dOSEK: the design and implementation of a dependability-oriented static embedded kernel

Abstract

Abstract-Because of shrinking structure sizes and operating voltages, computing hardware exhibits an increasing susceptibility against transient hardware faults: Issues previously only known from avionics systems, such as bit flips caused by cosmic radiation, nowadays also affect automotive and other cost-sensitive "ground-level" control systems. For such cost-sensitive systems, many software-based measures have been suggested to harden applications against transient effects. However, all these measures assume that the underlying operating system works reliably in all cases. We present software-based concepts for constructing an operating system that provides a reliable computing base even on unreliable hardware. Our design is based on two pillars: First, strict fault avoidance by static tailoring and elimination of susceptible indirections. Second, reliable fault detection by finegrained arithmetic encoding of the complete kernel execution path. Compared to an industry-grade off-the-shelf RTOS, our resulting dOSEK kernel thereby achieves a robustness improvement by four orders of magnitude. Our results are based on extensive fault-injection campaigns that cover the entire space of single-bit faults in random-access memory and registers.

ASTEROID and the Replica-Aware Co-scheduling for Mixed-Criticality

“…This chapter focuses on the system-level timing aspect of errors affecting the applications. We assume thereby the absence of failures in critical components [13,32], such as the OS/hypervisor, the replica manager/voter (e.g., Romain), and interconnect (e.g., NoC), which can be protected as in [23,39]. The Worst-Case Response Time (WCRT) of replicated execution has been analyzed in [6], where replicas are modeled as fork-join tasks in a system implementing Partitioned SPP.…”

Providing Integrity in Real-Time Networks-on-Chip

“…Although non-negligible, the observed performance overheads are low in comparison with other software and hardware-based fault-tolerance approaches for safety-critical real-time systems [12], [51]. Evaluating only timing can be a pitfall since the cost of the approach might be hidden.…”

A Simplex Architecture for Intelligent and Safe Unmanned Aerial Vehicles

“…The technology treads to develop efficient and high-performance processors shrinking dimensions and operating voltage, and increased frequency and density have dramatically increased the possibilities of SEUs [15], which could result in unexpected failures in the system [23,36] There has been a large body of research in the control systems community regarding the design of fault tolerant control of UAV systems [34]. While these fault tolerant controllers are designed to handle structural damage, actuator and sensor failures, they typically do not handle system-level failure such as on-board computing platform malfunction, which prevents execution of the control algorithms in the first place.…”

“…C'Mon focuses on detecting OS-level timing faults (e.g., deadline misses due to scheduling) that are caused by SEUs [36]. To guard the OS code and data against SEUs, dOSEK proposed to use a special encoding in storing OS code and data, which enables detection and recovery from the SEUs [23]. However, its software-based approach comes at a significant performance penalty.…”