# A Survey on Dynamic Corrective Control of Asynchronous Sequential Machines
## 5 Fault-Tolerant Control
### Applications to Space-Borne Digital Systems  
Among various engineering systems, it turns out that space-borne digital systems [84] are the most suitable for corrective control theory to be applied to, mainly because of the feature that they can be modeled by ASMs and the adverse effects of the faults frequently  
Figure 6: (**a**) Permanent state faults and (**b**) corrective control system with permanent state transition faults.  
occurring to them can be formulated in the schema of corrective control. Transient faults in space-borne digital systems mostly occur as the result of single event upsets (SEUs) wherein the logic value of a memory cell is upset from 0 to 1 or vice versa caused by radiation or ionized particles abundant in space [85; 86; 87; 88; 89]. Permanent faults in space-borne digital systems manifest themselves if a memory bit comprising the state or input signal is stuck at a certain value owing to internal failures or external disturbances including SEUs [90; 91]. Finally, intermittent faults happen for various reasons including temporary loss of actuator outputs (or buffers), temporary disconnections of wires in the input channel, abrupt change of voltage, etc. [92].  
Motivated by the aforementioned features of space-borne digital systems, researchers have successfully applied various existent corrective control schemes to building robust space-borne digital systems subject to faults. In broad terms, the case study systems with which fault-tolerant corrective controllers yield convincing experimental results are classified into six types: asynchronous error counters including error detection and correction (EDAC) counters for on-board computers (OBCs) of satellite systems and asynchronous clock dividers [93; 94; 95; 96]; scrubbing schedulers for memory including Johnson counters in satellite SSDR systems [97; 98; 99]; payload data and operation managers [100; 101]; ROM controllers for OBC [102]; configuration controllers for FPGA [103; 104; 105]; and asynchronous TMR memory [90; 106]. The utilized modeling formalisms of ASMs, considered fault types, and relevant publications regarding these case study systems are summarized in Table 1.  
To sketch the experimental environments in the above results, let us review, in particular, the implementation setting of [71] as illustrated in Figure 7. The closed-loop system of the controlled ASM (asynchronous 5-clock divider) is coded in VHSIC Hardware Description Language (VHDL), a common design-entry language for FPGA. QUARTUS\({}^{\text{\textregistered}}\) II (ver. 9.1) is employed for the compilation and synthesis of the VHDL code to the target EP1C6Q240C8 FPGA. The hardware net-list is relayed from the experimental PC into the target FPGA board via a byte blaster cable. Further, a synthetic fault injector is inserted to produce adversarial inputs into the controlled ASM. The major signals of the control system and the fault injector, e.g., the control input, adversarial input, and output, are extracted from the FPGA board and are displayed on a digital oscilloscope.  
\begin{table}
\begin{tabular}{c c c c} \hline
**System** & **ASM Type** & **Fault Type** & **Result** \\ \hline Error counter [93; 94; 95; 96] & Input/output & Transient fault & \\  & Input/state & Input constraint & \\ \hline Scrubbing scheduler & Input/output & Permanent fault & \\ for memory [97; 98; 99] & Input/state & Attack to controller & \\ \hline ROM controller [102] & Switched & Intermittent fault & \\  & & Transient fault & \\ \hline TMR memory [90; 106] & Input/state & Transient fault & [107] \\ \hline \end{tabular}
\end{table}
Table 1: Application study of fault-tolerant corrective control on space-borne digital systems.