# State-Bust Feedback Control for Fault Recovery of Input/State Asynchronous Sequential Machines
## 5 Illustrative Examples
### Asynchronous Error Counter  
As the second example, we apply the proposed scheme to fault tolerant control for asynchronous error counters embedded in the satellite computers [39]. Since SEU faults caused by cosmic rays in space corrupt logic values of memory elements in the computers, periodic memory scrubbing is needed based on the amount of accumulated errors. Error counters play the role of detecting and recording the error occurrences by transferring to specific states that characterize the degree of error occurrences. Consider an asynchronous 6-error counter \(\Sigma_{2}=(A,X,\bar{x},f)\) whose state flow diagram is shown in Figure 4, where \(A_{n}=\{a_{i},b_{i}|1\leq i\leq 6\}\), \(A_{d}=\{n_{j},f_{j}|0\leq j\leq 2\}\), and \(\bar{x}=x_{1}\), \(\Sigma_{2}\) receives two kinds of error signals: \(a_{i}\) with one-step resolution and \(b_{i}\) with two-step resolution. Typical examples of \(a_{i}\) and \(b_{i}\) are 1-bit and 2-bit errors that frequently occur in space-born digital systems [14; 15]. It is assumed that every character of \(A_{n}\) can be generated for control purposes. In accordance with the meaning of each signal, \(\Sigma_{2}\) advances one state in response to \(a_{i}\) and two states in response to \(b_{i}\) as depicted in Figure 4.  
\(\Sigma_{2}\) counts maximally six occurrences of \(a_{i}\)'s and three occurrences of \(b_{i}\)'s, after which \(\Sigma_{2}\) is reset to \(x_{1}\). Supposing that \(\Sigma_{2}\) is implemented as a digital circuit, we assign a three-bit binary number \(c_{2}c_{1}c_{0}\) to each state as follows: \(x_{1}=000\), \(x_{2}=001\), \(x_{3}=011\), \(x_{4}=111\), \(x_{5}=110\), and \(x_{6}=100\). Working in space, all the memory elements corresponding to \(c_{2}c_{1}c_{0}\) are also exposed to SEU faults. In \(A_{d}\), \(n_{j}\) and \(f_{j}\) represent an SEU fault that upsets the logic value of \(c_{j}\) from 0 to 1 and from 1 to 0, respectively, \(j=0,1,2\). The control goal is to design \(G\) and \(C\), if any, that accomplish fault diagnosis and fault recovery against any adversarial input of \(A_{d}\). By observing Figure 4, we can derive each \(W(x_{i})\) and \(\Gamma(x_{i})\), e.g., for \(x_{1}\),  
\[W(x_{1})=\{n_{0},n_{2}\},\ \Gamma(x_{1})=\{x_{2},x_{6}\}.\]  
It is found that \(W(x_{i})\
eq\emptyset\), \(\forall x_{i}\in X\). Let us investigate fault detectability for the existence of \(G\). For instance, consider the case of \(x_{1}\). The state bursts produced by \(W(x_{1})\) are \(\alpha(x_{1},n_{0})=x_{1}x_{2}\) and \(\alpha(x_{1},n_{2})=x_{1}x_{6}\). Since \(\alpha(x_{1},n_{0})\
otin sp(\alpha(x_{1},n_{2}))\) and vice versa, any unauthorized transitions occurring at \(x_{1}\) are fault detectable by Proposition 2. In fact, fault detectability is ensured for the rest of the states and thus \(G\) can be designed. Figure 4: State flow diagram of an asynchronous 6-error counter \(\Sigma_{2}\): state transitions with respect to \(A_{n}\) are drawn on the left, and those with respect to \(A_{d}\) are on the right. To construct \(G\), we continue to concern the case of \(x_{1}\). A fault occurrence at \(x_{1}\) is diagnosed when the state burst is observed to change to either \(x_{1}x_{2}\) or \(x_{1}x_{6}\), while the control input remains unchanged. According to the first line of (3), \(G\) is set to be \((U(x_{1})\cap A_{n}=\{a_{6},b_{5}\})\) as follows:  
\[G(x_{1}x_{2},u) =(x_{2},1),\ \forall u\in\{a_{6},b_{5}\}\] \[G(x_{1}x_{6},u) =(x_{6},1),\ \forall u\in\{a_{6},b_{5}\}.\]  
When \(\Sigma_{2}\) is under the procedure of fault recovery, \(G\) must not change \(m\) as defined in the second line of (3). For the case of \(x_{1}\), the latter operation is materialized by setting the following:  
\[G(z,u)=(z_{l},-),\ (z_{f},u,z_{l})\in s,\ m_{o}=1,\ z_{l}\
eq x_{1}.\]  
Finally, when \(\Sigma_{2}\) reaches the original state \(x_{1}\), \(m\) is reset to \(0\) as defined in the third line of (3). The operation of \(G\) at the other states is designed in a similar manner.