## 3 Test Environment for TMR Mitigation Structures
In the case of mapping in logic gates, knowing the probability at the inputs \(P(x)\), one can determine the probability of the value one at their output \(P(y)\); for example, NOT: \(P(y)=1-P(x)\), two-input AND: \(P(y)=P(a)P(b)\), two-input OR: \(P(y)=1-(1-P(a))(1-P(b))\). Of course, such an analysis can be applied to more complex gate structures such as TMR voters. This means that for different voter designs, different \(SW\) values can be obtained depending on the logic structure, and similarly for the circuits connected to the voter inputs. This means that the dynamic power consumed for equivalent mitigation structures may differ. A circuit will be more efficient if it has a lower switching activity. It is naturally open to determine the value of \(P(x)\) for the individual inputs of the implemented circuits. As a rule, for the analysis, it is assumed that the probability of 0 appearing is the same as the probability of 1 appearing at the input \(P(1)=P(0)=P(x)=0.5\). In the case of mapping the logic network in LUT blocks, such an analysis in terms of the SW would be very difficult to carry out. As a rule, FPGA manufacturers provide suitable simulators to estimate dynamic power. There are also academic tools to determine the power of ABC [46] or PowerdekBDD [2; 3]. In such an analysis, care should be taken to ensure that the probabilities of 0 and 1 are the same for the inputs to a given mitigation structure. In this situation, a good solution may be to attach a clock signal of a certain frequency to the individual inputs, as shown in Figure 4.  
Extremely important from the perspective of studying mitigation circuits using TMR is to assess their error-correction capability. Naturally, under simulation conditions, a TMR voter will perform as expected. This may be slightly different in a real hardware implementation, where the performance of the voter may depend on the dynamic properties of the implemented circuits. In the case of FPGAs, this verification will involve implementing the mitigation circuit under a test in a hardware-test environment implemented in an FPGA device. Figure 4: Connecting input signals to the voter to determine dynamic power. It is often the case that synthesis tools, in the process of optimising a circuit in terms of the number of blocks, realise the sharing of logic resources between selected logic functions. The common parts (the subfunction) of several selected functions are only realised once in a single shared subcircuit. Then, the result of this subfunction is delivered to the selected functions. From the point of view of reducing the number of logic blocks and power, this is an advantageous phenomenon (a given section of the circuit can be realised only once, rather than several times for the selected functions separately). Unfortunately, from the point of view of TMR mitigation, it is a very unfavourable phenomenon. The individual circuits attached to the voter should not have parts in common. Let us imagine a situation in which individual modules A, B and C have a part of the circuit in common, implementing a specific subfunction. If an error occurs in this part of the circuit, the error will be propagated through all three modules in exactly the same way. This means that the voter will not detect any differences in its inputs and will not correct the error. Such a case is shown in Figure 5. Thus, it can be seen that optimising the implementation in terms of the number of resources can, in some cases, lead to a degradation of the mitigation properties of the circuit. A key component of the hardware-test environment is the error injector. Under normal operating conditions, the same signal is present on all inputs of the voter. In order to test the voter's ability to correct an error, it is necessary to replace one of the input signals with an erroneous one (an error injection into the voter).