Cover
Title Page
Brief Introduction
Preface
1 Introduction
1. 1.1 Fundamental Concepts and Principles of Fault‐tolerance Techniques
2. 1.2 The Space Environment and Its Hazards for the Spacecraft Control Computer
3. 1.3 Development Status and Prospects of Fault Tolerance Techniques
4. References
2 Fault‐Tolerance Architectures and Key Techniques
1. 2.1 Fault‐tolerance Architecture
2. 2.2 Synchronization Techniques
3. 2.3 Fault‐tolerance Design with Hardware Redundancy
4. References
3 Fault Detection Techniques
1. 3.1 Fault Model
2. 3.2 Fault Detection Techniques
3. References
4 Bus Techniques
1. 4.1 Introduction to Space‐borne Bus
2. 4.2 The MIL‐STD‐1553B Bus
3. 4.3 The CAN Bus
4. 4.4 The SpaceWire Bus
5. 4.5 Other Buses
6. References
5 Software Fault‐Tolerance Techniques
1. 5.1 Software Fault‐tolerance Concepts and Principles
2. 5.2 Single‐version Software Fault‐tolerance Techniques
3. 5.3 Multiple‐version Software Fault‐tolerance Techniques
4. 5.4 Data Diversity Based Software Fault‐tolerance Techniques
5. References
6 Fault‐Tolerance Techniques for FPGA
1. 6.1 Effect of the Space Environment on FPGAs
2. 6.2 Fault Modes of SRAM‐based FPGAs
3. 6.3 Fault‐tolerance Techniques for SRAM‐based FPGAs
4. 6.4 Typical Fault‐tolerance Design of SRAM‐based FPGA
5. 6.5 Fault‐tolerance Techniques of Anti‐fuse Based FPGA
6. References
7 Fault‐Injection Techniques
1. 7.1 Basic Concepts
2. 7.2 Classification of Fault‐injection Techniques
3. 7.3 Fault‐injection System Evaluation and Application
4. 7.4 Fault‐injection Platform and Tools
5. References
8 Intelligent Fault‐Tolerance Techniques
1. 8.1 Evolvable Hardware Fault‐tolerance
2. 8.2 Artificial Immune Hardware Fault‐tolerance
3. References
Acronyms
Index
End User License Agreement

List of Tables

Chapter 02
1. Table 2.1 Design reference by signal type.
2. Table 2.2 IPU elements and application references.
3. Table 2.3 Application scope and the advantages and disadvantages of a power supply isolation protection circuit.
Chapter 05
1. Table 5.1 Backward recovery vs. forward recovery.
2. Table 5.2 Classification of software fault‐tolerance techniques.
Chapter 06
1. Table 6.1 Analysis of fault modes of SRAM‐based FPGA.
2. Table 6.2 SRAM‐based FPGA fault‐tolerance techniques.
3. Table 6.3 Maximum data bandwidth for various configuration modes.
4. Table 6.4 ICAP read‐back operation commands.
5. Table 6.5 Description of Frame_ECC port definition.
Chapter 07
1. Table 7.1 Ground simulation test accelerators for SEEs.
2. Table 7.2 Various fault‐injection approaches.
3. Table 7.3 Various typical fault‐injection tools.
Chapter 08
1. Table 8.1 Basic structure, manufacturing technique, and applicable evolution methods of various PLDs.
2. Table 8.2 Comparison of evolution methods in various hardware layers.
3. Table 8.3 Relationship of immune system to traditional fault‐tolerance.
4. Table 8.4 Foundation of an organism’s immune system.
5. Table 8.5 Mapping relationship between biological immune system and artificial immune system.
6. Table 8.6 Mapping relationship between biological immune system and hardware immune system.
7. Table 8.7 Mapping relationship between FPGA structure and an organism’s structure.
8. Table 8.8 Responsibility and function of artificial immune system applicable to FPGA fault‐tolerance.
9. Table 8.9 Function of artificial immune system hardware component based on the SoPC technique.
10. Table 8.10 Execution times of immune algorithm critical functions.

List of Illustrations

Chapter 01
1. Figure 1.1 Fault categorization.
2. Figure 1.2 Serial connection model.
3. Figure 1.3 Parallel connection model.
4. Figure 1.4 The r/n(G) model.
5. Figure 1.5 Magnetic layer of the earth and radiation.
6. Figure 1.6 Energy spectrum of protons.
7. Figure 1.7 Electron distribution above the equator.
8. Figure 1.8 Space radiation environment.
9. Figure 1.9 PNPN component: (a) NOT gate. (b) Equivalent circuit.
10. Figure 1.10 Physical essence of SEU damage.
11. Figure 1.11 MOSFET parasitic BJT structure that leads to SEB.
12. Figure 1.12 Physical mechanism of SEGR damage.
Chapter 02
1. Figure 2.1 Structure of module‐level redundancy.
2. Figure 2.2 Organization of modules in the control computer.
3. Figure 2.3 Reliability model of the control computer.
4. Figure 2.4 Dual‐computer cold‐backup fault‐tolerance structure.
5. Figure 2.5 Dual‐computer hot‐backup FT system structure.
6. Figure 2.6 TMT fault‐tolerance structure.
7. Figure 2.7 Truth table for the hardware voter.
8. Figure 2.8 TMR/S Tri‐computer FT structure.
9. Figure 2.9 Schematic diagram of the phase‐locked loop (PLL) clock circuit.
10. Figure 2.10 Clock module receiver circuit.
11. Figure 2.11 A clock module in the average algorithm.
12. Figure 2.12 Tri‐computer system data exchange.
13. Figure 2.13 Fault‐tolerance processing procedure.
14. Figure 2.14 Fault‐tolerance processing procedure with waiting time inserted.
15. Figure 2.15 Data input structure of a multi‐computer system.
16. Figure 2.16 Sequence of the computers.
17. Figure 2.17 Tri‐computer execution scenario.
18. Figure 2.18 Common logic model of redundancy design.
19. Figure 2.19 Example of system fault caused by FDMU.
20. Figure 2.20 The alienation principle among the BFUs.
21. Figure 2.21 Dual‐point‐dual‐line redundancy design.
22. Figure 2.22 RAS demonstration.
23. Figure 2.23 Satellite temperature measure redundancy circuits.
24. Figure 2.24 Demonstration of sneak circuit in the redundancy design.
Chapter 03
1. Figure 3.1 Internal structure of the 80C86 CPU.
2. Figure 3.2 Blocked storage space structure.
3. Figure 3.3 Typical memory test process.
4. Figure 3.4 I/O test structure.
Chapter 04
1. Figure 4.1 Structure of the 1553B Bus.
2. Figure 4.2 1553B Bus system function module.
3. Figure 4.3 System level fault distribution structure of the 1553b bus.
4. Figure 4.4 Bus‐level structure.
5. Figure 4.5 Terminal bus interface.
6. Figure 4.6 Faulty data internal influence.
7. Figure 4.7 Longest message on the 1553B bus.
8. Figure 4.8 Bus controller dual modular redundancy.
9. Figure 4.9 N‐modular redundancy of the bus controller.
10. Figure 4.10 Distributed redundancy mode of the bus controller.
11. Figure 4.11 Structure of the control computer system of a spacecraft.
12. Figure 4.12 Node relation in CAN networking.
13. Figure 4.13 CAN Protocol Layer and OSI.
14. Figure 4.14 Node structure of the CAN bus.
15. Figure 4.15 Structure of the CAN bus controller.
16. Figure 4.16 Nine fault scenarios in the CAN bus physical layer.
17. Figure 4.17 CAN bus communication process.
18. Figure 4.18 CAN bus coding.
19. Figure 4.19 CAN bus frame formats.
20. Figure 4.20 Relationship between the three fault modes.
21. Figure 4.21 CAN bus structure used on a space mission.
22. Figure 4.22 LVDS signal transmission voltage.
23. Figure 4.23 Operating principle of LVDS.
24. Figure 4.24 Data filter coding.
25. Figure 4.25 SpaceWire data character.
26. Figure 4.26 SpaceWire control character and control code.
27. Figure 4.27 Coverage area of SpaceWire parity check.
28. Figure 4.28 SpaceWire encoder/decoder state machine.
29. Figure 4.29 SpaceWire communication link initialization procedure.
30. Figure 4.30 Header deletion in SpaceWire.
31. Figure 4.31 Integration solution for an onboard SpaceWire electrical system.
32. Figure 4.32 Address mapping of node internal addressing.
33. Figure 4.33 Relationship between layers of the IEEE 1394 protocol.
34. Figure 4.34 Application of the IEEE 1394 bus in the telemetry acquisition system of JPLX2000.
35. Figure 4.35 Structure of the cabin electrical system in the ESA Columbus.
36. Figure 4.36 Electrical system network of the NASA X2000 program based on the I²C bus.
Chapter 05
1. Figure 5.1 Backward recovery.
2. Figure 5.2 Forward recovery using redundant processes.
3. Figure 5.3 Checkpoint and restart.
4. Figure 5.4 Example process used in SIHFT.
5. Figure 5.5 Workflow of CFCSS.
6. Figure 5.6 Runtime adjusting signature, D.
7. Figure 5.7 Recovery block structure and operation.
8. Figure 5.8 Recovery block structure with two alternates.
9. Figure 5.9 N‐version programming structure.
10. Figure 5.10 Distributed recovery block structure.
11. Figure 5.11 A fault‐free PSP task execution cycle.
12. Figure 5.12 A PSP station task execution cycle involving a failure.
13. Figure 5.13 NSCP using acceptance tests (ATs).
14. Figure 5.14 NSCP using comparison.
15. Figure 5.15 Consensus recovery block structure and operation.
16. Figure 5.16 Acceptance voting technique structure and operation.
17. Figure 5.17 Retry block structure and operation.
18. Figure 5.18 N‐copy programming structure.
19. Figure 5.19 Two‐pass adjudicator structure and operation.
Chapter 06
1. Figure 6.1 Radiation effect induced by charged particle bombardment.
2. Figure 6.2 SET of combinational logic and SEU of sequential logic.
3. Figure 6.3 SRAM configuration memory cell of an FPGA.
4. Figure 6.4 SEE induced multiple bits upset.
5. Figure 6.5 Internal structure of the Virtex FPGA.
6. Figure 6.6 Internal configuration information storage memory unit. [M] denotes configuration storage unit inside FPGA.
7. Figure 6.7 Upset of sequential and combinational logic.
8. Figure 6.8 Half‐latch structure of the Virtex series FPGA.
9. Figure 6.9 Structure of the traditional TMR.
10. Figure 6.10 TMR functional module.
11. Figure 6.11 Output of TMR.
12. Figure 6.12 TMR protection for block RAM.
13. Figure 6.13 TMR fault‐tolerance method to protect sequential logic against SEU.
14. Figure 6.14 Avoiding SET occurrence in combinational logic and sequential logic with the TMR fault‐tolerance method.
15. Figure 6.15 EDAC information redundancy protection solution.
16. Figure 6.16 Hamming EDAC system diagram.
17. Figure 6.17 Structure of Hamming encoder/decoder.
18. Figure 6.18 Fault detection based on DMR and fault isolation based on tristate gate.
19. Figure 6.19 Structure of the HWICP module.
20. Figure 6.20 ICAP interface configuration read‐back, verification, and reconfiguration.
21. Figure 6.21 Format of an I type packet.
22. Figure 6.22 Format of an II type packet.
23. Figure 6.23 Virtex 4 Frame_ECC module.
24. Figure 6.24 Design process based on ICAP configuration read‐back >+ RS fault‐tolerant coding.
25. Figure 6.25 RS encoding process.
26. Figure 6.26 RS encoder realization based on FPGA.
27. Figure 6.27 RS decoding process.
28. Figure 6.28 Module‐level dynamic reconfiguration fault recovery.
29. Figure 6.29 Synthesis realization of top layer module and sub‐modules.
30. Figure 6.30 Configuration file creation process.
31. Figure 6.31 Design hierarchy and reconfiguration area layout.
32. Figure 6.32 Physical module division of the PlanAhead module.
33. Figure 6.33 Hardware checkpoint setup process.
34. Figure 6.34 Structure of FPGA Capture module.
35. Figure 6.35 ICAP automatic scrubbing, read‐back, and reconfiguration prototype system.
36. Figure 6.36 Module position constraint in PlanAhead.
37. Figure 6.37 Signal observation and control in ChipScope.
38. Figure 6.38 LEON3 microprocessor configurable architecture.
39. Figure 6.39 LEON3 microprocessor architecture.
40. Figure 6.40 Dynamic reconfiguration time verification circuit. (a) Combinational function verification circuit structure (b) Sequential function verification circuit structure.
41. Figure 6.41 Structure of Actel FPGA. (a) Combinational ACTI (C‐cell) and sequential ACTI (R‐cell). (b) Detailed layout of C‐cell. (c) R‐cell: description of latch.
42. Figure 6.42 Memory unit internal TMR of radiation resistant FX or AX structured Actel FPGA.
Chapter 07
1. Figure 7.1 Fault‐injection procedures.
2. Figure 7.2 Classification of fault‐injection technology.
3. Figure 7.3 Example of injection validity.
4. Figure 7.4 Fault‐injection platform in the EDA environment.
5. Figure 7.5 Fault‐injection system functional modules.
6. Figure 7.6 Data flow in the fault‐injection system.
7. Figure 7.7 Uncapped FPGA.
8. Figure 7.8 Uncapped 1553B interface chip.
9. Figure 7.9 Test system environment.
10. Figure 7.10 Single‐particle test principle schematic diagram.
Chapter 08
1. Figure 8.1 Evolvable hardware fault‐tolerance implementation flow.
2. Figure 8.2 Evolvable hardware fault‐tolerance implementation methods.
3. Figure 8.3 Evolution‐based fault‐tolerance process in a PLD.
4. Figure 8.4 Standard genetic algorithm flowchart.
5. Figure 8.5 Two‐point crossover process.
6. Figure 8.6 ROM structure.
7. Figure 8.7 PAL basic structure.
8. Figure 8.8 Internal structure of a Xilinx FPGA.
9. Figure 8.9 Virtex serial FPGAs with two‐slice CLB structure.
10. Figure 8.10 A slice inside a Virtex series FPGA.
11. Figure 8.11 VRC structure adopted by Sekanian et al.
12. Figure 8.12 Genotype and phenotype.
13. Figure 8.13 Relationship between chromosome code, configuration data, and circuit function in hardware evolution system.
14. Figure 8.14 Hardware evolution system model and implementation. (a) Hardware evolution system model. (b) Hardware evolution system implementation.
15. Figure 8.15 Global dynamic reconfigurable system.
16. Figure 8.16 Partial dynamic reconfigurable system.
17. Figure 8.17 Evolvable hardware fault‐tolerance structure with FPGA implementation.
18. Figure 8.18 Hardware evolution implementation methods. (a) Extrinsic evolution. (b) Intrinsic evolution implemented with host computer. (c) Intrinsic evolution implemented with embedded system.
19. Figure 8.19 Evolution methods in various hardware layers.
20. Figure 8.20 Implementation methods for various hardware layers’ evolution. (a) Bit stream‐level evolution. (b) Netlist‐level evolution. (c) Design‐level evolution. (d) VRC‐level evolution.
21. Figure 8.21 Internal structure of a PAL.
22. Figure 8.22 Evolutional hardware fault‐tolerant capability of a simple PLD. (a) Point A is normal. (b) There is a stuck‐at‐0 fault in point A.
23. Figure 8.23 Internal evolution realized through implementation of JBits on FPGA.
24. Figure 8.24 T cell screening and maturing process.
25. Figure 8.25 Proliferation and differentiation after cell combination with antigens of high affinity.
26. Figure 8.26 Fast immune response in which T cells participate.
27. Figure 8.27 Flowchart of standard negative selection algorithm.
28. Figure 8.28 System structure of artificial immune system.
29. Figure 8.29 Flowchart of the immune system.
30. Figure 8.30 FSM of immune hardware.
31. Figure 8.31 Diagram of artificial immune fault‐tolerance system.
32. Figure 8.32 FPGA fault‐tolerant system hierarchy based on artificial immune system.
33. Figure 8.33 Structure of a basic unit in eCell.
34. Figure 8.34 eCell Structure.
35. Figure 8.35 Immune control system based on human adaptive immunity model.
36. Figure 8.36 eCell state transfer string encoding. Key: clk: clock signal; input: eCell input; present: eCell present state user logic output; past: eCell user logic former state output; trans: eCell state transfer string created through the assembly of circuit state acquisition module.
37. Figure 8.37 Flowchart of the standard PSA.
38. Figure 8.38 Procedure utilized in the learning phase.
39. Figure 8.39 Procedure utilized in the fault detection phase.
40. Figure 8.40 Fault recovery phase procedure.
41. Figure 8.41 eCell hardware design principle diagram.
42. Figure 8.42 Artificial immune system hardware structure based on the SoPC technique.
43. Figure 8.43 Simplified selection algorithm procedure. (a) Construction of PSA detector. (b) Fault detection and recovery of PSA.
44. Figure 8.44 Flowchart for eCell configuration software.

Pages

iii
iv
xiii
xv
xvi
xvii
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
343
344
345
346
347
348
349
350
351
352

This edition first published 2017

Published by John Wiley & Sons Singapore Pte. Ltd., 1 Fusionopolis Walk, #07‐01 Solaris South Tower, Singapore 138628, under exclusive license granted by National Defense Industry Press for all media and languages excluding Simplified and Traditional Chinese and throughout the world excluding Mainland China, and with non‐exclusive license for electronic versions in Mainland China.

For details of our global editorial offices, for customer services and for information about how to apply for permission to reuse the copyright material in this book please see our website at www.wiley.com.

All Rights Reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as expressly permitted by law, without either the prior written permission of the Publisher, or authorization through payment of the appropriate photocopy fee to the Copyright Clearance Center. Requests for permission should be addressed to the Publisher, John Wiley & Sons Singapore Pte. Ltd., 1 Fusionopolis Walk, #07‐01 Solaris South Tower, Singapore 138628, tel: 65‐66438000, fax: 65‐66438008, email: enquiry@wiley.com.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

Designations used by companies to distinguish their products are often claimed as trademarks. All brand names and product names used in this book are trade names, service marks, trademarks or registered trademarks of their respective owners. The Publisher is not associated with any product or vendor mentioned in this book. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold on the understanding that the Publisher is not engaged in rendering professional services. If professional advice or other expert assistance is required, the services of a competent professional should be sought.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. It is sold on the understanding that the publisher is not engaged in rendering professional services and neither the publisher nor the author shall be liable for damages arising herefrom. If professional advice or other expert assistance is required, the services of a competent professional should be sought.

Library of Congress Cataloging‐in‐Publication Data

Names: Yang, Mengfei, author. | Hua, Gengxin, 1965– author. | Feng, Yanjun, 1969– author. | Gong, Jian, 1975– author.
Title: Fault‐tolerance techniques for spacecraft control computers / Mengfei Yang, Gengxin Hua, Yanjun Feng, Jian Gong.
Other titles: Hang tian qi kong zhi ji suan ji rong cuop ji shu. English
Description: Singapore : John Wiley & Sons, Inc., 2017. | Translation of: Hang tian qi kong zhi ji suan ji rong cuop ji shu. | Includes bibliographical references and index.
Identifiers: LCCN 2016038233 (print) | LCCN 2016051493 (ebook) | ISBN 9781119107279 (cloth) | ISBN 9781119107408 (pdf) | ISBN 9781119107415 (epub)
Subjects: LCSH: Space vehicles–Control systems. | Fault‐tolerant computing.
Classification: LCC TL3250 .Y36513 2017 (print) | LCC TL3250 (ebook) | DDC 629.47/42–dc23
LC record available at https://lccn.loc.gov/2016038233

Cover design by Wiley

Cover image: pixelparticle/Gettyimages

Preface

The control computer is one of the key equipment in a spacecraft control system. Advances in space technology have resulted in the functionality of the control computer becoming increasingly more complex. In addition, the control computer used in space is affected by the harsh elements of the space environment, especially radiation, necessitating the satisfaction of stringent requirements to ensure the control computer’s reliability. Consequently, multiple fault‐tolerance techniques are used in spacecraft design to improve the reliability of the control computer.

NASA (in the United States) has been using fault‐tolerant computer systems in its spacecraft – for example, the self‐testing and repairing (STAR) fault‐tolerant computer – since the 1960s. China began to develop fault‐tolerant computers for spacecraft in the 1970s. We utilized a fault‐tolerant control computer in a satellite for the first time at the Beijing Institute of Control Engineering in the 1980s, and realized a successful on‐orbit flight. Fault‐tolerance techniques have subsequently been predominantly incorporated into control computers, and have contributed significantly to the success of spacecraft projects and missions.

The significance of fault‐tolerance techniques in space technology has prompted us to publish this book, introducing the techniques that we use in spacecraft control computer research and design in China. The content of this book covers not only the fundamental principles, but also methods and case studies in practical engineering.

There are a total of eight chapters. Chapter 1 summarizes fundamental concepts and principles of fault‐tolerance techniques, analyzes the characteristics of a spacecraft control computer and the influences of the space environment, and reviews the course of development of fault‐tolerance techniques and development perspectives expected in the future. Chapter 2 introduces the typical architecture of a fault‐tolerant computer and its key techniques, based on China’s spacecraft projects and engineering practices. Chapter 3 presents frequently used fault models, based upon which, fault detection techniques of computer key components are discussed. Chapter 4 introduces the fault‐tolerance techniques of several frequently used spacecraft control computer buses, with special focus on buses such as 1553B bus, CAN bus, and SpaceWire bus.

Chapter 5 outlines the fundamental concepts and principles underlying software fault‐tolerance and emphatically discusses several concrete software fault‐tolerance techniques, including single‐version fault tolerance, N‐version fault tolerance, and data diversity‐based fault tolerance. Chapter 6 discusses the effect that space radiation has on field programmable gate arrays (FPGAs), and the fault models and dynamic fault‐tolerance methods used in static random access memory (SRAM)‐based FPGAs. Chapter 7 presents fault‐injection relevant techniques based on practical engineering, primarily involving fault‐injection methods, evaluation methods, and tools. Chapter 8 discusses the fundamental concepts, principles, and concrete implementation methods of state‐of‐the‐art intelligence fault‐tolerance techniques, and introduces two representative intelligence fault‐tolerance techniques – specifically, evolvable hardware fault tolerance and artificial immune hardware fault tolerance.

All the authors listed in this book – Yang Mengfei, Hua Gengxin, Feng Yanjun, and Gong Jian – helped to plan it. Yang Mengfei, Gong Jian, and Feng Yanjun wrote Chapter 1; Yang Mengfei, Feng Yanjun, and Gong Jian wrote Chapter 2; Yang Mengfei and Gong Jian wrote Chapter 3; Hua Gengxin, Yang Mengfei, Feng Yanjun, and Gong Jian wrote Chapter 4; Feng Yanjun and Yang Mengfei wrote Chapter 5; Liu Hongjin, Yang Mengfei, and Gong Jian wrote Chapter 6; Hua Gengxin and Gong Jinggang wrote Chapter 7; and Gong Jian, Yang Mengfei, and Dong Yangyang wrote Chapter 8. Gong Jian and Feng Yanjun were responsible for formatting, while Yang Mengfei approved, proofread, and finalized the book.

This book contains not only a summary of our practical work, but also our research experience, fully reflecting the present status and level of China’s spacecraft control computer fault‐tolerance techniques. This book combines theory with practice, and is highly specialized. As a result, it can function as a reference for persons engaged in the research and design of high‐reliability computers, especially of spacecraft computer and electronics, and also as a textbook for graduates engaged in research work in this field.