Design of Robust Fault-Tolerant Finite-State Machines for Unmanned Aerial Vehicles

Abstract

Enhancing the robustness and fault tolerance of finite-state machines (FSMs) is crucial for safety-critical systems, such as transportation control systems and medical equipment. This issue becomes particularly important when developing control units for unmanned aerial vehicles (UAVs), which are exposed to external disturbances from electronic warfare (EW) systems. Under such conditions, traditional methods for creating fault-tolerant finite-state machines (FTFSMs), initially designed to address the effects of ionizing radiation that cause rare single-event upsets (SEUs), are often ineffective. This paper proposes a novel method for developing FTFSMs that can withstand multi-bit upsets (MBUs) affecting the FSM’s wires and memory cells due to external disturbances. The FTFSM architecture additionally includes an output register and a concurrent error detection (CED) circuit. When a fault is detected, the FTFSM switches to standby mode. Once the external disturbance ceases, the FTFSM resumes normal operation from the point of interruption without altering the control algorithm. In cases of critical errors, the FSM circuit can be reconfigured via the system processor. Experimental studies have shown that the proposed approach incurs exceptionally low overhead costs. Additionally, the paper presents a technique for calculating the probability of fault detection for FTFSMs implemented in field-programmable gate arrays (FPGAs).

1. Introduction

In digital systems, from computers and home appliances to transportation and aerospace systems, reliable fault-tolerant control units play an important role [1]. These control units are often implemented as finite-state machines (FSMs) to control the operation of system components, clearly defining transitions between states. Increasing the robustness and fault tolerance of control units is crucial, especially for safety-critical systems such as transportation management systems and medical equipment. This issue is particularly relevant when developing control units for unmanned aerial vehicles (UAVs), especially when exposed to external disturbances generated by electronic warfare (EW) systems [2].

External disturbances, such as powerful electromagnetic pulses or laser beams, can cause faults in the FSM circuit by affecting its input and output vectors, feedback loop, and combinational circuits. If the FSM is implemented in field-programmable gate arrays (FPGAs), external disturbances can also change the contents of the configuration memory. Note that FSMs implemented in application-specific integrated circuits (ASICs) are generally less susceptible to external disturbances than in configurable devices, such as FPGAs and system-on-chip (SoC) solutions.

Figure 1 shows the traditional structure of an FSM, where X represents the input signals (input vector); Y represents the output signals (output vector); Rs is the state register storing the present-state code; λ is the combinational circuit (logic) determining the code of the next state (λ: X × S → S); δ is the combinational circuit generating the values of the output signal; and S is the set of states of the FSM. The feedback loop connects the register Rs output to the input of the combinational circuit λ. For a Moore FSM, the output signal values are generated based on the present-state code (δ: S → Y), and for a Mealy FSM, based on the present-state code and the input signal values (δ: X × S → Y). Therefore, for a Mealy FSM, the X inputs are connected to the inputs of the combinational circuit λ (marked with a dotted line in Figure 1).

External disturbances can cause the following faults in the structure of an FSM:

• At the inputs: an invalid input vector X;
• In the state register Rs or in the feedback loop: an invalid code state of the present state;
• In the logic λ: generation of an invalid code next for the next state;
• In the logic δ or at the FSM outputs: generation of an invalid output vector Y.

Moreover, external disturbances can cause behavioral-level faults in the FSM, such as invalid transitions between legal states.

Designing fault-tolerant FSMs (FTFSMs) to eliminate external disturbances involves addressing the following tasks: fault detection (1), fault location (2), fault containment (3), and fault recovery (4). The robustness of an FSM can also be improved by using a special style of describing the FSM in hardware description language (HDL).

This paper presents a new method for designing FTFSMs that detects and eliminates multi-bit errors (MBUs) caused by external disturbances in the input and output vectors, in the present- and next-state codes, and neutralizes errors in the FSM behavior.

In the proposed approach, (1) fault detection is achieved by incorporating a concurrent error detection (CED) circuit into the FSM structure; fault location (2) is identified using specialized combinational circuits (logic) included within the CED circuit; (3) fault containment is accomplished using the output register Ro; and lastly, (4) fault recovery is implemented by controlling the clock enable (CE) input of the registers Rs and Ro, as well as by using the system processor.

This paper aims to develop robust FTFSMs for operation under MBUs caused by external disturbances, such as electromagnetic pulses and laser beams, resulting from EW.

The main contributions of this work are as follows:

• Structural models of FTFSMs for detecting specific faults, a generalized FTFSM structure, and a CED circuit structure;
• A method for synthesizing FTFSMs, which includes an algorithm for operating a CED circuit and an algorithm for synthesizing a generalized FTFSM structure;
• Experimental studies demonstrating the effectiveness of the proposed approach when FTFSM states are encoded using one-hot and binary codes;
• A technique for calculating the probability of fault detection when implementing an FTFSM in an FPGA using one-hot and binary state encoding;
• Recommendations for the practical application of the proposed approach to designing robust FTFSMs.

The paper is organized as follows. Section 2 provides an overview of relevant work in this area. Section 3 outlines the key concepts and the method for designing FTFSMs. Section 4 presents the experimental results and their analysis, along with recommendations for the practical application of the discussed approach. A technique for calculating the fault detection probability in FTFSMs implemented in FPGAs is described in Section 5. Finally, Section 6 presents a summary of the paper.

2. Related Works

Digital devices such as FPGAs, SoCs, and ASICs are often subject to short- or long-term faults caused by external disturbances. These faults can affect both combinational and sequential logic: in the first case, the fault effect, called a single-event transient (SET), is a pulse on a signal that, if latched in a register, results in an erroneous value; in the second case, the fault, called a single-event upset (SEU), causes a state change in a memory cell. These types of faults are commonly referred to as soft errors, which can be recovered by overwriting the correct value. This paper discusses multi-bit soft errors.

First and foremost, it is crucial to detect any faults in the FSM. There are various approaches to fault detection in FSMs, including Hamming codes [3], immunological principles [4], a probabilistic detector [5] that analyzes discrepancies between observed and expected state-occupancy frequencies, convolutional codes [6], and selective partial replication [7].

Among fault-detection methods, CED techniques hold particular significance. CED circuits operate in parallel with the digital system, allowing for early fault detection. These circuits detect errors in FSMs by comparing the monitor outputs with the sequencer outputs [8], analyzing signatures [9], performing parity checks [10], and using Bose-Lynn codes [11]. In [12,13] for Moore FSMs and [14] for Mealy FSMs, the CED circuit for detecting MBUs is proposed. This circuit is designed to detect errors in both the input and output vectors, as well as in the present- and next-state codes. Additionally, it can detect invalid state transitions.

A common method for implementing fault-tolerant systems in very large-scale integration (VLSI) devices is known as triple modular redundancy (TMR) [15]. In TMR, the outputs from three identical replicas of logic units or registers are combined using a majority voting mechanism to generate a single output signal. If one of the three replicas fails, the other two can detect and correct the error, effectively masking the fault.

There are various methods for enhancing TMR in FSM designs. One approach, presented in [16], focuses on improving circuit resilience against SEUs by selectively applying TMR to sensitive subcircuits. Another method discussed in [17] suggests optimizing TMR logic by strategically placing voters. In [18], a place-and-route algorithm is considered that, in combination with TMR, mitigates the effects of SEU in FPGA configuration memory.

The double modular redundancy (DMR) method is an alternative to TMR and is commonly used in the design of FTFSMs. In [19], the DMR method is utilized to create FTFSMs within FPGA memory blocks. Reference [20] examines the reliability of FTFSMs that employ both DMR with self-checking and TMR methods. In [21], when implementing sequential circuits in ASICs, DMR architectures use self-checking asynchronous circuits to mitigate the effects of single-event transients (SETs).

Fault tolerance in FSMs can be achieved through various FSM state-encoding methods. Reference [22] discusses constant errors in the state register of an FSM and proposes a state-encoding algorithm designed for a specific number of errors. In [23], the states of an FTFSM are encoded using a k-of-n code, where each code word of length n contains exactly k ones. Reference [24] introduces separable codes, specifically Berger codes, which assign a vector of length k (where k = log₂n) to an information vector of length n. This vector represents a binary number indicating the count of ones (or zeros) in the information vector. In [25], four methods for encoding the states of FTFSMs are compared: one-hot, binary, Hamming-2, and Hamming-3. The comparison reveals that while the Hamming-3 code offers the best fault tolerance, it requires the most resources and operates the slowest. On the other hand, the Hamming-2 code strikes an optimal balance between size, speed, and fault tolerance.

Some studies use HDLs, such as VHDL and Verilog, to design FTFSMs. In [26], a tool is introduced that synthesizes FTFSMs capable of handling SEUs in the state register. This tool automates the implementation of two FTFSM architectures, which can be specified in either KIS format [27] or VHDL. Fault tolerance is achieved through the use of single-error-correcting (SEC) codes. In [28], two styles for describing FTFSMs in Verilog, named safe0 and safe1, are presented. These styles are designed to prevent MBUs in both the input vector and the state register.

A significant number of studies have focused on the design of FTFSMs, characterized by a wide variety of approaches. In [29], a method for designing self-checking FSMs using Berger codes is explored. Reference [30] compares FTFSM architectures in terms of area and performance under SEUs. In [31], an approach to hardware fault tolerance is demonstrated using a fault-detection method inspired by the human immune system. In [32], redundant equivalent states are proposed for the design of FTFSMs to protect a small number of states with a high probability of SEU occurrence.

In [12], structural models of Moore FSMs are explored, focusing on fault detection and the mitigation of their effects on controlled objects. The structural models enable the identification of invalid transitions between FSM states, as well as invalid input and output vectors for each state and for the FSM as a whole. Furthermore, they can detect invalid codes for both the present and next states. Additionally, reference [12] provides area and performance estimates for these structural models. In [13], it is demonstrated that selecting an appropriate structure can prevent an increase in area and, in certain cases, even enhance the performance of FTFSMs. Reference [14] discusses structural models of Mealy FTFSMs aimed at fault detection. It presents combined structural models and identifies potential causes of faults that each FSM structural model can detect. Various styles for describing structural models of FTFSMs in Verilog HDL, including combined structural models, are presented in [33]. A methodology for constructing structural models of fault-tolerant Moore FSMs implemented on an FPGA is given in [34].

The main difference between the proposed approach to designing FTFSMs and existing methods is as follows. Most methods for designing FTFSMs (with the exceptions of [12,13,14,33,34]) consider single-event faults (SEUs), i.e., a single-bit change in the FSM state register. However, single-event faults (SETs), i.e., faults in the combinational circuits λ and δ, are rarely considered. Furthermore, faults in the input vector X are not considered, nor are behavioral-level faults that lead to invalid transitions between legal states. The proposed approach is free from these shortcomings. It involves the detection of multi-bit upsets (MBUs) of the SEU and SET types:

• In the input vector X;
• In the output vector Y;
• In the state register Rs;
• In the present- and next-state codes state and next.

Furthermore, the proposed approach enables the detection of FSM faults when an invalid transition occurs between legal states.

In the proposed approach, the synthesis of FTFSMs is performed at the structural level and at the level of the FSM description in a hardware description language (HDL). This paper uses Verilog as the HDL, but the proposed approach can easily be applied to VHDL and SystemVerilog.

Unlike the works in [12,13,14,33,34], this paper presents modified structural models of FTFSMs for specific fault detection, which enable the detection of faults in both Mealy FSMs and Moore FSMs; a new generalized structure for FTFSMs and CED circuits; new algorithms for synthesizing CED circuits and FTFSMs; and, for the first time, a technique for calculating the probability of fault detection when implementing FTFSMs in FPGAs.

3. Designing FTFSMs

3.1. Structural Models of FTFSMs

Structural models of FTFSMs that can detect faults caused by external disturbances are shown in Figure 2, where the VI structure defines a valid input vector, the VO structure defines a valid output vector, the VS structure defines a valid present-state code, the VN structure defines a valid next-state code, and the VT structure defines a valid transition between states.

The structures in Figure 2 include the additional output register Ro, which prevents faults from affecting the controlled object. Registers Rs and Ro have an extra input CE, to control register triggering. Each structure in Figure 2 includes a combinational circuit of the same name for fault detection. Combinational circuits VI, VO, VS, VN, and VT operate using inverse logic: the output signals vi, vo, vs, vn, and vt are set to 1 in the absence of a fault and to 0 in its presence.

The vi, vo, vs, vn, and vt signals control the CE input of the Rs and Ro registers. If a fault is detected, the CE inputs will be set to 0, preventing the registers from responding to the clock signal and causing the FSM to enter standby mode. In standby mode, the Rs register stores the code of the last present state, and the Ro register stores the value of the last output vector. Thus, in the event of a fault, the FSM remains in its last valid state, and the last valid output vector is stored at the FSM output. When the external disturbance ceases, and the CE inputs are set to 1, the FSM continues to operate in normal mode from the last valid state, i.e., without changing the control algorithm.

A generalized structure of the FTFSM is shown in Figure 3. To simultaneously detect multiple faults, the combinational circuits VI, VO, VS, VN, and VT can be combined into a single CED circuit. Depending on the types of faults to be detected, the CED circuit can include any subset of combinational circuits from the set {VI, VO, VS, VN, VT}. To detect all possible faults, the structure of the CED circuit is illustrated in Figure 4.

The output of the CED circuit is the signal enable, which controls the CE inputs of the registers Rs and Ro. The output signal enable of the CED circuit is determined using a logical “AND” operation that combines the vi, vo, vs, vn, and vt signals. Consequently, the enable signal will be a logical ‘0’ if a fault is detected, and a logical ‘1’ otherwise.

The FTFSM shown in Figure 3 also includes an additional output error for error reporting, which is the inverse of the signal enable. The signal error informs the external environment about a problem, prompting further action to correct the fault. For example, if an FTFSM implemented in an FPGA does not return to normal operation for a long time, a decision may be made to reconfigure the FPGA or the part of the FPGA that contains the FTFSM.

Note that the output register Ro in the structure of an FTFSM eliminates short-term pulses (glitches) at the outputs of Mealy-type FSMs, which arise from their asynchronous nature with respect to the inputs.

3.2. Synthesis of FTFSMs

Let K be the set of state codes of an FSM; X(s_i) be the set of input vectors that initiate transitions from state s_i; Y(s_i) be the set of output vectors that are formed during transitions from state s_i; and S(s_i) be the set of states in which transitions from state s_i end, s_i ∈ S.

Figure 5 shows the transition between two states of an FSM, where s_i is the initial state of the transition, s_i ∈ S; s_j is the final state of the transition, s_j ∈ S(s_i); K(s_i) is the code of the state of s_i; K(s_j) is the code of the state of s_j, K(s_i), K(s_j) ∈ K; x_ij is the input vector initiating the transition between states s_i and s_j, x_ij ∈ X(s_i); and y_ij is the output vector formed by the FSM during the transition between states s_i and s_j, y_ij ∈ Y(s_i). Note that the code K(s_i) corresponds to the variable state, and the code K(s_j) corresponds to the variable next in Figure 2 and Figure 3.

The combinational circuit VI checks the correctness of the input vector at state s_i using expression (1):

$$vi=\left\{\begin{array}{c}1,x_{ij}\in X\left(s_i\right);\\ 0,x_{ij}\notin X\left(s_i\right);\end{array}\right.$$

(1)

where the signal vi = 1 if the input vector x_ij is valid in state s_i, i.e., initiates some transition from state s_i; otherwise, vi = 0.

The combinational circuit VO checks the validity of the output vector in state s_i using expression (2):

$$vo=\left\{\begin{array}{c}1,y_{ij}\in Y\left(s_i\right);\\ 0,y_{ij}\notin Y\left(s_i\right);\end{array}\right.$$

(2)

where the signal vo = 1 if the output vector y_ij is valid in state s_i, i.e., formed during some transition from state s_i; otherwise, vo = 0.

The combinational circuit VS checks the validity of the present-state code K(s_i) using expression (3):

$$vs=\left\{\begin{array}{c}1,K\left(s_i\right)\in K;\\ 0,K\left(s_i\right)\notin K;\end{array}\right.$$

(3)

where the signal vs = 1 if the code K(s_i) is valid, i.e., is one of the state codes of the FSM; otherwise, vs = 0.

Similarly, the combinational circuit VN checks the validity of the code of the next state K(s_j) using expression (4):

$$vn=\left\{\begin{array}{c}1,K\left(s_j\right)\in K;\\ 0,K\left(s_j\right)\notin K;\end{array}\right.$$

(4)

where the signal vn = 1 if the code K(s_j) is valid, i.e., is one of the state codes of the FSM; otherwise, vn = 0.

The set of all transitions of the FSM can be defined as the set T of pairs (s_i, s_j) as follows:

$$T=\left\{\left(s_i,s_j\right)\right|s_i\in S,s_j\in \mathrm{S}\left(s_i\right)\}.$$

(5)

The combinational circuit VT checks the validity of the transition between states s_i and s_j using expression (6):

$$vt=\left\{\begin{array}{c}1,\left(s_i,s_j\right)\in T;\\ 0,\left(s_i,s_j\right)\notin T;\end{array}\right.$$

(6)

where the signal vt = 1 if the transition from state s_i to state s_j is valid; otherwise, vt = 0.

Based on expressions (1)–(6), the functioning of the CED circuit can be described using Algorithm 1.

Algorithm 1: Functioning of the CED circuit

INPUT: xij, yij, K, K(si), K(sj), T. OUTPUT: enable. Definition of sets: X(si), Y(sj), S(si). if xij ∈ X(si)         then vi = 1;                                           else vi = 0; if yij ∈ Y(si)          then vo = 1;                                           else vo = 0; if K(si) ∈ K           then vs = 1;                                           else vs = 0; if K(sj) ∈ K           then vn = 1;                                           else vn = 0; if (si, sj) ∈ T         then vt = 1;                                           else vt = 0; enable = vi & vo & vs & vn & vt; Return enable.

The process of synthesizing FTFSMs is represented in Algorithm 2.

Algorithm 2: Synthesis of FTFSMs

The types of faults to be detected are defined (input vector, output vector, present-state code, next-state code, state transitions). Based on the fault types defined in Step 1, the structure of the CED circuit in Figure 4 is determined (a subset of combinational circuits from the set {VI, VO, VS, VN, VT}). In accordance with Algorithm 1, the CED circuit is synthesized. The description of the FTFSM is generated in one of the HDLs. End.

The robustness of the CED circuit is ensured by its small area relative to the FSM. Therefore, the CED circuit (Step 2 of Algorithm 2) should include only those combinational circuits that detect the most likely faults.

To describe FTFSMs in one of the HDLs, the robust_0 style [33] is used, which improves FSM robustness. In this style, undefined transitions are redefined to transition to the initial state of the transition, i.e., the FSM does not change its state, and the outputs for undefined transitions are redefined as the zero vector.

3.3. Example of Designing the FTFSM

It is necessary to construct an FTFSM described by the state transition graph (STG) shown in Figure 6.

In Figure 6, the STG vertices represent the states of the FSM, and the STG arcs correspond to the transitions between states. Near each arc, the input vector that initiates the transition is indicated, followed by a slash that separates it from the output vector generated by the FSM during this transition. A hyphen in an input or output vector denotes a “don’t care” value. Our FSM has three states, two inputs, and three outputs.

Let it be necessary to construct an FTFSM that detects all the faults under consideration. In this case, the structure of the CED circuit corresponds to the structure shown in Figure 4. The sets X(s_i), Y(s_i), and S(s_i) for our FSM, generated according to Algorithm 1, are presented in

Table 1. Sets X(s_i), Y(s_i), and S(s_i) for the FSM from the example.

si	X(si)	Y(si)	S(si)
s0	{−0, −1}	{000, 001}	{s1}
s1	{01, 10}	{011, 010}	{s0, s2}
s2	{00, 11}	{111, 100}	{s0, s1}

.

After the sets X(s_i), Y(s_j), and S(s_i) are formed in accordance with Step 4 of Algorithm 2, the description for the FTFSM is created using one of the HDLs. An example of an FTFSM description in Verilog HDL is given in Appendix A.

4. Experimental Research

The efficiency of the considered approach for synthesizing FTFSMs was investigated using the FSM benchmarks developed by the MCNC [35]. The FSMs were implemented on Cyclone 10 LP FPGAs using the Altera Quartus Prime version 25.1 design tool. The area of the FSMs was measured by determining the number of look-up tables (LUTs) used, while the performance was defined as the maximum operating frequency of the FSM circuit. The FSM states were encoded using binary and one-hot codes. The FTFSMs were constructed according to the structure shown in Figure 3 and Figure 4, when the CED circuit includes all combinational circuits from the set {VI, VO, VS, VN, VT}.

These experimental studies aim to evaluate the increase in area and decrease in performance of FTFSMs compared to traditional FSM implementations, where the FSM is described in Verilog HDL using a three-process style [36].

4.1. Area of FTFSMs

An increase in the area of FTFSMs is expected compared to traditional FSM implementations for several reasons. The structure of an FTFSM (Figure 3) includes an additional output register Ro, a CED circuit, and an inverter that generates the signal error. In addition, the number of FTFSM outputs has been increased by 1 for the signal error, compared to the traditional FSM structure (Figure 1). Therefore, the following hypothesis can be put forward.

Hypothesis 1.

The average area of FTFSMs is larger than that of traditional FSMs.

Table 2. Area of traditional FSMs and FTFSMs.

FSM	Ltb	Lto	Ltmrb	Lfb	Lfo	Lfb/Ltb	Lfo/Lto	Ltmrb/Lfb
bbara	28	30	66	29	48	1.036	1.600	2.276
bbsse	60	42	127	16	69	0.267	1.643	7.938
bbtas	9	9	38	6	11	0.667	1.222	6.333
beecount	32	42	64	21	40	0.656	0.952	3.048
cse	103	111	146	17	92	0.165	0.829	8.588
dk14	43	44	86	37	41	0.860	0.932	2.324
dk15	16	33	44	16	40	1.000	1.212	2.750
dk16	85	65	122	99	76	1.165	1.169	1.232
dk17	14	25	40	13	24	0.929	0.960	3.077
dk27	7	10	38	5	9	0.714	0.900	7.600
dk512	16	21	60	16	19	1.000	0.905	3.750
ex1	147	135	247	248	189	1.687	1.400	0.996
ex2	92	78	93	34	64	0.370	0.821	2.735
ex3	44	42	58	8	25	0.182	0.595	7.250
ex4	62	57	102	31	38	0.500	0.667	3.290
ex5	34	34	55	21	32	0.618	0.941	2.619
ex6	71	63	119	44	63	0.620	1.000	2.705
ex7	45	41	59	20	39	0.444	0.951	2.950
lion	11	17	21	5	11	0.455	0.647	4.200
lion9	57	57	58	17	44	0.298	0.772	3.412
mc	6	11	32	8	16	1.333	1.455	4.000
planet	224	121	335	249	85	1.112	0.702	1.345
pma	162	147	176	220	146	1.358	0.993	0.800
s1	168	118	199	154	125	0.917	1.059	1.292
s1488	223	157	386	310	235	1.390	1.497	1.245
s1494	231	159	386	305	242	1.320	1.522	1.266
s208	14	49	104	43	74	3.071	1.510	2.419
s27	10	23	36	5	32	0.500	1.391	7.200
s298	795	616	889	1047	933	1.317	1.515	0.849
s386	63	43	129	96	74	1.524	1.721	1.344
s420	14	35	150	29	55	2.071	1.571	5.172
s510	118	70	153	109	69	0.924	0.986	1.404
s820	133	87	269	217	158	1.632	1.816	1.240
s832	132	83	278	223	162	1.689	1.952	1.247
sand	257	238	262	311	237	1.210	0.996	0.842
shiftreg	3	9	16	4	9	1.333	1.000	4.000
sse	77	70	127	16	73	0.208	1.043	7.938
styr	229	212	262	251	185	1.096	0.873	1.044
tav	9	10	32	9	13	1.000	1.300	3.556
tbk	303	295	125	377	350	1.244	1.186	0.332
tma	172	157	146	138	97	0.802	0.618	1.058
train11	52	48	65	36	45	0.692	0.938	1.806
train4	13	19	22	5	11	0.385	0.579	4.400
Av	101.95	86.81	144.698	113.14	102.33	0.971	1.124	3.137
Min	3	9	16	4	9	0.165	0.579	0.332
Max	795	616	889	1047	933	3.071	1.952	8.588

Maximum values are highlighted in bold, and minimum values are highlighted in italics.

presents the results of a study comparing the area of FTFSMs with that of traditional FSM implementations and the TMR method. The variables Ltb, Lto, and Ltmrb represent the areas of traditional FSMs with binary and one-hot state encoding, respectively, as well as the TMR method with binary state encoding. In contrast, Lfb and Lfo indicate the area of FTFSMs with binary and one-hot state encoding, respectively. The ratios Lfb/Ltb, Lfo/Lto, and Ltmrb/Lfb reflect the comparison of the corresponding parameters. Additionally, the variables Av, Min, and Max denote the arithmetic mean, minimum, and maximum values of the analyzed parameters.

When using binary codes to perform FSM state encoding, as shown in Table 2, there is a maximum increase in area by a factor of 3.071 for the example s208 and a maximum decrease in area by a factor of 6.1 (=1/0.165) for the example cse; meanwhile, on average the area does not increase, but rather, decreases by 2.9% (this corresponds to an Lfb/Ltb ratio of 0.971).

The reduction in the area of FTFSMs compared to traditional FSM implementations is explained by the use of the robust_0 style [33] to describe them. In the case of undefined FSM transitions, this style prevents the design tool from automatically installing latches in the FSM circuit to hold the FSM in the initial state of the transition and preserve the FSM output values.

When using one-hot encoding, the maximum area increases by a factor of 1.952 for the s832 example, and the maximum area decreases by a factor of 1.727 (=1/0.579) for the train4 example. On average, the area increases by 12.4%, corresponding to an Lfo/Lto ratio of 1.124.

Compared to the TMR method, the proposed approach reduces the average area of FTFSMs by a factor of 3.137 (and by more than 8 times in the cse example).

The ratios of the average area values for the traditional implementation of FSMs and for the proposed FTFSM synthesis method, when using binary and one-hot state encodings, are shown in Figure 7. However, when comparing the average area values (rather than the ratios) in Figure 8, it can be seen that the proposed method increases the area by approximately 11% for binary encoding and by 18% for one-hot encoding.

4.2. Performance of FTFSMs

A decrease in the average performance of FTFSMs can be expected compared to traditional FSM implementations, since the structure of an FTFSM additionally includes the output register Ro and the CED circuit. Therefore, the following hypothesis can be put forward.

Hypothesis 2.

The average performance of FTFSMs is lower than that of traditional FSMs.

Table 3. Performance of traditional FSMs and FTFSMs.

FSM	Ftb	Fto	Ffb	Ffo	Ftmrb	Ftb/Ffb	Fto/Ffo	Ffb/Ftmrb
bbara	448	510	441	258	288	1.016	1.977	1.531
bbsse	333	471	437	207	151	0.762	2.275	2.894
bbtas	679	835	926	469	236	0.733	1.780	3.924
beecount	658	200	479	289	181	1.374	0.692	2.646
cse	155	144	498	218	189	0.311	0.661	2.635
dk14	480	506	460	448	241	1.043	1.129	1.909
dk15	722	586	694	383	304	1.040	1.530	2.283
dk16	380	522	266	215	238	1.429	2.428	1.118
dk17	649	636	641	449	278	1.012	1.416	2.306
dk27	722	733	927	923	252	0.779	0.794	3.679
dk512	578	724	600	724	215	0.963	1.000	2.791
ex1	240	305	153	157	128	1.569	1.943	1.195
ex2	219	224	371	216	238	0.590	1.037	1.559
ex3	233	240	546	460	229	0.427	0.522	2.384
ex4	213	221	438	269	229	0.486	0.822	1.913
ex5	240	245	499	283	207	0.481	0.866	2.411
ex6	226	218	403	238	175	0.561	0.916	2.303
ex7	221	214	436	252	261	0.507	0.849	1.670
lion	677	489	917	556	705	0.738	0.879	1.301
lion9	209	180	625	281	143	0.334	0.641	4.371
mc	830	905	791	414	327	1.049	2.186	2.419
planet	238	722	128	213	192	1.859	3.390	0.667
pma	111	106	189	192	133	0.587	0.552	1.421
s1	249	423	161	170	191	1.547	2.488	0.843
s1488	221	433	151	145	201	1.464	2.986	0.751
s1494	233	452	156	156	206	1.494	2.897	0.757
s208	716	436	387	206	261	1.850	2.117	1.483
s27	540	551	921	297	332	0.586	1.855	2.774
s298	140	339	122	111	64	1.148	3.054	1.906
s386	354	527	212	221	200	1.670	2.385	1.060
s420	722	501	405	220	90	1.783	2.277	4.500
s510	254	848	293	546	200	0.867	1.553	1.465
s820	260	456	136	171	202	1.912	2.667	0.673
s832	247	410	139	137	199	1.777	2.993	0.698
sand	211	154	113	132	128	1.867	1.167	0.883
shiftreg	1319	1103	1319	964	466	1.000	1.144	2.830
sse	238	488	437	207	261	0.545	2.357	1.674
styr	203	168	128	134	158	1.586	1.254	0.810
tav	1279	1261	840	657	403	1.523	1.919	2.084
tbk	210	208	126	141	204	1.667	1.475	0.618
tma	119	142	225	263	229	0.529	0.540	0.983
train11	230	363	429	294	208	0.536	1.235	2.063
train4	262	207	923	400	290	0.284	0.518	3.183
Av	406.23	451.30	453.21	318.28	233.326	1.053	1.609	1.939
Min	111	106	113	111	64	0.284	0.518	0.618
Max	1319	1261	1319	964	705	1.912	3.390	4.500

Maximum values are highlighted in bold, and minimum values are highlighted in italics.

presents the results of a study of the performance of FTFSMs in comparison with traditional FSM implementations, where Ftb, Fto and Ftmrb are the performance (in MHz) of traditional FSMs with binary and one-hot state encoding, as well as the TMR method with binary state encoding; Ffb and Ffo are the performance of FTFSMs when using binary and one-hot codes for encoding states; Ftb/Ffb, Fto/Ffo and Ffb/Ftmr are the ratios of the corresponding parameters; and Av, Min, and Max denote the previous values.

When using binary codes for FSM state encoding, as shown in Table 3, there is a maximum performance reduction by a factor of 1.912 for the example s820, a maximum performance increase by a factor of 3.523 (=1/0.284) for the example train4, and an average performance reduction of 5.3% (corresponding to a ratio of Ftb/Ffb = 1.053).

When using one-hot codes for FSM state encoding, the maximum performance reduces by a factor of 3.390 for the example planet, the maximum performance increases by a factor of 1.932 (=1/0.518) for the example train4, and the average performance reduces by 60.9% (corresponding to a ratio Ftb/Ffb = 1.609).

Compared to the TMR method, the proposed approach increases the average performance of FTFSMs by a factor of 1.939 (up to 4.5 times for the s420 example).

The performance ratios for traditional FSM implementations and for the proposed FTFSM synthesis method, using binary and one-hot state encodings, are shown in Figure 9. However, the comparison of the average performance values (not the ratios) in Figure 10 shows that using the proposed approach increases performance by 11.6% when using binary encoding, but reduces performance by 41.8% when using one-hot encoding.

The performance increase in FSMs, in some cases, compared to traditional FSMs, is explained by the fact that a decrease in the area of the combinational part often leads to improved performance.

In summary, Hypothesis 1 was confirmed for the one-hot FSM state encoding and not confirmed for the binary FSM state encoding. Hypothesis 2 was also confirmed for the one-hot FSM state encoding and not confirmed for the binary FSM state encoding.

Figure 11 shows, on average, by how many times the proposed approach reduces the area and increases the performance of FTFSMs compared to the TMR method (the average area and performance ratios).

Based on the experimental results, we recommend using minimum-length codes, such as binary or Gray codes, for encoding the states of FTFSMs. In this approach, the performance of FTFSMs is only slightly reduced compared to traditional FSM implementations, while the area requirements increase only marginally or may even decrease.

5. Fault Detection Probability When Implementing FTFSMs in FPGAs

When implementing an FSM in an FPGA, faults can occur not only in the FSM wires and registers but also in the configuration memory cells that define the FSM circuit. These faults can lead to failures in the combinational circuits of the FTFSM (λ, δ, VI, VO, VS, VN, VT, and CED), as well as in the Rs and Ro registers. The task is to calculate the probability of detecting faults in the FTFSM shown in Figure 3, while accounting for faults in the CED circuit.

The probability of a fault occurring in a specific component of an FSM implemented in an FPGA depends on the area of the crystal occupied by that component. Note that for FPGAs based on LUTs, the component area is determined by the number of LUTs required to implement this component. The probability of a fault occurring in a component e, e ∈ {λ, δ, Rs, Ro, CED}, can be calculated using expression (7):

$$p_e={\displaystyle \frac{A_e}{A_{FSM}}},$$

(7)

where A_e and A_FSM represent the area of the component e and the area of the FSM, respectively.

Since the probabilities of a fault occurring in each component of the FSM are independent, condition (8) must be satisfied:

$$p_{\mathsf{\lambda }}+p_{\mathsf{\delta }}+p_{R\mathrm{s}}+p_{\mathrm{R}\mathrm{o}}+p_{\mathrm{C}\mathrm{E}\mathrm{D}}=1.$$

(8)

The probability of detecting a fault in any component of an FSM e, where e ∈ {λ, δ, Rs, Ro}, in the absence of a fault in the combinational circuit CED, is determined by expression (9):

$$b_e=p_e·q_{\mathrm{C}\mathrm{E}\mathrm{D}},$$

(9)

where q_CED represents the probability of no faults in the combinational circuit CED:

$$q_{\mathrm{CED}}=1-p_{\mathrm{CED}}.$$

(10)

By analogy with (9), the probability p_d of detecting a fault in any component of the FTFSM in Figure 3 in the absence of a fault in the combinational circuit CED is determined by expression (11):

$$p_d=\left(p_{\mathsf{\lambda }}+p_{\mathsf{\delta }}+p_{\mathrm{R}\mathrm{s}}+p_{\mathrm{R}\mathrm{o}}\right)·q_{\mathrm{C}\mathrm{E}\mathrm{D}}.$$

(11)

Considering expression (8), we have:

$$p_d=(1-p_{\mathrm{C}\mathrm{E}\mathrm{D}})·q_{\mathrm{C}\mathrm{E}\mathrm{D}},$$

(12)

and also taking into account (10), we obtain:

$$p_d=q_{\mathrm{C}\mathrm{E}\mathrm{D}}·q_{\mathrm{C}\mathrm{E}\mathrm{D}}=q_{\mathrm{C}\mathrm{E}\mathrm{D}}^2.$$

(13)

Thus, the probability p_d of detecting a fault in the FTFSM, according to (7), (10) and (13), depends on the area of the combinational CED circuit. When implementing an FTFSM in an LUT-based FPGA, the area of the combinational circuit CED, according to [37], is determined by the number of LUTs using expression (14):

$$A_{\mathrm{C}\mathrm{E}\mathrm{D}}=\left\{\begin{array}{c}1,rank\left(\mathrm{C}\mathrm{E}\mathrm{D}\right)\le n;\\ ⌈{\displaystyle \frac{rank\left(\mathrm{C}\mathrm{E}\mathrm{D}\right)-n}{n-1}}⌉,rank\left(\mathrm{C}\mathrm{E}\mathrm{D}\right)>n;\end{array}\right.$$

(14)

where rank(CED) is the number of inputs of the combinational circuit CED; n is the number of LUT inputs; and ⌈A⌉ is the smallest integer greater than or equal to A.

From Figure 2 and Figure 3, it follows that the ranks (number of inputs) of combinational circuits of an FTFSM are determined by the following expressions (15):

$$\begin{array}{c}rank\left(\mathrm{V}\mathrm{I}\right)=\left|X\right|+C;\\ rank\left(\mathrm{V}\mathrm{O}\right)=\left|X\right|+\left|Y\right|;\\ \begin{array}{c}rank\left(\mathrm{V}\mathrm{S}\right)=rank\left(\mathrm{V}\mathrm{N}\right)=C;\\ \begin{array}{c}rank\left(\mathrm{V}\mathrm{T}\right)=2·C;\\ rank\left(\mathrm{C}\mathrm{E}\mathrm{D}\right)=\left|X\right|+\left|Y\right|+2·C;\end{array}\end{array}\end{array}$$

(15)

where |A| is the cardinality of set A, and C is the length (number of bits) of the FSM state codes.

When using binary encoding, the length C_b of FSM state codes is equal to

$$C_b=⌈{\log }_2\left|S\right|⌉,$$

(16)

and when using one-hot encoding, the length C_o of FSM state codes is equal to

$$C_o=\left|S\right|.$$

(17)

The probability calculation for detecting a fault in an FTFSM implemented on an FPGA is represented by Algorithm 3.

Algorithm 3: Calculating the probability of fault detection for FTFSMs in an FPGA

INPUT: The FTFSM. OUTPUT: pd. The code length C is determined based on the method of encoding the FTFSM states, for example, as specified in (16) or (17). According to (15), the rank of the circuit CED for fault detection is determined. According to (14), the area of the circuit CED is determined. In accordance with Algorithm 2, the synthesis of an FTFSM is performed, and the area AFSM of the FTFSM is determined. According to (7), the probability pe of fault of the CED circuit is calculated. According to (10), the probability qCED of the absence of a fault in the CED circuit is calculated. According to (13), the probability pd of detecting a fault by the CED circuit is calculated. Return pd.

As an example, let us determine the probability of detecting faults using the proposed technique, based on the average parameter values of FSM benchmarks [35], for which |X| = 6, |Y| = 6, and |S| = 22. Note that for the Cyclone 10 LP family of FPGAs, the number of LUT inputs, n, is 4.

Let us calculate the probability of detecting faults when using binary codes for encoding the FSM states. From (16) it follows that for |S| = 22, the code length C_b = 5. The average value Lfb = 113.14 from Table 2 is considered to be the area A_FSM of the FTFSM.

Let us consider the cases when the CED circuit consists of only one combinational circuit e, e ∈ {VI, VO, VS, VN, VT}, and also when the CED circuit includes all combinational circuits, as shown in Figure 4. The results of executing Algorithm 3 are given in

Table 4. Fault detection probability of FTFSMs for binary encoding.

e	rank(e)	Ae	pe = Ae/AFSM	qe = 1 − pe	${\mathit{p}}_{\mathit{d}}={\mathit{q}}_{\mathit{e}}^2$	%
VI	11	4	0.0353544	0.9646456	0.9305411	93.1
VO	12	4	0.0353544	0.9646456	0.9305411	93.1
VS, VN	5	2	0.0176772	0.9823228	0.9649581	96.5
VT	10	3	0.0265158	0.9734842	0.9476715	94.8
CED	22	7	0.0618702	0.9381298	0.8800875	88.0

, where the probability of detecting faults as a percentage is added.

When using one-hot codes for FSM state encoding, according to (17), $C_o=\left|S\right|$ = 22, and the area A_FSM of the FSM is taken to be the average value of the area Lfo = 102.33 of the FTFSMs from Table 2. The results of executing Algorithm 3 are given in

Table 5. Fault detection probability of FTFSMs for one-hot encoding.

e	rank(e)	Ae	pe = Ae/AFSM	qe = 1 − pe	${\mathit{p}}_{\mathit{d}}={\mathit{q}}_{\mathit{e}}^2$	%
VI	28	9	0.0879507	0.9120493	0.8318339	83.2
VO	12	4	0.0390892	0.9609108	0.9233496	92.3
VS, VN	22	7	0.0684061	0.9315939	0.8678672	86.8
VT	44	15	0.1465846	0.8534154	0.7283178	72.8
CED	56	19	0.1856738	0.8143262	0.6631272	66.3

.

Figure 12 shows a comparison of the probabilities (in percent) of fault detection in FTFSMs using binary and one-hot encoding for various combinational circuits from the set {VI, VO, VS, VN, VT}, and also when the CED circuit includes all combinational circuits.

Table 4 and Table 5, as well as Figure 12, show that, with binary encoding, the fault-detection probability for FTFSMs implemented in FPGAs ranges from 93.1 to 96.5% for various faults and 88.0% for all faults. Using one-hot encoding, the fault-detection probability ranges from 72.8 to 92.3% for individual faults and 66.3% for all faults. Therefore, to increase the fault-detection probability in FTFSMs implemented in FPGAs, the FTFSM states should be encoded with minimal-length codes, such as binary or Gray.

6. Conclusions

This paper introduces a method for creating robust FTFSMs that can detect MBUs caused by external disturbances from EW systems affecting UAVs. The FTFSM structure is designed to identify faults in the input and output vectors, as well as in the present- and next-state codes, and it can detect invalid state transitions. When a fault is detected, the FTFSM enters a standby mode, during which it saves the code of the last present state and the value of the last valid output vector. Once the external disturbance ceases, the FTFSM returns to normal operation without changing the control algorithm. In the case of a critical error, the FTFSM circuit can be reconfigured using an external processor. Experimental studies have shown the high efficiency of this proposed approach. For example, compared with traditional FSM implementations that use one-hot state encoding, the area required for FTFSMs is reduced by an average of 2.9%, while performance decreases by an average of 5.3%. Furthermore, compared to the TMR method, the proposed approach reduces the average area by a factor of 3.137 and improves average performance by a factor of 1.939. Additionally, a technique for calculating the probability of fault detection when implementing FTFSMs on FPGAs is presented. To minimize overhead and increase the probability of fault detection, it is recommended to use minimum-length codes, such as binary or Gray codes, to encode the FTFSM states. Future research will concentrate on developing methods for designing even more fault-tolerant and robust FSMs.