# Error Mitigation Methods for FSM Using Triple Modular Redundancy
## 2 Theoretical Background
### Triple Modular Redundancy  
The essence of TMR is to triplicate selected modules and compare the states of their outputs. By majority voting, the correct answer from the triplicated modules is determined. This leads to the conclusion that the voting circuit (the voter) is a key element. The classical form of the voter is shown in Figure 3[41]. Naturally, the output 'Out' has inputs In1, In2 and In3, which is a majority. As can be seen, the classic form of the voter is very simple. This raises the question of its reliability. It seems that the main source of malfunctioning of the voter may be changes to its structure due to errors in the configuration memory of the FPGA chip. This memory is generally protected by a scrubbing mechanism. Theoretically, voter errors are possible, but given the mechanisms for repairing configuration memories, we assume their reliability in the remainder of this paper. In general, there are many different designs of TMR voters: Kshirsagar voter [42], the [PERSON] voter [43], the [PERSON] and Naviner voter [44], or the Mux-based voter [45]. Additionally, in [46], self-checking voting circuit for increased reliability consensus voting on FPGAs is shown. Other solutions should also be mentioned here, such as FPGA and FPAAs (Field Programmable Analog Array), which means it is a mixed-signal diverse redundancy [47], scan-chain-based multiple error recovery technique [48]. The main objective of TMR implementation is the need to introduce fault mitigation in critical circuits. Unfortunately, this approach is subject to some drawbacks. The main disadvantages of this approach are the significant increase in the logical structure obtained and the increased energy consumption. However, there are methods to reduce the increased area [49; 50]. The results from the paper [51] show that quadded logic, state machine encoding, and temporal redundancy provides greater reliability and often require more resources than TMR. In opposite, the high-level synthesis approach for scheduling and binding to provide attractive tradeoffs between area, performance, and redundancy presented in [52]  
Figure 3: The classic TMR voter structure. Figure 2: Impact of SET on internal FSM state. shows resource savings in relation to TMR. It is important to adopt a strategy for the use of TMR in the design [53]. Approaches to triple modular redundancy, and indeed to the location of the voter, are many [54, 55]. The location of the voter is important for the functionality of the system. In the case of combinatorial or combinatorial systems with register output (no feedback), this is less important, although there are also several possibilities here. Consider the combination of two functional blocks as a fragment of a larger system (Figure 4a, e.g., instruction decoder and arithmetic-logic unit in microprocessor). Let these functional blocks be combinatorial modules. The most obvious solution is to triplicate the modules understood as an overall/single block and locate the voter at the output--Figure 4b. It is easy to imagine a situation in which one of the blocks (or both) is critical to the criticality of the system, or one of the blocks occupies a noticeably larger area of the system and is, therefore, more exposed to radiation effects. In such a situation, redundancy can be applied to either or both modules, as shown in Figure 5.  
The combinatorial circuit in Figure 5a is mitigating for the circuit associated with module A, the Voter in this circuit realizes the majority selection of signals from individual modules A. Module B is not protected by the corresponding redundancy. In Figure 5b, the opposite situation occurs, in which module B is redundant and module A is not protected. In the case of Figure 5c, both modules are redundant. The situation is more complicated for sequential systems (with feedback). The essence and comparison of triple modular redundancy in FSM will be shown in the next section.