The TMR MicroBlaze sub-blocks have triplicated MicroBlaze, LMB memory and I/O Module peripherals, with majority voting of all the interfaces as shown in the following figure. In this configuration the interfaces with voters are:
- Instruction LMB Block RAM Interface Controller: Local memory block RAM
- Data LMB Block RAM Interface Controller: Local memory block RAM
- I/O Module external interfaces (UART, GPO)
The voters implement the FT property, with majority voting to ensure that a faulty MicroBlaze sub-block is masked by the two other sub-blocks. This guarantees that the I/O interfaces continue to provide correct output data even in the presence of a fault.
The LMB block RAM is triplicated, with majority voting of the read data to ensure that all three MicroBlaze processors see the correct data. This is necessary to be able to correct any errors in the block RAM.
It is also possible to use a single block RAM protected by Error Correcting Code (ECC) outside the triplicated sub-blocks, as shown in the following figure. The ECC is then generated and checked in the triplicated LMB Interface Controller at the boundary where the two protection schemes overlap. This configuration uses less resources, at the expense of somewhat reduced fault detection.
To avoid accumulating errors in the block RAM over time, software scrubbing must be implemented with both these configurations.