Implementation of a fault-tolerant system using safety-related Xilinx tools conforming to the standard IEC 61508

Abstract

Designing fault-tolerant systems implicates a redundant architecture of most critical system components. Traditional techniques — DMR and TMR, require a compromise with either incapability of a failed system masking or with an extremely high complexity and voter discrepancy. This paper presents a novel, warm redundancy architecture on FPGA based on a 32-bit microcontroller, which eliminates the drawbacks of DMR and TMR contributing their benefits. In order to mask a failed system, an enhanced diagnostic is implemented comprising CPU self-tests, internal and external watchdog, clock guarding and Xilinx soft error mitigation controller. Consequently, on-chip redundancy consists of two microcontrollers operating on the warm principle, in addition to an external watchdog that is designed to mask a failed system according to the status of diagnostics and to perform the activation of the redundant one. Increased availability is achieved due to the integration of two external watchdogs. Following the certified isolation design flow of Xilinx tools a conformance with the safety standard IEC 61508 is conducted. Furthermore, novel measures for mitigation of common cause failures are investigated to meet the requirements of the standard.