# Error Mitigation Methods for FSM Using Triple Modular Redundancy
## 4 FSM Mitigation Architectures Summary  
An analysis of the functionality of the presented models is summarized in Table 2.  
In Model 1, a significant drawback was the inability to correct an error injected into the transition block \(\delta\). It is essential to detect errors and correct the individual FSM or the entire system. Models 1 and 2 have very similar properties. In both cases, they have the ability to correct errors (2) and (3), and are self-correcting. Due to the architecture, the TMR is also performed on output block \(\lambda\) in Model 3, so injecting an error into the output block \(\lambda\) will not affect the output of the whole system. The design shown in Model 4 is dangerous, because the system has no self-correcting capacity. After an error, the FSM starts to work on a different cycle. In such a situation, in addition to the classic voter, the circuit should be equipped with error detection, which should result in resetting of each FSM (if such a possibility exists) or a more complex system for setting the internal state of a malfunctioning FSM during operation. The FSM outputs are realized by a combinatorial circuit, so the TMR application rules are not critical. Even if the block of outputs is synchronized, the output essentially depends on the state of the FSM and the correcting state is crucial for the whole system. The use of the method of encoding the internal states of an FSM requires a separate discussion. The way the internal states are encoded has a strong influence on the number of FFs and the number of LUTs (Look-up Tables; most modern FPGAs). Natural binary code or Gray code are characterized by their high compactness in terms of codeword. This leads to a small number of FFs but is paid for by a rather complex transition function, which increases the number of LUTs. A characteristic of Gray code is that the code distance is always equal to 1, which makes it easier to search for potential errors. However, this is only true in cyclic graphs, which are not typical in FSMs. More advanced solutions in terms of reliability would, however, require the introduction of redundant bits (error detection and correction), which would, in turn, lead to an increase in the number of FFs and LUTs. For LUT-type circuits, the most commonly used method of encoding states is one-hot because of the simple decoding and efficient functional decomposition methods. If any bit of the state is changed, the FSM immediately has an invalid internal state (unlike \begin{table}
\begin{tabular}{c c c c c} \hline  & **Model 1** & **Model 2** & **Model 3** & **Model 4** \\ \hline Correction capacity (1) & \(-\) & \(-\) & \(+\) & \(+\) \\ Correction capacity (2) & \(-\) & \(+\) & \(+\) & \(+\) \\ Correction capacity (3) & \(+\) & \(+\) & \(+\) & \(+\) \\ Whole-system & \(+\) & \(+\) & \(+\) & \(-\) \\ self-correction & \(+\) & \(+\) & \(-\) & \(-\) & \(+\)** \\ Necessary to force a reset * & \(+\) ** & \(-\) & \(-\) & \(+\) *** \\ Necessary to enforce the & \(+\) ** & \(-\) & \(-\) & \(+\) *** \\ correct state by FF SET * & & & & \\ Correct output in each & \(-\) & \(+\) & \(+\) & \(+\) \\ internal state & & & & \\ \hline \end{tabular}  
*—one of the two methods, **—for all FSMs, ***—for a malfunctioning FSM only.  
\end{table} 
Table 2: Functionality analysis of each model. other coding methods, where the state may have the correct bit pattern). On the other hand, a higher number of FFs is required compared to compact coding. It is, therefore, difficult to identify the optimum coding here. Moreover, in this situation, depending on the method of describing the FSM in HDL and the synthesis algorithm used, the FSM will move to the wrong state or correct itself to the initial state. Either way, it will not remain in the correct cycle. One-hot encoding is used for SEU reliability [56]. A way of automatically embedding TMR into a design is to use tools for automated high-reliability synthesis. Some commercially available tools for FPGAs are AMD/Xilinx XTMR, Synopsys Synplify Premier, and Siemens Precision Hi-Rel.