WEBVTT

1
00:00:00.000 --> 00:00:04.340
Three verifiers vote to release the same failed
image.

2
00:00:04.340 --> 00:00:07.310
One corrupted replica can be outvoted.

3
00:00:07.310 --> 00:00:10.909
A shared wrong input can make all three vote yes.

4
00:00:10.909 --> 00:00:14.769
Before counting copies, draw what they share.

5
00:00:15.042 --> 00:00:19.556
Dual modular redundancy, DMR, keeps two copies
and compares them.

6
00:00:19.556 --> 00:00:23.099
Our gate grants only when both one-bit copies are
true.

7
00:00:23.099 --> 00:00:26.334
A disagreement raises bad and denies permission.

8
00:00:26.334 --> 00:00:33.279
This detects a single replica flip under the
stated trusted-comparator model; it cannot

9
00:00:33.279 --> 00:00:35.811
identify which copy is right.

10
00:00:36.083 --> 00:00:39.810
Triple modular redundancy, TMR, uses three
copies.

11
00:00:39.810 --> 00:00:43.577
Majority returns true when at least two copies
are true.

12
00:00:43.577 --> 00:00:47.905
With three correct false copies, one flip leaves
the vote false.

13
00:00:47.905 --> 00:00:55.006
Two flips yield 110, so the majority grants
although the image remains unauthorized.

14
00:00:55.292 --> 00:00:58.558
The majority voter also exposes disagreement.

15
00:00:58.558 --> 00:01:04.153
We compare two policies: continue with majority,
or reject whenever any copy differs.

16
00:01:04.153 --> 00:01:09.748
Reject-mismatch blocks the two-flip 110 case, but
three flips produce unanimous 111.

17
00:01:09.748 --> 00:01:14.215
No equality check can distinguish that value from
honest agreement.

18
00:01:14.500 --> 00:01:18.688
For an authorized image, one flipped replica
creates 011.

19
00:01:18.688 --> 00:01:22.187
Majority still grants; rejection blocks service.

20
00:01:22.187 --> 00:01:26.093
This is a real availability difference inside the
model.

21
00:01:26.093 --> 00:01:31.259
It does not establish which policy fits a
cryptographic operation whose faulty outputs

22
00:01:31.259 --> 00:01:32.962
might leak information.

23
00:01:33.250 --> 00:01:38.131
The main campaign has one event before accepting
edge 1.

24
00:01:38.131 --> 00:01:43.510
The event XORs a selected mask into two DMR bits
or three TMR bits.

25
00:01:43.510 --> 00:01:47.195
Each bit corresponds to one replica output.

26
00:01:47.195 --> 00:01:54.019
We enumerate four DMR masks and eight TMR masks;
zero is the no-fault control.

27
00:01:54.292 --> 00:01:57.861
One event can affect two replicas in this
abstraction.

28
00:01:57.861 --> 00:02:04.014
A claim of protection against one faulty replica
therefore needs a replica-count restriction, not

29
00:02:04.014 --> 00:02:05.112
merely one event.

30
00:02:05.112 --> 00:02:11.160
Storage persistence is irrelevant to this
one-edge observation; later operation and

31
00:02:11.160 --> 00:02:13.676
recovery are outside the window.

32
00:02:13.958 --> 00:02:19.837
The image reference, input distribution,
comparator/voter, clock/reset and handshake stay

33
00:02:19.837 --> 00:02:21.824
trusted in the replica campaign.

34
00:02:21.824 --> 00:02:25.515
Masks do not represent physical locations or
probabilities.

35
00:02:25.515 --> 00:02:31.394
Source and voter experiments below replace one
target at a time and retain the independent image

36
00:02:31.394 --> 00:02:32.420
reference.

37
00:02:32.708 --> 00:02:39.218
For the source experiment, invert one shared
authorization bit before all copies sample it.

38
00:02:39.218 --> 00:02:41.483
Every replica now contains true.

39
00:02:41.483 --> 00:02:43.344
DMR and TMR agree and grant.

40
00:02:43.344 --> 00:02:50.247
The checker has not malfunctioned: it correctly
reports equality between three wrong answers.

41
00:02:50.500 --> 00:02:56.600
For the voter experiment, keep all replicas false
and invert only final voter grant.

42
00:02:56.600 --> 00:02:59.425
The accepting interface observes true.

43
00:02:59.425 --> 00:03:02.333
This target lies after replica checking.

44
00:03:02.333 --> 00:03:08.500
Do not combine it with a replica upset while
claiming a single replica-fault bound.

45
00:03:08.750 --> 00:03:14.252
Clock, reset, enable, input data and placement
can create dependencies between replicas.

46
00:03:14.252 --> 00:03:19.141
A spatial split may help against a localized
effect, but it needs physical evidence.

47
00:03:19.141 --> 00:03:21.620
Synthesis can also merge redundant logic.

48
00:03:21.620 --> 00:03:27.607
OpenTitan flags that optimization risk in its
implementation guidance.

49
00:03:27.875 --> 00:03:31.500
Choose TMR with mask 1 and unauthorized input.

50
00:03:31.500 --> 00:03:33.783
The vote denies and bad is true.

51
00:03:33.783 --> 00:03:38.963
That is both disagreement detection and masked
release in this model.

52
00:03:38.963 --> 00:03:40.017
Now use mask 3.

53
00:03:40.017 --> 00:03:44.671
Majority permits a wrong request even though bad
remains true.

54
00:03:44.671 --> 00:03:49.028
Rejection changes only the local policy.

55
00:03:49.292 --> 00:03:55.179
The eight TMR masks contain four unauthorized
majority outcomes: three masks affect two

56
00:03:55.179 --> 00:03:57.455
replicas and one affects all three.

57
00:03:57.455 --> 00:04:00.867
The four DMR masks contain one unauthorized
outcome.

58
00:04:00.867 --> 00:04:04.811
These executed finite counts are not reliability
estimates.

59
00:04:04.811 --> 00:04:09.599
Shared source and voter forcing run outside those
tables.

60
00:04:09.875 --> 00:04:13.515
Set authorized true and mask zero for both
schemes.

61
00:04:13.515 --> 00:04:14.715
Each must accept.

62
00:04:14.715 --> 00:04:18.235
Then use one replica flip and compare
availability.

63
00:04:18.235 --> 00:04:21.675
Save one source trace with unanimous wrong
copies.

64
00:04:21.675 --> 00:04:27.999
Explain why agreement is evidence of consistency,
while the separate reference establishes the

65
00:04:27.999 --> 00:04:29.721
authorization error.

66
00:04:30.000 --> 00:04:35.612
The fragment specifies TMR combinational behavior
and an independent harness assertion.

67
00:04:35.612 --> 00:04:36.666
It is uncompiled.

68
00:04:36.666 --> 00:04:42.570
A product must evaluate voter hardening, replica
preservation, latency alignment, reset skew and

69
00:04:42.570 --> 00:04:44.046
faulted output leakage.

70
00:04:44.046 --> 00:04:49.521
Our one-bit replicas model permission outputs,
not three complete cryptographic cores.

71
00:04:49.521 --> 00:04:53.077
Lesson 6 follows a shared enable into progress
counters.

72
00:04:53.333 --> 00:04:59.994
One event affects selected replica outputs at
edge 1; DMR width two and TMR width three.

73
00:04:59.994 --> 00:05:03.885
Source and final voter targets run separately.

74
00:05:04.167 --> 00:05:10.573
All four DMR and eight TMR masks ran with
source/voter witnesses and positive controls.

75
00:05:10.573 --> 00:05:13.859
No RTL or physical independence test ran.

76
00:05:14.125 --> 00:05:18.812
One-bit replicas omit complete datapaths,
temporal alignment and leakage.

77
00:05:18.812 --> 00:05:21.371
Rejection can block authorized work.