A Practitioner's Guide to Software-Based Soft-Error Mitigation Using AN-Codes

Hoffmann, Martin; Ulbrich, Peter; Dietrich, Christian; Schirmeier, Horst; Lohmann, Daniel; Schröder-Preikschat, Wolfgang

doi:10.1109/hase.2014.14

Cited by 17 publications

(13 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Fact is that "realistic" fault models are still a big topic of research, rarely available, and depend to a high degree on the (often oblique) internals of the hardware architecture. However, our chosen implementation measures, especially ANB-Codes, have shown to work also well in case of multi-bit faults [15]. Also we do not see how our design measures, especially avoidance of indirections, could potentially cause more harm than good with other fault models.…”

Section: A Threats To Validitymentioning

confidence: 84%

“…Here, we concentrate -in contrast to others [4], [20], [33] -on reliable fault detection and fault containment within the kernel execution path (Section V). We employ arithmetic encoding [12] to realize self-contained data and control-flow error detection, a technique we have previously applied to harden the voter in CoRed TMR systems [15], [34]. In this paper, we use it to harden a complete RTOS kernel.…”

Section: Overview and Contributionsmentioning

confidence: 99%

“…However, the overhead in time and space also increases the amount of alive kernel state (i.e., the "attack surface" for transient faults), so that the number of SDCs can actually increase. Implementation glitches that manifest only on compiler-or ISA-level can easily lead to loopholes for transient faults in algorithms that we considered as robust [15]. So the third rule of fault-avoiding operating-system development is: Assess the actual impact of any dependability measure early and often.…”

Section: A General Considerationsmentioning

confidence: 99%

“…However, such a generic implementation would induce an immense overhead in terms of code and run time. Instead, we realized a distinct operation tailored to the specific demands of the scheduling algorithm, similar to our proven concept of the Combined Redundancy (CoRed) voter [15], [34].…”

Section: ) Encoded Schedulermentioning

confidence: 99%

“…Yet, these generic realizations are not practicable for realizing a RCB -not only due their immense run time overhead of a factor of 10 3 up to 10 5 , but also due to the specific nature of low-level system software. Thus, following our proven CoRed concept [15], [34], we concentrate the encoded execution to the minimal necessary points, to keep the overhead on a bearable level.…”

Section: Related Workmentioning

confidence: 99%

See 4 more Smart Citations

dOSEK: the design and implementation of a dependability-oriented static embedded kernel

Hoffmann

Lukas

Dietrich

et al. 2015

21st IEEE Real-Time and Embedded Technology and Applications Symposium

Self Cite

View full text Add to dashboard Cite

Abstract-Because of shrinking structure sizes and operating voltages, computing hardware exhibits an increasing susceptibility against transient hardware faults: Issues previously only known from avionics systems, such as bit flips caused by cosmic radiation, nowadays also affect automotive and other cost-sensitive "ground-level" control systems. For such cost-sensitive systems, many software-based measures have been suggested to harden applications against transient effects. However, all these measures assume that the underlying operating system works reliably in all cases. We present software-based concepts for constructing an operating system that provides a reliable computing base even on unreliable hardware. Our design is based on two pillars: First, strict fault avoidance by static tailoring and elimination of susceptible indirections. Second, reliable fault detection by finegrained arithmetic encoding of the complete kernel execution path. Compared to an industry-grade off-the-shelf RTOS, our resulting dOSEK kernel thereby achieves a robustness improvement by four orders of magnitude. Our results are based on extensive fault-injection campaigns that cover the entire space of single-bit faults in random-access memory and registers.

show abstract

Section: A Threats To Validitymentioning

confidence: 84%

Section: Overview and Contributionsmentioning

confidence: 99%

Section: A General Considerationsmentioning

confidence: 99%

Section: ) Encoded Schedulermentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

dOSEK: the design and implementation of a dependability-oriented static embedded kernel

Hoffmann

Lukas

Dietrich

et al. 2015

21st IEEE Real-Time and Embedded Technology and Applications Symposium

Self Cite

View full text Add to dashboard Cite

show abstract

Dependability Aspects in Configurable Embedded Operating Systems

Schirmeier

Borchert

Hoffmann

et al. 2020

Dependable Embedded Systems

Self Cite

View full text Add to dashboard Cite

As all conceptual layers in the software stack depend on the operating system (OS) to reliably provide resource-management services and isolation, it can be considered the “reliable computing base” that must be hardened for correct operation under fault models such as transient hardware faults in the memory hierarchy. In this chapter, we approach the problem of system-software hardening in three complementary scenarios. (1) We address the following research question: Where do the general reliability limits of static system-software stacks lie, if designed from scratch with reliability as a first-class design goal? In order to reduce the proverbial “attack surface” as far as possible, we harness static application knowledge from an AUTOSAR-compliant task set, and protect the whole OS kernel with AN-encoding. This static approach yields an extremely reliable software system, but is constrained to specific application domains. (2) We investigate how reliable a dynamic COTS embedded OS can become if hardened with programming-language and compiler-based fault-tolerance techniques. We show that aspect-oriented programming is an appropriate means to encapsulate generic software-implemented hardware fault tolerance mechanisms that can be application-specifically applied to a selection of OS components. (3) We examine how system-software stacks can survive even more adverse fault models like whole-system outages, using emerging persistent memory (PM) technology as a vehicle for state conservation. Our findings include that software transactional memory facilitates maintaining consistent state within PM and allows fast recovery.

show abstract