariate exponential lifetimes and a general repair distribution. Analysis of an extended Markov Renewal Process (MRP) enables us to formulate a stochastic model and give some reliability measures which are quite useful to evaluate the TMR computer system.     

Hybrid redundancy approach to increase the reliability of FPGA based speed controller core for high speed train

With the progress of the railway technology, the railway transportation is becoming more efficient, intelligent and faster. High speed trains, as a major part of the railway transportation, are engaged with passenger＇s safety, and therefore the reliability issue is very important in such vital systems. In this paper, a dependable speed controller core based on FPGA has been developed for high speed trains. To improve the reliability and mitigate single upset faults on basic speed controller, this paper proposes a new effective method which is based on hardware redundancy. In the proposed Hybrid Dual Duplex Redundancy （HDDR） method, the original controller is quadruplicated and correct values are voted through the comparator and error detection unit. We have analyzed the proposed system with Reliability, Availability, Mean time to failure and Security （RAMS） theory in order to evaluate the effectiveness of proposed scheme. Theoretical analysis shows that the Mean Time To Failure （MTTF） of the proposed system is 2.5 times better than the traditional Triple Modular Redundancy （TMR）. Furthermore, the fault injection experimental results reveal that the capability of tolerating Single Event Upsets （SEUs） in the proposed method increases up to 7.5 times with respect to a regular speed controller.     

Protection against soft errors in the space environment: A finite impulse response (FIR) filter case study

The problem of radiation is a key issue in Space applications, since it produces several negative effects on digital circuits. Considering the high reliability expected in these systems, many techniques have been proposed to mitigate these effects. However, traditional protection techniques against soft errors, like Triple Modular Redundancy (TMR) or EDAC codes (for example Hamming), normally result in a significant area and power overhead. In this paper we propose a specific technique to protect digital finite impulse response (FIR) filters applying the “system knowledge”. This means to study and use the singularities in their structure in order to provide effective protection with minimal area and power. The results obtained in the experimental process have been compared with the protection offered by TMR and Hamming codes, in order to prove the quality of the proposed solution.     

Design of Dependent-Failure-Tolerant Microcomputer System Using Triple-Modular Redundancy

Microcomputer system reliability using triple-modular redundancy (TMR) is discussed when failures exist not only in any single module but also in any two or three modules at a time. The optimal time interval is calculated by which the system will even be resynchronized periodically so that additional transient failures can be tolerated. It is shown that in spite of the optimal reaynchronisation, the reliability of the system cannot be improved by the ordinary TMR under some dependent-failures. For the purpose of eliminating the effect of dependent-failures, a new fault-tolerant microcomputer system is proposed where a program is executed three times by three CPU's.     

一种基于ALU单元的改进的三模冗余结构设计

对于传统的三模冗余结构(TMR),当其中两个模块发生失效时可能出现功能相同的情况,造成三模冗余失效.为了解决这一问题,针对ALU模块的结构特点提出了对操作数编码的方法到达三个模块差异化的效果,采用此方法后能100%的消除TMR同功能失效的问题,同时此方法相对于模块的差异化设计成本更低,效果更明显.     

高可靠微处理器结构与实现

文章介绍了抗单粒子翻转容错处理器NBHARK的结构与实现．采用了改进的优化奇权重列编码方法纠检寄存器文件的瞬时错误。提出了多种有效方法提高整个处理器可靠性，如三模冗余内部临时寄存器,三模冗余时钟，片上EDAC，奇偶校验，强制cache缺失等。该芯片在smic0．18μmCMOS工艺投片。辐射试验表明，粒子注入（〉50，000）引起的单粒子翻转错误均成功纠正。试验采用^252Cf辐射源，3．5uCi，以及43MeV．cm^2／mg平均LET进行。