I have recently been introduced to the IEC61508 and the ISO 26262 and trying to get my head around how to make a hardware design safe. This question is related to article "Four Steps To ISO 26262 Safety Mechanism Insertion And Validation" written by PING YEUNG.
For the design interfaces, parity checks can be performed to ensure accurate data transmission between the interface modules and the interface controllers inside the design. Once the data are inside the design, they can be protected with data parity on the buses and error-correction code (ECC) in the storage elements. On-chip bus transactions can be observed by dedicated bus monitors. Critical control components, such as functional safety mechanisms and arbitration logic, will best be protected with triple module redundancy and majority voting. Central and embedded processors can be protected with double modular redundancy along with lockstep checkers.
Register-level insertion is more surgical. It inserts safety mechanisms in the storage elements, such as register duplication and parity. This approach is commonly used to protect control and state machine structures. Some register- level safety mechanisms include:
- Parity generation and checking for critical control elements
- Double modular redundancy for a selected list of registers
- Triple modular redundancy for a selected list of registers
- Error correction, and single-error correction with double-error detection for banks of registers
- Protocol checking ensures valid state transitions for finite state machines Safety synthesis can add parity checking to all or a list of special registers in a module.
Now if we use parity and ECC, we can detect and possibly correct errors. However, if we use double or triple redundancy, it will not help us to detect faults when they occur.
- Doesn't making system "safe" means we can detect if something goes wrong like it happens with parity and CRC? Also,
- With triple modular redundancy we vote between three values and the final value is the majority of the t`hree. Then how does double modular redundancy work when we can't know which value is correct if the two are different?
