Refine
Year of publication
- 2019 (4) (remove)
Document Type
Language
- English (4)
Has Fulltext
- no (4)
Is part of the Bibliography
- no (4)
Institute
Begutachtungsstatus
- peer-reviewed (3)
- begutachtet (1)
New computing-intensive applications such as assisted or highly automated driving are rapidly expanding the domain of safety-critical embedded systems, driven by the vision of the driverless car. This development makes it necessary to use high performance multi-core systems which are commercially available and provide more parallelism in terms of redundant execution units, however, at the cost of being less reliable. With the continuous down-scaling of semiconductor technology, computing hardware exhibits an increasing vulnerability against random hardware faults. Since these high-performance controller provide less or no hardware redundancy to ensure a safe execution of the application, software-only fault tolerance approaches are under current investigation. Our Scalable Software Support for Dependable Embedded Systems (S3DES) approach achieves fault tolerance by utilizing software-based triple modular redundancy for computational and optimized arithmetic encoded voter processes to ensure fault detection and error handling on application level. In S3DES voters are replicated to allow the compensation of voting failures. However, new challenges with regard to error propagation and multiple voting result outputs are introduced by this extension. We describe how mutual voter monitoring and threshold value checks could be used to establish a hierarchy among the replicated voters without re-introducing a reliability bottleneck in the sense of a single point of failure and resolve the aforementioned challenges.
Among the available dependability assessment techniques, fault injection (FI) is widely adopted and strongly recommended by safety standards for the validation that functional and technical safety mechanisms are implemented correctly and effectively. The main challenge in fault injection assessments is the increasing complexity of system-on-chips as well as the increasing size of memory, which leads to enormous efforts to test every possible fault introduced to the system. Therefore, a number of publicly available fault injection frameworks utilize fault space pruning techniques to reduce the overall fault space and consequently the overall experiment duration. Most of the fault space pruning techniques mainly discuss the reduction of the number of data errors which have to be injected into registers and memory locations. However, control flow errors represent a further domain of possible errors on the application level. Usually for the evaluation of effectiveness of fault tolerance mechanisms against data errors, a single fault assumption at microarchitectural level (e.g. bit-flips) is assumed. In most cases, this assumption is equivalently applied to the program counter to investigate possible control flow errors. Due to this approach, the error space is consciously or unconsciously reduced to the possible erroneous jump targets that can be reached by a specific set of bit-flips in the program counter at a specified time during the program execution. This approach is considered valid regarding the corresponding fault assumption, but leads to negative effects on the significance of the injection and the resulting effectiveness of the tested fault tolerance mechanism. In this paper, we discuss different strategies for the analysis and injection of control flow errors and the resulting differences by considering the single fault assumption at microarchitectural and application level.
Scalable Software Support for Dependable Embedded Systems (S3DES) achieves fault tolerance by utilizing spatial software-based triple modular redundancy for computational and voter processes on application level. Due to the parallel execution of the replicas on distinct CPU cores it makes a step towards software-based fault tolerance against transient and permanent random hardware errors. Additionally, the compliance with real-time requirements in terms of response time is enhanced compared to similar approaches. The replicated voters, the introduced mutual voter monitoring and the optimized arithmetic encoding allow the detection and compensation of voter failures without the utilization of backward recovery. Fault injection experiments on real hardware reveal that S3DES can detect and mask all injected data and program flow errors under a single fault assumption, whereas an uncoded voting scheme yields approx. 12% silent data corruptions in a similar experiment.
In fault tolerant systems, applications are replicated and executed to enable error detection and recovery. If one replica application fails, another is able to take its place and provide the correct results. This concept can benefit from parallel execution on separate execution units. The rise of multicore platforms supports the development of parallel software, by providing the adequate hardware. However, this raises challenges regarding the synchronization of the redundant strings of execution. Replica determinism means that given the same input, identical programs provide the same output. To ensure replica determinism, requirements regarding the synchronization can be split in two domains: data and time. This paper examines the state of the art of synchronization techniques for parallel replicated execution in the context of fault tolerant systems. We analyze the requirements regarding synchronization within the time and data domain and compare different concepts of hardware (multicore, multiprocessor and multi-PCB) and software (processes, threads).