Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “triple modular redundancy”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
NASA NTRS2001

Fundamentals of Digital Engineering: Designing for Reliability

The concept of designing for reliability will be introduced along with a brief overview of reliability, redundancy and traditional methods of fault tolerance is presented, as applied to current logic devices. The fundamentals of advanced circuit design and analysis techniques will be the primary focus. The introduction will cover the definitions of key device parameters and how analysis is used to prove circuit correctness. Basic design techniques such as synchronous vs asynchronous design, metastable state resolution time/arbiter design, and finite state machine structure/implementation will be reviewed. Advanced topics will be explored such as skew-tolerant circuit design, the use of triple-modular redundancy and circuit hazards, device transients and preventative circuit design, lock-up states in finite state machines generated by logic synthesizers, device transient characteristics, radiation mitigation techniques. worst-case analysis, the use of timing analyzer and simulators, and others. Case studies and lessons learned from spaceflight designs will be given as examples

Katz, R.↗
NASA NTRS1967

Automatic channel switching device

Automatic channel switching device operates with all three triple modular redundant channels when there are no errors. When a failure occurs, channel and module switching isolate the failure to a specific channel. Since only one must operate correctly, reliability is increased.

Ball, M.↗
NASA NTRS1973

A reliability and comparative analysis of two standby system configurations.

Equations are derived which enable one to calculate the system reliability for parallel or triple modular redundant systems with standby spares. Software error detection is introduced into the TMR/Spares system configuration in order to utilize fully all of the units. An indication of the sensitivity of the system reliability to an increase in the number of spares, partitioning, switching, variations in the powered and unpowered failures rates, and time is presented. A comparison of the parallel and the TMR/Spares system configurations, under similar conditions, is given.

Taylor, D. S.↗
NASA NTRS1974

Unpowered to powered failure rate ratio - A key reliability parameter

It is shown that the initial assumption of the ratio of unpowered to powered failure rates can have a strong influence on the design of a modular system intended for space missions. The analysis is performed for parallel systems and for triple modular redundant systems. Parallel systems are shown to be much more sensitive to the unpowered to powered failure rate ratio than the TMR/Spares systems, however, regardless of which standby redundancy technique is considered, the dependence of the system reliability on this ratio increases as the number of standby spares increases.

Taylor, D. S.↗
NASA NTRS1974

A multiprocessor computer simulation model employing a feedback scheduler/allocator for memory space and bandwidth matching and TMR processing

A computer simulation model for a multiprocessor computer is developed that is useful for studying the problem of matching multiprocessor's memory space, memory bandwidth and numbers and speeds of processors with aggregate job set characteristics. The model assumes an input work load of a set of recurrent jobs. The model includes a feedback scheduler/allocator which attempts to improve system performance through higher memory bandwidth utilization by matching individual job requirements for space and bandwidth with space availability and estimates of bandwidth availability at the times of memory allocation. The simulation model includes provisions for specifying precedence relations among the jobs in a job set, and provisions for specifying precedence execution of TMR (Triple Modular Redundant and SIMPLEX (non redundant) jobs.

Bradley, D. B.↗
NASA NTRS1975

HOME - An application of fault-tolerant techniques and system self-testing

Hard Over Monitoring Equipment (HOME) has been designed to complement and enhance the flight safety of a flight research helicopter. HOME is an independent, highly reliable, and fail-safe special purpose computer that monitors the flight control commands issued by the flight control computer of the helicopter. In particular, HOME detects the issuance of a hazardous hard-over command for any of the four flight control axes and transfers the control of the helicopter to the flight safety pilot. The design of HOME incorporates certain reliability and fail-safe enhancement design features, such as triple modular redundancy, majority logic voting, fail-safe dual circuits, independent status monitors, in-flight self-test, and a built-in preflight exerciser. The HOME design and operation is described with special emphasis on the reliability and fail-safe aspects of the design.

Holden, D. G.↗
NASA NTRS1981

Development of a fault-tolerant microprocessor based computer system for space flight

A methodology for the design of a tightly coupled, highly reliable microprocessor based computer system is described. The concept of triple modular redundancy with sparing is used. The notion of synchronizing by using a single crystal oscillator is examined. The use of decoders to replace voters is also used. The decoders not only isolate the failed module but also allow error identification to be accomplished. Each module is to have its own RAM memory. The necessary circuitry to select a correct memory and the corresponding DMA controller was designed.

Montgomery, V. T.↗
NASA NTRS1992

Derivation and application of hard deadlines for real-time control systems

The computation-time delay in the feedback controller of a real-time control system may cause failure to update the control input during one or more sampling periods. If this delay exceeds a certain limit called a hard deadline, either the necessary conditions for system stability are violated or the system leaves the allowed state-space. In such a case a dynamic failure is said to occur to the system. A method for calculating the hard deadlines in linear time-invariant control systems by considering system stability and the allowed state-space is presented. To derive necessary conditions for (asymptotic) system stability, the state difference equation is modified based on an assumed maximum delay and the probability distribution of delays whose magnitudes are less than, or equal to, the assumed maximum delay. Moreover, the allowed state-space - which is derived from given input and state constraints - is used to calculate the hard deadline as a function of time and the system state. A one-shot delay model in which a single event causes a dynamic failure is also considered. The knowledge of hard deadline is then applied to the design of error recovery in a triple modular redundant (TMR) controller computer.

Shin, Kang G.↗
NASA NTRS2006

Evolutionary Based Techniques for Fault Tolerant Field Programmable Gate Arrays

The use of SRAM-based Field Programmable Gate Arrays (FPGAs) is becoming more and more prevalent in space applications. Commercial-grade FPGAs are potentially susceptible to permanently debilitating Single-Event Latchups (SELs). Repair methods based on Evolutionary Algorithms may be applied to FPGA circuits to enable successful fault recovery. This paper presents the experimental results of applying such methods to repair four commonly used circuits (quadrature decoder, 3-by-3-bit multiplier, 3-by-3-bit adder, 440-7 decoder) into which a number of simulated faults have been introduced. The results suggest that evolutionary repair techniques can improve the process of fault recovery when used instead of or as a supplement to Triple Modular Redundancy (TMR), which is currently the predominant method for mitigating FPGA faults.

Larchev, Gregory V.↗
NASA NTRS2006

Single Event Effects Test Results for Advanced Field Programmable Gate Arrays

Reconfigurable Field Programmable Gate Arrays (FPGAs) from Altera and Actel and an FPGA-based quick-turnApplication Specific Integrated Circuit (ASIC) from Altera were subjected to single-event testing using heavy ions. Both Altera devices (Stratix II and HardCopy II) exhibited a low latchup threshold (below an LET of 3 MeV-cm2/mg) and thus are not recommended for applications in the space radiation environment. The flash-based Actel ProASIC Plus device did not exhibit latchup to an effective LET of 75 MeV-cm2/mg at room temperature. In addition, these tests did not show flash cell charge loss (upset) or retention damage. Upset characterization of the design-level flip-flops yielded an LET threshold below 10 MeV-cm2/mg and a high LET cross section of about lxlO-6 cm2/bit for storing ones and about lxl0-7 cm2/bit for storing zeros . Thus, the ProASIC device may be suitable for critical flight applications with appropriate triple modular redundancy mitigation techniques.

Field Programmable Gate Arrays↗
NASA NTRS2010

SEU/SET Tolerant Phase-Locked Loops

The phase-locked loop (PLL) is an old and widely used circuit for frequency and phase demodulation, carrier and clock recovery, and frequency synthesis [1]. Its implementations range from discrete components to fully integrated circuits and even to firmware or software. Often the PLL is a highly critical component of a system, as for example when it is used to derive the on-chip clock, but as of this writing no definitive single-event upset (SET)/single-event transient (SET) tolerant PLL circuit has been described. This chapter hopes to rectify that situation, at least in regard to PLLs that are used to generate clocks. Older literature on fault-tolerant PLLs deals with detection of a hard failure, which is recovered by replacement, repair, or manual restart of discrete component systems. Several patents exist along these lines (6349391, 6272647, and 7089442). A newer approach is to harden the parts of a PLL system, to one degree or another, such as by using a voltage-based charge pump or a triple modular redundant (TMR) voted voltage-controlled oscillator (VCO). A more comprehensive approach is to harden by triplication and voting (TMR) all the digital pieces (primarily the divider) of a frequency synthesis PLL, but this still leaves room for errors in the VCO and the loop filter. Instead of hardening or voting pieces of a system, such as a frequency synthesis system (i.e., clock multiplier), we will show how the entire system can be voted. There are two main ways of doing this, each with advantages and drawbacks. We will show how each has advantages in certain areas, depending on the lock acquisition and tracking characteristics of the PLL. Because of this dependency on PLL characteristics, we will briefly revisit the theory of PLLs. But first we will describe the characteristics of voters and their correct application, as some literature does not follow the voting procedure that guarantees elimination of errors. Additionally, we will find that voting clocks is a bit trickier than voting data where an infallible clock is assumed. It is our job here to produce (or recover) that assumed infallible clock!

Shuler, Robert L., Jr.↗
NASA NTRS2004

FPGA-Based, Self-Checking, Fault-Tolerant Computers

A proposed computer architecture would exploit the capabilities of commercially available field-programmable gate arrays (FPGAs) to enable computers to detect and recover from bit errors. The main purpose of the proposed architecture is to enable fault-tolerant computing in the presence of single-event upsets (SEUs). [An SEU is a spurious bit flip (also called a soft error) caused by a single impact of ionizing radiation.] The architecture would also enable recovery from some soft errors caused by electrical transients and, to some extent, from intermittent and permanent (hard) errors caused by aging of electronic components. A typical FPGA of the current generation contains one or more complete processor cores, memories, and highspeed serial input/output (I/O) channels, making it possible to shrink a board-level processor node to a single integrated-circuit chip. Custom, highly efficient microcontrollers, general-purpose computers, custom I/O processors, and signal processors can be rapidly and efficiently implemented by use of FPGAs. Unfortunately, FPGAs are susceptible to SEUs. Prior efforts to mitigate the effects of SEUs have yielded solutions that degrade performance of the system and require support from external hardware and software. In comparison with other fault-tolerant- computing architectures (e.g., triple modular redundancy), the proposed architecture could be implemented with less circuitry and lower power demand. Moreover, the fault-tolerant computing functions would require only minimal support from circuitry outside the central processing units (CPUs) of computers, would not require any software support, and would be largely transparent to software and to other computer hardware. There would be two types of modules: a self-checking processor module and a memory system (see figure). The self-checking processor module would be implemented on a single FPGA and would be capable of detecting its own internal errors. It would contain two CPUs executing identical programs in lock step, with comparison of their outputs to detect errors. It would also contain various cache local memory circuits, communication circuits, and configurable special-purpose processors that would use self-checking checkers. (The basic principle of the self-checking checker method is to utilize logic circuitry that generates error signals whenever there is an error in either the checker or the circuit being checked.) The memory system would comprise a main memory and a hardware-controlled check-pointing system (CPS) based on a buffer memory denoted the recovery cache. The main memory would contain random-access memory (RAM) chips and FPGAs that would, in addition to everything else, implement double-error-detecting and single-error-correcting memory functions to enable recovery from single-bit errors.

Some, Raphael↗
NASA NTRS2011

CoNNeCT Baseband Processor Module

A document describes the CoNNeCT Baseband Processor Module (BPM) based on an updated processor, memory technology, and field-programmable gate arrays (FPGAs). The BPM was developed from a requirement to provide sufficient computing power and memory storage to conduct experiments for a Software Defined Radio (SDR) to be implemented. The flight SDR uses the AT697 SPARC processor with on-chip data and instruction cache. The non-volatile memory has been increased from a 20-Mbit EEPROM (electrically erasable programmable read only memory) to a 4-Gbit Flash, managed by the RTAX2000 Housekeeper, allowing more programs and FPGA bit-files to be stored. The volatile memory has been increased from a 20-Mbit SRAM (static random access memory) to a 1.25-Gbit SDRAM (synchronous dynamic random access memory), providing additional memory space for more complex operating systems and programs to be executed on the SPARC. All memory is EDAC (error detection and correction) protected, while the SPARC processor implements fault protection via TMR (triple modular redundancy) architecture. Further capability over prior BPM designs includes the addition of a second FPGA to implement features beyond the resources of a single FPGA. Both FPGAs are implemented with Xilinx Virtex-II and are interconnected by a 96-bit bus to facilitate data exchange. Dedicated 1.25- Gbit SDRAMs are wired to each Xilinx FPGA to accommodate high rate data buffering for SDR applications as well as independent SpaceWire interfaces. The RTAX2000 manages scrub and configuration of each Xilinx.

Yamamoto, Clifford K↗
NASA NTRS2012

Fault Tolerance Middleware for a Multi-Core System

Fault Tolerance Middleware (FTM) provides a framework to run on a dedicated core of a multi-core system and handles detection of single-event upsets (SEUs), and the responses to those SEUs, occurring in an application running on multiple cores of the processor. This software was written expressly for a multi-core system and can support different kinds of fault strategies, such as introspection, algorithm-based fault tolerance (ABFT), and triple modular redundancy (TMR). It focuses on providing fault tolerance for the application code, and represents the first step in a plan to eventually include fault tolerance in message passing and the FTM itself. In the multi-core system, the FTM resides on a single, dedicated core, separate from the cores used by the application. This is done in order to isolate the FTM from application faults and to allow it to swap out any application core for a substitute. The structure of the FTM consists of an interface to a fault tolerant strategy module, a responder module, a fault manager module, an error factory, and an error mapper that determines the severity of the error. In the present reference implementation, the only fault tolerant strategy implemented is introspection. The introspection code waits for an application node to send an error notification to it. It then uses the error factory to create an error object, and at this time, a severity level is assigned to the error. The introspection code uses its built-in knowledge base to generate a recommended response to the error. Responses might include ignoring the error, logging it, rolling back the application to a previously saved checkpoint, swapping in a new node to replace a bad one, or restarting the application. The original error and recommended response are passed to the top-level fault manager module, which invokes the response. The responder module also notifies the introspection module of the generated response. This provides additional information to the introspection module that it can use in generating its next response. For example, if the responder triggers an application rollback and errors are still occurring, the introspection module may decide to recommend an application restart.

Some, Raphael R.↗
NASA NTRS2012

Fault Mitigation Schemes for Future Spaceflight Multicore Processors

Future planetary exploration missions demand significant advances in on-board computing capabilities over current avionics architectures based on a single-core processing element. The state-of-the-art multi-core processor provides much promise in meeting such challenges while introducing new fault tolerance problems when applied to space missions. Software-based schemes are being presented in this paper that can achieve system-level fault mitigation beyond that provided by radiation-hard-by-design (RHBD). For mission and time critical applications such as the Terrain Relative Navigation (TRN) for planetary or small body navigation, and landing, a range of fault tolerance methods can be adapted by the application. The software methods being investigated include Error Correction Code (ECC) for data packet routing between cores, virtual network routing, Triple Modular Redundancy (TMR), and Algorithm-Based Fault Tolerance (ABFT). A robust fault tolerance framework that provides fail-operational behavior under hard real-time constraints and graceful degradation will be demonstrated using TRN executing on a commercial Tilera(R) processor with simulated fault injections.

software based↗
NASA NTRS2015

Single Event Effects in FPGA Devices 2014-2015

This presentation provides an overview of single event effects in FPGA devices 2014-2015 including commercial Xilinx V5 heavy ion accelerated testing, Xilinx Kintex-7 heavy ion accelerated testing. Mitigation study, and investigation of various types of triple modular redundancy (TMR) for commercial SRAM based FPGAs.

Single event upset (SEU)↗
NASA NTRS2016

Single Event Effects in FPGA Devices 2015-2016

This presentation provides an overview of single event effects in FPGA devices 2015-2016 including commercial Xilinx V5 heavy ion accelerated testing, Xilinx Kintex-7 heavy ion accelerated testing, mitigation study, and investigation of various types of triple modular redundancy (TMR) for commercial SRAM based FPGAs.

Xilinx V5↗
NASA NTRS2016

Single Event Effects in FPGA Devices 2015-2016

This presentation provides an overview of single event effects in FPGA devices 2015-2016 including commercial Xilinx V5 heavy ion accelerated testing, Xilinx Kintex-7 heavy ion accelerated testing. Mitigation study, and investigation of various types of triple modular redundancy (TMR) for commercial SRAM based FPGAs.

Single Event Upset (SEU) Testing↗